@cavuno/board 1.28.1 → 1.30.0

package/dist/bin.mjs

@@ -1,11 +1,4 @@
 #!/usr/bin/env node
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 
 // src/skills.ts
 import { readFileSync } from "fs";
@@ -14,26 +7,580 @@ import { fileURLToPath } from "url";
 function packageRoot() {
   return resolve(dirname(fileURLToPath(import.meta.url)), "..");
 }
-function resolveFromPackageRoot(relativePath) {
-  return resolve(packageRoot(), relativePath);
+function resolveFromPackageRoot(relativePath, baseDir) {
+  return resolve(baseDir ?? packageRoot(), relativePath);
 }
-function loadSkillManifest() {
-  const manifestPath = resolveFromPackageRoot("skills/manifest.json");
+function loadSkillManifest(baseDir) {
+  const manifestPath = resolveFromPackageRoot("skills/manifest.json", baseDir);
   return JSON.parse(readFileSync(manifestPath, "utf8"));
 }
-var init_skills = __esm({
-  "src/skills.ts"() {
-    "use strict";
+function loadSkillCorpus(baseDir) {
+  const manifest = loadSkillManifest(baseDir);
+  return {
+    version: manifest.version,
+    skills: manifest.skills.map((skill) => ({
+      ...skill,
+      content: readFileSync(
+        resolveFromPackageRoot(skill.path, baseDir),
+        "utf8"
+      )
+    }))
+  };
+}
+
+// src/doctor/checks.ts
+function record(id, tier) {
+  return (status, detail) => ({
+    id,
+    tier,
+    status,
+    detail
+  });
+}
+var ENV_API_URL = record("env.api-url", 1);
+var ENV_BOARD_KEY = record("env.board-key", 1);
+var PK_RE = /^pk_[0-9a-f]{32}$/;
+function checkEnv(env) {
+  const results = [];
+  if (!env.apiUrl) {
+    results.push(ENV_API_URL("fail", "PUBLIC_CAVUNO_API_URL is not set"));
+  } else {
+    let origin = null;
+    try {
+      origin = new URL(env.apiUrl).origin;
+    } catch {
+      origin = null;
+    }
+    results.push(
+      origin ? ENV_API_URL("pass", origin) : ENV_API_URL(
+        "fail",
+        `PUBLIC_CAVUNO_API_URL is not a valid URL: ${env.apiUrl}`
+      )
+    );
+  }
+  if (!env.boardKey) {
+    results.push(ENV_BOARD_KEY("fail", "PUBLIC_CAVUNO_BOARD is not set"));
+  } else {
+    results.push(
+      PK_RE.test(env.boardKey) ? ENV_BOARD_KEY("pass", "pk_ key") : ENV_BOARD_KEY(
+        "fail",
+        "PUBLIC_CAVUNO_BOARD must be a publishable key (pk_ + 32 hex chars)"
+      )
+    );
+  }
+  return results;
+}
+var JOB_DETAIL_LINK_RE = /href="(\/companies\/[a-z0-9-]+\/jobs\/[a-z0-9-]+)"/i;
+function extractJobDetailLink(html) {
+  return html.match(JOB_DETAIL_LINK_RE)?.[1] ?? null;
+}
+var JSON_LD_RE = /<script[^>]*type="application\/ld\+json"[^>]*>([\s\S]*?)<\/script>/gi;
+function extractJobPostingJsonLd(html) {
+  for (const match of html.matchAll(JSON_LD_RE)) {
+    try {
+      const parsed = JSON.parse(match[1].trim());
+      if (parsed["@type"] === "JobPosting") return parsed;
+    } catch {
+    }
+  }
+  return null;
+}
+var LOC_RE = /<loc>([^<]+)<\/loc>/gi;
+function parseSitemap(xml) {
+  const kind = /<urlset[\s>]/i.test(xml) ? "urlset" : /<sitemapindex[\s>]/i.test(xml) ? "index" : null;
+  if (!kind) return null;
+  return { kind, urls: [...xml.matchAll(LOC_RE)].map((m) => m[1].trim()) };
+}
+function summarize(results) {
+  const passed = results.filter((r) => r.status === "pass").map((r) => r.id);
+  const failed = results.filter((r) => r.status === "fail").map((r) => r.id);
+  const skipped = results.filter((r) => r.status === "skip").map((r) => r.id);
+  return { exitCode: failed.length > 0 ? 1 : 0, passed, failed, skipped };
+}
+
+// src/doctor/probe.ts
+var FETCH_TIMEOUT_MS = 1e4;
+async function probe(fetchImpl, url) {
+  try {
+    const response = await fetchImpl(url, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    return {
+      ok: response.ok,
+      status: response.status,
+      body: await response.text()
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      body: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+// src/doctor/read.ts
+var READ = {
+  home: record("read.home", 2),
+  jobs: record("read.jobs", 2),
+  jsonld: record("read.jsonld", 2),
+  sitemap: record("read.sitemap", 2),
+  robots: record("read.robots", 2)
+};
+function skipReadProbes(reason) {
+  return Object.values(READ).map((make) => make("skip", reason));
+}
+async function probeJobsAndJsonLd(fetchImpl, base) {
+  const jobs = await probe(fetchImpl, `${base}/jobs`);
+  const jobLink = jobs.ok ? extractJobDetailLink(jobs.body) : null;
+  const jobsResult = jobs.ok && jobLink ? READ.jobs("pass", `listing renders with job detail links (${jobLink})`) : READ.jobs(
+    "fail",
+    jobs.ok ? "listing renders but contains no /companies/{c}/jobs/{s} detail links" : `listing HTTP ${jobs.status}`
+  );
+  if (!jobLink) {
+    return [
+      jobsResult,
+      READ.jsonld(
+        "skip",
+        jobs.ok ? "not probed \u2014 the listing rendered no job detail link (see read.jobs failure)" : "not probed \u2014 the /jobs listing itself failed (see read.jobs failure)"
+      )
+    ];
+  }
+  const detail = await probe(fetchImpl, `${base}${jobLink}`);
+  const posting = detail.ok ? extractJobPostingJsonLd(detail.body) : null;
+  return [
+    jobsResult,
+    posting ? READ.jsonld(
+      "pass",
+      `JobPosting JSON-LD present (${String(posting.title ?? "")})`
+    ) : READ.jsonld(
+      "fail",
+      detail.ok ? "job detail page has no parseable JobPosting JSON-LD" : `job detail HTTP ${detail.status}`
+    )
+  ];
+}
+function onFrontend(base, locUrl) {
+  try {
+    const parsed = new URL(locUrl);
+    return `${base}${parsed.pathname}${parsed.search}`;
+  } catch {
+    return locUrl;
+  }
+}
+async function probeSitemap(fetchImpl, base) {
+  const sitemap = await probe(fetchImpl, `${base}/sitemap.xml`);
+  if (!sitemap.ok) {
+    return READ.sitemap("fail", `sitemap.xml HTTP ${sitemap.status}`);
+  }
+  const doc = parseSitemap(sitemap.body);
+  if (!doc || doc.urls.length === 0) {
+    return READ.sitemap(
+      "fail",
+      doc ? "sitemap.xml has no <loc> entries" : "sitemap.xml is not a sitemap"
+    );
+  }
+  let urls = doc.urls;
+  if (doc.kind === "index") {
+    const child = await probe(fetchImpl, onFrontend(base, urls[0]));
+    const childDoc = child.ok ? parseSitemap(child.body) : null;
+    if (!childDoc || childDoc.urls.length === 0) {
+      return READ.sitemap(
+        "fail",
+        `child sitemap ${urls[0]} ${child.ok ? "has no <loc> entries" : `HTTP ${child.status}`}`
+      );
+    }
+    urls = childDoc.urls;
+  }
+  const sampleUrl = onFrontend(base, urls[0]);
+  const sample = await probe(fetchImpl, sampleUrl);
+  return sample.ok ? READ.sitemap("pass", `${urls.length} entries; sample page resolves`) : READ.sitemap("fail", `sitemap page ${sampleUrl} \u2192 HTTP ${sample.status}`);
+}
+async function runReadProbes(fetchImpl, frontendUrl) {
+  const base = frontendUrl.replace(/\/$/, "");
+  const [home, jobsAndJsonLd, sitemap, robots] = await Promise.all([
+    probe(fetchImpl, base),
+    probeJobsAndJsonLd(fetchImpl, base),
+    probeSitemap(fetchImpl, base),
+    probe(fetchImpl, `${base}/robots.txt`)
+  ]);
+  return [
+    home.ok && /<(html|body|div|main)[\s>]/i.test(home.body) ? READ.home("pass", "home renders") : READ.home(
+      "fail",
+      home.ok ? "home returned 200 but no HTML document \u2014 captive portal or empty shell?" : `home HTTP ${home.status}`
+    ),
+    ...jobsAndJsonLd,
+    sitemap,
+    robots.ok && /user-agent\s*:/i.test(robots.body) ? READ.robots("pass", "present") : READ.robots(
+      "fail",
+      robots.ok ? "robots.txt returned 200 but has no User-agent directive" : `robots.txt HTTP ${robots.status}`
+    )
+  ];
+}
+
+// src/doctor/writes.ts
+var WRITE = {
+  board: record("write.board", 3),
+  register: record("write.register", 3),
+  login: record("write.login", 3),
+  email: record("write.email", 3),
+  apply: record("write.apply", 3),
+  alert: record("write.alert", 3)
+};
+var DEPENDENT_CHECKS = [
+  WRITE.register,
+  WRITE.login,
+  WRITE.email,
+  WRITE.apply,
+  WRITE.alert
+];
+function skipWriteProbes(reason) {
+  return Object.values(WRITE).map((make) => make("skip", reason));
+}
+var FETCH_TIMEOUT_MS2 = 1e4;
+var RESEND_API_BASE = "https://api.resend.com";
+async function request(fetchImpl, url, init) {
+  try {
+    const response = await fetchImpl(url, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2),
+      ...init
+    });
+    let json = null;
+    try {
+      json = await response.json();
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, json };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      json: { error: error instanceof Error ? error.message : String(error) }
+    };
+  }
+}
+function post(fetchImpl, url, body, bearer) {
+  return request(fetchImpl, url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      ...bearer ? { authorization: `Bearer ${bearer}` } : {}
+    },
+    body: JSON.stringify(body)
+  });
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function observeVerificationEmail(fetchImpl, apiKey, recipient, pollMs, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const subjectMarker = `[To: ${recipient}]`;
+  do {
+    const list = await request(
+      fetchImpl,
+      `${RESEND_API_BASE}/emails?limit=20`,
+      {
+        headers: { authorization: `Bearer ${apiKey}` }
+      }
+    );
+    if (!list.ok) {
+      return WRITE.email(
+        "fail",
+        `Resend list returned HTTP ${list.status} \u2014 wrong RESEND_API_KEY?`
+      );
+    }
+    const items = list.json?.data ?? [];
+    const match = items.find(
+      (item) => item.subject?.includes(subjectMarker) || item.to?.includes(recipient)
+    );
+    if (match) {
+      return WRITE.email(
+        "pass",
+        `verification send observed in Resend for ${recipient}`
+      );
+    }
+    await sleep(pollMs);
+  } while (Date.now() < deadline);
+  return WRITE.email(
+    "fail",
+    `no verification send for ${recipient} appeared in Resend within ${timeoutMs}ms`
+  );
+}
+async function runWriteProbes(options) {
+  const { fetchImpl } = options;
+  const origin = new URL(options.env.apiUrl).origin;
+  const base = `${origin}/v1/boards/${encodeURIComponent(options.env.boardKey)}`;
+  const nonce = options.nonce ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+  const email = `doctor+${nonce}@cavuno.com`;
+  const password = `doctor-probe-${nonce}-A1!`;
+  let context = options.boardContext ?? null;
+  if (context === null) {
+    const r = await request(fetchImpl, base);
+    if (!r.ok) {
+      return [
+        WRITE.board("fail", `board context did not resolve (HTTP ${r.status})`),
+        ...DEPENDENT_CHECKS.map(
+          (make) => make("skip", "not run \u2014 the write gate failed (see write.board)")
+        )
+      ];
+    }
+    context = r.json ?? {};
+  }
+  if (context.sandbox !== true) {
+    return [
+      WRITE.board(
+        "fail",
+        "refusing write probes: this board is not the platform sandbox (`sandbox` is not true) \u2014 point PUBLIC_CAVUNO_BOARD at the sandbox pk_"
+      ),
+      ...DEPENDENT_CHECKS.map(
+        (make) => make("skip", "not run \u2014 the write gate failed (see write.board)")
+      )
+    ];
+  }
+  const results = [
+    WRITE.board("pass", "board is the platform sandbox")
+  ];
+  const registered = await post(fetchImpl, `${base}/auth/register`, {
+    role: "candidate",
+    method: "emailpass",
+    email,
+    password,
+    displayName: "Doctor Probe"
+  });
+  const sessionOk = (r) => r.ok && typeof r.json?.accessToken === "string";
+  results.push(
+    sessionOk(registered) ? WRITE.register("pass", `candidate registered (${email})`) : WRITE.register(
+      "fail",
+      `register returned HTTP ${registered.status}` + (registered.status === 429 ? " \u2014 rate-limited: register allows 5 signups / 15 min per IP; wait before rerunning" : "")
+    )
+  );
+  let accessToken = null;
+  if (sessionOk(registered)) {
+    const login = await post(fetchImpl, `${base}/auth/login`, {
+      email,
+      password
+    });
+    if (sessionOk(login)) {
+      accessToken = login.json.accessToken;
+      results.push(WRITE.login("pass", "emailpass login returns a session"));
+    } else {
+      results.push(WRITE.login("fail", `login returned HTTP ${login.status}`));
+    }
+  } else {
+    results.push(WRITE.login("skip", "not run \u2014 register failed"));
+  }
+  if (!sessionOk(registered)) {
+    results.push(WRITE.email("skip", "not run \u2014 register failed"));
+  } else if (!options.resendApiKey) {
+    results.push(
+      WRITE.email(
+        "skip",
+        "RESEND_API_KEY not set \u2014 the verification send was NOT verified (platform-operator check)"
+      )
+    );
+  } else {
+    results.push(
+      await observeVerificationEmail(
+        fetchImpl,
+        options.resendApiKey,
+        email,
+        options.emailPollMs ?? 2e3,
+        options.emailTimeoutMs ?? 3e4
+      )
+    );
+  }
+  if (!accessToken) {
+    results.push(WRITE.apply("skip", "not run \u2014 no session (see above)"));
+  } else {
+    const listing = await request(fetchImpl, `${base}/jobs?limit=1`);
+    const card = listing.json?.data?.[0];
+    if (!listing.ok || !card?.slug) {
+      results.push(
+        WRITE.apply(
+          "fail",
+          listing.ok ? "the board has no jobs to apply to \u2014 is the sandbox seeded?" : `jobs listing returned HTTP ${listing.status}`
+        )
+      );
+    } else {
+      const applied = await post(
+        fetchImpl,
+        `${base}/jobs/${encodeURIComponent(card.slug)}/apply`,
+        {},
+        accessToken
+      );
+      results.push(
+        applied.ok && typeof applied.json?.id === "string" ? WRITE.apply("pass", `applied to ${card.slug}`) : WRITE.apply("fail", `apply returned HTTP ${applied.status}`)
+      );
+    }
+  }
+  const alert = await post(fetchImpl, `${base}/job-alerts`, {
+    email,
+    consent: true
+  });
+  results.push(
+    alert.ok ? WRITE.alert("pass", "job-alert subscription accepted") : WRITE.alert("fail", `job-alerts returned HTTP ${alert.status}`)
+  );
+  return results;
+}
+
+// src/doctor/run.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join } from "path";
+var STATIC_API = record("static.api", 1);
+var STATIC_BOARD = record("static.board", 1);
+var STATIC_SKILLS = record("static.skills", 1);
+async function checkApiReachable(fetchImpl, apiUrl) {
+  let origin;
+  try {
+    origin = new URL(apiUrl).origin;
+  } catch {
+    return null;
+  }
+  const spec = await probe(fetchImpl, `${origin}/api/v1/openapi.json`);
+  const result = spec.ok ? spec : await probe(fetchImpl, `${origin}/v1/openapi.json`);
+  if (!result.ok) {
+    return STATIC_API(
+      "fail",
+      `OpenAPI spec unreachable (HTTP ${result.status})`
+    );
   }
-});
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed.openapi !== "string") throw new Error("not a spec");
+  } catch {
+    return STATIC_API(
+      "fail",
+      "endpoint returned 200 but not an OpenAPI document \u2014 proxy or captive portal in the way?"
+    );
+  }
+  return STATIC_API("pass", "OpenAPI spec reachable");
+}
+async function checkBoardResolves(fetchImpl, env) {
+  const origin = new URL(env.apiUrl).origin;
+  const result = await probe(
+    fetchImpl,
+    `${origin}/v1/boards/${encodeURIComponent(env.boardKey)}`
+  );
+  if (!result.ok) {
+    return {
+      result: STATIC_BOARD(
+        "fail",
+        `board did not resolve for this key (HTTP ${result.status}) \u2014 revoked or wrong key?`
+      ),
+      context: null
+    };
+  }
+  let parsed = null;
+  try {
+    parsed = JSON.parse(result.body);
+    if (typeof parsed !== "object" || parsed === null) throw new Error("shape");
+  } catch {
+    return {
+      result: STATIC_BOARD(
+        "fail",
+        "board endpoint returned 200 but not JSON \u2014 proxy or captive portal in the way?"
+      ),
+      context: null
+    };
+  }
+  return {
+    result: STATIC_BOARD("pass", "publishable key resolves the board"),
+    context: parsed
+  };
+}
+var SKILL_ROOTS = [".claude/skills", ".agents/skills"];
+function checkSkillsFreshness(projectRoot) {
+  const roots = SKILL_ROOTS.map((root) => join(projectRoot, root)).filter(
+    (root) => existsSync(root)
+  );
+  if (roots.length === 0) {
+    return STATIC_SKILLS(
+      "skip",
+      "no .claude/skills or .agents/skills directory \u2014 run `npx @cavuno/board setup` to install agent skills"
+    );
+  }
+  const corpus = loadSkillCorpus();
+  const stale = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  for (const root of roots) {
+    for (const skill of corpus.skills) {
+      const copied = join(root, skill.name, "SKILL.md");
+      if (!existsSync(copied)) continue;
+      seen.add(skill.name);
+      if (readFileSync2(copied, "utf8") !== skill.content) {
+        stale.add(skill.name);
+      }
+    }
+  }
+  const found = seen.size;
+  if (found === 0) {
+    return STATIC_SKILLS(
+      "skip",
+      "no cavuno-board-* skills installed \u2014 run `npx @cavuno/board setup`"
+    );
+  }
+  return stale.size === 0 ? STATIC_SKILLS(
+    "pass",
+    `${found} installed skills match v${corpus.version}`
+  ) : STATIC_SKILLS(
+    "fail",
+    `stale skills (re-run \`npx @cavuno/board setup\`): ${[...stale].join(", ")}`
+  );
+}
+async function runDoctor(options) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const results = [];
+  const envResults = checkEnv(options.env);
+  results.push(...envResults);
+  const envOk = envResults.every((r) => r.status === "pass");
+  if (options.env.apiUrl) {
+    const api = await checkApiReachable(fetchImpl, options.env.apiUrl);
+    results.push(
+      api ?? STATIC_API("skip", "API URL malformed \u2014 fix env.api-url first")
+    );
+  } else {
+    results.push(STATIC_API("skip", "PUBLIC_CAVUNO_API_URL not set"));
+  }
+  let boardContext = null;
+  if (envOk) {
+    const resolved = await checkBoardResolves(fetchImpl, options.env);
+    boardContext = resolved.context;
+    results.push(resolved.result);
+  } else {
+    results.push(STATIC_BOARD("skip", "env checks failed \u2014 fix them first"));
+  }
+  results.push(checkSkillsFreshness(options.projectRoot ?? process.cwd()));
+  results.push(
+    ...options.frontendUrl ? await runReadProbes(fetchImpl, options.frontendUrl) : skipReadProbes("no --frontend <url> given")
+  );
+  if (!options.sandbox) {
+    results.push(
+      ...skipWriteProbes(
+        "write probes not enabled \u2014 run with --sandbox against the platform sandbox"
+      )
+    );
+  } else if (!envOk) {
+    results.push(...skipWriteProbes("env checks failed \u2014 fix them first"));
+  } else {
+    results.push(
+      ...await runWriteProbes({
+        env: options.env,
+        fetchImpl,
+        resendApiKey: options.resendApiKey,
+        nonce: options.writeProbeNonce,
+        boardContext
+      })
+    );
+  }
+  return { results, summary: summarize(results) };
+}
 
 // src/setup/run.ts
-import { cpSync, existsSync, mkdirSync, readFileSync as readFileSync2 } from "fs";
+import { cpSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname2, resolve as resolve2 } from "path";
 function detectFramework(cwd) {
   const pkgPath = resolve2(cwd, "package.json");
-  if (!existsSync(pkgPath)) return null;
-  const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+  if (!existsSync2(pkgPath)) return null;
+  const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
   const deps = { ...pkg.dependencies, ...pkg.devDependencies };
   if (deps["@tanstack/react-start"]) return "tanstack-start";
   return null;
@@ -48,7 +595,7 @@ function runSetup(cwd = process.cwd()) {
     resolve2(cwd, ".claude", "skills"),
     resolve2(cwd, ".agents", "skills")
   ];
-  const existing = roots.filter((root) => existsSync(root));
+  const existing = roots.filter((root) => existsSync2(root));
   const targetDirs = existing.length > 0 ? existing : [roots[0]];
   const copied = [];
   for (const targetDir of targetDirs) {
@@ -63,45 +610,76 @@ function runSetup(cwd = process.cwd()) {
   }
   return { version: manifest.version, framework, targetDirs, copied };
 }
-var init_run = __esm({
-  "src/setup/run.ts"() {
-    "use strict";
-    init_skills();
-  }
-});
 
 // src/bin.ts
-var require_bin = __commonJS({
-  "src/bin.ts"() {
-    init_run();
-    function main() {
-      if (process.argv[2] !== "setup") {
-        console.error("Usage: cavuno-board setup");
-        process.exit(1);
-      }
-      const result = runSetup();
-      console.log(`
-@cavuno/board setup \u2014 v${result.version}`);
-      console.log(
-        `Detected framework: ${result.framework ?? "none (core skills only)"}`
-      );
-      console.log(
-        `Copied ${result.copied.length} skills \u2192 ${result.targetDirs.join(", ")}`
-      );
-      for (const name of result.copied) console.log(`  - ${name}`);
-      console.log("\nNext steps:");
-      console.log("  1. Set your environment variables:");
-      console.log("       PUBLIC_CAVUNO_API_URL=https://api.cavuno.com");
-      console.log(
-        "       PUBLIC_CAVUNO_BOARD=pk_...   # your board publishable key"
-      );
-      console.log('  2. Ask your coding agent: "set up my Cavuno board".');
-      console.log("     It reads the cavuno-board-setup skill first.");
-      console.log(
-        "\n  Re-run `npx @cavuno/board setup` after upgrading to refresh skills."
-      );
-    }
-    main();
+async function doctor(argv) {
+  const frontendFlag = argv.indexOf("--frontend");
+  const frontendUrl = frontendFlag >= 0 ? argv[frontendFlag + 1] : void 0;
+  const { results, summary } = await runDoctor({
+    env: {
+      apiUrl: process.env.PUBLIC_CAVUNO_API_URL,
+      boardKey: process.env.PUBLIC_CAVUNO_BOARD
+    },
+    frontendUrl,
+    // Tier-3 write probes: opt-in via --sandbox, and refused server-side
+    // unless the resolved board is platform-marked test (writes.ts gate).
+    sandbox: argv.includes("--sandbox"),
+    resendApiKey: process.env.RESEND_API_KEY
+  });
+  console.log("\n@cavuno/board doctor");
+  for (const result of results) {
+    const mark = result.status === "pass" ? "\u2713" : result.status === "fail" ? "\u2717" : "\u2212";
+    console.log(
+      `  ${mark} [tier ${result.tier}] ${result.id} \u2014 ${result.detail}`
+    );
+  }
+  console.log(
+    `
+${summary.passed.length} passed, ${summary.failed.length} failed, ${summary.skipped.length} skipped`
+  );
+  if (summary.skipped.length > 0) {
+    console.log(`  Skipped (NOT verified): ${summary.skipped.join(", ")}`);
+  }
+  if (!frontendUrl) {
+    console.log(
+      "  Pass --frontend <url> to run the read probes against your board frontend."
+    );
+  }
+  process.exit(summary.exitCode);
+}
+function main() {
+  const verb = process.argv[2];
+  if (verb === "doctor") {
+    doctor(process.argv.slice(3)).catch((error) => {
+      console.error("doctor crashed:", error);
+      process.exit(1);
+    });
+    return;
+  }
+  if (verb !== "setup") {
+    console.error("Usage: cavuno-board <setup|doctor>");
+    process.exit(1);
   }
-});
-export default require_bin();
+  const result = runSetup();
+  console.log(`
+@cavuno/board setup \u2014 v${result.version}`);
+  console.log(
+    `Detected framework: ${result.framework ?? "none (core skills only)"}`
+  );
+  console.log(
+    `Copied ${result.copied.length} skills \u2192 ${result.targetDirs.join(", ")}`
+  );
+  for (const name of result.copied) console.log(`  - ${name}`);
+  console.log("\nNext steps:");
+  console.log("  1. Set your environment variables:");
+  console.log("       PUBLIC_CAVUNO_API_URL=https://api.cavuno.com");
+  console.log(
+    "       PUBLIC_CAVUNO_BOARD=pk_...   # your board publishable key"
+  );
+  console.log('  2. Ask your coding agent: "set up my Cavuno board".');
+  console.log("     It reads the cavuno-board-setup skill first.");
+  console.log(
+    "\n  Re-run `npx @cavuno/board setup` after upgrading to refresh skills."
+  );
+}
+main();

package/dist/filters.d.mts

@@ -1,4 +1,4 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-DK5mPBgq.mjs';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-lzeoVGY6.mjs';
 
 declare const REMOTE_OPTIONS: readonly RemoteOption[];
 /**

package/dist/filters.d.ts

@@ -1,4 +1,4 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-DK5mPBgq.js';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-lzeoVGY6.js';
 
 declare const REMOTE_OPTIONS: readonly RemoteOption[];
 /**

package/dist/format.d.mts

@@ -1,4 +1,4 @@
-import { P as PublicJob, a as PublicJobCard } from './jobs-DK5mPBgq.mjs';
+import { P as PublicJob, a as PublicJobCard } from './jobs-lzeoVGY6.mjs';
 
 /**
  * Date display helpers in the board language (required leading parameter,

package/dist/format.d.ts

@@ -1,4 +1,4 @@
-import { P as PublicJob, a as PublicJobCard } from './jobs-DK5mPBgq.js';
+import { P as PublicJob, a as PublicJobCard } from './jobs-lzeoVGY6.js';
 
 /**
  * Date display helpers in the board language (required leading parameter,

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-DK5mPBgq.mjs';
-export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-DK5mPBgq.mjs';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-CrJsaZe6.mjs';
-export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-CrJsaZe6.mjs';
+import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-lzeoVGY6.mjs';
+export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-lzeoVGY6.mjs';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-DpH5CxdM.mjs';
+export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-DpH5CxdM.mjs';
 
 type Awaitable<T> = T | Promise<T>;
 /**
@@ -203,7 +203,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.28.1";
+declare const SDK_VERSION = "1.30.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -654,6 +654,7 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
         logoUrl: string | null;
         primaryDomain: string | null;
         showCavunoBranding: boolean;
+        sandbox: boolean;
         features: {
             jobAlerts: boolean;
             candidates: boolean;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-DK5mPBgq.js';
-export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-DK5mPBgq.js';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-CXt6Vkrp.js';
-export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-CXt6Vkrp.js';
+import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-lzeoVGY6.js';
+export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-lzeoVGY6.js';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-Cy3MhZov.js';
+export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-Cy3MhZov.js';
 
 type Awaitable<T> = T | Promise<T>;
 /**
@@ -203,7 +203,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.28.1";
+declare const SDK_VERSION = "1.30.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -654,6 +654,7 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
         logoUrl: string | null;
         primaryDomain: string | null;
         showCavunoBranding: boolean;
+        sandbox: boolean;
         features: {
             jobAlerts: boolean;
             candidates: boolean;

package/dist/index.js

@@ -310,7 +310,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.28.1";
+var SDK_VERSION = "1.30.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/index.mjs

@@ -265,7 +265,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.28.1";
+var SDK_VERSION = "1.30.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/{jobs-DK5mPBgq.d.mts → jobs-lzeoVGY6.d.mts}

@@ -2382,6 +2382,8 @@ interface components {
             primaryDomain: string | null;
             /** @description Whitelabel toggle (default `true`). Render the "Powered by Cavuno" badge unless `false`. */
             showCavunoBranding: boolean;
+            /** @description True ONLY for the platform sandbox fixture tenant — the safe target for write probes (doctor tier 3); data is reset nightly. Every real tenant board is `false`. */
+            sandbox: boolean;
             features: {
                 jobAlerts: boolean;
                 candidates: boolean;

package/dist/{jobs-DK5mPBgq.d.ts → jobs-lzeoVGY6.d.ts}

@@ -2382,6 +2382,8 @@ interface components {
             primaryDomain: string | null;
             /** @description Whitelabel toggle (default `true`). Render the "Powered by Cavuno" badge unless `false`. */
             showCavunoBranding: boolean;
+            /** @description True ONLY for the platform sandbox fixture tenant — the safe target for write probes (doctor tier 3); data is reset nightly. Every real tenant board is `false`. */
+            sandbox: boolean;
             features: {
                 jobAlerts: boolean;
                 candidates: boolean;

package/dist/{salaries-CXt6Vkrp.d.ts → salaries-Cy3MhZov.d.ts}

@@ -1,4 +1,4 @@
-import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-DK5mPBgq.js';
+import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-lzeoVGY6.js';
 
 type PublicBoard = Schemas['PublicBoardContext'];
 type PublicBoardFeatures = PublicBoard['features'];

package/dist/{salaries-CrJsaZe6.d.mts → salaries-DpH5CxdM.d.mts}

@@ -1,4 +1,4 @@
-import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-DK5mPBgq.mjs';
+import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-lzeoVGY6.mjs';
 
 type PublicBoard = Schemas['PublicBoardContext'];
 type PublicBoardFeatures = PublicBoard['features'];

package/dist/seo.d.mts

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CrJsaZe6.mjs';
-import { P as PublicJob } from './jobs-DK5mPBgq.mjs';
+import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-DpH5CxdM.mjs';
+import { P as PublicJob } from './jobs-lzeoVGY6.mjs';
 
 /**
  * Google for Jobs `JobPosting` structured data on the `@cavuno/board` wire

package/dist/seo.d.ts

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CXt6Vkrp.js';
-import { P as PublicJob } from './jobs-DK5mPBgq.js';
+import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-Cy3MhZov.js';
+import { P as PublicJob } from './jobs-lzeoVGY6.js';
 
 /**
  * Google for Jobs `JobPosting` structured data on the `@cavuno/board` wire

package/dist/server.d.mts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.mjs';
-import './jobs-DK5mPBgq.mjs';
-import './salaries-CrJsaZe6.mjs';
+import './jobs-lzeoVGY6.mjs';
+import './salaries-DpH5CxdM.mjs';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.js';
-import './jobs-DK5mPBgq.js';
-import './salaries-CXt6Vkrp.js';
+import './jobs-lzeoVGY6.js';
+import './salaries-Cy3MhZov.js';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/sitemap.d.mts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.mjs';
-import './jobs-DK5mPBgq.mjs';
-import './salaries-CrJsaZe6.mjs';
+import './jobs-lzeoVGY6.mjs';
+import './salaries-DpH5CxdM.mjs';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/sitemap.d.ts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.js';
-import './jobs-DK5mPBgq.js';
-import './salaries-CXt6Vkrp.js';
+import './jobs-lzeoVGY6.js';
+import './salaries-Cy3MhZov.js';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/skills-types.d.mts

@@ -0,0 +1,20 @@
+/**
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
+ */
+interface SkillManifestEntry {
+    name: string;
+    description: string;
+    /** Path to the SKILL.md, relative to the package root. */
+    path: string;
+    /** Framework slug for flavor skills; `null` for framework-agnostic core skills. */
+    framework: string | null;
+    category: 'core' | 'flavor';
+}
+interface SkillManifest {
+    version: string;
+    skills: SkillManifestEntry[];
+}
+
+export type { SkillManifest, SkillManifestEntry };

package/dist/skills-types.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
+ */
+interface SkillManifestEntry {
+    name: string;
+    description: string;
+    /** Path to the SKILL.md, relative to the package root. */
+    path: string;
+    /** Framework slug for flavor skills; `null` for framework-agnostic core skills. */
+    framework: string | null;
+    category: 'core' | 'flavor';
+}
+interface SkillManifest {
+    version: string;
+    skills: SkillManifestEntry[];
+}
+
+export type { SkillManifest, SkillManifestEntry };

package/dist/skills-types.js

@@ -0,0 +1,18 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/skills/types.ts
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);

package/dist/skills.d.mts

@@ -1,9 +1,7 @@
 /**
- * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
- * the installed package) — kept out of the isomorphic core and exposed via the
- * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
- * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
- * stay fed from one source.
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
  */
 interface SkillManifestEntry {
     name: string;
@@ -18,6 +16,15 @@ interface SkillManifest {
     version: string;
     skills: SkillManifestEntry[];
 }
+
+/**
+ * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
+ * the installed package) — kept out of the isomorphic core and exposed via the
+ * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
+ * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
+ * stay fed from one source.
+ */
+
 interface LoadedSkill extends SkillManifestEntry {
     content: string;
 }
@@ -26,13 +33,13 @@ interface SkillCorpus {
     skills: LoadedSkill[];
 }
 /** Resolve a package-root-relative path (e.g. a manifest `path`) to an absolute path. */
-declare function resolveFromPackageRoot(relativePath: string): string;
-declare function loadSkillManifest(): SkillManifest;
+declare function resolveFromPackageRoot(relativePath: string, baseDir?: string): string;
+declare function loadSkillManifest(baseDir?: string): SkillManifest;
 /**
  * Load the full skill corpus — manifest metadata plus each skill's markdown
  * `content`. The sidekick injects `content` into its agent context; an external
  * Claude Code instead receives the files copied by the setup command.
  */
-declare function loadSkillCorpus(): SkillCorpus;
+declare function loadSkillCorpus(baseDir?: string): SkillCorpus;
 
 export { type LoadedSkill, type SkillCorpus, type SkillManifest, type SkillManifestEntry, loadSkillCorpus, loadSkillManifest, resolveFromPackageRoot };

package/dist/skills.d.ts

@@ -1,9 +1,7 @@
 /**
- * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
- * the installed package) — kept out of the isomorphic core and exposed via the
- * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
- * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
- * stay fed from one source.
+ * Skill-manifest types, split from `skills.ts` so non-Node consumers (the
+ * remote-mcp worker types its `/dev` toolset against the wire shape) can
+ * import them without dragging the Node fs loader into their program.
  */
 interface SkillManifestEntry {
     name: string;
@@ -18,6 +16,15 @@ interface SkillManifest {
     version: string;
     skills: SkillManifestEntry[];
 }
+
+/**
+ * Skill-corpus loader. Node-only (reads the shipped `skills/` directory from
+ * the installed package) — kept out of the isomorphic core and exposed via the
+ * `@cavuno/board/skills` subpath export. Both `npx @cavuno/board setup` and the
+ * in-admin sidekick (ADR-0033) read the corpus through here, so the two doors
+ * stay fed from one source.
+ */
+
 interface LoadedSkill extends SkillManifestEntry {
     content: string;
 }
@@ -26,13 +33,13 @@ interface SkillCorpus {
     skills: LoadedSkill[];
 }
 /** Resolve a package-root-relative path (e.g. a manifest `path`) to an absolute path. */
-declare function resolveFromPackageRoot(relativePath: string): string;
-declare function loadSkillManifest(): SkillManifest;
+declare function resolveFromPackageRoot(relativePath: string, baseDir?: string): string;
+declare function loadSkillManifest(baseDir?: string): SkillManifest;
 /**
  * Load the full skill corpus — manifest metadata plus each skill's markdown
  * `content`. The sidekick injects `content` into its agent context; an external
  * Claude Code instead receives the files copied by the setup command.
  */
-declare function loadSkillCorpus(): SkillCorpus;
+declare function loadSkillCorpus(baseDir?: string): SkillCorpus;
 
 export { type LoadedSkill, type SkillCorpus, type SkillManifest, type SkillManifestEntry, loadSkillCorpus, loadSkillManifest, resolveFromPackageRoot };

package/dist/skills.js

@@ -37,20 +37,23 @@ var import_node_url = require("url");
 function packageRoot() {
   return (0, import_node_path.resolve)((0, import_node_path.dirname)((0, import_node_url.fileURLToPath)(importMetaUrl)), "..");
 }
-function resolveFromPackageRoot(relativePath) {
-  return (0, import_node_path.resolve)(packageRoot(), relativePath);
+function resolveFromPackageRoot(relativePath, baseDir) {
+  return (0, import_node_path.resolve)(baseDir ?? packageRoot(), relativePath);
 }
-function loadSkillManifest() {
-  const manifestPath = resolveFromPackageRoot("skills/manifest.json");
+function loadSkillManifest(baseDir) {
+  const manifestPath = resolveFromPackageRoot("skills/manifest.json", baseDir);
   return JSON.parse((0, import_node_fs.readFileSync)(manifestPath, "utf8"));
 }
-function loadSkillCorpus() {
-  const manifest = loadSkillManifest();
+function loadSkillCorpus(baseDir) {
+  const manifest = loadSkillManifest(baseDir);
   return {
     version: manifest.version,
     skills: manifest.skills.map((skill) => ({
       ...skill,
-      content: (0, import_node_fs.readFileSync)(resolveFromPackageRoot(skill.path), "utf8")
+      content: (0, import_node_fs.readFileSync)(
+        resolveFromPackageRoot(skill.path, baseDir),
+        "utf8"
+      )
     }))
   };
 }

package/dist/skills.mjs

@@ -5,20 +5,23 @@ import { fileURLToPath } from "url";
 function packageRoot() {
   return resolve(dirname(fileURLToPath(import.meta.url)), "..");
 }
-function resolveFromPackageRoot(relativePath) {
-  return resolve(packageRoot(), relativePath);
+function resolveFromPackageRoot(relativePath, baseDir) {
+  return resolve(baseDir ?? packageRoot(), relativePath);
 }
-function loadSkillManifest() {
-  const manifestPath = resolveFromPackageRoot("skills/manifest.json");
+function loadSkillManifest(baseDir) {
+  const manifestPath = resolveFromPackageRoot("skills/manifest.json", baseDir);
   return JSON.parse(readFileSync(manifestPath, "utf8"));
 }
-function loadSkillCorpus() {
-  const manifest = loadSkillManifest();
+function loadSkillCorpus(baseDir) {
+  const manifest = loadSkillManifest(baseDir);
   return {
     version: manifest.version,
     skills: manifest.skills.map((skill) => ({
       ...skill,
-      content: readFileSync(resolveFromPackageRoot(skill.path), "utf8")
+      content: readFileSync(
+        resolveFromPackageRoot(skill.path, baseDir),
+        "utf8"
+      )
     }))
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "1.28.1",
+  "version": "1.30.0",
   "description": "Typed isomorphic client for the Cavuno Board API",
   "license": "MIT",
   "type": "commonjs",
@@ -100,6 +100,16 @@
         "default": "./dist/skills.js"
       }
     },
+    "./skills/types": {
+      "import": {
+        "types": "./dist/skills-types.d.mts",
+        "default": "./dist/skills-types.mjs"
+      },
+      "require": {
+        "types": "./dist/skills-types.d.ts",
+        "default": "./dist/skills-types.js"
+      }
+    },
     "./skills/*": "./skills/*"
   },
   "files": [

package/skills/cavuno-board-smoke-test/SKILL.md

@@ -15,6 +15,34 @@ auth, and SEO surfaces behave. Verify at runtime, in this order.
 - After upgrading `@cavuno/board` or rotating the `pk_…` key.
 - When any surface renders empty and you don't know which layer is wrong.
 
+## 0 — Run `doctor` first (deterministic pass)
+
+```bash
+PUBLIC_CAVUNO_API_URL=... PUBLIC_CAVUNO_BOARD=pk_... \
+  npx @cavuno/board doctor --frontend http://localhost:3000
+```
+
+Doctor codifies the static checks (env shape, API reachability) and the
+read probes (home/jobs render, JobPosting JSON-LD, sitemap, robots) as
+pass/fail/skip with a non-zero exit on failure — anything it SKIPS is
+named in its summary and still needs the manual checks below. Use the
+rest of this skill for the behavioral checks doctor does not automate
+(auth flows, gating semantics, production build).
+
+Add `--sandbox` to also run the write probes (register → login → apply →
+alert-signup). They are refused unless the board the `pk_` resolves is
+THE platform sandbox (`sandbox: true` in the board context — set only by
+the platform's sandbox seed and stripped from any client settings write)
+— never point them at a real tenant. The
+email-delivery check additionally needs `RESEND_API_KEY` (a platform
+operator credential) and SKIPs loudly without it.
+
+Rate limits are real on the sandbox: the auth endpoints share a
+10-requests/min bucket and register allows 5 signups per 15 minutes per
+IP, and one probe run consumes 4 requests + 1 signup. Rapid reruns will
+start failing with HTTP 429 — that's the limiter working, not a broken
+board; wait a few minutes.
+
 ## 1 — Probe the API directly (before blaming app code)
 
 Use the real env values the app reads (`PUBLIC_CAVUNO_API_URL`,

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.28.1",
+  "version": "1.30.0",
   "skills": [
     {
       "name": "cavuno-board-account",