@cavuno/board 1.29.0 → 1.30.0

package/dist/bin.mjs

@@ -98,20 +98,8 @@ function summarize(results) {
   return { exitCode: failed.length > 0 ? 1 : 0, passed, failed, skipped };
 }
 
-// src/doctor/run.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import { join } from "path";
+// src/doctor/probe.ts
 var FETCH_TIMEOUT_MS = 1e4;
-var READ = {
-  home: record("read.home", 2),
-  jobs: record("read.jobs", 2),
-  jsonld: record("read.jsonld", 2),
-  sitemap: record("read.sitemap", 2),
-  robots: record("read.robots", 2)
-};
-var STATIC_API = record("static.api", 1);
-var STATIC_BOARD = record("static.board", 1);
-var STATIC_SKILLS = record("static.skills", 1);
 async function probe(fetchImpl, url) {
   try {
     const response = await fetchImpl(url, {
@@ -130,6 +118,316 @@ async function probe(fetchImpl, url) {
     };
   }
 }
+
+// src/doctor/read.ts
+var READ = {
+  home: record("read.home", 2),
+  jobs: record("read.jobs", 2),
+  jsonld: record("read.jsonld", 2),
+  sitemap: record("read.sitemap", 2),
+  robots: record("read.robots", 2)
+};
+function skipReadProbes(reason) {
+  return Object.values(READ).map((make) => make("skip", reason));
+}
+async function probeJobsAndJsonLd(fetchImpl, base) {
+  const jobs = await probe(fetchImpl, `${base}/jobs`);
+  const jobLink = jobs.ok ? extractJobDetailLink(jobs.body) : null;
+  const jobsResult = jobs.ok && jobLink ? READ.jobs("pass", `listing renders with job detail links (${jobLink})`) : READ.jobs(
+    "fail",
+    jobs.ok ? "listing renders but contains no /companies/{c}/jobs/{s} detail links" : `listing HTTP ${jobs.status}`
+  );
+  if (!jobLink) {
+    return [
+      jobsResult,
+      READ.jsonld(
+        "skip",
+        jobs.ok ? "not probed \u2014 the listing rendered no job detail link (see read.jobs failure)" : "not probed \u2014 the /jobs listing itself failed (see read.jobs failure)"
+      )
+    ];
+  }
+  const detail = await probe(fetchImpl, `${base}${jobLink}`);
+  const posting = detail.ok ? extractJobPostingJsonLd(detail.body) : null;
+  return [
+    jobsResult,
+    posting ? READ.jsonld(
+      "pass",
+      `JobPosting JSON-LD present (${String(posting.title ?? "")})`
+    ) : READ.jsonld(
+      "fail",
+      detail.ok ? "job detail page has no parseable JobPosting JSON-LD" : `job detail HTTP ${detail.status}`
+    )
+  ];
+}
+function onFrontend(base, locUrl) {
+  try {
+    const parsed = new URL(locUrl);
+    return `${base}${parsed.pathname}${parsed.search}`;
+  } catch {
+    return locUrl;
+  }
+}
+async function probeSitemap(fetchImpl, base) {
+  const sitemap = await probe(fetchImpl, `${base}/sitemap.xml`);
+  if (!sitemap.ok) {
+    return READ.sitemap("fail", `sitemap.xml HTTP ${sitemap.status}`);
+  }
+  const doc = parseSitemap(sitemap.body);
+  if (!doc || doc.urls.length === 0) {
+    return READ.sitemap(
+      "fail",
+      doc ? "sitemap.xml has no <loc> entries" : "sitemap.xml is not a sitemap"
+    );
+  }
+  let urls = doc.urls;
+  if (doc.kind === "index") {
+    const child = await probe(fetchImpl, onFrontend(base, urls[0]));
+    const childDoc = child.ok ? parseSitemap(child.body) : null;
+    if (!childDoc || childDoc.urls.length === 0) {
+      return READ.sitemap(
+        "fail",
+        `child sitemap ${urls[0]} ${child.ok ? "has no <loc> entries" : `HTTP ${child.status}`}`
+      );
+    }
+    urls = childDoc.urls;
+  }
+  const sampleUrl = onFrontend(base, urls[0]);
+  const sample = await probe(fetchImpl, sampleUrl);
+  return sample.ok ? READ.sitemap("pass", `${urls.length} entries; sample page resolves`) : READ.sitemap("fail", `sitemap page ${sampleUrl} \u2192 HTTP ${sample.status}`);
+}
+async function runReadProbes(fetchImpl, frontendUrl) {
+  const base = frontendUrl.replace(/\/$/, "");
+  const [home, jobsAndJsonLd, sitemap, robots] = await Promise.all([
+    probe(fetchImpl, base),
+    probeJobsAndJsonLd(fetchImpl, base),
+    probeSitemap(fetchImpl, base),
+    probe(fetchImpl, `${base}/robots.txt`)
+  ]);
+  return [
+    home.ok && /<(html|body|div|main)[\s>]/i.test(home.body) ? READ.home("pass", "home renders") : READ.home(
+      "fail",
+      home.ok ? "home returned 200 but no HTML document \u2014 captive portal or empty shell?" : `home HTTP ${home.status}`
+    ),
+    ...jobsAndJsonLd,
+    sitemap,
+    robots.ok && /user-agent\s*:/i.test(robots.body) ? READ.robots("pass", "present") : READ.robots(
+      "fail",
+      robots.ok ? "robots.txt returned 200 but has no User-agent directive" : `robots.txt HTTP ${robots.status}`
+    )
+  ];
+}
+
+// src/doctor/writes.ts
+var WRITE = {
+  board: record("write.board", 3),
+  register: record("write.register", 3),
+  login: record("write.login", 3),
+  email: record("write.email", 3),
+  apply: record("write.apply", 3),
+  alert: record("write.alert", 3)
+};
+var DEPENDENT_CHECKS = [
+  WRITE.register,
+  WRITE.login,
+  WRITE.email,
+  WRITE.apply,
+  WRITE.alert
+];
+function skipWriteProbes(reason) {
+  return Object.values(WRITE).map((make) => make("skip", reason));
+}
+var FETCH_TIMEOUT_MS2 = 1e4;
+var RESEND_API_BASE = "https://api.resend.com";
+async function request(fetchImpl, url, init) {
+  try {
+    const response = await fetchImpl(url, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS2),
+      ...init
+    });
+    let json = null;
+    try {
+      json = await response.json();
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, json };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      json: { error: error instanceof Error ? error.message : String(error) }
+    };
+  }
+}
+function post(fetchImpl, url, body, bearer) {
+  return request(fetchImpl, url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+      ...bearer ? { authorization: `Bearer ${bearer}` } : {}
+    },
+    body: JSON.stringify(body)
+  });
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function observeVerificationEmail(fetchImpl, apiKey, recipient, pollMs, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const subjectMarker = `[To: ${recipient}]`;
+  do {
+    const list = await request(
+      fetchImpl,
+      `${RESEND_API_BASE}/emails?limit=20`,
+      {
+        headers: { authorization: `Bearer ${apiKey}` }
+      }
+    );
+    if (!list.ok) {
+      return WRITE.email(
+        "fail",
+        `Resend list returned HTTP ${list.status} \u2014 wrong RESEND_API_KEY?`
+      );
+    }
+    const items = list.json?.data ?? [];
+    const match = items.find(
+      (item) => item.subject?.includes(subjectMarker) || item.to?.includes(recipient)
+    );
+    if (match) {
+      return WRITE.email(
+        "pass",
+        `verification send observed in Resend for ${recipient}`
+      );
+    }
+    await sleep(pollMs);
+  } while (Date.now() < deadline);
+  return WRITE.email(
+    "fail",
+    `no verification send for ${recipient} appeared in Resend within ${timeoutMs}ms`
+  );
+}
+async function runWriteProbes(options) {
+  const { fetchImpl } = options;
+  const origin = new URL(options.env.apiUrl).origin;
+  const base = `${origin}/v1/boards/${encodeURIComponent(options.env.boardKey)}`;
+  const nonce = options.nonce ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+  const email = `doctor+${nonce}@cavuno.com`;
+  const password = `doctor-probe-${nonce}-A1!`;
+  let context = options.boardContext ?? null;
+  if (context === null) {
+    const r = await request(fetchImpl, base);
+    if (!r.ok) {
+      return [
+        WRITE.board("fail", `board context did not resolve (HTTP ${r.status})`),
+        ...DEPENDENT_CHECKS.map(
+          (make) => make("skip", "not run \u2014 the write gate failed (see write.board)")
+        )
+      ];
+    }
+    context = r.json ?? {};
+  }
+  if (context.sandbox !== true) {
+    return [
+      WRITE.board(
+        "fail",
+        "refusing write probes: this board is not the platform sandbox (`sandbox` is not true) \u2014 point PUBLIC_CAVUNO_BOARD at the sandbox pk_"
+      ),
+      ...DEPENDENT_CHECKS.map(
+        (make) => make("skip", "not run \u2014 the write gate failed (see write.board)")
+      )
+    ];
+  }
+  const results = [
+    WRITE.board("pass", "board is the platform sandbox")
+  ];
+  const registered = await post(fetchImpl, `${base}/auth/register`, {
+    role: "candidate",
+    method: "emailpass",
+    email,
+    password,
+    displayName: "Doctor Probe"
+  });
+  const sessionOk = (r) => r.ok && typeof r.json?.accessToken === "string";
+  results.push(
+    sessionOk(registered) ? WRITE.register("pass", `candidate registered (${email})`) : WRITE.register(
+      "fail",
+      `register returned HTTP ${registered.status}` + (registered.status === 429 ? " \u2014 rate-limited: register allows 5 signups / 15 min per IP; wait before rerunning" : "")
+    )
+  );
+  let accessToken = null;
+  if (sessionOk(registered)) {
+    const login = await post(fetchImpl, `${base}/auth/login`, {
+      email,
+      password
+    });
+    if (sessionOk(login)) {
+      accessToken = login.json.accessToken;
+      results.push(WRITE.login("pass", "emailpass login returns a session"));
+    } else {
+      results.push(WRITE.login("fail", `login returned HTTP ${login.status}`));
+    }
+  } else {
+    results.push(WRITE.login("skip", "not run \u2014 register failed"));
+  }
+  if (!sessionOk(registered)) {
+    results.push(WRITE.email("skip", "not run \u2014 register failed"));
+  } else if (!options.resendApiKey) {
+    results.push(
+      WRITE.email(
+        "skip",
+        "RESEND_API_KEY not set \u2014 the verification send was NOT verified (platform-operator check)"
+      )
+    );
+  } else {
+    results.push(
+      await observeVerificationEmail(
+        fetchImpl,
+        options.resendApiKey,
+        email,
+        options.emailPollMs ?? 2e3,
+        options.emailTimeoutMs ?? 3e4
+      )
+    );
+  }
+  if (!accessToken) {
+    results.push(WRITE.apply("skip", "not run \u2014 no session (see above)"));
+  } else {
+    const listing = await request(fetchImpl, `${base}/jobs?limit=1`);
+    const card = listing.json?.data?.[0];
+    if (!listing.ok || !card?.slug) {
+      results.push(
+        WRITE.apply(
+          "fail",
+          listing.ok ? "the board has no jobs to apply to \u2014 is the sandbox seeded?" : `jobs listing returned HTTP ${listing.status}`
+        )
+      );
+    } else {
+      const applied = await post(
+        fetchImpl,
+        `${base}/jobs/${encodeURIComponent(card.slug)}/apply`,
+        {},
+        accessToken
+      );
+      results.push(
+        applied.ok && typeof applied.json?.id === "string" ? WRITE.apply("pass", `applied to ${card.slug}`) : WRITE.apply("fail", `apply returned HTTP ${applied.status}`)
+      );
+    }
+  }
+  const alert = await post(fetchImpl, `${base}/job-alerts`, {
+    email,
+    consent: true
+  });
+  results.push(
+    alert.ok ? WRITE.alert("pass", "job-alert subscription accepted") : WRITE.alert("fail", `job-alerts returned HTTP ${alert.status}`)
+  );
+  return results;
+}
+
+// src/doctor/run.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join } from "path";
+var STATIC_API = record("static.api", 1);
+var STATIC_BOARD = record("static.board", 1);
+var STATIC_SKILLS = record("static.skills", 1);
 async function checkApiReachable(fetchImpl, apiUrl) {
   let origin;
   try {
@@ -163,21 +461,31 @@ async function checkBoardResolves(fetchImpl, env) {
     `${origin}/v1/boards/${encodeURIComponent(env.boardKey)}`
   );
   if (!result.ok) {
-    return STATIC_BOARD(
-      "fail",
-      `board did not resolve for this key (HTTP ${result.status}) \u2014 revoked or wrong key?`
-    );
+    return {
+      result: STATIC_BOARD(
+        "fail",
+        `board did not resolve for this key (HTTP ${result.status}) \u2014 revoked or wrong key?`
+      ),
+      context: null
+    };
   }
+  let parsed = null;
   try {
-    const parsed = JSON.parse(result.body);
+    parsed = JSON.parse(result.body);
     if (typeof parsed !== "object" || parsed === null) throw new Error("shape");
   } catch {
-    return STATIC_BOARD(
-      "fail",
-      "board endpoint returned 200 but not JSON \u2014 proxy or captive portal in the way?"
-    );
+    return {
+      result: STATIC_BOARD(
+        "fail",
+        "board endpoint returned 200 but not JSON \u2014 proxy or captive portal in the way?"
+      ),
+      context: null
+    };
   }
-  return STATIC_BOARD("pass", "publishable key resolves the board");
+  return {
+    result: STATIC_BOARD("pass", "publishable key resolves the board"),
+    context: parsed
+  };
 }
 var SKILL_ROOTS = [".claude/skills", ".agents/skills"];
 function checkSkillsFreshness(projectRoot) {
@@ -218,71 +526,6 @@ function checkSkillsFreshness(projectRoot) {
     `stale skills (re-run \`npx @cavuno/board setup\`): ${[...stale].join(", ")}`
   );
 }
-async function probeJobsAndJsonLd(fetchImpl, base) {
-  const jobs = await probe(fetchImpl, `${base}/jobs`);
-  const jobLink = jobs.ok ? extractJobDetailLink(jobs.body) : null;
-  const jobsResult = jobs.ok && jobLink ? READ.jobs("pass", `listing renders with job detail links (${jobLink})`) : READ.jobs(
-    "fail",
-    jobs.ok ? "listing renders but contains no /companies/{c}/jobs/{s} detail links" : `listing HTTP ${jobs.status}`
-  );
-  if (!jobLink) {
-    return [
-      jobsResult,
-      READ.jsonld(
-        "skip",
-        jobs.ok ? "not probed \u2014 the listing rendered no job detail link (see read.jobs failure)" : "not probed \u2014 the /jobs listing itself failed (see read.jobs failure)"
-      )
-    ];
-  }
-  const detail = await probe(fetchImpl, `${base}${jobLink}`);
-  const posting = detail.ok ? extractJobPostingJsonLd(detail.body) : null;
-  return [
-    jobsResult,
-    posting ? READ.jsonld(
-      "pass",
-      `JobPosting JSON-LD present (${String(posting.title ?? "")})`
-    ) : READ.jsonld(
-      "fail",
-      detail.ok ? "job detail page has no parseable JobPosting JSON-LD" : `job detail HTTP ${detail.status}`
-    )
-  ];
-}
-function onFrontend(base, locUrl) {
-  try {
-    const parsed = new URL(locUrl);
-    return `${base}${parsed.pathname}${parsed.search}`;
-  } catch {
-    return locUrl;
-  }
-}
-async function probeSitemap(fetchImpl, base) {
-  const sitemap = await probe(fetchImpl, `${base}/sitemap.xml`);
-  if (!sitemap.ok) {
-    return READ.sitemap("fail", `sitemap.xml HTTP ${sitemap.status}`);
-  }
-  const doc = parseSitemap(sitemap.body);
-  if (!doc || doc.urls.length === 0) {
-    return READ.sitemap(
-      "fail",
-      doc ? "sitemap.xml has no <loc> entries" : "sitemap.xml is not a sitemap"
-    );
-  }
-  let urls = doc.urls;
-  if (doc.kind === "index") {
-    const child = await probe(fetchImpl, onFrontend(base, urls[0]));
-    const childDoc = child.ok ? parseSitemap(child.body) : null;
-    if (!childDoc || childDoc.urls.length === 0) {
-      return READ.sitemap(
-        "fail",
-        `child sitemap ${urls[0]} ${child.ok ? "has no <loc> entries" : `HTTP ${child.status}`}`
-      );
-    }
-    urls = childDoc.urls;
-  }
-  const sampleUrl = onFrontend(base, urls[0]);
-  const sample = await probe(fetchImpl, sampleUrl);
-  return sample.ok ? READ.sitemap("pass", `${urls.length} entries; sample page resolves`) : READ.sitemap("fail", `sitemap page ${sampleUrl} \u2192 HTTP ${sample.status}`);
-}
 async function runDoctor(options) {
   const fetchImpl = options.fetchImpl ?? fetch;
   const results = [];
@@ -297,35 +540,37 @@ async function runDoctor(options) {
   } else {
     results.push(STATIC_API("skip", "PUBLIC_CAVUNO_API_URL not set"));
   }
-  results.push(
-    envOk ? await checkBoardResolves(fetchImpl, options.env) : STATIC_BOARD("skip", "env checks failed \u2014 fix them first")
-  );
-  results.push(checkSkillsFreshness(options.projectRoot ?? process.cwd()));
-  if (!options.frontendUrl) {
-    for (const make of Object.values(READ)) {
-      results.push(make("skip", "no --frontend <url> given"));
-    }
-    return { results, summary: summarize(results) };
+  let boardContext = null;
+  if (envOk) {
+    const resolved = await checkBoardResolves(fetchImpl, options.env);
+    boardContext = resolved.context;
+    results.push(resolved.result);
+  } else {
+    results.push(STATIC_BOARD("skip", "env checks failed \u2014 fix them first"));
   }
-  const base = options.frontendUrl.replace(/\/$/, "");
-  const [home, jobsAndJsonLd, sitemap, robots] = await Promise.all([
-    probe(fetchImpl, base),
-    probeJobsAndJsonLd(fetchImpl, base),
-    probeSitemap(fetchImpl, base),
-    probe(fetchImpl, `${base}/robots.txt`)
-  ]);
+  results.push(checkSkillsFreshness(options.projectRoot ?? process.cwd()));
   results.push(
-    home.ok && /<(html|body|div|main)[\s>]/i.test(home.body) ? READ.home("pass", "home renders") : READ.home(
-      "fail",
-      home.ok ? "home returned 200 but no HTML document \u2014 captive portal or empty shell?" : `home HTTP ${home.status}`
-    ),
-    ...jobsAndJsonLd,
-    sitemap,
-    robots.ok && /user-agent\s*:/i.test(robots.body) ? READ.robots("pass", "present") : READ.robots(
-      "fail",
-      robots.ok ? "robots.txt returned 200 but has no User-agent directive" : `robots.txt HTTP ${robots.status}`
-    )
+    ...options.frontendUrl ? await runReadProbes(fetchImpl, options.frontendUrl) : skipReadProbes("no --frontend <url> given")
   );
+  if (!options.sandbox) {
+    results.push(
+      ...skipWriteProbes(
+        "write probes not enabled \u2014 run with --sandbox against the platform sandbox"
+      )
+    );
+  } else if (!envOk) {
+    results.push(...skipWriteProbes("env checks failed \u2014 fix them first"));
+  } else {
+    results.push(
+      ...await runWriteProbes({
+        env: options.env,
+        fetchImpl,
+        resendApiKey: options.resendApiKey,
+        nonce: options.writeProbeNonce,
+        boardContext
+      })
+    );
+  }
   return { results, summary: summarize(results) };
 }
 
@@ -375,7 +620,11 @@ async function doctor(argv) {
       apiUrl: process.env.PUBLIC_CAVUNO_API_URL,
       boardKey: process.env.PUBLIC_CAVUNO_BOARD
     },
-    frontendUrl
+    frontendUrl,
+    // Tier-3 write probes: opt-in via --sandbox, and refused server-side
+    // unless the resolved board is platform-marked test (writes.ts gate).
+    sandbox: argv.includes("--sandbox"),
+    resendApiKey: process.env.RESEND_API_KEY
   });
   console.log("\n@cavuno/board doctor");
   for (const result of results) {

package/dist/filters.d.mts

@@ -1,4 +1,4 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-DK5mPBgq.mjs';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-lzeoVGY6.mjs';
 
 declare const REMOTE_OPTIONS: readonly RemoteOption[];
 /**

package/dist/filters.d.ts

@@ -1,4 +1,4 @@
-import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-DK5mPBgq.js';
+import { J as JobSort, E as EmploymentType, R as RemoteOption, S as Seniority } from './jobs-lzeoVGY6.js';
 
 declare const REMOTE_OPTIONS: readonly RemoteOption[];
 /**

package/dist/format.d.mts

@@ -1,4 +1,4 @@
-import { P as PublicJob, a as PublicJobCard } from './jobs-DK5mPBgq.mjs';
+import { P as PublicJob, a as PublicJobCard } from './jobs-lzeoVGY6.mjs';
 
 /**
  * Date display helpers in the board language (required leading parameter,

package/dist/format.d.ts

@@ -1,4 +1,4 @@
-import { P as PublicJob, a as PublicJobCard } from './jobs-DK5mPBgq.js';
+import { P as PublicJob, a as PublicJobCard } from './jobs-lzeoVGY6.js';
 
 /**
  * Date display helpers in the board language (required leading parameter,

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-DK5mPBgq.mjs';
-export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-DK5mPBgq.mjs';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-CrJsaZe6.mjs';
-export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-CrJsaZe6.mjs';
+import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-lzeoVGY6.mjs';
+export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-lzeoVGY6.mjs';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-DpH5CxdM.mjs';
+export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-DpH5CxdM.mjs';
 
 type Awaitable<T> = T | Promise<T>;
 /**
@@ -203,7 +203,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.29.0";
+declare const SDK_VERSION = "1.30.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -654,6 +654,7 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
         logoUrl: string | null;
         primaryDomain: string | null;
         showCavunoBranding: boolean;
+        sandbox: boolean;
         features: {
             jobAlerts: boolean;
             candidates: boolean;

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-DK5mPBgq.js';
-export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-DK5mPBgq.js';
-import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-CXt6Vkrp.js';
-export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-CXt6Vkrp.js';
+import { b as Schemas, R as RemoteOption, E as EmploymentType, S as Seniority, L as ListEnvelope, c as components, d as JobsListQuery, e as JobCardListEnvelope, f as JobsSearchBody, g as JobCardSearchEnvelope, h as JobsSimilarQuery, i as SearchEnvelope } from './jobs-lzeoVGY6.js';
+export { C as CustomFieldValue, j as CustomFieldValues, k as EducationRequirement, l as JobCompany, J as JobSort, O as OfficeLocation, P as PublicJob, a as PublicJobCard, m as RelatedSearch, n as RemotePermit, o as RemoteTimezone, p as StorefrontPagination } from './jobs-lzeoVGY6.js';
+import { c as CompaniesListQuery, d as CompanyListEnvelope, e as CompaniesSearchBody, f as CompanyJobsListQuery, g as CompanySimilarQuery, h as CompanyMarketsListQuery, i as SalaryDetailQuery, j as BlogPostsListQuery, k as BlogSimilarQuery, l as BlogSearchBody } from './salaries-Cy3MhZov.js';
+export { B as BlogAuthorEmbed, m as BlogTagEmbed, C as CompanyCategorySalary, n as CompanyMarket, o as CompanyMarketRef, b as CompanySalary, p as CustomFieldDefinition, q as CustomFieldOption, r as CustomFieldType, L as LocationSalaryDetail, s as LocationSkillsIndex, t as LocationTitlesIndex, u as PublicBlogAdjacentPosts, v as PublicBlogAuthor, w as PublicBlogPost, a as PublicBlogPostSummary, x as PublicBlogTag, P as PublicBoard, y as PublicBoardAnalytics, z as PublicBoardFeatures, A as PublicBoardTheme, D as PublicCompany, E as PublicCompanyDetail, F as SalaryCompany, G as SalaryLocation, H as SalarySkill, I as SalaryTitle, J as SkillLocationSalary, K as SkillLocationsIndex, S as SkillSalaryDetail, M as TitleLocationSalary, N as TitleLocationsIndex, T as TitleSalaryDetail } from './salaries-Cy3MhZov.js';
 
 type Awaitable<T> = T | Promise<T>;
 /**
@@ -203,7 +203,7 @@ declare function paginate<Q extends Record<string, unknown>, P extends PageShape
  * constant because the package is platform-neutral and cannot read
  * package.json at runtime.
  */
-declare const SDK_VERSION = "1.29.0";
+declare const SDK_VERSION = "1.30.0";
 
 type SavedJob = Schemas['SavedJob'];
 type SavedJobsListQuery = {
@@ -654,6 +654,7 @@ declare function createBoardClient(options: CreateBoardClientOptions): {
         logoUrl: string | null;
         primaryDomain: string | null;
         showCavunoBranding: boolean;
+        sandbox: boolean;
         features: {
             jobAlerts: boolean;
             candidates: boolean;

package/dist/index.js

@@ -310,7 +310,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.29.0";
+var SDK_VERSION = "1.30.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/index.mjs

@@ -265,7 +265,7 @@ async function clearSession(storage) {
 }
 
 // src/version.ts
-var SDK_VERSION = "1.29.0";
+var SDK_VERSION = "1.30.0";
 
 // src/client.ts
 function isRawBody(body) {

package/dist/{jobs-DK5mPBgq.d.mts → jobs-lzeoVGY6.d.mts}

@@ -2382,6 +2382,8 @@ interface components {
             primaryDomain: string | null;
             /** @description Whitelabel toggle (default `true`). Render the "Powered by Cavuno" badge unless `false`. */
             showCavunoBranding: boolean;
+            /** @description True ONLY for the platform sandbox fixture tenant — the safe target for write probes (doctor tier 3); data is reset nightly. Every real tenant board is `false`. */
+            sandbox: boolean;
             features: {
                 jobAlerts: boolean;
                 candidates: boolean;

package/dist/{jobs-DK5mPBgq.d.ts → jobs-lzeoVGY6.d.ts}

@@ -2382,6 +2382,8 @@ interface components {
             primaryDomain: string | null;
             /** @description Whitelabel toggle (default `true`). Render the "Powered by Cavuno" badge unless `false`. */
             showCavunoBranding: boolean;
+            /** @description True ONLY for the platform sandbox fixture tenant — the safe target for write probes (doctor tier 3); data is reset nightly. Every real tenant board is `false`. */
+            sandbox: boolean;
             features: {
                 jobAlerts: boolean;
                 candidates: boolean;

package/dist/{salaries-CXt6Vkrp.d.ts → salaries-Cy3MhZov.d.ts}

@@ -1,4 +1,4 @@
-import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-DK5mPBgq.js';
+import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-lzeoVGY6.js';
 
 type PublicBoard = Schemas['PublicBoardContext'];
 type PublicBoardFeatures = PublicBoard['features'];

package/dist/{salaries-CrJsaZe6.d.mts → salaries-DpH5CxdM.d.mts}

@@ -1,4 +1,4 @@
-import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-DK5mPBgq.mjs';
+import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-lzeoVGY6.mjs';
 
 type PublicBoard = Schemas['PublicBoardContext'];
 type PublicBoardFeatures = PublicBoard['features'];

package/dist/seo.d.mts

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CrJsaZe6.mjs';
-import { P as PublicJob } from './jobs-DK5mPBgq.mjs';
+import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-DpH5CxdM.mjs';
+import { P as PublicJob } from './jobs-lzeoVGY6.mjs';
 
 /**
  * Google for Jobs `JobPosting` structured data on the `@cavuno/board` wire

package/dist/seo.d.ts

@@ -1,5 +1,5 @@
-import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CXt6Vkrp.js';
-import { P as PublicJob } from './jobs-DK5mPBgq.js';
+import { P as PublicBoard, a as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, b as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-Cy3MhZov.js';
+import { P as PublicJob } from './jobs-lzeoVGY6.js';
 
 /**
  * Google for Jobs `JobPosting` structured data on the `@cavuno/board` wire

package/dist/server.d.mts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.mjs';
-import './jobs-DK5mPBgq.mjs';
-import './salaries-CrJsaZe6.mjs';
+import './jobs-lzeoVGY6.mjs';
+import './salaries-DpH5CxdM.mjs';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.js';
-import './jobs-DK5mPBgq.js';
-import './salaries-CXt6Vkrp.js';
+import './jobs-lzeoVGY6.js';
+import './salaries-Cy3MhZov.js';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/sitemap.d.mts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.mjs';
-import './jobs-DK5mPBgq.mjs';
-import './salaries-CrJsaZe6.mjs';
+import './jobs-lzeoVGY6.mjs';
+import './salaries-DpH5CxdM.mjs';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/sitemap.d.ts

@@ -1,6 +1,6 @@
 import { BoardSdk } from './index.js';
-import './jobs-DK5mPBgq.js';
-import './salaries-CXt6Vkrp.js';
+import './jobs-lzeoVGY6.js';
+import './salaries-Cy3MhZov.js';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "Typed isomorphic client for the Cavuno Board API",
   "license": "MIT",
   "type": "commonjs",

package/skills/cavuno-board-smoke-test/SKILL.md

@@ -29,6 +29,20 @@ named in its summary and still needs the manual checks below. Use the
 rest of this skill for the behavioral checks doctor does not automate
 (auth flows, gating semantics, production build).
 
+Add `--sandbox` to also run the write probes (register → login → apply →
+alert-signup). They are refused unless the board the `pk_` resolves is
+THE platform sandbox (`sandbox: true` in the board context — set only by
+the platform's sandbox seed and stripped from any client settings write)
+— never point them at a real tenant. The
+email-delivery check additionally needs `RESEND_API_KEY` (a platform
+operator credential) and SKIPs loudly without it.
+
+Rate limits are real on the sandbox: the auth endpoints share a
+10-requests/min bucket and register allows 5 signups per 15 minutes per
+IP, and one probe run consumes 4 requests + 1 signup. Rapid reruns will
+start failing with HTTP 429 — that's the limiter working, not a broken
+board; wait a few minutes.
+
 ## 1 — Probe the API directly (before blaming app code)
 
 Use the real env values the app reads (`PUBLIC_CAVUNO_API_URL`,

package/skills/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.29.0",
+  "version": "1.30.0",
   "skills": [
     {
       "name": "cavuno-board-account",