@cavuno/board 1.34.0 → 1.35.1

package/dist/{salaries-CL_00fNX.d.ts → salaries-CTin-18R.d.ts}

@@ -1,4 +1,4 @@
-import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-IIJtDgzX.js';
+import { b as Schemas, L as ListEnvelope, o as RelatedSearch } from './jobs-Dq2a9oPj.js';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];
@@ -44,9 +44,9 @@ type CompanySalary = Schemas['CompanySalary'];
  */
 type CompanyCategorySalary = Schemas['CompanyCategorySalary'];
 /** The companies browse list — `PublicCompany`s + `market` `relatedSearches`. */
-interface CompanyListEnvelope extends ListEnvelope<PublicCompany> {
+type CompanyListEnvelope = ListEnvelope<PublicCompany> & {
     relatedSearches?: RelatedSearch[];
-}
+};
 type CompaniesListQuery = {
     cursor?: string;
     /** Scope to a single market (sector) by slug. Unknown slugs 404. */
@@ -54,7 +54,7 @@ type CompaniesListQuery = {
     /** 1–100. */
     limit?: number;
     /**
-     * Storefront page offset (companies to skip); takes precedence over
+     * Company catalog page offset (companies to skip); takes precedence over
      * `cursor`. Pair with the response `count` to page in parallel.
      */
     offset?: number;

package/dist/{salaries-BfEEEOHj.d.mts → salaries-CWg82dOz.d.mts}

@@ -1,4 +1,4 @@
-import { b as Schemas, L as ListEnvelope, m as RelatedSearch } from './jobs-IIJtDgzX.mjs';
+import { b as Schemas, L as ListEnvelope, o as RelatedSearch } from './jobs-Dq2a9oPj.mjs';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];
@@ -44,9 +44,9 @@ type CompanySalary = Schemas['CompanySalary'];
  */
 type CompanyCategorySalary = Schemas['CompanyCategorySalary'];
 /** The companies browse list — `PublicCompany`s + `market` `relatedSearches`. */
-interface CompanyListEnvelope extends ListEnvelope<PublicCompany> {
+type CompanyListEnvelope = ListEnvelope<PublicCompany> & {
     relatedSearches?: RelatedSearch[];
-}
+};
 type CompaniesListQuery = {
     cursor?: string;
     /** Scope to a single market (sector) by slug. Unknown slugs 404. */
@@ -54,7 +54,7 @@ type CompaniesListQuery = {
     /** 1–100. */
     limit?: number;
     /**
-     * Storefront page offset (companies to skip); takes precedence over
+     * Company catalog page offset (companies to skip); takes precedence over
      * `cursor`. Pair with the response `count` to page in parallel.
      */
     offset?: number;

package/dist/seo.d.mts

@@ -1,7 +1,7 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, a as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-BfEEEOHj.mjs';
-import { P as PublicBoard } from './board-DgDC0T4g.mjs';
-import { P as PublicJob } from './jobs-IIJtDgzX.mjs';
-import { B as BoardLabelOverrides } from './ui-copy-rlfoH9P3.mjs';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, a as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CWg82dOz.mjs';
+import { P as PublicBoard } from './board-t_WltBBa.mjs';
+import { P as PublicJob } from './jobs-Dq2a9oPj.mjs';
+import { B as BoardLabelOverrides } from './ui-copy-CKfFTtLk.mjs';
 
 /**
  * Google for Jobs `JobPosting` structured data on the `@cavuno/board` wire

package/dist/seo.d.ts

@@ -1,7 +1,7 @@
-import { P as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, a as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CL_00fNX.js';
-import { P as PublicBoard } from './board-Id19Yg8-.js';
-import { P as PublicJob } from './jobs-IIJtDgzX.js';
-import { B as BoardLabelOverrides } from './ui-copy-rlfoH9P3.js';
+import { P as PublicBlogPostSummary, B as BlogAuthorEmbed, C as CompanyCategorySalary, a as CompanySalary, L as LocationSalaryDetail, S as SkillSalaryDetail, T as TitleSalaryDetail } from './salaries-CTin-18R.js';
+import { P as PublicBoard } from './board-Z7hjKDp8.js';
+import { P as PublicJob } from './jobs-Dq2a9oPj.js';
+import { B as BoardLabelOverrides } from './ui-copy-CKfFTtLk.js';
 
 /**
  * Google for Jobs `JobPosting` structured data on the `@cavuno/board` wire

package/dist/seo.js

@@ -217,8 +217,7 @@ var EN = {
     jobAlertEmailPlaceholder: "you@example.com",
     jobAlertButtonText: "Get alerts",
     subscribingLabel: "Subscribing\u2026",
-    jobAlertSuccessToast: "Check your email to confirm your subscription.",
-    jobAlertDuplicateToast: "You're already subscribed to this alert.",
+    jobAlertSuccessToast: "If this email isn't already subscribed, we've sent a confirmation link \u2014 check your inbox.",
     jobAlertErrorToast: "Something went wrong. Please try again.",
     sectionAriaLabel: "Job alerts",
     emailAriaLabel: "email",
@@ -367,8 +366,7 @@ var DE = {
     jobAlertEmailPlaceholder: "name@beispiel.de",
     jobAlertButtonText: "Abonnieren",
     subscribingLabel: "Wird abonniert \u2026",
-    jobAlertSuccessToast: "\xDCberpr\xFCfe deine E-Mails, um dein Abonnement zu best\xE4tigen.",
-    jobAlertDuplicateToast: "Du hast diese Benachrichtigung bereits abonniert.",
+    jobAlertSuccessToast: "Falls diese E-Mail noch nicht abonniert ist, haben wir einen Best\xE4tigungslink gesendet \u2014 pr\xFCfe deinen Posteingang.",
     jobAlertErrorToast: "Etwas ist schiefgelaufen. Bitte versuche es erneut.",
     sectionAriaLabel: "Job-Benachrichtigungen",
     emailAriaLabel: "E-Mail",
@@ -517,8 +515,7 @@ var FR = {
     jobAlertEmailPlaceholder: "vous@exemple.fr",
     jobAlertButtonText: "Activer les alertes",
     subscribingLabel: "Abonnement en cours\u2026",
-    jobAlertSuccessToast: "V\xE9rifiez votre e-mail pour confirmer votre abonnement.",
-    jobAlertDuplicateToast: "Vous \xEAtes d\xE9j\xE0 abonn\xE9 \xE0 cette alerte.",
+    jobAlertSuccessToast: "Si cet e-mail n'est pas d\xE9j\xE0 abonn\xE9, nous avons envoy\xE9 un lien de confirmation \u2014 v\xE9rifiez votre bo\xEEte de r\xE9ception.",
     jobAlertErrorToast: "Une erreur est survenue. Veuillez r\xE9essayer.",
     sectionAriaLabel: "Alertes emploi",
     emailAriaLabel: "e-mail",

package/dist/seo.mjs

@@ -169,8 +169,7 @@ var EN = {
     jobAlertEmailPlaceholder: "you@example.com",
     jobAlertButtonText: "Get alerts",
     subscribingLabel: "Subscribing\u2026",
-    jobAlertSuccessToast: "Check your email to confirm your subscription.",
-    jobAlertDuplicateToast: "You're already subscribed to this alert.",
+    jobAlertSuccessToast: "If this email isn't already subscribed, we've sent a confirmation link \u2014 check your inbox.",
     jobAlertErrorToast: "Something went wrong. Please try again.",
     sectionAriaLabel: "Job alerts",
     emailAriaLabel: "email",
@@ -319,8 +318,7 @@ var DE = {
     jobAlertEmailPlaceholder: "name@beispiel.de",
     jobAlertButtonText: "Abonnieren",
     subscribingLabel: "Wird abonniert \u2026",
-    jobAlertSuccessToast: "\xDCberpr\xFCfe deine E-Mails, um dein Abonnement zu best\xE4tigen.",
-    jobAlertDuplicateToast: "Du hast diese Benachrichtigung bereits abonniert.",
+    jobAlertSuccessToast: "Falls diese E-Mail noch nicht abonniert ist, haben wir einen Best\xE4tigungslink gesendet \u2014 pr\xFCfe deinen Posteingang.",
     jobAlertErrorToast: "Etwas ist schiefgelaufen. Bitte versuche es erneut.",
     sectionAriaLabel: "Job-Benachrichtigungen",
     emailAriaLabel: "E-Mail",
@@ -469,8 +467,7 @@ var FR = {
     jobAlertEmailPlaceholder: "vous@exemple.fr",
     jobAlertButtonText: "Activer les alertes",
     subscribingLabel: "Abonnement en cours\u2026",
-    jobAlertSuccessToast: "V\xE9rifiez votre e-mail pour confirmer votre abonnement.",
-    jobAlertDuplicateToast: "Vous \xEAtes d\xE9j\xE0 abonn\xE9 \xE0 cette alerte.",
+    jobAlertSuccessToast: "Si cet e-mail n'est pas d\xE9j\xE0 abonn\xE9, nous avons envoy\xE9 un lien de confirmation \u2014 v\xE9rifiez votre bo\xEEte de r\xE9ception.",
     jobAlertErrorToast: "Une erreur est survenue. Veuillez r\xE9essayer.",
     sectionAriaLabel: "Alertes emploi",
     emailAriaLabel: "e-mail",

package/dist/server.d.mts

@@ -1,7 +1,7 @@
 import { BoardSdk } from './index.mjs';
-import './jobs-IIJtDgzX.mjs';
-import './board-DgDC0T4g.mjs';
-import './salaries-BfEEEOHj.mjs';
+import './jobs-Dq2a9oPj.mjs';
+import './board-t_WltBBa.mjs';
+import './salaries-CWg82dOz.mjs';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/server.d.ts

@@ -1,7 +1,7 @@
 import { BoardSdk } from './index.js';
-import './jobs-IIJtDgzX.js';
-import './board-Id19Yg8-.js';
-import './salaries-CL_00fNX.js';
+import './jobs-Dq2a9oPj.js';
+import './board-Z7hjKDp8.js';
+import './salaries-CTin-18R.js';
 
 /**
  * Session cookie codec — pure (no framework imports, no node imports) so it

package/dist/sitemap.d.mts

@@ -1,7 +1,7 @@
 import { BoardSdk } from './index.mjs';
-import './jobs-IIJtDgzX.mjs';
-import './board-DgDC0T4g.mjs';
-import './salaries-BfEEEOHj.mjs';
+import './jobs-Dq2a9oPj.mjs';
+import './board-t_WltBBa.mjs';
+import './salaries-CWg82dOz.mjs';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/sitemap.d.ts

@@ -1,7 +1,7 @@
 import { BoardSdk } from './index.js';
-import './jobs-IIJtDgzX.js';
-import './board-Id19Yg8-.js';
-import './salaries-CL_00fNX.js';
+import './jobs-Dq2a9oPj.js';
+import './board-Z7hjKDp8.js';
+import './salaries-CTin-18R.js';
 
 /**
  * Sitemap primitives — the pure XML + bucket-filename logic behind a board

package/dist/{ui-copy-rlfoH9P3.d.mts → ui-copy-CKfFTtLk.d.mts}

@@ -99,7 +99,6 @@ interface AlertsCopy {
     jobAlertButtonText: string;
     subscribingLabel: string;
     jobAlertSuccessToast: string;
-    jobAlertDuplicateToast: string;
     jobAlertErrorToast: string;
     sectionAriaLabel: string;
     emailAriaLabel: string;

package/dist/{ui-copy-rlfoH9P3.d.ts → ui-copy-CKfFTtLk.d.ts}

@@ -99,7 +99,6 @@ interface AlertsCopy {
     jobAlertButtonText: string;
     subscribingLabel: string;
     jobAlertSuccessToast: string;
-    jobAlertDuplicateToast: string;
     jobAlertErrorToast: string;
     sectionAriaLabel: string;
     emailAriaLabel: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cavuno/board",
-  "version": "1.34.0",
+  "version": "1.35.1",
   "description": "Typed isomorphic client for the Cavuno Board API",
   "license": "MIT",
   "type": "commonjs",

package/skills/cavuno-board-auth/SKILL.md

@@ -49,7 +49,6 @@ import { createBoardClient } from '@cavuno/board';
 // Browser/SPA: 'local' persists the pair across tabs + reloads via
 // localStorage; 'session' scopes it to the tab; 'memory' drops it on reload.
 const board = createBoardClient({
-  baseUrl: 'https://api.cavuno.com',
   board: 'pk_a8f3...',
   auth: { storage: 'local' },
 });

package/skills/cavuno-board-client/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cavuno-board-client
-description: Create and configure the @cavuno/board client — baseUrl and the pk_ board identifier, global headers, request/response hooks, per-call FetchOptions caching passthrough, the client.fetch escape hatch, and the rule that keeps one shared instance safe under SSR.
+description: Create and configure the @cavuno/board client — the pk_ board identifier, optional API-origin override, global headers, hooks, per-call FetchOptions, and the rule that keeps one shared instance safe under SSR.
 ---
 
 # The Board API client
@@ -23,7 +23,6 @@ description: Create and configure the @cavuno/board client — baseUrl and the p
 import { createBoardClient } from '@cavuno/board';
 
 const board = createBoardClient({
-  baseUrl: 'https://api.cavuno.com',
   board: 'pk_a8f3...', // pk_ key (preferred) | boards_ id | slug
 });
 ```
@@ -34,7 +33,6 @@ Use the `pk_…` publishable key for `board`, not the slug: the slug is operator
 
 ```ts no-check
 const board = createBoardClient({
-  baseUrl: process.env.PUBLIC_CAVUNO_API_URL!,
   board: process.env.PUBLIC_CAVUNO_BOARD!,
   globalHeaders: { 'Accept-Language': 'en' },
   onRequest: async (req) => req,          // mutate/replace the request (locale, URL rewrite)
@@ -69,7 +67,6 @@ import { createBoardClient } from '@cavuno/board';
 
 // Safe: shared, stateless. Per-user token rides per call.
 export const board = createBoardClient({
-  baseUrl: process.env.PUBLIC_CAVUNO_API_URL!,
   board: process.env.PUBLIC_CAVUNO_BOARD!,
 });
 ```

package/skills/cavuno-board-filters/SKILL.md

@@ -64,6 +64,46 @@ deliberately offers 5 of the 7 wire values (`volunteer`/`other` exist on
 jobs but are not filter options). `JOB_SORTS` deliberately excludes
 `oldest` (ADR-0048); `relevance` is the featured-ranked default.
 
+## Load category, skill, and keyword options
+
+Use the Board API taxonomy collections for filter/autocomplete options. Items
+are backed by published jobs on this board and already carry the board-language
+display name and canonical URL slug. Keep `sourceSlug` for job filtering and
+`canonicalSlug` for links.
+
+```ts snippet
+const categories = await board.taxonomy.categories.list({ limit: 50 });
+const skills = await board.taxonomy.skills.list({ limit: 50 });
+const suggestions = await board.taxonomy.suggestions.list({
+  q: searchText,
+  limit: 10,
+});
+
+const categoryOptions = categories.data.map((term) => ({
+    label: term.displayName,
+    filterValue: term.sourceSlug,
+    href: `/jobs/${term.canonicalSlug}`,
+}));
+```
+
+Category and skill lists accept `q`, `limit` (1–100), and the opaque
+`cursor` request field. Pass the previous response's `nextCursor` into it:
+
+```ts snippet
+const first = await board.taxonomy.categories.list({ limit: 50 });
+const second = first.nextCursor
+  ? await board.taxonomy.categories.list({
+      limit: 50,
+      cursor: first.nextCursor,
+    })
+  : null;
+```
+
+Suggestions accept `q` and `limit`;
+a present query under two characters returns no suggestions. Suggestions contain
+categories and skills only. A category and skill may legitimately share a slug,
+so use `type + canonicalSlug` as the option identity.
+
 ## Anti-patterns
 
 ```ts no-check
@@ -76,9 +116,9 @@ board.jobs.list({ seniority: rawSearch.seniority });
 
 ## Out of scope — do not invent exports
 
-No URL BUILDER (routes are app-owned — serialize with your router), no
-category/skill/location taxonomy lists (those come from the API:
-`board.taxonomy.*`, `jobs.list` filters), no saved-filter persistence.
+No URL BUILDER (routes are app-owned — serialize with your router), no location
+taxonomy vocabulary (locations come from `board.taxonomy.places`), no
+saved-filter persistence.
 
 ## Verify
 

package/skills/cavuno-board-job-alerts/SKILL.md

@@ -28,17 +28,16 @@ Only the methods and fields shown here exist. There is no pause/suspend: deactiv
 const sub = await board.jobAlerts.subscribe({
   email: 'ada@example.com',
   consent: true,
-  frequency: 'weekly', // 'daily' | 'weekly'
+  frequency: 'weekly', // the only supported cadence
   filters: { jobFunctions: ['engineering'], remoteOptions: ['remote'], placeSlugs: ['berlin'] },
 });
-sub.status;               // 'created' | 'duplicate'
-sub.requiresConfirmation; // true when the opt-in email was sent
+sub.status;               // always 'submitted' — uniform, never reveals new vs. already-subscribed
 
 // Confirm page — token from the email link:
 const res = await board.jobAlerts.confirm({ token });
 res.status; // 'confirmed' | 'already_confirmed' | 'expired' | 'not_found'
 if (res.status === 'expired') {
-  await board.jobAlerts.resendConfirmation({ email }); // status: 'sent' | 'throttled' | ...
+  await board.jobAlerts.resendConfirmation({ email }); // status: always 'submitted'
 }
 ```
 
@@ -67,7 +66,7 @@ await board.jobAlerts.updatePreference({
   subscriptionId,
   preferenceId: pref.id,
   token,
-  frequency: 'daily',    // required — restate even if unchanged
+  frequency: 'weekly',   // required — restate even if unchanged
   filters: pref.filters, // round-trip stored filters you aren't editing
 });
 ```
@@ -94,7 +93,7 @@ await board.me.alerts.remove(alert.id); // 204 → void; the only way to stop an
 ```ts snippet
 const current = await board.me.alerts.retrieve(alertId);
 await board.me.alerts.update(alertId, {
-  frequency: 'daily', // the one edit
+  frequency: 'weekly',
   jobFunctions: current.filters.jobFunctions,
   seniorityLevels: current.filters.seniorityLevels,
   remoteOptions: current.filters.remoteOptions,
@@ -107,9 +106,10 @@ await board.me.alerts.update(alertId, {
 
 ## Verify
 
-- [ ] Subscribe form sends `consent: true` and handles `status: 'duplicate'` without erroring.
+- [ ] Subscribe form sends `consent: true` and shows a uniform "check your email" message on `status: 'submitted'` (never reveals already-subscribed).
 - [ ] Confirm page branches on all four statuses (including `expired` → resend).
 - [ ] Manage page reads `subscription` + `token` from the email link's query string; writes send `subscriptionId` in the body.
 - [ ] Editing one preference field leaves the others intact (full-replace round-trip, both surfaces).
 - [ ] Alert UI only promises filtering on job function / place / remote option.
+- [ ] Alert UI offers weekly cadence only and never sends a legacy daily value.
 - [ ] Alert surfaces are hidden when `features.jobAlerts` is false.

package/skills/cavuno-board-job-posting/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cavuno-board-job-posting
-description: Build the anonymous "Post a job" funnel with the @cavuno/board SDK — jobPosting.plans, create and its status-discriminated JobPostingResult (checkout / published / pending_approval / invoice_sent), logo upload + fetchLogoByDomain, and the email-verified billing helpers (checkBilling, sendBillingVerification, getBillingOptions, checkSubscriptionEntitlements).
+description: Build the anonymous "Post a job" funnel with the @cavuno/board SDK — jobPosting.plans, create and its status-discriminated JobPostingResult (checkout / published / pending_approval / invoice_sent), logo upload + fetchLogoByDomain, and the email-verified billing helpers (sendBillingVerification, getBillingOptions).
 ---
 
 # Job posting: the anonymous submission funnel
@@ -87,16 +87,15 @@ The five billing paths map onto those four statuses: paid-Stripe → `checkout`;
 
 ## Existing credit: the verified-email branch
 
-A submitter whose email already holds a plan/bundle can post against remaining capacity — no new charge. Verify the email first; an option's fields become `selectedBilling`:
+A submitter whose email already holds a plan/bundle can post against remaining capacity — no new charge. Verification is the gate: there is deliberately no pre-check by bare email (that would let anyone probe whether an address holds billing). Send the verification email, then read the options with the token; an option's fields become `selectedBilling`:
 
 ```ts snippet
-const { hasActiveBilling } = await board.jobPosting.checkBilling({ email });
-if (hasActiveBilling) {
-  await board.jobPosting.sendBillingVerification({ email }); // emails a token
-  // …the poster pastes/clicks the token…
-  const { options } = await board.jobPosting.getBillingOptions({
-    verificationToken,
-  });
+await board.jobPosting.sendBillingVerification({ email }); // emails a token
+// …the poster pastes/clicks the token…
+const { options } = await board.jobPosting.getBillingOptions({
+  verificationToken,
+});
+if (options.length > 0) {
   const option = options[0]!;
   option.jobsRemaining;     // capacity left
   option.featuredRemaining; // featured slots left
@@ -109,19 +108,6 @@ if (hasActiveBilling) {
 }
 ```
 
-For subscription holders, gate the "featured" toggle on entitlements:
-
-```ts snippet
-const ent = await board.jobPosting.checkSubscriptionEntitlements({
-  email,
-  planId: plan.id,
-});
-ent.hasSubscription;
-ent.canFeature;             // may the wizard offer isFeatured?
-ent.featuredSlotsRemaining; // and how many
-ent.maxActiveRemaining;
-```
-
 ## Verify
 
 - [ ] Every `create` call site handles all four `result.status` variants — no fallthrough that assumes `published`.

package/skills/cavuno-board-jobs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cavuno-board-jobs
-description: Browse, search, and render jobs with the @cavuno/board SDK — jobs.list, jobs.search, jobs.retrieve, jobs.similar. Covers the slim card vs full job shapes, storefront pagination (count/limit/offset + opaque cursor), filters, and the candidate-paywall gatedCount.
+description: Browse, search, and render jobs with the @cavuno/board SDK — jobs.list, jobs.search, jobs.retrieve, jobs.similar. Covers the slim card vs full job shapes, catalog pagination (count/limit/offset + opaque cursor), filters, and the candidate-paywall gatedCount.
 ---
 
 # Jobs: browse, search, detail
@@ -19,7 +19,7 @@ The highest-traffic surface. Listing and search return slim `PublicJobCard`s; th
 
 ## List and render cards
 
-`jobs.list` returns a `JobCardListEnvelope`: storefront pagination fields plus `data: PublicJobCard[]` and optional `relatedSearches`.
+`jobs.list` returns a `JobCardListEnvelope`: catalog pagination fields plus `data: PublicJobCard[]` and optional `relatedSearches`.
 
 ```ts snippet
 const page = await board.jobs.list({ limit: 20, seniority: ['senior', 'lead'] });

package/skills/cavuno-board-setup/SKILL.md

@@ -32,14 +32,13 @@ Read `package.json` and the project layout before writing anything. Identify: th
 - `next` → use Server Components + per-call `FetchOptions` (`next: { revalidate, tags }`).
 - Anything else (Nuxt, SvelteKit, Astro, SolidStart, plain JS) → use the core skills directly; the SDK surface is identical.
 
-## Use standard environment names
+## Use the standard board environment name
 
-Read these two values from the environment; never hard-code them:
+Read the board key from the environment; never hard-code it:
 
-- `PUBLIC_CAVUNO_API_URL` — the API base, e.g. `https://api.cavuno.com`.
 - `PUBLIC_CAVUNO_BOARD` — the board identifier. Use the `pk_…` publishable key, not the slug (the slug is operator-mutable and breaks deployed frontends on rename).
 
-Both are public-safe (the `pk_…` key is client-safe by design). Use your framework's public-env convention for the variable name (`VITE_`, `PUBLIC_`, `NEXT_PUBLIC_`); the values are the same.
+The `pk_…` key is public-safe by design. Use your framework's public-env convention for the variable name (`VITE_`, `PUBLIC_`, `NEXT_PUBLIC_`). The SDK uses `https://api.cavuno.com` by default. Pass `baseUrl` only when Cavuno supplies a staging or development origin.
 
 ## Keep credentials server-side
 
@@ -57,7 +56,6 @@ Create one client and reuse it. See `cavuno-board-client`.
 import { createBoardClient } from '@cavuno/board';
 
 export const board = createBoardClient({
-  baseUrl: process.env.PUBLIC_CAVUNO_API_URL!,
   board: process.env.PUBLIC_CAVUNO_BOARD!,
 });
 ```
@@ -68,7 +66,7 @@ export const board = createBoardClient({
 
 ## Build jobs browsing + detail
 
-The core surface. `jobs.list` / `jobs.search` for listing pages, `jobs.retrieve` for the detail page, `jobs.similar` for the related rail. Honor storefront pagination and the candidate-paywall `gatedCount`; use `paginate()` for full-catalog walks (sitemaps, feeds). See `cavuno-board-jobs`.
+The core surface. `jobs.list` / `jobs.search` for listing pages, `jobs.retrieve` for the detail page, `jobs.similar` for the related rail. Honor catalog pagination and the candidate-paywall `gatedCount`; use `paginate()` for full-catalog walks (sitemaps, feeds). See `cavuno-board-jobs`.
 
 ## Add board users + saved jobs
 
@@ -85,7 +83,7 @@ hand-rolling (each has a skill):
 
 - Salary/date/label formatting in the board language → `cavuno-board-format`
 - Listing-filter vocabulary + URL param parsing → `cavuno-board-filters`
-- Board theme → shadcn CSS variables + fonts → `cavuno-board-theme`
+- Optional hosted-board theme compatibility → `cavuno-board-theme`. By default, the consuming application owns tokens, fonts, and color mode.
 
 ## Build the remaining surfaces per feature flag
 
@@ -117,4 +115,4 @@ Then run the `cavuno-board-smoke-test` skill against your `pk_…` — type chec
 
 ## Stop conditions
 
-Stop and ask the human when: no `pk_…` board identifier or API URL is available; the framework is unrecognized and has no server boundary for secrets; or a surface you need (e.g. job alerts, applications) has no corresponding skill yet — the SDK only exposes endpoints that are live, so a missing skill means the endpoint isn't shipped.
+Stop and ask the human when: no `pk_…` board identifier is available; the framework is unrecognized and has no server boundary for credentials; or a surface you need (e.g. job alerts, applications) has no corresponding skill yet — the SDK only exposes endpoints that are live, so a missing skill means the endpoint isn't shipped.

package/skills/cavuno-board-smoke-test/SKILL.md

@@ -18,7 +18,7 @@ auth, and SEO surfaces behave. Verify at runtime, in this order.
 ## 0 — Run `doctor` first (deterministic pass)
 
 ```bash
-PUBLIC_CAVUNO_API_URL=... PUBLIC_CAVUNO_BOARD=pk_... \
+PUBLIC_CAVUNO_BOARD=pk_... \
   npx @cavuno/board doctor --frontend http://localhost:3000
 ```
 
@@ -45,21 +45,22 @@ board; wait a few minutes.
 
 ## 1 — Probe the API directly (before blaming app code)
 
-Use the real env values the app reads (`PUBLIC_CAVUNO_API_URL`,
-`PUBLIC_CAVUNO_BOARD`). Expected outputs are exact.
+Use the real `PUBLIC_CAVUNO_BOARD` value the app reads. The SDK and doctor use `https://api.cavuno.com` by default; set `PUBLIC_CAVUNO_API_URL` only for a Cavuno-supplied non-production override. Expected outputs are exact.
 
 ```bash
+CAVUNO_API_URL="${PUBLIC_CAVUNO_API_URL:-https://api.cavuno.com}"
+
 # Board context: MUST return JSON with "object": "public_board" and your
 # board's name — not an HTML error page, not {"error":{"code":"boards_not_found"}}.
-curl -s "$PUBLIC_CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD" | head -c 300
+curl -s "$CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD" | head -c 300
 
 # Jobs list: MUST return {"object":"list", ... "data":[...]}. An empty data
 # array on a board you know has jobs means the wrong board identifier.
-curl -s "$PUBLIC_CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD/jobs?limit=2" | head -c 300
+curl -s "$CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD/jobs?limit=2" | head -c 300
 
 # Error envelope: a bogus job slug MUST return the v1 error shape with
 # "code":"jobs_not_found" — anything else means a proxy is rewriting responses.
-curl -s "$PUBLIC_CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD/jobs/definitely-not-a-job"
+curl -s "$CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD/jobs/definitely-not-a-job"
 ```
 
 On a password-protected board, every content read above returns 401 with
@@ -89,7 +90,7 @@ Start the app (dev is fine for this step) and probe its own routes:
   (idempotent), not a duplicate.
 - **Paywall** (gated boards): anonymous list shows the `gatedCount` upsell;
   an entitled login makes the same URL return the ungated view.
-- **Alerts**: subscribe → `status: "created"`; repeat → `"duplicate"`.
+- **Alerts**: subscribe → `status: "submitted"`; repeat → same uniform `"submitted"` (never reveals already-subscribed).
 
 ## 4 — Production build (mandatory)