@cavuno/board 2.0.3 → 3.0.0

package/skills/cavuno-board-sitemap/SKILL.md

@@ -1,42 +1,30 @@
 ---
 name: cavuno-board-sitemap
-description: Build the board's sitemap with @cavuno/board/sitemap — the hosted 8-bucket model (marketing, jobs taxonomies, job details, companies, salaries, blog), 45k chunking, XML rendering, and the buildBucketUrls walker that enumerates a board's content through the BoardSdk with the hosted SEO rules built in (feature gating, ≥5-job thin-content floor, pagination backstops). Use when adding /sitemap.xml and /sitemap/:file routes to a custom board frontend.
+description: Board sitemap generation with @cavuno/board/sitemap. Use for sitemap indexes, bucket routes, XML rendering, catalog walking, chunking, or robots.txt discovery.
 ---
 
-# Sitemap: the 8-bucket model
+# Sitemap generation
 
-`@cavuno/board/sitemap` ships the hosted board's sitemap architecture: a
-sitemap INDEX at `/sitemap.xml` pointing at one file per content bucket,
-each an ordinary `<urlset>`. The XML byte layout and the bucket rules are
-tested against the hosted implementation, so a custom frontend's
-sitemap corpus lines up bucket-for-bucket with what cavuno.com would emit.
+`@cavuno/board/sitemap` implements the hosted eight-bucket sitemap: an index at
+`/sitemap.xml` points to ordinary `<urlset>` files for `marketing`,
+`jobs-categories`, `jobs-skills`, `jobs-locations`, `jobs-details`,
+`companies`, `salaries`, and optionally `blog`.
 
-Two tiers, use both:
+Structured data and head tags use `cavuno-board-seo`. The host app owns feeds.
 
-- **XML primitives** (pure, no I/O): `SITEMAP_BUCKETS`,
-  `SITEMAP_CHUNK_SIZE` (45,000), `chunk`, `bucketFilename` /
-  `parseBucketFilename`, `renderUrlset`, `renderSitemapIndex`.
-- **The walker** (opinionated, injected I/O): `listedBuckets(board)` and
-  `buildBucketUrls(board, origin, bucket)` take your `BoardSdk` instance
-  and return plain URL strings with the hosted rules applied — you never
-  re-derive the SEO policy.
+## Use both tiers
 
-## When to use
+The pure XML tier exports `SITEMAP_BUCKETS`, `SITEMAP_CHUNK_SIZE` (45,000),
+`chunk`, `bucketFilename`, `parseBucketFilename`, `renderUrlset`, and
+`renderSitemapIndex`. The catalog tier exports `listedBuckets(board)` and
+`buildBucketUrls(board, origin, bucket)`; it walks the SDK and applies the
+hosted indexing policy.
 
-- Adding `/sitemap.xml` + `/sitemap/:file` routes to a board frontend.
-- Deciding which listing pages deserve indexing (the walker already does).
+## Serve the index
 
-## When not to use
-
-- Structured data / meta tags — `cavuno-board-seo`.
-- Feeds (RSS/Atom) — app-owned.
-
-## The two routes
-
-The index lists one entry per bucket; each bucket route parses its filename
-back to a bucket + chunk and renders a urlset. Empty buckets render a valid
-empty urlset — only `blog` is dropped from the index when the feature is
-off (`listedBuckets` handles that).
+List every non-empty chunk filename for every listed bucket. Keep one filename
+for an empty bucket so its route returns a valid empty urlset. `listedBuckets`
+removes blog when the feature is off.
 
 ```ts snippet
 import {
@@ -45,15 +33,13 @@ import {
   bucketFilename,
   chunk,
   listedBuckets,
-  parseBucketFilename,
   renderSitemapIndex,
-  renderUrlset,
 } from '@cavuno/board/sitemap';
 
-// GET /sitemap.xml — one <sitemap> per listed bucket (plus -2, -3… chunks).
 const origin = 'https://jobs.example.com';
 const buckets = await listedBuckets(board);
 const locs: string[] = [];
+
 for (const bucket of buckets) {
   const urls = await buildBucketUrls(board, origin, bucket);
   const chunks = chunk(urls, SITEMAP_CHUNK_SIZE);
@@ -61,87 +47,84 @@ for (const bucket of buckets) {
     locs.push(`${origin}/sitemap/${bucketFilename(bucket, i)}`);
   }
 }
+
 return xmlResponse(renderSitemapIndex(locs));
 ```
 
+## Serve a bucket file
+
+Parse the filename, rebuild that bucket, select its zero-based chunk, and
+render it. A filename outside the bucket grammar resolves to 404.
+
 ```ts snippet
-// GET /sitemap/:file — parse, enumerate, slice, render. Unknown file → 404.
+import {
+  SITEMAP_CHUNK_SIZE,
+  buildBucketUrls,
+  chunk,
+  parseBucketFilename,
+  renderUrlset,
+} from '@cavuno/board/sitemap';
+
 const parsed = parseBucketFilename(params.file);
 if (!parsed) return notFound();
+
 const urls = await buildBucketUrls(board, origin, parsed.bucket);
 const page = chunk(urls, SITEMAP_CHUNK_SIZE)[parsed.chunkIndex] ?? [];
 return xmlResponse(renderUrlset(page));
 ```
 
-`renderUrlset` also accepts `{ url, lastModified?, images? }` entries when
-you have per-URL dates (a `Date` serializes to ISO 8601). `changefreq` and
-`priority` are deliberately unsupported — the hosted board never emits them.
-
-## robots.txt
-
-Point crawlers at the index — one line, at the site root:
-
-```txt
-Sitemap: https://jobs.example.com/sitemap.xml
-```
-
-## The rules the walker enforces (don't re-implement)
+`renderUrlset` also accepts `{ url, lastModified?, images? }`; `Date` values
+serialize to ISO 8601. `renderSitemapIndex` accepts strings or
+`{ url, lastModified? }`. The hosted format omits `changefreq` and `priority`.
 
-- **Thin-content floor**: a category/skill/location listing page is emitted
-  only with ≥5 distinct jobs (`MIN_JOBS_PER_INDEXED_PAGE`) — below that,
-  the page is thin content that wastes crawl budget.
-- **Feature gating**: `/impressum`, `/talent`, `/employers` appear in the
-  marketing bucket only when `context().features` enables them; the blog
-  bucket exists only when `features.blog` is on.
-- **Board language**: salary-index reads pass `context().language`, so a
-  non-English board emits board-language canonical salary slugs (jobs,
-  companies, and blog slugs arrive canonical on the wire already). No
-  locale parameter to thread.
-- **Pagination backstops**: offset enumeration runs in parallel when the
-  envelope carries `count` (capped at the API's 10,000-offset window);
-  cursor walks cap at 200 pages. Both warn on truncation instead of
-  hanging a build.
+## Keep the walker policy intact
 
-## Stable order caveat (cursor walks)
+`buildBucketUrls` is the policy boundary:
 
-Cursor and offset enumeration order can shift between requests on a large,
-churning board — two chunk requests may see slightly different orderings.
-That is harmless for a sitemap (URLs dedupe and the ≥5 counts are a
-heuristic), but do NOT reuse the walker as a general "export all jobs in
-order" tool; for stable ordering, pass an explicit sort/query to
-`board.jobs.list` yourself.
+- Taxonomy and location pages enter the sitemap at five distinct jobs,
+  `MIN_JOBS_PER_INDEXED_PAGE`.
+- Marketing URLs follow context feature flags for impressum, talent directory,
+  and employers. Blog is listed only when `features.blog` is enabled.
+- Salary index reads use `context().language`, producing board-language
+  canonical salary slugs. Job, company, market, and blog slugs arrive
+  canonical on the wire.
+- Collections with `count` enumerate offsets in parallel up to the API's
+  10,000-offset window. Cursor walks stop after 200 pages. Both paths warn when
+  their backstop truncates output.
+- XML escaping and hosted byte layout come from `renderUrlset` and
+  `renderSitemapIndex`.
 
-## Named exclusions (v1 API gap — not bugs)
+Cursor and offset order may move while a large board changes. That is safe for
+this deduplicated sitemap heuristic. Use an explicit sort or search with
+`board.jobs.list` for a stable ordered export.
 
-Two URL families the HOSTED sitemap emits are deliberately absent, because
-v1 exposes them only per-slug and a bulk-pairs endpoint doesn't exist yet
-(per-slug N+1 is ~1k+ calls per build):
+## Preserve the named v1 exclusions
 
-- Cross-axis salary pages (title×location, skill×location,
-  company×category, and the per-entity `/locations` · `/titles` ·
-  `/skills` salary index pages).
-- Jobs place×category / place×skill combination listings.
+The walker omits families that v1 can discover only through per-slug N+1
+reads: cross-axis salary pages (title×location, skill×location,
+company×category, and per-entity salary indexes) and job
+place×category/place×skill combinations. Internal links keep them reachable
+until a bulk-pairs endpoint lets the walker add them.
 
-Both stay reachable through internal links. When the bulk endpoint lands,
-the walker picks them up additively — don't hand-enumerate them.
+## Publish discovery
 
-## Anti-patterns
+At the site root, point robots.txt at the index:
 
-```ts snippet
-// NEVER emit every taxonomy page unconditionally — the ≥5-job floor exists
-// to keep thin pages out of the index:
-for (const c of allCategories) urls.push(`${origin}/jobs/${c.slug}`); // wrong
-// NEVER hand-build the XML with a template string per route — use
-// renderUrlset/renderSitemapIndex (escaping + byte-parity with hosted).
-// NEVER fetch every salary detail page to discover cross-axis pairs (N+1).
+```txt
+Sitemap: https://jobs.example.com/sitemap.xml
 ```
 
-## Verify
+## Completion gate
+
+Finish only after every applicable check passes:
 
-- [ ] `/sitemap.xml` lists one file per bucket (no `blog` entry when the
-      feature is off) and every listed file returns valid XML.
-- [ ] A category with 4 jobs is absent from `jobs-categories.xml`; one with
-      5 is present.
-- [ ] `jobs-details-2.xml` style chunk names round-trip through
-      `parseBucketFilename` and unknown filenames 404.
-- [ ] robots.txt points at `/sitemap.xml`.
+- `/sitemap.xml` lists all enabled buckets, omits blog when disabled, and every
+  listed file returns valid XML, including empty buckets.
+- A taxonomy page with four distinct jobs is absent and one with five is
+  present.
+- `jobs-details-2.xml` round-trips through `parseBucketFilename`; an unknown
+  filename returns 404.
+- More than 45,000 URLs produce numbered `-2`, `-3`, and later files without
+  dropping or duplicating a URL.
+- robots.txt points to the absolute `/sitemap.xml` URL.
+- No excluded N+1 URL family is enumerated outside the walker.

package/skills/cavuno-board-smoke-test/SKILL.md

@@ -1,104 +1,69 @@
 ---
 name: cavuno-board-smoke-test
-description: Runtime verification for a wired Cavuno board frontend — literal curl probes against the Board API plus per-surface behavioral checks and a mandatory production-build pass. Run after cavuno-board-setup finishes, after upgrading @cavuno/board, or whenever board wiring is suspect. Type checks are not enough for board wiring.
+description: Prove a Cavuno board integration at runtime. Use after initial setup, an @cavuno/board upgrade, a board-key rotation, or when rendered board data is unexpectedly missing.
 ---
 
-# Smoke-testing a Cavuno board frontend
+# Smoke-test a Cavuno board
 
-Type checks prove the code compiles against the SDK; they do not prove the
-app reaches the right board with the right credentials, or that gating,
-auth, and SEO surfaces behave. Verify at runtime, in this order.
+Follow the layers in order. Each passing layer narrows the next failure to app wiring rather than credentials or the public API.
 
-## When to use
-
-- Right after `cavuno-board-setup` completes.
-- After upgrading `@cavuno/board` or rotating the `pk_…` key.
-- When any surface renders empty and you don't know which layer is wrong.
-
-## 0 — Run `doctor` first (deterministic pass)
+## 1. Run doctor
 
 ```bash
 PUBLIC_CAVUNO_BOARD=pk_... \
   npx @cavuno/board doctor --frontend http://localhost:3000
 ```
 
-Doctor codifies the static checks (env shape, API reachability) and the
-read probes (home/jobs render, JobPosting JSON-LD, sitemap, robots) as
-pass/fail/skip with a non-zero exit on failure — anything it SKIPS is
-named in its summary and still needs the manual checks below. Use the
-rest of this skill for the behavioral checks doctor does not automate
-(auth flows, gating semantics, production build).
+Doctor checks environment shape, API reachability, installed skills, and—when `--frontend` is present—rendered pages, sitemap, robots rules, and JobPosting structured data. It is read-only and reports every skipped check.
 
-Doctor is non-destructive. It validates configuration, the public Board API,
-installed skills, and—when `--frontend` is provided—rendered pages, sitemaps,
-robots rules, and JobPosting structured data. It never creates users,
-applications, or alerts and needs no Cavuno operator credentials.
+**Complete when:** doctor exits zero and every skip that applies to an implemented surface is recorded for manual verification below.
 
-## 1 — Probe the API directly (before blaming app code)
+## 2. Probe the public API
 
-Use the real `PUBLIC_CAVUNO_BOARD` value the app reads. The SDK and doctor use `https://api.cavuno.com` by default; set `PUBLIC_CAVUNO_API_URL` only for a Cavuno-supplied non-production override. Expected outputs are exact.
+Use the exact board value and API origin read by the app:
 
 ```bash
 CAVUNO_API_URL="${PUBLIC_CAVUNO_API_URL:-https://api.cavuno.com}"
 
-# Board context: MUST return JSON with "object": "public_board" and your
-# board's name — not an HTML error page, not {"error":{"code":"boards_not_found"}}.
 curl -s "$CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD" | head -c 300
-
-# Jobs list: MUST return {"object":"list", ... "data":[...]}. An empty data
-# array on a board you know has jobs means the wrong board identifier.
 curl -s "$CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD/jobs?limit=2" | head -c 300
-
-# Error envelope: a bogus job slug MUST return the v1 error shape with
-# "code":"jobs_not_found" — anything else means a proxy is rewriting responses.
 curl -s "$CAVUNO_API_URL/v1/boards/$PUBLIC_CAVUNO_BOARD/jobs/definitely-not-a-job"
 ```
 
-On a password-protected board, every content read above returns 401 with
-`"code":"board_password_required"` — that is correct behavior, not a
-failure; verify the grant flow in step 3 instead.
+The context response has `"object":"public_board"` and the expected name. The jobs response has `"object":"list"` and a `data` array. The fabricated slug has the v1 error code `jobs_not_found`. A protected board instead returns `board_password_required` for content reads; that is the expected pre-grant state.
+
+Pause here when the API is unreachable, resolves a different board, or returns a non-v1 envelope. Report this layer as the blocker and preserve app code.
+
+**Complete when:** identity, list shape, and error-envelope probes match the expected board, or the protected-board challenge is confirmed.
+
+## 3. Probe the development app
+
+Start the app and verify:
 
-## 2 — Verify the app serves board data
+- The shell renders the name and logo from `board.context()`.
+- A listing renders real jobs and links to `/companies/:companySlug/jobs/:jobSlug`.
+- A fabricated job route renders the app's not-found state.
 
-Start the app (dev is fine for this step) and probe its own routes:
+**Complete when:** all three behaviors are visible through the app rather than inferred from types or source code.
 
-- The home/shell renders the board name and logo from `board.context()`.
-- A listing page shows real job cards; a card links to
-  `/companies/:companySlug/jobs/:jobSlug` (never `/jobs/:slug`).
-- A fabricated job URL renders the app's not-found state — a handled
-  `isNotFound` branch, not a crash or blank page.
+## 4. Exercise each implemented stateful surface
 
-## 3 — Per-surface behavioral checks (only for surfaces you built)
+Run only the branches the app exposes:
 
-- **Auth**: register → the verification gate appears; login → an authed
-  read (`me.retrieve`) succeeds; after `auth.logout()` the same read fails
-  with a 401 that the app handles by signing out, not looping.
-- **Password gate**: with protection enabled, an anonymous content read
-  redirects to the password page; `password.verify()` + retry renders
-  content; a wrong password shows `board_password_invalid` messaging.
-- **Saved jobs / apply**: save → reload → still saved (server state, not
-  local); a second apply to the same job returns the same application
-  (idempotent), not a duplicate.
-- **Paywall** (gated boards): anonymous list shows the `gatedCount` upsell;
-  an entitled login makes the same URL return the ungated view.
-- **Alerts**: subscribe → `status: "submitted"`; repeat → same uniform `"submitted"` (never reveals already-subscribed).
+- **Auth:** register, observe verification state, log in, prove `me.retrieve`, log out, then prove the app handles the next authenticated read as signed out.
+- **Password gate:** confirm the anonymous challenge, verify the password, retry successfully, then confirm a wrong password renders `board_password_invalid`.
+- **Saved jobs and applications:** save and reload to prove server persistence; submit the same application twice and confirm one application identity.
+- **Paywall:** compare the anonymous `gatedCount` state with the entitled view at the same URL.
+- **Alerts:** submit twice and confirm both responses preserve the uniform `submitted` state.
 
-## 4 — Production build (mandatory)
+Pause a branch when its board password or test account is unavailable and report the exact credential needed.
 
-Dev servers mask wiring bugs (looser env loading, dev-only middleware, no
-tree-shake). Run the app's real build, boot the production output, and
-repeat step 2 against it. `import 'server-only'`-style boundaries and env
-prefixes (`VITE_`, `NEXT_PUBLIC_`) frequently pass dev and fail prod.
+**Complete when:** every implemented branch passes or has an explicit credential blocker; logout and refresh paths terminate without loops.
 
-## Out of scope — do not invent checks
+## 5. Prove the production artifact
 
-No load testing, no Lighthouse/SEO scoring, no visual regression — those
-are app-owned. This skill verifies board wiring only.
+Run the app's production build, boot that output, and repeat the three app probes from step 3 against it. Use the app's real production command and environment-loading path.
 
-## Stop conditions
+**Complete when:** the build succeeds and the running production artifact passes the shell, listing/detail-link, and not-found probes.
 
-Stop and report to the human when: step 1 fails (the problem is
-credentials/network, not code — do not "fix" app code to compensate); the
-API returns codes the app has no branch for; or a check needs a credential
-you don't have (board password, test account). Never commit real
-credentials while fixing findings.
+The smoke test covers Cavuno board wiring. Performance, visual regression, and broader SEO scoring belong to their dedicated project checks.

package/skills/manifest.json

@@ -1,173 +1,159 @@
 {
-  "version": "2.0.3",
+  "version": "3.0.0",
   "skills": [
     {
       "name": "cavuno-board-account",
-      "description": "Candidate account self-service with the @cavuno/board SDK — me.retrieve/delete, the candidate profile (merge-patch update, handle availability), experience/education CRUD, skills/languages full-replace, avatar upload, resume upload with async parse polling, and notification preferences plus the anonymous token unsubscribe. Use when building account, profile-edit, onboarding, or notification-settings pages for a signed-in board user.",
+      "description": "Candidate self-service boundary with @cavuno/board. Use for account, profile, resume onboarding, avatar, experience, education, skills, languages, or notification preferences.",
       "path": "skills/cavuno-board-account/SKILL.md",
       "framework": null,
       "category": "core"
     },
+    {
+      "name": "cavuno-board-api-client",
+      "description": "Configure the @cavuno/board API client. Use when creating the shared client, adding global hooks or headers, passing framework fetch options, or calling an endpoint through the typed escape hatch.",
+      "path": "skills/cavuno-board-api-client/SKILL.md",
+      "framework": null,
+      "category": "core"
+    },
     {
       "name": "cavuno-board-applications",
-      "description": "The native apply flow with the @cavuno/board SDK — jobs.apply (signed-in or guest), attaching a resume via jobs.uploadApplicationResume, the jobs.myApplication \"have I applied?\" check, managing submitted applications (me.applications list/retrieve/updateFacts/withdraw), and saved jobs (me.savedJobs). Use when building an apply form, an application-tracker page, or a save-job button.",
+      "description": "Candidate application handoff with @cavuno/board. Use for native or guest apply, application tracking, resume attachment, withdrawal, and saved jobs.",
       "path": "skills/cavuno-board-applications/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-auth",
-      "description": "Authenticate board users with the @cavuno/board SDK — register, login, refresh, logout, email verification and password reset. Covers bearer-JWT storage modes, the deliberate no-auto-refresh-on-401 rule (and single-flight handling), and the server-side httpOnly-cookie pattern that keeps tokens out of the browser.",
+      "description": "Authenticate Cavuno board users. Use for registration, login, logout, token refresh, email verification, password recovery, magic links, OAuth, or authenticated board-user calls.",
       "path": "skills/cavuno-board-auth/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-blog",
-      "description": "Build the blog with the @cavuno/board SDK — post archives (blog.posts.list with tagSlug/authorSlug/featured), the post page (blog.posts.retrieve + adjacent + similar), blog.tags and blog.authors, and free-text blog.search. Covers the summary-vs-detail split (html on the single read only), cursor pagination, slug-change redirects (redirected/newSlug), and the SEO fields the API actually returns.",
+      "description": "Public blog reads with @cavuno/board. Use for post archives, post detail, adjacent or similar posts, tag and author pages, or blog search.",
       "path": "skills/cavuno-board-blog/SKILL.md",
       "framework": null,
       "category": "core"
     },
-    {
-      "name": "cavuno-board-client",
-      "description": "Create and configure the @cavuno/board client — the pk_ board identifier, optional API-origin override, global headers, hooks, per-call FetchOptions, and the rule that keeps one shared instance safe under SSR.",
-      "path": "skills/cavuno-board-client/SKILL.md",
-      "framework": null,
-      "category": "core"
-    },
     {
       "name": "cavuno-board-companies",
-      "description": "Build company surfaces with the @cavuno/board SDK — the companies index (companies.list / companies.search with the market filter), the company profile (companies.retrieve, listJobs, similar), the markets sub-surface (companies.markets + markets.resolve with its 308 redirectTo), and company salary pages (companies.salaries + salaries.category). Covers PublicCompany vs PublicCompanyDetail and envelope pagination.",
+      "description": "Company catalog reads with @cavuno/board. Use for company indexes, market archives, profiles, company job rails, similar companies, or company salary pages.",
       "path": "skills/cavuno-board-companies/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-errors",
-      "description": "Handle errors and access gating with the @cavuno/board SDK — the BoardApiError shape, the typed guards (isNotFound, isUnauthorized, isValidationError, isRateLimited, isForbidden, isConflict), and the board-password flow (isBoardPasswordRequired → password.verify → X-Board-Access grant).",
+      "description": "Classify Board API failures and board-password challenges. Use when mapping SDK errors to UI states, retries, support diagnostics, or password-gated access.",
       "path": "skills/cavuno-board-errors/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-filters",
-      "description": "The canonical listing-filter vocabulary and URL search-param parsing with @cavuno/board/filters — remote/employment/seniority/company/sort sets, localized seniority labels, and parseListingFilters for jobs-listing routes. Use when building listing pages, filter sidebars, sort dropdowns, or validating listing URL params.",
+      "description": "Listing-filter contracts with @cavuno/board. Use for job filter controls, sort controls, listing URL validation, or taxonomy-backed filter options.",
       "path": "skills/cavuno-board-filters/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-format",
-      "description": "Display formatting for board frontends with @cavuno/board/format — salary ranges, seniority/employment/remote labels, location labels, dates, and the board-language salary lexicon. Use when rendering job cards, detail pages, or salary figures, and whenever a value like salaryMin/salaryTimeframe/seniority needs to become display text.",
+      "description": "Board-language display formatting with @cavuno/board/format. Use for salary ranges, dates, job labels, location labels, card conversion, or salary metadata copy.",
       "path": "skills/cavuno-board-format/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-i18n",
-      "description": "Multi-language chrome for a board frontend — the single-language board model, the uiCopy catalog ⊕ operator labels ⊕ generated copy layering, the one copy seam, and how to add path-prefixed locales (/de/, /fr/) with Paraglide JS on TanStack Start. Use when localizing a starter's chrome, adding a language, or wiring locale routing. Do NOT use to translate job content — that stays the board's language.",
+      "description": "One-seam board localization with @cavuno/board. Use when localizing UI chrome, adding locale routing, merging operator labels, or preserving board-language content.",
       "path": "skills/cavuno-board-i18n/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-job-alerts",
-      "description": "Build job-alert flows with the @cavuno/board SDK — the anonymous double-opt-in surface (jobAlerts.subscribe/confirm/resendConfirmation + HMAC-token manage/unsubscribe/resubscribe/updatePreference/deletePreference) and the authenticated board.me.alerts CRUD. Covers which surface to use when, how the manage token rides, which filters actually scope delivery, and the full-replace update trap.",
+      "description": "Job-alert two-lane model with @cavuno/board. Use for anonymous double opt-in, token-managed preferences, or signed-in alert CRUD.",
       "path": "skills/cavuno-board-job-alerts/SKILL.md",
       "framework": null,
       "category": "core"
     },
-    {
-      "name": "cavuno-board-job-posting",
-      "description": "Build the anonymous \"Post a job\" funnel with the @cavuno/board SDK — jobPosting.plans, create and its status-discriminated JobPostingResult (checkout / published / pending_approval / invoice_sent), logo upload + fetchLogoByDomain, and the email-verified billing helpers (sendBillingVerification, getBillingOptions).",
-      "path": "skills/cavuno-board-job-posting/SKILL.md",
-      "framework": null,
-      "category": "core"
-    },
     {
       "name": "cavuno-board-jobs",
-      "description": "Browse, search, and render jobs with the @cavuno/board SDK — jobs.list, jobs.search, jobs.retrieve, jobs.similar. Covers the slim card vs full job shapes, catalog pagination (count/limit/offset + opaque cursor), filters, and the candidate-paywall gatedCount.",
+      "description": "Job catalog reads with @cavuno/board. Use for job browse or search, job detail, similar jobs, candidate gating, or full-catalog iteration.",
       "path": "skills/cavuno-board-jobs/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-messaging",
-      "description": "Build the board-user messaging inbox with the @cavuno/board SDK — me.conversations (list, unreadCount, retrieve, listMessages, start, reply, markRead, archive), me.messages (edit, unsend, report), me.blocks. Covers the polled-REST contract (no realtime transport in v1), visibility-aware polling, the unread badge, and read receipts.",
+      "description": "Polled messaging contract with @cavuno/board. Use for inboxes, unread badges, threads, read receipts, message moderation, or user blocks.",
       "path": "skills/cavuno-board-messaging/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-paywall",
-      "description": "Build the candidate job-access paywall with the @cavuno/board SDK — anonymous offer reads (paywall.offers), the gated browse experience (gatedCount on job lists), the embedded Stripe checkout mount kit (me.access.checkout → retrieveCheckout → grant), and the billing portal (me.access.portal for recurring grants).",
+      "description": "Grant-is-truth candidate paywall with @cavuno/board. Use for offers, gated job counts, embedded checkout handoff, access confirmation, or subscription portal links.",
       "path": "skills/cavuno-board-paywall/SKILL.md",
       "framework": null,
       "category": "core"
     },
+    {
+      "name": "cavuno-board-post-a-job",
+      "description": "Post a job publicly with @cavuno/board. Use for plan selection, logos, checkout handoff, or verified existing credit.",
+      "path": "skills/cavuno-board-post-a-job/SKILL.md",
+      "framework": null,
+      "category": "core"
+    },
     {
       "name": "cavuno-board-salaries",
-      "description": "Build salary pages with the @cavuno/board SDK — salaries.titles/skills/locations (list + retrieve + cross-axis .locations/.location/.titles/.skills), salaries.companies.list. Covers the sourceSlug/canonicalSlug 308 contract, the { locale } overlay, aggregate field shapes (avg/median/percentile bands + jobCount), and why salary math must never be recomputed client-side.",
+      "description": "Salary read models with @cavuno/board. Use for title, skill, or location salary indexes and detail, cross-axis pages, or the salary companies hub.",
       "path": "skills/cavuno-board-salaries/SKILL.md",
       "framework": null,
       "category": "core"
     },
+    {
+      "name": "cavuno-board-search-suggestions",
+      "description": "Build server-ranked search suggestions with @cavuno/board. Use for company-and-term typeahead, autocomplete dropdowns, or suggestion-controller wiring.",
+      "path": "skills/cavuno-board-search-suggestions/SKILL.md",
+      "framework": null,
+      "category": "core"
+    },
     {
       "name": "cavuno-board-seo",
-      "description": "Structured data + head builders for board frontends with @cavuno/board/seo — Google for Jobs JobPosting JSON-LD, breadcrumbs, blog Article/ProfilePage, salary-page Occupation/FAQ structured data, and listing <head> descriptors. Use when building a job-detail, listing, blog, or salary page and it needs JSON-LD or SEO meta tags, or whenever \"structured data\", \"rich results\", or \"Google for Jobs\" comes up.",
+      "description": "SEO builders with @cavuno/board/seo. Use for JobPosting or breadcrumb JSON-LD, blog schema, salary rich results, or job-listing head metadata.",
       "path": "skills/cavuno-board-seo/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
-      "name": "cavuno-board-server",
-      "description": "SSR session plumbing with @cavuno/board/server — the __Host- httpOnly session-cookie codec (BoardSession serialize/parse/clear + the 5-minute isExpiringSoon window), the board-password grant-cookie codec with the open-redirect guards (safeRedirectPath, currentPathFromReferer), and createSessionRefresher, the single-flight rotation helper for the single-use refresh token. Use when wiring board-user auth or the board-password gate into any server-rendered frontend (TanStack Start, Next.js, Remix, Workers).",
-      "path": "skills/cavuno-board-server/SKILL.md",
+      "name": "cavuno-board-server-sessions",
+      "description": "Wire Cavuno server sessions and board-password access. Use when a server-rendered app needs httpOnly cookies, per-request bearer headers, single-flight refresh, grant cookies, or safe redirect-back handling.",
+      "path": "skills/cavuno-board-server-sessions/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-setup",
-      "description": "End-to-end orchestrator for building a headless Cavuno job board with the @cavuno/board SDK. Start here after `npx @cavuno/board setup` copies the skills — detect the framework, wire the client, render board context, jobs browsing and detail, board-user auth and saved jobs, handle errors and access gating, then verify.",
+      "description": "Orchestrate a headless Cavuno board integration. Use when starting a frontend with @cavuno/board or adding Cavuno board surfaces to an existing app.",
       "path": "skills/cavuno-board-setup/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-sitemap",
-      "description": "Build the board's sitemap with @cavuno/board/sitemap — the hosted 8-bucket model (marketing, jobs taxonomies, job details, companies, salaries, blog), 45k chunking, XML rendering, and the buildBucketUrls walker that enumerates a board's content through the BoardSdk with the hosted SEO rules built in (feature gating, ≥5-job thin-content floor, pagination backstops). Use when adding /sitemap.xml and /sitemap/:file routes to a custom board frontend.",
+      "description": "Board sitemap generation with @cavuno/board/sitemap. Use for sitemap indexes, bucket routes, XML rendering, catalog walking, chunking, or robots.txt discovery.",
       "path": "skills/cavuno-board-sitemap/SKILL.md",
       "framework": null,
       "category": "core"
     },
     {
       "name": "cavuno-board-smoke-test",
-      "description": "Runtime verification for a wired Cavuno board frontend — literal curl probes against the Board API plus per-surface behavioral checks and a mandatory production-build pass. Run after cavuno-board-setup finishes, after upgrading @cavuno/board, or whenever board wiring is suspect. Type checks are not enough for board wiring.",
+      "description": "Prove a Cavuno board integration at runtime. Use after initial setup, an @cavuno/board upgrade, a board-key rotation, or when rendered board data is unexpectedly missing.",
       "path": "skills/cavuno-board-smoke-test/SKILL.md",
       "framework": null,
       "category": "core"
-    },
-    {
-      "name": "cavuno-board-suggest",
-      "description": "Federated keyword search suggestions with the @cavuno/board SDK — board.search.suggest for companies + taxonomy terms in one server-ranked list, and the headless createSuggestController under @cavuno/board/suggest (debounce, abort, stale-drop). Use when building a search dropdown, typeahead, or autocomplete that mirrors the hosted board.",
-      "path": "skills/cavuno-board-suggest/SKILL.md",
-      "framework": null,
-      "category": "core"
-    },
-    {
-      "name": "cavuno-board-tanstack-start",
-      "description": "TanStack-Start-on-Cloudflare-Workers reference wiring for a headless Cavuno board — SSR loaders calling @cavuno/board server-side, the session held in an __Host- httpOnly cookie owned by the app, a single-flight refresh helper, and FetchOptions cache passthrough on Workers.",
-      "path": "skills/flavors/tanstack-start/SKILL.md",
-      "framework": "tanstack-start",
-      "category": "flavor"
-    },
-    {
-      "name": "cavuno-board-theme",
-      "description": "Optional hosted-board theme compatibility with @cavuno/board/theme. Use only when a custom frontend deliberately mirrors or migrates an existing Cavuno hosted theme; the consuming application normally owns tokens, fonts, and color mode.",
-      "path": "skills/cavuno-board-theme/SKILL.md",
-      "framework": null,
-      "category": "core"
     }
   ]
 }