@cavuno/board 4.7.0 → 4.9.0

package/CHANGELOG.md

@@ -3,6 +3,41 @@
 This changelog records changes that affect Board API compatibility, exported
 types, runtime behavior, or supported integration patterns.
 
+## 4.9.0 — 2026-08-27
+
+- **`@cavuno/board/seo-files`**: new dependency-free subpath with
+  `robotsResponse`, `adsTxtResponse`, `indexNowResponse`, and
+  `googleSiteVerificationMeta`. Headless frontends serve `robots.txt`,
+  `ads.txt`, and `indexnow-key.txt` byte-identically to hosted boards from
+  `board.seo()`; the robots body now includes `Disallow: /go/` and
+  `Disallow: /t/` like hosted boards.
+- **Doctor**: `--frontend` probes gained `read.adsTxt`, `read.indexNow`,
+  `read.googleVerification`, and `read.oauthCallback`, and `read.robots` now
+  checks the `Sitemap:` line and `/go/` disallow. Results gained an additive
+  `warn` status (`DoctorSummary.warned`) that never fails the run; a file that
+  is served while unconfigured in the dashboard, or a missing OAuth callback
+  forward, warns instead of failing. Read probes run serially and retry a
+  503 child sitemap once.
+- **`board.context()`**: exposes `ads` (`enabled`, `clientId`) and
+  `jobForm` visibility, typed as `PublicBoardAds` and `PublicBoardJobForm`.
+  Employer companies expose `deletionEnabled`.
+- **Taxonomy lists** accept `sort: 'jobCount'` to order collections by live
+  job count.
+- **Generated types** cover the `candidate.profile.updated` webhook event
+  and the operator candidate sync resources (`CandidateSyncSnapshot`,
+  `CandidateReconcileResult`, and related bodies).
+
+## 4.8.0 — 2026-08-23
+
+- **Country-gated Apply flows**: compatible starters can use
+  `board.jobs.createApplyIntent` for opaque external-apply redirects and
+  `board.jobs.prepareApplyApproval` before native Apply. The browser completes
+  country approval directly against the Cavuno Apply gateway, then returns the
+  opaque receipt through the existing `board.jobs.apply` call. New job payloads
+  expose `applyAction`, and native Apply accepts `approvalReceipt` plus the
+  matching server-owned `approvalSessionKey`. These additions keep destination
+  URLs and client-supplied country or IP values out of the trusted decision.
+
 ## 4.7.0 — 2026-08-23
 
 - **`board.me.companies.recommendedTalent.list`**: candidates who fit one of

package/dist/{_spec-B2ZrXuea.d.mts → _spec-B9Ah8dNs.d.mts}

@@ -127,11 +127,40 @@ interface components {
                 companyName: string | null;
             } | null;
         };
+        ApplyApprovalPlan: {
+            /** @enum {string} */
+            object: "apply_approval_plan";
+            /** @enum {string} */
+            kind: "not_required";
+        } | {
+            /** @enum {string} */
+            object: "apply_approval_plan";
+            /** @enum {string} */
+            kind: "approval_required";
+            /** Format: uri */
+            approvalUrl: string;
+            /** Format: date-time */
+            expiresAt: string;
+        };
         ApplyBody: {
             name?: string;
             /** Format: email */
             email?: string;
             coverNote?: string;
+            /** @description Opaque native country-approval receipt returned by the browser-direct Apply gateway. */
+            approvalReceipt?: string;
+            /** @description Server-owned board session key that prepared the country approval. */
+            approvalSessionKey?: string;
+        };
+        ApplyIntent: {
+            /** @description Opaque one-time Apply intent token. */
+            id: string;
+            /** @enum {string} */
+            object: "apply_intent";
+            /** Format: uri */
+            gatewayUrl: string;
+            /** Format: date-time */
+            expiresAt: string;
         };
         Block: {
             /** @enum {string} */
@@ -329,6 +358,7 @@ interface components {
             handle: string | null;
             headline: string | null;
             location: string | null;
+            countryCode: string | null;
             /** @enum {string} */
             profileVisibility: "hidden" | "logged_in_only" | "public";
             /** @enum {string} */
@@ -634,6 +664,12 @@ interface components {
             object: "conversation_ref";
             conversationId: string | null;
         };
+        CreateApplyApprovalBody: {
+            sessionKey: string;
+        };
+        CreateApplyIntentBody: {
+            sessionKey: string;
+        };
         CreateCompanyBody: {
             /** @description Public company website URL. Normalized to a canonical apex domain when stored. */
             website?: string;
@@ -925,6 +961,8 @@ interface components {
             linkedinUrl: string | null;
             facebookUrl: string | null;
             logoUrl: string | null;
+            /** @description Whether company admins may delete this company. Mirrors the board Features toggle `employerCompanyDeletionEnabled`. Absent board config defaults to `true`. When `false`, DELETE returns 403 `company_deletion_disabled` and clients should hide the danger zone. */
+            deletionEnabled: boolean;
         };
         EmployerCreateJobBody: {
             /** @description Long-form description of the role. Up to 25,000 characters. */
@@ -1578,8 +1616,9 @@ interface components {
             /** @enum {string} */
             object: "notification_preference";
             /** @enum {string} */
-            channel: "messageEmails" | "applicationEmails";
+            channel: "messageEmails" | "applicationEmails" | "recommendedJobEmails";
             subscribed: boolean;
+            waitlisted: boolean;
             updatedAt: number | null;
         };
         PaywallOffer: {
@@ -1753,6 +1792,10 @@ interface components {
             showCavunoBranding: boolean;
             features: {
                 jobAlerts: boolean;
+                /** @description Whether personalized candidate job recommendations are available on this board. Absent board config defaults to `true`. */
+                jobRecommendationsEnabled: boolean;
+                /** @description Whether the board-level Recommended talent toggle is enabled. The endpoint additionally requires the Candidate area and a non-off talent directory. Absent board config defaults to `false`. */
+                recommendedTalentEnabled: boolean;
                 candidates: boolean;
                 employers: boolean;
                 blog: boolean;
@@ -1778,11 +1821,37 @@ interface components {
                 linkedInPartnerId: string | null;
                 cookieConsentRequired: boolean;
             };
+            /** @description Public AdSense switch + publisher id from board advertising settings. Not the slot map (Puck/Cavuno placements) and not `ads.txt` (`board.seo()`). */
+            ads: {
+                /** @description Whether AdSense is turned on for this board (Settings → Advertising). Headless frontends render their own placements only when this is true and `clientId` is a valid `ca-pub-` publisher id. Per-placement slot ids are not on this resource — applications own geometry. */
+                enabled: boolean;
+                /** @description AdSense publisher id (`ca-pub-` + 16 digits), or null when ads are off or the stored value is malformed. Already public on hosted pages as `data-ad-client`. */
+                clientId: string | null;
+            };
             /** @description Operator-defined custom field definitions keyed by model (currently only `job`). Each key holds that model's definitions in display order. Company and talent keys are added when those models ship. The frontend uses these to render and localize each record's opaque `customFieldValues`. Display-only: not filterable or searchable in v1. */
             customFields: {
                 /** @description This model's custom-field definitions in display order. Empty when the board defines none for the model. */
                 job: components["schemas"]["CustomFieldDefinition"][];
             };
+            /** @description Built-in job-form field visibility from Settings → Job form. Does not include custom fields (`customFields.job`) or operator-only constraints (required, bounds, allowlists). */
+            jobForm: {
+                salary: {
+                    /** @description Whether salary is captured on posting forms and shown on public job cards. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+                seniority: {
+                    /** @description Whether seniority is captured on posting forms. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+                location: {
+                    /** @description Whether office location is captured on posting forms. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+                sponsorship: {
+                    /** @description Whether visa sponsorship is captured on posting forms. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+            };
             /** @description Operator-authored contact and social identity (settings › Contact & company details). Extracted from the former `footer` group in 4.0.0: contact is identity data, not layout. Brand/social URLs are sanitized to absolute http(s). */
             contact: {
                 /** @description Public contact email (render as `mailto:`). Operator-set in settings › Contact & company details. */
@@ -1880,6 +1949,9 @@ interface components {
             description: string | null;
             /** @description Where candidates apply, or `null` if not specified. An HTTPS URL or `mailto:` URI. */
             applicationUrl: string | null;
+            isSponsored: boolean;
+            /** @enum {string} */
+            applyAction: "native" | "external_direct" | "gateway_external" | "gateway_native";
             /** @description Hierarchical permit selection authored by the board owner. The three `remoteWorkPermit*` and `remoteWorldwide` fields are read-only derived projections. */
             remotePermits: {
                 type: string;
@@ -2156,6 +2228,8 @@ interface components {
             canonicalSlug: string;
             /** @description Board-language name with source-name fallback. */
             displayName: string;
+            /** @description Live published-job count for this term on the board. Maintained as jobs publish and expire — not a tally of the current list page. */
+            jobCount: number;
         };
         PublicVerifyBoardPasswordBody: {
             /** @description The board password. */
@@ -2761,7 +2835,7 @@ interface components {
         UnsubscribeBody: {
             boardUserId: string;
             /** @enum {string} */
-            channel: "messageEmails" | "applicationEmails";
+            channel: "messageEmails" | "applicationEmails" | "recommendedJobEmails";
             token: string;
         };
         UpdateApplicationFactsBody: {
@@ -2778,6 +2852,7 @@ interface components {
             handle?: string;
             headline?: string;
             location?: string;
+            countryCode?: string | null;
             /** @enum {string} */
             profileVisibility?: "hidden" | "logged_in_only" | "public";
             /** @enum {string} */
@@ -2832,7 +2907,7 @@ interface components {
         };
         UpdateNotificationPreferenceBody: {
             /** @enum {string} */
-            channel: "messageEmails" | "applicationEmails";
+            channel: "messageEmails" | "applicationEmails" | "recommendedJobEmails";
             subscribed: boolean;
         };
         UpdatePasswordBody: {

package/dist/{_spec-B2ZrXuea.d.ts → _spec-B9Ah8dNs.d.ts}

@@ -127,11 +127,40 @@ interface components {
                 companyName: string | null;
             } | null;
         };
+        ApplyApprovalPlan: {
+            /** @enum {string} */
+            object: "apply_approval_plan";
+            /** @enum {string} */
+            kind: "not_required";
+        } | {
+            /** @enum {string} */
+            object: "apply_approval_plan";
+            /** @enum {string} */
+            kind: "approval_required";
+            /** Format: uri */
+            approvalUrl: string;
+            /** Format: date-time */
+            expiresAt: string;
+        };
         ApplyBody: {
             name?: string;
             /** Format: email */
             email?: string;
             coverNote?: string;
+            /** @description Opaque native country-approval receipt returned by the browser-direct Apply gateway. */
+            approvalReceipt?: string;
+            /** @description Server-owned board session key that prepared the country approval. */
+            approvalSessionKey?: string;
+        };
+        ApplyIntent: {
+            /** @description Opaque one-time Apply intent token. */
+            id: string;
+            /** @enum {string} */
+            object: "apply_intent";
+            /** Format: uri */
+            gatewayUrl: string;
+            /** Format: date-time */
+            expiresAt: string;
         };
         Block: {
             /** @enum {string} */
@@ -329,6 +358,7 @@ interface components {
             handle: string | null;
             headline: string | null;
             location: string | null;
+            countryCode: string | null;
             /** @enum {string} */
             profileVisibility: "hidden" | "logged_in_only" | "public";
             /** @enum {string} */
@@ -634,6 +664,12 @@ interface components {
             object: "conversation_ref";
             conversationId: string | null;
         };
+        CreateApplyApprovalBody: {
+            sessionKey: string;
+        };
+        CreateApplyIntentBody: {
+            sessionKey: string;
+        };
         CreateCompanyBody: {
             /** @description Public company website URL. Normalized to a canonical apex domain when stored. */
             website?: string;
@@ -925,6 +961,8 @@ interface components {
             linkedinUrl: string | null;
             facebookUrl: string | null;
             logoUrl: string | null;
+            /** @description Whether company admins may delete this company. Mirrors the board Features toggle `employerCompanyDeletionEnabled`. Absent board config defaults to `true`. When `false`, DELETE returns 403 `company_deletion_disabled` and clients should hide the danger zone. */
+            deletionEnabled: boolean;
         };
         EmployerCreateJobBody: {
             /** @description Long-form description of the role. Up to 25,000 characters. */
@@ -1578,8 +1616,9 @@ interface components {
             /** @enum {string} */
             object: "notification_preference";
             /** @enum {string} */
-            channel: "messageEmails" | "applicationEmails";
+            channel: "messageEmails" | "applicationEmails" | "recommendedJobEmails";
             subscribed: boolean;
+            waitlisted: boolean;
             updatedAt: number | null;
         };
         PaywallOffer: {
@@ -1753,6 +1792,10 @@ interface components {
             showCavunoBranding: boolean;
             features: {
                 jobAlerts: boolean;
+                /** @description Whether personalized candidate job recommendations are available on this board. Absent board config defaults to `true`. */
+                jobRecommendationsEnabled: boolean;
+                /** @description Whether the board-level Recommended talent toggle is enabled. The endpoint additionally requires the Candidate area and a non-off talent directory. Absent board config defaults to `false`. */
+                recommendedTalentEnabled: boolean;
                 candidates: boolean;
                 employers: boolean;
                 blog: boolean;
@@ -1778,11 +1821,37 @@ interface components {
                 linkedInPartnerId: string | null;
                 cookieConsentRequired: boolean;
             };
+            /** @description Public AdSense switch + publisher id from board advertising settings. Not the slot map (Puck/Cavuno placements) and not `ads.txt` (`board.seo()`). */
+            ads: {
+                /** @description Whether AdSense is turned on for this board (Settings → Advertising). Headless frontends render their own placements only when this is true and `clientId` is a valid `ca-pub-` publisher id. Per-placement slot ids are not on this resource — applications own geometry. */
+                enabled: boolean;
+                /** @description AdSense publisher id (`ca-pub-` + 16 digits), or null when ads are off or the stored value is malformed. Already public on hosted pages as `data-ad-client`. */
+                clientId: string | null;
+            };
             /** @description Operator-defined custom field definitions keyed by model (currently only `job`). Each key holds that model's definitions in display order. Company and talent keys are added when those models ship. The frontend uses these to render and localize each record's opaque `customFieldValues`. Display-only: not filterable or searchable in v1. */
             customFields: {
                 /** @description This model's custom-field definitions in display order. Empty when the board defines none for the model. */
                 job: components["schemas"]["CustomFieldDefinition"][];
             };
+            /** @description Built-in job-form field visibility from Settings → Job form. Does not include custom fields (`customFields.job`) or operator-only constraints (required, bounds, allowlists). */
+            jobForm: {
+                salary: {
+                    /** @description Whether salary is captured on posting forms and shown on public job cards. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+                seniority: {
+                    /** @description Whether seniority is captured on posting forms. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+                location: {
+                    /** @description Whether office location is captured on posting forms. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+                sponsorship: {
+                    /** @description Whether visa sponsorship is captured on posting forms. Absent board config defaults to `true`. */
+                    visible: boolean;
+                };
+            };
             /** @description Operator-authored contact and social identity (settings › Contact & company details). Extracted from the former `footer` group in 4.0.0: contact is identity data, not layout. Brand/social URLs are sanitized to absolute http(s). */
             contact: {
                 /** @description Public contact email (render as `mailto:`). Operator-set in settings › Contact & company details. */
@@ -1880,6 +1949,9 @@ interface components {
             description: string | null;
             /** @description Where candidates apply, or `null` if not specified. An HTTPS URL or `mailto:` URI. */
             applicationUrl: string | null;
+            isSponsored: boolean;
+            /** @enum {string} */
+            applyAction: "native" | "external_direct" | "gateway_external" | "gateway_native";
             /** @description Hierarchical permit selection authored by the board owner. The three `remoteWorkPermit*` and `remoteWorldwide` fields are read-only derived projections. */
             remotePermits: {
                 type: string;
@@ -2156,6 +2228,8 @@ interface components {
             canonicalSlug: string;
             /** @description Board-language name with source-name fallback. */
             displayName: string;
+            /** @description Live published-job count for this term on the board. Maintained as jobs publish and expire — not a tally of the current list page. */
+            jobCount: number;
         };
         PublicVerifyBoardPasswordBody: {
             /** @description The board password. */
@@ -2761,7 +2835,7 @@ interface components {
         UnsubscribeBody: {
             boardUserId: string;
             /** @enum {string} */
-            channel: "messageEmails" | "applicationEmails";
+            channel: "messageEmails" | "applicationEmails" | "recommendedJobEmails";
             token: string;
         };
         UpdateApplicationFactsBody: {
@@ -2778,6 +2852,7 @@ interface components {
             handle?: string;
             headline?: string;
             location?: string;
+            countryCode?: string | null;
             /** @enum {string} */
             profileVisibility?: "hidden" | "logged_in_only" | "public";
             /** @enum {string} */
@@ -2832,7 +2907,7 @@ interface components {
         };
         UpdateNotificationPreferenceBody: {
             /** @enum {string} */
-            channel: "messageEmails" | "applicationEmails";
+            channel: "messageEmails" | "applicationEmails" | "recommendedJobEmails";
             subscribed: boolean;
         };
         UpdatePasswordBody: {

package/dist/bin.mjs

@@ -109,7 +109,14 @@ function summarize(results) {
   const passed = results.filter((r) => r.status === "pass").map((r) => r.id);
   const failed = results.filter((r) => r.status === "fail").map((r) => r.id);
   const skipped = results.filter((r) => r.status === "skip").map((r) => r.id);
-  return { exitCode: failed.length > 0 ? 1 : 0, passed, failed, skipped };
+  const warned = results.filter((r) => r.status === "warn").map((r) => r.id);
+  return {
+    exitCode: failed.length > 0 ? 1 : 0,
+    passed,
+    failed,
+    skipped,
+    warned
+  };
 }
 
 // src/doctor/cookie-conformance.ts
@@ -284,7 +291,7 @@ function checkCookieCodecConformance(projectRoot) {
 }
 
 // src/doctor/probe.ts
-var FETCH_TIMEOUT_MS = 1e4;
+var FETCH_TIMEOUT_MS = 6e4;
 async function probe(fetchImpl, url) {
   try {
     const response = await fetchImpl(url, {
@@ -310,7 +317,11 @@ var READ = {
   jobs: record("read.jobs", 2),
   jsonld: record("read.jsonld", 2),
   sitemap: record("read.sitemap", 2),
-  robots: record("read.robots", 2)
+  robots: record("read.robots", 2),
+  adsTxt: record("read.adsTxt", 2),
+  indexNow: record("read.indexNow", 2),
+  googleVerification: record("read.googleVerification", 2),
+  oauthCallback: record("read.oauthCallback", 2)
 };
 function skipReadProbes(reason) {
   return Object.values(READ).map((make) => make("skip", reason));
@@ -366,7 +377,11 @@ async function probeSitemap(fetchImpl, base) {
   }
   let urls = doc.urls;
   if (doc.kind === "index") {
-    const child = await probe(fetchImpl, onFrontend(base, urls[0]));
+    const childUrl = onFrontend(base, urls[0]);
+    let child = await probe(fetchImpl, childUrl);
+    if (!child.ok && (child.status === 503 || child.status === 0)) {
+      child = await probe(fetchImpl, childUrl);
+    }
     const childDoc = child.ok ? parseSitemap(child.body) : null;
     if (!childDoc || childDoc.urls.length === 0) {
       return READ.sitemap(
@@ -380,14 +395,109 @@ async function probeSitemap(fetchImpl, base) {
   const sample = await probe(fetchImpl, sampleUrl);
   return sample.ok ? READ.sitemap("pass", `${urls.length} entries; sample page resolves`) : READ.sitemap("fail", `sitemap page ${sampleUrl} \u2192 HTTP ${sample.status}`);
 }
-async function runReadProbes(fetchImpl, frontendUrl) {
+function scoreRobots(robots, seo) {
+  if (!robots.ok) {
+    return READ.robots("fail", `robots.txt HTTP ${robots.status}`);
+  }
+  const missing = [];
+  if (!/user-agent\s*:/i.test(robots.body)) missing.push("User-agent");
+  if (!robots.body.includes("Disallow: /go/")) missing.push("Disallow: /go/");
+  if (seo) {
+    const canonicalBase = seo.canonicalBase.replace(/\/+$/, "");
+    const sitemapLine = `Sitemap: ${canonicalBase}/sitemap.xml`;
+    if (!robots.body.includes(sitemapLine)) missing.push(sitemapLine);
+  }
+  if (missing.includes("User-agent")) {
+    return READ.robots(
+      "fail",
+      "robots.txt returned 200 but has no User-agent directive"
+    );
+  }
+  return missing.length === 0 ? READ.robots("pass", "present") : READ.robots(
+    "warn",
+    `robots.txt is missing ${missing.join(", ")} (hosted boards emit it)`
+  );
+}
+function configuredText(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function scoreOptionalTextFile(options) {
+  const { make, label, path, seo, probed } = options;
+  if (seo == null) {
+    return make("skip", "board seo not fetched");
+  }
+  const expected = configuredText(options.configured);
+  if (expected !== null) {
+    if (!probed.ok) {
+      return make("fail", `${path} HTTP ${probed.status}`);
+    }
+    if (probed.body.trimEnd() === expected.trimEnd()) {
+      return make("pass", `${label} matches dashboard`);
+    }
+    return make("fail", `${path} body does not match dashboard ${label}`);
+  }
+  if (probed.status === 404) {
+    return make("pass", "unconfigured; 404 as expected");
+  }
+  if (probed.status === 200) {
+    return make(
+      "warn",
+      `${label} served but not configured in dashboard \u2014 clone leftover?`
+    );
+  }
+  return make("fail", `${path} HTTP ${probed.status}`);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function hasGoogleSiteVerificationMeta(html, token) {
+  const escaped = escapeRegExp(token);
+  const quoted = `["']${escaped}["']`;
+  const name = `name\\s*=\\s*["']google-site-verification["']`;
+  const content = `content\\s*=\\s*${quoted}`;
+  return new RegExp(`<meta\\b[^>]*\\b${name}[^>]*\\b${content}`, "i").test(html) || new RegExp(`<meta\\b[^>]*\\b${content}[^>]*\\b${name}`, "i").test(html);
+}
+function scoreGoogleVerification(homeHtml, seo) {
+  if (seo == null) {
+    return READ.googleVerification("skip", "board seo not fetched");
+  }
+  const token = configuredText(seo.googleSiteVerification);
+  if (token === null) {
+    return READ.googleVerification("skip", "no token configured");
+  }
+  return hasGoogleSiteVerificationMeta(homeHtml, token) ? READ.googleVerification("pass", "google-site-verification meta present") : READ.googleVerification(
+    "fail",
+    "home HTML is missing the google-site-verification meta tag"
+  );
+}
+var OAUTH_PROVIDERS = ["google", "linkedin"];
+function scoreOAuthCallback(probed) {
+  const broken = OAUTH_PROVIDERS.filter(
+    (provider) => !(probed[provider].status === 400 && /missing code or state/i.test(probed[provider].body))
+  );
+  return broken.length === 0 ? READ.oauthCallback("pass", "callback paths reach the hosted app") : READ.oauthCallback(
+    "warn",
+    `${broken.map((p) => `/api/board-auth/oauth/${p}/callback \u2192 HTTP ${probed[p].status}`).join(", ")} \u2014 only matters if you registered this domain's callback with the provider: forward the path to cavuno.com, or register https://cavuno.com/api/board-auth/oauth/{provider}/callback instead`
+  );
+}
+async function runReadProbes(fetchImpl, frontendUrl, seo) {
   const base = frontendUrl.replace(/\/$/, "");
-  const [home, jobsAndJsonLd, sitemap, robots] = await Promise.all([
-    probe(fetchImpl, base),
-    probeJobsAndJsonLd(fetchImpl, base),
-    probeSitemap(fetchImpl, base),
-    probe(fetchImpl, `${base}/robots.txt`)
-  ]);
+  const home = await probe(fetchImpl, base);
+  const jobsAndJsonLd = await probeJobsAndJsonLd(fetchImpl, base);
+  const sitemap = await probeSitemap(fetchImpl, base);
+  const robots = await probe(fetchImpl, `${base}/robots.txt`);
+  const adsTxt = await probe(fetchImpl, `${base}/ads.txt`);
+  const indexNow = await probe(fetchImpl, `${base}/indexnow-key.txt`);
+  const oauthCallback = {
+    google: await probe(
+      fetchImpl,
+      `${base}/api/board-auth/oauth/google/callback`
+    ),
+    linkedin: await probe(
+      fetchImpl,
+      `${base}/api/board-auth/oauth/linkedin/callback`
+    )
+  };
   return [
     home.ok && /<(html|body|div|main)[\s>]/i.test(home.body) ? READ.home("pass", "home renders") : READ.home(
       "fail",
@@ -395,10 +505,25 @@ async function runReadProbes(fetchImpl, frontendUrl) {
     ),
     ...jobsAndJsonLd,
     sitemap,
-    robots.ok && /user-agent\s*:/i.test(robots.body) ? READ.robots("pass", "present") : READ.robots(
-      "fail",
-      robots.ok ? "robots.txt returned 200 but has no User-agent directive" : `robots.txt HTTP ${robots.status}`
-    )
+    scoreRobots(robots, seo),
+    scoreOptionalTextFile({
+      make: READ.adsTxt,
+      label: "ads.txt",
+      path: "/ads.txt",
+      seo,
+      configured: seo?.adsTxt,
+      probed: adsTxt
+    }),
+    scoreOptionalTextFile({
+      make: READ.indexNow,
+      label: "indexnow-key.txt",
+      path: "/indexnow-key.txt",
+      seo,
+      configured: seo?.indexNowKey,
+      probed: indexNow
+    }),
+    scoreGoogleVerification(home.body, seo),
+    scoreOAuthCallback(oauthCallback)
   ];
 }
 
@@ -454,6 +579,28 @@ async function checkBoardResolves(fetchImpl, env) {
   }
   return STATIC_BOARD("pass", "publishable key resolves the board");
 }
+async function fetchBoardSeo(fetchImpl, env) {
+  const result = await probe(
+    fetchImpl,
+    `${apiBase(env.apiUrl)}/v1/boards/${encodeURIComponent(env.boardKey)}/seo`
+  );
+  if (!result.ok) return null;
+  try {
+    const parsed = JSON.parse(result.body);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const rec = parsed;
+    if (typeof rec.canonicalBase !== "string") return null;
+    const asNullableString = (value) => value === null || typeof value === "string" ? value : null;
+    return {
+      canonicalBase: rec.canonicalBase,
+      adsTxt: asNullableString(rec.adsTxt),
+      indexNowKey: asNullableString(rec.indexNowKey),
+      googleSiteVerification: asNullableString(rec.googleSiteVerification)
+    };
+  } catch {
+    return null;
+  }
+}
 var SKILL_ROOTS = [
   ".claude/skills",
   ".agents/skills",
@@ -515,8 +662,13 @@ async function runDoctor(options) {
   } else {
     results.push(STATIC_API("skip", "PUBLIC_CAVUNO_API_URL not set"));
   }
+  let seo = null;
   if (envOk) {
-    results.push(await checkBoardResolves(fetchImpl, env));
+    const boardResult = await checkBoardResolves(fetchImpl, env);
+    results.push(boardResult);
+    if (boardResult.status === "pass") {
+      seo = await fetchBoardSeo(fetchImpl, env);
+    }
   } else {
     results.push(STATIC_BOARD("skip", "env checks failed \u2014 fix them first"));
   }
@@ -525,7 +677,7 @@ async function runDoctor(options) {
     ...checkCookieCodecConformance(options.projectRoot ?? process.cwd())
   );
   results.push(
-    ...options.frontendUrl ? await runReadProbes(fetchImpl, options.frontendUrl) : skipReadProbes("no --frontend <url> given")
+    ...options.frontendUrl ? await runReadProbes(fetchImpl, options.frontendUrl, seo) : skipReadProbes("no --frontend <url> given")
   );
   return { results, summary: summarize(results) };
 }
@@ -596,18 +748,21 @@ async function doctor(argv) {
   });
   console.log("\n@cavuno/board doctor");
   for (const result of results) {
-    const mark = result.status === "pass" ? "\u2713" : result.status === "fail" ? "\u2717" : "\u2212";
+    const mark = result.status === "pass" ? "\u2713" : result.status === "fail" ? "\u2717" : result.status === "warn" ? "!" : "\u2212";
     console.log(
       `  ${mark} [tier ${result.tier}] ${result.id} \u2014 ${result.detail}`
     );
   }
   console.log(
     `
-${summary.passed.length} passed, ${summary.failed.length} failed, ${summary.skipped.length} skipped`
+${summary.passed.length} passed, ${summary.failed.length} failed, ${summary.skipped.length} skipped, ${summary.warned.length} warned`
   );
   if (summary.skipped.length > 0) {
     console.log(`  Skipped (NOT verified): ${summary.skipped.join(", ")}`);
   }
+  if (summary.warned.length > 0) {
+    console.log(`  Warned: ${summary.warned.join(", ")}`);
+  }
   if (!frontendUrl) {
     console.log(
       "  Pass --frontend <url> to run the read probes against your board frontend."

package/dist/{blog-B125P3dS.d.mts → blog-BmqWfLZi.d.mts}

@@ -1,4 +1,4 @@
-import { S as Schemas } from './_spec-B2ZrXuea.mjs';
+import { S as Schemas } from './_spec-B9Ah8dNs.mjs';
 
 /** Author shape embedded on posts (no `object` discriminator). */
 type BlogAuthorEmbed = Schemas['PublicBlogAuthorEmbed'];