career-compass-mcp 2.3.0 → 2.4.0

package/build/src/dashboard-lite/server.js

@@ -1,5 +1,5 @@
 import { createServer } from "http";
-import { loadPipeline, isCorruptDataError } from "../storage/file-store.js";
+import { getDataDir, loadPipeline, isCorruptDataError } from "../storage/file-store.js";
 import { renderLiteDashboard } from "./render.js";
 /**
  * Zero-build "lite" dashboard server.
@@ -10,8 +10,79 @@ import { renderLiteDashboard } from "./render.js";
  * of ~/.career-compass, mirroring the force-dynamic guarantee of the Next.js
  * dashboard. Ships in the npm package (pure JS, no framework, no build).
  */
+/**
+ * Host names this server will answer to. Everything else is refused.
+ *
+ * Binding loopback stops the *network* from reaching the dashboard; it does not
+ * stop a web page. Any site the user visits can point a hostname it controls at
+ * 127.0.0.1 and have the browser issue same-origin requests to this server —
+ * DNS rebinding. The one thing that distinguishes those requests from a real
+ * one is the `Host` header, which carries the attacker's name rather than a
+ * loopback name, so checking it is the whole defense.
+ *
+ * The dashboard serves a user's entire job search — companies, salaries,
+ * contacts, interview notes — from a machine-local origin with no auth, which
+ * is exactly the shape of target rebinding exists to reach.
+ */
+const ALLOWED_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+/**
+ * Split the hostname out of a `Host` header value, or reject the value.
+ *
+ * `Host` is `name[":" port]`, but a bracketed IPv6 literal (`[::1]:3141`) and a
+ * bare one (`::1`, which some clients send) both contain colons, so a naive
+ * split on ":" turns `[::1]` into `[`.
+ *
+ * Everything after the name is checked rather than discarded. Taking the left
+ * half of the first colon and asking no questions about the right half let
+ * `localhost:evil.com` and `[::1]evil.com` read as loopback. Nothing can put
+ * those bytes on the wire from a browser — `Host` is built from the URL
+ * authority, so a rebound page still sends its own name — but a parser that
+ * answers a question it was not asked is one refactor away from mattering.
+ * Only `:<digits>` is a port; anything else makes the header malformed, and
+ * malformed is not loopback.
+ */
+function hostnameOf(host) {
+    const h = host.trim().toLowerCase();
+    if (!h)
+        return null;
+    // Bracketed IPv6 literal: nothing may follow the closing bracket but a port.
+    if (h.startsWith("[")) {
+        const bracketed = /^(\[[0-9a-f:.]+\])(?::\d+)?$/.exec(h);
+        return bracketed ? bracketed[1] : null;
+    }
+    // More than one colon and no brackets: a bare IPv6 literal, which cannot
+    // carry a port — the whole value is the hostname, so every character of it
+    // has to be one an address can contain.
+    if (h.split(":").length - 1 > 1) {
+        return /^[0-9a-f:.]+$/.test(h) ? h : null;
+    }
+    const named = /^([^:]+)(?::\d+)?$/.exec(h);
+    return named ? named[1] : null;
+}
+/**
+ * Is this `Host` header one of ours?
+ *
+ * A missing header is refused too. HTTP/1.1 requires it and every browser sends
+ * it, so its absence is either a hand-written request or an attempt to skip the
+ * check — neither is a case worth serving a career history to.
+ */
+export function isAllowedHost(host) {
+    if (!host)
+        return false;
+    const hostname = hostnameOf(host);
+    return hostname !== null && ALLOWED_HOSTNAMES.has(hostname);
+}
 export function createLiteDashboardServer() {
     return createServer(async (req, res) => {
+        // Checked before anything else, including the path: a rejected origin must
+        // not learn which paths exist or how the server responds to them.
+        if (!isAllowedHost(req.headers.host)) {
+            res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+            res.end(`Refused: this dashboard only answers to ${[...ALLOWED_HOSTNAMES].join(", ")}.\n` +
+                `The request arrived with Host: ${req.headers.host ?? "(none)"}.\n\n` +
+                `It binds loopback and is meant to be opened at http://localhost:<port> on this machine.`);
+            return;
+        }
         // Only serve the dashboard at "/"; everything else 404s (favicon, etc.).
         const path = (req.url ?? "/").split("?")[0];
         if (path !== "/" && path !== "/index.html") {
@@ -21,7 +92,9 @@ export function createLiteDashboardServer() {
         }
         try {
             const pipeline = await loadPipeline();
-            const html = renderLiteDashboard(pipeline);
+            // Read per request, like the pipeline itself: the footer names the folder
+            // this page is actually serving, not the default one.
+            const html = renderLiteDashboard(pipeline, getDataDir());
             res.writeHead(200, {
                 "content-type": "text/html; charset=utf-8",
                 // Never cache: the whole point is a live read of local data.

package/build/src/dashboard-lite/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/dashboard-lite/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,MAAM,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,0BAA0B;gBAC1C,6DAA6D;gBAC7D,eAAe,EAAE,2BAA2B;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO;gBACjB,CAAC,CAAC,uGAAwG,GAAa,CAAC,OAAO,EAAE;gBACjI,CAAC,CAAC,+BAAgC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAQ,GAAG,WAAW;IACrE,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,wEAAwE;YACxE,oDAAoD;YACpD,MAAM,EAAE,GAAG,yBAAyB,EAAE,CAAC;YACvC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAAmC;YAC5E,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;gBAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/dashboard-lite/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,MAAM,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;GAQG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CACL,2CAA2C,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC/E,kCAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,OAAO;gBACrE,yFAAyF,CAC5F,CAAC;YACF,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,0BAA0B;gBAC1C,6DAA6D;gBAC7D,eAAe,EAAE,2BAA2B;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO;gBACjB,CAAC,CAAC,uGAAwG,GAAa,CAAC,OAAO,EAAE;gBACjI,CAAC,CAAC,+BAAgC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAQ,GAAG,WAAW;IACrE,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,wEAAwE;YACxE,oDAAoD;YACpD,MAAM,EAAE,GAAG,yBAAyB,EAAE,CAAC;YACvC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAAmC;YAC5E,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;gBAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/src/pipeline-stats.d.ts

@@ -0,0 +1,59 @@
+import type { Application, ApplicationStatus } from "./schemas/career-schema.js";
+/**
+ * The one place a pipeline turns into numbers.
+ *
+ * `pipeline_view action=stats` and the dashboard both answer "what is my
+ * response rate?", and they answered it differently: the tool computed
+ * (total − applied) / total, which counts a role you have only *discovered* —
+ * and never sent anything to — as an employer response, and divides by a
+ * denominator that includes it. On the bundled sample that reported 75% while
+ * the dashboard, doing responded / sent, reported 71%. Two surfaces of one
+ * product disagreeing about the user's own number is worse than either being
+ * wrong: there is no way for them to tell which to believe.
+ *
+ * So the arithmetic lives here and both call it. Adding a stage to the funnel
+ * is now one edit rather than a hunt for every place a status list was inlined.
+ */
+/**
+ * Stages a search is still live in — nothing has closed the door yet.
+ *
+ * `discovered` belongs here: a role you have found and not yet applied to is
+ * live work, and the board shows it as a column.
+ */
+export declare const ACTIVE_STATUSES: readonly ApplicationStatus[];
+/**
+ * Did this application actually get sent?
+ *
+ * Everything past `discovered` did. This is the denominator for both rates
+ * below, because a role you never applied to cannot answer you and cannot
+ * ghost you — including it only dilutes the number you were asking about.
+ */
+export declare function wasSent(app: Application): boolean;
+/**
+ * Did the employer come back?
+ *
+ * Anything past `applied` means someone on the other side acted, except
+ * `ghosted`, which is the recorded absence of exactly that.
+ *
+ * `withdrawn` counts as a response, which is right in the ordinary case — you
+ * withdraw from a process you are in — and generous in the rarer one where
+ * someone withdraws an application nobody ever answered. The stored data does
+ * not distinguish those, and the alternative (silently dropping withdrawals
+ * from the numerator) understates real conversations.
+ */
+export declare function gotResponse(app: Application): boolean;
+export interface PipelineStats {
+    total: number;
+    /** Applications actually submitted — the denominator for both rates. */
+    sent: number;
+    active: number;
+    inConversation: number;
+    offers: number;
+    ghosted: number;
+    /** Percent of sent applications the employer answered, 0 when none sent. */
+    responseRate: number;
+    /** Percent of sent applications that went silent, 0 when none sent. */
+    ghostRate: number;
+}
+export declare function computeStats(apps: Application[]): PipelineStats;
+//# sourceMappingURL=pipeline-stats.d.ts.map

package/build/src/pipeline-stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-stats.d.ts","sourceRoot":"","sources":["../../src/pipeline-stats.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,iBAAiB,EAEvD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAErD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,aAAa,CAgB/D"}

package/build/src/pipeline-stats.js

@@ -0,0 +1,66 @@
+/**
+ * The one place a pipeline turns into numbers.
+ *
+ * `pipeline_view action=stats` and the dashboard both answer "what is my
+ * response rate?", and they answered it differently: the tool computed
+ * (total − applied) / total, which counts a role you have only *discovered* —
+ * and never sent anything to — as an employer response, and divides by a
+ * denominator that includes it. On the bundled sample that reported 75% while
+ * the dashboard, doing responded / sent, reported 71%. Two surfaces of one
+ * product disagreeing about the user's own number is worse than either being
+ * wrong: there is no way for them to tell which to believe.
+ *
+ * So the arithmetic lives here and both call it. Adding a stage to the funnel
+ * is now one edit rather than a hunt for every place a status list was inlined.
+ */
+/**
+ * Stages a search is still live in — nothing has closed the door yet.
+ *
+ * `discovered` belongs here: a role you have found and not yet applied to is
+ * live work, and the board shows it as a column.
+ */
+export const ACTIVE_STATUSES = [
+    "discovered", "applied", "screening", "interviewing", "offer", "negotiating",
+];
+/**
+ * Did this application actually get sent?
+ *
+ * Everything past `discovered` did. This is the denominator for both rates
+ * below, because a role you never applied to cannot answer you and cannot
+ * ghost you — including it only dilutes the number you were asking about.
+ */
+export function wasSent(app) {
+    return app.status !== "discovered";
+}
+/**
+ * Did the employer come back?
+ *
+ * Anything past `applied` means someone on the other side acted, except
+ * `ghosted`, which is the recorded absence of exactly that.
+ *
+ * `withdrawn` counts as a response, which is right in the ordinary case — you
+ * withdraw from a process you are in — and generous in the rarer one where
+ * someone withdraws an application nobody ever answered. The stored data does
+ * not distinguish those, and the alternative (silently dropping withdrawals
+ * from the numerator) understates real conversations.
+ */
+export function gotResponse(app) {
+    return !["discovered", "applied", "ghosted"].includes(app.status);
+}
+export function computeStats(apps) {
+    const sent = apps.filter(wasSent).length;
+    const responded = apps.filter(gotResponse).length;
+    const ghosted = apps.filter((a) => a.status === "ghosted").length;
+    const pct = (n) => (sent ? Math.round((n / sent) * 100) : 0);
+    return {
+        total: apps.length,
+        sent,
+        active: apps.filter((a) => ACTIVE_STATUSES.includes(a.status)).length,
+        inConversation: apps.filter((a) => ["screening", "interviewing"].includes(a.status)).length,
+        offers: apps.filter((a) => ["offer", "negotiating", "accepted"].includes(a.status)).length,
+        ghosted,
+        responseRate: pct(responded),
+        ghostRate: pct(ghosted),
+    };
+}
+//# sourceMappingURL=pipeline-stats.js.map

package/build/src/pipeline-stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-stats.js","sourceRoot":"","sources":["../../src/pipeline-stats.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiC;IAC3D,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa;CAC7E,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,GAAgB;IACtC,OAAO,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,OAAO,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAgBD,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACrE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3F,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC1F,OAAO;QACP,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;KACxB,CAAC;AACJ,CAAC"}

package/build/src/sample-data.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The bundled Alex Rivera sample, kept current.
+ *
+ * `data/example/` is the one populated Career KB anybody can look at without
+ * typing their own history in: the README points at it, the screenshots are
+ * taken from it, and `CAREER_DATA_PATH=data/example` is the documented way to
+ * see the dashboard with something in it. Every date in it was written by hand
+ * to represent mid-June 2026 — a panel "coming up" on the 17th, a follow-up
+ * four days past due. Nothing ages those, so the demo curdles: within weeks the
+ * interviews have already happened, the follow-ups are months overdue, and the
+ * first impression of a job-search tool is a search that was abandoned.
+ *
+ * Rather than re-date the YAML on a schedule (which only moves the expiry), the
+ * dates are shifted at read time by the distance between {@link sampleAnchor}
+ * — the sample's own notion of "today" — and the real today. The relative shape
+ * the sample was authored with is exactly preserved: the panel is still three
+ * days out, the rejection still landed a week ago. The files on disk are never
+ * touched, and only the copy inside this package is affected: a user's own data
+ * goes through untouched, whatever dates it has.
+ */
+/**
+ * The anchor for a fixture this code cannot read.
+ *
+ * Only reachable when the sample directory is missing or unparseable, in which
+ * case there is nothing to shift and the value never gets used. It exists so
+ * the shift is a number rather than a special case.
+ */
+export declare const SAMPLE_ANCHOR_FALLBACK = "2026-06-16";
+/**
+ * Return a copy of `value` with every date shifted forward to sit around
+ * `today`. Pure: the input is never mutated, so a caller can hand it a parsed
+ * document and keep the original.
+ *
+ * `today` and `anchor` are injectable so tests are not a function of the day
+ * they run on, nor of the fixture's current contents.
+ */
+export declare function freshenSampleDates<T>(value: T, today?: Date, anchor?: string): T;
+export declare function bundledSampleDir(): string | null;
+/** Is this data directory the demo that ships with the package? */
+export declare function isBundledSampleDir(dir: string): boolean;
+/**
+ * The sample's own "today": the newest moment anything in it was written.
+ *
+ * Read from the fixture rather than declared, so re-dating the YAML moves the
+ * anchor with it and the two cannot drift apart again. Cached — the fixture is
+ * immutable for the life of the process, and this runs on every sample read.
+ */
+export declare function sampleAnchor(): string;
+//# sourceMappingURL=sample-data.d.ts.map

package/build/src/sample-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-data.d.ts","sourceRoot":"","sources":["../../src/sample-data.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAwDnD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,KAAK,EAAE,CAAC,EACR,KAAK,GAAE,IAAiB,EACxB,MAAM,GAAE,MAAuB,GAC9B,CAAC,CAcH;AAmDD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGvD;AA6DD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAGrC"}

package/build/src/sample-data.js

@@ -0,0 +1,234 @@
+import { existsSync, readdirSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { fileURLToPath } from "url";
+import { parse as parseYaml } from "yaml";
+/**
+ * The bundled Alex Rivera sample, kept current.
+ *
+ * `data/example/` is the one populated Career KB anybody can look at without
+ * typing their own history in: the README points at it, the screenshots are
+ * taken from it, and `CAREER_DATA_PATH=data/example` is the documented way to
+ * see the dashboard with something in it. Every date in it was written by hand
+ * to represent mid-June 2026 — a panel "coming up" on the 17th, a follow-up
+ * four days past due. Nothing ages those, so the demo curdles: within weeks the
+ * interviews have already happened, the follow-ups are months overdue, and the
+ * first impression of a job-search tool is a search that was abandoned.
+ *
+ * Rather than re-date the YAML on a schedule (which only moves the expiry), the
+ * dates are shifted at read time by the distance between {@link sampleAnchor}
+ * — the sample's own notion of "today" — and the real today. The relative shape
+ * the sample was authored with is exactly preserved: the panel is still three
+ * days out, the rejection still landed a week ago. The files on disk are never
+ * touched, and only the copy inside this package is affected: a user's own data
+ * goes through untouched, whatever dates it has.
+ */
+/**
+ * The anchor for a fixture this code cannot read.
+ *
+ * Only reachable when the sample directory is missing or unparseable, in which
+ * case there is nothing to shift and the value never gets used. It exists so
+ * the shift is a number rather than a special case.
+ */
+export const SAMPLE_ANCHOR_FALLBACK = "2026-06-16";
+/**
+ * Fields that record *when a record was last written*, and nothing else.
+ *
+ * The anchor has to come from the fixture, because a hand-written constant is
+ * exactly what broke: `data/example/` was re-dated from March to June with a
+ * +81-day shift on its activity dates, and the anchor constant was set from a
+ * different reading of the same file. Every date then landed (today − 55) days
+ * on, which pushed the newest ones past today — a pipeline whose header claimed
+ * a "last write" seven weeks in the future and applications "updated tomorrow".
+ *
+ * These two keys are the only unambiguous ones. `followUpDue`, an interview
+ * round's `date`, and an offer's `expiresDate`/`startDate` are all *supposed* to
+ * sit in the future — anchoring on the newest of those would drag the whole
+ * demo into the past and produce the abandoned-search look this mechanism
+ * exists to prevent.
+ */
+const ANCHOR_KEYS = new Set(["dateUpdated", "lastUpdated"]);
+/** A whole-string date: `YYYY-MM-DD`, optionally followed by a time. */
+const DATE_STRING = /^(\d{4})-(\d{2})-(\d{2})(.*)$/;
+/** A date used as a note prefix: `[2026-06-01] Tailored resume…`. */
+const NOTE_DATE = /\[(\d{4})-(\d{2})-(\d{2})\]/g;
+function toUtcDay(y, m, d) {
+    return Date.UTC(y, m - 1, d);
+}
+function daysBetween(fromIso, to) {
+    const [y, m, d] = fromIso.split("-").map(Number);
+    // The target is read as a calendar day in the user's own timezone: "today"
+    // means the date on their wall, not a UTC instant.
+    const toDay = toUtcDay(to.getFullYear(), to.getMonth() + 1, to.getDate());
+    return Math.round((toDay - toUtcDay(y, m, d)) / 86400000);
+}
+function shiftDay(y, m, d, days) {
+    const shifted = new Date(toUtcDay(y, m, d) + days * 86400000);
+    return shifted.toISOString().slice(0, 10);
+}
+function shiftString(value, days) {
+    const whole = DATE_STRING.exec(value);
+    if (whole) {
+        const [, y, m, d, rest] = whole;
+        return shiftDay(Number(y), Number(m), Number(d), days) + rest;
+    }
+    // `YYYY-MM` (employment history) has no day and is not a moving target — a
+    // job that started in 2021-03 started in 2021-03 — so it is left alone by
+    // both patterns on purpose.
+    return value.replace(NOTE_DATE, (_all, y, m, d) => `[${shiftDay(Number(y), Number(m), Number(d), days)}]`);
+}
+/**
+ * Return a copy of `value` with every date shifted forward to sit around
+ * `today`. Pure: the input is never mutated, so a caller can hand it a parsed
+ * document and keep the original.
+ *
+ * `today` and `anchor` are injectable so tests are not a function of the day
+ * they run on, nor of the fixture's current contents.
+ */
+export function freshenSampleDates(value, today = new Date(), anchor = sampleAnchor()) {
+    const days = daysBetween(anchor, today);
+    if (days === 0)
+        return value;
+    const walk = (node) => {
+        if (typeof node === "string")
+            return shiftString(node, days);
+        if (Array.isArray(node))
+            return node.map(walk);
+        if (node && typeof node === "object") {
+            return Object.fromEntries(Object.entries(node).map(([k, v]) => [k, walk(v)]));
+        }
+        return node;
+    };
+    return walk(value);
+}
+/**
+ * This module's own directory, or null where that question has no answer.
+ *
+ * `import.meta.url` is not always a `file:` URL — under the dashboard's browser
+ * -like test environment it is an `http:` one, and fileURLToPath throws on it.
+ * That threw out of a *load*, so an unrelated Career-KB read failed with
+ * "The URL must be of scheme file". Locating the demo is best-effort by nature;
+ * failing to locate it must never fail the caller.
+ */
+function moduleDir() {
+    try {
+        return resolve(fileURLToPath(new URL(".", import.meta.url)));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Absolute path of the sample that ships inside this package.
+ *
+ * Resolved by walking up to our own package.json rather than a fixed number of
+ * `..` hops, because this module runs from `src/` under vitest and from
+ * `build/src/` when installed — the same reason version.ts walks. Falls back to
+ * the working directory when the module's own path is unavailable, which walks
+ * up to the same package.json from anywhere inside the project.
+ */
+function findBundledSampleDir() {
+    let dir = moduleDir() ?? process.cwd();
+    for (;;) {
+        const pkg = join(dir, "package.json");
+        if (existsSync(pkg)) {
+            try {
+                const parsed = JSON.parse(readFileSync(pkg, "utf-8"));
+                if (parsed.name === "career-compass-mcp") {
+                    const sample = join(dir, "data", "example");
+                    return existsSync(sample) ? sample : null;
+                }
+            }
+            catch {
+                // Unreadable package.json — keep walking rather than give up here.
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+let cached;
+export function bundledSampleDir() {
+    if (cached === undefined)
+        cached = findBundledSampleDir();
+    return cached;
+}
+/** Is this data directory the demo that ships with the package? */
+export function isBundledSampleDir(dir) {
+    const sample = bundledSampleDir();
+    return sample !== null && resolve(dir) === resolve(sample);
+}
+// ─── Anchor derivation ────────────────────────────────────────────────────────
+/**
+ * Every `dateUpdated` / `lastUpdated` value under a parsed document.
+ *
+ * `key` is the field the current node was reached through, which is what makes
+ * this selective: the same date string means "written on" under `dateUpdated`
+ * and "due on" under `followUpDue`, and only the first can bound the anchor.
+ * Array elements inherit their array's key, which is correct — the entries of
+ * a `notes:` list are still notes — and objects rebind it per field.
+ */
+function collectAnchorDates(node, key, out) {
+    if (typeof node === "string") {
+        if (key !== null && ANCHOR_KEYS.has(key) && DATE_STRING.test(node))
+            out.push(node.slice(0, 10));
+        return;
+    }
+    if (Array.isArray(node)) {
+        for (const item of node)
+            collectAnchorDates(item, key, out);
+        return;
+    }
+    if (node && typeof node === "object") {
+        for (const [k, v] of Object.entries(node)) {
+            collectAnchorDates(v, k, out);
+        }
+    }
+}
+function findSampleAnchor() {
+    const root = bundledSampleDir();
+    if (!root)
+        return SAMPLE_ANCHOR_FALLBACK;
+    const found = [];
+    const walk = (dir) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const full = join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+            }
+            else if (entry.name.endsWith(".yaml") || entry.name.endsWith(".yml")) {
+                try {
+                    collectAnchorDates(parseYaml(readFileSync(full, "utf-8")), null, found);
+                }
+                catch {
+                    // One unparseable file must not cost the anchor. The loader reports
+                    // that failure properly; this is a best-effort read for a demo.
+                }
+            }
+        }
+    };
+    try {
+        walk(root);
+    }
+    catch {
+        return SAMPLE_ANCHOR_FALLBACK;
+    }
+    if (found.length === 0)
+        return SAMPLE_ANCHOR_FALLBACK;
+    return found.reduce((a, b) => (a > b ? a : b));
+}
+let cachedAnchor;
+/**
+ * The sample's own "today": the newest moment anything in it was written.
+ *
+ * Read from the fixture rather than declared, so re-dating the YAML moves the
+ * anchor with it and the two cannot drift apart again. Cached — the fixture is
+ * immutable for the life of the process, and this runs on every sample read.
+ */
+export function sampleAnchor() {
+    if (cachedAnchor === undefined)
+        cachedAnchor = findSampleAnchor();
+    return cachedAnchor;
+}
+//# sourceMappingURL=sample-data.js.map

package/build/src/sample-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-data.js","sourceRoot":"","sources":["../../src/sample-data.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAE5D,wEAAwE;AACxE,MAAM,WAAW,GAAG,+BAA+B,CAAC;AACpD,qEAAqE;AACrE,MAAM,SAAS,GAAG,8BAA8B,CAAC;AAEjD,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,EAAQ;IAC5C,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,IAAY;IAC7D,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QAChC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC;IAChE,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,4BAA4B;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CACxE,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAQ,EACR,QAAc,IAAI,IAAI,EAAE,EACxB,SAAiB,YAAY,EAAE;IAE/B,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,IAAa,EAAW,EAAE;QACtC,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAM,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB;IAC3B,IAAI,GAAG,GAAG,SAAS,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAuB,CAAC;gBAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;oBACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;oBAC5C,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5C,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,MAAiC,CAAC;AAEtC,MAAM,UAAU,gBAAgB;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,GAAG,oBAAoB,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,IAAa,EAAE,GAAkB,EAAE,GAAa;IAC1E,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChG,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YACrE,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,sBAAsB,CAAC;IAEzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,IAAI,CAAC;oBACH,kBAAkB,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1E,CAAC;gBAAC,MAAM,CAAC;oBACP,oEAAoE;oBACpE,gEAAgE;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACtD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,YAAgC,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,YAAY,KAAK,SAAS;QAAE,YAAY,GAAG,gBAAgB,EAAE,CAAC;IAClE,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/build/src/schemas/career-schema.d.ts

@@ -12,6 +12,17 @@ export declare const ApplicationStatus: z.ZodEnum<{
     ghosted: "ghosted";
 }>;
 export type ApplicationStatus = z.infer<typeof ApplicationStatus>;
+/**
+ * Every status, in funnel order — the order the stages are declared above.
+ *
+ * This is the canonical ordering for anything that needs to rank stages: the
+ * dashboard board, `pipeline_view sortBy=status`, and the transition check in
+ * pipeline.ts. Derived from the enum rather than retyped so a new stage cannot
+ * be added in one place and forgotten in the other.
+ */
+export declare const STATUS_ORDER: readonly ApplicationStatus[];
+/** Position of a status in the funnel. Lower is earlier. */
+export declare function statusRank(status: ApplicationStatus): number;
 export declare const Achievement: z.ZodObject<{
     metric: z.ZodString;
     context: z.ZodString;
@@ -79,8 +90,8 @@ export declare const Profile: z.ZodObject<{
     salaryMin: z.ZodOptional<z.ZodNumber>;
     salaryMax: z.ZodOptional<z.ZodNumber>;
     salaryCurrency: z.ZodDefault<z.ZodString>;
-    openToRemote: z.ZodDefault<z.ZodBoolean>;
-    openToRelocation: z.ZodDefault<z.ZodBoolean>;
+    openToRemote: z.ZodOptional<z.ZodBoolean>;
+    openToRelocation: z.ZodOptional<z.ZodBoolean>;
     noticePeriod: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
@@ -173,8 +184,8 @@ export declare const CareerData: z.ZodObject<{
         salaryMin: z.ZodOptional<z.ZodNumber>;
         salaryMax: z.ZodOptional<z.ZodNumber>;
         salaryCurrency: z.ZodDefault<z.ZodString>;
-        openToRemote: z.ZodDefault<z.ZodBoolean>;
-        openToRelocation: z.ZodDefault<z.ZodBoolean>;
+        openToRemote: z.ZodOptional<z.ZodBoolean>;
+        openToRelocation: z.ZodOptional<z.ZodBoolean>;
         noticePeriod: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     experience: z.ZodDefault<z.ZodArray<z.ZodObject<{

package/build/src/schemas/career-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"career-schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/career-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;EAW5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAIlE,eAAO,MAAM,WAAW;;;;;iBAKtB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;iBAMhB,CAAC;AAEH,eAAO,MAAM,SAAS;;;;;;;iBAOpB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;iBAQlB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;iBAMtB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;iBAiBlB,CAAC;AAIH;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BvB,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAwB,CAAC;AAIpD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQrB,CAAC;AAIH,eAAO,MAAM,OAAO;;;;;;iBAMlB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;iBAMzB,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;iBAShB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BtB,CAAC;AAEH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnB,CAAC;AAIH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAChD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}
+{"version":3,"file":"career-schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/career-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,iBAAiB;;;;;;;;;;;EAW5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,SAAS,iBAAiB,EAA8B,CAAC;AAEpF,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAE5D;AAID,eAAO,MAAM,WAAW;;;;;iBAKtB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;iBAUrB,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;iBAMhB,CAAC;AAEH,eAAO,MAAM,SAAS;;;;;;;iBAOpB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;iBAQlB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;iBAMtB,CAAC;AAEH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;iBAsClB,CAAC;AAIH;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2BvB,CAAC;AAEH,oFAAoF;AACpF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAwB,CAAC;AAIpD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQrB,CAAC;AAIH,eAAO,MAAM,OAAO;;;;;;iBAMlB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;iBAMzB,CAAC;AAEH,eAAO,MAAM,KAAK;;;;;;;;;iBAShB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BtB,CAAC;AAEH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnB,CAAC;AAIH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAC1C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAChD,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAC9C,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC"}

package/build/src/schemas/career-schema.js

@@ -12,6 +12,19 @@ export const ApplicationStatus = z.enum([
     "withdrawn",
     "ghosted",
 ]);
+/**
+ * Every status, in funnel order — the order the stages are declared above.
+ *
+ * This is the canonical ordering for anything that needs to rank stages: the
+ * dashboard board, `pipeline_view sortBy=status`, and the transition check in
+ * pipeline.ts. Derived from the enum rather than retyped so a new stage cannot
+ * be added in one place and forgotten in the other.
+ */
+export const STATUS_ORDER = ApplicationStatus.options;
+/** Position of a status in the funnel. Lower is earlier. */
+export function statusRank(status) {
+    return STATUS_ORDER.indexOf(status);
+}
 // ─── Career Data ───────────────────────────────────────────────────────────────
 export const Achievement = z.object({
     metric: z.string().describe("Quantifiable outcome, e.g. 'reduced latency 40%'"),
@@ -75,8 +88,29 @@ export const Profile = z.object({
     salaryMin: z.number().optional(),
     salaryMax: z.number().optional(),
     salaryCurrency: z.string().default("USD"),
-    openToRemote: z.boolean().default(true),
-    openToRelocation: z.boolean().default(false),
+    // `.optional()` rather than `.default(true)`/`.default(false)`.
+    //
+    // A zod default is applied at parse time, so once the profile is loaded a
+    // stated answer and an unanswered field are indistinguishable. That is
+    // harmless for a field nobody asserts anything about, and wrong for these two:
+    // the fit analysis prints them under "the hard constraints this fit must be
+    // checked against" and then treats a location mismatch as a blocker. A
+    // first-run profile is name + summary only — exactly what the documented
+    // resume-paste onboarding produces — so the defaults had the tool assert
+    // "Open to relocation: no" on the user's behalf and rule roles out on a
+    // preference they never expressed. Inventing a preference is the specific
+    // dishonesty this product exists to prevent.
+    //
+    // It also stopped absence being recoverable: `save_career_section` validates
+    // with this schema and writes `parsed.data`, so the baked default was
+    // persisted into profile.yaml on the first save and became indistinguishable
+    // from a real answer from then on.
+    //
+    // Consumers that need a plain boolean apply the old default at their own use
+    // site (`?? true` / `?? false`), so behavior for the absent case is unchanged
+    // everywhere except where the stated/unstated distinction is the point.
+    openToRemote: z.boolean().optional(),
+    openToRelocation: z.boolean().optional(),
     noticePeriod: z.string().optional().describe("e.g. '2 weeks', 'immediately'"),
 });
 // ─── Career Journal ─────────────────────────────────────────────────────────────