career-compass-mcp 2.3.0 → 2.4.1

package/build/src/dashboard-lite/server.js

@@ -1,5 +1,5 @@
 import { createServer } from "http";
-import { loadPipeline, isCorruptDataError } from "../storage/file-store.js";
+import { getDataDir, loadPipeline, isCorruptDataError } from "../storage/file-store.js";
 import { renderLiteDashboard } from "./render.js";
 /**
  * Zero-build "lite" dashboard server.
@@ -10,8 +10,79 @@ import { renderLiteDashboard } from "./render.js";
  * of ~/.career-compass, mirroring the force-dynamic guarantee of the Next.js
  * dashboard. Ships in the npm package (pure JS, no framework, no build).
  */
+/**
+ * Host names this server will answer to. Everything else is refused.
+ *
+ * Binding loopback stops the *network* from reaching the dashboard; it does not
+ * stop a web page. Any site the user visits can point a hostname it controls at
+ * 127.0.0.1 and have the browser issue same-origin requests to this server —
+ * DNS rebinding. The one thing that distinguishes those requests from a real
+ * one is the `Host` header, which carries the attacker's name rather than a
+ * loopback name, so checking it is the whole defense.
+ *
+ * The dashboard serves a user's entire job search — companies, salaries,
+ * contacts, interview notes — from a machine-local origin with no auth, which
+ * is exactly the shape of target rebinding exists to reach.
+ */
+const ALLOWED_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+/**
+ * Split the hostname out of a `Host` header value, or reject the value.
+ *
+ * `Host` is `name[":" port]`, but a bracketed IPv6 literal (`[::1]:3141`) and a
+ * bare one (`::1`, which some clients send) both contain colons, so a naive
+ * split on ":" turns `[::1]` into `[`.
+ *
+ * Everything after the name is checked rather than discarded. Taking the left
+ * half of the first colon and asking no questions about the right half let
+ * `localhost:evil.com` and `[::1]evil.com` read as loopback. Nothing can put
+ * those bytes on the wire from a browser — `Host` is built from the URL
+ * authority, so a rebound page still sends its own name — but a parser that
+ * answers a question it was not asked is one refactor away from mattering.
+ * Only `:<digits>` is a port; anything else makes the header malformed, and
+ * malformed is not loopback.
+ */
+function hostnameOf(host) {
+    const h = host.trim().toLowerCase();
+    if (!h)
+        return null;
+    // Bracketed IPv6 literal: nothing may follow the closing bracket but a port.
+    if (h.startsWith("[")) {
+        const bracketed = /^(\[[0-9a-f:.]+\])(?::\d+)?$/.exec(h);
+        return bracketed ? bracketed[1] : null;
+    }
+    // More than one colon and no brackets: a bare IPv6 literal, which cannot
+    // carry a port — the whole value is the hostname, so every character of it
+    // has to be one an address can contain.
+    if (h.split(":").length - 1 > 1) {
+        return /^[0-9a-f:.]+$/.test(h) ? h : null;
+    }
+    const named = /^([^:]+)(?::\d+)?$/.exec(h);
+    return named ? named[1] : null;
+}
+/**
+ * Is this `Host` header one of ours?
+ *
+ * A missing header is refused too. HTTP/1.1 requires it and every browser sends
+ * it, so its absence is either a hand-written request or an attempt to skip the
+ * check — neither is a case worth serving a career history to.
+ */
+export function isAllowedHost(host) {
+    if (!host)
+        return false;
+    const hostname = hostnameOf(host);
+    return hostname !== null && ALLOWED_HOSTNAMES.has(hostname);
+}
 export function createLiteDashboardServer() {
     return createServer(async (req, res) => {
+        // Checked before anything else, including the path: a rejected origin must
+        // not learn which paths exist or how the server responds to them.
+        if (!isAllowedHost(req.headers.host)) {
+            res.writeHead(403, { "content-type": "text/plain; charset=utf-8" });
+            res.end(`Refused: this dashboard only answers to ${[...ALLOWED_HOSTNAMES].join(", ")}.\n` +
+                `The request arrived with Host: ${req.headers.host ?? "(none)"}.\n\n` +
+                `It binds loopback and is meant to be opened at http://localhost:<port> on this machine.`);
+            return;
+        }
         // Only serve the dashboard at "/"; everything else 404s (favicon, etc.).
         const path = (req.url ?? "/").split("?")[0];
         if (path !== "/" && path !== "/index.html") {
@@ -21,7 +92,9 @@ export function createLiteDashboardServer() {
         }
         try {
             const pipeline = await loadPipeline();
-            const html = renderLiteDashboard(pipeline);
+            // Read per request, like the pipeline itself: the footer names the folder
+            // this page is actually serving, not the default one.
+            const html = renderLiteDashboard(pipeline, getDataDir());
             res.writeHead(200, {
                 "content-type": "text/html; charset=utf-8",
                 // Never cache: the whole point is a live read of local data.

package/build/src/dashboard-lite/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/dashboard-lite/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,MAAM,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,0BAA0B;gBAC1C,6DAA6D;gBAC7D,eAAe,EAAE,2BAA2B;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO;gBACjB,CAAC,CAAC,uGAAwG,GAAa,CAAC,OAAO,EAAE;gBACjI,CAAC,CAAC,+BAAgC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAQ,GAAG,WAAW;IACrE,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,wEAAwE;YACxE,oDAAoD;YACpD,MAAM,EAAE,GAAG,yBAAyB,EAAE,CAAC;YACvC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAAmC;YAC5E,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;gBAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/dashboard-lite/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,MAAM,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;GAQG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpB,6EAA6E;IAC7E,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,wCAAwC;IACxC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACrC,2EAA2E;QAC3E,kEAAkE;QAClE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CACL,2CAA2C,CAAC,GAAG,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC/E,kCAAkC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,OAAO;gBACrE,yFAAyF,CAC5F,CAAC;YACF,OAAO;QACT,CAAC;QACD,yEAAyE;QACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;YACtC,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;YACzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,cAAc,EAAE,0BAA0B;gBAC1C,6DAA6D;gBAC7D,eAAe,EAAE,2BAA2B;aAC7C,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO;gBACjB,CAAC,CAAC,uGAAwG,GAAa,CAAC,OAAO,EAAE;gBACjI,CAAC,CAAC,+BAAgC,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpF,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAQ,GAAG,WAAW;IACrE,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,wEAAwE;YACxE,oDAAoD;YACpD,MAAM,EAAE,GAAG,yBAAyB,EAAE,CAAC;YACvC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,mCAAmC;YAC5E,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE;gBAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/build/src/manifest-format.d.ts

@@ -0,0 +1,56 @@
+/**
+ * How `manifest.json` is written to disk — the encoding, not the content.
+ *
+ * `manifest.json` is generated from the live server by
+ * `scripts/gen-manifest-tools.mjs`, and it is checked in with every non-ASCII
+ * character as a `\uXXXX` escape. Both forms are valid JSON and decode
+ * identically, so the choice is purely about diffs: the descriptions are full
+ * of em dashes, and letting them land as literals buries the first real copy
+ * change under a screenful of encoding noise.
+ *
+ * That invariant was documented only in a comment inside the generator, which
+ * meant nothing enforced it. The v2.4.0 release (18ec920) checked the manifest
+ * back in with literal em dashes — semantically identical, so
+ * manifest-truth.test.ts (which compares *parsed* descriptions) stayed green
+ * and CI never noticed. The cost showed up in the workflow instead:
+ * `gen-manifest-tools.mjs --check` failed on a clean checkout of main claiming
+ * "manifest.json disagrees with the server" when the copy was in fact correct,
+ * and `npm run gen:manifest` rewrote ten untouched lines every run.
+ *
+ * So the encoding lives here, in one typed place, exercised by
+ * manifest-truth.test.ts against the file that actually ships.
+ */
+/**
+ * Escape every non-ASCII character in an already-serialized JSON string.
+ *
+ * JSON's `\u` escape is exactly four hex digits, so anything outside the BMP
+ * has to be emitted as the surrogate pair JSON already uses internally. The
+ * first version of this formatted the whole code point with a single escape,
+ * which turned a four-digit `padStart` into a five-digit sequence: an emoji
+ * (`U+1F600`) came out as `ὠ0`, which re-parses as `ὠ` followed by a
+ * literal `0` — `ὠ0`. Still valid JSON, so nothing threw; the description was
+ * just silently corrupted. No manifest string has ever contained an astral
+ * character, so this was latent rather than shipped, but the failure mode is
+ * quiet enough to be worth closing.
+ */
+export declare function escapeNonAscii(json: string): string;
+/** A tool as both the manifest and a `tools/list` response describe it. */
+export interface ManifestTool {
+    name: string;
+    description: string;
+}
+/**
+ * The exact bytes `manifest.json` should contain, given the manifest as parsed
+ * and the tools the server actually serves.
+ *
+ * Spreading rather than mutating keeps the caller's object intact; `tools`
+ * already exists on the manifest, so it keeps its original key position and
+ * the rewrite stays a content diff instead of a reordering.
+ *
+ * Emits LF endings. The repo is developed on Windows with `core.autocrlf=true`,
+ * so a working copy is checked out with CRLF while the committed blob is LF —
+ * comparisons against this output must normalize line endings rather than
+ * assume either one.
+ */
+export declare function renderManifest(manifest: Record<string, unknown>, tools: ManifestTool[]): string;
+//# sourceMappingURL=manifest-format.d.ts.map

package/build/src/manifest-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-format.d.ts","sourceRoot":"","sources":["../../src/manifest-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcnD;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,KAAK,EAAE,YAAY,EAAE,GACpB,MAAM,CAER"}

package/build/src/manifest-format.js

@@ -0,0 +1,67 @@
+/**
+ * How `manifest.json` is written to disk — the encoding, not the content.
+ *
+ * `manifest.json` is generated from the live server by
+ * `scripts/gen-manifest-tools.mjs`, and it is checked in with every non-ASCII
+ * character as a `\uXXXX` escape. Both forms are valid JSON and decode
+ * identically, so the choice is purely about diffs: the descriptions are full
+ * of em dashes, and letting them land as literals buries the first real copy
+ * change under a screenful of encoding noise.
+ *
+ * That invariant was documented only in a comment inside the generator, which
+ * meant nothing enforced it. The v2.4.0 release (18ec920) checked the manifest
+ * back in with literal em dashes — semantically identical, so
+ * manifest-truth.test.ts (which compares *parsed* descriptions) stayed green
+ * and CI never noticed. The cost showed up in the workflow instead:
+ * `gen-manifest-tools.mjs --check` failed on a clean checkout of main claiming
+ * "manifest.json disagrees with the server" when the copy was in fact correct,
+ * and `npm run gen:manifest` rewrote ten untouched lines every run.
+ *
+ * So the encoding lives here, in one typed place, exercised by
+ * manifest-truth.test.ts against the file that actually ships.
+ */
+/**
+ * Escape every non-ASCII character in an already-serialized JSON string.
+ *
+ * JSON's `\u` escape is exactly four hex digits, so anything outside the BMP
+ * has to be emitted as the surrogate pair JSON already uses internally. The
+ * first version of this formatted the whole code point with a single escape,
+ * which turned a four-digit `padStart` into a five-digit sequence: an emoji
+ * (`U+1F600`) came out as `ὠ0`, which re-parses as `ὠ` followed by a
+ * literal `0` — `ὠ0`. Still valid JSON, so nothing threw; the description was
+ * just silently corrupted. No manifest string has ever contained an astral
+ * character, so this was latent rather than shipped, but the failure mode is
+ * quiet enough to be worth closing.
+ */
+export function escapeNonAscii(json) {
+    let out = "";
+    // Iterating a string yields whole code points, so `ch` is the astral
+    // character itself (length 2) rather than a lone surrogate.
+    for (const ch of json) {
+        if (ch.codePointAt(0) <= 127) {
+            out += ch;
+            continue;
+        }
+        for (let i = 0; i < ch.length; i++) {
+            out += "\\u" + ch.charCodeAt(i).toString(16).padStart(4, "0");
+        }
+    }
+    return out;
+}
+/**
+ * The exact bytes `manifest.json` should contain, given the manifest as parsed
+ * and the tools the server actually serves.
+ *
+ * Spreading rather than mutating keeps the caller's object intact; `tools`
+ * already exists on the manifest, so it keeps its original key position and
+ * the rewrite stays a content diff instead of a reordering.
+ *
+ * Emits LF endings. The repo is developed on Windows with `core.autocrlf=true`,
+ * so a working copy is checked out with CRLF while the committed blob is LF —
+ * comparisons against this output must normalize line endings rather than
+ * assume either one.
+ */
+export function renderManifest(manifest, tools) {
+    return escapeNonAscii(JSON.stringify({ ...manifest, tools }, null, 2)) + "\n";
+}
+//# sourceMappingURL=manifest-format.js.map

package/build/src/manifest-format.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-format.js","sourceRoot":"","sources":["../../src/manifest-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,qEAAqE;IACrE,4DAA4D;IAC5D,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,IAAI,GAAG,EAAE,CAAC;YAC9B,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAiC,EACjC,KAAqB;IAErB,OAAO,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;AAChF,CAAC"}

package/build/src/pipeline-stats.d.ts

@@ -0,0 +1,59 @@
+import type { Application, ApplicationStatus } from "./schemas/career-schema.js";
+/**
+ * The one place a pipeline turns into numbers.
+ *
+ * `pipeline_view action=stats` and the dashboard both answer "what is my
+ * response rate?", and they answered it differently: the tool computed
+ * (total − applied) / total, which counts a role you have only *discovered* —
+ * and never sent anything to — as an employer response, and divides by a
+ * denominator that includes it. On the bundled sample that reported 75% while
+ * the dashboard, doing responded / sent, reported 71%. Two surfaces of one
+ * product disagreeing about the user's own number is worse than either being
+ * wrong: there is no way for them to tell which to believe.
+ *
+ * So the arithmetic lives here and both call it. Adding a stage to the funnel
+ * is now one edit rather than a hunt for every place a status list was inlined.
+ */
+/**
+ * Stages a search is still live in — nothing has closed the door yet.
+ *
+ * `discovered` belongs here: a role you have found and not yet applied to is
+ * live work, and the board shows it as a column.
+ */
+export declare const ACTIVE_STATUSES: readonly ApplicationStatus[];
+/**
+ * Did this application actually get sent?
+ *
+ * Everything past `discovered` did. This is the denominator for both rates
+ * below, because a role you never applied to cannot answer you and cannot
+ * ghost you — including it only dilutes the number you were asking about.
+ */
+export declare function wasSent(app: Application): boolean;
+/**
+ * Did the employer come back?
+ *
+ * Anything past `applied` means someone on the other side acted, except
+ * `ghosted`, which is the recorded absence of exactly that.
+ *
+ * `withdrawn` counts as a response, which is right in the ordinary case — you
+ * withdraw from a process you are in — and generous in the rarer one where
+ * someone withdraws an application nobody ever answered. The stored data does
+ * not distinguish those, and the alternative (silently dropping withdrawals
+ * from the numerator) understates real conversations.
+ */
+export declare function gotResponse(app: Application): boolean;
+export interface PipelineStats {
+    total: number;
+    /** Applications actually submitted — the denominator for both rates. */
+    sent: number;
+    active: number;
+    inConversation: number;
+    offers: number;
+    ghosted: number;
+    /** Percent of sent applications the employer answered, 0 when none sent. */
+    responseRate: number;
+    /** Percent of sent applications that went silent, 0 when none sent. */
+    ghostRate: number;
+}
+export declare function computeStats(apps: Application[]): PipelineStats;
+//# sourceMappingURL=pipeline-stats.d.ts.map

package/build/src/pipeline-stats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-stats.d.ts","sourceRoot":"","sources":["../../src/pipeline-stats.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,iBAAiB,EAEvD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAEjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAErD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,aAAa,CAgB/D"}

package/build/src/pipeline-stats.js

@@ -0,0 +1,66 @@
+/**
+ * The one place a pipeline turns into numbers.
+ *
+ * `pipeline_view action=stats` and the dashboard both answer "what is my
+ * response rate?", and they answered it differently: the tool computed
+ * (total − applied) / total, which counts a role you have only *discovered* —
+ * and never sent anything to — as an employer response, and divides by a
+ * denominator that includes it. On the bundled sample that reported 75% while
+ * the dashboard, doing responded / sent, reported 71%. Two surfaces of one
+ * product disagreeing about the user's own number is worse than either being
+ * wrong: there is no way for them to tell which to believe.
+ *
+ * So the arithmetic lives here and both call it. Adding a stage to the funnel
+ * is now one edit rather than a hunt for every place a status list was inlined.
+ */
+/**
+ * Stages a search is still live in — nothing has closed the door yet.
+ *
+ * `discovered` belongs here: a role you have found and not yet applied to is
+ * live work, and the board shows it as a column.
+ */
+export const ACTIVE_STATUSES = [
+    "discovered", "applied", "screening", "interviewing", "offer", "negotiating",
+];
+/**
+ * Did this application actually get sent?
+ *
+ * Everything past `discovered` did. This is the denominator for both rates
+ * below, because a role you never applied to cannot answer you and cannot
+ * ghost you — including it only dilutes the number you were asking about.
+ */
+export function wasSent(app) {
+    return app.status !== "discovered";
+}
+/**
+ * Did the employer come back?
+ *
+ * Anything past `applied` means someone on the other side acted, except
+ * `ghosted`, which is the recorded absence of exactly that.
+ *
+ * `withdrawn` counts as a response, which is right in the ordinary case — you
+ * withdraw from a process you are in — and generous in the rarer one where
+ * someone withdraws an application nobody ever answered. The stored data does
+ * not distinguish those, and the alternative (silently dropping withdrawals
+ * from the numerator) understates real conversations.
+ */
+export function gotResponse(app) {
+    return !["discovered", "applied", "ghosted"].includes(app.status);
+}
+export function computeStats(apps) {
+    const sent = apps.filter(wasSent).length;
+    const responded = apps.filter(gotResponse).length;
+    const ghosted = apps.filter((a) => a.status === "ghosted").length;
+    const pct = (n) => (sent ? Math.round((n / sent) * 100) : 0);
+    return {
+        total: apps.length,
+        sent,
+        active: apps.filter((a) => ACTIVE_STATUSES.includes(a.status)).length,
+        inConversation: apps.filter((a) => ["screening", "interviewing"].includes(a.status)).length,
+        offers: apps.filter((a) => ["offer", "negotiating", "accepted"].includes(a.status)).length,
+        ghosted,
+        responseRate: pct(responded),
+        ghostRate: pct(ghosted),
+    };
+}
+//# sourceMappingURL=pipeline-stats.js.map

package/build/src/pipeline-stats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-stats.js","sourceRoot":"","sources":["../../src/pipeline-stats.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiC;IAC3D,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa;CAC7E,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,GAAgB;IACtC,OAAO,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,GAAgB;IAC1C,OAAO,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC;AAgBD,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAClE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAErE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACrE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC3F,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC1F,OAAO;QACP,YAAY,EAAE,GAAG,CAAC,SAAS,CAAC;QAC5B,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC;KACxB,CAAC;AACJ,CAAC"}

package/build/src/sample-data.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The bundled Alex Rivera sample, kept current.
+ *
+ * `data/example/` is the one populated Career KB anybody can look at without
+ * typing their own history in: the README points at it, the screenshots are
+ * taken from it, and `CAREER_DATA_PATH=data/example` is the documented way to
+ * see the dashboard with something in it. Every date in it was written by hand
+ * to represent mid-June 2026 — a panel "coming up" on the 17th, a follow-up
+ * four days past due. Nothing ages those, so the demo curdles: within weeks the
+ * interviews have already happened, the follow-ups are months overdue, and the
+ * first impression of a job-search tool is a search that was abandoned.
+ *
+ * Rather than re-date the YAML on a schedule (which only moves the expiry), the
+ * dates are shifted at read time by the distance between {@link sampleAnchor}
+ * — the sample's own notion of "today" — and the real today. The relative shape
+ * the sample was authored with is exactly preserved: the panel is still three
+ * days out, the rejection still landed a week ago. The files on disk are never
+ * touched, and only the copy inside this package is affected: a user's own data
+ * goes through untouched, whatever dates it has.
+ */
+/**
+ * The anchor for a fixture this code cannot read.
+ *
+ * Only reachable when the sample directory is missing or unparseable, in which
+ * case there is nothing to shift and the value never gets used. It exists so
+ * the shift is a number rather than a special case.
+ */
+export declare const SAMPLE_ANCHOR_FALLBACK = "2026-06-16";
+/**
+ * Return a copy of `value` with every date shifted forward to sit around
+ * `today`. Pure: the input is never mutated, so a caller can hand it a parsed
+ * document and keep the original.
+ *
+ * `today` and `anchor` are injectable so tests are not a function of the day
+ * they run on, nor of the fixture's current contents.
+ */
+export declare function freshenSampleDates<T>(value: T, today?: Date, anchor?: string): T;
+export declare function bundledSampleDir(): string | null;
+/** Is this data directory the demo that ships with the package? */
+export declare function isBundledSampleDir(dir: string): boolean;
+/**
+ * The sample's own "today": the newest moment anything in it was written.
+ *
+ * Read from the fixture rather than declared, so re-dating the YAML moves the
+ * anchor with it and the two cannot drift apart again. Cached — the fixture is
+ * immutable for the life of the process, and this runs on every sample read.
+ */
+export declare function sampleAnchor(): string;
+//# sourceMappingURL=sample-data.d.ts.map

package/build/src/sample-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sample-data.d.ts","sourceRoot":"","sources":["../../src/sample-data.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAwDnD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,KAAK,EAAE,CAAC,EACR,KAAK,GAAE,IAAiB,EACxB,MAAM,GAAE,MAAuB,GAC9B,CAAC,CAcH;AAmDD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGvD;AA6DD;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAGrC"}