careermate 0.1.0 → 0.1.1

package/dist/web.mjs

@@ -216,6 +216,123 @@ var MIGRATIONS = [
   CREATE INDEX IF NOT EXISTS idx_clv_letter ON cover_letter_versions(cover_letter_id);
   CREATE INDEX IF NOT EXISTS idx_cl_job ON cover_letters(job_id);
   CREATE INDEX IF NOT EXISTS idx_activities_created ON activities(created_at DESC);
+  `,
+  // v2 — add foreign keys so PRAGMA foreign_keys=ON is actually enforced.
+  //
+  // SQLite cannot ALTER a table to add constraints, so each table that needs an
+  // FK is recreated (create new → copy → drop old → rename). The copy also
+  // repairs pre-existing orphans: child rows whose parent is gone are dropped
+  // (CASCADE intent) and dangling optional refs are nulled (SET NULL intent), so
+  // a subsequent PRAGMA foreign_key_check stays clean. FKs are disabled for the
+  // rebuild and the whole thing runs in one transaction (auto-rolled-back if the
+  // process dies mid-migration, since the version bump happens only afterwards).
+  `
+  PRAGMA foreign_keys=OFF;
+  BEGIN;
+
+  -- cover_letters.job_id -> jobs(id) ON DELETE SET NULL
+  CREATE TABLE cover_letters_new (
+    id TEXT PRIMARY KEY,
+    title TEXT NOT NULL,
+    job_id TEXT REFERENCES jobs(id) ON DELETE SET NULL,
+    is_primary INTEGER NOT NULL DEFAULT 0,
+    current_version_id TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  INSERT INTO cover_letters_new (id,title,job_id,is_primary,current_version_id,created_at,updated_at)
+    SELECT id,title,
+           CASE WHEN job_id IN (SELECT id FROM jobs) THEN job_id ELSE NULL END,
+           is_primary,current_version_id,created_at,updated_at
+    FROM cover_letters;
+  DROP TABLE cover_letters;
+  ALTER TABLE cover_letters_new RENAME TO cover_letters;
+
+  -- cover_letter_versions.cover_letter_id -> cover_letters(id) ON DELETE CASCADE
+  CREATE TABLE cover_letter_versions_new (
+    id TEXT PRIMARY KEY,
+    cover_letter_id TEXT NOT NULL REFERENCES cover_letters(id) ON DELETE CASCADE,
+    version_no INTEGER NOT NULL,
+    content TEXT NOT NULL,
+    note TEXT,
+    source TEXT NOT NULL DEFAULT 'ai',
+    created_at TEXT NOT NULL
+  );
+  INSERT INTO cover_letter_versions_new (id,cover_letter_id,version_no,content,note,source,created_at)
+    SELECT id,cover_letter_id,version_no,content,note,source,created_at
+    FROM cover_letter_versions
+    WHERE cover_letter_id IN (SELECT id FROM cover_letters);
+  DROP TABLE cover_letter_versions;
+  ALTER TABLE cover_letter_versions_new RENAME TO cover_letter_versions;
+
+  -- fit_analyses.job_id -> jobs(id) ON DELETE CASCADE
+  CREATE TABLE fit_analyses_new (
+    id TEXT PRIMARY KEY,
+    job_id TEXT NOT NULL REFERENCES jobs(id) ON DELETE CASCADE,
+    score REAL,
+    summary TEXT,
+    strengths TEXT NOT NULL DEFAULT '[]',
+    gaps TEXT NOT NULL DEFAULT '[]',
+    matched_keywords TEXT NOT NULL DEFAULT '[]',
+    missing_keywords TEXT NOT NULL DEFAULT '[]',
+    recommendations TEXT NOT NULL DEFAULT '[]',
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  INSERT INTO fit_analyses_new (id,job_id,score,summary,strengths,gaps,matched_keywords,missing_keywords,recommendations,created_at,updated_at)
+    SELECT id,job_id,score,summary,strengths,gaps,matched_keywords,missing_keywords,recommendations,created_at,updated_at
+    FROM fit_analyses
+    WHERE job_id IN (SELECT id FROM jobs);
+  DROP TABLE fit_analyses;
+  ALTER TABLE fit_analyses_new RENAME TO fit_analyses;
+
+  -- applications: job_id CASCADE, resume_id/cover_letter_id SET NULL
+  CREATE TABLE applications_new (
+    id TEXT PRIMARY KEY,
+    job_id TEXT NOT NULL UNIQUE REFERENCES jobs(id) ON DELETE CASCADE,
+    status TEXT NOT NULL DEFAULT 'draft',
+    resume_id TEXT REFERENCES documents(id) ON DELETE SET NULL,
+    cover_letter_id TEXT REFERENCES cover_letters(id) ON DELETE SET NULL,
+    applied_at TEXT,
+    notes TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  INSERT INTO applications_new (id,job_id,status,resume_id,cover_letter_id,applied_at,notes,created_at,updated_at)
+    SELECT id,job_id,status,
+           CASE WHEN resume_id IN (SELECT id FROM documents) THEN resume_id ELSE NULL END,
+           CASE WHEN cover_letter_id IN (SELECT id FROM cover_letters) THEN cover_letter_id ELSE NULL END,
+           applied_at,notes,created_at,updated_at
+    FROM applications
+    WHERE job_id IN (SELECT id FROM jobs);
+  DROP TABLE applications;
+  ALTER TABLE applications_new RENAME TO applications;
+
+  -- interview_preps.job_id -> jobs(id) ON DELETE CASCADE
+  CREATE TABLE interview_preps_new (
+    id TEXT PRIMARY KEY,
+    job_id TEXT NOT NULL UNIQUE REFERENCES jobs(id) ON DELETE CASCADE,
+    questions TEXT NOT NULL DEFAULT '[]',
+    star_guides TEXT NOT NULL DEFAULT '[]',
+    self_introduction TEXT,
+    notes TEXT,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  );
+  INSERT INTO interview_preps_new (id,job_id,questions,star_guides,self_introduction,notes,created_at,updated_at)
+    SELECT id,job_id,questions,star_guides,self_introduction,notes,created_at,updated_at
+    FROM interview_preps
+    WHERE job_id IN (SELECT id FROM jobs);
+  DROP TABLE interview_preps;
+  ALTER TABLE interview_preps_new RENAME TO interview_preps;
+
+  -- Recreate indexes dropped along with their tables.
+  CREATE INDEX IF NOT EXISTS idx_fit_job ON fit_analyses(job_id);
+  CREATE INDEX IF NOT EXISTS idx_clv_letter ON cover_letter_versions(cover_letter_id);
+  CREATE INDEX IF NOT EXISTS idx_cl_job ON cover_letters(job_id);
+
+  COMMIT;
+  PRAGMA foreign_keys=ON;
   `
 ];
 function migrate(db) {
@@ -247,6 +364,26 @@ function getDb() {
   _db = db;
   return db;
 }
+var _inTx = false;
+function tx(fn) {
+  if (_inTx) return fn();
+  const db = getDb();
+  db.exec("BEGIN");
+  _inTx = true;
+  try {
+    const result = fn();
+    db.exec("COMMIT");
+    return result;
+  } catch (err) {
+    try {
+      db.exec("ROLLBACK");
+    } catch {
+    }
+    throw err;
+  } finally {
+    _inTx = false;
+  }
+}
 function toJson(value) {
   return JSON.stringify(value ?? null);
 }
@@ -305,6 +442,27 @@ var INTERVIEW_UNLOCK_STATUSES = [
   "interview",
   "final_passed"
 ];
+var ALLOWED_STATUS_TRANSITIONS = {
+  draft: ["planned", "applied", "document_passed", "interview", "final_passed", "rejected", "on_hold"],
+  planned: ["applied", "document_passed", "interview", "final_passed", "rejected", "on_hold"],
+  applied: ["planned", "document_passed", "interview", "final_passed", "rejected", "on_hold"],
+  document_passed: ["planned", "applied", "interview", "final_passed", "rejected", "on_hold"],
+  interview: ["planned", "applied", "document_passed", "final_passed", "rejected", "on_hold"],
+  final_passed: ["document_passed", "interview", "rejected", "on_hold"],
+  rejected: ["draft", "planned", "applied", "document_passed", "interview", "final_passed", "on_hold"],
+  on_hold: ["draft", "planned", "applied", "document_passed", "interview", "final_passed", "rejected"]
+};
+function canTransitionStatus(from, to) {
+  if (from === to) return true;
+  return ALLOWED_STATUS_TRANSITIONS[from]?.includes(to) ?? false;
+}
+function assertStatusTransition(from, to) {
+  if (!canTransitionStatus(from, to)) {
+    throw new Error(
+      `'${APPLICATION_STATUS_LABELS[from]}'\uC5D0\uC11C '${APPLICATION_STATUS_LABELS[to]}'(\uC73C)\uB85C\uB294 \uC0C1\uD0DC\uB97C \uBC14\uAFC0 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.`
+    );
+  }
+}
 var DOCUMENT_KINDS = ["resume", "career_description", "portfolio", "other"];
 var DOCUMENT_KIND_LABELS = {
   resume: "\uC774\uB825\uC11C",
@@ -4969,34 +5127,38 @@ var documentRepo = {
     const ts = now();
     const id3 = newId("doc_");
     const db = getDb();
-    if (input.is_primary) {
-      db.prepare(`UPDATE documents SET is_primary=0 WHERE kind=?`).run(input.kind);
-    }
-    db.prepare(
-      `INSERT INTO documents (id,kind,title,content,source,is_primary,tags,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?)`
-    ).run(
-      id3,
-      input.kind,
-      input.title,
-      input.content ?? "",
-      input.source ?? "manual",
-      toBit(input.is_primary),
-      toJson(input.tags ?? []),
-      ts,
-      ts
-    );
-    return this.get(id3);
+    return tx(() => {
+      if (input.is_primary) {
+        db.prepare(`UPDATE documents SET is_primary=0 WHERE kind=?`).run(input.kind);
+      }
+      db.prepare(
+        `INSERT INTO documents (id,kind,title,content,source,is_primary,tags,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?)`
+      ).run(
+        id3,
+        input.kind,
+        input.title,
+        input.content ?? "",
+        input.source ?? "manual",
+        toBit(input.is_primary),
+        toJson(input.tags ?? []),
+        ts,
+        ts
+      );
+      return this.get(id3);
+    });
   },
   update(id3, input) {
     const cur = this.get(id3);
     if (!cur) return null;
     const db = getDb();
     const m = { ...cur, ...input };
-    if (input.is_primary) db.prepare(`UPDATE documents SET is_primary=0 WHERE kind=?`).run(m.kind);
-    db.prepare(
-      `UPDATE documents SET kind=?,title=?,content=?,source=?,is_primary=?,tags=?,updated_at=? WHERE id=?`
-    ).run(m.kind, m.title, m.content, m.source, toBit(m.is_primary), toJson(m.tags), now(), id3);
-    return this.get(id3);
+    return tx(() => {
+      if (input.is_primary) db.prepare(`UPDATE documents SET is_primary=0 WHERE kind=?`).run(m.kind);
+      db.prepare(
+        `UPDATE documents SET kind=?,title=?,content=?,source=?,is_primary=?,tags=?,updated_at=? WHERE id=?`
+      ).run(m.kind, m.title, m.content, m.source, toBit(m.is_primary), toJson(m.tags), now(), id3);
+      return this.get(id3);
+    });
   },
   remove(id3) {
     return getDb().prepare(`DELETE FROM documents WHERE id=?`).run(id3).changes > 0;
@@ -5045,37 +5207,41 @@ var coverLetterRepo = {
     const ts = now();
     const id3 = newId("cl_");
     const db = getDb();
-    if (opts.is_primary) db.prepare(`UPDATE cover_letters SET is_primary=0`).run();
-    db.prepare(
-      `INSERT INTO cover_letters (id,title,job_id,is_primary,current_version_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?)`
-    ).run(id3, opts.title, opts.job_id ?? null, toBit(opts.is_primary), null, ts, ts);
-    return this.get(id3);
+    return tx(() => {
+      if (opts.is_primary) db.prepare(`UPDATE cover_letters SET is_primary=0`).run();
+      db.prepare(
+        `INSERT INTO cover_letters (id,title,job_id,is_primary,current_version_id,created_at,updated_at) VALUES (?,?,?,?,?,?,?)`
+      ).run(id3, opts.title, opts.job_id ?? null, toBit(opts.is_primary), null, ts, ts);
+      return this.get(id3);
+    });
   },
   /** Append a new version. Creates the cover letter if cover_letter_id is omitted. */
   addVersion(opts) {
     const db = getDb();
-    let clId = opts.cover_letter_id;
-    if (!clId) {
-      const cl = this.create({ title: opts.title ?? "\uC790\uAE30\uC18C\uAC1C\uC11C", job_id: opts.job_id ?? null });
-      clId = cl.id;
-    }
-    const maxRow = db.prepare(`SELECT MAX(version_no) AS m FROM cover_letter_versions WHERE cover_letter_id=?`).get(clId);
-    const versionNo = (maxRow.m ?? 0) + 1;
-    const vid = newId("clv_");
-    const ts = now();
-    db.prepare(
-      `INSERT INTO cover_letter_versions (id,cover_letter_id,version_no,content,note,source,created_at) VALUES (?,?,?,?,?,?,?)`
-    ).run(vid, clId, versionNo, opts.content, opts.note ?? null, opts.source ?? "ai", ts);
-    const setCurrent = opts.set_current !== false;
-    if (setCurrent) {
-      db.prepare(`UPDATE cover_letters SET current_version_id=?, updated_at=? WHERE id=?`).run(vid, ts, clId);
-    } else {
-      db.prepare(`UPDATE cover_letters SET updated_at=? WHERE id=?`).run(ts, clId);
-    }
-    if (opts.title) db.prepare(`UPDATE cover_letters SET title=? WHERE id=?`).run(opts.title, clId);
-    if (opts.job_id !== void 0)
-      db.prepare(`UPDATE cover_letters SET job_id=? WHERE id=?`).run(opts.job_id, clId);
-    return { coverLetter: this.get(clId), version: mapVersion(db.prepare(`SELECT * FROM cover_letter_versions WHERE id=?`).get(vid)) };
+    return tx(() => {
+      let clId = opts.cover_letter_id;
+      if (!clId) {
+        const cl = this.create({ title: opts.title ?? "\uC790\uAE30\uC18C\uAC1C\uC11C", job_id: opts.job_id ?? null });
+        clId = cl.id;
+      }
+      const maxRow = db.prepare(`SELECT MAX(version_no) AS m FROM cover_letter_versions WHERE cover_letter_id=?`).get(clId);
+      const versionNo = (maxRow.m ?? 0) + 1;
+      const vid = newId("clv_");
+      const ts = now();
+      db.prepare(
+        `INSERT INTO cover_letter_versions (id,cover_letter_id,version_no,content,note,source,created_at) VALUES (?,?,?,?,?,?,?)`
+      ).run(vid, clId, versionNo, opts.content, opts.note ?? null, opts.source ?? "ai", ts);
+      const setCurrent = opts.set_current !== false;
+      if (setCurrent) {
+        db.prepare(`UPDATE cover_letters SET current_version_id=?, updated_at=? WHERE id=?`).run(vid, ts, clId);
+      } else {
+        db.prepare(`UPDATE cover_letters SET updated_at=? WHERE id=?`).run(ts, clId);
+      }
+      if (opts.title) db.prepare(`UPDATE cover_letters SET title=? WHERE id=?`).run(opts.title, clId);
+      if (opts.job_id !== void 0)
+        db.prepare(`UPDATE cover_letters SET job_id=? WHERE id=?`).run(opts.job_id, clId);
+      return { coverLetter: this.get(clId), version: mapVersion(db.prepare(`SELECT * FROM cover_letter_versions WHERE id=?`).get(vid)) };
+    });
   },
   setCurrentVersion(coverLetterId, versionId) {
     getDb().prepare(`UPDATE cover_letters SET current_version_id=?, updated_at=? WHERE id=?`).run(versionId, now(), coverLetterId);
@@ -5083,14 +5249,18 @@ var coverLetterRepo = {
   },
   setPrimary(id3) {
     const db = getDb();
-    db.prepare(`UPDATE cover_letters SET is_primary=0`).run();
-    db.prepare(`UPDATE cover_letters SET is_primary=1, updated_at=? WHERE id=?`).run(now(), id3);
-    return this.get(id3);
+    return tx(() => {
+      db.prepare(`UPDATE cover_letters SET is_primary=0`).run();
+      db.prepare(`UPDATE cover_letters SET is_primary=1, updated_at=? WHERE id=?`).run(now(), id3);
+      return this.get(id3);
+    });
   },
   remove(id3) {
     const db = getDb();
-    db.prepare(`DELETE FROM cover_letter_versions WHERE cover_letter_id=?`).run(id3);
-    return db.prepare(`DELETE FROM cover_letters WHERE id=?`).run(id3).changes > 0;
+    return tx(() => {
+      db.prepare(`DELETE FROM cover_letter_versions WHERE cover_letter_id=?`).run(id3);
+      return db.prepare(`DELETE FROM cover_letters WHERE id=?`).run(id3).changes > 0;
+    });
   }
 };
 function mapJob(r) {
@@ -5175,10 +5345,12 @@ var jobRepo = {
   },
   remove(id3) {
     const db = getDb();
-    db.prepare(`DELETE FROM fit_analyses WHERE job_id=?`).run(id3);
-    db.prepare(`DELETE FROM applications WHERE job_id=?`).run(id3);
-    db.prepare(`DELETE FROM interview_preps WHERE job_id=?`).run(id3);
-    return db.prepare(`DELETE FROM jobs WHERE id=?`).run(id3).changes > 0;
+    return tx(() => {
+      db.prepare(`DELETE FROM fit_analyses WHERE job_id=?`).run(id3);
+      db.prepare(`DELETE FROM applications WHERE job_id=?`).run(id3);
+      db.prepare(`DELETE FROM interview_preps WHERE job_id=?`).run(id3);
+      return db.prepare(`DELETE FROM jobs WHERE id=?`).run(id3).changes > 0;
+    });
   }
 };
 function mapFit(r) {
@@ -5285,6 +5457,7 @@ var applicationRepo = {
   },
   upsert(input) {
     const app = this.ensure(input.job_id, input.status ?? "draft");
+    if (input.status && input.status !== app.status) assertStatusTransition(app.status, input.status);
     const m = { ...app, ...input };
     getDb().prepare(
       `UPDATE applications SET status=?,resume_id=?,cover_letter_id=?,applied_at=?,notes=?,updated_at=? WHERE id=?`
@@ -5293,6 +5466,7 @@ var applicationRepo = {
   },
   setStatus(jobId, status, note) {
     const app = this.ensure(jobId);
+    assertStatusTransition(app.status, status);
     const appliedAt = status === "applied" && !app.applied_at ? now() : app.applied_at;
     const notes = note ? [app.notes, note].filter(Boolean).join("\n") : app.notes;
     getDb().prepare(`UPDATE applications SET status=?, applied_at=?, notes=?, updated_at=? WHERE id=?`).run(status, appliedAt, notes, now(), app.id);
@@ -5368,6 +5542,21 @@ var activityRepo = {
     return getDb().prepare(`SELECT * FROM activities ORDER BY created_at DESC LIMIT ?`).all(limit);
   }
 };
+function getEntityCounts() {
+  const db = getDb();
+  const c = (t) => db.prepare(`SELECT COUNT(*) AS n FROM ${t}`).get().n;
+  return {
+    profile: c("profile"),
+    experiences: c("experiences"),
+    projects: c("projects"),
+    skills: c("skills"),
+    documents: c("documents"),
+    cover_letters: c("cover_letters"),
+    jobs: c("jobs"),
+    applications: c("applications"),
+    interview_preps: c("interview_preps")
+  };
+}
 
 // apps/web/src/security.ts
 import crypto from "node:crypto";
@@ -5677,6 +5866,21 @@ function addResume(input) {
   activityRepo.log("resume_added", `${doc.title} \uBB38\uC11C\uB97C \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4.`, "document", doc.id);
   return doc;
 }
+function addExperience(input) {
+  const exp = experienceRepo.add(input);
+  activityRepo.log("profile_updated", `\uACBD\uB825(${exp.company})\uC744 \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4.`, "experience", exp.id);
+  return exp;
+}
+function addProject(input) {
+  const prj = projectRepo.add(input);
+  activityRepo.log("profile_updated", `\uD504\uB85C\uC81D\uD2B8(${prj.name})\uB97C \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4.`, "project", prj.id);
+  return prj;
+}
+function addSkill(input) {
+  const skill = skillRepo.add(input);
+  activityRepo.log("profile_updated", `\uAE30\uC220(${skill.name})\uC744 \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4.`, "skill", skill.id);
+  return skill;
+}
 function saveJobPosting(input, id3) {
   const job = jobRepo.upsert(input, id3);
   const application = applicationRepo.ensure(job.id, "draft");
@@ -5734,7 +5938,13 @@ function updateApplicationStatus(jobId, status, note) {
 function saveInterviewPrep(input) {
   const job = jobRepo.get(input.job_id);
   if (!job) throw new Error(`\uACF5\uACE0\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4: ${input.job_id}`);
-  applicationRepo.ensure(job.id);
+  const app = applicationRepo.getByJob(job.id);
+  if (!app || !INTERVIEW_UNLOCK_STATUSES.includes(app.status)) {
+    const current = app ? APPLICATION_STATUS_LABELS[app.status] : "\uBBF8\uC9C0\uC6D0";
+    throw new Error(
+      `\uBA74\uC811 \uC900\uBE44\uB294 '\uC11C\uB958 \uD569\uACA9' \uC774\uC0C1 \uC0C1\uD0DC\uC5D0\uC11C\uB9CC \uC800\uC7A5\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4. \uD604\uC7AC \uC0C1\uD0DC: '${current}'. \uBA3C\uC800 update_application_status\uB85C \uC0C1\uD0DC\uB97C \uC62C\uB9B0 \uB4A4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694.`
+    );
+  }
   const prep = interviewRepo.save(input);
   activityRepo.log("interview_prep_saved", `${job.company} \xB7 ${job.position} \uBA74\uC811 \uC900\uBE44 \uC790\uB8CC\uB97C \uC800\uC7A5\uD588\uC2B5\uB2C8\uB2E4.`, "interview_prep", prep.id);
   return prep;
@@ -6360,11 +6570,8 @@ function cleanJobPosting(raw) {
 function escapeHtml(input) {
   return (input ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function looksLikeHtml2(s) {
-  return /<\/?(p|h[1-6]|ul|ol|li|div|section|article|br|hr|strong|em|a|table)\b/i.test(s);
-}
-function toPrintableHtml(title, bodyMarkdownOrHtml) {
-  const body = looksLikeHtml2(bodyMarkdownOrHtml) ? bodyMarkdownOrHtml : markdownToHtml(bodyMarkdownOrHtml);
+function toPrintableHtml(title, bodyMarkdown) {
+  const body = markdownToHtml(bodyMarkdown);
   const safeTitle = escapeHtml(title);
   return `<!doctype html>
 <html lang="ko">
@@ -6765,7 +6972,7 @@ function exportInterview(jobId, format) {
 
 // apps/web/src/info.ts
 var APP_NAME = "CareerMate";
-var APP_VERSION = "0.1.0";
+var APP_VERSION = true ? "0.1.1" : "0.0.0-dev";
 var _port = 0;
 function setServerPort(port) {
   _port = port;
@@ -6781,41 +6988,22 @@ function getServerInfo() {
     exports_dir: getExportsDir(),
     backups_dir: getBackupsDir(),
     node_version: process.version,
-    counts: {
-      profile: profileRepo.get() ? 1 : 0,
-      experiences: experienceRepo.list().length,
-      projects: projectRepo.list().length,
-      skills: skillRepo.list().length,
-      documents: documentRepo.list().length,
-      cover_letters: coverLetterRepo.list().length,
-      jobs: jobRepo.list().length,
-      applications: applicationRepo.list().length,
-      interview_preps: interviewRepo.list().length
-    }
+    counts: getEntityCounts()
   };
 }
 
 // apps/web/src/settings.ts
 import fs4 from "node:fs";
 import path4 from "node:path";
-var TABLES = [
-  "profile",
-  "experiences",
-  "projects",
-  "skills",
-  "documents",
-  "cover_letters",
-  "cover_letter_versions",
-  "jobs",
-  "fit_analyses",
-  "applications",
-  "interview_preps",
-  "activities"
-];
+function listTables(db) {
+  return db.prepare(
+    `SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%' AND name != '_meta' ORDER BY name`
+  ).all().map((r) => r.name);
+}
 function exportAll() {
   const db = getDb();
   const tables = {};
-  for (const t of TABLES) {
+  for (const t of listTables(db)) {
     tables[t] = db.prepare(`SELECT * FROM ${t}`).all();
   }
   const ver = db.prepare(`SELECT value FROM _meta WHERE key='schema_version'`).get();
@@ -6826,7 +7014,13 @@ function createBackup() {
   const dir = getBackupsDir();
   const dbBackup = path4.join(dir, `careermate-${stamp}.sqlite`);
   const jsonBackup = path4.join(dir, `careermate-${stamp}.json`);
+  const resolvedDir = path4.resolve(dir);
+  if (!path4.resolve(dbBackup).startsWith(resolvedDir + path4.sep)) {
+    throw new Error("\uBC31\uC5C5 \uACBD\uB85C\uAC00 \uBC31\uC5C5 \uD3F4\uB354\uB97C \uBC97\uC5B4\uB0AC\uC2B5\uB2C8\uB2E4.");
+  }
+  const safeForLiteral = !/[\0\n\r]/.test(dbBackup);
   try {
+    if (!safeForLiteral) throw new Error("backup path not safe for SQL literal");
     getDb().exec(`VACUUM INTO '${dbBackup.replace(/'/g, "''")}'`);
   } catch {
     fs4.copyFileSync(getDbPath(), dbBackup);
@@ -6842,7 +7036,7 @@ function resetAll(confirm) {
   const db = getDb();
   db.exec("BEGIN");
   try {
-    for (const t of TABLES) db.exec(`DELETE FROM ${t}`);
+    for (const t of listTables(db)) db.exec(`DELETE FROM ${t}`);
     db.exec("COMMIT");
   } catch (e) {
     db.exec("ROLLBACK");
@@ -6891,9 +7085,11 @@ function registerApiRoutes(router2) {
   router2.get("/api/health", () => ({ ok: true, ...getServerInfo() }));
   router2.get("/api/onboarding", () => getOnboardingStatus());
   router2.get("/api/summary", () => getHomeSummary());
-  router2.get("/api/activity", (ctx) => ({
-    activities: listRecentActivity(Number(ctx.query.get("limit") ?? 30))
-  }));
+  router2.get("/api/activity", (ctx) => {
+    const raw = Number(ctx.query.get("limit"));
+    const limit = Number.isFinite(raw) && raw > 0 ? Math.min(raw, 100) : 30;
+    return { activities: listRecentActivity(limit) };
+  });
   router2.get(
     "/api/context",
     (ctx) => getApplicationContext({ job_id: ctx.query.get("job_id") ?? void 0 })
@@ -6912,9 +7108,7 @@ function registerApiRoutes(router2) {
   router2.get("/api/experiences", () => ({ experiences: experienceRepo.list() }));
   router2.post("/api/experiences", async (ctx) => {
     const input = await readJsonBody(ctx.req, ExperienceInputSchema);
-    const exp = experienceRepo.add(input);
-    activityRepo.log("profile_updated", `\uACBD\uB825(${exp.company})\uC744 \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4.`, "experience", exp.id);
-    return { experience: exp };
+    return { experience: addExperience(input) };
   });
   router2.put("/api/experiences/:id", async (ctx) => {
     const input = await readJsonBody(ctx.req, ExperienceInputSchema.partial());
@@ -6926,9 +7120,7 @@ function registerApiRoutes(router2) {
   router2.get("/api/projects", () => ({ projects: projectRepo.list() }));
   router2.post("/api/projects", async (ctx) => {
     const input = await readJsonBody(ctx.req, ProjectInputSchema);
-    const prj = projectRepo.add(input);
-    activityRepo.log("profile_updated", `\uD504\uB85C\uC81D\uD2B8(${prj.name})\uB97C \uCD94\uAC00\uD588\uC2B5\uB2C8\uB2E4.`, "project", prj.id);
-    return { project: prj };
+    return { project: addProject(input) };
   });
   router2.put("/api/projects/:id", async (ctx) => {
     const input = await readJsonBody(ctx.req, ProjectInputSchema.partial());
@@ -6940,7 +7132,7 @@ function registerApiRoutes(router2) {
   router2.get("/api/skills", () => ({ skills: skillRepo.list() }));
   router2.post("/api/skills", async (ctx) => {
     const input = await readJsonBody(ctx.req, SkillInputSchema);
-    return { skill: skillRepo.add(input) };
+    return { skill: addSkill(input) };
   });
   router2.put("/api/skills/:id", async (ctx) => {
     const input = await readJsonBody(ctx.req, SkillInputSchema.partial());
@@ -7022,9 +7214,9 @@ function registerApiRoutes(router2) {
   router2.get("/api/jobs/:id", (ctx) => ({ job: jobDetail(id2(ctx)) }));
   router2.put("/api/jobs/:id", async (ctx) => {
     const input = await readJsonBody(ctx.req, JobInputSchema.partial());
-    const existing = jobRepo.get(id2(ctx));
-    if (!existing) throw new HttpError(404, "\uACF5\uACE0\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
-    const job = jobRepo.upsert({ ...existing, ...input }, existing.id);
+    const jid = id2(ctx);
+    if (!jobRepo.get(jid)) throw new HttpError(404, "\uACF5\uACE0\uB97C \uCC3E\uC744 \uC218 \uC5C6\uC2B5\uB2C8\uB2E4.");
+    const job = jobRepo.upsert(input, jid);
     return { job: jobWithMeta(job) };
   });
   router2.delete("/api/jobs/:id", (ctx) => ({ ok: jobRepo.remove(id2(ctx)) }));
@@ -7153,8 +7345,8 @@ function createServer() {
       }
       if (pathname.startsWith("/install/")) {
         const rel2 = pathname === "/install/" ? "index.html" : pathname.slice("/install/".length);
-        if (serveStatic(res, INSTALL_ROOT, rel2, injectToken)) return;
-        if (serveStatic(res, INSTALL_ROOT, "index.html", injectToken)) return;
+        if (serveStatic(res, INSTALL_ROOT, rel2)) return;
+        if (serveStatic(res, INSTALL_ROOT, "index.html")) return;
       }
       const rel = pathname === "/" ? "index.html" : pathname.slice(1);
       if (serveStatic(res, WEB_ROOT, rel, injectToken)) return;
@@ -7176,29 +7368,31 @@ function startServer(preferredPort) {
   const server = createServer();
   return new Promise((resolve, reject) => {
     let attempt = 0;
-    const tryListen = (port) => {
-      server.once("error", (e) => {
-        if (e.code === "EADDRINUSE" && attempt < 15) {
-          attempt++;
-          tryListen(port + 1);
-        } else {
-          reject(e);
-        }
-      });
-      server.listen(port, "127.0.0.1", () => {
-        setServerPort(port);
-        const url = `http://127.0.0.1:${port}`;
-        writeRuntimeInfo({ url, port, pid: process.pid, started_at: (/* @__PURE__ */ new Date()).toISOString() });
-        const cleanup = () => {
-          clearRuntimeInfo();
-          process.exit(0);
-        };
-        process.on("SIGINT", cleanup);
-        process.on("SIGTERM", cleanup);
-        resolve({ server, port, url });
-      });
+    const onError = (e) => {
+      if (e.code === "EADDRINUSE" && attempt < 15) {
+        attempt++;
+        server.listen(preferredPort + attempt, "127.0.0.1");
+      } else {
+        reject(e);
+      }
     };
-    tryListen(preferredPort);
+    server.on("error", onError);
+    server.once("listening", () => {
+      server.removeListener("error", onError);
+      const addr = server.address();
+      const port = typeof addr === "object" && addr ? addr.port : preferredPort;
+      setServerPort(port);
+      const url = `http://127.0.0.1:${port}`;
+      writeRuntimeInfo({ url, port, pid: process.pid, started_at: (/* @__PURE__ */ new Date()).toISOString() });
+      const cleanup = () => {
+        clearRuntimeInfo();
+        process.exit(0);
+      };
+      process.on("SIGINT", cleanup);
+      process.on("SIGTERM", cleanup);
+      resolve({ server, port, url });
+    });
+    server.listen(preferredPort, "127.0.0.1");
   });
 }
 

package/docs/DEMO.md

@@ -7,7 +7,7 @@
 
 > 핵심 모델: **CareerMate 안에는 LLM이 없습니다.** 분석·작성은 당신의 AI(ChatGPT/Claude/Gemini)가 수행하고, CareerMate는 로컬 DB에 데이터를 읽고/쓰는 **MCP 도구**를 제공합니다. 모든 데이터는 로컬(`~/.careermate`)에만 저장됩니다.
 >
-> 관련 문서: [`INSTALL.md`](./INSTALL.md) · [`START_WORKFLOW.md`](./START_WORKFLOW.md)
+> 관련 문서: [`INSTALL.md`](../INSTALL.md) · [`START_WORKFLOW.md`](./START_WORKFLOW.md)
 
 ---
 
@@ -106,7 +106,7 @@ npm start
 
 ### 5단계 — AI 클라이언트에서 MCP 연결 확인 🧑
 
-- CareerMate는 **로컬 stdio MCP 서버**라, 내 컴퓨터에서 실행되며 로컬 프로그램을 띄울 수 있는 클라이언트에서만 동작합니다 — Claude Desktop · Cursor · Cline · Windsurf · Claude Code. (ChatGPT·Gemini의 웹/앱은 클라우드에서 돌아 로컬 MCP 서버에 직접 연결할 수 없습니다.) 설치는 두 갈래입니다: 비개발자는 `.mcpb` 원클릭, 개발자는 `npm run init` 자동 등록 — 자세한 절차는 [`INSTALL_AND_USAGE.md`](./INSTALL_AND_USAGE.md)를 참고하세요. MCP 서버 자체는 보통 다음 형태로 기동됩니다(클라이언트가 자동 실행).
+- CareerMate는 **로컬 stdio MCP 서버**라, 내 컴퓨터에서 실행되며 로컬 프로그램을 띄울 수 있는 클라이언트에서만 동작합니다 — Claude Desktop · Cursor · Cline · Windsurf · Claude Code. (ChatGPT·Gemini의 웹/앱은 클라우드에서 돌아 로컬 MCP 서버에 직접 연결할 수 없습니다.) 설치는 크게 세 갈래입니다: 에이전트가 한 문장으로 대신 설치 / 터미널 `npx -y careermate init` / Claude Desktop `.mcpb` — 자세한 절차는 [`SUPPORTED_AI_APPS.md`](./SUPPORTED_AI_APPS.md)(또는 사람용 안내 https://careermate.life)를 참고하세요. MCP 서버 자체는 보통 다음 형태로 기동됩니다(클라이언트가 자동 실행).
 
 ```bash
 npm run mcp
@@ -239,4 +239,4 @@ npm run mcp
 7. `save_interview_prep` — 면접 준비 저장
 8. `open_application` / `open_dashboard` — 사용자에게 결과 보여주기
 
-> 더 자세한 단계별 런북은 [`START_WORKFLOW.md`](./START_WORKFLOW.md), 설치·연결은 [`INSTALL.md`](./INSTALL.md)를 참고하세요.
+> 더 자세한 단계별 런북은 [`START_WORKFLOW.md`](./START_WORKFLOW.md), 설치·연결은 [`INSTALL.md`](../INSTALL.md)를 참고하세요.