careermate 0.1.1 → 0.1.3

package/apps/web/public/pages/profile.js

@@ -1,20 +1,12 @@
 // Profile — the user's career identity, fully editable. Feeds AI writing/analysis.
 import {
-  el, get, post, put, del, icon, Card, Badge, Btn, IconBtn, EmptyState, Chips,
+  el, get, post, put, del, icon, Card, Badge, Btn, IconBtn, SubmitBtn, EmptyState, Chips,
   Field, Input, Textarea, openModal, closeModal, confirmDialog,
-  toastOk, toastError, fmtDate, mount,
+  toastOk, toastError, fmtDate, mount, linesToArray, csvToArray,
 } from '/lib.js';
 
 /* ----------------------------------------------------------- small helpers */
 
-// textarea (newline-separated) → trimmed array, empties dropped.
-function lines(str) {
-  return String(str || '').split('\n').map((s) => s.trim()).filter(Boolean);
-}
-// "a, b, c" → trimmed array, empties dropped.
-function commas(str) {
-  return String(str || '').split(',').map((s) => s.trim()).filter(Boolean);
-}
 function val(node) { return node ? node.value : ''; }
 
 // Render a "YYYY-MM ~ YYYY-MM / 재직중" period label from a record.
@@ -146,24 +138,22 @@ function editBasic(p, reload) {
     ),
     footer: (close) => [
       Btn('취소', { onClick: close }),
-      Btn('기본 정보 저장', { variant: 'primary', onClick: async () => {
-        const links = lines(linksTa.value).map((line) => {
+      SubmitBtn('기본 정보 저장', async () => {
+        const links = linesToArray(linksTa.value).map((line) => {
           const i = line.indexOf('|');
           const label = (i >= 0 ? line.slice(0, i) : line).trim();
           const url = (i >= 0 ? line.slice(i + 1) : line).trim();
           return { label: label || url, url };
         }).filter((l) => l.url);
-        try {
-          await put('/api/profile', {
-            name: val(name).trim(), email: val(email).trim(), phone: val(phone).trim(),
-            location: val(location).trim(), headline: val(headline).trim(),
-            summary: val(summary).trim(), links,
-          });
-          toastOk('기본 정보를 저장했어요.');
-          close();
-          await reload();
-        } catch (e) { toastError(e); }
-      } }),
+        await put('/api/profile', {
+          name: val(name).trim(), email: val(email).trim(), phone: val(phone).trim(),
+          location: val(location).trim(), headline: val(headline).trim(),
+          summary: val(summary).trim(), links,
+        });
+        toastOk('기본 정보를 저장했어요.');
+        close();
+        await reload();
+      }),
     ],
   });
 }
@@ -206,17 +196,15 @@ function editDesired(p, reload) {
     ),
     footer: (close) => [
       Btn('취소', { onClick: close }),
-      Btn('희망 조건 저장', { variant: 'primary', onClick: async () => {
-        try {
-          await put('/api/profile', {
-            desired_roles: commas(roles.value),
-            desired_conditions: val(conditions).trim(),
-          });
-          toastOk('희망 조건을 저장했어요.');
-          close();
-          await reload();
-        } catch (e) { toastError(e); }
-      } }),
+      SubmitBtn('희망 조건 저장', async () => {
+        await put('/api/profile', {
+          desired_roles: csvToArray(roles.value),
+          desired_conditions: val(conditions).trim(),
+        });
+        toastOk('희망 조건을 저장했어요.');
+        close();
+        await reload();
+      }),
     ],
   });
 }
@@ -260,17 +248,15 @@ function editWriting(p, reload) {
     ),
     footer: (close) => [
       Btn('취소', { onClick: close }),
-      Btn('설정 저장', { variant: 'primary', onClick: async () => {
-        try {
-          await put('/api/profile', {
-            preferred_tone: val(tone).trim(),
-            emphasis_points: lines(emphasis.value),
-          });
-          toastOk('자기소개서 설정을 저장했어요.');
-          close();
-          await reload();
-        } catch (e) { toastError(e); }
-      } }),
+      SubmitBtn('설정 저장', async () => {
+        await put('/api/profile', {
+          preferred_tone: val(tone).trim(),
+          emphasis_points: linesToArray(emphasis.value),
+        });
+        toastOk('자기소개서 설정을 저장했어요.');
+        close();
+        await reload();
+      }),
     ],
   });
 }
@@ -278,7 +264,7 @@ function editWriting(p, reload) {
 /* ---------------------------------------------------- 4. 경력 (Experiences) */
 
 function ExperiencesCard(items, reload) {
-  const add = Btn('추가', { icon: 'plus', sm: true, variant: 'ghost', onClick: () => editExperience(null, reload) });
+  const add = Btn('경력 추가', { icon: 'plus', sm: true, variant: 'ghost', onClick: () => editExperience(null, reload) });
 
   if (!items.length) {
     return Card({
@@ -323,7 +309,7 @@ function ExperiencesCard(items, reload) {
 async function removeExperience(x, reload) {
   const ok = await confirmDialog({ title: '경력 삭제', message: `"${x.company}" 경력을 삭제할까요?`, confirmLabel: '삭제', danger: true });
   if (!ok) return;
-  try { await del(`/api/experiences/${x.id}`); toastOk('삭제했어요.'); await reload(); }
+  try { await del(`/api/experiences/${x.id}`); toastOk('경력을 삭제했어요.'); await reload(); }
   catch (e) { toastError(e); }
 }
 
@@ -356,8 +342,8 @@ function editExperience(x, reload) {
     ),
     footer: (close) => [
       Btn('취소', { onClick: close }),
-      Btn('경력 저장', { variant: 'primary', onClick: async () => {
-        if (!val(company).trim()) { toastError(new Error('회사명을 입력해 주세요.')); return; }
+      SubmitBtn(x ? '경력 저장' : '경력 추가', async () => {
+        if (!val(company).trim()) throw new Error('회사명을 입력해 주세요.');
         const payload = {
           company: val(company).trim(),
           role: val(role).trim(),
@@ -366,17 +352,15 @@ function editExperience(x, reload) {
           end_date: isCurrent.checked ? '' : val(end).trim(),
           is_current: isCurrent.checked,
           description: val(desc).trim(),
-          achievements: lines(achievements.value),
-          tech: commas(tech.value),
+          achievements: linesToArray(achievements.value),
+          tech: csvToArray(tech.value),
         };
-        try {
-          if (x) await put(`/api/experiences/${x.id}`, payload);
-          else await post('/api/experiences', payload);
-          toastOk(x ? '경력을 수정했어요.' : '경력을 추가했어요.');
-          close();
-          await reload();
-        } catch (e) { toastError(e); }
-      } }),
+        if (x) await put(`/api/experiences/${x.id}`, payload);
+        else await post('/api/experiences', payload);
+        toastOk(x ? '경력을 수정했어요.' : '경력을 추가했어요.');
+        close();
+        await reload();
+      }),
     ],
   });
 }
@@ -384,7 +368,7 @@ function editExperience(x, reload) {
 /* ----------------------------------------------------- 5. 프로젝트 (Projects) */
 
 function ProjectsCard(items, reload) {
-  const add = Btn('추가', { icon: 'plus', sm: true, variant: 'ghost', onClick: () => editProject(null, reload) });
+  const add = Btn('프로젝트 추가', { icon: 'plus', sm: true, variant: 'ghost', onClick: () => editProject(null, reload) });
 
   if (!items.length) {
     return Card({
@@ -432,7 +416,7 @@ function periodProject(x) {
 async function removeProject(x, reload) {
   const ok = await confirmDialog({ title: '프로젝트 삭제', message: `"${x.name}" 프로젝트를 삭제할까요?`, confirmLabel: '삭제', danger: true });
   if (!ok) return;
-  try { await del(`/api/projects/${x.id}`); toastOk('삭제했어요.'); await reload(); }
+  try { await del(`/api/projects/${x.id}`); toastOk('프로젝트를 삭제했어요.'); await reload(); }
   catch (e) { toastError(e); }
 }
 
@@ -460,43 +444,41 @@ function editProject(x, reload) {
     ),
     footer: (close) => [
       Btn('취소', { onClick: close }),
-      Btn('프로젝트 저장', { variant: 'primary', onClick: async () => {
-        if (!val(name).trim()) { toastError(new Error('프로젝트명을 입력해 주세요.')); return; }
+      SubmitBtn(x ? '프로젝트 저장' : '프로젝트 추가', async () => {
+        if (!val(name).trim()) throw new Error('프로젝트명을 입력해 주세요.');
         const payload = {
           name: val(name).trim(),
           role: val(role).trim(),
           description: val(desc).trim(),
-          highlights: lines(highlights.value),
-          tech: commas(tech.value),
+          highlights: linesToArray(highlights.value),
+          tech: csvToArray(tech.value),
           url: val(url).trim(),
           start_date: val(start).trim(),
           end_date: val(end).trim(),
         };
-        try {
-          if (x) await put(`/api/projects/${x.id}`, payload);
-          else await post('/api/projects', payload);
-          toastOk(x ? '프로젝트를 수정했어요.' : '프로젝트를 추가했어요.');
-          close();
-          await reload();
-        } catch (e) { toastError(e); }
-      } }),
+        if (x) await put(`/api/projects/${x.id}`, payload);
+        else await post('/api/projects', payload);
+        toastOk(x ? '프로젝트를 수정했어요.' : '프로젝트를 추가했어요.');
+        close();
+        await reload();
+      }),
     ],
   });
 }
 
-/* -------------------------------------------------------- 6. 기술스택 (Skills) */
+/* -------------------------------------------------------- 6. 기술 (Skills) */
 
 function SkillsCard(items, reload) {
-  const add = Btn('추가', { icon: 'plus', sm: true, variant: 'ghost', onClick: () => editSkill(null, reload) });
+  const add = Btn('기술 추가', { icon: 'plus', sm: true, variant: 'ghost', onClick: () => editSkill(null, reload) });
 
   if (!items.length) {
     return Card({
-      title: '기술스택',
+      title: '기술',
       actions: add,
       body: EmptyState({
         iconName: 'sparkle',
         title: '등록된 기술이 없어요',
-        body: '보유 기술스택을 정리해 두면 공고 키워드 매칭이 정확해집니다.',
+        body: '보유 기술을 정리해 두면 공고 키워드 매칭이 정확해집니다.',
         action: Btn('기술 추가', { icon: 'plus', variant: 'primary', onClick: () => editSkill(null, reload) }),
       }),
     });
@@ -524,7 +506,7 @@ function SkillsCard(items, reload) {
             IconBtn('trash', { title: '삭제', variant: 'danger', onClick: () => removeSkill(s, reload) })))))));
 
   return Card({
-    title: '기술스택',
+    title: '기술',
     sub: `${items.length}개`,
     actions: add,
     body: el('div', { class: 'stack-3' }, ...blocks),
@@ -534,7 +516,7 @@ function SkillsCard(items, reload) {
 async function removeSkill(s, reload) {
   const ok = await confirmDialog({ title: '기술 삭제', message: `"${s.name}"을(를) 삭제할까요?`, confirmLabel: '삭제', danger: true });
   if (!ok) return;
-  try { await del(`/api/skills/${s.id}`); toastOk('삭제했어요.'); await reload(); }
+  try { await del(`/api/skills/${s.id}`); toastOk('기술을 삭제했어요.'); await reload(); }
   catch (e) { toastError(e); }
 }
 
@@ -554,8 +536,8 @@ function editSkill(s, reload) {
     ),
     footer: (close) => [
       Btn('취소', { onClick: close }),
-      Btn('기술 저장', { variant: 'primary', onClick: async () => {
-        if (!val(name).trim()) { toastError(new Error('기술명을 입력해 주세요.')); return; }
+      SubmitBtn(s ? '기술 저장' : '기술 추가', async () => {
+        if (!val(name).trim()) throw new Error('기술명을 입력해 주세요.');
         const yrs = val(years).trim();
         const payload = {
           name: val(name).trim(),
@@ -563,14 +545,12 @@ function editSkill(s, reload) {
           level: val(level).trim(),
         };
         if (yrs !== '' && !Number.isNaN(Number(yrs))) payload.years = Number(yrs);
-        try {
-          if (s) await put(`/api/skills/${s.id}`, payload);
-          else await post('/api/skills', payload);
-          toastOk(s ? '기술을 수정했어요.' : '기술을 추가했어요.');
-          close();
-          await reload();
-        } catch (e) { toastError(e); }
-      } }),
+        if (s) await put(`/api/skills/${s.id}`, payload);
+        else await post('/api/skills', payload);
+        toastOk(s ? '기술을 수정했어요.' : '기술을 추가했어요.');
+        close();
+        await reload();
+      }),
     ],
   });
 }

package/apps/web/public/pages/settings.js

@@ -6,7 +6,7 @@ import {
 } from '/lib.js';
 
 const COUNT_LABELS = {
-  profile: '프로필', experiences: '경력', projects: '프로젝트', skills: '스킬',
+  profile: '프로필', experiences: '경력', projects: '프로젝트', skills: '기술',
   documents: '문서', cover_letters: '자기소개서', jobs: '채용공고',
   applications: '지원', interview_preps: '면접 준비',
 };
@@ -90,7 +90,8 @@ function Connection(info) {
 
 /* ------------------------------------------------------------- 테마 */
 function currentTheme() {
-  const saved = localStorage.getItem('cf-theme');
+  // New key with legacy 'cf-theme' fallback so a saved theme survives the rename.
+  const saved = localStorage.getItem('careermate-theme') || localStorage.getItem('cf-theme');
   return saved === 'light' || saved === 'dark' ? saved : 'system';
 }
 
@@ -106,10 +107,12 @@ function Theme() {
   function applyTheme(value) {
     if (value === 'system') {
       delete document.documentElement.dataset.theme;
-      localStorage.removeItem('cf-theme');
+      localStorage.removeItem('careermate-theme');
+      localStorage.removeItem('cf-theme'); // also clear legacy key
     } else {
       document.documentElement.dataset.theme = value;
-      localStorage.setItem('cf-theme', value);
+      localStorage.setItem('careermate-theme', value);
+      localStorage.removeItem('cf-theme'); // migrate off legacy key
     }
     paint();
   }
@@ -150,7 +153,7 @@ function Backup(backups = [], rerender) {
   async function createBackup() {
     try {
       const res = await post('/api/settings/backup');
-      toastOk('백업을 생성했습니다.');
+      toastOk('백업을 생성했어요.');
       await rerender();
     } catch (e) {
       toastError(e);
@@ -181,10 +184,12 @@ function Backup(backups = [], rerender) {
 function DangerZone(ctx) {
   function openResetModal() {
     let confirmBtn;
+    // Gate on the Korean word so there's no IME switch and it matches the '초기화' button.
+    // (The API still expects the fixed 'DELETE' token; we send that on the wire below.)
     const input = Input({
-      placeholder: 'DELETE',
-      onInput: (e) => { if (confirmBtn) confirmBtn.disabled = e.target.value.trim() !== 'DELETE'; },
-      onKeydown: (e) => { if (e.key === 'Enter' && e.target.value.trim() === 'DELETE' && confirmBtn && !confirmBtn.disabled) confirmBtn.click(); },
+      placeholder: '초기화',
+      onInput: (e) => { if (confirmBtn) confirmBtn.disabled = e.target.value.trim() !== '초기화'; },
+      onKeydown: (e) => { if (e.key === 'Enter' && e.target.value.trim() === '초기화' && confirmBtn && !confirmBtn.disabled) confirmBtn.click(); },
     });
 
     openModal({
@@ -197,7 +202,7 @@ function DangerZone(ctx) {
             el('div', { class: 'callout__body' },
               '프로필·공고·지원·문서·면접 준비를 포함한 모든 데이터가 영구적으로 삭제됩니다. 안전을 위해 초기화 직전에 자동으로 백업이 한 번 생성됩니다.'))),
         el('p', { class: 'text-secondary', style: { margin: 0, lineHeight: '1.6' } },
-          '계속하려면 아래 입력란에 ', el('span', { class: 'strong' }, 'DELETE'), ' 를 입력하세요.'),
+          '계속하려면 아래 입력란에 ', el('span', { class: 'strong' }, '초기화'), ' 를 입력하세요.'),
         input),
       footer: (close) => {
         confirmBtn = Btn('모든 데이터 초기화', {
@@ -208,7 +213,7 @@ function DangerZone(ctx) {
             try {
               await post('/api/settings/reset', { confirm: 'DELETE' });
               close();
-              toastOk('모든 데이터가 초기화되었습니다.');
+              toastOk('모든 데이터를 초기화했어요.');
               navigate('/');
               await ctx.refreshNav();
             } catch (e) {

package/apps/web/public/styles.css

@@ -155,6 +155,13 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .topbar__title { font-size: 15px; font-weight: 650; }
 .topbar__crumb { color: var(--text-tertiary); }
 .topbar__spacer { flex: 1; }
+/* mobile nav: hamburger (hidden ≥900px) + off-canvas drawer scrim */
+.nav-toggle { display: none; width: 34px; height: 34px; flex: none; place-items: center;
+  border: 1px solid var(--border); background: var(--surface); border-radius: var(--radius-sm);
+  color: var(--text-secondary); cursor: pointer; margin-right: 4px; }
+.nav-toggle:hover { background: var(--surface-hover); color: var(--text); }
+.nav-toggle svg { width: 20px; height: 20px; }
+.nav-scrim { display: none; position: fixed; inset: 0; z-index: 40; background: rgba(0,0,0,.4); }
 .view { padding: 24px; max-width: var(--maxw); width: 100%; margin: 0 auto; }
 .view--wide { max-width: 1280px; }
 
@@ -168,7 +175,16 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .grid--2 { grid-template-columns: repeat(2, 1fr); }
 .grid--3 { grid-template-columns: repeat(3, 1fr); }
 .grid--4 { grid-template-columns: repeat(4, 1fr); }
-@media (max-width: 900px){ .grid--2,.grid--3,.grid--4{ grid-template-columns: 1fr; } .app{ grid-template-columns: 1fr; } .sidebar{ display:none; } }
+@media (max-width: 900px){
+  .grid--2,.grid--3,.grid--4{ grid-template-columns: 1fr; }
+  .app{ grid-template-columns: 1fr; }
+  /* sidebar slides in as an off-canvas drawer; the topbar hamburger toggles it */
+  .sidebar{ position: fixed; top: 0; left: 0; bottom: 0; height: 100%; z-index: 50;
+    transform: translateX(-100%); transition: transform .22s ease; box-shadow: var(--shadow-lg); }
+  .app.nav-open .sidebar{ transform: none; }
+  .app.nav-open .nav-scrim{ display: block; }
+  .nav-toggle{ display: inline-grid; }
+}
 
 /* ----------------------------------------------------------------- card */
 .card { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius-lg); box-shadow: var(--shadow-sm); }
@@ -229,7 +245,14 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
   background: var(--surface); border: 1px solid var(--border-strong); border-radius: var(--radius-sm);
   padding: 8px 11px; transition: border-color .12s, box-shadow .12s;
 }
-.input:focus, .textarea:focus, .select:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-soft); }
+.input:focus, .textarea:focus, .select:focus { border-color: var(--accent); box-shadow: 0 0 0 3px var(--accent-soft); }
+/* keyboard focus must be clearly visible (the soft ring alone fails WCAG 1.4.11/2.4.11) */
+.input:focus-visible, .textarea:focus-visible, .select:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; box-shadow: none; }
+/* skip link — hidden until focused, then drops into the top-left */
+.skip-link { position: fixed; top: 8px; left: 8px; z-index: 200; transform: translateY(-200%);
+  background: var(--accent); color: var(--text-on-accent); padding: 8px 14px; border: 0;
+  border-radius: var(--radius-sm); font: inherit; font-weight: 600; cursor: pointer; transition: transform .15s; }
+.skip-link:focus { transform: none; outline: 2px solid var(--text-on-accent); outline-offset: 2px; }
 .textarea { resize: vertical; min-height: 90px; line-height: 1.6; }
 .textarea--lg { min-height: 280px; font-size: 15px; }
 .input::placeholder, .textarea::placeholder { color: var(--text-tertiary); }
@@ -268,6 +291,9 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .table tbody tr.is-clickable:hover { background: var(--surface-hover); }
 .table .muted { color: var(--text-tertiary); }
 .table .strong { font-weight: 600; }
+/* keyboard-reachable lead-cell link that looks identical to plain text */
+.cell-link { color: inherit; text-decoration: none; }
+.cell-link:hover { text-decoration: none; }
 
 /* ----------------------------------------------------------------- progress */
 .progress { height: 7px; background: var(--bg-sunken); border-radius: 999px; overflow: hidden; }
@@ -377,7 +403,9 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
   background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); padding: 22px 26px; max-height: 60vh; overflow-y: auto; }
 .kv { display: grid; grid-template-columns: 132px 1fr; gap: 8px 16px; }
 .kv dt { color: var(--text-tertiary); font-size: 13px; }
-.kv dd { margin: 0; }
+/* min-width:0 overrides a grid item's default min-width:auto so the 1fr column
+   can shrink below its content — otherwise a long path/value overflows the grid. */
+.kv dd { margin: 0; min-width: 0; }
 
 /* ----------------------------------------------------------------- modal */
 .modal-root { position: fixed; inset: 0; z-index: 60; display: none; }
@@ -390,6 +418,9 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .modal__head { padding: 16px 20px; border-bottom: 1px solid var(--border); display: flex; align-items: center; }
 .modal__head h3 { font-size: 15px; }
 .modal__body { padding: 20px; overflow-y: auto; }
+.modal__error { margin: 0 20px 4px; padding: 10px 12px; border-radius: var(--radius); border: 1px solid var(--red-border);
+  background: var(--red-soft); color: var(--red); font-size: 13px; line-height: 1.5; }
+.modal__error[hidden] { display: none; }
 .modal__foot { padding: 14px 20px; border-top: 1px solid var(--border); display: flex; justify-content: flex-end; gap: 8px; }
 @keyframes pop { from { transform: translate(-50%,-46%); opacity: 0; } to { transform: translate(-50%,-50%); opacity: 1; } }
 @keyframes fade { from { opacity: 0; } to { opacity: 1; } }
@@ -421,11 +452,15 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .between { justify-content: space-between; } .center { align-items: center; } .wrap { flex-wrap: wrap; }
 .ml-auto { margin-left: auto; } .mt-2{margin-top:8px;} .mt-3{margin-top:12px;} .mt-4{margin-top:16px;} .mb-2{margin-bottom:8px;} .mb-3{margin-bottom:12px;} .mb-4{margin-bottom:16px;}
 .tnum { font-variant-numeric: tabular-nums; }
-.truncate { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 100%; }
+/* min-width:0 lets a truncating element actually shrink inside a flex row;
+   without it a long unbreakable value (e.g. a data-folder path) forces the
+   flex item to its content width and overflows the viewport on narrow screens. */
+.truncate { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 100%; min-width: 0; }
 .divider { height: 1px; background: var(--border); margin: 16px 0; }
 .skeleton { background: linear-gradient(90deg, var(--bg-sunken) 25%, var(--surface-hover) 37%, var(--bg-sunken) 63%); background-size: 400% 100%; animation: shimmer 1.4s infinite; border-radius: 6px; }
 @keyframes shimmer { 0% { background-position: 100% 0; } 100% { background-position: 0 0; } }
 .hide { display: none !important; }
+.sr-only { position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px; overflow: hidden; clip: rect(0,0,0,0); white-space: nowrap; border: 0; }
 
 /* score color helper */
 .score-strong { color: var(--green); } .score-mid { color: var(--amber); } .score-weak { color: var(--red); }
@@ -437,3 +472,27 @@ h1,h2,h3,h4 { margin: 0; font-weight: 650; letter-spacing: -0.01em; }
 .callout--privacy svg { color: var(--text-tertiary); }
 .callout__title { font-weight: 600; margin-bottom: 2px; }
 .callout__body { color: var(--text-secondary); font-size: 13px; }
+
+/* ----------------------------------------------------------------- phone layout */
+/* Placed last so these win over the base widths (media queries add no specificity). */
+@media (max-width: 640px){
+  .topbar{ padding: 0 12px; gap: 8px; }
+  /* title takes the room between hamburger and actions and truncates instead of
+     collapsing to vertical text; the flex spacer isn't needed at this width */
+  .topbar__title{ flex: 1; min-width: 0; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  .topbar__spacer{ display: none; }
+  .input--inline{ width: 110px; max-width: 32vw; }
+  .view{ padding: 16px; }
+  /* jobs table: drop the secondary 위치·마감일 column so 회사·직무·적합도·상태 all fit */
+  .table--jobs th:nth-child(2), .table--jobs td:nth-child(2){ display: none; }
+  /* keep the 적합도 score ("88점") on one line in the narrow column */
+  .table--jobs th:nth-child(3), .table--jobs td:nth-child(3){ white-space: nowrap; }
+  .table--jobs td:nth-child(3) .tnum{ font-size: 13px; }
+  /* any remaining wide table can still scroll instead of crushing columns */
+  .table-scroll{ overflow-x: auto; -webkit-overflow-scrolling: touch; }
+  /* stack key/value so long emails·paths·URLs aren't clipped by the fixed label column */
+  .kv{ grid-template-columns: 1fr; gap: 0; }
+  .kv dt{ margin-top: 10px; }
+  .kv dd{ margin: 0 0 2px; }
+  .page-head{ flex-wrap: wrap; }
+}

package/apps/web/src/http.ts

@@ -107,8 +107,13 @@ export async function readJsonBody<T>(req: IncomingMessage, schema?: ZodType<T>)
     return schema.parse(parsed);
   } catch (e) {
     if (e instanceof ZodError) {
-      const msg = e.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join(', ');
-      throw new HttpError(400, `입력값 검증 실패 — ${msg}`, 'validation');
+      // Messages already written as full Korean guidance are shown as-is (the zod
+      // path like "links.0.url" is developer jargon). Generic/English messages keep
+      // a field hint so the user knows which input to fix.
+      const msg = e.issues
+        .map((i) => (/[가-힣]/.test(i.message) ? i.message : `${i.path.join('.') || '입력값'}: ${i.message}`))
+        .join('\n');
+      throw new HttpError(400, msg, 'validation');
     }
     throw e;
   }
@@ -170,11 +175,33 @@ export function serveStatic(
   const mime = MIME[ext] ?? 'application/octet-stream';
   let payload: Buffer | string = fs.readFileSync(resolved);
   if (transform && (ext === '.html')) payload = transform(payload.toString('utf8'));
-  res.writeHead(200, {
+  const headers: Record<string, string> = {
     'Content-Type': mime,
     'X-Content-Type-Options': 'nosniff',
     'Cache-Control': ext === '.html' ? 'no-store' : 'no-cache',
-  });
+  };
+  if (ext === '.html') {
+    // Content-Security-Policy: with no inline scripts and only same-origin
+    // assets, any XSS that slips past escaping can't load external code or
+    // exfiltrate (connect-src 'self'). Dashboard pages (served with the token
+    // transform) hold the CSRF token and render user-controlled career data, so
+    // they get a strict no-inline-script policy. The install page (no transform)
+    // is static marketing with inline bootstrap scripts (theme/carousel), so it
+    // permits inline script but keeps every other hardening directive.
+    const scriptSrc = transform ? "script-src 'self'" : "script-src 'self' 'unsafe-inline'";
+    headers['Content-Security-Policy'] = [
+      "default-src 'none'",
+      scriptSrc,
+      "style-src 'self' 'unsafe-inline'", // inline style="" attrs + JS-set element styles
+      "img-src 'self' data:", // data: favicon + local screenshots/icons
+      "font-src 'self'",
+      "connect-src 'self'",
+      "base-uri 'none'",
+      "form-action 'none'",
+      "frame-ancestors 'none'", // clickjacking guard
+    ].join('; ');
+  }
+  res.writeHead(200, headers);
   res.end(payload);
   return true;
 }

package/apps/web/src/info.ts

@@ -10,11 +10,11 @@ import {
   getBackupsDir,
   getEntityCounts,
 } from '@careermate/db';
+import { APP_VERSION } from '@careermate/shared';
 
 export const APP_NAME = 'CareerMate';
-// 번들 빌드(esbuild)에서 package.json 버전으로 치환된다. tsx 개발 실행에서는 정의되지 않아 typeof로 안전 분기.
-declare const __APP_VERSION__: string | undefined;
-export const APP_VERSION = typeof __APP_VERSION__ !== 'undefined' ? __APP_VERSION__ : '0.0.0-dev';
+// 버전은 @careermate/shared 단일 출처에서. (번들에서 package.json 버전으로 치환)
+export { APP_VERSION };
 
 let _port = 0;
 export function setServerPort(port: number): void {

package/apps/web/src/routes.ts

@@ -22,6 +22,7 @@ import {
   APPLICATION_STATUS_LABELS,
   DOCUMENT_KIND_LABELS,
   APPLICATION_BOARD_ORDER,
+  INTERVIEW_UNLOCK_STATUSES,
   type DocumentKind,
   type JobInput,
 } from '@careermate/shared';
@@ -263,7 +264,7 @@ export function registerApiRoutes(router: Router): void {
     const preps = interviewRepo.list().map((p) => ({ ...p, job: jobRepo.get(p.job_id) }));
     const eligible = applicationRepo
       .list()
-      .filter((a) => ['document_passed', 'interview', 'final_passed'].includes(a.status))
+      .filter((a) => INTERVIEW_UNLOCK_STATUSES.includes(a.status))
       .map((a) => ({
         job: jobRepo.get(a.job_id),
         status: a.status,

package/apps/web/src/server.ts

@@ -6,15 +6,12 @@ import http from 'node:http';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getDb, writeRuntimeInfo, clearRuntimeInfo } from '@careermate/db';
+import { BUNDLED } from '@careermate/shared';
 import { checkRequest, injectToken } from './security.ts';
 import { Router, sendJson, sendDownload, serveStatic, HttpError } from './http.ts';
 import { registerApiRoutes, isDownload } from './routes.ts';
 import { setServerPort } from './info.ts';
 
-// 번들 빌드(esbuild)에서 true로 치환된다. tsx 개발 실행에서는 정의되지 않아 typeof로 안전 분기.
-declare const __BUNDLED__: boolean | undefined;
-const BUNDLED = typeof __BUNDLED__ !== 'undefined' && __BUNDLED__;
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // dev(tsx): apps/web/src 기준 상대경로 · prod(dist/web.mjs): dist 기준.
 const WEB_ROOT = BUNDLED ? path.resolve(__dirname, 'public') : path.resolve(__dirname, '..', 'public');