@juicedresume/mcp 0.3.2 → 0.4.1

package/dist/index.js

@@ -220,6 +220,7 @@ var MULTI_COLUMN_TEMPLATES = [
   "coral",
   "prism",
   "deedy",
+  "meridian",
   "nova",
   "axis",
   "kintsugi",
@@ -238,6 +239,14 @@ var Styling = z.object({
   accent: z.string().default("#111111"),
   fontHeading: z.string().default("Playfair Display"),
   fontBody: z.string().default("Inter"),
+  // Per-resume font OVERRIDES. Empty string = "use the template's designed
+  // font" (the default look). When set, the chosen family wins across every
+  // template — including Classic/Sidebar templates that otherwise hard-code
+  // their own faces — and is applied identically in the editor preview and the
+  // exported PDF. Kept separate from fontHeading/fontBody so existing resumes
+  // (which never set these) render exactly as before.
+  fontHeadingOverride: z.string().default(""),
+  fontBodyOverride: z.string().default(""),
   fontSize: z.number().default(10.5),
   // body pt
   lineHeight: z.number().default(1.5),
@@ -268,7 +277,7 @@ var Locale = z.object({
   dateFormat: z.enum(["MM/YYYY", "MMM YYYY", "YYYY", "DD/MM/YYYY", "MM/DD/YYYY"]).default("MMM YYYY"),
   pageFormat: z.enum(["A4", "Letter"]).default("A4")
 });
-var Resume = z.object({
+var ResumeObject = z.object({
   id: z.string(),
   name: z.string().default("Untitled"),
   schemaVersion: z.literal(2).default(2),
@@ -279,6 +288,29 @@ var Resume = z.object({
   styling: Styling,
   locale: Locale
 });
+var RICH_TEXT_KEYS = /* @__PURE__ */ new Set(["body", "description"]);
+var URL_KEYS = /* @__PURE__ */ new Set(["photoUrl", "url", "link", "employerLink", "schoolLink", "website", "linkedin", "github", "twitter"]);
+var LONG_KEYS = /* @__PURE__ */ new Set(["skills"]);
+function capFor(key) {
+  if (RICH_TEXT_KEYS.has(key)) return 6e4;
+  if (LONG_KEYS.has(key)) return 1e4;
+  if (URL_KEYS.has(key)) return 2e3;
+  return 1e3;
+}
+function capStrings(value, key = "") {
+  if (typeof value === "string") {
+    const max = capFor(key);
+    return value.length > max ? value.slice(0, max) : value;
+  }
+  if (Array.isArray(value)) return value.map((v) => capStrings(v, key));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = capStrings(v, k);
+    return out;
+  }
+  return value;
+}
+var Resume = z.preprocess((value) => capStrings(value), ResumeObject);
 var CoverLetter = z.object({
   id: z.string(),
   name: z.string().default("Untitled"),
@@ -1415,15 +1447,29 @@ function bigrams(toks) {
   return out;
 }
 function resumeText(resume) {
-  const parts = [];
-  parts.push(resume.personal.title);
+  const parts = [resume.personal.title];
   for (const sec of resume.sections) {
+    if (sec.visible === false) continue;
     for (const it of sec.items) {
-      parts.push(it.body || "");
-      parts.push(it.description || "");
-      parts.push(it.skills || "");
-      parts.push(it.jobTitle || it.degree || it.name || it.title || "");
-      parts.push(it.employer || it.school || it.publisher || it.institution || "");
+      if (it.visible === false) continue;
+      parts.push(
+        it.body || "",
+        it.description || "",
+        it.skills || "",
+        it.category || "",
+        it.jobTitle || "",
+        it.degree || "",
+        it.field || "",
+        it.name || "",
+        it.title || "",
+        it.role || "",
+        it.employer || "",
+        it.school || "",
+        it.publisher || "",
+        it.institution || "",
+        it.issuer || "",
+        it.location || ""
+      );
     }
   }
   return parts.join(" ").replace(/<[^>]+>/g, " ");
@@ -1433,16 +1479,16 @@ function tailorToJob(resume, jdText) {
   const resumeFullText = resumeText(resume).toLowerCase();
   const resumeToks = new Set(tokens(resumeFullText));
   const resumeNorm = new Set([...resumeToks].map((t) => normalizeSkill(t).toLowerCase()));
-  function resumeHas(keyword) {
+  function matchKind(keyword) {
     const k = keyword.toLowerCase();
     if (k.includes(" ")) {
-      return new RegExp(`\\b${escapeRe(k)}\\b`).test(resumeFullText);
+      return new RegExp(`\\b${escapeRe(k)}\\b`).test(resumeFullText) ? "exact" : "none";
     }
-    if (resumeToks.has(k)) return true;
+    if (resumeToks.has(k)) return "exact";
     const canon = normalizeSkill(keyword).toLowerCase();
-    if (resumeNorm.has(canon)) return true;
-    if (canon.includes(" ") && new RegExp(`\\b${escapeRe(canon)}\\b`).test(resumeFullText)) return true;
-    return false;
+    if (resumeNorm.has(canon)) return "variant";
+    if (canon.includes(" ") && new RegExp(`\\b${escapeRe(canon)}\\b`).test(resumeFullText)) return "variant";
+    return "none";
   }
   const jdGrams = /* @__PURE__ */ new Set([...jdToks, ...bigrams(jdToks)]);
   const skillNames = new Map(SKILLS.map((s) => [s.name.toLowerCase(), s]));
@@ -1460,10 +1506,20 @@ function tailorToJob(resume, jdText) {
   const matched = [];
   const missing = [];
   const kindMult = (kind) => kind === "hard" ? 2 : kind === "soft" ? 1.3 : 1;
+  const VARIANT_CREDIT = 0.6;
   for (const [k, meta] of jdSkills) {
     const w = meta.importance * kindMult(meta.kind);
-    if (resumeHas(k)) {
+    const kind = matchKind(k);
+    if (kind === "exact") {
       matched.push({ keyword: k, kind: meta.kind, count: w });
+    } else if (kind === "variant") {
+      matched.push({
+        keyword: k,
+        kind: meta.kind,
+        count: w * VARIANT_CREDIT,
+        partial: true,
+        note: `You use a variant of "${k}". ATS keyword search is usually exact-match, so add the exact term "${k}" too.`
+      });
     } else {
       missing.push({ keyword: k, kind: meta.kind, importance: w });
     }
@@ -1483,9 +1539,71 @@ function tailorToJob(resume, jdText) {
     missing,
     jdSkills: jdSkills.size,
     resumeSkills: resumeToks.size,
-    titleMatch
+    titleMatch,
+    flags: jdKnockoutFlags(resume, jdText)
   };
 }
+function tailorMMYYYY(d) {
+  if (!d) return null;
+  const m = d.match(/^(\d{1,2})\/(\d{4})$/);
+  if (m) return parseInt(m[2], 10) * 12 + parseInt(m[1], 10);
+  const mn = d.match(/^([A-Za-z]+)\s+(\d{4})$/);
+  if (mn) {
+    const months = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
+    const i = months.findIndex((x) => mn[1].toLowerCase().startsWith(x));
+    if (i >= 0) return parseInt(mn[2], 10) * 12 + (i + 1);
+  }
+  const y = d.match(/^(\d{4})$/);
+  if (y) return parseInt(y[1], 10) * 12;
+  return null;
+}
+function resumeYears(resume) {
+  const exp = resume.sections.find((s) => s.type === "experience");
+  if (!exp) return 0;
+  const now = (/* @__PURE__ */ new Date()).getFullYear() * 12 + ((/* @__PURE__ */ new Date()).getMonth() + 1);
+  let months = 0;
+  for (const it of exp.items || []) {
+    if (it.visible === false) continue;
+    const s = tailorMMYYYY(it.startDate || "");
+    const e = it.current ? now : tailorMMYYYY(it.endDate || "");
+    if (s && e && e >= s) months += e - s;
+  }
+  return Math.round(months / 12 * 10) / 10;
+}
+function jdKnockoutFlags(resume, jdText) {
+  const flags = [];
+  const degreeRequired = /\b(bachelor|master|b\.?s\.?|m\.?s\.?|b\.?a\.?|ph\.?d|mba|degree)\b[^.\n]{0,40}\b(required|require|must|minimum|mandatory)\b/i.test(jdText) || /\b(required|must have|minimum|mandatory)\b[^.\n]{0,40}\b(bachelor|master|degree|b\.?s\.?|m\.?s\.?|ph\.?d|diploma)\b/i.test(jdText);
+  if (degreeRequired) {
+    const eduSec = resume.sections.find((s) => s.type === "education");
+    const hasDegree = (eduSec?.items || []).some((it) => it.visible !== false && String(it.degree || "").trim());
+    if (!hasDegree) {
+      flags.push({
+        id: "K4.missing-required-degree",
+        severity: "risk",
+        title: "This job states a degree requirement",
+        detail: "The description asks for a specific degree, and no completed degree is listed on your resume. A stated degree requirement is often a hard knockout filter.",
+        suggestion: "Add your degree in the Education section, or if you have equivalent experience, be ready to address the gap in a cover note.",
+        requirement: "degree"
+      });
+    }
+  }
+  const yoe = [...jdText.matchAll(/(\d{1,2})\s*\+?\s*(?:to|-|–|—)?\s*\d{0,2}\s*years?(?:['’]?s?)?\s*(?:of\s+)?(?:experience|exp\b)/gi)].map((m) => parseInt(m[1], 10)).filter((n) => n >= 1 && n <= 20);
+  if (yoe.length) {
+    const required = Math.min(...yoe);
+    const have = resumeYears(resume);
+    if (have + 0.5 < required) {
+      flags.push({
+        id: "K5.yoe-below-requirement",
+        severity: "risk",
+        title: `Asks for ${required}+ years; your resume shows about ${have}`,
+        detail: "Years of experience is one of the most common automated and recruiter filters. A year or more below the stated minimum is a frequent screen-out.",
+        suggestion: "Make sure every relevant role has dates so your full tenure is counted, and include earlier or concurrent experience if it applies.",
+        requirement: `${required}+ years`
+      });
+    }
+  }
+  return flags;
+}
 
 // ../../packages/scoring/src/v2-additions.ts
 function stripHtml(s) {
@@ -1531,41 +1649,6 @@ function firstBulletStrongest(resume) {
     )
   };
 }
-function dateFormatConsistency(resume) {
-  const exp = resume.sections.find((s) => s.type === "experience");
-  const edu = resume.sections.find((s) => s.type === "education");
-  const dates = [];
-  [...exp?.items || [], ...edu?.items || []].forEach((it) => {
-    if (it.startDate) dates.push(it.startDate);
-    if (it.endDate && !it.current) dates.push(it.endDate);
-  });
-  if (dates.length < 2) return null;
-  const MM_YYYY = /^\d{1,2}\/\d{4}$/;
-  const MMM_YYYY = /^[A-Za-z]+\s+\d{4}$/;
-  const YYYY = /^\d{4}$/;
-  const ABBREV = /['']\d{2}|\d{1,2}\/\d{2}|\b[A-Z][a-z]{2}'\d{2}\b/;
-  const formats = /* @__PURE__ */ new Set();
-  for (const d of dates) {
-    if (ABBREV.test(d)) formats.add("abbrev");
-    else if (MM_YYYY.test(d)) formats.add("mm/yyyy");
-    else if (MMM_YYYY.test(d)) formats.add("month-yyyy");
-    else if (YYYY.test(d)) formats.add("yyyy");
-    else formats.add("other");
-  }
-  const hasAbbrev = formats.has("abbrev");
-  const inconsistent = formats.size > 1;
-  const score = hasAbbrev ? 0.2 : inconsistent ? 0.55 : 1;
-  return {
-    dim: "style",
-    check: passSoft(
-      "C9.date-format",
-      "Date format is consistent",
-      score,
-      hasAbbrev ? "Date abbreviations like '21 or Jan'24 break ATS years-of-experience calculation." : inconsistent ? `You're mixing date formats (${[...formats].join(", ")}). Pick one and apply consistently.` : "Dates are formatted consistently \u2014 ATS parses them cleanly.",
-      "Use MM/YYYY (06/2024) or Month YYYY (June 2024) \u2014 consistently across every entry."
-    )
-  };
-}
 function targetTitle(resume) {
   const title = resume.personal?.title?.trim() || "";
   const score = title.length >= 3 ? 1 : 0;
@@ -1626,7 +1709,6 @@ function threeLocationsRule(resume) {
 function additionalChecks(resume) {
   return [
     firstBulletStrongest(resume),
-    dateFormatConsistency(resume),
     targetTitle(resume),
     dobAgePenalty(resume),
     threeLocationsRule(resume)
@@ -2642,7 +2724,8 @@ function atsChecks(resume, b) {
   const allText = b.bullets.map((x) => x.text).join(" ");
   const isSingleCol = !isMultiColumnTemplate(s.template);
   const isSafeFont = SAFE_FONTS.has(s.fontHeading) && SAFE_FONTS.has(s.fontBody);
-  const fontSizeOK = s.fontSize >= 9.5 && s.fontSize <= 12;
+  const fontSizeIdeal = s.fontSize >= 10 && s.fontSize <= 12;
+  const fontSizeAcceptable = s.fontSize >= 9.5 && s.fontSize <= 12.5;
   const safeBullet = SAFE_BULLET_GLYPHS.has(s.bulletGlyph === "disc" ? "\u2022" : s.bulletGlyph === "dash" ? "-" : "");
   const emailOK = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(p.email);
   const phoneOK = !p.phone || /(\+?\d[\d\s().-]{6,})/.test(p.phone);
@@ -2684,10 +2767,14 @@ function atsChecks(resume, b) {
       // single-column), but ~1 in 10 still scrambles reading order and columns
       // cost human skimmability. A single, evidence-scaled ding — the overall
       // score also takes a small proportional multi-column haircut (see below).
-      isSingleCol ? 1 : 0.55,
-      isSingleCol ? "Single-column layout \u2014 every ATS parses this cleanly." : "Multi-column template. Modern parsers usually handle columns, but a minority still scramble reading order, and columns are harder for a recruiter to skim. Single-column is the zero-risk choice.",
+      // ~0.85 reflects the real ~90% correct column-extraction rate reported by
+      // Textkernel, so the within-dimension ding stays light; the small overall
+      // multi-column haircut in scoreResume carries the actual score effect
+      // (we deliberately don't double-penalize with a 0.55 here).
+      isSingleCol ? 1 : 0.85,
+      isSingleCol ? "Single-column layout. Every ATS parses this cleanly." : "Multi-column template. Modern parsers handle columns about 90% of the time, but a minority scramble reading order, and columns are harder for a recruiter to skim.",
       [],
-      !isSingleCol ? "For maximum ATS safety, switch to a single-column template (Jake, Harvard, Classic) in the Templates tab. Not required, but it removes all parse risk." : void 0,
+      !isSingleCol ? "Exporting via the ATS PDF button always outputs a single-column, parse-clean file, so you can keep this template on screen and still submit a safe PDF. Or switch to a single-column template (Jake, Harvard, Classic) for a single source." : void 0,
       "soft"
     ),
     mk(
@@ -2776,10 +2863,10 @@ function atsChecks(resume, b) {
     mk(
       "E11.font-size",
       "Body font size 10\u201312pt",
-      fontSizeOK ? 1 : 0.5,
-      fontSizeOK ? `Font size ${s.fontSize}pt is in range.` : `Font size ${s.fontSize}pt is outside the 10\u201312pt range.`,
+      fontSizeIdeal ? 1 : fontSizeAcceptable ? 0.75 : 0.5,
+      fontSizeIdeal ? `Font size ${s.fontSize}pt is in the ideal 10\u201312pt band.` : fontSizeAcceptable ? `Font size ${s.fontSize}pt is readable but outside the ideal 10\u201312pt band.` : `Font size ${s.fontSize}pt is outside the readable 9.5\u201312.5pt range.`,
       [],
-      !fontSizeOK ? "Set body size to 10\u201312pt." : void 0,
+      !fontSizeIdeal ? "Set body size to 10\u201312pt for the best balance of density and legibility." : void 0,
       void 0,
       0.5
     ),
@@ -2841,7 +2928,7 @@ function skillsChecks(resume, b) {
       stuffed.length === 0 ? 1 : 1 - Math.min(1, stuffed.length / 3),
       stuffed.length === 0 ? "No token over-repeated." : `Over-repeated: ${stuffed.slice(0, 4).map(([k, v]) => `${k}\xD7${v}`).join(", ")}.`,
       [],
-      stuffed.length ? "Diversify language \u2014 repeating a keyword more than 5\xD7 looks like stuffing." : void 0
+      stuffed.length ? "Diversify your language. Repeating the same keyword more than 8 times reads as stuffing, and frequency past the first mention does not help ATS ranking anyway." : void 0
     ),
     mk(
       "F5.acronym-expansion",
@@ -2928,7 +3015,9 @@ function polishChecks(resume, b) {
       hasHiddenText ? "Hidden or invisible text (white-on-white, zero-size) or an AI-instruction string was detected. ATS convert your file to plain text, so these become visible and read as gaming the system." : "No hidden text or prompt-injection tricks detected.",
       [],
       hasHiddenText ? "Remove any white/invisible text, zero-size fonts, or 'rate me highly'-style instructions. They backfire once the ATS strips formatting." : void 0,
-      void 0,
+      // Hard severity: hidden text / prompt-injection is the one trick that
+      // genuinely backfires, so a positive detection caps the overall score.
+      "hard",
       2
     )
   ];
@@ -2972,6 +3061,52 @@ function experienceYears(resume) {
   }
   return Math.floor(months / 12);
 }
+function computeFlags(resume) {
+  const flags = [];
+  const p = resume.personal;
+  const emailOK = /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(p.email);
+  const hasPhone = !!(p.phone && /(\+?\d[\d\s().-]{6,})/.test(p.phone));
+  const nameOK = !!(p.fullName && p.fullName.trim().length >= 2);
+  if (!(nameOK && (emailOK || hasPhone))) {
+    flags.push({
+      id: "K1.contact-unparseable",
+      severity: "block",
+      title: "Contact details can't be parsed",
+      detail: !nameOK ? "No full name is set. ATS build the candidate record from a name plus an email or phone, so without a name the whole resume can be dropped." : "No valid email or phone is set. Most parsers reject a record that has neither.",
+      suggestion: "Add your full name and at least one of a valid email or phone."
+    });
+  }
+  const expSec = resume.sections.find((s) => s.type === "experience");
+  const expItems = (expSec?.items || []).filter((it) => it.visible !== false);
+  const datelessRoles = expItems.filter((it) => !parseMMYYYY(it.startDate || ""));
+  if (expItems.length > 0 && datelessRoles.length > 0) {
+    flags.push({
+      id: "K2.role-without-dates",
+      severity: "risk",
+      title: `${datelessRoles.length} role${datelessRoles.length === 1 ? "" : "s"} missing dates`,
+      detail: "A role with no start date can't be ordered or counted toward years of experience by a parser, and years-of-experience filters are a top recruiter screen.",
+      suggestion: "Add a start and end date (MM/YYYY or Month YYYY) to every role."
+    });
+  }
+  const nowMonths = (/* @__PURE__ */ new Date()).getFullYear() * 12 + ((/* @__PURE__ */ new Date()).getMonth() + 1);
+  const ranges = expItems.map((it) => ({ start: parseMMYYYY(it.startDate || ""), end: it.current ? nowMonths : parseMMYYYY(it.endDate || it.startDate || "") })).filter((r) => r.start && r.end);
+  ranges.sort((a, b) => b.start - a.start);
+  let maxGap = 0;
+  for (let i = 0; i < ranges.length - 1; i++) {
+    const gap = ranges[i].start - ranges[i + 1].end;
+    if (gap > maxGap) maxGap = gap;
+  }
+  if (maxGap > 6) {
+    flags.push({
+      id: "K3.employment-gap",
+      severity: "risk",
+      title: `About a ${maxGap}-month employment gap`,
+      detail: "Some employers screen for gaps over 6 months. A gap is legitimate, but an unexplained one lowers callback odds.",
+      suggestion: "Add a one-line note (contract, study, caregiving) or a short bridging entry so the gap does not read as unexplained."
+    });
+  }
+  return flags;
+}
 function aggregate(checks, weight) {
   if (!checks.length) return { score: 0, weighted: 0 };
   let wsum = 0, wtot = 0;
@@ -3001,7 +3136,7 @@ var LABELS = {
   skills: "Skills & Keywords",
   polish: "Completeness & Polish"
 };
-function scoreResume(resume) {
+function scoreResume(resume, opts) {
   const b = gather(resume);
   const dims = [
     { dim: "impact", checks: impactChecks(resume, b) },
@@ -3036,6 +3171,21 @@ function scoreResume(resume) {
   }
   const hardFail = dimensions.some((d) => d.checks.some((c) => c.severity === "hard" && c.status === "fail"));
   if (hardFail) overall = Math.min(overall, 60);
+  const parseFindings = opts?.parseFindings ?? [];
+  const parseHard = parseFindings.some((f) => f.severity === "hard");
+  const parseSoftCount = parseFindings.filter((f) => f.severity === "soft").length;
+  if (parseHard) overall = Math.min(overall, 55);
+  if (parseSoftCount) overall = Math.max(0, overall - Math.min(12, parseSoftCount * 4));
+  const flags = [
+    ...computeFlags(resume),
+    ...parseFindings.map((f) => ({
+      id: f.id,
+      severity: f.severity === "hard" ? "block" : "risk",
+      title: f.title,
+      detail: f.detail,
+      suggestion: f.suggestion ?? null
+    }))
+  ];
   const sortedDims = [...dimensions].sort((a, b2) => a.score - b2.score);
   const worst = sortedDims[0];
   const best = sortedDims[sortedDims.length - 1];
@@ -3048,6 +3198,7 @@ function scoreResume(resume) {
     summary: `Strongest: ${best.label} (${best.score}). Focus area: ${worst.label} (${worst.score}).`,
     priorities,
     hardFails: dimensions.flatMap((d) => d.checks.filter((c) => c.severity === "hard" && c.status === "fail").map((c) => ({ ...c, dim: d.dimension }))),
+    flags,
     stats: {
       totalBullets: b.bullets.length,
       experienceBullets: b.expBullets.length,
@@ -3069,6 +3220,10 @@ var CLOUD = CLOUD_TOKEN.length > 0;
 async function ensure(dir) {
   await fs.mkdir(dir, { recursive: true });
 }
+function assertSafeId(id) {
+  if (!/^[A-Za-z0-9_-]{1,64}$/.test(id)) throw new Error(`JuicedResume: invalid resume id "${id}".`);
+  return id;
+}
 async function cloudReq(method, p, body) {
   let res;
   try {
@@ -3109,6 +3264,7 @@ async function listResumes() {
   return out.sort((a, b) => a.updatedAt < b.updatedAt ? 1 : -1);
 }
 async function getResume(id) {
+  assertSafeId(id);
   if (CLOUD) {
     const data = await cloudReq("GET", `/resumes/${id}`);
     return data ? Resume.parse(data) : null;
@@ -3121,6 +3277,7 @@ async function getResume(id) {
   }
 }
 async function saveResume(r) {
+  assertSafeId(r.id);
   const next = { ...r, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   if (CLOUD) {
     await cloudReq("PUT", `/resumes/${r.id}`, next);
@@ -3150,6 +3307,7 @@ async function createBlankResume(name = "Untitled") {
   return await saveResume(blank);
 }
 async function deleteResume(id) {
+  assertSafeId(id);
   if (CLOUD) {
     await cloudReq("DELETE", `/resumes/${id}`);
     return;
@@ -3187,7 +3345,7 @@ function resumeToLatex(r) {
 {\\LARGE \\textbf{${tex(p.fullName || "Your Name")}}}\\\\[2pt]
 ${p.title ? `{\\itshape ${tex(p.title)}}\\\\[2pt]` : ""}
 ${[
-    p.email && `\\href{mailto:${p.email}}{${tex(p.email)}}`,
+    p.email && `\\href{mailto:${texUrl(p.email)}}{${tex(p.email)}}`,
     p.phone && tex(p.phone),
     p.location && tex(p.location),
     p.linkedin && hrefHandle(p.linkedin),
@@ -3232,7 +3390,7 @@ ${i.description ? htmlToTex(i.description) : ""}
       return `${header}
 ${items.map((i) => `
 \\noindent\\textbf{${tex(i.name)}}${i.role ? ` --- ${tex(i.role)}` : ""}\\hfill ${tex(dateRange(i.startDate, i.endDate, false, r))}\\\\
-${i.link ? `\\href{${ensureProto(i.link)}}{${tex(i.link)}}\\\\` : ""}
+${i.link ? `\\href{${texUrl(ensureProto(i.link))}}{${tex(i.link)}}\\\\` : ""}
 ${htmlToTex(i.description)}
 `).join("\n")}
 `;
@@ -3252,7 +3410,7 @@ ${items.map((i) => `
       return `${header}
 \\begin{itemize}
 ${items.map(
-        (i) => `  \\item \\textbf{${tex(i.name)}}${i.issuer ? ` --- ${tex(i.issuer)}` : ""}${i.date ? ` (${tex(i.date)})` : ""}${i.link ? ` \\href{${ensureProto(i.link)}}{link}` : ""}`
+        (i) => `  \\item \\textbf{${tex(i.name)}}${i.issuer ? ` --- ${tex(i.issuer)}` : ""}${i.date ? ` (${tex(i.date)})` : ""}${i.link ? ` \\href{${texUrl(ensureProto(i.link))}}{link}` : ""}`
       ).join("\n")}
 \\end{itemize}
 `;
@@ -3286,7 +3444,7 @@ ${i.description ? htmlToTex(i.description) : ""}
       return `${header}
 ${items.map((i) => `
 \\noindent\\textbf{${tex(i.title)}}${i.publisher ? ` --- ${tex(i.publisher)}` : ""}${i.date ? `\\hfill ${tex(i.date)}` : ""}\\\\
-${i.link ? `\\href{${ensureProto(i.link)}}{${tex(i.link)}}\\\\` : ""}
+${i.link ? `\\href{${texUrl(ensureProto(i.link))}}{${tex(i.link)}}\\\\` : ""}
 ${i.description ? htmlToTex(i.description) : ""}
 `).join("\n")}
 `;
@@ -3357,7 +3515,7 @@ function inlineHtmlToTex(html) {
       const href = m[1];
       const end = findCloseTag(src, close + 1, "a");
       const inner = src.slice(close + 1, end.start);
-      out += `\\href{${href}}{${inlineHtmlToTex(inner)}}`;
+      out += `\\href{${texUrl(decodeEntities(href))}}{${inlineHtmlToTex(inner)}}`;
       i = end.after;
       continue;
     }
@@ -3393,10 +3551,13 @@ ${after}`;
   return html.split(/<\/?p[^>]*>/gi).map((c) => inlineHtmlToTex(c).trim()).filter(Boolean).join("\\\\\n");
 }
 function sanitizeColor(hex) {
-  return hex.replace(/^#/, "").slice(0, 6).padEnd(6, "0");
+  return hex.replace(/[^0-9a-fA-F]/g, "").slice(0, 6).padEnd(6, "0");
+}
+function texUrl(s) {
+  return s.replace(/[{}\\\s"]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0"));
 }
 function hrefHandle(s) {
-  return `\\href{${ensureProto(s)}}{${tex(s)}}`;
+  return `\\href{${texUrl(ensureProto(s))}}{${tex(s)}}`;
 }
 function ensureProto(s) {
   if (/^https?:\/\//i.test(s)) return s;
@@ -3497,8 +3658,12 @@ var ok = (data) => ({ content: [{ type: "text", text: typeof data === "string" ?
 async function mutate(id, fn) {
   const r = await getResume(id);
   if (!r) throw new Error(`Resume not found: ${id}`);
-  const next = fn(r);
-  return await saveResume(next);
+  const parsed = Resume.safeParse(fn(r));
+  if (!parsed.success) {
+    const first = parsed.error.issues[0];
+    throw new Error(`Invalid patch \u2014 resume would no longer validate (${first?.path.join(".")}: ${first?.message}).`);
+  }
+  return await saveResume(parsed.data);
 }
 var TOOLS = [
   // discovery
@@ -3577,7 +3742,7 @@ server.setRequestHandler(CallToolRequestSchema, async (req) => {
       case "add_section":
         return ok(await mutate(args.id, (r) => {
           const type = args.type;
-          if (!DEFAULT_SECTION_TITLES[type]) throw new Error(`unknown section type: ${type}`);
+          if (!Object.hasOwn(DEFAULT_SECTION_TITLES, type)) throw new Error(`unknown section type: ${type}`);
           const section = { id: newId(), type, title: args.title || DEFAULT_SECTION_TITLES[type], visible: true, columns: 1, items: [] };
           return { ...r, sections: [...r.sections, section] };
         }));

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@juicedresume/mcp",
-  "version": "0.3.2",
+  "version": "0.4.1",
+  "mcpName": "com.juicedresume/mcp",
   "description": "Model Context Protocol server for JuicedResume — score, tailor, and edit your resume from any MCP client (Claude Code, Claude Desktop, Cursor).",
   "keywords": [
     "mcp",