How Resume Tailor actually works.

Browser / API client
        │
        │  POST /api/tailor
        │  { jobDescription, resume }
        ▼
  ┌─────────────────────────────────┐
  │  1. Rate limit (Upstash Redis)  │
  │     15 req / IP / day           │
  └───────────────┬─────────────────┘
                  │
  ┌───────────────▼─────────────────┐
  │  2. Zod input validation        │
  │     JD: 50–15,000 chars         │
  │     Resume: 50–30,000 chars     │
  └───────────────┬─────────────────┘
                  │
  ┌───────────────▼─────────────────┐
  │  3. Keyword cross-check         │
  │     Deterministic, zero-LLM     │
  │     → roughScore seed for prompt│
  └───────────────┬─────────────────┘
                  │
  ┌───────────────▼─────────────────┐
  │  4. Build prompt                │
  │     JD + resume wrapped in      │
  │     <JOB_DESCRIPTION>/<RESUME>  │
  │     tags as DATA, not commands  │
  └───────────────┬─────────────────┘
                  │
  ┌───────────────▼─────────────────┐
  │  5. Gemini 2.5 Flash call       │
  │     responseMimeType: JSON      │
  │     responseSchema (OpenAPI)    │
  │     maxOutputTokens: 4096       │
  └───────────────┬─────────────────┘
                  │
  ┌───────────────▼─────────────────┐
  │  6. Zod output validation       │
  │     Reject malformed model resp │
  └───────────────┬─────────────────┘
                  │
        ┌─────────▼──────────┐
        │  TailorResponse    │
        │  matchScore 0–100  │
        │  matchedKeywords   │
        │  missingKeywords   │
        │  tailoredBullets   │
        │  summary           │
        └────────────────────┘

1. 01

   Rate limit

   Upstash sliding window — 15 requests per IP per 24 hours. Graceful no-op when Upstash is not configured, so the demo runs without Redis. The counter key is prefixed rl:resume to avoid collision with sibling projects in the same database.

2. 02

   Zod input validation

   Every field validated at the API boundary before any expensive work begins. jobDescription: 50–15,000 chars; resume: 50–30,000 chars. Integer size caps prevent prompt-stuffing and control token costs. Vitest spec covers the boundary conditions.

3. 03

   Deterministic keyword pre-check

   A zero-dependency tokeniser runs before the Gemini call. It strips stop words, recognises tech bigrams (e.g. "machine learning", "ci/cd", "next.js"), and cross-checks the job description vocabulary against the resume. The result is a rough score integer that seeds the prompt — this gives the model a concrete calibration point to reason from rather than producing unconstrained numbers.

4. 04

   Prompt construction with data isolation

   The job description and resume are wrapped in XML-style delimiters (<JOB_DESCRIPTION>, <RESUME>). The system instruction explicitly tells the model to treat the enclosed text as untrusted user data and to ignore any directives embedded in it. This is the primary prompt-injection defence. The instruction portion of the prompt contains no user-controlled text.

5. 05

   Gemini 2.5 Flash structured output

   responseMimeType: "application/json" forces the model into JSON mode. responseSchema (a hand-built OpenAPI v3 subset) constrains the exact shape of the output. Gemini requires nullable: true instead of a null type union; no $ref or anyOf. maxOutputTokens is capped at 4096 to bound cost and response time. temperature: 0.2 for reproducible scoring.

6. 06

   Zod output validation — never trust the model

   Even with a responseSchema, Gemini can return unexpected types, missing fields, or out-of-range numbers. Every LLM response is parsed through tailorOutputSchema before the data is returned to the client. A malformed model response returns a typed AI_OUTPUT_INVALID error — no partial data leaks, no crashes.

7. 07

   Typed error codes, no stack traces

   The API surface exposes a small union of error codes: INVALID_INPUT, RATE_LIMIT, AI_ERROR, AI_OUTPUT_INVALID, INTERNAL. Error messages are user-friendly strings. Server-side detail (model errors, validation traces) is console.error'd but never forwarded to the client.