Skip to main content
01

Product Overview & Philosophy

Philosophy, deterministic ATS score engine, and zero-storage career privacy guarantees.

02

Quickstart Walkthrough

End-to-end workflow from PDF upload to sub-50ms vector PDF download.

03

System Execution Pipeline

Interactive execution flow across in-browser extraction, schema parsing, and compilation.

Product Overview & Philosophy

LumaCV is a high-performance, open-source resume engineering platform. It pairs the Typst Rust WASM vector typesetting engine with a deterministic ATS scoring model, multi-provider AI tailoring, and client-side zero-storage privacy guarantees.

Zero Hallucinations

Immutable guardrailsGround-truth diffingNo invented dates

Every AI rewrite is diffed against your original resume before it ever reaches you. Employers, job titles, dates, and universities are treated as immutable ground truth, the model can rephrase and reorganize, but it cannot invent.

Sub-50ms Typst Engine

Rust WASMNative vector PDFNo Chromium

Most resume builders render through a headless Chromium instance, slow, memory-heavy, and prone to layout drift. LumaCV compiles directly through Typst’s Rust engine instead, producing crisp single-page vector PDFs in 15–45ms.

Client-Side BYOK

Bring your own keyTLS-only transitZero server storage

Your API key never touches a database. It travels once, encrypted over TLS as a request header, is used for that single call, and is discarded, Gemini, OpenAI, Claude, and Groq are all supported.

4-Vector ATS Scoring

Required Skills 40%Responsibilities 25%Deterministic, not vibes

No black-box "AI vibe score." The match against a job description is computed from four weighted, inspectable vectors, Required Skills, Responsibilities, Preferred Skills, and Terminology, so you can see exactly why a number moved.

Quickstart Walkthrough

Generate an ATS-tailored, vector-typeset resume in four simple steps:

1

Upload Resume PDF & Paste Target Job Description

Open /builder. Drag-and-drop your existing resume PDF. Mozilla pdfjs-dist extracts text client-side in a Web Worker without uploading unparsed files to any server.

2

Verify Profile Data & Experience Details

Review parsed work experiences, education records, and skills taxonomy in Step 2. You can reorder sections, add missing achievements, and verify links.

3

AI Bullet Tailoring & ATS Gap Optimization

Choose Optimize (100% fact-preserving polish) or Tailor (aggressive JD alignment). The pipeline identifies missing keywords from the JD and refines bullet points while preserving 100% of your real employment facts.

4

Select From 52 Typst Templates & Export Vector PDF

Inspect side-by-side bullet diffs in Step 4. Switch between 52 architectural templates across 8 curated palettes. Export crisp vector PDFs or pure .typ code.

Pro-Tip: Single Page Guarantee

Typst automatically balances margins and font leading based on content density to ensure clean single-page outputs without awkward orphan lines.

Interactive Execution Architecture

LumaCV separates heavy vector typesetting and deterministic scoring into specialized runtime layers:

STAGE 01
Client PDF Extraction

Mozilla pdfjs-dist runs locally in web workers to extract tokens and URLs.

STAGE 02
Zod Schema Parsing

Validates structure and uses jsonrepair for robust JSON syntax recovery.

STAGE 03
4-Vector ATS Scoring

Evaluates alignment against JD requirements, verbs, and taxonomy.

STAGE 04
Multi-Provider BYOK

Gemini / OpenAI / Claude / Groq client keys transmitted via TLS headers.

STAGE 05
Fact Integrity Guard

Guarantees that job titles, employers, and degree dates remain unedited.

STAGE 06
Typst Native Vector PDF

Sub-50ms vector compilation across 52 templates with zero rasterization.

4-Step Resume Studio Workflow

The resume builder UI is designed as a focused, linear 4-step wizard that ensures complete verification before export:

Step 1: Upload & Target JD

Extracts raw text from user-uploaded PDFs using in-browser Web Workers. Accepts target job descriptions and generates a baseline ATS keyword analysis.

Step 2: Experience & Details Editor

Provides an interactive editor to inspect, correct, and reorder extracted sections. Changes hydrate the client-side Zustand store with immediate localStorage persistence.

Step 3: AI Tailoring & Alignment

Applies the selected tailoring mode (Optimize or Tailor) to align bullet points with target role criteria while enforcing truth verification.

Step 4: Typesetting Studio & Diff Studio

Live Typst compilation preview, side-by-side bullet diff inspector, template selector (52 templates), color palette picker, and instant vector PDF / .typ download.

Authentication & Workspace Isolation

LumaCV uses server-side cookie authentication to preserve drafts, track revision histories, and prevent unauthorized access:

Row Level Security (RLS)

PostgreSQL policies enforce strict ownership: auth.uid() = user_id. No user can read or overwrite another user's resumes.

HTTP-Only Secure Cookies

Sessions are verified at the Edge via middleware.ts using encrypted, HTTP-only cookie headers.

Typst Vector Typesetting vs Headless Chromium

Most traditional resume builders rely on headless browsers (Puppeteer, Playwright) or heavy LaTeX distributions (TeX Live). LumaCV is built around Typst, a modern, Rust-based typesetting system.

Typesetting EngineAverage Compile TimeOutput FormatRuntime FootprintPage Break Fidelity
Typst (LumaCV)15ms – 45msNative Vector PDF~35 MB binaryMathematical Exact
Puppeteer / Chromium1,800ms – 4,500msRasterized Web Print~450 MB ChromiumUnpredictable CSS breaks
pdflatex / XeLaTeX3,000ms – 8,000msVector PDF~3.5 GB TeX LiveMathematical Exact
Sample Typst Template Function (Rust AST)
#let resume(title: "", author: (), body) = {
  set document(title: title, author: author.name)
  set page(paper: "a4", margin: (x: 1.5cm, y: 1.2cm))
  set text(font: "Liberation Sans", size: 10pt)
  body
}

Template Catalog & Architecture (52 Systems)

LumaCV provides 52 distinct Typst template systems organized into 5 professional archetypes. Explore them in the Templates Gallery:

1. ATS-Optimized Archetype (14 Systems)

Linear typographic hierarchies designed for automated enterprise applicant tracking systems (`Apex`, `Catalyst`, `Stratum`, `Sentinel`, `Clearance`).

2. Modern & Tech Archetype (11 Systems)

Clean, high-density layouts favored by software engineers, platform architects, and tech founders (`Vector`, `Platform`, `Gridline`, `Terminal`).

3. Executive & Advisory Archetype (12 Systems)

Authoritative serif and mixed hierarchies designed for directors, consultants, and senior leaders (`Heritage`, `Executive`, `Advisory`, `Meridian`).

4. Editorial & Creative Archetype (13 Systems)

Design-forward typography, asymmetric balance, and clean editorial whitespace (`Boutique`, `Editorial`, `Atelier`, `Nordic`).

5. Academic & Research Archetype (2 Systems)

Multi-page scholarly formats accommodating extensive publications, research grants, patents, and advisory boards (`Scholar`, `Discovery`).

AI Pipeline & Client-Side BYOK Setup

LumaCV supports community-tier models out of the box and empowers candidates to connect their personal API keys from Google, OpenAI, Anthropic, or Groq for unlimited high-throughput tailoring.

Google GeminiFastest / Recommended

Native support for JSON structured outputs. Recommended for high reliability and zero rate limiting.

Get API Key

Supported Models & Latency Benchmarks

gemini-2.5-flash
Latency:350ms
Context:1M tokens
gemini-2.5-pro
Latency:1,100ms
Context:2M tokens
gemini-2.5-flash-lite
Latency:220ms
Context:1M tokens

Client Security Architecture

  • Storage: Stored strictly in browser encrypted localStorage under key luma_byok_keys.
  • Transmission: Transmitted exclusively as TLS headers (x-gemini-api-key) during completion calls.
  • Zero Retention: Never saved to PostgreSQL, Supabase Auth tables, or application server logs.
Configure your personal keys in user settings:Open Key Settings

Deterministic ATS Scoring Formula

LumaCV evaluates alignment between your resume and target job descriptions using a deterministic 4-vector algorithm defined in app/api/v1/resume/score/route.ts:

1. Required Skills & Technical Toolchains (Weight: 40%)0.40

Measures exact and fuzzy matches for primary technical languages, libraries, and core qualifications specified in the JD requirements section.

2. Responsibilities & Action Verbs (Weight: 25%)0.25

Evaluates executive verbs (e.g., spearheaded, architected, orchestrated) and presence of measurable metrics (revenue, latency, scale).

3. Preferred Skills & Methodologies (Weight: 20%)0.20

Scans for secondary qualifications such as agile frameworks, CI/CD pipelines, and cloud certifications.

4. Industry Terminology & Nomenclature (Weight: 15%)0.15

Ensures appropriate acronyms (e.g. SOC2, HIPAA, Kubernetes, Microservices) match standard industry taxonomy.

Fact-Checking & Integrity Verification

Standard AI chatbots frequently hallucinate certifications, employers, or technologies you never used. LumaCV enforces strict anti-hallucination guardrails implemented in lib/fact-validator.ts:

  • Immutable Ground Truth: Extracted company names, job titles, dates of employment, and university degrees cannot be modified or invented by the AI pipeline.
  • Bullet Diff Studio: In Step 4, candidates can inspect side-by-side diffs of original vs. tailored bullets and selectively revert any individual line with a single click.
  • Truth Verification Algorithm: Any newly suggested bullet point that introduces ungrounded credentials not substantiated by the source document is flagged or pruned.

Data Handling & Privacy Standards

We treat candidate career histories as strictly confidential data:

Zero Model Training

Candidate resumes, drafts, and job descriptions are never used to train public or proprietary AI models.

Row Level Security (RLS)

Every cloud-saved resume is locked behind PostgreSQL Row Level Security accessible only to the authenticated session owner.

REST API Reference & Endpoints

LumaCV exposes clean, documented REST route handlers for programmatic resume parsing, tailoring, scoring, and vector compilation:

POST/api/v1/resume/parse

Accepts raw text or extracted PDF tokens and structures them into the verified LumaCV resume JSON schema.

Request Headers

HeaderRequiredDescription
Content-TypeYesapplication/json
x-gemini-api-keyOptionalPersonal Google API Key (optional BYOK)
x-openai-api-keyOptionalPersonal OpenAI API Key (optional BYOK)

Request Body Parameters

ParameterTypeRequiredDescription
extractedTextstringYesRaw plaintext extracted client-side from the candidate PDF (min. 10 characters).

Sample Request (CURL)

Request Example
curl -X POST "https://your-domain.com/api/v1/resume/parse" \
  -H "Content-Type: application/json" \
  -H "x-gemini-api-key: YOUR_GEMINI_API_KEY" \
  -d '{ ...payload }'

Sample Response (200 OK)

{
  "personalInfo": {
    "name": "Jane Doe",
    "email": "jane@example.com",
    "title": "Principal Distributed Systems Architect"
  },
  "experience": [
    {
      "company": "Tech Corp",
      "title": "Staff Engineer",
      "dates": "2021, Present",
      "bullets": [
        "Architected real-time streaming pipeline reducing event latency by 72%."
      ]
    }
  ]
}

Tech Stack & Dependency Audit

LumaCV is built with modern, battle-tested technologies selected for performance, type safety, and minimal bundle size:

Package / IntegrationVersionRole in LumaCV
Next.js (App Router)14.2.xCore web framework, serverless route handlers, and SSR streaming.
TypeScript5.xFull end-to-end type safety across schemas, stores, and API payloads.
Typst Native CLI0.11.xNative Rust compiler generating sub-50ms vector PDFs.
Tailwind CSS3.4.xSemantic dark/light design tokens and typography styling.
Zustand4.5.xReactive client store with persistent local storage hydration guards.
pdfjs-dist4.10.xClient-side PDF text and hyperlink extraction via web worker.

Environment Variables & Configuration

Configure the following variables in your .env.local file:

VariableRequiredPurpose
GEMINI_API_KEYYes*Server-side fallback API key for Google Gemini (Flash / Flash-Lite).
GROQ_API_KEYYes*Server-side secondary failover key for Groq Cloud (Qwen / Llama).
NEXT_PUBLIC_SUPABASE_URLOptionalSupabase project URL for cloud authentication & database persistence.
NEXT_PUBLIC_SUPABASE_ANON_KEYOptionalSupabase anonymous public key.

Docker & Self-Hosting Guide

Run LumaCV fully isolated in your private infrastructure with pre-installed Typst binary:

docker-compose.yml
version: '3.8'

services:
  lumacv:
    image: ghcr.io/sahilbnsll/lumacv:latest
    container_name: lumacv-app
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - GEMINI_API_KEY=${GEMINI_API_KEY}
      - GROQ_API_KEY=${GROQ_API_KEY}
      - NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
      - NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}

Start the service using Docker Compose:

docker-compose up -d

Keyboard Shortcuts Reference

Speed up your resume engineering workflow with built-in hotkeys:

Spotlight Command Search
⌘K
Export PDF in Studio
⌘P
Close Modals / DrawersEsc

Production Deployment Guide

LumaCV is optimized for one-click serverless deployment on Vercel:

  • Native Typst Execution: The serverless compiler automatically provisions the platform-specific Typst binary in Node.js serverless functions.
  • Timeout Buffering: Long-running AI endpoints (/api/v1/resume/parse, /api/v1/resume/tailor) are configured with maxDuration = 60.
  • Edge Compatibility: Real-time keyword scoring (/api/v1/resume/score) executes in under 10ms.

Troubleshooting & Common Questions

Q: PDF text extraction returns empty or garbled text?

If your PDF was created via a flat image scanner or is password-protected, text chunks cannot be extracted client-side. You can either export a fresh text-selectable PDF or skip straight to Step 2 to type your details into the structured fields manually.

Q: "Too many requests" (HTTP 429) during peak hours?

The free community quota enforces per-IP rate limits to prevent automated abuse. To bypass all platform rate limits, configure your own free personal API key in Settings (BYOK).

Q: How do I compile Typst locally from the downloaded .typ file?

Install Typst on your machine (brew install typst on macOS, winget install Typst.Typst on Windows), then run typst compile resume.typ.

Changelog & Version History

All notable updates, engine speedups, model integrations, and security hardening are documented here chronologically:

v2.5.0March 12, 2026

Modern Documentation Hub, ⌘K Command Palette & REST API Explorer

Major release introducing a 3-column documentation architecture, instant Spotlight search, interactive API documentation, and hardened data normalization against stringified object payloads.

Features
  • Redesigned documentation UI with 3-column layout, sticky category navigation, and right-hand ScrollSpy "On this page" TOC.
  • Added universal Spotlight Command Palette (⌘K / /) with fast fuzzy search across all topics, models, and API endpoints.
  • Shipped interactive REST API Explorer for /api/v1/resume/parse, /tailor, /score, and /compile with cURL, TypeScript, and Python snippets.
  • Added interactive BYOK model selector with real-time latency benchmarks for Gemini 2.5, GPT-4o, Claude 3.5, and Groq LPUs.
Fixes & Hardening
  • Eliminated "[object Object]" keyword leakage in normalize-jd.ts, ATS score calculation, and tailoring summaries.
  • Implemented defensive store rehydration guards in lib/store.ts to auto-purge corrupted persisted scores.
v2.4.0February 18, 2026

Deterministic 4-Vector ATS Scoring Engine & Bullet Diff Studio

Introduced mathematical ATS alignment scoring and side-by-side bullet diffing to give candidates granular control over AI modifications.

Features
  • Deterministic 4-vector scoring: Required Skills (40%), Responsibilities (25%), Preferred Skills (20%), and Terminology (15%).
  • Side-by-side Bullet Diff Studio in Step 4 allowing 1-click single-line reversion of any tailored bullet.
  • Real-time ATS alignment gauge with categorized keyword gap feedback (Missing, Partial, Matched).
Security & Privacy
  • Ground-truth validation guardrails ensuring AI models cannot hallucinate employer names, job titles, or dates of employment.
v2.3.0January 20, 2026

Multi-Provider Client-Side BYOK (Bring Your Own Key)

Enabled candidates to bring their personal API keys with zero server-side storage and instant multi-model switching.

Security & Privacy
  • Multi-provider support: Google Gemini 2.5 (Flash / Pro), OpenAI GPT-4o, Anthropic Claude 3.5 Sonnet, and Groq LPUs.
  • Client-side BYOK security: Keys are stored exclusively in browser localStorage (luma_byok_keys) and sent via TLS headers.
  • Zero database persistence or retention of candidate API credentials.
Performance & Engine
  • Optimized token streaming and payload compression for long-context job descriptions.
v2.2.0December 10, 2025

Typst Rust WASM Engine Migration & 52 Architectural Templates

Replaced headless Chromium (Puppeteer) with the Rust-based Typst engine, slashing compile times from 3,500ms down to sub-50ms.

Performance & Engine
  • Typst compilation latency reduced to 15ms–45ms with 100% vector fidelity and mathematical page-break fitting.
  • Eliminated 450MB Puppeteer/Chromium dependency overhead in serverless runtimes.
  • Shipped 52 architectural Typst templates across 5 professional archetypes (ATS, Modern, Executive, Creative, Academic).
Features
  • Interactive Color Palette selector with 8 curated color schemes matching typographic hierarchies.
  • Direct export of raw .typ source files for local command-line compilation.
v2.1.0November 15, 2025

In-Browser PDF Parsing & Zod Schema Recovery

Client-side PDF text extraction in Web Workers with resilient JSON recovery for complex resumes.

Features
  • Client-side PDF extraction powered by Mozilla pdfjs-dist Web Worker, preserving privacy before parsing.
  • Integrated jsonrepair for robust JSON syntax recovery on malformed LLM responses.
  • Complete Zod schema validation across all resume data layers.
v2.0.0October 01, 2025

Open Source Release & PostgreSQL Workspace Isolation

Initial open-source release with Supabase Row Level Security (RLS) and dark/light design system tokens.

Security & Privacy
  • PostgreSQL Row Level Security (RLS) enforcing strict user workspace isolation.
  • Cookie-based SSR session management with @supabase/ssr and Edge middleware.
  • Released under permissive MIT License for community contribution and self-hosting.

License & Open-Source Terms

LumaCV is open-source software licensed under the MIT License:

MIT License

Copyright (c) 2026 Sahil Bansal & LumaCV Contributors.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.