feat: implement download_resume_pdf mcp tool

packages/ai/package.json

@@ -29,7 +29,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/api/package.json

@@ -19,14 +19,14 @@
 		"test:agent": "vitest run --reporter=agent --reporter=json --outputFile.json=reports/vitest-results.json --passWithNoTests"
 	},
 	"dependencies": {
-		"@ai-sdk/anthropic": "^3.0.80",
+		"@ai-sdk/anthropic": "^3.0.81",
 		"@ai-sdk/google": "^3.0.80",
-		"@ai-sdk/openai": "^3.0.65",
+		"@ai-sdk/openai": "^3.0.67",
 		"@ai-sdk/openai-compatible": "^2.0.48",
-		"@aws-sdk/client-s3": "^3.1055.0",
-		"@orpc/client": "^1.14.3",
-		"@orpc/experimental-ratelimit": "^1.14.3",
-		"@orpc/server": "^1.14.3",
+		"@aws-sdk/client-s3": "^3.1057.0",
+		"@orpc/client": "^1.14.4",
+		"@orpc/experimental-ratelimit": "^1.14.4",
+		"@orpc/server": "^1.14.4",
 		"@reactive-resume/ai": "workspace:*",
 		"@reactive-resume/auth": "workspace:*",
 		"@reactive-resume/db": "workspace:*",
@@ -35,9 +35,9 @@
 		"@reactive-resume/resume": "workspace:*",
 		"@reactive-resume/schema": "workspace:*",
 		"@reactive-resume/utils": "workspace:*",
-		"ai": "^6.0.191",
+		"ai": "^6.0.193",
 		"bcrypt": "^6.0.0",
-		"better-auth": "1.6.11",
+		"better-auth": "1.6.13",
 		"drizzle-orm": "1.0.0-rc.3",
 		"drizzle-zod": "1.0.0-beta.14-a36c63d",
 		"es-toolkit": "^1.47.0",
@@ -52,7 +52,7 @@
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
 		"@types/bcrypt": "^6.0.0",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/api/src/features/resume/export.ts

@@ -6,6 +6,37 @@ import { protectedProcedure } from "../../context";
 import { pdfExportRateLimit } from "../../middleware/rate-limit";
 import { resumeService } from "./service";
 
+export {
+	createResumePdfDownloadUrl,
+	MAX_PDF_DOWNLOAD_URL_TTL_SECONDS,
+	PDF_DOWNLOAD_URL_EXPIRES_IN_SECONDS,
+	verifyResumePdfDownloadToken,
+} from "./pdf-download-url";
+
+type CreateResumePdfDownloadInput = {
+	id: string;
+	userId: string;
+};
+
+export async function createResumePdfDownload(input: CreateResumePdfDownloadInput) {
+	const resume = await resumeService.getById({ id: input.id, userId: input.userId });
+	const filename = generateFilename(resume.name, "pdf");
+
+	try {
+		const body = await createResumePdfFile({ data: resume.data, filename });
+
+		return {
+			headers: {
+				"content-disposition": `attachment; filename="${filename}"`,
+			},
+			body,
+		};
+	} catch (error) {
+		console.error("[PDF API] Failed to render resume PDF", { resumeId: input.id, error });
+		throw new ORPCError("INTERNAL_SERVER_ERROR", { message: "Failed to generate resume PDF" });
+	}
+}
+
 export const downloadResumePdfProcedure = protectedProcedure
 	.route({
 		method: "GET",
@@ -29,20 +60,5 @@ export const downloadResumePdfProcedure = protectedProcedure
 	)
 	.use(pdfExportRateLimit)
 	.handler(async ({ context, input }) => {
-		const resume = await resumeService.getById({ id: input.id, userId: context.user.id });
-		const filename = generateFilename(resume.name, "pdf");
-
-		try {
-			const body = await createResumePdfFile({ data: resume.data, filename });
-
-			return {
-				headers: {
-					"content-disposition": `attachment; filename="${filename}"`,
-				},
-				body,
-			};
-		} catch (error) {
-			console.error("[PDF API] Failed to render resume PDF", { resumeId: input.id, error });
-			throw new ORPCError("INTERNAL_SERVER_ERROR", { message: "Failed to generate resume PDF" });
-		}
+		return createResumePdfDownload({ id: input.id, userId: context.user.id });
 	});

packages/api/src/features/resume/pdf-download-url.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("@reactive-resume/env/server", () => ({
+	env: {
+		APP_URL: "https://example.com/app/",
+		AUTH_SECRET: "test-secret",
+	},
+}));
+
+const { MAX_PDF_DOWNLOAD_URL_TTL_SECONDS, createResumePdfDownloadUrl, verifyResumePdfDownloadToken } = await import(
+	"./pdf-download-url"
+);
+
+describe("resume PDF signed download URLs", () => {
+	it("creates a URL with a token that is capped at 10 minutes", () => {
+		const now = new Date("2026-06-01T10:00:00.000Z");
+
+		const result = createResumePdfDownloadUrl({
+			resumeId: "resume-1",
+			userId: "user-1",
+			now,
+			ttlSeconds: 60 * 60,
+		});
+
+		const url = new URL(result.url);
+		const token = url.searchParams.get("token");
+
+		expect(MAX_PDF_DOWNLOAD_URL_TTL_SECONDS).toBe(600);
+		expect(url.origin).toBe("https://example.com");
+		expect(url.pathname).toBe("/api/resumes/resume-1/pdf");
+		expect(token).toBeTruthy();
+		expect(result.expiresInSeconds).toBe(600);
+		expect(result.expiresAt).toBe("2026-06-01T10:10:00.000Z");
+		if (!token) throw new Error("Expected signed URL token");
+
+		expect(
+			verifyResumePdfDownloadToken({
+				resumeId: "resume-1",
+				token,
+				now: new Date("2026-06-01T10:09:59.000Z"),
+			}),
+		).toEqual({
+			ok: true,
+			resumeId: "resume-1",
+			userId: "user-1",
+			expiresAt: "2026-06-01T10:10:00.000Z",
+		});
+	});
+
+	it("rejects expired, tampered, and mismatched tokens", () => {
+		const result = createResumePdfDownloadUrl({
+			resumeId: "resume-1",
+			userId: "user-1",
+			now: new Date("2026-06-01T10:00:00.000Z"),
+		});
+		const token = new URL(result.url).searchParams.get("token");
+		if (!token) throw new Error("Expected signed URL token");
+
+		expect(
+			verifyResumePdfDownloadToken({
+				resumeId: "resume-1",
+				token,
+				now: new Date("2026-06-01T10:10:01.000Z"),
+			}),
+		).toEqual({ ok: false, reason: "expired" });
+
+		expect(
+			verifyResumePdfDownloadToken({
+				resumeId: "other-resume",
+				token,
+				now: new Date("2026-06-01T10:01:00.000Z"),
+			}),
+		).toEqual({ ok: false, reason: "resume_mismatch" });
+
+		const tamperedToken = `${token.slice(0, -1)}${token.endsWith("x") ? "y" : "x"}`;
+
+		expect(
+			verifyResumePdfDownloadToken({
+				resumeId: "resume-1",
+				token: tamperedToken,
+				now: new Date("2026-06-01T10:01:00.000Z"),
+			}),
+		).toEqual({ ok: false, reason: "invalid_signature" });
+	});
+});

packages/api/src/features/resume/pdf-download-url.ts

@@ -0,0 +1,127 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { env } from "@reactive-resume/env/server";
+
+export const MAX_PDF_DOWNLOAD_URL_TTL_SECONDS = 10 * 60;
+export const PDF_DOWNLOAD_URL_EXPIRES_IN_SECONDS = MAX_PDF_DOWNLOAD_URL_TTL_SECONDS;
+
+type PdfDownloadTokenPayload = {
+	v: 1;
+	resumeId: string;
+	userId: string;
+	expiresAt: number;
+	issuedAt: number;
+};
+
+type CreateResumePdfDownloadUrlInput = {
+	resumeId: string;
+	userId: string;
+	now?: Date;
+	ttlSeconds?: number;
+};
+
+type VerifyResumePdfDownloadTokenInput = {
+	resumeId: string;
+	token: string;
+	now?: Date;
+};
+
+type VerifyResumePdfDownloadTokenResult =
+	| {
+			ok: true;
+			resumeId: string;
+			userId: string;
+			expiresAt: string;
+	  }
+	| {
+			ok: false;
+			reason: "expired" | "invalid_signature" | "malformed" | "resume_mismatch";
+	  };
+
+function resolveTtlSeconds(ttlSeconds: number | undefined) {
+	if (ttlSeconds === undefined || !Number.isFinite(ttlSeconds)) return PDF_DOWNLOAD_URL_EXPIRES_IN_SECONDS;
+	return Math.min(Math.max(Math.floor(ttlSeconds), 1), MAX_PDF_DOWNLOAD_URL_TTL_SECONDS);
+}
+
+function encodeJson(value: unknown) {
+	return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+
+function decodeJson(value: string): unknown {
+	return JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+}
+
+function sign(payload: string) {
+	return createHmac("sha256", env.AUTH_SECRET).update(payload).digest("base64url");
+}
+
+function signaturesMatch(actual: string, expected: string) {
+	const actualBuffer = Buffer.from(actual);
+	const expectedBuffer = Buffer.from(expected);
+
+	return actualBuffer.byteLength === expectedBuffer.byteLength && timingSafeEqual(actualBuffer, expectedBuffer);
+}
+
+function parsePayload(value: unknown): PdfDownloadTokenPayload | null {
+	if (!value || typeof value !== "object") return null;
+
+	const payload = value as Partial<PdfDownloadTokenPayload>;
+	if (payload.v !== 1) return null;
+	if (typeof payload.resumeId !== "string" || payload.resumeId.length === 0) return null;
+	if (typeof payload.userId !== "string" || payload.userId.length === 0) return null;
+	if (typeof payload.expiresAt !== "number" || !Number.isFinite(payload.expiresAt)) return null;
+	if (typeof payload.issuedAt !== "number" || !Number.isFinite(payload.issuedAt)) return null;
+
+	return payload as PdfDownloadTokenPayload;
+}
+
+export function createResumePdfDownloadUrl({
+	resumeId,
+	userId,
+	now = new Date(),
+	ttlSeconds,
+}: CreateResumePdfDownloadUrlInput) {
+	const expiresInSeconds = resolveTtlSeconds(ttlSeconds);
+	const expiresAt = new Date(now.getTime() + expiresInSeconds * 1000);
+	const payload = encodeJson({
+		v: 1,
+		resumeId,
+		userId,
+		expiresAt: expiresAt.getTime(),
+		issuedAt: now.getTime(),
+	} satisfies PdfDownloadTokenPayload);
+	const token = `${payload}.${sign(payload)}`;
+	const url = new URL(`/api/resumes/${encodeURIComponent(resumeId)}/pdf`, env.APP_URL);
+	url.searchParams.set("token", token);
+
+	return {
+		url: url.toString(),
+		expiresAt: expiresAt.toISOString(),
+		expiresInSeconds,
+	};
+}
+
+export function verifyResumePdfDownloadToken({
+	resumeId,
+	token,
+	now = new Date(),
+}: VerifyResumePdfDownloadTokenInput): VerifyResumePdfDownloadTokenResult {
+	const [payload, signature, extra] = token.split(".");
+	if (!payload || !signature || extra !== undefined) return { ok: false, reason: "malformed" };
+	if (!signaturesMatch(signature, sign(payload))) return { ok: false, reason: "invalid_signature" };
+
+	try {
+		const parsed = parsePayload(decodeJson(payload));
+		if (!parsed) return { ok: false, reason: "malformed" };
+		if (parsed.resumeId !== resumeId) return { ok: false, reason: "resume_mismatch" };
+		if (parsed.expiresAt <= now.getTime()) return { ok: false, reason: "expired" };
+
+		return {
+			ok: true,
+			resumeId: parsed.resumeId,
+			userId: parsed.userId,
+			expiresAt: new Date(parsed.expiresAt).toISOString(),
+		};
+	} catch {
+		return { ok: false, reason: "malformed" };
+	}
+}

packages/auth/package.json

@@ -16,17 +16,17 @@
 		"test:agent": "vitest run --reporter=agent --reporter=json --outputFile.json=reports/vitest-results.json --passWithNoTests"
 	},
 	"dependencies": {
-		"@better-auth/api-key": "^1.6.11",
-		"@better-auth/drizzle-adapter": "^1.6.11",
-		"@better-auth/infra": "^0.2.10",
-		"@better-auth/oauth-provider": "^1.6.11",
-		"@better-auth/passkey": "^1.6.11",
+		"@better-auth/api-key": "^1.6.13",
+		"@better-auth/drizzle-adapter": "^1.6.13",
+		"@better-auth/infra": "^0.2.11",
+		"@better-auth/oauth-provider": "^1.6.13",
+		"@better-auth/passkey": "^1.6.13",
 		"@reactive-resume/db": "workspace:*",
 		"@reactive-resume/email": "workspace:*",
 		"@reactive-resume/env": "workspace:*",
 		"@reactive-resume/utils": "workspace:*",
 		"bcrypt": "^6.0.0",
-		"better-auth": "1.6.11",
+		"better-auth": "1.6.13",
 		"drizzle-orm": "1.0.0-rc.3",
 		"jose": "^6.2.3",
 		"react": "^19.2.6",
@@ -36,7 +36,7 @@
 		"@reactive-resume/config": "workspace:*",
 		"@types/bcrypt": "^6.0.0",
 		"@types/react": "^19.2.15",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/db/package.json

@@ -31,7 +31,7 @@
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
 		"@types/pg": "^8.20.0",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"drizzle-kit": "1.0.0-rc.3",
 		"typescript": "^6.0.3"
 	}

packages/docx/package.json

@@ -20,7 +20,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/email/package.json

@@ -17,7 +17,7 @@
 	},
 	"dependencies": {
 		"@reactive-resume/env": "workspace:*",
-		"nodemailer": "^8.0.9",
+		"nodemailer": "^8.0.10",
 		"react": "^19.2.6",
 		"react-email": "^6.5.0"
 	},
@@ -26,7 +26,7 @@
 		"@reactive-resume/config": "workspace:*",
 		"@types/nodemailer": "^8.0.0",
 		"@types/react": "^19.2.15",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/env/package.json

@@ -22,7 +22,7 @@
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
 		"@types/node": "^25.9.1",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/fonts/package.json

@@ -19,7 +19,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/import/package.json

@@ -23,7 +23,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/mcp/package.json

@@ -20,7 +20,7 @@
 	},
 	"dependencies": {
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"@orpc/server": "^1.14.3",
+		"@orpc/server": "^1.14.4",
 		"@reactive-resume/ai": "workspace:*",
 		"@reactive-resume/api": "workspace:*",
 		"@reactive-resume/env": "workspace:*",
@@ -29,7 +29,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3",
 		"vitest": "^4.1.7"
 	}

packages/mcp/src/mcp-server-card.test.ts

@@ -32,6 +32,15 @@ describe("buildMcpServerCard", () => {
 		expect(cardToolNames).toEqual(expectedNames);
 	});
 
+	it("advertises a short-lived PDF download URL tool", () => {
+		const tool = card.tools.find((item) => item.name === "download_resume_pdf");
+
+		expect(tool?.title).toBe("Download Resume PDF");
+		expect(tool?.description).toContain("short-lived");
+		expect(tool?.description).toContain("10 minutes");
+		expect(tool?.annotations?.readOnlyHint).toBe(true);
+	});
+
 	it("declares a JSON Schema input for every tool", () => {
 		for (const tool of card.tools) {
 			expect(tool.inputSchema, tool.name).toBeDefined();

packages/mcp/src/mcp-server-card.ts

@@ -83,6 +83,18 @@ export function buildMcpServerCard(appVersion: string) {
 			inputSchema: toJsonSchemaCompat(z.object({ id: resumeId })),
 			annotations: TOOL_ANNOTATIONS[T.getResumeAnalysis],
 		},
+		{
+			name: T.downloadResumePdf,
+			title: "Download Resume PDF",
+			description: [
+				"Create a short-lived authenticated URL for downloading a resume as a PDF.",
+				"The URL expires in 10 minutes and should be used immediately.",
+				"Returns JSON containing: resumeId, name, downloadUrl, expiresAt, expiresInSeconds, contentType.",
+				`Use \`${T.listResumes}\` first to find valid IDs.`,
+			].join("\n"),
+			inputSchema: toJsonSchemaCompat(z.object({ id: resumeId })),
+			annotations: TOOL_ANNOTATIONS[T.downloadResumePdf],
+		},
 		{
 			name: T.createResume,
 			title: "Create Resume",

packages/mcp/src/mcp-tool-names.ts

@@ -4,6 +4,7 @@ export const MCP_TOOL_NAME = {
 	listResumeTags: "list_resume_tags",
 	getResume: "read_resume",
 	getResumeAnalysis: "get_resume_analysis",
+	downloadResumePdf: "download_resume_pdf",
 	createResume: "create_resume",
 	importResume: "import_resume",
 	duplicateResume: "duplicate_resume",

packages/mcp/src/tool-annotations.test.ts

@@ -44,6 +44,13 @@ describe("TOOL_ANNOTATIONS", () => {
 		}
 	});
 
+	it("marks PDF download URL generation as read-only but non-idempotent", () => {
+		const annotations = TOOL_ANNOTATIONS[MCP_TOOL_NAME.downloadResumePdf];
+		expect(annotations.readOnlyHint).toBe(true);
+		expect(annotations.idempotentHint).toBe(false);
+		expect(annotations.destructiveHint).toBe(false);
+	});
+
 	it("marks deleteResume as destructive (but still idempotent)", () => {
 		const annotations = TOOL_ANNOTATIONS[MCP_TOOL_NAME.deleteResume];
 		expect(annotations.destructiveHint).toBe(true);

packages/mcp/src/tool-annotations.ts

@@ -29,6 +29,12 @@ export const TOOL_ANNOTATIONS: Record<McpRegisteredToolName, ToolAnnotations> =
 		idempotentHint: true,
 		openWorldHint: false,
 	},
+	[MCP_TOOL_NAME.downloadResumePdf]: {
+		readOnlyHint: true,
+		destructiveHint: false,
+		idempotentHint: false,
+		openWorldHint: false,
+	},
 	[MCP_TOOL_NAME.createResume]: {
 		readOnlyHint: false,
 		destructiveHint: false,

packages/mcp/src/tools.test.ts

@@ -0,0 +1,107 @@
+// biome-ignore-all lint/style/noNonNullAssertion: These tests assert registered tool names before exercising handlers.
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	resolveUserFromRequestHeaders: vi.fn(),
+	createResumePdfDownloadUrl: vi.fn(),
+}));
+
+vi.mock("@reactive-resume/api/context", () => ({
+	resolveUserFromRequestHeaders: mocks.resolveUserFromRequestHeaders,
+}));
+
+vi.mock("@reactive-resume/api/features/resume/export", () => ({
+	PDF_DOWNLOAD_URL_EXPIRES_IN_SECONDS: 600,
+	createResumePdfDownloadUrl: mocks.createResumePdfDownloadUrl,
+}));
+
+vi.mock("@reactive-resume/env/server", () => ({
+	env: {
+		APP_URL: "https://example.com",
+	},
+}));
+
+const { MCP_TOOL_NAME, registerTools } = await import("./tools");
+
+type ToolHandler = (input: { id: string }) => Promise<{
+	content: Array<{ type: "text"; text: string }>;
+	isError?: boolean;
+}>;
+
+type Registration = {
+	name: string;
+	config: {
+		title?: string;
+		description?: string;
+		inputSchema?: unknown;
+	};
+	handler: ToolHandler;
+};
+
+const makeFakeServer = () => {
+	const registered: Registration[] = [];
+	const server = {
+		registerTool: vi.fn((name: string, config: Registration["config"], handler: ToolHandler) => {
+			registered.push({ name, config, handler });
+		}),
+	};
+	return { server, registered };
+};
+
+const clientMock = {
+	resume: {
+		getById: vi.fn(),
+		list: vi.fn(),
+		tags: { list: vi.fn() },
+		analysis: { getById: vi.fn() },
+		create: vi.fn(),
+		import: vi.fn(),
+		duplicate: vi.fn(),
+		patch: vi.fn(),
+		update: vi.fn(),
+		delete: vi.fn(),
+		setLocked: vi.fn(),
+		statistics: { getById: vi.fn() },
+	},
+};
+
+describe("registerTools", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it("registers a PDF download URL tool that validates access before signing", async () => {
+		clientMock.resume.getById.mockResolvedValueOnce({ id: "resume-1", name: "Scizor" });
+		mocks.resolveUserFromRequestHeaders.mockResolvedValueOnce({ id: "user-1" });
+		mocks.createResumePdfDownloadUrl.mockReturnValueOnce({
+			url: "https://example.com/api/resumes/resume-1/pdf?token=signed",
+			expiresAt: "2026-06-01T10:10:00.000Z",
+			expiresInSeconds: 600,
+		});
+
+		const requestHeaders = new Headers({ "x-api-key": "key" });
+		const { server, registered } = makeFakeServer();
+		registerTools(server as never, clientMock as never, requestHeaders);
+
+		const tool = registered.find((item) => item.name === "download_resume_pdf")!;
+		const result = await tool.handler({ id: "resume-1" });
+		const payload = JSON.parse(result.content[0]!.text);
+
+		expect(tool.config.title).toBe("Download Resume PDF");
+		expect(clientMock.resume.getById).toHaveBeenCalledWith({ id: "resume-1" });
+		expect(mocks.resolveUserFromRequestHeaders).toHaveBeenCalledWith(requestHeaders);
+		expect(mocks.createResumePdfDownloadUrl).toHaveBeenCalledWith({ resumeId: "resume-1", userId: "user-1" });
+		expect(payload).toEqual({
+			resumeId: "resume-1",
+			name: "Scizor",
+			downloadUrl: "https://example.com/api/resumes/resume-1/pdf?token=signed",
+			expiresAt: "2026-06-01T10:10:00.000Z",
+			expiresInSeconds: 600,
+			contentType: "application/pdf",
+		});
+	});
+
+	it("keeps the tool name stable", () => {
+		expect(MCP_TOOL_NAME.downloadResumePdf).toBe("download_resume_pdf");
+	});
+});

packages/mcp/src/tools.ts

@@ -5,6 +5,10 @@ import type router from "@reactive-resume/api/routers";
 import z from "zod";
 import { resumePatchOperationsSchema } from "@reactive-resume/ai/tools/resume-tool-contracts";
 import { resolveUserFromRequestHeaders } from "@reactive-resume/api/context";
+import {
+	createResumePdfDownloadUrl,
+	PDF_DOWNLOAD_URL_EXPIRES_IN_SECONDS,
+} from "@reactive-resume/api/features/resume/export";
 import { env } from "@reactive-resume/env/server";
 import { resumeDataSchema } from "@reactive-resume/schema/resume/data";
 import { MCP_TOOL_NAME } from "./mcp-tool-names";
@@ -195,6 +199,44 @@ export function registerTools(server: McpServer, client: RouterClient<typeof rou
 		}),
 	);
 
+	// ── Download Resume PDF ───────────────────────────────────────
+	server.registerTool(
+		T.downloadResumePdf,
+		{
+			title: "Download Resume PDF",
+			description: [
+				"Create a short-lived authenticated URL for downloading a resume as a PDF.",
+				`The URL expires in ${PDF_DOWNLOAD_URL_EXPIRES_IN_SECONDS / 60} minutes and should be used immediately.`,
+				"Returns JSON containing: resumeId, name, downloadUrl, expiresAt, expiresInSeconds, contentType.",
+				`Use \`${T.listResumes}\` first to find valid IDs.`,
+			].join("\n"),
+			inputSchema: z.object({ id: resumeIdSchema }),
+			annotations: TOOL_ANNOTATIONS[T.downloadResumePdf],
+		},
+		withErrorHandling("creating PDF download URL", async ({ id }: { id: string }) => {
+			const resume = await client.resume.getById({ id });
+			const user = await resolveUserFromRequestHeaders(requestHeaders);
+			if (!user) throw new Error("Unauthorized");
+
+			const signedUrl = createResumePdfDownloadUrl({ resumeId: id, userId: user.id });
+
+			return text(
+				JSON.stringify(
+					{
+						resumeId: id,
+						name: resume.name,
+						downloadUrl: signedUrl.url,
+						expiresAt: signedUrl.expiresAt,
+						expiresInSeconds: signedUrl.expiresInSeconds,
+						contentType: "application/pdf",
+					},
+					null,
+					2,
+				),
+			);
+		}),
+	);
+
 	// ── Create Resume ─────────────────────────────────────────────
 	server.registerTool(
 		T.createResume,

packages/pdf/package.json

@@ -37,7 +37,7 @@
 		"@react-pdf/types": "^2.11.1",
 		"@reactive-resume/config": "workspace:*",
 		"@types/react": "^19.2.15",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/resume/package.json

@@ -21,7 +21,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/schema/package.json

@@ -22,7 +22,7 @@
 	},
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }

packages/ui/package.json

@@ -25,12 +25,12 @@
 		"@reactive-resume/utils": "workspace:*",
 		"class-variance-authority": "^0.7.1",
 		"cmdk": "^1.1.1",
-		"js-cookie": "^3.0.7",
+		"js-cookie": "^3.0.8",
 		"next-themes": "^0.4.6",
 		"react": "^19.2.6",
 		"react-dom": "^19.2.6",
 		"react-resizable-panels": "^4.11.2",
-		"shadcn": "^4.8.2",
+		"shadcn": "^4.9.0",
 		"sonner": "^2.0.7",
 		"tw-animate-css": "^1.4.0"
 	},
@@ -41,7 +41,7 @@
 		"@types/js-cookie": "^3.0.6",
 		"@types/react": "^19.2.15",
 		"@types/react-dom": "^19.2.3",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"postcss": "^8.5.15",
 		"tailwindcss": "^4.3.0",
 		"typescript": "^6.0.3"

packages/utils/package.json

@@ -39,7 +39,7 @@
 	"devDependencies": {
 		"@reactive-resume/config": "workspace:*",
 		"@types/node": "^25.9.1",
-		"@typescript/native-preview": "7.0.0-dev.20260527.1",
+		"@typescript/native-preview": "7.0.0-dev.20260527.2",
 		"typescript": "^6.0.3"
 	}
 }