@k2b/cloud 0.16.1 → 0.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -99,7 +99,7 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.12.1",
     "@k2b/ssr": "0.14.0",
-    "@k2b/ui": "0.6.3",
+    "@k2b/ui": "0.8.0",
     "@k2b/stdlib": "0.26.0",
     "@k2b/sync": "6.5.0",
     "@nats-io/transport-node": "3.4.0",
@@ -130,6 +130,7 @@
     "@types/bun": "1.4.2",
     "babel-preset-solid": "1.9.15",
     "hono": "4.13.8",
+    "playwright": "1.62.0",
     "solid-js": "1.9.15",
     "typescript": "5.9.3",
     "zod": "4.6.5"

package/src/ai/chat/blocks.tsx

@@ -24,6 +24,7 @@ import {
   jsonPreview,
   memoryToolPresentation,
 } from "./message-utils";
+import { aiChatMessages } from "./messages";
 import { AssistantMarkdownBlock } from "./primitives";
 import { AiToolActivity, AiToolDisclosureProvider, type AiToolDisclosureState, createAiToolDisclosureState } from "./tool-disclosure";
 import { groupToolBlocks, isFailedTool, summarizeToolGroup } from "./tool-groups";
@@ -57,16 +58,18 @@ function ReviewDetailValue(props: { detail: ReviewDetail }) {
 // turn streams, so every branch must re-evaluate when the store updates.
 
 function ThinkingBlockView(props: { text: string; streaming?: boolean }) {
+  const locale = useLocale();
+  const t = () => aiChatMessages(locale());
   return (
     <Show
       when={props.text.trim()}
       fallback={
         <Show when={props.streaming}>
-          <Chat.Activity label="Thinking" icon="ti ti-sparkles" tone="ai" busy />
+          <Chat.Activity label={t().thinking} icon="ti ti-sparkles" tone="ai" busy />
         </Show>
       }
     >
-      <Chat.Activity label="Show reasoning" icon="ti ti-sparkles" tone="ai" bodyInset={false}>
+      <Chat.Activity label={t().showReasoning} icon="ti ti-sparkles" tone="ai" bodyInset={false}>
         <pre class="max-h-52 w-full min-w-0 overflow-auto whitespace-pre-wrap rounded-md bg-zinc-100/70 p-2 text-[11px] leading-5 text-secondary [box-shadow:var(--ui-control-recess)] dark:bg-zinc-950/70">
           {props.text}
         </pre>

package/src/ai/chat/builtin-tools.tsx

@@ -24,6 +24,7 @@ const SPECIALIZED_TOOL_NAMES = new Set([
   "calculate",
   "view_image",
   "markdown_to_pdf",
+  "html_to_pdf",
   "local_bash",
   "read_cloud_resource",
 ]);
@@ -317,6 +318,12 @@ function FileOperationView(props: { block: ToolBlock; verb: string; resultPath?:
   );
 }
 
+function CreatedPdfView(props: { block: ToolBlock }) {
+  const locale = useLocale();
+  const result = () => (isRecord(props.block.result) ? props.block.result : {});
+  return <FileOperationView block={props.block} verb={aiChatMessages(locale()).createdPdf} resultPath={text(result().path)} />;
+}
+
 function ReadFileView(props: { block: ToolBlock }) {
   const locale = useLocale();
   const result = () => (isRecord(props.block.result) ? props.block.result : {});
@@ -412,10 +419,9 @@ export function SpecializedBuiltinToolBlock(props: { block: ToolBlock }) {
       return <CalculateView block={props.block} />;
     case "view_image":
       return <ViewImageView block={props.block} />;
-    case "markdown_to_pdf": {
-      const result = isRecord(props.block.result) ? props.block.result : {};
-      return <FileOperationView block={props.block} verb="Created PDF" resultPath={text(result.path)} />;
-    }
+    case "markdown_to_pdf":
+    case "html_to_pdf":
+      return <CreatedPdfView block={props.block} />;
     case "local_bash":
       return <LocalBashView block={props.block} />;
     case "read_cloud_resource":

package/src/ai/chat/message-utils.ts

@@ -304,6 +304,7 @@ const BUILT_IN_TOOL_ICONS = new Map<string, string>([
   ["write_file", "ti ti-file-spark"],
   ["fetch_file", "ti ti-world-download"],
   ["markdown_to_pdf", "ti ti-file-type-pdf"],
+  ["html_to_pdf", "ti ti-file-type-pdf"],
   ["present", "ti ti-file-spark"],
   ["calculate", "ti ti-calculator"],
   ["web_search", "ti ti-search"],

package/src/ai/chat/messages.ts

@@ -18,6 +18,9 @@ const messages = i18n.define({
       toolIssues: "Tool issues",
       none: "None",
       read: "Read",
+      createdPdf: "Created PDF",
+      thinking: "Thinking",
+      showReasoning: "Show reasoning",
       byteRange: ({ start, end }: { start: string; end: string }) => `Bytes ${start}–${end}`,
     },
     de: {
@@ -36,6 +39,9 @@ const messages = i18n.define({
       toolIssues: "Werkzeugprobleme",
       none: "Keine",
       read: "Gelesen",
+      createdPdf: "PDF erstellt",
+      thinking: "Denkt nach",
+      showReasoning: "Denkprozess anzeigen",
       byteRange: ({ start, end }) => `Bytes ${start}–${end}`,
     },
   },

package/src/ai/chat/presentation.tsx

@@ -27,10 +27,15 @@ export type AiChatTimelineSession = {
 
 export { type AiChatActions, AiChatActionsProvider };
 
-const isWideBlock = (block: AiAssistantTimelineItem["blocks"][number]) => block.kind === "tool";
-
 type AssistantBlock = AiAssistantTimelineItem["blocks"][number];
 
+// Activity blocks span the full message column so disclosure chevrons share one
+// right edge. Tool and compaction blocks count even while busy; reasoning counts
+// only once it has text, because empty reasoning renders at most a busy row and
+// must not widen a prose-only reply.
+const isWideBlock = (block: AssistantBlock) =>
+  block.kind === "tool" || block.kind === "compaction" || (block.kind === "thinking" && block.text.trim().length > 0);
+
 type SurveyResultBlock = Extract<AssistantBlock, { kind: "tool" }>;
 type SurveySegment = { type: "assistant"; blocks: AssistantBlock[] } | { type: "survey"; block: SurveyResultBlock };
 

package/src/ai/chat/tool-groups.ts

@@ -48,6 +48,7 @@ export function summarizeToolGroup(tools: readonly Tool[], locale: string): stri
       return de ? "Cloud-Integration verwendet" : "Used Cloud integration";
     if (["read_file", "list_files", "view_image"].includes(tool.name)) return de ? "Dateien gelesen" : "Read files";
     if (tool.name === "write_file") return de ? "Dateien geschrieben" : "Wrote files";
+    if (["markdown_to_pdf", "html_to_pdf"].includes(tool.name)) return de ? "PDFs erstellt" : "Created PDFs";
     if (["load_skill", "load_tools", "search_tools"].includes(tool.name))
       return de ? "Werkzeuge und Wissen geladen" : "Loaded tools and guidance";
     if (tool.name.startsWith("web_") || tool.name === "fetch_file") return de ? "Im Web recherchiert" : "Searched the web";

package/src/ai/code-mode-skill.ts

@@ -4,10 +4,10 @@ import type { AiSkillTemplate } from "./skills";
 
 export const ASSISTANT_CODE_MODE_SKILL = {
   "key": "assistant:code-mode",
-  "version": 52,
+  "version": 54,
   "name": "assistant-code-mode",
   "description": "Inspect and transform unfamiliar data, analyze files, compare results across Cloud apps, or build and improve interactive and agent-only Apps in Assistant Studio. Use for quick code experiments, data analysis, file generation, resource SQL queries and combining discovered Cloud capabilities. For plain arithmetic or date offsets, answer directly or use calculate.",
-  "instructions": "# Assistant code mode\n\nChoose the smallest useful result: one-off answer, exported file, or reusable\nStudio App. Apps may expose agent actions, a display-only dashboard, or both.\nPersistence is optional. One-off scripts stay in their chat and cannot be shared. Reuse an\nexisting Cloud feature when it fits. For a\nquick reading of an uploaded PDF or Office document, `read_file` can return\nMarkdown; use code for exact cells, calculations, original PDF text or positions.\n\n## Start from the contract\n\nLoad the needed `code_*` tools individually through `load_tools` and read their\ninput schemas. They are Assistant tools, not capabilities or functions inside\ncode. Discover other Cloud operations before using `capabilities.run`.\n\nRuntime namespaces are globals: no imports or package installation are needed.\nOnly relative imports of the resource's own source files are supported. There is\nno DOM or native network access. Before using a namespace, read its reference\nbelow for signatures, options and return values. Do not invent methods or infer\nan API from a familiar library. For discovered Cloud capabilities and external\nAPIs, obtain their actual contracts separately.\n\nInspect supplied data before joining, filtering or calculating: column names,\ntypes, units, date ranges and missing values. Ask only for decisions or inputs\nthat cannot be established from available evidence. For several real steps,\nkeep a short `todo_write` plan and update it as work changes; skip ceremony for a\nsmall experiment. A failed experiment should change the next hypothesis.\n\n## First file script\n\nPass exact current-chat manifest paths as `code_run.inputPaths`, and this entry\nas `code_run.code` for a small CSV:\n\n```js\nexport default async () => {\n  const [input] = await files.list();\n  if (!input) throw new Error(\"Select a CSV input.\");\n  const rows = await sheet.fromCsv(await files.read(input.name));\n  return { rows: rows.length, columns: Object.keys(rows[0] ?? {}), sample: rows.slice(0, 3) };\n};\n```\n\n`input.name` is the full path, such as `/sales.csv`; pass it unchanged to\n`files.read`, which returns a `File`. CSV rows are objects keyed by headers:\n`rows[0]` is already data. Do not drop it. For older Excel CSVs, use\n`sheet.fromCsv(file, {encoding:\"windows-1252\"})`. Inspect actual headings first.\nFor a tiny experiment without files, `export default () => ({answer:42})` suffices.\nEach run has fresh variables. No saved resource or UI is required.\n\n## Reference routing\n\nRead only the rows relevant to the task. Each link describes its own complete\nsupported surface; links within references add related workflows when needed.\n\n| Task / API | Read |\n| --- | --- |\n| Source entry, input/output files, pickers, CSV, IDs | [Runtime and files](/skills/assistant-code-mode/references/runtime.md) |\n| Inspect PDF pages, read PDF text/positions or XLSX/ODS cells, write ODS | [Documents](/skills/assistant-code-mode/references/documents.md) |\n| Generate a PDF, embed attachments, combine invoice HTML and XML | [PDF generation](/skills/assistant-code-mode/references/pdf.md) |\n| Exact amounts, taxes, allocation, localized money | [Money](/skills/assistant-code-mode/references/money.md) |\n| Export DATEV bookings or SEPA transfers | [DATEV and SEPA](/skills/assistant-code-mode/references/finance.md) |\n| Parse a CAMT bank report | [Bank reports](/skills/assistant-code-mode/references/camt.md) |\n| Calculate, create or read electronic invoices/XML/PDF attachments | [Electronic invoices](/skills/assistant-code-mode/references/einvoice.md) |\n| Controls, layouts and dialogs | [UI and dialogs](/skills/assistant-code-mode/references/ui.md), [Analytics UI](/skills/assistant-code-mode/references/analytics.md) |\n| Chart types, series and axes | [Charts](/skills/assistant-code-mode/references/charts.md) |\n| Long processing, progress, cancellation | [Background work](/skills/assistant-code-mode/references/work.md) |\n| Persist JSON or files locally/shared | [Storage](/skills/assistant-code-mode/references/storage.md) |\n| Copy files between stores; list and download Filesv2 beside Grids documents | [File transfers](/skills/assistant-code-mode/references/files.md) |\n| Resource SQL, schema, row CRUD, imports | [Database](/skills/assistant-code-mode/references/database.md) |\n| Generate text, classify data or extract structured fields | [AI calculations](/skills/assistant-code-mode/references/ai.md) |\n| Discovered Cloud queries/actions | [Capability calls](/skills/assistant-code-mode/references/capabilities.md) |\n| External HTTPS and personal secrets | [HTTP and secrets](/skills/assistant-code-mode/references/http.md) |\n| Call a published App action; declare handlers | [App actions](/skills/assistant-code-mode/references/app-actions.md) |\n| Reuse work across chats, create or edit an App | [Source workflow](/skills/assistant-code-mode/references/source-workflow.md) |\n| Publish, restore, copy | [Publishing](/skills/assistant-code-mode/references/publishing.md) |\n| Find recipients or change App/Skill sharing | [Access](/skills/assistant-code-mode/references/access.md) |\n| Inspect, export, clear server data, or delete an App | [Management](/skills/assistant-code-mode/references/management.md) |\n| Execute, inspect, interact, export, stop, diagnose errors | [Run and debug](/skills/assistant-code-mode/references/debugging.md) |\n| Unfamiliar inputs or cross-app investigation | [Investigation](/skills/assistant-code-mode/references/investigation.md) |\n| Complete app starters | [Examples](/skills/assistant-code-mode/references/examples.md) |\n\nFor a new app, read Source workflow and the closest complete example before\nwriting source, plus only the API references it uses. For analytical reports or\ndashboards, also load `assistant-data-analysis` for metrics and source validation.\n\n## Choose the delivery\n\nFor a one-off chart, calculator, or interactive analysis in this conversation,\nuse `code_run({code,inputPaths})`, test the controls, then\n`code_present({runId,title})`. Read [Chat visualizations](/skills/assistant-code-mode/references/chat.md).\nA successful run is visible to the agent only; present it before saying the\nuser can see it. No saved App or chat file is necessary.\n\nUse a Studio App when the user needs an independently accessible, reusable\napplication. Use `files.save`, `code_export`, and `present` when the requested\nresult is a file. These are separate delivery choices.\n\n## Verify and deliver\n\nRun the actual source (the saved revision for Apps) and test relevant controls with IDs returned by\n`code_run`/`code_interact`, including invalid inputs and picker fixtures. Creating,\ncompiling or saving source does not verify behavior. If `work.status` is\n`running`, wait with `code_inspect({runId,waitMs:30000})`; do not restart the job.\nInspect only when the returned snapshot needs more detail. Errors and\n`outputTruncated` are not successful complete results.\n\nFor a CSV, call `await files.save(sheet.toCsv(rows), \"result.csv\")` inside code;\nfor a spreadsheet, `await files.save(await sheet.toOds(sheets), \"result.ods\")`.\nThen call the **tool** `code_export` with the returned `runId` and captured file\nname, and `present` its returned chat path. `files.save` returns no path.\nReuse exported data via its path/version rather than retyping truncated output.\nReconcile row counts, exclusions and totals before reporting findings.\n\nOpen GUI apps with `code_open`. Saving or testing does\nnot replace a user's already-running app. Stop runs no longer needed that retain\nUI, jobs or output files. Never claim an unexecuted result is verified.\n\nAgent execution runs independently of the user's tab. Agent local storage is\ntemporary; shared storage, database writes and external actions are real, even\nin tests. Cancellation and source restore do not undo them. Apps select local\nfiles explicitly; they never gain implicit access to chat attachments. Use\n`code_secret` for credentials, never chat or app controls. Honor normal access\nand approval decisions; availability is not authorization for unrelated actions.",
+  "instructions": "# Assistant code mode\n\nChoose the smallest useful result: one-off answer, exported file, or reusable\nStudio App. Apps may expose agent actions, a display-only dashboard, or both.\nPersistence is optional. One-off scripts stay in their chat and cannot be shared. Reuse an\nexisting Cloud feature when it fits. For a\nquick reading of an uploaded PDF or Office document, `read_file` can return\nMarkdown; use code for exact cells, calculations, original PDF text or positions.\n\n## Start from the contract\n\nLoad the needed `code_*` tools individually through `load_tools` and read their\ninput schemas. They are Assistant tools, not capabilities or functions inside\ncode. Discover other Cloud operations before using `capabilities.run`.\n\nRuntime namespaces are globals: no imports or package installation are needed.\nOnly relative imports of the resource's own source files are supported. There is\nno DOM or native network access. Before using a namespace, read its reference\nbelow for signatures, options and return values. Do not invent methods or infer\nan API from a familiar library. For discovered Cloud capabilities and external\nAPIs, obtain their actual contracts separately.\n\nInspect supplied data before joining, filtering or calculating: column names,\ntypes, units, date ranges and missing values. Ask only for decisions or inputs\nthat cannot be established from available evidence. For several real steps,\nkeep a short `todo_write` plan and update it as work changes; skip ceremony for a\nsmall experiment. A failed experiment should change the next hypothesis.\n\n## First file script\n\nPass exact current-chat manifest paths as `code_run.inputPaths`, and this entry\nas `code_run.code` for a small CSV:\n\n```js\nexport default async () => {\n  const [input] = await files.list();\n  if (!input) throw new Error(\"Select a CSV input.\");\n  const rows = await sheet.fromCsv(await files.read(input.name));\n  return { rows: rows.length, columns: Object.keys(rows[0] ?? {}), sample: rows.slice(0, 3) };\n};\n```\n\n`input.name` is the full path, such as `/sales.csv`; pass it unchanged to\n`files.read`, which returns a `File`. CSV rows are objects keyed by headers:\n`rows[0]` is already data. Do not drop it. For older Excel CSVs, use\n`sheet.fromCsv(file, {encoding:\"windows-1252\"})`. Inspect actual headings first.\nFor a tiny experiment without files, `export default () => ({answer:42})` suffices.\nEach run has fresh variables. No saved resource or UI is required.\n\n## Reference routing\n\nRead only the rows relevant to the task. Each link describes its own complete\nsupported surface; links within references add related workflows when needed.\n\n| Task / API | Read |\n| --- | --- |\n| Source entry, input/output files, pickers, CSV, IDs | [Runtime and files](/skills/assistant-code-mode/references/runtime.md) |\n| Inspect PDF pages, read PDF text/positions or XLSX/ODS cells, write ODS | [Documents](/skills/assistant-code-mode/references/documents.md) |\n| Generate a PDF, save one in Files, embed attachments, combine invoice HTML and XML | [PDF generation](/skills/assistant-code-mode/references/pdf.md) |\n| Exact amounts, taxes, allocation, localized money | [Money](/skills/assistant-code-mode/references/money.md) |\n| Export DATEV bookings or SEPA transfers | [DATEV and SEPA](/skills/assistant-code-mode/references/finance.md) |\n| Parse a CAMT bank report | [Bank reports](/skills/assistant-code-mode/references/camt.md) |\n| Calculate, create or read electronic invoices/XML/PDF attachments | [Electronic invoices](/skills/assistant-code-mode/references/einvoice.md) |\n| Controls, layouts and dialogs | [UI and dialogs](/skills/assistant-code-mode/references/ui.md), [Analytics UI](/skills/assistant-code-mode/references/analytics.md) |\n| Chart types, series and axes | [Charts](/skills/assistant-code-mode/references/charts.md) |\n| Long processing, progress, cancellation | [Background work](/skills/assistant-code-mode/references/work.md) |\n| Persist JSON or files locally/shared | [Storage](/skills/assistant-code-mode/references/storage.md) |\n| Copy files between stores; list and download Filesv2 beside Grids documents | [File transfers](/skills/assistant-code-mode/references/files.md) |\n| Resource SQL, schema, row CRUD, imports | [Database](/skills/assistant-code-mode/references/database.md) |\n| Generate text, classify data or extract structured fields | [AI calculations](/skills/assistant-code-mode/references/ai.md) |\n| Discovered Cloud queries/actions | [Capability calls](/skills/assistant-code-mode/references/capabilities.md) |\n| External HTTPS and personal secrets | [HTTP and secrets](/skills/assistant-code-mode/references/http.md) |\n| Call a published App action; declare handlers | [App actions](/skills/assistant-code-mode/references/app-actions.md) |\n| Reuse work across chats, create or edit an App | [Source workflow](/skills/assistant-code-mode/references/source-workflow.md) |\n| Publish, restore, copy | [Publishing](/skills/assistant-code-mode/references/publishing.md) |\n| Find recipients or change App/Skill sharing | [Access](/skills/assistant-code-mode/references/access.md) |\n| Inspect, export, clear server data, or delete an App | [Management](/skills/assistant-code-mode/references/management.md) |\n| Execute, inspect, interact, export, stop, diagnose errors | [Run and debug](/skills/assistant-code-mode/references/debugging.md) |\n| Unfamiliar inputs or cross-app investigation | [Investigation](/skills/assistant-code-mode/references/investigation.md) |\n| Complete app starters | [Examples](/skills/assistant-code-mode/references/examples.md) |\n\nFor a new app, read Source workflow and the closest complete example before\nwriting source, plus only the API references it uses. For analytical reports or\ndashboards, also load `assistant-data-analysis` for metrics and source validation.\n\n## Choose the delivery\n\nFor a one-off chart, calculator, or interactive analysis in this conversation,\nuse `code_run({code,inputPaths})`, test the controls, then\n`code_present({runId,title})`. Read [Chat visualizations](/skills/assistant-code-mode/references/chat.md).\nA successful run is visible to the agent only; present it before saying the\nuser can see it. No saved App or chat file is necessary.\n\nUse a Studio App when the user needs an independently accessible, reusable\napplication. Use `files.save`, `code_export`, and `present` when the requested\nresult is a file. These are separate delivery choices.\n\n## Verify and deliver\n\nRun the actual source (the saved revision for Apps) and test relevant controls with IDs returned by\n`code_run`/`code_interact`, including invalid inputs and picker fixtures. Creating,\ncompiling or saving source does not verify behavior. If `work.status` is\n`running`, wait with `code_inspect({runId,waitMs:30000})`; do not restart the job.\nInspect only when the returned snapshot needs more detail. Errors and\n`outputTruncated` are not successful complete results.\n\nFor a CSV, call `await files.save(sheet.toCsv(rows), \"result.csv\")` inside code;\nfor a spreadsheet, `await files.save(await sheet.toOds(sheets), \"result.ods\")`.\nThen call the **tool** `code_export` with the returned `runId` and captured file\nname, and `present` its returned chat path. `files.save` returns no path.\nReuse exported data via its path/version rather than retyping truncated output.\nReconcile row counts, exclusions and totals before reporting findings.\n\nOpen GUI apps with `code_open`. Saving or testing does\nnot replace a user's already-running app. Stop runs no longer needed that retain\nUI, jobs or output files. Never claim an unexecuted result is verified.\n\nAgent execution runs independently of the user's tab. Agent local storage is\ntemporary; shared storage, database writes and external actions are real, even\nin tests. Cancellation and source restore do not undo them. Apps select local\nfiles explicitly; they never gain implicit access to chat attachments. Use\n`code_secret` for credentials, never chat or app controls. Honor normal access\nand approval decisions; availability is not authorization for unrelated actions.",
   "extraFrontmatter": {},
   "references": [
     {
@@ -88,7 +88,7 @@ export const ASSISTANT_CODE_MODE_SKILL = {
     },
     {
       "path": "references/pdf.md",
-      "content": "# Generate PDFs\n\n`pdf.render`, `pdf.attach` and `pdf.facturX` are asynchronous and return a PDF\n`Blob`. They use the instance's configured PDF service. `pdf.open` is\nthe local text reader described in [Documents](documents.md).\n\n## HTML and CSS\n\n```js\nconst document = await pdf.render({\n  html: `<!doctype html><html><head><style>\n    body { font-family: sans-serif; }\n    h1 { color: #087f70; }\n    tr { break-inside: avoid; }\n  </style></head><body><h1>Stock report</h1><img src=\"logo.png\"></body></html>`,\n  assets: [{ name: \"logo.png\", data: logoFile }],\n  page: { format: \"A4\", landscape: false, margin: { top: 15, right: 15, bottom: 15, left: 15 } },\n  tagged: true,\n});\nawait files.save(document, \"stock-report.pdf\");\n```\n\n`html` is required. `assets` defaults to an empty array and accepts named `Blob`\nvalues for local images, fonts and CSS. Use plain filenames, no directories;\nreference the exact filename from HTML or CSS. Duplicate names and the reserved\nnames `index.html`, `header.html`, `footer.html`, `factur-x.xml` fail.\n`headerHtml` and `footerHtml` are optional independent HTML strings with their own\nCSS. Page markers such as `<span class=\"pageNumber\"></span>` work in\nthose templates. Background colors are printed.\n\n`page.format` defaults to `A4`; alternatives are `A3`, `A5`, `Letter`, and `Legal`.\n`landscape` defaults to false. Each margin is a nonnegative millimeter number,\ndefaulting to 15. Use `page` for paper dimensions and margins; avoid conflicting\nCSS `@page` rules. `tagged` defaults to true, which requests a tagged PDF but does\nnot certify accessibility.\n\nStudio styles are not inherited. Scripts, redirects, frames and outbound\nresources are blocked. Supply local assets or data URLs; this is not a URL-to-PDF\nbrowser or a JavaScript rendering environment.\n\n## Attach files\n\n```js\nconst result = await pdf.attach({\n  document,\n  attachments: [{\n    name: \"details.xml\",\n    data: new Blob([xml], { type: \"application/xml\" }),\n    relationship: \"Data\",\n  }],\n});\nawait files.shared.write(\"reports/with-details.pdf\", result);\n```\n\nThe source PDF and attachments are ordinary `Blob`s. Their origin does not\nmatter: explicit picker selections, authorized chat inputs, or app storage use\nthe same API. `relationship` defaults to `Unspecified`; alternatives are\n`Source`, `Data`, `Alternative`, and `Supplement`. MIME type comes from the Blob\nand defaults to `application/octet-stream` if empty. Provide at least one attachment. Names within the request\nmust be unique. All asset/attachment names are 1–180 characters, with no slash,\nbackslash or control characters, and cannot be `.` or `..`. Embedding an XML file alone does not create a compliant invoice.\n\n## Factur-X / ZUGFeRD\n\n```js\nconst checked = einvoice.validate(invoice);\nif (!checked.ok) throw new Error(JSON.stringify(checked.error));\nconst xml = einvoice.serialize(checked.data, { format: \"zugferd-2.5-en16931\" });\nif (!xml.ok) throw new Error(JSON.stringify(xml.error));\nconst document = await pdf.facturX({\n  html: invoiceHtml,\n  xml: xml.data.xml,\n  profile: \"EN 16931\",\n});\nawait files.save(document, \"invoice.pdf\");\n```\n\n`facturX` accepts the same render options plus required `xml` and `profile`.\nProfiles: `MINIMUM`, `BASIC WL`, `BASIC`, `EN 16931`, `EXTENDED`. Use `EN 16931`\nwith the bundled `einvoice.serialize` output; that serializer does not support\nthe other profiles. The service embeds `factur-x.xml`, sets Factur-X 1.0 invoice\nmetadata and requests PDF/A-3b. The app must supply matching HTML and XML.\nNeither rendering nor parsing certifies XSD, Schematron, tax or invoice validity.\n\n## Cancellation, access and limits\n\nAll three methods accept a second `{ signal }` argument, for example the signal\nfrom a `work.run` job. Abort rejects with `AbortError`. Stopping the execution\nhost also cancels pending PDF requests. Rendering creates no stored file until\ncode explicitly saves it; do not automatically retry failed calls.\n\nSaved resources need Use access, not Manage. One-off scripts need an accessible,\nunrestricted current chat. The server checks access before reading the body.\nNo service URL, credentials, shell flags or arbitrary conversion route are\nexposed to app code. This is an internal conversion, not `http.fetch`; there is\nno external API approval prompt.\n\nConfigured service input, output and timeout limits apply. HTML, its headers,\nfooters, assets and invoice XML share the HTML input budget. PDF attachments\nand the source PDF share the PDF input budget. All transfers also have a 64 MiB\nceiling; multipart framing has a separate bounded overhead. Shared storage and\nchat export budgets remain independent. Errors include `PDF_NOT_CONFIGURED`,\n`PDF_LIMIT`, `PDF_TIMEOUT`, `PDF_FAILED`, `INVALID_INPUT`, and `ACCESS_DENIED`.\n"
+      "content": "# Generate PDFs\n\n`pdf.render`, `pdf.attach` and `pdf.facturX` are asynchronous and return a PDF\n`Blob`. They use the instance's configured PDF service. `pdf.open` is\nthe local text reader described in [Documents](documents.md).\n\n## Choose the path\n\nA document written in the chat needs no code. Use the chat tool\n`markdown_to_pdf` for text-first documents; it applies A4 presets and custom CSS\nand turns images into links. Use `html_to_pdf` for a chat `.html` file whose\nlayout needs HTML and CSS, images, or fonts. It takes optional CSS (file or\ninline), header and footer files, chat files as named assets, and the `page`\noptions below, then writes a sibling `.pdf` for `present`. Use `pdf.render` when\ncode builds the document from data, for Factur-X or attachments, and in Studio\nApps.\n\n## HTML and CSS\n\n```js\nconst document = await pdf.render({\n  html: `<!doctype html><html><head><style>\n    body { font-family: sans-serif; }\n    h1 { color: #087f70; }\n    tr { break-inside: avoid; }\n  </style></head><body><h1>Stock report</h1><img src=\"logo.png\"></body></html>`,\n  assets: [{ name: \"logo.png\", data: logoFile }],\n  page: { format: \"A4\", landscape: false, margin: { top: 15, right: 15, bottom: 15, left: 15 } },\n  tagged: true,\n});\nawait files.save(document, \"stock-report.pdf\");\n```\n\n`html` is required. `assets` defaults to an empty array and accepts named `Blob`\nvalues for local images, fonts and CSS. Use plain filenames, no directories;\nreference the exact filename from HTML or CSS. Duplicate names and the reserved\nnames `index.html`, `header.html`, `footer.html`, `factur-x.xml` fail.\n`headerHtml` and `footerHtml` are optional independent HTML strings with their own\nCSS. They load no assets; use `data:` URLs for images there. Page markers such as\n`<span class=\"pageNumber\"></span>` work in those templates, and the page margin\nmust leave room for them. Background colors are printed.\n\n`page.format` defaults to `A4`; alternatives are `A3`, `A5`, `Letter`, and `Legal`.\n`landscape` defaults to false. Each margin is a nonnegative millimeter number,\ndefaulting to 15. Use `page` for paper dimensions and margins; avoid conflicting\nCSS `@page` rules. `tagged` defaults to true, which requests a tagged PDF but does\nnot certify accessibility.\n\nStudio styles are not inherited. Scripts, redirects, frames and outbound\nresources are blocked. MathML (`math`) and the SVG elements `foreignObject` and\n`desc` are removed; write formulas and labels as HTML and CSS or as SVG text.\nSupply local assets or data URLs; this is not a URL-to-PDF browser or a\nJavaScript rendering environment.\n\n## Attach files\n\n```js\nconst result = await pdf.attach({\n  document,\n  attachments: [{\n    name: \"details.xml\",\n    data: new Blob([xml], { type: \"application/xml\" }),\n    relationship: \"Data\",\n  }],\n});\nawait files.shared.write(\"reports/with-details.pdf\", result);\n```\n\nThe source PDF and attachments are ordinary `Blob`s. Their origin does not\nmatter: explicit picker selections, authorized chat inputs, or app storage use\nthe same API. `relationship` defaults to `Unspecified`; alternatives are\n`Source`, `Data`, `Alternative`, and `Supplement`. MIME type comes from the Blob\nand defaults to `application/octet-stream` if empty. Provide at least one attachment. Names within the request\nmust be unique. All asset/attachment names are 1–180 characters, with no slash,\nbackslash or control characters, and cannot be `.` or `..`. Embedding an XML file alone does not create a compliant invoice.\n\n## Factur-X / ZUGFeRD\n\n```js\nconst checked = einvoice.validate(invoice);\nif (!checked.ok) throw new Error(JSON.stringify(checked.error));\nconst xml = einvoice.serialize(checked.data, { format: \"zugferd-2.5-en16931\" });\nif (!xml.ok) throw new Error(JSON.stringify(xml.error));\nconst document = await pdf.facturX({\n  html: invoiceHtml,\n  xml: xml.data.xml,\n  profile: \"EN 16931\",\n});\nawait files.save(document, \"invoice.pdf\");\n```\n\n`facturX` accepts the same render options plus required `xml` and `profile`.\nProfiles: `MINIMUM`, `BASIC WL`, `BASIC`, `EN 16931`, `EXTENDED`. Use `EN 16931`\nwith the bundled `einvoice.serialize` output; that serializer does not support\nthe other profiles. The service embeds `factur-x.xml`, sets Factur-X 1.0 invoice\nmetadata and requests PDF/A-3b. The app must supply matching HTML and XML.\nNeither rendering nor parsing certifies XSD, Schematron, tax or invoice validity.\n\n## Save a PDF in Files\n\nA chat PDF stays in the chat until code writes it elsewhere. To save it in the\nuser's Files, pass its chat path in `code_run.inputPaths` and write it through\nthe discovered `filesv2.content.create` action:\n\n```js\nexport default async () => {\n  const document = await files.read(\"/offer.pdf\");\n  const target = await capabilities.run(\"filesv2.content.create\", {\n    baseId: \"<exact ID from filesv2.bases.list>\",\n    path: \"Offers/offer.pdf\",\n    size: document.size,\n    mediaType: \"application/pdf\",\n  });\n  return capabilities.streams.write(target.stream, document);\n};\n```\n\nAsk for the storage base and folder when the request does not name them. The user\nreviews the write. It creates a new file and fails when the path exists;\nreplacing requires the current `expectedRevision`. A `pdf.render` result can be\nwritten the same way without saving it to the chat first. See\n[Capability calls](capabilities.md) for stream limits and interrupted writes.\n\n## Cancellation, access and limits\n\nAll three methods accept a second `{ signal }` argument, for example the signal\nfrom a `work.run` job. Abort rejects with `AbortError`. Stopping the execution\nhost also cancels pending PDF requests. Rendering creates no stored file until\ncode explicitly saves it; do not automatically retry failed calls.\n\nSaved resources need Use access, not Manage. One-off scripts need an accessible,\nunrestricted current chat. The server checks access before reading the body.\nNo service URL, credentials, shell flags or arbitrary conversion route are\nexposed to app code. This is an internal conversion, not `http.fetch`; there is\nno external API approval prompt.\n\nConfigured service input, output and timeout limits apply. HTML, its headers,\nfooters, assets and invoice XML share the HTML input budget. PDF attachments\nand the source PDF share the PDF input budget. All transfers also have a 64 MiB\nceiling; multipart framing has a separate bounded overhead. Shared storage and\nchat export budgets remain independent. Errors include `PDF_NOT_CONFIGURED`,\n`PDF_LIMIT`, `PDF_TIMEOUT`, `PDF_FAILED`, `INVALID_INPUT`, and `ACCESS_DENIED`.\n"
     },
     {
       "path": "references/publishing.md",

package/src/ai/default-tools.ts

@@ -34,6 +34,7 @@ import {
   createCloudAiWriteFileTool,
 } from "./file-tools";
 import { createCloudAiWebExtractTool, createCloudAiWebSearchTool, isCloudAiFirecrawlConfigured } from "./firecrawl-tools";
+import { createCloudAiHtmlToPdfTool } from "./html-pdf-tool";
 import { createCloudAiMarkdownToPdfTool } from "./markdown-pdf-tool";
 import { createAiTodoTool } from "./todo-tool";
 import { defineAiTool } from "./tools";
@@ -190,6 +191,7 @@ export const CLOUD_AI_DEFERRED_BUILTIN_TOOL_NAMES = new Set<string>([
   "list_files",
   "write_file",
   "markdown_to_pdf",
+  "html_to_pdf",
   "present",
   "calculate",
   "read_cloud_resource",
@@ -208,6 +210,7 @@ export const createConfiguredDefaultCloudAiTools = async (config?: {
     createCloudAiFetchFileTool(),
     createCloudAiWriteFileTool(),
     createCloudAiMarkdownToPdfTool(),
+    createCloudAiHtmlToPdfTool(),
     createCloudAiPresentTool(),
     createCloudAiCalculateTool(),
     createCloudAiViewImageTool(),

package/src/ai/html-pdf-tool.ts

@@ -0,0 +1,180 @@
+import { z } from "zod";
+import {
+  type GotenbergConfig,
+  getGotenbergConfig,
+  MARKDOWN_PDF_MAX_CUSTOM_CSS_BYTES,
+  type RenderHtmlToPdfInput,
+  type RenderHtmlToPdfOptions,
+  type RenderHtmlToPdfResult,
+  renderHtmlToPdfWithConfig,
+} from "../services/pdf";
+import { aiProjectFilePathFromMount, aiSkillFilePathFromMount } from "./file-mount";
+import { type AiFileContent, type AiFileStat, aiFileStore, normalizeAiFilePath } from "./files-store";
+import { withAiPdfConversionSlot } from "./pdf-conversions";
+import { defineAiTool } from "./tools";
+
+/** The same bound as the chat input files of one code_run. */
+export const HTML_PDF_MAX_ASSETS = 64;
+
+const FilePath = z.string().trim().min(1);
+const Margin = z.number().finite().nonnegative();
+
+export const CloudAiHtmlToPdfInputSchema = z
+  .object({
+    path: FilePath.describe("Absolute path to an assistant-created .html file in this conversation."),
+    cssPath: FilePath.optional().describe("Optional conversation CSS file, applied after the document's own styles."),
+    customCss: z.string().max(MARKDOWN_PDF_MAX_CUSTOM_CSS_BYTES).optional().describe("Optional inline CSS, applied last."),
+    headerPath: FilePath.optional().describe("Optional conversation HTML file printed at the top of every page."),
+    footerPath: FilePath.optional().describe("Optional conversation HTML file printed at the bottom of every page."),
+    assets: z
+      .array(FilePath)
+      .max(HTML_PDF_MAX_ASSETS)
+      .optional()
+      .describe("Conversation image or font files. The HTML and CSS reference each by its file name only, such as logo.png."),
+    page: z
+      .object({
+        format: z.enum(["A4", "A3", "A5", "Letter", "Legal"]).optional().describe("Paper size. Default A4."),
+        landscape: z.boolean().optional().describe("Landscape orientation. Default false."),
+        margin: z
+          .object({ top: Margin.optional(), right: Margin.optional(), bottom: Margin.optional(), left: Margin.optional() })
+          .strict()
+          .optional()
+          .describe("Page margins in millimeters. Each defaults to 15."),
+      })
+      .strict()
+      .optional(),
+  })
+  .strict();
+
+export const CloudAiHtmlToPdfOutputSchema = z.object({
+  sourcePath: z.string(),
+  path: z.string(),
+  size: z.number().int().nonnegative(),
+  mediaType: z.literal("application/pdf"),
+});
+
+type HtmlPdfToolDependencies = {
+  stat?: (input: { conversationId: string; path: string }) => Promise<AiFileStat | null>;
+  read?: (input: { conversationId: string; path: string }) => Promise<AiFileContent | null>;
+  write?: (input: { conversationId: string; path: string; bytes: Uint8Array; mediaType: string; origin: "assistant" }) => Promise<void>;
+  config?: () => Promise<GotenbergConfig>;
+  render?: (input: RenderHtmlToPdfInput, config: GotenbergConfig, options: RenderHtmlToPdfOptions) => Promise<RenderHtmlToPdfResult>;
+};
+
+const HTML_EXTENSION = /\.html?$/i;
+
+const conversationPath = (value: string, role: "source" | "input"): string => {
+  const path = normalizeAiFilePath(value.startsWith("/") ? value : `/${value}`);
+  if (!path) throw new Error(`Use an absolute conversation file path instead of ${value}.`);
+  if (aiProjectFilePathFromMount(path) !== null || aiSkillFilePathFromMount(path) !== null) {
+    throw new Error(
+      role === "source"
+        ? "html_to_pdf converts only conversation files; copy the HTML into a conversation file with write_file first."
+        : `html_to_pdf reads only files of this conversation, not ${path}.`,
+    );
+  }
+  if (role === "source" && !HTML_EXTENSION.test(path)) throw new Error("html_to_pdf requires a .html file written with write_file.");
+  return path;
+};
+
+const basename = (path: string): string => path.slice(path.lastIndexOf("/") + 1);
+
+const utf8 = (file: AiFileContent): string => {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(file.bytes);
+  } catch {
+    throw new Error(`File ${file.path} is not valid UTF-8 text.`);
+  }
+};
+
+const cancelled = (signal: AbortSignal): Error =>
+  signal.reason instanceof Error ? signal.reason : new Error("PDF conversion was cancelled.");
+
+export const createCloudAiHtmlToPdfTool = (dependencies: HtmlPdfToolDependencies = {}) => {
+  const stat = dependencies.stat ?? aiFileStore.stat;
+  const read = dependencies.read ?? aiFileStore.read;
+  const write = dependencies.write ?? aiFileStore.write;
+  const loadConfig = dependencies.config ?? getGotenbergConfig;
+  const render = dependencies.render ?? renderHtmlToPdfWithConfig;
+
+  return defineAiTool({
+    name: "html_to_pdf",
+    description:
+      'Convert one assistant-created conversation HTML file to a sibling PDF; the output path replaces .html with .pdf. Use it when the layout needs HTML and CSS, such as columns, exact tables, letterheads, invoices, certificates, images, or custom fonts; use markdown_to_pdf for text-first documents. Write the .html source with write_file first, appending long files in parts; CSS, header, footer, and asset files can be any conversation files, including uploads. Rendering is offline without JavaScript: scripts, frames, and remote URLs are removed or blocked, and MathML and the SVG foreignObject and desc elements are removed, so write formulas and labels as HTML and CSS or as SVG text. Embed images and fonts as data: URLs, or list conversation files in assets and reference each by its file name only, for example <img src="logo.png"> or url("brand.woff2"); percent-encode #, ?, %, and : in a name, such as logo%232.png for logo#2.png. cssPath and customCss apply after the document\'s own styles. page sets paper size (default A4), orientation, and millimeter margins (default 15); CSS @page sizes are ignored. Header and footer files are small separate HTML documents with their own inline styles; they load no assets, so use data: URLs for images there. <span class="pageNumber"></span> and <span class="totalPages"></span> print page numbers, and the top or bottom margin must leave room for them. All input files share the configured PDF input budget. Call present with the returned path. To also save the PDF in Files, follow the PDF reference of the assistant-code-mode skill.',
+    inputSchema: CloudAiHtmlToPdfInputSchema,
+    outputSchema: CloudAiHtmlToPdfOutputSchema,
+    approval: "never",
+    timeoutMs: 125_000,
+    promptHint:
+      "for PDFs whose layout needs HTML and CSS, images, or fonts: write an assistant-owned .html file with write_file, convert it with html_to_pdf, then call present with the returned PDF path.",
+  }).server(async (input, ctx) => {
+    const conversationId = ctx.conversationId;
+    if (!conversationId) throw new Error("The html_to_pdf tool needs a conversation context.");
+    const sourcePath = conversationPath(input.path, "source");
+    const cssPath = input.cssPath === undefined ? undefined : conversationPath(input.cssPath, "input");
+    const headerPath = input.headerPath === undefined ? undefined : conversationPath(input.headerPath, "input");
+    const footerPath = input.footerPath === undefined ? undefined : conversationPath(input.footerPath, "input");
+    const assetPaths = (input.assets ?? []).map((path) => conversationPath(path, "input"));
+    const config = await loadConfig();
+
+    // Check every file and the shared input budget before loading any bytes.
+    let total = new TextEncoder().encode(input.customCss ?? "").byteLength;
+    for (const path of [sourcePath, cssPath, headerPath, footerPath, ...assetPaths]) {
+      if (path === undefined) continue;
+      const file = await stat({ conversationId, path });
+      if (!file) throw new Error(`No such file: ${path}`);
+      if (path === sourcePath && file.origin !== "assistant") {
+        throw new Error(`Create an assistant-owned HTML file with write_file before converting ${sourcePath}.`);
+      }
+      total += file.size;
+      if (total > config.maxHtmlBytes) {
+        throw new Error(`The HTML, CSS, header, footer, and assets exceed the ${config.maxHtmlBytes}-byte PDF input budget.`);
+      }
+    }
+
+    const load = async (path: string): Promise<AiFileContent> => {
+      const file = await read({ conversationId, path });
+      if (!file) throw new Error(`No such file: ${path}`);
+      return file;
+    };
+    const text = async (path: string | undefined): Promise<string | undefined> => (path === undefined ? undefined : utf8(await load(path)));
+
+    const source = utf8(await load(sourcePath));
+    const css = [await text(cssPath), input.customCss].filter((value) => value?.trim()).join("\n");
+    if (/<\/style/i.test(css)) throw new Error("CSS cannot contain </style.");
+    const headerHtml = await text(headerPath);
+    const footerHtml = await text(footerPath);
+    const assets: RenderHtmlToPdfInput["assets"] = [];
+    for (const path of assetPaths) {
+      const file = await load(path);
+      assets.push({ name: basename(path), data: new Blob([new Uint8Array(file.bytes)], { type: file.mediaType }) });
+    }
+
+    let rendered: RenderHtmlToPdfResult;
+    try {
+      rendered = await withAiPdfConversionSlot(() =>
+        render(
+          {
+            // Like Code Mode, the document renders in standards mode. Separate CSS
+            // follows the document, so it wins over the document's own styles.
+            html: `<!doctype html>${source}${css ? `\n<style>\n${css}\n</style>\n` : ""}`,
+            headerHtml,
+            footerHtml,
+            assets,
+            page: { format: input.page?.format ?? "A4", landscape: input.page?.landscape ?? false, margin: input.page?.margin },
+            tagged: true,
+          },
+          config,
+          { signal: ctx.signal },
+        ),
+      );
+    } catch (error) {
+      throw ctx.signal.aborted ? cancelled(ctx.signal) : error;
+    }
+    if (ctx.signal.aborted) throw cancelled(ctx.signal);
+
+    const path = sourcePath.replace(HTML_EXTENSION, ".pdf");
+    await write({ conversationId, path, bytes: rendered.pdf, mediaType: "application/pdf", origin: "assistant" });
+    return { sourcePath, path, size: rendered.pdf.byteLength, mediaType: "application/pdf" as const };
+  });
+};

package/src/ai/markdown-pdf-tool.ts

@@ -4,10 +4,12 @@ import {
   MARKDOWN_PDF_MAX_MARKDOWN_BYTES,
   MARKDOWN_PDF_TEMPLATE_IDS,
   type RenderMarkdownToPdfInput,
+  type RenderMarkdownToPdfOptions,
   renderMarkdownToPdf,
 } from "../services/pdf";
 import { aiProjectFilePathFromMount } from "./file-mount";
 import { type AiFileContent, aiFileStore, normalizeAiFilePath } from "./files-store";
+import { withAiPdfConversionSlot } from "./pdf-conversions";
 import { defineAiTool } from "./tools";
 
 export const CloudAiMarkdownToPdfInputSchema = z
@@ -28,7 +30,7 @@ export const CloudAiMarkdownToPdfOutputSchema = z.object({
 type MarkdownPdfToolDependencies = {
   read?: (input: { conversationId: string; path: string }) => Promise<AiFileContent | null>;
   write?: (input: { conversationId: string; path: string; bytes: Uint8Array; mediaType: string; origin: "assistant" }) => Promise<void>;
-  render?: (input: RenderMarkdownToPdfInput) => Promise<{ pdf: Uint8Array; contentType: string }>;
+  render?: (input: RenderMarkdownToPdfInput, options: RenderMarkdownToPdfOptions) => Promise<{ pdf: Uint8Array; contentType: string }>;
 };
 
 const conversationPath = (value: string): string => {
@@ -52,13 +54,13 @@ export const createCloudAiMarkdownToPdfTool = (dependencies: MarkdownPdfToolDepe
   return defineAiTool({
     name: "markdown_to_pdf",
     description:
-      "Convert one assistant-created conversation Markdown file to a sibling PDF. Write or edit the .md source with write_file first. A named A4 template may be combined with custom CSS; custom CSS without a template is used as the complete stylesheet. The output path replaces .md with .pdf.",
+      "Convert one assistant-created conversation Markdown file to a sibling PDF. Use it for text-first documents; use html_to_pdf when the layout needs HTML, images, or fonts. Write or edit the .md source with write_file first. A named A4 template may be combined with custom CSS; custom CSS without a template is used as the complete stylesheet. Images become links and are not embedded. The output path replaces .md with .pdf.",
     inputSchema: CloudAiMarkdownToPdfInputSchema,
     outputSchema: CloudAiMarkdownToPdfOutputSchema,
     approval: "never",
     timeoutMs: 125_000,
     promptHint:
-      "write or edit an assistant-owned .md file with write_file before converting it with markdown_to_pdf; call present with the returned PDF path afterwards.",
+      "for text-first PDFs: write or edit an assistant-owned .md file with write_file, convert it with markdown_to_pdf, then call present with the returned PDF path.",
   }).server(async (input, ctx) => {
     if (!ctx.conversationId) throw new Error("The markdown_to_pdf tool needs a conversation context.");
     const sourcePath = conversationPath(input.path);
@@ -78,10 +80,16 @@ export const createCloudAiMarkdownToPdfTool = (dependencies: MarkdownPdfToolDepe
       throw new Error(`File ${sourcePath} is not valid UTF-8 Markdown.`);
     }
 
-    const rendered = await render({ markdown, templateId: input.template, customCss: input.customCss });
-    if (ctx.signal.aborted) {
-      throw ctx.signal.reason instanceof Error ? ctx.signal.reason : new Error("PDF conversion was cancelled.");
+    const cancelled = () => (ctx.signal.reason instanceof Error ? ctx.signal.reason : new Error("PDF conversion was cancelled."));
+    let rendered: { pdf: Uint8Array; contentType: string };
+    try {
+      rendered = await withAiPdfConversionSlot(() =>
+        render({ markdown, templateId: input.template, customCss: input.customCss }, { signal: ctx.signal }),
+      );
+    } catch (error) {
+      throw ctx.signal.aborted ? cancelled() : error;
     }
+    if (ctx.signal.aborted) throw cancelled();
     const path = pdfPath(sourcePath);
     await write({
       conversationId: ctx.conversationId,

package/src/ai/pdf-conversions.ts

@@ -0,0 +1,21 @@
+/**
+ * Chat PDF tools share Gotenberg with every other Cloud renderer. Like the
+ * Tools app's Markdown route, one process renders at most two chat PDFs at a
+ * time and rejects further conversions instead of queueing them until the
+ * render timeout.
+ */
+export const AI_PDF_MAX_ACTIVE_CONVERSIONS = 2;
+
+let activeConversions = 0;
+
+export const withAiPdfConversionSlot = async <T>(render: () => Promise<T>): Promise<T> => {
+  if (activeConversions >= AI_PDF_MAX_ACTIVE_CONVERSIONS) {
+    throw new Error("The PDF renderer is busy with other conversions. Try again after they finish.");
+  }
+  activeConversions += 1;
+  try {
+    return await render();
+  } finally {
+    activeConversions -= 1;
+  }
+};

package/src/ai/routes.ts

@@ -200,6 +200,7 @@ const MemoryUpdateSchema = MemoryCreateSchema.partial().refine((value) => Object
 const MemoryIdSchema = z.string().regex(AI_SHORT_ID_PATTERN);
 
 const notFound = (c: Context<AuthContext>) => respond(c, fail(err.notFound("Conversation")));
+const fileNotFound = (c: Context<AuthContext>) => respond(c, fail(err.notFound("File")));
 
 const publicConversation = (conversation: AiConversation, projectId: string | null = null) => ({
   ...conversation,
@@ -1294,9 +1295,9 @@ export const aiRoutes = (() => {
         const conversation = await loadConversation(c, ctx);
         if (!conversation) return notFound(c);
         const path = normalizeAiFilePath(c.req.valid("query").path);
-        if (!path) return notFound(c);
+        if (!path) return fileNotFound(c);
         const stored = await aiFileStore.read({ conversationId: conversation.id, path });
-        if (!stored) return notFound(c);
+        if (!stored) return fileNotFound(c);
         const filename = path.slice(path.lastIndexOf("/") + 1).replaceAll('"', "");
         return c.body(stored.bytes as unknown as ArrayBuffer, 200, {
           "Content-Type": stored.mediaType || "application/octet-stream",
@@ -1311,9 +1312,9 @@ export const aiRoutes = (() => {
         const conversation = await loadConversation(c, ctx);
         if (!conversation) return notFound(c);
         const path = normalizeAiFilePath(c.req.valid("query").path);
-        if (!path) return notFound(c);
+        if (!path) return fileNotFound(c);
         const removed = await aiFileStore.remove({ conversationId: conversation.id, path, recursive: false });
-        if (removed === 0) return notFound(c);
+        if (removed === 0) return fileNotFound(c);
         return respond(c, ok({ deleted: true }));
       })
       .put("/conversations/:conversationId/files/content", v("json", FileWriteSchema), async (c) => {

package/src/ai/runtime-tools.ts

@@ -33,6 +33,7 @@ export {
   evaluateAiDate,
   evaluateAiMath,
 } from "./file-tools";
+export { CloudAiHtmlToPdfInputSchema, CloudAiHtmlToPdfOutputSchema, createCloudAiHtmlToPdfTool } from "./html-pdf-tool";
 export {
   CloudAiMarkdownToPdfInputSchema,
   CloudAiMarkdownToPdfOutputSchema,

package/src/api/auth.ts

@@ -189,24 +189,19 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Request magic link login",
         description:
-          "Request a magic link token for local account sign-in. The `email` field accepts the email address or the username of the account; the link is always sent to the account's email address.",
+          "Request a magic link token for local account sign-in. The `email` field accepts the email address or the username of the account; the link is always sent to the account's email address. The response is the same, and returns equally fast, for existing, unknown and mail-less accounts.",
         responses: {
           200: jsonResponse(MessageResponseSchema, "Request accepted"),
-          400: jsonResponse(ErrorResponseSchema, "Email sign-in not available"),
         },
       }),
       v("json", EmailLoginSchema),
       async (c) => {
         const { email, redirectTo, category } = c.req.valid("json");
 
-        const requestResult = await authFlows.magicLink.request({ email, redirectTo, category, locale: getLocale(c) }, notificationSender);
-        if (!requestResult.ok) {
-          return c.json({ message: requestResult.message }, requestResult.status);
-        }
-
+        authFlows.magicLink.request({ email, redirectTo, category, locale: getLocale(c) }, notificationSender);
         log.info("Magic link requested", { identifier: email });
         return c.json({
-          message: "If this email can sign in with a login code, a code has been sent.",
+          message: "If this account can sign in by email, a sign-in code has been sent. If no message arrives, contact an administrator.",
         });
       },
     )
@@ -251,7 +246,7 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Request password reset",
         description:
-          "Request a one-time password reset email for an IPA-backed account. The response is always generic to avoid account enumeration.",
+          "Request a one-time password reset email for an IPA-backed account. The response is the same, and returns equally fast, for every address to avoid account enumeration.",
         responses: {
           200: jsonResponse(MessageResponseSchema, "Request accepted"),
         },
@@ -260,7 +255,7 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
       async (c) => {
         const { email, redirectTo } = c.req.valid("json");
 
-        const result = await authFlows.passwordReset.request({ email, redirectTo, locale: getLocale(c) }, notificationSender);
+        const result = authFlows.passwordReset.request({ email, redirectTo, locale: getLocale(c) }, notificationSender);
         return c.json({ message: result.message });
       },
     )

package/src/browser/app-approval.ts

@@ -215,6 +215,12 @@ const connect = async (options: {
         throw new AppApprovalClientError("INVALID_RESPONSE");
       return result;
     },
+    /** Reads the account this device signs in and the device's own record. Older Clouds answer HTTP 400. */
+    account: async (device: AppApprovalDevice, signal?: AbortSignal) => {
+      const result = await command(device, { operation: "account" }, signal);
+      if (!("account" in result)) throw new AppApprovalClientError("INVALID_RESPONSE");
+      return result;
+    },
     /** Hands this device's push token to the Cloud. Older Clouds answer HTTP 400. */
     push: async (device: AppApprovalDevice, token: string, signal?: AbortSignal) => {
       const result = await command(device, { operation: "push", token }, signal);