@proveanything/smartlinks 2.0.65 → 2.0.67

package/dist/ai-tools.js

@@ -62,7 +62,7 @@ export const BUILTIN_AI_TOOLS = [
     { name: 'image.transform', group: 'media', capabilities: ['media:image'],
         description: 'Transform an image: resize/crop/rotate/flip/grayscale/tint/format-convert/compress → hosted URL.' },
     { name: 'pdf.create', group: 'media', capabilities: ['media:pdf'],
-        description: 'Render HTML to a PDF and return a hosted URL.' },
+        description: 'Render HTML (or one fragment per page) to a PDF, 1:1: exact page sizes (width/height/unit) for labels, many pages per call, text and SVG kept vector, no scripts. Returns a public URL, an expiring private link, or base64; identical inputs reuse the cached render.' },
     { name: 'pdf.fill', group: 'media', capabilities: ['media:pdf'],
         description: 'Fill an AcroForm PDF\'s fields from a { field: value } map → hosted URL.' },
     { name: 'pdf.merge', group: 'media', capabilities: ['media:pdf'],

package/dist/api/appConfiguration.d.ts

@@ -483,4 +483,27 @@ export declare namespace appConfiguration {
      * ```
      */
     function isFeatureEnabledSync(collectionId: string, flag: string): boolean | undefined;
+    /**
+     * Has the collection SWITCHED ON this part of the platform (`appConfig.enabled[key]`)? A missing
+     * key is on — only an explicit `false` is off. This is "does this business use it", not "does the
+     * plan allow it": for something a plan gates, check `resolveFeature()` as well. docs/appConfig.md §8a.
+     */
+    function resolveEnabled(cfg: {
+        enabled?: Record<string, boolean>;
+    } | null | undefined, key: string): boolean;
+    /**
+     * Has the collection switched on `key` (`products`, `crm`, `analytics`, `hub`, `portal`,
+     * `printStudio`, or an app's own key)? Hide what's off: a website-only business switches off
+     * products and the CRM, so menus, cards and setup steps for them shouldn't appear.
+     *
+     * @example
+     * ```typescript
+     * if (await appConfiguration.isEnabled(collectionId, 'products')) showProductsMenu();
+     * ```
+     */
+    function isEnabled(collectionId: string, key: string, options?: {
+        force?: boolean;
+    }): Promise<boolean>;
+    /** Cache-only `isEnabled` — `undefined` until `getAppConfig()` has been read this page load. */
+    function isEnabledSync(collectionId: string, key: string): boolean | undefined;
 }

package/dist/api/appConfiguration.js

@@ -620,4 +620,36 @@ export var appConfiguration;
         return resolveFeature(cfg.system, flag);
     }
     appConfiguration.isFeatureEnabledSync = isFeatureEnabledSync;
+    /**
+     * Has the collection SWITCHED ON this part of the platform (`appConfig.enabled[key]`)? A missing
+     * key is on — only an explicit `false` is off. This is "does this business use it", not "does the
+     * plan allow it": for something a plan gates, check `resolveFeature()` as well. docs/appConfig.md §8a.
+     */
+    function resolveEnabled(cfg, key) {
+        var _a;
+        return ((_a = cfg === null || cfg === void 0 ? void 0 : cfg.enabled) === null || _a === void 0 ? void 0 : _a[key]) !== false;
+    }
+    appConfiguration.resolveEnabled = resolveEnabled;
+    /**
+     * Has the collection switched on `key` (`products`, `crm`, `analytics`, `hub`, `portal`,
+     * `printStudio`, or an app's own key)? Hide what's off: a website-only business switches off
+     * products and the CRM, so menus, cards and setup steps for them shouldn't appear.
+     *
+     * @example
+     * ```typescript
+     * if (await appConfiguration.isEnabled(collectionId, 'products')) showProductsMenu();
+     * ```
+     */
+    async function isEnabled(collectionId, key, options) {
+        return resolveEnabled(await getAppConfig(collectionId, options), key);
+    }
+    appConfiguration.isEnabled = isEnabled;
+    /** Cache-only `isEnabled` — `undefined` until `getAppConfig()` has been read this page load. */
+    function isEnabledSync(collectionId, key) {
+        const cfg = cache.peek(appConfigCacheKey(collectionId));
+        if (!cfg)
+            return undefined;
+        return resolveEnabled(cfg, key);
+    }
+    appConfiguration.isEnabledSync = isEnabledSync;
 })(appConfiguration || (appConfiguration = {}));

package/dist/api/tags.d.ts

@@ -6,9 +6,9 @@ import type { TagIndexEntry, CreateTagRequest, CreateTagResponse, BatchCreateTag
  * etc.) and products, proofs, or any polymorphic object in the platform.
  *
  * ### Two-tier architecture
- * - **Per-org shard** (`tags` table) — full tag data; used for all collection-scoped
+ * - **Per-org shard** (`tags` table) — full tag data; used for all collection-scoped
  *   queries.
- * - **Shared shard** (`tag_index` table) — `tagId → collectionId` routing only; used
+ * - **Shared shard** (`tag_index` table) — `tagId → collectionId` routing only; used
  *   when the collection is not yet known.
  *
  * 99% of callers will know the collection and should use collection-scoped endpoints
@@ -49,7 +49,7 @@ export declare namespace tags {
      *
      * Tags with `productId` but no `proofId` automatically get serial numbers.
      * Serial number generation is grouped by `(productId, variantId, batchId)` for
-     * efficiency.  Partial success is possible — check `results` for individual outcomes.
+     * efficiency.  Partial success is possible — check `results` for individual outcomes.
      *
      * @param collectionId - Collection context
      * @param data - Batch payload; `force` applies to all tags in the batch
@@ -78,7 +78,7 @@ export declare namespace tags {
     /**
      * Update a tag (admin).
      *
-     * Partial update — only provided fields are changed.  `metadata` is
+     * Partial update — only provided fields are changed.  `metadata` is
      * deep-merged with the existing value.  Pass `refType: null, refId: null`
      * to clear the polymorphic ref.
      *
@@ -130,7 +130,7 @@ export declare namespace tags {
      */
     function list(collectionId: string, params?: ListTagsRequest): Promise<ListTagsResponse>;
     /**
-     * Reverse lookup — find all tags linked to a given object (admin).
+     * Reverse lookup — find all tags linked to a given object (admin).
      *
      * Uses a compound index on `(orgId, refType, refId)` on the per-org shard.
      * No embed support on the admin side.
@@ -149,7 +149,7 @@ export declare namespace tags {
      */
     function byRef(collectionId: string, params: ReverseTagLookupParams): Promise<ReverseTagLookupResponse>;
     /**
-     * Global tag resolve — returns `{ tagId, collectionId }` only.
+     * Global tag resolve — returns `{ tagId, collectionId }` only.
      *
      * Use this **only** when you have a raw `tagId` and do not yet know which
      * collection it belongs to.  Queries the shared `tag_index` shard.
@@ -159,7 +159,7 @@ export declare namespace tags {
      * > Use the collection-scoped `publicByRef` instead.
      *
      * @param tagId - Physical tag identifier
-     * @returns `{ tagId, collectionId }` — routing info only, no full tag data
+     * @returns `{ tagId, collectionId }` — routing info only, no full tag data
      *
      * @example
      * ```typescript
@@ -179,7 +179,7 @@ export declare namespace tags {
      * `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref`
      *
      * Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'`
-     * (`'collection'` is not supported — the collection is already known from the URL).
+     * (`'collection'` is not supported — the collection is already known from the URL).
      *
      * @param collectionId - Collection context
      * @param tagId - Physical tag identifier

package/dist/api/tags.js

@@ -7,9 +7,9 @@ import { request, post, put, del } from "../http.js";
  * etc.) and products, proofs, or any polymorphic object in the platform.
  *
  * ### Two-tier architecture
- * - **Per-org shard** (`tags` table) — full tag data; used for all collection-scoped
+ * - **Per-org shard** (`tags` table) — full tag data; used for all collection-scoped
  *   queries.
- * - **Shared shard** (`tag_index` table) — `tagId → collectionId` routing only; used
+ * - **Shared shard** (`tag_index` table) — `tagId → collectionId` routing only; used
  *   when the collection is not yet known.
  *
  * 99% of callers will know the collection and should use collection-scoped endpoints
@@ -58,7 +58,7 @@ export var tags;
      *
      * Tags with `productId` but no `proofId` automatically get serial numbers.
      * Serial number generation is grouped by `(productId, variantId, batchId)` for
-     * efficiency.  Partial success is possible — check `results` for individual outcomes.
+     * efficiency.  Partial success is possible — check `results` for individual outcomes.
      *
      * @param collectionId - Collection context
      * @param data - Batch payload; `force` applies to all tags in the batch
@@ -95,7 +95,7 @@ export var tags;
     /**
      * Update a tag (admin).
      *
-     * Partial update — only provided fields are changed.  `metadata` is
+     * Partial update — only provided fields are changed.  `metadata` is
      * deep-merged with the existing value.  Pass `refType: null, refId: null`
      * to clear the polymorphic ref.
      *
@@ -175,7 +175,7 @@ export var tags;
     }
     tags.list = list;
     /**
-     * Reverse lookup — find all tags linked to a given object (admin).
+     * Reverse lookup — find all tags linked to a given object (admin).
      *
      * Uses a compound index on `(orgId, refType, refId)` on the per-org shard.
      * No embed support on the admin side.
@@ -201,10 +201,10 @@ export var tags;
     }
     tags.byRef = byRef;
     // ============================================================================
-    // Public Endpoints — global resolve (collection unknown)
+    // Public Endpoints — global resolve (collection unknown)
     // ============================================================================
     /**
-     * Global tag resolve — returns `{ tagId, collectionId }` only.
+     * Global tag resolve — returns `{ tagId, collectionId }` only.
      *
      * Use this **only** when you have a raw `tagId` and do not yet know which
      * collection it belongs to.  Queries the shared `tag_index` shard.
@@ -214,7 +214,7 @@ export var tags;
      * > Use the collection-scoped `publicByRef` instead.
      *
      * @param tagId - Physical tag identifier
-     * @returns `{ tagId, collectionId }` — routing info only, no full tag data
+     * @returns `{ tagId, collectionId }` — routing info only, no full tag data
      *
      * @example
      * ```typescript
@@ -233,7 +233,7 @@ export var tags;
     }
     tags.resolveTag = resolveTag;
     // ============================================================================
-    // Public Endpoints — collection-scoped
+    // Public Endpoints — collection-scoped
     // ============================================================================
     /**
      * Single tag lookup with optional embedded data (public).
@@ -241,7 +241,7 @@ export var tags;
      * `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref`
      *
      * Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'`
-     * (`'collection'` is not supported — the collection is already known from the URL).
+     * (`'collection'` is not supported — the collection is already known from the URL).
      *
      * @param collectionId - Collection context
      * @param tagId - Physical tag identifier

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.65  |  Generated: 2026-10-14T11:51:48.823Z
+Version: 2.0.67  |  Generated: 2026-10-15T17:52:10.614Z
 
 This is a concise summary of all available API functions and types.
 
@@ -1600,10 +1600,35 @@ interface PdfClip {
 **PdfCreateArgs** (interface)
 ```typescript
 interface PdfCreateArgs {
-  html: string
+  html?: string
+  pages?: string[]
+  head?: string
+  width?: number
+  height?: number
+  unit?: 'mm' | 'cm' | 'in' | 'pt' | 'px'
   format?: string
   landscape?: boolean
   margin?: string
+  return?: 'url' | 'signedUrl' | 'base64'
+  expiresIn?: number
+  filename?: string
+  cache?: boolean
+}
+```
+
+**PdfCreateResult** (interface)
+```typescript
+interface PdfCreateResult {
+  url?: string
+  hostedUrl?: string
+  base64?: string
+  expiresAt?: string
+  contentType: 'application/pdf'
+  size: number
+  pageCount: number
+  cached: boolean
+  renderer?: string
+  warnings?: string[]
 }
 ```
 
@@ -2479,6 +2504,7 @@ interface AppConfigSettings {
   addOns?: string[]
   requestedBasePlanId?: string
   itemRecordMode?: 'registered' | 'owned' | null
+  enabled?: Record<string, boolean>
   system?: SystemBlock
 }
 ```
@@ -2785,6 +2811,7 @@ interface ServerFunctionSl {
   forCaller(): Promise<{ contactId: string } | null>;
   };
   interactions: { record(event: ServerFunctionInteractionEvent): Promise<{ eventId: string }> };
+  tools: { run<T = any>(name: string, args?: Record<string, any>): Promise<T> };
   products: any;
   attestations: any;
   appData: AppDataHandle & { global: AppDataHandle; collection: AppDataHandle };
@@ -10886,6 +10913,15 @@ Check whether a feature flag is enabled for a collection, per `appConfig.system.
 **isFeatureEnabledSync**(collectionId: string, flag: string) → `boolean | undefined`
 Synchronous, cache-only check for a feature flag. Returns `undefined` if `getAppConfig()` / `isFeatureEnabled()` hasn't been called yet for this collection this page load (i.e. nothing to read without an await) — treat `undefined` as "not yet known", not as "disabled". ```typescript // Warm the cache once, e.g. in a top-level effect: useEffect(() => { appConfiguration.isFeatureEnabled(collectionId, 'custom_domain') }, [collectionId]); // Elsewhere, read synchronously without an await: const enabled = appConfiguration.isFeatureEnabledSync(collectionId, 'custom_domain'); if (enabled === undefined) { // not warmed yet — fall back to a loading state or the async version } ```
 
+**resolveEnabled**(cfg: { enabled?: Record<string, boolean> } | null | undefined, key: string) → `boolean`
+Has the collection SWITCHED ON this part of the platform (`appConfig.enabled[key]`)? A missing key is on — only an explicit `false` is off. This is "does this business use it", not "does the plan allow it": for something a plan gates, check `resolveFeature()` as well. docs/appConfig.md §8a.
+
+**isEnabled**(collectionId: string, key: string, options?: { force?: boolean }) → `Promise<boolean>`
+Has the collection switched on `key` (`products`, `crm`, `analytics`, `hub`, `portal`, `printStudio`, or an app's own key)? Hide what's off: a website-only business switches off products and the CRM, so menus, cards and setup steps for them shouldn't appear. ```typescript if (await appConfiguration.isEnabled(collectionId, 'products')) showProductsMenu(); ```
+
+**isEnabledSync**(collectionId: string, key: string) → `boolean | undefined`
+Cache-only `isEnabled` — `undefined` until `getAppConfig()` has been read this page load.
+
 ### asset
 
 **upload**(options: UploadAssetOptions) → `Promise<Asset>`
@@ -12805,7 +12841,7 @@ Create a single tag mapping (admin). If `productId` is set without `proofId`, a
 
 **createBatch**(collectionId: string,
     data: BatchCreateTagRequest) → `Promise<BatchCreateResult>`
-Batch-create tags (admin). Tags with `productId` but no `proofId` automatically get serial numbers. Serial number generation is grouped by `(productId, variantId, batchId)` for efficiency.  Partial success is possible — check `results` for individual outcomes. ```typescript const result = await tags.createBatch('coll_123', { tags: [ { tagId: 'NFC-001', productId: 'prod_456', batchId: 'batch_2026_01' }, { tagId: 'NFC-002', productId: 'prod_456', batchId: 'batch_2026_01' }, ], }) console.log(`Created: ${result.summary.created}, Conflicts: ${result.summary.conflicts}`) ```
+Batch-create tags (admin). Tags with `productId` but no `proofId` automatically get serial numbers. Serial number generation is grouped by `(productId, variantId, batchId)` for efficiency.  Partial success is possible — check `results` for individual outcomes. ```typescript const result = await tags.createBatch('coll_123', { tags: [ { tagId: 'NFC-001', productId: 'prod_456', batchId: 'batch_2026_01' }, { tagId: 'NFC-002', productId: 'prod_456', batchId: 'batch_2026_01' }, ], }) console.log(`Created: ${result.summary.created}, Conflicts: ${result.summary.conflicts}`) ```
 
 **get**(collectionId: string,
     tagId: string) → `Promise<GetTagResponse>`
@@ -12814,7 +12850,7 @@ Get a single tag by `tagId` (admin).
 **update**(collectionId: string,
     tagId: string,
     data: UpdateTagRequest) → `Promise<UpdateTagResponse>`
-Update a tag (admin). Partial update — only provided fields are changed.  `metadata` is deep-merged with the existing value.  Pass `refType: null, refId: null` to clear the polymorphic ref. ```typescript const updated = await tags.update('coll_123', 'NFC-001', { variantId: 'var_premium', metadata:  { notes: 'Updated to premium variant' }, }) // Clear polymorphic ref await tags.update('coll_123', 'NFC-001', { refType: null, refId: null }) ```
+Update a tag (admin). Partial update — only provided fields are changed.  `metadata` is deep-merged with the existing value.  Pass `refType: null, refId: null` to clear the polymorphic ref. ```typescript const updated = await tags.update('coll_123', 'NFC-001', { variantId: 'var_premium', metadata:  { notes: 'Updated to premium variant' }, }) // Clear polymorphic ref await tags.update('coll_123', 'NFC-001', { refType: null, refId: null }) ```
 
 **remove**(collectionId: string,
     tagId: string) → `Promise<DeleteTagResponse>`
@@ -12826,15 +12862,15 @@ List tags with optional filters and pagination (admin). ```typescript // All tag
 
 **byRef**(collectionId: string,
     params: ReverseTagLookupParams) → `Promise<ReverseTagLookupResponse>`
-Reverse lookup — find all tags linked to a given object (admin). Uses a compound index on `(orgId, refType, refId)` on the per-org shard. No embed support on the admin side. ```typescript const { tags: linked } = await tags.byRef('coll_123', { refType: 'container', refId:   'container-uuid', }) ```
+Reverse lookup — find all tags linked to a given object (admin). Uses a compound index on `(orgId, refType, refId)` on the per-org shard. No embed support on the admin side. ```typescript const { tags: linked } = await tags.byRef('coll_123', { refType: 'container', refId:   'container-uuid', }) ```
 
 **resolveTag**(tagId: string) → `Promise<TagIndexEntry>`
-Global tag resolve — returns `{ tagId, collectionId }` only. Use this **only** when you have a raw `tagId` and do not yet know which collection it belongs to.  Queries the shared `tag_index` shard. Once `collectionId` is resolved, call `publicGetByCollection` for full data. > The global `/public/tags/by-ref` endpoint has been removed. > Use the collection-scoped `publicByRef` instead. ```typescript // Step 1: resolve collection const { collectionId } = await tags.resolveTag('NFC-001') // Step 2: full lookup with embedded data const { tag, embedded } = await tags.publicGetByCollection( collectionId, 'NFC-001', 'product,proof' ) ```
+Global tag resolve — returns `{ tagId, collectionId }` only. Use this **only** when you have a raw `tagId` and do not yet know which collection it belongs to.  Queries the shared `tag_index` shard. Once `collectionId` is resolved, call `publicGetByCollection` for full data. > The global `/public/tags/by-ref` endpoint has been removed. > Use the collection-scoped `publicByRef` instead. ```typescript // Step 1: resolve collection const { collectionId } = await tags.resolveTag('NFC-001') // Step 2: full lookup with embedded data const { tag, embedded } = await tags.publicGetByCollection( collectionId, 'NFC-001', 'product,proof' ) ```
 
 **publicGetByCollection**(collectionId: string,
     tagId: string,
     embed?: string) → `Promise<PublicGetTagResponse>`
-Single tag lookup with optional embedded data (public). `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref` Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'` (`'collection'` is not supported — the collection is already known from the URL). ```typescript const { tag, embedded } = await tags.publicGetByCollection( 'coll_123', 'NFC-001', 'product,proof' ) const product = embedded.products?.[tag.productId!] const proof   = embedded.proofs?.[tag.proofId!] ```
+Single tag lookup with optional embedded data (public). `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref` Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'` (`'collection'` is not supported — the collection is already known from the URL). ```typescript const { tag, embedded } = await tags.publicGetByCollection( 'coll_123', 'NFC-001', 'product,proof' ) const product = embedded.products?.[tag.productId!] const proof   = embedded.proofs?.[tag.proofId!] ```
 
 **lookupTags**(collectionId: string,
     data: LookupTagsRequest) → `Promise<TagLookupResponse>`

package/dist/docs/agent-tools.md

@@ -29,7 +29,7 @@ needs to call it — a description and an input schema:
 ```jsonc
 {
   "functions": {
-    "files": { "js": { "umd": "dist/functions.umd.js" } },
+    "files": { "js": { "umd": "functions.umd.js" } },
     "definitions": [
       {
         "name": "createFaq",

package/dist/docs/ai.md

@@ -323,7 +323,7 @@ in `input`.
 | `image.fromReference` | Image-to-image: generate guided by reference image(s). |
 | `image.searchStock` | Search real stock photos (Unsplash). |
 | `image.transform` | Resize / crop / rotate / grayscale / format-convert / compress → hosted URL. |
-| `pdf.create` | Render HTML → PDF → hosted URL. |
+| `pdf.create` | Render HTML (or one fragment per page) → PDF, 1:1: exact `width`/`height`/`unit` for labels, `pages[]` for many pages in one render, no scripts, only SmartLinks/Google Fonts/data: resources. `return`: `url` (public), `signedUrl` (expiring), `base64`. Cached by input. |
 | `pdf.fill` | Fill an AcroForm PDF's fields (`{ field: value }`) → hosted URL. |
 | `pdf.merge` | Merge several PDFs into one, in order → hosted URL. |
 | `pdf.inspect` | Cheap, no-AI introspection: page count/sizes, which pages have a real text layer, raster present, and a routing hint (`text` vs `vision`). |
@@ -402,9 +402,11 @@ if (!ready.result.report.compliant) showFindings(ready.result.report.findings)
 - **A review UI that flags guessed fields** → `pdf.extract` with `includeConfidence` (per-field
   confidence + source) and `includeBoxes` (per-field bbox on text-native pages) in `fieldsMeta`.
 - **Produce a PDF** → `pdf.create` (HTML → PDF), `pdf.fill` (populate an AcroForm's fields),
-  `pdf.merge` (combine several). These return a hosted `hostedUrl` (`pdf.create` also returns it as
-  `url`). `pdf.create` loads remote `<img>` URLs before rendering and honours `page-break-inside`; pass
-  `margin: "0"` when your HTML sets its own body margin (default page margin is 18mm/14mm).
+  `pdf.merge` (combine several). `pdf.create` takes an exact page size (`width`, `height`, `unit`) or a
+  `format`, `html` or `pages: [html, …]` (one per page, sharing `head`), and returns `url` (public),
+  a `signedUrl` that expires, or `base64` (`return`). JavaScript doesn't run, and images, fonts and
+  stylesheets load only from SmartLinks hosts, Google Fonts or `data:` URIs. From a server function:
+  `ctx.sl.tools.run('pdf.create', …)` with the `tools:pdf.create` capability (server-functions.md).
 
 Every tool is also directly callable without the model loop via `ai.tools.run(collectionId, name,
 args)` — e.g. render a page or extract fields straight from a UI, no agent round-trip:

package/dist/docs/app-manifest.md

@@ -428,7 +428,7 @@ this is just the manifest shape.
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `files.js.umd` | string | UMD bundle path (e.g. `dist/functions.umd.js`) — a self-contained bundle exporting each handler by name |
+| `files.js.umd` | string | UMD bundle path, relative to the published build like the other bundles (e.g. `functions.umd.js`, built to `dist/functions.umd.js`) — a self-contained bundle exporting each handler by name |
 | `definitions[]` | object[] | One entry per function |
 | `definitions[].name` | string | Function name; also the handler export name (override with `handler`) |
 | `definitions[].trigger` | object | `{ type: "http"|"event"|"cron", … }` |

package/dist/docs/appConfig.md

@@ -36,6 +36,8 @@ export interface AppConfigSettings {
 
   /** How the account handles individual physical items. */
   itemRecordMode?: 'registered' | 'owned' | null;
+  /** What the collection has switched on (absent key = on) — see §8a. */
+  enabled?: Record<string, boolean>;
 
   // ── SYSTEM-OWNED, PUBLIC (reconcile writes; client read-only) ─────
   /** Resolved entitlement truth. Read this to gate features. */
@@ -501,6 +503,41 @@ the customer add-ons page (`src/components/pricing/ItemHandlingSection`)
 because these settings change the whole UX shape (claim, ownership,
 CRM visibility), not just a capability flag.
 
+## 8a. What's switched on (`enabled`)
+
+A root-level, user-owned map (like `itemRecordMode`; reconcile never touches it) saying which parts of
+the platform this collection **uses** — separate from what its plan **allows** (`system.features`):
+
+| | Plan allows (`system.features`) | Switched on (`enabled`) |
+|---|---|---|
+| Written by | billing (`entitlements-reconcile`) | the collection: sign-up wizards, admins |
+| Means | "you may have this" | "this business uses this" |
+| Missing key | standard: off · enterprise: on | **on** |
+
+```json
+{ "enabled": { "products": false, "crm": false, "hub": false, "portal": false, "printStudio": false } }
+```
+
+**A missing key is on**, so a collection that never set `enabled` behaves exactly as before. Only an
+explicit `false` switches something off. A website-only sign-up switches off what it doesn't use
+(products, CRM, Hub, Portal…), and Studio hides the menus, dashboard cards and setup steps for them;
+an admin can switch them back on.
+
+Known keys: `products`, `crm`, `analytics`, `hub`, `portal`, `printStudio`. The map is open — an app
+may define its own key.
+
+```ts
+if (await SL.appConfiguration.isEnabled(collectionId, 'products')) showProducts()
+// already have the config:
+SL.appConfiguration.resolveEnabled(cfg, 'crm')
+```
+
+For something a plan gates, show it only when both hold: `resolveEnabled(cfg, key)` **and**
+`resolveFeature(cfg.system, flag)`.
+
+Write it through the admin settings route (`collection.updateSettings(collectionId, 'appConfig',
+{ enabled: { products: true } })`) — keys merge, so set only the ones you change.
+
 ## 9. Migration notes
 
 - Legacy `entitlements` settings group is deprecated. Everything moved

package/dist/docs/connectors.md

@@ -66,7 +66,7 @@ deterministically. A connector's `shape` and `serialize` must be deterministic t
   "aiGuide": "connector-ai-guide.md"
 },
 "functions": {
-  "files": { "js": { "umd": "dist/functions.umd.js" } },
+  "files": { "js": { "umd": "functions.umd.js" } },
   "definitions": [
     { "name": "testConnection", "trigger": { "type": "http", "method": "POST" },
       "visibility": "admin", "authority": "collection",

package/dist/docs/server-functions.md

@@ -33,7 +33,7 @@ in a bundle alongside your widgets/containers:
 ```jsonc
 {
   "functions": {
-    "files": { "js": { "umd": "dist/functions.umd.js" } },
+    "files": { "js": { "umd": "functions.umd.js" } },
     "definitions": [
       {
         "name": "submitCompetitionEntry",
@@ -98,9 +98,12 @@ export default defineConfig({
 }
 ```
 
-That emits `dist/functions.umd.js` (matching `functions.files.js.umd`), whose named exports the
-platform pairs with your manifest `definitions`. Then **deploy** it — for dev,
-`smartlinks-publish` uploads `dist/` and registers in one step (see
+That emits `dist/functions.umd.js`, whose named exports the platform pairs with your manifest
+`definitions`. In the manifest, `functions.files.js.umd` is **`functions.umd.js`** — relative to the
+published build (the contents of `dist/`), like the widget and container files; not
+`dist/functions.umd.js`. Publishing refuses a release whose functions bundle isn't there.
+
+Then **deploy** it — for dev, `smartlinks-publish` uploads `dist/` and registers in one step (see
 [Deploying & registering](deploying-apps.md)).
 
 ---
@@ -169,6 +172,7 @@ Declare the minimum you need.
 | `network:<host>` | `ctx.fetch` to that host only (repeat for several). Prefer this over blanket `network`. |
 | `network:*.<domain>` | `ctx.fetch` to any subdomain of `<domain>` (not `<domain>` itself), for a customer's own endpoint at a provider, e.g. `network:*.servicebus.windows.net`. `<domain>` needs at least two labels (`*.com` is not honoured). |
 | `secrets:<name>` | `ctx.secrets.get('<name>')` for that one secret (see [Secrets](#secrets--api-keys-per-collection)). |
+| `tools:<name>` / `tools:<family>.*` | `ctx.sl.tools.run('<name>', args)` for a platform tool, e.g. `tools:pdf.create`, or `tools:pdf.*` for every PDF tool (see [Platform tools](#platform-tools--pdfs-labels-barcodes)). |
 
 If you don't declare `network`, `ctx.fetch` is absent. Reading a secret you didn't declare with
 `secrets:<name>` throws.
@@ -606,6 +610,58 @@ await ctx.sl.interactions.record({
 
 ---
 
+## Platform tools — PDFs, labels, barcodes
+
+`ctx.sl.tools.run(name, args)` runs one of the platform's deterministic tools from your function: no
+model, no agent loop. Declare each tool as a capability: `tools:pdf.create`, or `tools:pdf.*` for the
+whole family. Open to functions: `pdf.create`, `pdf.merge`, `pdf.fill`, `pdf.inspect`, `pdf.render`,
+`pdf.decodeBarcodes`, `pdf.inspectGraphics`, `pdf.preflight`, `pdf.printReady`, `pdf.edit`,
+`image.transform` (arguments as in [ai.md](ai.md)).
+
+- **Identity:** the call runs as the function's collection, whatever the caller. An anonymous caller
+  holding only your own key gets the same result; the work is attributed and billed to the collection.
+- **Rate:** per collection (10 calls a second by default); bursts wait rather than fail.
+- **Failure:** throws an `Error` with `code` (`bad_args`, `too_large`, `too_many_pages`,
+  `resource_timeout`, `timeout`, `busy`, `TOOL_NOT_AVAILABLE`, or a capability denial).
+
+**Labels with `pdf.create`.** Exact page sizes, many pages in one render, and bytes straight back:
+
+```ts
+// capabilities: ["tools:pdf.create", "tools:pdf.decodeBarcodes"]
+export async function printLabel(ctx, event) {
+  const { gtin, lot, expiry, qty = 1 } = event.body
+  const barcode = bwipjs.toSVG({ bcid: 'gs1-128', text: `(01)${gtin}(10)${lot}(17)${expiry}` }) // inline SVG
+  const pdf = await ctx.sl.tools.run('pdf.create', {
+    width: 100, height: 50, unit: 'mm',                      // exact; output is 1:1
+    head: '<style>.l{position:absolute;font:3mm Arial}</style>',
+    pages: Array.from({ length: qty }, () => `<div class="l" style="left:4mm;top:3mm">Lot ${lot}</div>
+      <div style="position:absolute;left:4mm;top:10mm;width:92mm">${barcode}</div>`),
+    return: 'base64',                                        // or 'signedUrl' + expiresIn
+  })
+  return { pdf: pdf.base64, pages: pdf.pageCount }
+}
+```
+
+- **Page size:** `width` + `height` (+ `unit`: mm, cm, in, pt, px) is exact to the point. Otherwise
+  `format` ("A4", "Letter"), or the document's own CSS `@page { size }` when neither is given.
+- **Pages:** `pages: [html, …]` lays one fragment per page; with an exact size and no margin each page
+  box is that size (overflow hidden), so a long value can't push onto the next label. Up to 2000 pages
+  and 10 MB of HTML per render.
+- **Output:** 1:1 at scale 1 with backgrounds; text stays text and SVG stays vector (render barcodes as
+  inline SVG, e.g. bwip-js `toSVG`, never as a canvas bitmap). Colour is RGB; for CMYK pass the result
+  through `pdf.printReady`.
+- **What loads:** JavaScript does not run. Images, fonts and stylesheets load only from SmartLinks hosts
+  (our CDN), Google Fonts or inline `data:` URIs; anything else is skipped and listed in `warnings`.
+  Embed brand fonts as `data:` URIs in `@font-face`, or host them on the SmartLinks CDN.
+- **Delivery:** `return: 'base64'` (nothing stored), `'signedUrl'` (private link that expires after
+  `expiresIn` seconds, default 900, max 7 days — use this for anything with lot, expiry or serial
+  data), or `'url'` (public and permanent — artwork and documents meant to be shared).
+- **Cache:** the same inputs return the earlier render without rendering again (`cached: true`).
+- **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
+  confirm the digits before answering.
+
+---
+
 ## Worked example — a public competition entry
 
 ```ts

package/dist/openapi.yaml

@@ -8339,7 +8339,7 @@ paths:
     get:
       tags:
         - tags
-      summary: Reverse lookup — find all tags linked to a given object (admin).
+      summary: Reverse lookup — find all tags linked to a given object (admin).
       operationId: tags_byRef
       security:
         - bearerAuth: []
@@ -14108,7 +14108,7 @@ paths:
     get:
       tags:
         - tags
-      summary: "Global tag resolve — returns `{ tagId, collectionId }` only."
+      summary: "Global tag resolve — returns `{ tagId, collectionId }` only."
       operationId: tags_resolveTag
       security: []
       parameters:
@@ -17499,14 +17499,74 @@ components:
       properties:
         html:
           type: string
+        pages:
+          type: array
+          items:
+            type: string
+        head:
+          type: string
+        width:
+          type: number
+        height:
+          type: number
+        unit:
+          type: string
+          enum:
+            - mm
+            - cm
+            - in
+            - pt
+            - px
         format:
           type: string
         landscape:
           type: boolean
         margin:
           type: string
+        return:
+          type: string
+          enum:
+            - url
+            - signedUrl
+            - base64
+        expiresIn:
+          type: number
+        filename:
+          type: string
+        cache:
+          type: boolean
+    PdfCreateResult:
+      type: object
+      properties:
+        url:
+          type: string
+        hostedUrl:
+          type: string
+        base64:
+          type: string
+        expiresAt:
+          type: string
+        contentType:
+          type: string
+          enum:
+            - application/pdf
+        size:
+          type: number
+        pageCount:
+          type: number
+        cached:
+          type: boolean
+        renderer:
+          type: string
+        warnings:
+          type: array
+          items:
+            type: string
       required:
-        - html
+        - contentType
+        - size
+        - pageCount
+        - cached
     PdfFillArgs:
       type: object
       properties:
@@ -19168,6 +19228,10 @@ components:
           enum:
             - registered
             - owned
+        enabled:
+          type: object
+          additionalProperties:
+            type: boolean
         system:
           $ref: "#/components/schemas/SystemBlock"
       required:
@@ -19653,6 +19717,9 @@ components:
         interactions:
           type: object
           additionalProperties: true
+        tools:
+          type: object
+          additionalProperties: true
         products: {}
         attestations: {}
         appData:
@@ -19663,6 +19730,7 @@ components:
         - tags
         - contacts
         - interactions
+        - tools
         - products
         - attestations
         - appData

package/dist/types/ai.d.ts

@@ -945,11 +945,49 @@ export interface PdfClip {
     y1: number;
 }
 export interface PdfCreateArgs {
-    html: string;
+    /** One HTML document (inline CSS). Give `html` or `pages`. */
+    html?: string;
+    /** One HTML fragment per page, laid out one per page (sharing `head`). With width/height and no margin each page box is exactly that size, overflow hidden. 500 labels = one call. */
+    pages?: string[];
+    /** With `pages`: shared <head> content (<style>, @font-face). */
+    head?: string;
+    /** Exact page size (labels, rolls, sheets) — exact to the point. Give both. */
+    width?: number;
+    height?: number;
+    /** Unit for width/height (default 'mm'). */
+    unit?: 'mm' | 'cm' | 'in' | 'pt' | 'px';
+    /** Named page size ("A4", "Letter") when not giving width/height. With neither, the document's CSS @page size is used (else A4). */
     format?: string;
     landscape?: boolean;
-    /** Page margin for all sides, e.g. "0" or "12mm" (default 18mm/14mm). Use "0" when the HTML sets its own margins. */
+    /** Page margin for all sides, e.g. "0" or "12mm". Default 0 with width/height or pages; 18mm/14mm for named formats. */
     margin?: string;
+    /** 'url' (public, permanent; default), 'signedUrl' (private link that expires), 'base64' (bytes in the response, nothing stored). */
+    return?: 'url' | 'signedUrl' | 'base64';
+    /** signedUrl lifetime in seconds: 30 to 604800 (7 days); default 900. */
+    expiresIn?: number;
+    /** File name for signedUrl downloads (default document.pdf). */
+    filename?: string;
+    /** Reuse an identical earlier render (default true). */
+    cache?: boolean;
+}
+export interface PdfCreateResult {
+    /** return 'url' or 'signedUrl'. */
+    url?: string;
+    /** return 'url': same as url. */
+    hostedUrl?: string;
+    /** return 'base64'. */
+    base64?: string;
+    /** return 'signedUrl': when the link stops working. */
+    expiresAt?: string;
+    contentType: 'application/pdf';
+    size: number;
+    pageCount: number;
+    /** An identical earlier render was reused (no new render). */
+    cached: boolean;
+    /** The renderer, e.g. "Chrome/141.0…". */
+    renderer?: string;
+    /** Resources that were not loaded (only images, fonts and stylesheets from SmartLinks hosts, Google Fonts or data: URIs load). */
+    warnings?: string[];
 }
 export interface PdfFillArgs {
     url: string;

package/dist/types/appConfiguration.d.ts

@@ -128,6 +128,14 @@ export interface AppConfigSettings {
     requestedBasePlanId?: string;
     /** How the account handles individual physical items. */
     itemRecordMode?: 'registered' | 'owned' | null;
+    /**
+     * What this collection has SWITCHED ON — separate from what its plan allows (`system.features`).
+     * A missing key means on, so collections that never set it behave as they always have. A website
+     * sign-up switches off what it doesn't use, e.g. `{ products: false, crm: false, hub: false }`.
+     * Known keys: `products`, `crm`, `analytics`, `hub`, `portal`, `printStudio`; the map is open.
+     * Read it with `appConfiguration.isEnabled()` / `resolveEnabled()` — docs/appConfig.md §8a.
+     */
+    enabled?: Record<string, boolean>;
     /** Resolved entitlement truth. Read this to gate features. */
     system?: SystemBlock;
 }

package/dist/types/appManifest.d.ts

@@ -457,6 +457,16 @@ export interface ServerFunctionSl {
             eventId: string;
         }>;
     };
+    /**
+     * Platform tools (`tools:<name>` or `tools:<family>.*`, e.g. `tools:pdf.create`, `tools:pdf.*`):
+     * pdf.create, pdf.merge, pdf.fill, pdf.inspect, pdf.render, pdf.decodeBarcodes, pdf.inspectGraphics,
+     * pdf.preflight, pdf.printReady, pdf.edit, image.transform. Runs as THIS collection whatever the caller
+     * (authorised by the declaration, billed to the collection), rate-limited per collection. Returns the
+     * tool's result; a failure throws an Error with `code` (e.g. bad_args, busy, too_many_pages).
+     */
+    tools: {
+        run<T = any>(name: string, args?: Record<string, any>): Promise<T>;
+    };
     /** Products, scoped by caller authority + declared capability. */
     products: any;
     /** Attestations, scoped by caller authority + declared capability. */

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.65  |  Generated: 2026-10-14T11:51:48.823Z
+Version: 2.0.67  |  Generated: 2026-10-15T17:52:10.614Z
 
 This is a concise summary of all available API functions and types.
 
@@ -1600,10 +1600,35 @@ interface PdfClip {
 **PdfCreateArgs** (interface)
 ```typescript
 interface PdfCreateArgs {
-  html: string
+  html?: string
+  pages?: string[]
+  head?: string
+  width?: number
+  height?: number
+  unit?: 'mm' | 'cm' | 'in' | 'pt' | 'px'
   format?: string
   landscape?: boolean
   margin?: string
+  return?: 'url' | 'signedUrl' | 'base64'
+  expiresIn?: number
+  filename?: string
+  cache?: boolean
+}
+```
+
+**PdfCreateResult** (interface)
+```typescript
+interface PdfCreateResult {
+  url?: string
+  hostedUrl?: string
+  base64?: string
+  expiresAt?: string
+  contentType: 'application/pdf'
+  size: number
+  pageCount: number
+  cached: boolean
+  renderer?: string
+  warnings?: string[]
 }
 ```
 
@@ -2479,6 +2504,7 @@ interface AppConfigSettings {
   addOns?: string[]
   requestedBasePlanId?: string
   itemRecordMode?: 'registered' | 'owned' | null
+  enabled?: Record<string, boolean>
   system?: SystemBlock
 }
 ```
@@ -2785,6 +2811,7 @@ interface ServerFunctionSl {
   forCaller(): Promise<{ contactId: string } | null>;
   };
   interactions: { record(event: ServerFunctionInteractionEvent): Promise<{ eventId: string }> };
+  tools: { run<T = any>(name: string, args?: Record<string, any>): Promise<T> };
   products: any;
   attestations: any;
   appData: AppDataHandle & { global: AppDataHandle; collection: AppDataHandle };
@@ -10886,6 +10913,15 @@ Check whether a feature flag is enabled for a collection, per `appConfig.system.
 **isFeatureEnabledSync**(collectionId: string, flag: string) → `boolean | undefined`
 Synchronous, cache-only check for a feature flag. Returns `undefined` if `getAppConfig()` / `isFeatureEnabled()` hasn't been called yet for this collection this page load (i.e. nothing to read without an await) — treat `undefined` as "not yet known", not as "disabled". ```typescript // Warm the cache once, e.g. in a top-level effect: useEffect(() => { appConfiguration.isFeatureEnabled(collectionId, 'custom_domain') }, [collectionId]); // Elsewhere, read synchronously without an await: const enabled = appConfiguration.isFeatureEnabledSync(collectionId, 'custom_domain'); if (enabled === undefined) { // not warmed yet — fall back to a loading state or the async version } ```
 
+**resolveEnabled**(cfg: { enabled?: Record<string, boolean> } | null | undefined, key: string) → `boolean`
+Has the collection SWITCHED ON this part of the platform (`appConfig.enabled[key]`)? A missing key is on — only an explicit `false` is off. This is "does this business use it", not "does the plan allow it": for something a plan gates, check `resolveFeature()` as well. docs/appConfig.md §8a.
+
+**isEnabled**(collectionId: string, key: string, options?: { force?: boolean }) → `Promise<boolean>`
+Has the collection switched on `key` (`products`, `crm`, `analytics`, `hub`, `portal`, `printStudio`, or an app's own key)? Hide what's off: a website-only business switches off products and the CRM, so menus, cards and setup steps for them shouldn't appear. ```typescript if (await appConfiguration.isEnabled(collectionId, 'products')) showProductsMenu(); ```
+
+**isEnabledSync**(collectionId: string, key: string) → `boolean | undefined`
+Cache-only `isEnabled` — `undefined` until `getAppConfig()` has been read this page load.
+
 ### asset
 
 **upload**(options: UploadAssetOptions) → `Promise<Asset>`
@@ -12805,7 +12841,7 @@ Create a single tag mapping (admin). If `productId` is set without `proofId`, a
 
 **createBatch**(collectionId: string,
     data: BatchCreateTagRequest) → `Promise<BatchCreateResult>`
-Batch-create tags (admin). Tags with `productId` but no `proofId` automatically get serial numbers. Serial number generation is grouped by `(productId, variantId, batchId)` for efficiency.  Partial success is possible — check `results` for individual outcomes. ```typescript const result = await tags.createBatch('coll_123', { tags: [ { tagId: 'NFC-001', productId: 'prod_456', batchId: 'batch_2026_01' }, { tagId: 'NFC-002', productId: 'prod_456', batchId: 'batch_2026_01' }, ], }) console.log(`Created: ${result.summary.created}, Conflicts: ${result.summary.conflicts}`) ```
+Batch-create tags (admin). Tags with `productId` but no `proofId` automatically get serial numbers. Serial number generation is grouped by `(productId, variantId, batchId)` for efficiency.  Partial success is possible — check `results` for individual outcomes. ```typescript const result = await tags.createBatch('coll_123', { tags: [ { tagId: 'NFC-001', productId: 'prod_456', batchId: 'batch_2026_01' }, { tagId: 'NFC-002', productId: 'prod_456', batchId: 'batch_2026_01' }, ], }) console.log(`Created: ${result.summary.created}, Conflicts: ${result.summary.conflicts}`) ```
 
 **get**(collectionId: string,
     tagId: string) → `Promise<GetTagResponse>`
@@ -12814,7 +12850,7 @@ Get a single tag by `tagId` (admin).
 **update**(collectionId: string,
     tagId: string,
     data: UpdateTagRequest) → `Promise<UpdateTagResponse>`
-Update a tag (admin). Partial update — only provided fields are changed.  `metadata` is deep-merged with the existing value.  Pass `refType: null, refId: null` to clear the polymorphic ref. ```typescript const updated = await tags.update('coll_123', 'NFC-001', { variantId: 'var_premium', metadata:  { notes: 'Updated to premium variant' }, }) // Clear polymorphic ref await tags.update('coll_123', 'NFC-001', { refType: null, refId: null }) ```
+Update a tag (admin). Partial update — only provided fields are changed.  `metadata` is deep-merged with the existing value.  Pass `refType: null, refId: null` to clear the polymorphic ref. ```typescript const updated = await tags.update('coll_123', 'NFC-001', { variantId: 'var_premium', metadata:  { notes: 'Updated to premium variant' }, }) // Clear polymorphic ref await tags.update('coll_123', 'NFC-001', { refType: null, refId: null }) ```
 
 **remove**(collectionId: string,
     tagId: string) → `Promise<DeleteTagResponse>`
@@ -12826,15 +12862,15 @@ List tags with optional filters and pagination (admin). ```typescript // All tag
 
 **byRef**(collectionId: string,
     params: ReverseTagLookupParams) → `Promise<ReverseTagLookupResponse>`
-Reverse lookup — find all tags linked to a given object (admin). Uses a compound index on `(orgId, refType, refId)` on the per-org shard. No embed support on the admin side. ```typescript const { tags: linked } = await tags.byRef('coll_123', { refType: 'container', refId:   'container-uuid', }) ```
+Reverse lookup — find all tags linked to a given object (admin). Uses a compound index on `(orgId, refType, refId)` on the per-org shard. No embed support on the admin side. ```typescript const { tags: linked } = await tags.byRef('coll_123', { refType: 'container', refId:   'container-uuid', }) ```
 
 **resolveTag**(tagId: string) → `Promise<TagIndexEntry>`
-Global tag resolve — returns `{ tagId, collectionId }` only. Use this **only** when you have a raw `tagId` and do not yet know which collection it belongs to.  Queries the shared `tag_index` shard. Once `collectionId` is resolved, call `publicGetByCollection` for full data. > The global `/public/tags/by-ref` endpoint has been removed. > Use the collection-scoped `publicByRef` instead. ```typescript // Step 1: resolve collection const { collectionId } = await tags.resolveTag('NFC-001') // Step 2: full lookup with embedded data const { tag, embedded } = await tags.publicGetByCollection( collectionId, 'NFC-001', 'product,proof' ) ```
+Global tag resolve — returns `{ tagId, collectionId }` only. Use this **only** when you have a raw `tagId` and do not yet know which collection it belongs to.  Queries the shared `tag_index` shard. Once `collectionId` is resolved, call `publicGetByCollection` for full data. > The global `/public/tags/by-ref` endpoint has been removed. > Use the collection-scoped `publicByRef` instead. ```typescript // Step 1: resolve collection const { collectionId } = await tags.resolveTag('NFC-001') // Step 2: full lookup with embedded data const { tag, embedded } = await tags.publicGetByCollection( collectionId, 'NFC-001', 'product,proof' ) ```
 
 **publicGetByCollection**(collectionId: string,
     tagId: string,
     embed?: string) → `Promise<PublicGetTagResponse>`
-Single tag lookup with optional embedded data (public). `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref` Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'` (`'collection'` is not supported — the collection is already known from the URL). ```typescript const { tag, embedded } = await tags.publicGetByCollection( 'coll_123', 'NFC-001', 'product,proof' ) const product = embedded.products?.[tag.productId!] const proof   = embedded.proofs?.[tag.proofId!] ```
+Single tag lookup with optional embedded data (public). `GET /public/collection/:collectionId/tags/:tagId?embed=product,proof,container,ref` Supported `embed` values: `'product'`, `'proof'`, `'container'`, `'ref'` (`'collection'` is not supported — the collection is already known from the URL). ```typescript const { tag, embedded } = await tags.publicGetByCollection( 'coll_123', 'NFC-001', 'product,proof' ) const product = embedded.products?.[tag.productId!] const proof   = embedded.proofs?.[tag.proofId!] ```
 
 **lookupTags**(collectionId: string,
     data: LookupTagsRequest) → `Promise<TagLookupResponse>`

package/docs/agent-tools.md

@@ -29,7 +29,7 @@ needs to call it — a description and an input schema:
 ```jsonc
 {
   "functions": {
-    "files": { "js": { "umd": "dist/functions.umd.js" } },
+    "files": { "js": { "umd": "functions.umd.js" } },
     "definitions": [
       {
         "name": "createFaq",

package/docs/ai.md

@@ -323,7 +323,7 @@ in `input`.
 | `image.fromReference` | Image-to-image: generate guided by reference image(s). |
 | `image.searchStock` | Search real stock photos (Unsplash). |
 | `image.transform` | Resize / crop / rotate / grayscale / format-convert / compress → hosted URL. |
-| `pdf.create` | Render HTML → PDF → hosted URL. |
+| `pdf.create` | Render HTML (or one fragment per page) → PDF, 1:1: exact `width`/`height`/`unit` for labels, `pages[]` for many pages in one render, no scripts, only SmartLinks/Google Fonts/data: resources. `return`: `url` (public), `signedUrl` (expiring), `base64`. Cached by input. |
 | `pdf.fill` | Fill an AcroForm PDF's fields (`{ field: value }`) → hosted URL. |
 | `pdf.merge` | Merge several PDFs into one, in order → hosted URL. |
 | `pdf.inspect` | Cheap, no-AI introspection: page count/sizes, which pages have a real text layer, raster present, and a routing hint (`text` vs `vision`). |
@@ -402,9 +402,11 @@ if (!ready.result.report.compliant) showFindings(ready.result.report.findings)
 - **A review UI that flags guessed fields** → `pdf.extract` with `includeConfidence` (per-field
   confidence + source) and `includeBoxes` (per-field bbox on text-native pages) in `fieldsMeta`.
 - **Produce a PDF** → `pdf.create` (HTML → PDF), `pdf.fill` (populate an AcroForm's fields),
-  `pdf.merge` (combine several). These return a hosted `hostedUrl` (`pdf.create` also returns it as
-  `url`). `pdf.create` loads remote `<img>` URLs before rendering and honours `page-break-inside`; pass
-  `margin: "0"` when your HTML sets its own body margin (default page margin is 18mm/14mm).
+  `pdf.merge` (combine several). `pdf.create` takes an exact page size (`width`, `height`, `unit`) or a
+  `format`, `html` or `pages: [html, …]` (one per page, sharing `head`), and returns `url` (public),
+  a `signedUrl` that expires, or `base64` (`return`). JavaScript doesn't run, and images, fonts and
+  stylesheets load only from SmartLinks hosts, Google Fonts or `data:` URIs. From a server function:
+  `ctx.sl.tools.run('pdf.create', …)` with the `tools:pdf.create` capability (server-functions.md).
 
 Every tool is also directly callable without the model loop via `ai.tools.run(collectionId, name,
 args)` — e.g. render a page or extract fields straight from a UI, no agent round-trip:

package/docs/app-manifest.md

@@ -428,7 +428,7 @@ this is just the manifest shape.
 
 | Field | Type | Description |
 |-------|------|-------------|
-| `files.js.umd` | string | UMD bundle path (e.g. `dist/functions.umd.js`) — a self-contained bundle exporting each handler by name |
+| `files.js.umd` | string | UMD bundle path, relative to the published build like the other bundles (e.g. `functions.umd.js`, built to `dist/functions.umd.js`) — a self-contained bundle exporting each handler by name |
 | `definitions[]` | object[] | One entry per function |
 | `definitions[].name` | string | Function name; also the handler export name (override with `handler`) |
 | `definitions[].trigger` | object | `{ type: "http"|"event"|"cron", … }` |

package/docs/appConfig.md

@@ -36,6 +36,8 @@ export interface AppConfigSettings {
 
   /** How the account handles individual physical items. */
   itemRecordMode?: 'registered' | 'owned' | null;
+  /** What the collection has switched on (absent key = on) — see §8a. */
+  enabled?: Record<string, boolean>;
 
   // ── SYSTEM-OWNED, PUBLIC (reconcile writes; client read-only) ─────
   /** Resolved entitlement truth. Read this to gate features. */
@@ -501,6 +503,41 @@ the customer add-ons page (`src/components/pricing/ItemHandlingSection`)
 because these settings change the whole UX shape (claim, ownership,
 CRM visibility), not just a capability flag.
 
+## 8a. What's switched on (`enabled`)
+
+A root-level, user-owned map (like `itemRecordMode`; reconcile never touches it) saying which parts of
+the platform this collection **uses** — separate from what its plan **allows** (`system.features`):
+
+| | Plan allows (`system.features`) | Switched on (`enabled`) |
+|---|---|---|
+| Written by | billing (`entitlements-reconcile`) | the collection: sign-up wizards, admins |
+| Means | "you may have this" | "this business uses this" |
+| Missing key | standard: off · enterprise: on | **on** |
+
+```json
+{ "enabled": { "products": false, "crm": false, "hub": false, "portal": false, "printStudio": false } }
+```
+
+**A missing key is on**, so a collection that never set `enabled` behaves exactly as before. Only an
+explicit `false` switches something off. A website-only sign-up switches off what it doesn't use
+(products, CRM, Hub, Portal…), and Studio hides the menus, dashboard cards and setup steps for them;
+an admin can switch them back on.
+
+Known keys: `products`, `crm`, `analytics`, `hub`, `portal`, `printStudio`. The map is open — an app
+may define its own key.
+
+```ts
+if (await SL.appConfiguration.isEnabled(collectionId, 'products')) showProducts()
+// already have the config:
+SL.appConfiguration.resolveEnabled(cfg, 'crm')
+```
+
+For something a plan gates, show it only when both hold: `resolveEnabled(cfg, key)` **and**
+`resolveFeature(cfg.system, flag)`.
+
+Write it through the admin settings route (`collection.updateSettings(collectionId, 'appConfig',
+{ enabled: { products: true } })`) — keys merge, so set only the ones you change.
+
 ## 9. Migration notes
 
 - Legacy `entitlements` settings group is deprecated. Everything moved

package/docs/connectors.md

@@ -66,7 +66,7 @@ deterministically. A connector's `shape` and `serialize` must be deterministic t
   "aiGuide": "connector-ai-guide.md"
 },
 "functions": {
-  "files": { "js": { "umd": "dist/functions.umd.js" } },
+  "files": { "js": { "umd": "functions.umd.js" } },
   "definitions": [
     { "name": "testConnection", "trigger": { "type": "http", "method": "POST" },
       "visibility": "admin", "authority": "collection",

package/docs/server-functions.md

@@ -33,7 +33,7 @@ in a bundle alongside your widgets/containers:
 ```jsonc
 {
   "functions": {
-    "files": { "js": { "umd": "dist/functions.umd.js" } },
+    "files": { "js": { "umd": "functions.umd.js" } },
     "definitions": [
       {
         "name": "submitCompetitionEntry",
@@ -98,9 +98,12 @@ export default defineConfig({
 }
 ```
 
-That emits `dist/functions.umd.js` (matching `functions.files.js.umd`), whose named exports the
-platform pairs with your manifest `definitions`. Then **deploy** it — for dev,
-`smartlinks-publish` uploads `dist/` and registers in one step (see
+That emits `dist/functions.umd.js`, whose named exports the platform pairs with your manifest
+`definitions`. In the manifest, `functions.files.js.umd` is **`functions.umd.js`** — relative to the
+published build (the contents of `dist/`), like the widget and container files; not
+`dist/functions.umd.js`. Publishing refuses a release whose functions bundle isn't there.
+
+Then **deploy** it — for dev, `smartlinks-publish` uploads `dist/` and registers in one step (see
 [Deploying & registering](deploying-apps.md)).
 
 ---
@@ -169,6 +172,7 @@ Declare the minimum you need.
 | `network:<host>` | `ctx.fetch` to that host only (repeat for several). Prefer this over blanket `network`. |
 | `network:*.<domain>` | `ctx.fetch` to any subdomain of `<domain>` (not `<domain>` itself), for a customer's own endpoint at a provider, e.g. `network:*.servicebus.windows.net`. `<domain>` needs at least two labels (`*.com` is not honoured). |
 | `secrets:<name>` | `ctx.secrets.get('<name>')` for that one secret (see [Secrets](#secrets--api-keys-per-collection)). |
+| `tools:<name>` / `tools:<family>.*` | `ctx.sl.tools.run('<name>', args)` for a platform tool, e.g. `tools:pdf.create`, or `tools:pdf.*` for every PDF tool (see [Platform tools](#platform-tools--pdfs-labels-barcodes)). |
 
 If you don't declare `network`, `ctx.fetch` is absent. Reading a secret you didn't declare with
 `secrets:<name>` throws.
@@ -606,6 +610,58 @@ await ctx.sl.interactions.record({
 
 ---
 
+## Platform tools — PDFs, labels, barcodes
+
+`ctx.sl.tools.run(name, args)` runs one of the platform's deterministic tools from your function: no
+model, no agent loop. Declare each tool as a capability: `tools:pdf.create`, or `tools:pdf.*` for the
+whole family. Open to functions: `pdf.create`, `pdf.merge`, `pdf.fill`, `pdf.inspect`, `pdf.render`,
+`pdf.decodeBarcodes`, `pdf.inspectGraphics`, `pdf.preflight`, `pdf.printReady`, `pdf.edit`,
+`image.transform` (arguments as in [ai.md](ai.md)).
+
+- **Identity:** the call runs as the function's collection, whatever the caller. An anonymous caller
+  holding only your own key gets the same result; the work is attributed and billed to the collection.
+- **Rate:** per collection (10 calls a second by default); bursts wait rather than fail.
+- **Failure:** throws an `Error` with `code` (`bad_args`, `too_large`, `too_many_pages`,
+  `resource_timeout`, `timeout`, `busy`, `TOOL_NOT_AVAILABLE`, or a capability denial).
+
+**Labels with `pdf.create`.** Exact page sizes, many pages in one render, and bytes straight back:
+
+```ts
+// capabilities: ["tools:pdf.create", "tools:pdf.decodeBarcodes"]
+export async function printLabel(ctx, event) {
+  const { gtin, lot, expiry, qty = 1 } = event.body
+  const barcode = bwipjs.toSVG({ bcid: 'gs1-128', text: `(01)${gtin}(10)${lot}(17)${expiry}` }) // inline SVG
+  const pdf = await ctx.sl.tools.run('pdf.create', {
+    width: 100, height: 50, unit: 'mm',                      // exact; output is 1:1
+    head: '<style>.l{position:absolute;font:3mm Arial}</style>',
+    pages: Array.from({ length: qty }, () => `<div class="l" style="left:4mm;top:3mm">Lot ${lot}</div>
+      <div style="position:absolute;left:4mm;top:10mm;width:92mm">${barcode}</div>`),
+    return: 'base64',                                        // or 'signedUrl' + expiresIn
+  })
+  return { pdf: pdf.base64, pages: pdf.pageCount }
+}
+```
+
+- **Page size:** `width` + `height` (+ `unit`: mm, cm, in, pt, px) is exact to the point. Otherwise
+  `format` ("A4", "Letter"), or the document's own CSS `@page { size }` when neither is given.
+- **Pages:** `pages: [html, …]` lays one fragment per page; with an exact size and no margin each page
+  box is that size (overflow hidden), so a long value can't push onto the next label. Up to 2000 pages
+  and 10 MB of HTML per render.
+- **Output:** 1:1 at scale 1 with backgrounds; text stays text and SVG stays vector (render barcodes as
+  inline SVG, e.g. bwip-js `toSVG`, never as a canvas bitmap). Colour is RGB; for CMYK pass the result
+  through `pdf.printReady`.
+- **What loads:** JavaScript does not run. Images, fonts and stylesheets load only from SmartLinks hosts
+  (our CDN), Google Fonts or inline `data:` URIs; anything else is skipped and listed in `warnings`.
+  Embed brand fonts as `data:` URIs in `@font-face`, or host them on the SmartLinks CDN.
+- **Delivery:** `return: 'base64'` (nothing stored), `'signedUrl'` (private link that expires after
+  `expiresIn` seconds, default 900, max 7 days — use this for anything with lot, expiry or serial
+  data), or `'url'` (public and permanent — artwork and documents meant to be shared).
+- **Cache:** the same inputs return the earlier render without rendering again (`cached: true`).
+- **Verify:** `pdf.decodeBarcodes` on a `signedUrl` reads the codes back deterministically, so you can
+  confirm the digits before answering.
+
+---
+
 ## Worked example — a public competition entry
 
 ```ts

package/openapi.yaml

@@ -8339,7 +8339,7 @@ paths:
     get:
       tags:
         - tags
-      summary: Reverse lookup — find all tags linked to a given object (admin).
+      summary: Reverse lookup — find all tags linked to a given object (admin).
       operationId: tags_byRef
       security:
         - bearerAuth: []
@@ -14108,7 +14108,7 @@ paths:
     get:
       tags:
         - tags
-      summary: "Global tag resolve — returns `{ tagId, collectionId }` only."
+      summary: "Global tag resolve — returns `{ tagId, collectionId }` only."
       operationId: tags_resolveTag
       security: []
       parameters:
@@ -17499,14 +17499,74 @@ components:
       properties:
         html:
           type: string
+        pages:
+          type: array
+          items:
+            type: string
+        head:
+          type: string
+        width:
+          type: number
+        height:
+          type: number
+        unit:
+          type: string
+          enum:
+            - mm
+            - cm
+            - in
+            - pt
+            - px
         format:
           type: string
         landscape:
           type: boolean
         margin:
           type: string
+        return:
+          type: string
+          enum:
+            - url
+            - signedUrl
+            - base64
+        expiresIn:
+          type: number
+        filename:
+          type: string
+        cache:
+          type: boolean
+    PdfCreateResult:
+      type: object
+      properties:
+        url:
+          type: string
+        hostedUrl:
+          type: string
+        base64:
+          type: string
+        expiresAt:
+          type: string
+        contentType:
+          type: string
+          enum:
+            - application/pdf
+        size:
+          type: number
+        pageCount:
+          type: number
+        cached:
+          type: boolean
+        renderer:
+          type: string
+        warnings:
+          type: array
+          items:
+            type: string
       required:
-        - html
+        - contentType
+        - size
+        - pageCount
+        - cached
     PdfFillArgs:
       type: object
       properties:
@@ -19168,6 +19228,10 @@ components:
           enum:
             - registered
             - owned
+        enabled:
+          type: object
+          additionalProperties:
+            type: boolean
         system:
           $ref: "#/components/schemas/SystemBlock"
       required:
@@ -19653,6 +19717,9 @@ components:
         interactions:
           type: object
           additionalProperties: true
+        tools:
+          type: object
+          additionalProperties: true
         products: {}
         attestations: {}
         appData:
@@ -19663,6 +19730,7 @@ components:
         - tags
         - contacts
         - interactions
+        - tools
         - products
         - attestations
         - appData

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.0.65",
+  "version": "2.0.67",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",