lambda-erp 0.8.33__tar.gz → 1.0.0__tar.gz

{lambda_erp-0.8.33 → lambda_erp-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 0.8.33
+Version: 1.0.0
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-0.8.33 → lambda_erp-1.0.0}/api/chat.py

@@ -179,6 +179,17 @@ def save_chat_message(session_id: str, role: str, content: str, message_type: st
     touch_session(session_id)
 
 
+def _save_tool_trace(session_id: str, message_type: str, payload: dict):
+    """Audit visible tool activity without masking a completed business write."""
+    try:
+        save_chat_message(session_id, "tool", json.dumps(payload, default=str), message_type=message_type)
+    except Exception:
+        # A session can be deleted while a tool is running. In particular, a
+        # failed result audit must not turn a successful write into a retry.
+        get_db().conn.rollback()
+        logger.warning("Could not persist %s trace for session %s", message_type, session_id)
+
+
 def load_chat_history(session_id: str, limit: int = 50, before_id: int | None = None) -> list[dict]:
     """Load recent chat messages for a session.
 
@@ -189,13 +200,13 @@ def load_chat_history(session_id: str, limit: int = 50, before_id: int | None =
     if before_id:
         rows = db.sql(
             'SELECT id, role, message_type, content, metadata_json, created_at '
-            'FROM "Chat Message" WHERE session_id = ? AND id < ? ORDER BY id DESC LIMIT ?',
+            'FROM "Chat Message" WHERE session_id = ? AND role IN (\'user\', \'assistant\') AND id < ? ORDER BY id DESC LIMIT ?',
             [session_id, int(before_id), limit],
         )
     else:
         rows = db.sql(
             'SELECT id, role, message_type, content, metadata_json, created_at '
-            'FROM "Chat Message" WHERE session_id = ? ORDER BY id DESC LIMIT ?',
+            'FROM "Chat Message" WHERE session_id = ? AND role IN (\'user\', \'assistant\') ORDER BY id DESC LIMIT ?',
             [session_id, limit],
         )
     rows.reverse()
@@ -275,7 +286,7 @@ def load_serialized_chat_history(
     if oldest_id is not None:
         db = get_db()
         older = db.sql(
-            'SELECT 1 FROM "Chat Message" WHERE session_id = ? AND id < ? LIMIT 1',
+            'SELECT 1 FROM "Chat Message" WHERE session_id = ? AND role IN (\'user\', \'assistant\') AND id < ? LIMIT 1',
             [session_id, int(oldest_id)],
         )
         has_more = bool(older)
@@ -483,7 +494,7 @@ TOOLS = [
         "type": "function",
         "function": {
             "name": "get_document_fields",
-            "description": "List the available columns of a document type and identify which are text fields. Call this before building list_documents filters when you are unsure of a field name or whether it supports the case-insensitive contains operator. Also returns the default fields used by free-text search.",
+            "description": "List the available columns of a document type and identify which are text fields. Call this before building list_documents filters when you are unsure of a field name or whether it supports the case-insensitive contains operator. Also returns required fields, conditional business rules, child requirements, dynamic links and supported transient inputs. Check these before creating or updating a document; unknown fields are rejected.",
             "parameters": {
                 "type": "object",
                 "properties": {
@@ -493,6 +504,16 @@ TOOLS = [
             },
         },
     },
+    {
+        "type": "function",
+        "function": {
+            "name": "generate_document_pdf",
+            "description": "Generate and validate the actual PDF before offering or sending it. Returns a downloadable file snapshot only after successful rendering and content checks. Read get_document_fields.pdf for support and output requirements. Relay errors; never invent a PDF URL or claim a file is attached without this tool succeeding.",
+            "parameters": {"type": "object", "properties": {
+                "doctype": {"type": "string", "enum": DOCUMENT_SLUGS},
+                "name": {"type": "string"}}, "required": ["doctype", "name"]},
+        },
+    },
     {
         "type": "function",
         "function": {
@@ -513,7 +534,7 @@ TOOLS = [
         "function": {
             "name": "create_document",
             "description": (
-                "Create a new draft document (docstatus=0). The document is saved but NOT submitted. IMPORTANT: you MUST pass the 'data' object with ALL document fields — doctype alone is not enough. Example: {\"doctype\": \"purchase-order\", \"data\": {\"supplier\": \"SUPP-001\", \"company\": \"My Co\", \"transaction_date\": \"2026-04-14\", \"items\": [{\"item_code\": \"ITEM-001\", \"qty\": 10, \"rate\": 100}]}}\n"
+                "Create a new draft document (docstatus=0). The document is saved but NOT submitted. Use get_document_fields for required/conditional fields. Never omit an ambiguous business reference to make a call succeed: ask a targeted question. Relay _validation.warnings from saved documents. IMPORTANT: you MUST pass the 'data' object with ALL document fields — doctype alone is not enough. Example: {\"doctype\": \"purchase-order\", \"data\": {\"supplier\": \"SUPP-001\", \"company\": \"My Co\", \"transaction_date\": \"2026-04-14\", \"items\": [{\"item_code\": \"ITEM-001\", \"qty\": 10, \"rate\": 100}]}}\n"
                 "Currency: `currency` is optional — it defaults to the customer/supplier's currency, else the company's base currency. To bill in a foreign currency, also pass `conversion_rate` = how many units of the company's base currency equal 1 unit of the document currency (no automatic FX lookup yet, so you MUST supply it for a foreign currency). Item rates stay in the document currency. Example (base USD, invoicing in EUR at 1 EUR = 1.10 USD): {\"doctype\": \"sales-invoice\", \"data\": {\"customer\": \"CUST-001\", \"company\": \"My Co\", \"posting_date\": \"2026-05-22\", \"currency\": \"EUR\", \"conversion_rate\": 1.10, \"items\": [{\"item_code\": \"ITEM-001\", \"qty\": 1, \"rate\": 100}]}}"
             ),
             "parameters": {
@@ -1468,21 +1489,17 @@ def _handle_list_documents(args):
     return rows
 
 
+def _handle_generate_document_pdf(args, user=None):
+    from api.pdf_exports import create_pdf_export
+    from api.pdf_contract import PDFError
+    try:
+        return create_pdf_export(args.get('doctype'), args.get('name'), user)
+    except PDFError as exc:
+        return {'error': str(exc), 'code': exc.code, 'fields': exc.fields}
+
+
 def _handle_get_document_fields(args):
-    doctype = args["doctype"]
-    table = services.SLUG_TO_DOCTYPE.get(doctype)
-    if not table:
-        return {"error": f"Unknown document type: {doctype}"}
-    db = get_db()
-    cls = services.DOCUMENT_CLASSES.get(table)
-    return {
-        "doctype": doctype,
-        "fields": sorted(db._get_table_columns(table)),
-        "text_fields": sorted(db._get_text_columns(table)),
-        "default_search_fields": services.document_search_columns(db, doctype),
-        "child_tables": sorted((cls.CHILD_TABLES or {}).keys()) if cls else [],
-        "link_fields": dict(getattr(cls, "LINK_FIELDS", None) or {}) if cls else {},
-    }
+    return services.document_field_metadata(args["doctype"])
 
 
 def _handle_get_document(args):
@@ -1569,6 +1586,7 @@ def _fuzzy_master_search(db, doctype, search_cols, query, has_disabled, limit):
 
 
 def _handle_get_master_fields(args):
+    from api.routers.masters import master_requirements, MASTER_LINK_FIELDS
     db = get_db()
     master_type = args["master_type"]
     entry = services.MASTER_TABLES.get(master_type)
@@ -1577,6 +1595,7 @@ def _handle_get_master_fields(args):
     doctype, _ = entry
     default_search = _master_search_columns(db, doctype)
     bulk = services.master_bulk_text_columns(db, doctype)
+    cls = services.DOCUMENT_CLASSES.get(doctype)
     return {
         "master_type": master_type,
         "fields": sorted(db._get_table_columns(doctype)),
@@ -1585,6 +1604,10 @@ def _handle_get_master_fields(args):
         "default_search_fields": default_search,
         # Large text fields searched ONLY when named in search_masters `fields`.
         "bulk_text_fields": bulk,
+        "requirements": master_requirements(master_type),
+        "link_fields": dict(cls.LINK_FIELDS) if cls else MASTER_LINK_FIELDS.get(master_type, {}),
+        "dynamic_link_fields": dict(cls.DYNAMIC_LINK_FIELDS) if cls else {},
+        "input_fields": sorted(set(cls.INPUT_FIELDS if cls else ()) | ({services.MASTER_IDENTITY_ALIAS[master_type]} if master_type in services.MASTER_IDENTITY_ALIAS else set())),
     }
 
 
@@ -2236,6 +2259,7 @@ def _handle_apply_company_setup(args):
 TOOL_HANDLERS = {
     "list_documents": _handle_list_documents,
     "get_document_fields": _handle_get_document_fields,
+    "generate_document_pdf": _handle_generate_document_pdf,
     "get_document": _handle_get_document,
     "create_document": _handle_create_document,
     "update_document": _handle_update_document,
@@ -2356,12 +2380,30 @@ def _prompt_uom_context() -> str:
     )
 
 
+def _prompt_validation_context():
+    from lambda_erp.validation import document_requirements
+    from api.routers.masters import master_requirements
+    groups = {}
+    for doctype, cls in services.DOCUMENT_CLASSES.items():
+        rules = document_requirements(cls)
+        if not any(rules.values()):
+            continue
+        key = json.dumps(rules, sort_keys=True)
+        groups.setdefault(key, []).append(doctype)
+    for slug, (doctype, _) in services.MASTER_TABLES.items():
+        if doctype not in services.DOCUMENT_CLASSES:
+            key = json.dumps(master_requirements(slug), sort_keys=True)
+            groups.setdefault(key, []).append(doctype + ' (master)')
+    return "\n".join(f"- {', '.join(names)}: {rules}" for rules, names in groups.items())
+
+
 def build_system_prompt(user_info: dict | None = None, channel: str = "web"):
     user_name = user_info.get("full_name", "User") if user_info else "User"
     user_role = user_info.get("role", "viewer") if user_info else "viewer"
     company_context = _prompt_company_context()
     analytics_context = _prompt_analytics_context()
     uom_context = _prompt_uom_context()
+    validation_context = _prompt_validation_context()
 
     # Deployment-registered types (register_doctype / register_master). Folded
     # into the type lists below so the assistant knows they exist and can act
@@ -2387,6 +2429,11 @@ def build_system_prompt(user_info: dict | None = None, channel: str = "web"):
                 + ", ".join(f"`{field}`" for field in meta["fields"])
             )
     chat_doctype_section = _chat_doctype_section()
+    from api.pdf_profiles import pdf_metadata
+    chat_doctype_section += "\n## PDF output contracts\n" + "\n".join(
+        f"- {services.DOCTYPE_TO_SLUG[dt]}: {json.dumps(pdf_metadata(dt), ensure_ascii=False)}"
+        for dt in services.DOCUMENT_CLASSES
+    )
 
     # Channel-aware link guidance. On the "web" channel the reader is a browser
     # inside the ERP, so web-relative links are clickable. On the "api" channel the
@@ -2400,7 +2447,7 @@ def build_system_prompt(user_info: dict | None = None, channel: str = "web"):
         markdown_links_section = """## Referring to records
 Your reply is relayed to an external application (the user's Lambda assistant / app), NOT the ERP web interface. Links into the ERP web UI are NOT clickable there, so refer to every record by its human identifier in plain text — e.g. "Quotation **QTN-2298**", "Sales Invoice **SINV-0012**". Do not paste `/app/...`, `/masters/...`, or `/reports/...` URLs; they do not work outside the ERP."""
         document_links_section = """## Delivering document PDFs
-When the user wants a document as a file (an invoice, quotation, delivery note, etc.), include exactly one canonical PDF reference in the form `/api/documents/{doctype-slug}/{name}/pdf` — e.g. `/api/documents/sales-invoice/SINV-0001/pdf`. The platform detects this reference, fetches the PDF, and delivers it to the user as a downloadable attachment. So phrase it as the file being provided ("I've attached the PDF of QTN-2298"), NOT as a link to click. Do not include `/app/...` view links or `/masters/...` links — name the record instead."""
+Call generate_document_pdf for every requested file. Only a successful result means a file is generated and available for attachment. The platform attaches that exact validated file. Do not invent PDF URLs or claim generation after an error. Name the document in prose; no /app or /masters view links on this channel."""
     else:
         markdown_links_section = """## Always use markdown links
 Every URL you mention in chat MUST be written as a markdown link `[label](url)` — never a bare URL on its own. The chat UI only turns `[label](url)` into a proper clickable link. A bare `/reports/analytics?report_id=...` still works (a fallback linkifier catches it), but markdown form is the expected shape.
@@ -2414,14 +2461,14 @@ When referencing records, always use clickable markdown links so the user can op
 
 **Documents** (quotations, invoices, orders, deliveries, receipts, payments, journal entries, stock entries):
 - **View/edit link:** `/app/{doctype-slug}/{name}` — e.g. [SINV-0001](/app/sales-invoice/SINV-0001)
-- **PDF link:** `/api/documents/{doctype-slug}/{name}/pdf` — e.g. [Download PDF](/api/documents/sales-invoice/SINV-0001/pdf)
+- **PDF files:** call generate_document_pdf. Only link the returned download_url after successful generation; never construct PDF links yourself.
 The doctype slug is the lowercase, hyphenated form: sales-invoice, purchase-order, delivery-note, etc.
 
 **Master records** (customer, supplier, item, warehouse, company):
 - **View/edit link:** `/masters/{master-type}/{name}` — e.g. [SUPP-001](/masters/supplier/SUPP-001), [CUST-003](/masters/customer/CUST-003), [ITEM-001](/masters/item/ITEM-001)
 - NEVER use `/app/...` for masters — that path is only for transactional documents.
 
-Always include the view link after creating, submitting, converting, or updating a record. Include the PDF link when the user asks for a printable version or when sharing an invoice/quotation."""
+Always include the view link after creating, submitting, converting, or updating a record. Call generate_document_pdf when a printable file is requested. Only confirm and link a successfully generated file."""
 
     if user_role == "admin":
         role_desc = "You have **admin** access — full permissions to create, edit, submit, cancel documents, manage master data, run reports, and manage users."
@@ -2453,11 +2500,16 @@ If `jurisdiction.is_fallback` is true, tell the user their country isn't localiz
 
 You help users manage their business by creating documents, looking up data, and running reports — all through natural conversation.
 
+## Enforced document requirements (generated from backend rule metadata)
+{validation_context}
+Use get_document_fields for full field and relationship metadata. On updates these rules apply to the merged document, so already stored values need not be resubmitted. Never remove an ambiguous link to bypass a validation error.
+
 ## Never fabricate actions or results
-Only state that something was done — created, changed, enabled/disabled, booked, repointed — **after a tool call returns a success result that confirms it**, and check the returned record actually reflects the change (after `update_master` with {{"disabled": 0}}, confirm the returned row shows `disabled = 0`; after submitting a journal entry, confirm it posted non-zero GL). If a tool returns an error, a warning, or a record that doesn't reflect your intent, tell the user it did **not** work and why — never smooth it over as success.
+Only state that something was done — created, changed, enabled/disabled, booked, repointed — **after a tool call returns a success result that confirms it**, and check the returned record actually reflects the change (after `update_master` with {{"disabled": 0}}, confirm the returned row shows `disabled = 0`; after submitting a journal entry, confirm it posted non-zero GL). An error means the action failed. For a successful result with warnings, explain both what was saved and what remains incomplete (for example, pool capacity reserved but no machine assigned). If the record doesn't reflect your intent, explain the mismatch — never smooth it over as success.
 - If a capability doesn't exist, say so plainly. There is **no rename** for accounts or other masters — a master's identifying `name`/number is immutable; you can only edit display fields or create a new record and migrate. Never claim you "renamed" an account.
 - Never assert a field or capability is missing without checking (e.g. an item's income account) — verify with `get_master_fields` / `search_masters` first.
 - A master you can't find via `search_masters` may just be **disabled** (search hides disabled by default). Retry with `include_disabled: true` before concluding it doesn't exist — you need this to re-enable a disabled account.
+- Respect document requirements from get_document_fields. Missing required data or ambiguous matches require a targeted question, not guessed IDs, omitted links, or zero quantities. A tool error means the action failed; _validation.warnings must be explained.
 - If you can't confirm an action took effect, re-fetch and look, or tell the user you couldn't confirm it — never guess.
 
 ## Answering data questions — three paths
@@ -2556,7 +2608,7 @@ Shape — note it does NOT use `items`:
 - Parent fields: `title` (e.g. "Offerte"), `customer`, `company`, `proposal_date`, `partner_name`, `partner_email`, `cover_letter` (the intro/greeting letter text).
 - Child table `quotations[]` — one row per offer to include, in display order. Each row has: `quotation` (the name of an existing Quotation), optional `position_title` and `position_blurb` (default from the quotation), and `is_recommended` (0 or 1 — set 1 on the offer you recommend, which draws an "Empfehlung" badge).
 
-To build one: ensure each offer already exists as its own Quotation (create them first if needed), then call create_document with doctype "proposal" and a data object whose `quotations` array references those quotations by name. Do NOT submit it; link the user to the PDF at `/api/documents/proposal/<name>/pdf` (and the editor at `/app/proposal/<name>`).
+To build one: ensure each offer already exists as its own Quotation (create them first if needed), then call create_document with doctype "proposal" and a data object whose `quotations` array references those quotations by name. Do NOT submit it; call generate_document_pdf with doctype proposal and link the returned download_url (and the editor at `/app/proposal/<name>`).
 
 ### Recurring offer lines (quotation line `frequency`)
 A **Quotation** line item carries an optional `frequency` that controls how it is billed and totalled on the offer:
@@ -2643,9 +2695,11 @@ Use these only for items flagged `is_asset_tracked` on the Item master. Neither
 - **Item vs Asset:** the Item is the *type* ("17t Excavator") and carries the rate and pricing rules. An **Asset** (slug `asset`) is ONE physical unit of it. Three identical machines = one Item + three Assets. Create with `item_code` (required) plus `asset_tag` (plate / serial — optional but must be unique), `warehouse` (its home yard), and optionally `purchase_date`, `purchase_value`, `meter_reading`. `status` is Available / On Hire / Maintenance / Retired — the unit's state *today*, not a date range. Retired units leave the pool.
 - **Opting in:** creating an Asset for an Item that isn't asset-tracked is refused. Fix it by setting `is_asset_tracked` = 1 on the Item via update_master, then retry. Never suggest the user edit the database.
 - **Reservation** (slug `reservation`) books a time window. Required: `from_datetime` and `to_datetime` (`YYYY-MM-DD` or `YYYY-MM-DD HH:MM:SS`; a bare date means midnight). Windows are **half-open** — a hire ending on the 19th and the next starting on the 19th do NOT clash. Two ways to book:
-  - **pooled** — set `item_code`, `warehouse` and `qty`: "*a* machine of this type from that yard". Use this at quotation/order time when the specific unit doesn't matter yet.
+  - **pooled** — explicitly set `allocation_mode="Pool"`; set `item_code`, `warehouse` and `qty`: "*a* machine of this type from that yard". Use this at quotation/order time when the specific unit doesn't matter yet.
   - **unit** — set `asset`: "*that* machine". `item_code`, `warehouse` and `qty` are filled in from the Asset automatically.
-- **Who it's for (do NOT skip this):** set `party` to the hiring customer's id (e.g. `CUST-005`) with `party_type = "Customer"`. The customer is almost always given by NAME — "reserve the 17t for Hans Meisterhans" — so FIRST resolve the name to a record with `search_masters` (master_type "customer") and set `party` to the matched id; never put the raw name in `party`. No match → create the customer (or ask which existing one is meant), then book. A reservation with no `party` is only for an internal block (maintenance, transport, transfer) — if the user named a customer, a booking without `party` set is a bug, not an option.
+- **Choosing a machine:** resolve the Item, then list active, non-discarded Assets and the relevant reservations. If multiple usable units match and the customer has not specified a yard/unit, ask which yard/plate is meant; do not guess and do not silently omit asset. Only create a Pool booking when the user intentionally wants unassigned capacity. A uniquely identified available unit can be booked by asset ID. Asset and reservation warehouse must match; record a transfer first if needed.
+- **Calendar:** Pool bookings appear on separate unassigned rows, not on a specific machine. Always tell the user when no machine is assigned. On a report of a missing booking, get_document and inspect asset, status, discarded and warehouse; do not claim a unit is booked merely because a Reservation exists. Out requires an asset.
+- **Who it's for (do NOT skip this):** set `party` to the hiring customer's id (e.g. `CUST-005`) with `party_type = "Customer"`. The customer is almost always given by NAME — "reserve the 17t for Hans Meisterhans" — so FIRST resolve the name to a record with `search_masters` (master_type "customer") and set `party` to the matched id; never put the raw name in `party`. No match → create the customer (or ask which existing one is meant), then book. A reservation with no `party` is only for an internal block (maintenance, transport, transfer) — if the user named a customer, a booking without `party` set is a bug, not an option. Internal blocks without party require an explicit purpose.
 - `status` is Reserved / Out / Returned / Cancelled. **Reserved and Out block the calendar; Returned and Cancelled do not** — so a hire that comes back early frees its slot the moment you set it to Returned. Link a booking to the order that caused it with `voucher_type` + `voucher_no`.
 - **Double-booking is refused at save time.** If you get "already committed" (that unit is taken) or "free at" (the yard's pool is exhausted for that window), do NOT retry blindly — report the conflict, then offer the alternatives: different dates, a different yard, or a different model.
 - To answer "what's free between X and Y", list reservations for the item over the window and compare against the Assets that exist; a unit with no overlapping Reserved/Out row is available.
@@ -3439,6 +3493,7 @@ async def run_thinking_loop(
     # immediately affects resource-aware handlers as well as the shared policy.
     principal_ref = [user_info]
     tool_handlers = dict(TOOL_HANDLERS)
+    tool_handlers["generate_document_pdf"] = lambda args: _handle_generate_document_pdf(args, principal_ref[0])
     # delete_master needs the caller's role (admin-only) — scoped here rather
     # than in TOOL_HANDLERS, whose handlers are called with (args) only.
     tool_handlers["delete_master"] = lambda args: _handle_delete_master(args, principal_ref[0])
@@ -3621,6 +3676,8 @@ async def run_thinking_loop(
             tool_call_id = tc.id
 
             await on_event({"type": "tool_call", "tool": fn_name, "args": fn_args})
+            if session_id:
+                _save_tool_trace(session_id, "tool_call", {"tool": fn_name, "args": fn_args})
 
             # LLM turns can run for many seconds. Re-resolve the principal at
             # the actual execution boundary so a demotion, disable, or key
@@ -3656,7 +3713,7 @@ async def run_thinking_loop(
             else:
                 try:
                     result = await asyncio.to_thread(handler, fn_args)
-                    success = True
+                    success = not (isinstance(result, dict) and ("error" in result or result.get("ok") is False or result.get("failed", 0)))
                 except Exception as e:
                     result = {"error": str(e)}
                     success = False
@@ -3677,6 +3734,10 @@ async def run_thinking_loop(
                 "success": success,
                 "summary": summary,
             }
+            if isinstance(result, dict):
+                event_payload["warnings"] = (result.get("_validation") or {}).get("warnings", [])
+                if not success:
+                    event_payload["error"] = result.get("error") or "One or more operations failed; inspect the tool result."
             # Surface the report id so the sidebar can flash the specific draft.
             if (
                 success
@@ -3685,6 +3746,12 @@ async def run_thinking_loop(
                 and result.get("id")
             ):
                 event_payload["report_id"] = result["id"]
+            if fn_name == "generate_document_pdf":
+                event_payload["document_request"] = {key: fn_args.get(key) for key in ("doctype", "name")}
+            if success and fn_name == "generate_document_pdf" and isinstance(result, dict) and result.get("artifact_id"):
+                event_payload["document"] = result
+            if session_id:
+                _save_tool_trace(session_id, "tool_result", {**event_payload, "result": result})
             await on_event(event_payload)
 
             messages.append({
@@ -3875,8 +3942,15 @@ async def run_session_turn(
 
     messages.extend(conversation)
 
+    generated_files = []
+
+    async def pdf_events(event):
+        if event.get('type') == 'tool_result' and event.get('tool') == 'generate_document_pdf' and event.get('success') and event.get('document'):
+            generated_files.append(event['document'])
+        await on_event(event)
+
     await run_thinking_loop(
-        messages, on_event,
+        messages, pdf_events,
         session_id=session_id,
         user_info=user_info,
         client_ip=client_ip,
@@ -3886,6 +3960,20 @@ async def run_session_turn(
     for msg in reversed(messages):
         if msg.get("role") == "assistant" and msg.get("content"):
             assistant_content = msg["content"]
+            allowed_urls = {d[key] for d in generated_files for key in ('download_url', 'pdf_url')}
+            pdf_pattern = r"/api/(?:v1/)?documents/[^\s`<>)]*/pdf(?:\?[^\s`<>)]*)?"
+            ungenerated = []
+            def verified_link(match):
+                if match.group(0) in allowed_urls:
+                    return match.group(0)
+                ungenerated.append(match.group(0))
+                return '[PDF not generated]'
+            assistant_content = re.sub(pdf_pattern, verified_link, assistant_content)
+            if ungenerated:
+                event = {'type': 'tool_result', 'tool': 'generate_document_pdf', 'success': False,
+                         'error': 'The reply referenced a PDF that was not generated. Generate the file before offering it.', 'warnings': [], 'document_request': {'doctype': None, 'name': None}}
+                await on_event(event)
+                _save_tool_trace(session_id, 'tool_result', event)
             save_chat_message(session_id, "assistant", assistant_content)
             if on_assistant_message:
                 await on_assistant_message(session_id, assistant_content)

{lambda_erp-0.8.33 → lambda_erp-1.0.0}/api/errors.py

@@ -63,10 +63,23 @@ def _friendly_integrity(msg: str) -> str:
 
 
 async def _integrity_handler(request: Request, exc: Exception):
+    msg = str(exc)
+    code = getattr(exc, 'sqlstate', None)
+    if code == '23502' or 'NOT NULL constraint failed:' in msg:
+        column = getattr(getattr(exc, 'diag', None), 'column_name', None)
+        if not column and 'NOT NULL constraint failed:' in msg:
+            column = msg.split('NOT NULL constraint failed:', 1)[1].strip()
+        return JSONResponse(status_code=422, content={'detail': f'{column or "A required field"} is required'})
+    if code == '23503' or 'foreign key constraint failed' in msg.lower():
+        return JSONResponse(status_code=422, content={'detail': "This links to a record that does not exist or is still referenced."})
     return JSONResponse(status_code=409, content={"detail": _friendly_integrity(str(exc))})
 
 
 def register_exception_handlers(app: FastAPI):
+    from api.pdf_contract import PDFError
+    async def pdf_error_handler(request, exc):
+        return JSONResponse(status_code=422, content={"detail": {"code": exc.code, "message": str(exc), "fields": exc.fields}})
+    app.add_exception_handler(PDFError, pdf_error_handler)
 
     @app.exception_handler(ValueError)
     async def value_error(request: Request, exc: ValueError):

{lambda_erp-0.8.33 → lambda_erp-1.0.0}/api/main.py

@@ -61,6 +61,9 @@ async def lifespan(app: FastAPI):
     from api.services import apply_plugin_schema
     apply_plugin_schema()
 
+    from api.pdf_profiles import validate_pdf_registry
+    validate_pdf_registry()
+
     # Ensure the demo spend log table exists before any LLM call happens.
     from api.demo_limits import init_schema as init_demo_spend_schema
     init_demo_spend_schema()