PDF & Factur-X Generation

Quickstart

Both builtins take the template and data as JSON strings and return the PDF as a base64 string (Soli has no bytes type). Save it with file_write_base64, or return it from a controller.

let template = slurp("pdf/invoice.json")
let data     = JSON.stringify({ "invoice": { "number": "AN-2025-0042" }, "items": [ ... ] })

let pdf = pdf_render(template, data)          # base64 string
file_write_base64("out/invoice.pdf", pdf)

let xml = slurp("pdf/factur-x.xml")           # your EN 16931 CII XML

let pdf = pdf_facturx(template, data, xml, {
  "profile": "en16931",
  "title":   "Invoice AN-2025-0042"
})
file_write_base64("out/invoice.pdf", pdf)     # opens normally AND validates as Factur-X

let invoice = slurp("pdf/invoice.json")       # typed invoice, see below

let pdf = pdf_facturx_from_invoice(template, invoice, { "profile": "en16931" })
file_write_base64("out/invoice.pdf", pdf)     # totals, VAT breakdown and CII XML are computed

Samples

Every sample below is one template file rendered with the engine. The visual language is deliberate: solid colour bands (a filled table-header row) and hairline accent rules (cell borders) carry the identity; body text stays disciplined black. The full templates live in pdf/samples/.

Looking for a finished invoice or quote to start from? Invoice & Quote Templates collects eight ready-to-copy billing documents — compliant and minimal invoices, subscription billing, a credit note, and sectioned or optioned quotes — each with its data file, preview and a playground link.

Modern invoice · Factur-X ready

A full-width teal identity band (fillColor + white textColor), a tinted line-items header, a data-bound rows table, and an accent rule above the total.

Quote · plain PDF

The same engine, a different identity: a charcoal band with an amber accent and a tinted “valid until” strip. Proof the design system flexes by data, not by code.

Letter · plain PDF

Paragraphs, move, and alignment — no tables. A right-aligned dateline, wrapped body, bold sign-off, and a P.S. line of inline rich text mixing italic, monospace, bold, and a link.

Statement · 3 pages

A 60-line statement of account that paginates automatically. The table's column header repeats at the top of every page and the footer counts “Page X of Y”.

Receipt · QR · watermark

Shows the newer primitives: a diagonal PAID watermark, an EPC scan-to-pay QR, an hr rule, a tinted rect panel, and a line accent.

Annual report · 5 pages · charts · tables

The engine at full stretch: a five-page report from one template. A branded cover with an SVG sun mark and a strip of KPI cards; bar, line and pie charts (incl. a grouped multi-series comparison); data-bound P&L and regional tables with a filled header band; a nested list; a running header with a Page X of Y footer; a diagonal CONFIDENTIAL watermark; and a verification QR + barcode. Try it live in the playground.

Dynamic · data-driven

One template, shaped entirely by data. repeat lays out the line items from an array; if/else swaps the PAID banner for BALANCE DUE; unless in_stock adds a backorder note only where needed. No per-row code — the document follows the data. Try it live in the playground.

Template reference · 12 pages · self-documenting

A PDF that documents itself: a branded hero cover with a clickable table of contents (anchor/linkTo + #PAGE_OF# real page numbers), then five chapters. Every feature is a card — a heading, a one-line description, the JSON that declares it, and the result it renders to. Covers paragraph options (underline/strike/color/italic/mono/justify), spans, lists, dashed/rounded rects, both QR kinds + two barcode symbologies, a zebra-striped table with colspan/fill, rich cells + per-table watermark, repeat, if/unless, grouped/stacked/line/pie/donut charts, columns, and the ${...}/#PAGE# tokens (including the $${ literal escape). Try it live in the playground.

…from one call

def create
  let tpl  = slurp("pdf/invoice.json")
  let data = Invoice.find(params["id"]).to_json()
  let pdf  = pdf_render(tpl, data)
  file_write_base64(
    "storage/inv-" + params["id"] + ".pdf",
    pdf
  )
  render("invoices/show")
end

Functions

def download
  let tpl  = slurp("pdf/invoice.json")
  let data = Invoice.find(params["id"]).to_json()
  return pdf_response(tpl, data, { "filename": "invoice-" + params["id"] + ".pdf" })
end

let doc     = pdf_merge([ "cover.pdf", report, "terms.pdf" ])
let excerpt = pdf_pages(doc, "1-3")
let draft   = pdf_stamp(doc, "DRAFT", { opacity: 0.2, color: "cc2222", rotation: 45 })

let xml = pdf_extract_facturx("inbox/supplier-invoice.pdf")
if xml.present?
  let invoice = Xml.parse(xml)   # read totals, VAT, line items…
end

let signed = pdf_sign("contract.pdf", { cert: signer_pem, key: signer_key, reason: "Approved" })
for sig in pdf_verify(received_pdf)
  print("#{sig["field"]}: valid=#{sig["valid"]} by #{sig["signer"]}")
end

Digital signatures · sign · PAdES

Pass a sign option to cryptographically sign the PDF with a detached CMS signature (PAdES baseline, ETSI.CAdES.detached). A reader — Acrobat, Okular, pdfsig — can then confirm who issued the document and that it hasn't been modified since. Signing is in‑process (no external service) and layers on top of everything else, including Factur-X: emit an invoice that is archival (PDF/A‑3b), machine‑readable (EN 16931) and signed in one call.

let pdf = pdf_render(template, data, {
  sign: {
    cert: slurp("config/certs/signer.pem"),   # signer certificate (PEM or path)
    key:  slurp("config/certs/signer.key"),   # private key (PEM or path)
    reason:   "Invoice issued",
    location: "Paris, FR",
    name:     "ACME SARL"
  }
})

# The flagship: archival + machine-readable + signed, in one call.
let pdf = pdf_facturx_from_invoice(template, invoice, {
  sign: { cert: signer_pem, key: signer_key }
})

Produces a PAdES-B-B signature: SHA-256 digest, RSA or ECDSA (P-256), with the standard signed attributes (content-type, message-digest, signing-time, and the ESS signing-certificate-v2 that binds the signature to this exact certificate). It covers the whole document except its own signature value, so any later edit invalidates it.

Trusted timestamp (PAdES-B-T). Add a tsa URL to have the signature timestamped by a Time-Stamp Authority: the signature value is hashed, sent to the TSA, and the returned RFC 3161 token is embedded as an unsigned attribute — independent proof the signature existed at a given time, resilient to the signer's certificate later expiring. tsa: "http://timestamp.digicert.com"

Key handling. Read the certificate and key from files or env — never from request data — and keep the private key out of source control. Soli reads the material you pass and never logs it.

• Incompatible with password — a signed PDF must not be AES-encrypted; choose one.
• The signer certificate must chain to a root the verifier trusts for a "trusted" badge; a self-signed cert still verifies as valid + unmodified, just untrusted.
• A single signature. Long-term-validation (LTV) data — embedded OCSP/CRL for offline verification years later — is a planned follow-up.

Saving & serving

file_write_base64(path, b64) decodes the base64 string and writes the bytes — the natural partner to either builtin.

let pdf = pdf_render(tpl, data)
file_write_base64("storage/invoice.pdf", pdf)

To stream it as a download, return base64 with a PDF content type and let your front-end / proxy decode, or persist then redirect to the file:

def download
  let pdf = pdf_render(slurp("pdf/invoice.json"), Invoice.find(params["id"]).to_json())
  let path = "storage/inv-" + params["id"] + ".pdf"
  file_write_base64(path, pdf)
  redirect("/" + path)
end

Storing a PDF on a model

The builtins return base64, so persisting a generated PDF is a question of where the bytes live — three options, lightest commitment last.

Uploader recommended

Declare an uploader and attach the generated bytes — Soli stores the blob in SoliDB, keeps only its id on the document, and serves it back. No HTTP upload is involved; attach_<field> just needs a file hash.

class Invoice < Model
  uploader("pdf", {
    "multiple":      false,
    "content_types": ["application/pdf"],
    "max_size":      10_000_000,
    "collection":    "invoice_pdfs"
  })

  # Render the Factur-X for this record and file it as the `pdf` attachment.
  def store_pdf(template, invoice_json)
    let pdf = pdf_facturx_from_invoice(template, invoice_json, { "profile": "en16931" })
    this.attach_pdf({
      "data":         pdf,                          # pass base64 as-is — stored as raw bytes (decoded automatically)
      "filename":     "invoice-#{this.number}.pdf",
      "content_type": "application/pdf",
      "size":         Base64.decode(pdf).length()   # raw byte count, for the max_size cap
    })
  end
end

Add uploads("invoices") to config/routes.sl and the file is served at /invoices/:id/pdf; this.pdf_url() returns the link. detach_pdf() removes it, and deleting the record cleans up the blob.

Direct blob storage

Skip the DSL and keep the blob id yourself:

let client  = Solidb(getenv("SOLIDB_HOST"), getenv("SOLIDB_DATABASE"))
let blob_id = solidb_store_blob(client, "invoice_pdfs", pdf,
                                "invoice.pdf", "application/pdf")
invoice.update({ "pdf_blob_id": blob_id })

# read it back (returns base64)
let stored = solidb_get_blob(client, "invoice_pdfs", invoice.pdf_blob_id)

Inline field

Simplest — store the base64 string straight on the document:

invoice.update({ "pdf": pdf })

Fine for small, occasional PDFs. Avoid it when the PDFs are large or you query that collection often: every read of the record carries the full base64 (a 135 KB PDF ≈ 180 KB of text). Blob storage keeps the document lean and the bytes out of band.

Template reference

Document shape

A template has five top-level keys. content is the flow; header/footer repeat on every page.

{
  "fonts":   ["titillium"],          // family to use as the primary text face
  "options": {
    "header_height": 0,              // reserved top band height (pt)
    "margins": { "top": 90, "left": 70, "right": 70, "bottom": 80 }, // pt; or a single number for all sides
    "watermark": { "text": "PAID", "angle": 45, "color": "e8c4c4", "fontSize": 96 }
  },
  "header":  [ /* elements drawn at the top of every page */ ],
  "footer":  [ /* elements drawn at the bottom; may use #PAGE# / #PAGES# */ ],
  "content": [ /* the document flow */ ]
}

All five keys are optional. Lengths are in points (A4 = 595×842 pt; 1 mm ≈ 2.835 pt).

options.page — a preset (a4, letter, legal, a5, a3) or a custom { "width": …, "height": … } in points; options.orientation: "landscape" swaps width/height. Defaults to A4 portrait.

options.background — a page background fill (hex, no #) painted behind every page, beneath any watermark and content. Omit for white paper.

options.backgroundImage — a full-page background image { "src", "pages"?, "opacity"? } (a cover photo / branded page). Drawn stretched to the page, above the background fill and below the watermark/content; pages filters like the watermark. opacity (0–1, default 1) fades it into a soft wash — e.g. 0.15 for a faint stationery tint behind the content.

options.margins — page margins in points: a single number for all four sides, or an object overriding individual sides (unset sides keep the 20 mm default). The top margin is the gap above the header, the bottom margin the gap below the footer; header_height reserves the header band below the top margin. 1 mm ≈ 2.835 pt.

options.watermark draws a diagonal stamp (e.g. PAID, DRAFT) — centered behind the content of every page by default, with layering, position and page-scope all configurable. Fields: text (required), angle (deg, default 45), color (hex, default light grey), fontSize (pt, default 96), fontWeight (default bold), front (draw on top so panels/images can't hide it; default false), x/y (explicit center, pt; default page center), anchor (vertical hint when y is unset: top/center/bottom), and pages ("all"/"first"/"last" or a list like [1, 3]).

"options": { "watermark": { "text": "PAID", "front": true, "anchor": "top", "pages": "first" } }

Per-table watermark. A table element can carry its own watermark (same fields), stamped centered over that table's box and always on top — mark one table PAID/VOID without touching the rest of the page (front/pages are ignored; the stamp follows the table).

{ "type": "table", "data": "items", "rows": [ ... ],
  "watermark": { "text": "PAID", "fontSize": 104, "color": "e8c4c4" } }

Accessible / tagged output · tagged

Set options.tagged: true (with an optional options.lang) to emit a tagged PDF. The renderer wraps each piece of content in marked content with a semantic role and adds the structure assistive tech relies on — a StructTreeRoot, MarkInfo, a ParentTree, per-page StructParents, logical tab order (/Tabs /S), the document /Lang, and an XMP pdfuaid identifier.

"options": { "tagged": true, "lang": "fr-FR" }

Roles come from the template: a bookmarked paragraph (bookmark/bookmarkLevel) becomes H1…H6 (level = bookmarkLevel); any other paragraph is P; an image/qr/barcode is a Figure carrying /Alt from its alt; rules, watermarks, background art and the running header/footer are Artifacts that screen readers skip. Give every meaningful image an alt — a tagged render warns for each one missing it.

Headings, paragraphs, figures, lists (L › LI › LBody) and tables (Table › TR › TD/TH, with a /Scope on header cells) are all mapped to real structure. A tagged document rendered with pdfa (or via pdf_facturx*) validates as both PDF/A-3b and PDF/UA-1 — checked in CI with the veraPDF reference validator.

Tagging composes with PDF/A and Factur-X. Set options.tagged together with the pdfa option (or use pdf_facturx*) and the output carries both the PDF/A-3b (pdfaid) and PDF/UA-1 (pdfuaid) identifiers over a single structure tree — one file that is accessible, archival and (for Factur-X) machine-readable at once.

Elements

Each element in an array has a type. The cursor flows top-down; lengths are in points (A4 is 595×842 pt, default margins 20 mm).

{ "type": "paragraph", "value": "Invoice ${invoice.number}",
  "options": { "alignment": "left|right|center", "fontSize": 24, "fontWeight": "normal|bold", "color": "0f766e" } }

{ "type": "move", "x": 0, "y": 24 }

{ "type": "at", "x": 40, "y": 120, "width": 220, "content": [
  { "type": "box", "fill": "1B3A6B", "padding": 12, "content": [
    { "type": "paragraph", "spans": [ { "text": "Placed here", "color": "FFFFFF" } ] }
  ] }
] }

{ "type": "box", "fill": "F7F9FC", "border": "D7E0EC", "borderWidth": 0.8,
  "radius": 4, "padding": 14, "gap": 16, "content": [
  { "type": "paragraph", "value": "Payment", "options": { "fontWeight": "bold" } },
  { "type": "paragraph", "value": "IBAN ${payment.iban}", "options": { "fontSize": 9 } }
] }

{ "type": "columns", "count": 2, "gap": 22, "content": [
  { "type": "paragraph", "value": "flows down column 1, then into column 2\u2026" },
  { "type": "list", "items": ["lists flow too"] }
] }

{ "type": "page_break" }

{ "type": "image", "value": "https://acme.example/logo.png", "width": 100 }
{ "type": "image", "value": "file://brand/logo.svg", "width": 120, "alt": "Acme logo" }

{ "type": "table", "data": "items",
  "header_columns": [ { "text": "DESCRIPTION", "width": 280, "fontWeight": "bold",
                        "borderSides": { "bottom": "true" } }, ... ],
  "rows": [ [ { "text": "${name}", "width": 280 }, { "text": "${amount}", "alignment": "right" } ] ],
  "options": { "header": { "fillColor": "0F766E", "textColor": "FFFFFF", "borderColor": "0F766E" },
               "stripe": "f1f5f9", "padding_x": 6, "padding_y": 7 } }

{ "type": "table",
  "header_columns": [ { "text": "A", "width": 200 }, { "text": "B", "width": 100 }, { "text": "C", "width": 100 } ],
  "rows": [ [ { "text": "TOTAL DUE", "colspan": 2, "alignment": "right", "fontWeight": "bold" },
              { "text": "2,140.00 EUR", "alignment": "right", "fill": "fef3c7" } ] ] }

{ "type": "hr", "color": "cccccc", "thickness": 0.5 }

{ "type": "rect", "width": 515, "height": 26, "fill": "f4f4f5", "border": "000000", "borderWidth": 0.5 }

{ "type": "line", "dx": 200, "dy": 0, "color": "cccccc", "width": 0.5 }

{ "type": "qr", "kind": "epc",
  "name": "${payment.name}", "iban": "${payment.iban}",
  "amount": "${payment.amount}", "currency": "${payment.currency}",
  "remittance": "${invoice.number}", "width": 110 }

{ "type": "ellipse", "rx": 6, "ry": 6, "fill": "16a34a" }

{ "type": "barcode", "symbology": "code128", "value": "ORDER-${order.id}",
  "width": 220, "height": 56, "humanReadable": true }

{ "type": "list", "ordered": true, "options": { "fontSize": 11 }, "items": [
  "Grind the beans",
  { "text": "Brew", "list": { "items": ["Bloom 30s", "Pour to 250 g"] } }
] }

{ "type": "chart", "kind": "bar", "title": "Revenue by month",
  "data": "months", "label": "name", "value": "revenue", "width": 360, "height": 160 }

{ "type": "chart", "kind": "bar", "data": "quarters", "label": "q", "gridlines": true,
  "values": [ { "field": "fy24", "name": "FY 2024", "color": "94a3b8" },
              { "field": "fy25", "name": "FY 2025", "color": "0f766e" } ],
  "width": 460, "height": 160 }

{ "type": "repeat", "data": "invoices", "content": [
  { "type": "paragraph", "spans": [ { "text": "${number}", "fontWeight": "bold" }, { "text": " — ${customer}" } ] },
  { "type": "hr" } ] }

{ "type": "if", "when": "paid", "equals": "true",
  "content": [ { "type": "paragraph", "value": "PAID IN FULL" } ],
  "else":    [ { "type": "paragraph", "value": "Balance due" } ] }

hr, line, and rect/ellipse borders accept a dash array (pt on/off lengths, e.g. [3, 2]) for dashed strokes; rect accepts a radius (pt) for rounded corners.

Inline rich text

A paragraph may carry spans instead of value to mix weight, size, colour, and inline links within one wrapped flow. Each span inherits the paragraph options for fields it omits; the line height follows the largest span on each line.

{ "type": "paragraph", "options": { "fontSize": 12 }, "spans": [
  { "text": "Amount due: " },
  { "text": "EUR 600.00", "fontWeight": "bold", "color": "0F766E", "fontSize": 16 },
  { "text": "  —  " },
  { "text": "pay now", "link": "https://pay.example/42", "color": "2563eb" },
  { "text": " see ", "italic": true }, { "text": "README", "mono": true }
] }

Span fields: text (required), fontSize, fontWeight, italic (bool), mono (bool — monospace, e.g. for code), color (hex), link (external URL), underline / strike (bool — the stroke follows the span's colour, so a red strike span reads as a redlined price). italic/mono use the matching faces in the font dir (Titillium italics + JetBrains Mono ship by default); a missing face degrades to the nearest available one.

let spans = Markdown.to_spans("Pay **now**, read the `README`, see [docs](https://x).")
let template = { "fonts": ["titillium"],
  "content": [ { "type": "paragraph", "spans": spans } ] }
let pdf = pdf_render(template.to_json(), "{}")

Cells: text & rich

A cell is either a simple text cell, or a rich cell whose content stacks multiple items — text lines and images — vertically in one cell.

{ "content": [
    { "type": "text",  "value": "${company.name}", "fontSize": 12, "fontWeight": "bold" },
    { "type": "text",  "value": "${company.city}", "fontSize": 10 },
    { "type": "image", "value": "file://logo.png", "width": 80 }
  ],
  "width": 200, "alignment": "left",
  "borderSides": { "right": "false", "left": "false", "top": "false", "bottom": "false" } }

Styling & colours

Interpolation

Fonts

No fonts are embedded in the binary — place font files in a font/ folder (the default font_dirs). The template's fonts field names the primary family; its Regular/Bold styles are resolved from the files, and any other loaded font becomes a fallback for characters the primary can't cover (e.g. a CJK font for こんにちは). Characters no loaded font covers are dropped with a warning, keeping the PDF valid.

font/
  TitilliumWeb-Regular.ttf
  TitilliumWeb-Bold.ttf
  NotoSansJP-Regular.ttf   # optional CJK fallback

Payment QR · scan-to-pay

A qr element renders a QR code as a raster image (square, side = width pt). Two kinds:

Invalid input (non-EUR, missing IBAN, over-long fields) is skipped with a warning, never fatal. With pdf_facturx_from_invoice, a ready-made payment block is exposed in the render data — give the seller an iban (and optional bic) and bind the QR straight to it:

{ "type": "qr", "kind": "epc",
  "name": "${payment.name}", "iban": "${payment.iban}", "bic": "${payment.bic}",
  "amount": "${payment.amount}", "currency": "${payment.currency}",
  "remittance": "${payment.remittance}", "width": 110 }

payment.amount is the amount due with no currency symbol (e.g. 600.00), payment.currency the ISO code, and payment.remittance the invoice number.

Factur-X & PDF/A-3b

The profile sets the embedded file's /AFRelationship and the XMP fx:ConformanceLevel; it should match your XML's BT-24 guideline id. Default is EN 16931.

Validate the output with the two standard gates:

# PDF/A-3b structure, fonts, OutputIntent, XMP
verapdf -f 3b invoice.pdf            # → PASS, 146/146 rules

# Factur-X XML + profile (XSD + Schematron)
java -jar Mustang-CLI.jar --action validate --source invoice.pdf

Typed invoice document

pdf_facturx_from_invoice takes a typed invoice instead of separate data + XML. Totals and the VAT breakdown are computed from the lines and the document-level allowances/charges, then mapped onto the template (invoice.*, company.* = seller, customer.* = buyer, items[], discounts[], charges[], total.*, infos.text) and emitted as CII XML.

{
  "number": "#12345",
  "issue_date": "2025-11-28",
  "due_date": "2025-12-28",
  "currency": "EUR",
  "note": "Thank you for your business.",
  "seller": {
    "name": "PDFx", "address_line": "1 Rue des Champs-Élysées",
    "postcode": "75000", "city": "PARIS",
    "country": "FR", "country_name": "France",
    "phone": "+33 6 12 34 80 32", "vat_id": "FRXX999999999",
    "legal_id": "512 345 679 00017",
    "iban": "FR7630006000011234567890189"
  },
  "buyer": {
    "name": "John Doe", "address_line": "123 Main St",
    "postcode": "12345", "city": "NYC", "country": "US", "country_name": "USA"
  },
  "lines": [
    { "name": "Item 1", "quantity": 1, "unit_price": 100, "vat_rate": 20.0 },
    { "name": "Item 2", "quantity": 2, "unit_price": 200, "vat_rate": 20.0 }
  ],
  "allowances": [
    { "reason": "Volume discount", "percent": 10, "vat_rate": 20.0 }
  ],
  "charges": [
    { "reason": "Shipping", "amount": "20.00", "vat_rate": 20.0 }
  ],
  "payment_terms": "30 days net"
}

Amounts accept a number (100, 100.5) or a numeric string ("100.50") and are kept exact to the cent.

Credit notes. Set "type_code": "381" (or 261 for self-billed): amounts stay positive — in CII the type code carries the semantics, there is no separate credit-note document. The render data exposes invoice.type_code and a ready-made invoice.type_label ("Invoice" / "Credit note") for the template's title line.

Render-data paths. Besides items[], the computed figures land on total.*: total.amount (line total), total.discount (BT-107), total.charges (BT-108), total.taxable (the tax basis, BT-109 — differs from total.amount once allowances/charges exist), total.vat, total.due_amount. Each allowance/charge is also exposed in discounts[] / charges[] as { reason, amount, percent } — bind them with a repeat or a data-bound table for the totals card.

SIREN, SIRET and the French mandate

legal_id fills the legal registration identifier — BT-30 for the seller, BT-47 for the buyer:

"seller": { "legal_id": "512 345 679 00017" },
"buyer":  { "legal_id": "842917361" }

which emits, in the CII party block:

<ram:SellerTradeParty>
  <ram:Name>Meridian Instruments SAS</ram:Name>
  <ram:SpecifiedLegalOrganization>
    <ram:ID schemeID="0009">51234567900017</ram:ID>
  </ram:SpecifiedLegalOrganization>
  ...

The scheme is inferred. A 9-digit value is a SIREN and gets schemeID="0002" (SIRENE); a 14-digit value is a SIRET and gets schemeID="0009". Spaces are stripped, so the readable "512 345 679 00017" travels as the 14 bare digits a routing directory expects. Set legal_id_scheme explicitly for any other ISO 6523 ICD code:

"seller": { "legal_id": "34567890", "legal_id_scheme": "0106" }

A non-numeric value with no explicit scheme — a Dutch "KvK 34567890", say — is emitted as a bare <ram:ID> with no schemeID rather than being tagged with a wrong one. EN 16931 allows that.

Both identifiers also reach the template as company.registration / customer.registration (and company.vat_number / customer.vat_number), so the visual PDF can print the statutory mentions the XML carries. The invoice_compliant sample does exactly this — open it in the playground.

Performance

Generation is in-process and CPU-bound — no browser to spawn. The numbers below load-test a controller action that renders a real invoice (the Quote sample) on every request, measured with oha on a release build (16 cores). /health is the bare-framework baseline, to show the overhead is the PDF, not the HTTP path.

def pdf_bench
  let pdf = pdf_render(slurp("pdf/template.json"), slurp("pdf/data.json"),
                       { "fetch_images": false })
  return { "status": 200, "headers": {"Content-Type": "text/plain"},
           "body": "generated " + len(pdf) + " base64 bytes" }
end

oha -n 6000 -c 50 http://127.0.0.1:8080/pdf-bench
#   Requests/sec: 9423   ·   p50 5 ms   ·   p99 9 ms   ·   100% success

Each embedded face is subset to the glyphs actually used before embedding, so a typical invoice weighs ~30 KB and a CJK invoice drops from multiple MB to a few hundred KB — which is also why throughput is high (there's little font data to compress per request). The CJK fallback is only loaded when a document needs it.