@broadpaper/server 0.1.1

package/Dockerfile

@@ -0,0 +1,22 @@
+# BroadPaper render service.
+#
+# The browserless engine is WebAssembly, so this is a plain Node image with no
+# browser in it: ~150 MB against the ~1.5 GB a Playwright base costs, and it
+# starts in milliseconds rather than seconds. Report data never leaves your
+# network — there is no BroadPaper endpoint for it to be sent to.
+FROM node:22-alpine
+WORKDIR /app
+ENV NODE_ENV=production PORT=4780
+
+COPY package.json ./
+COPY dist ./dist
+RUN npm install --omit=dev --ignore-scripts && npm cache clean --force
+
+# Never as root: this process parses documents supplied by callers.
+USER node
+EXPOSE 4780
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=5s \
+  CMD node -e "fetch('http://localhost:'+(process.env.PORT||4780)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "dist/cli.js"]

package/LICENSE

@@ -0,0 +1,143 @@
+BroadPaper — Software Licence
+
+Copyright (c) 2026 Codingbadger Creative Limited, trading as BroadPaper.
+Registered in England and Wales, company number 16896863.
+hello@broadpaper.com
+
+This is proprietary software, not open source. It is free to evaluate, with
+every feature enabled and no trial clock, and requires a paid Licence for
+production use. The full agreement is the Terms and Conditions at
+https://www.broadpaper.com/legal/terms/ ; this notice is the part of it you need
+in the package, and where the two differ, those Terms prevail.
+
+Version of 9 September 2026.
+
+
+1. DEFINITIONS
+
+"Software" means the BroadPaper packages published by us — @broadpaper/core,
+@broadpaper/blocks, @broadpaper/renderer, @broadpaper/forme, @broadpaper/pdf,
+@broadpaper/server, @broadpaper/license, @broadpaper/editor, @broadpaper/react,
+@broadpaper/angular and BroadPaper.Client — together with their documentation
+and updates.
+
+"Licence" means a signed licence certificate we have issued to your
+Organisation, and the rights granted with it. A Licence belongs to the
+Organisation, not to an individual.
+
+"Product" means an application your Organisation builds that incorporates the
+Software.
+
+"Internal User" means someone who works for your Organisation: an employee, an
+officer, or a contractor engaged by you and working under your direction.
+"External User" means anyone else, including your customers, their staff, your
+partners and the public.
+
+"Licence Year" means the twelve months from the date a paid Licence is issued
+or renewed.
+
+
+2. EVALUATION
+
+You may install and use the Software free of charge, worldwide and
+non-exclusively, for development, testing and evaluation. Every feature is
+enabled, nothing expires, and there is no limit on how long you take.
+
+Documents generated without a paid Licence carry a visible BroadPaper
+evaluation mark. This grant does not permit production use, whether or not you
+charge for it and whether or not the mark is present in the output. Removing,
+suppressing or circumventing the mark does not make unlicensed production use
+permitted.
+
+
+3. PAID LICENCES
+
+Subject to payment, we grant your Organisation a non-exclusive,
+non-transferable, worldwide licence to install and use the Software in
+Products, in any number of Products and for an unlimited number of users,
+developers, documents and renders. Two types are offered, unlocking identical
+software and differing only in who the resulting Product may be made available
+to:
+
+  Internal    — Products for your Organisation's Internal Users only.
+  SaaS / OEM  — the above, and Products made available to External Users:
+                software you sell, host, embed, ship or otherwise make
+                available outside your Organisation.
+
+Because the Software cannot and does not detect how it is deployed, which type
+you need is determined by the use you actually make of it, not by what the
+software permits.
+
+A Licence runs for the Licence Year. When it ends you may continue to use any
+version of the Software released during a Licence Year you paid for,
+indefinitely and under this notice, but you will receive no further updates or
+support unless you renew, and the Software stops rendering without the
+evaluation mark once the certificate's grace period has passed.
+
+
+4. REDISTRIBUTION
+
+You may redistribute the Software only as a compiled, integrated part of a
+Product. You may not distribute it on its own, offer it as a component for
+others to build with, or make its functionality available as a stand-alone
+report-design service. The end users of your Product do not need their own
+Licence.
+
+
+5. LICENCE CERTIFICATES
+
+A Licence is a cryptographically signed certificate recording your
+Organisation, its Licence type and its expiry date. The Software verifies it
+locally, against a public key compiled into the package, and makes no network
+call to do so.
+
+It is not a secret, and we do not ask you to treat it as one: it may appear in
+your application's configuration, its build and its distributed code. You may
+not share it with anyone outside your Organisation for their own use, alter it,
+or interfere with the Software's licence checking or its evaluation mark.
+
+
+6. RESTRICTIONS
+
+Except as expressly permitted above, you may not: copy, modify, translate or
+create derivative works of the Software beyond what integrating it into your
+Product requires; reverse engineer it beyond what applicable law allows; remove
+any proprietary notice; use it to build a competing report designer; or use it
+in breach of any law, including to generate documents intended to deceive.
+
+We own the Software and everything in it that is not third-party material.
+Nothing here transfers ownership. Your templates, your data, your themes and
+the documents your Product produces are yours; we claim no rights in them and,
+because the Software makes no calls to us, we never receive them.
+
+
+7. THIRD-PARTY COMPONENTS
+
+The Software incorporates third-party components under their own licences.
+These are listed in the THIRD-PARTY-NOTICES.md file distributed with each
+package — including the fonts and Rust crates statically linked into the Forme
+engine, which no dependency manifest reveals. Those licences govern those
+components.
+
+
+8. NO WARRANTY, AND LIABILITY
+
+Except for the limited ninety-day warranty in the Terms, the Software is
+provided "AS IS", without warranty of any kind, express or implied, including
+merchantability, fitness for a particular purpose and non-infringement. We do
+not warrant that the Software is error-free, or that a document it produces
+meets any regulatory or legal requirement that applies to you: that remains
+your responsibility.
+
+To the extent the law allows, we are not liable for any loss of profit,
+revenue, business, data or goodwill, or for any indirect or consequential
+loss. Our total liability in any twelve-month period is limited to the amount
+you paid us in that period, or $100 if you paid nothing. Nothing here limits
+liability for death or personal injury caused by negligence, for fraud, or for
+anything else that cannot be limited by law.
+
+This notice is governed by the law of England and Wales.
+
+
+Questions, and licence purchases: hello@broadpaper.com
+Pricing and the full Terms: https://www.broadpaper.com/legal/terms/

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,255 @@
+# Third-party notices
+
+BroadPaper is built on the work below. This file is generated by
+`scripts/third-party-notices.mjs` from what is actually installed — including
+the contents of the WebAssembly engine, which carries its own dependencies and
+its own fonts inside a single binary. Do not edit it by hand.
+
+It ships inside every published package and beside the demo, because two of the
+licences here require their notice to travel with the software.
+
+## The PDF engine
+
+`@formepdf/core` and `@formepdf/shared` — the browserless layout and PDF engine,
+Rust compiled to WebAssembly. Used unmodified, as an npm dependency.
+
+    MIT License
+
+    Copyright (c) 2026 Daniel Molitor
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+
+## Fonts inside the engine
+
+The engine binary carries complete font files, and subsets of them are embedded
+into any PDF containing a character the standard PDF faces cannot represent — a
+Greek or Cyrillic name, a symbol. Documents produced this way are unrestricted:
+the licence below exempts anything created *with* the font. The notice is
+required because the font software itself travels inside the engine.
+
+### Noto Sans Regular
+
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-greek-cyrillic)
+
+Licensed under the SIL Open Font License, Version 1.1.
+
+Its own declaration, verbatim from the font's name table:
+
+    Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-
+    greek-cyrillic)Noto SansRegular2.015;GOOG;NotoSans-RegularNoto Sans RegularV
+    ersion 2.015; ttfautohint (v1.8.4.7-5d5b)NotoSans-RegularNoto is a trademark
+     of Google LLC.Monotype Imaging Inc.Monotype Design TeamDesigned by Monotype
+     design team, Irene Vlachou.http://www.google.com/get/noto/http://www.monoty
+    pe.com/studioThis Font Software is licensed under the SIL Open Font License,
+     Version 1.1. This license is available with a FAQ at: https://scripts.sil.o
+    rg/OFLhttps://scripts.sil.org/OFLflorin symbolTitling Alternates I and J for
+     titling and all cap settingsAccented Greek SCiota adscrip
+    t
+
+### Noto Sans Bold
+
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-greek-cyrillic)
+
+Licensed under the SIL Open Font License, Version 1.1.
+
+Its own declaration, verbatim from the font's name table:
+
+    Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-
+    greek-cyrillic)Noto SansBold2.015;GOOG;NotoSans-BoldNoto Sans BoldVersion 2.
+    015; ttfautohint (v1.8.4.7-5d5b)NotoSans-BoldNoto is a trademark of Google L
+    LC.Monotype Imaging Inc.Monotype Design TeamDesigned by Monotype design team
+    , Irene Vlachou.http://www.google.com/get/noto/http://www.monotype.com/studi
+    oThis Font Software is licensed under the SIL Open Font License, Version 1.1
+    . This license is available with a FAQ at: https://scripts.sil.org/OFLhttps:
+    //scripts.sil.org/OFLflorin symbolTitling Alternates I and J for titling and
+     all cap settingsAccented Greek SCiota adscrip
+    t
+
+    -----------------------------------------------------------
+    SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+    -----------------------------------------------------------
+
+    PREAMBLE
+    The goals of the Open Font License (OFL) are to stimulate worldwide
+    development of collaborative font projects, to support the font creation
+    efforts of academic and linguistic communities, and to provide a free and
+    open framework in which fonts may be shared and improved in partnership
+    with others.
+
+    The OFL allows the licensed fonts to be used, studied, modified and
+    redistributed freely as long as they are not sold by themselves. The
+    fonts, including any derivative works, can be bundled, embedded,
+    redistributed and/or sold with any software provided that any reserved
+    names are not used by derivative works. The fonts and derivatives,
+    however, cannot be released under any other type of license. The
+    requirement for fonts to remain under this license does not apply
+    to any document created using the fonts or their derivatives.
+
+    DEFINITIONS
+    "Font Software" refers to the set of files released by the Copyright
+    Holder(s) under this license and clearly marked as such. This may
+    include source files, build scripts and documentation.
+
+    "Reserved Font Name" refers to any names specified as such after the
+    copyright statement(s).
+
+    "Original Version" refers to the collection of Font Software components as
+    distributed by the Copyright Holder(s).
+
+    "Modified Version" refers to any derivative made by adding to, deleting,
+    or substituting -- in part or in whole -- any of the components of the
+    Original Version, by changing formats or by porting the Font Software to a
+    new environment.
+
+    "Author" refers to any designer, engineer, programmer, technical
+    writer or other person who contributed to the Font Software.
+
+    PERMISSION & CONDITIONS
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of the Font Software, to use, study, copy, merge, embed, modify,
+    redistribute, and sell modified and unmodified copies of the Font
+    Software, subject to the following conditions:
+
+    1) Neither the Font Software nor any of its individual components,
+    in Original or Modified Versions, may be sold by itself.
+
+    2) Original or Modified Versions of the Font Software may be bundled,
+    redistributed and/or sold with any software, provided that each copy
+    contains the above copyright notice and this license. These can be
+    included either as stand-alone text files, human-readable headers or
+    in the appropriate machine-readable metadata fields within text or
+    binary files as long as those fields can be easily viewed by the user.
+
+    3) No Modified Version of the Font Software may use the Reserved Font
+    Name(s) unless explicit written permission is granted by the corresponding
+    Copyright Holder. This restriction only applies to the primary font name as
+    presented to the users.
+
+    4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+    Software shall not be used to promote, endorse or advertise any
+    Modified Version, except to acknowledge the contribution(s) of the
+    Copyright Holder(s) and the Author(s) or with their explicit written
+    permission.
+
+    5) The Font Software, modified or unmodified, in part or in whole,
+    must be distributed entirely under this license, and must not be
+    distributed under any other license. The requirement for fonts to
+    remain under this license does not apply to any document created
+    using the Font Software.
+
+    TERMINATION
+    This license becomes null and void if any of the above conditions are
+    not met.
+
+    DISCLAIMER
+    THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+    OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+    COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+    INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+    DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+    FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+    OTHER DEALINGS IN THE FONT SOFTWARE.
+
+## Rust crates inside the engine
+
+These 38 crates are statically linked into the engine binary and are
+therefore redistributed with it. The list is read out of the compiled artefact
+rather than from a manifest, so it reflects what is genuinely in there.
+
+- aho-corasick-1.1.4
+- barcoders-2.0.0
+- base64-0.22.1
+- base64ct-1.8.3
+- console_error_panic_hook-0.1.7
+- const-oid-0.9.6
+- der-0.7.10
+- fdeflate-0.3.7
+- hypher-0.1.6
+- image-0.24.9
+- itoa-1.0.17
+- jpeg-decoder-0.3.2
+- memchr-2.8.0
+- miniz_oxide-0.7.4
+- num-bigint-dig-0.8.6
+- num-integer-0.1.46
+- pem-rfc7468-0.7.0
+- png-0.17.16
+- qrcode-0.14.1
+- quick-xml-0.37.5
+- regex-1.12.3
+- regex-automata-0.4.14
+- regex-syntax-0.8.10
+- rsa-0.9.10
+- rustybuzz-0.20.1
+- serde-1.0.228
+- serde-wasm-bindgen-0.6.5
+- serde_core-1.0.228
+- serde_json-1.0.149
+- signature-2.2.0
+- smallvec-1.15.1
+- ttf-parser-0.25.1
+- unicode-bidi-0.3.18
+- unicode-bidi-mirroring-0.4.0
+- unicode-linebreak-0.1.5
+- unicode-properties-0.1.4
+- unicode-script-0.5.8
+- wasm-bindgen-0.2.108
+
+## npm dependencies
+
+Runtime dependencies of the published packages. A consumer installs these from
+npm themselves, under the licences their own packages carry.
+
+| Package | Version | Licence |
+| --- | --- | --- |
+| `@floating-ui/react` | 0.27.20 | MIT |
+| `@formepdf/core` | 0.20.0 | MIT |
+| `@formepdf/shared` | 0.20.0 | MIT |
+| `@noble/ed25519` | 3.2.0 | MIT |
+| `d3-scale` | 4.0.2 | ISC |
+| `d3-shape` | 3.2.0 | ISC |
+| `immer` | 10.2.0 | MIT |
+| `lucide-react` | 0.469.0 | ISC |
+| `pdf-lib` | 1.17.1 | MIT |
+| `prosemirror-commands` | 1.7.2 | MIT |
+| `prosemirror-history` | 1.5.0 | MIT |
+| `prosemirror-keymap` | 1.2.3 | MIT |
+| `prosemirror-model` | 1.25.11 | MIT |
+| `prosemirror-schema-list` | 1.5.1 | MIT |
+| `prosemirror-state` | 1.4.4 | MIT |
+| `prosemirror-view` | 1.42.3 | MIT |
+| `react` | 19.2.8 | MIT |
+| `react-dom` | 19.2.8 | MIT |
+| `tslib` | 2.8.1 | 0BSD |
+| `zod` | 3.25.76 | MIT |
+
+### A note on the Chromium backend
+
+`@broadpaper/pdf` drives headless Chromium through Playwright, which is an
+optional peer dependency: it is absent from the table above because the host
+installs it deliberately, not because the backend stopped needing it.
+`playwright-core` is Apache-2.0, but it *downloads a browser build separately
+at install time*. That browser is covered by nothing here: it carries its own
+licences, several of them, and they are not ours to restate. Anyone shipping an
+image built on that backend needs to carry Chromium's notices too. The
+browserless engine named at the top of this file has no such tail, which is one
+of the reasons it is the recommended backend.
+