@taprootio/espalier 2.0.0

package/licenses/README.md

@@ -0,0 +1,66 @@
+# Espalier Commercial Licensing Drafts
+
+These files are draft business/legal documents for attorney review. They are
+intended to support a proprietary public package containing compiled and
+obfuscated Espalier artifacts, without publishing source code.
+
+They are not legal advice and should not be used with customers or partners
+until reviewed and adapted by qualified IP and technology-transactions counsel.
+
+## Documents
+
+- `ESPALIER_PROPRIETARY_BINARY_LICENSE.md` - default license for the public
+  compiled package and for paid production use by direct enterprise customers.
+- `ESPALIER_ENTERPRISE_ORDER_FORM_TEMPLATE.md` - short commercial order form to
+  pair with the binary license for direct customers.
+- `ESPALIER_STRATEGIC_PARTNER_LICENSE_TERM_SHEET.md` - draft terms for a
+  strategic enterprise reseller/OEM/private-label deal with a $3M+ annual
+  minimum guarantee.
+- `ESPALIER_SOURCE_ESCROW_ADDENDUM.md` - source escrow terms for enterprise
+  reassurance without giving source away in the ordinary case.
+- `ESPALIER_SOURCE_SNAPSHOT_PURCHASE_TERM_SHEET.md` - draft terms for a
+  $20M+ one-time source snapshot transaction while preserving Taproot's
+  continuing ownership and future development rights unless counsel negotiates
+  a broader sale.
+- `ESPALIER_DEAL_READINESS_CHECKLIST.md` - practical readiness checklist for
+  lawyer review, diligence, packaging, and outreach.
+- `THIRD_PARTY_NOTICES.md` - third-party open-source notices for materials
+  copied into Espalier distribution artifacts, including Tabler Icons.
+- `asset-provenance.json` and `ASSET_PROVENANCE.md` - machine-readable and
+  human-readable provenance records for generated fonts, icons, textures, demo
+  datasets, and docs assets.
+- `open-source-audit/` - preserved dependency/license audit material for
+  open-source diligence, SBOM planning, and third-party notice review.
+
+## Commercial Position
+
+The intended positioning is:
+
+1. Espalier source remains private.
+2. The public package ships compiled, obfuscated runtime artifacts, declarations,
+   docs, and machine-readable manifests.
+3. Public package access permits limited evaluation only unless a paid order
+   form grants production rights.
+4. Strategic exclusivity is expensive, narrow, time-limited, and performance
+   based.
+5. Source escrow is available for enterprise continuity protection.
+6. A source snapshot transaction starts at $20M+ and does not include future
+   Espalier versions, trademark ownership, or Taproot business assets unless
+   specifically negotiated.
+
+## Counsel Review Notes
+
+Ask counsel to review at least:
+
+- enforceability of clickwrap/browsewrap/package license acceptance for the
+  intended npm/GitHub distribution path
+- whether evaluation use should require account gating or a click-through flow
+- reverse-engineering language and any statutory limits
+- export controls and sanctions language
+- warranty, indemnity, and liability caps for enterprise customers
+- source escrow release conditions
+- reseller/OEM sublicensing mechanics
+- exclusivity termination and minimum guarantee structure
+- tax, revenue-recognition, and accounting treatment of prepaid guarantees
+- trademark licensing and quality-control language
+- treatment of third-party dependencies and open-source notices

package/licenses/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,36 @@
+# Third-Party Notices
+
+This file preserves notices for third-party open-source materials included in
+or substantially copied into Espalier distribution artifacts.
+
+## Tabler Icons
+
+Espalier includes SVG icon paths adapted from Tabler Icons in `assets/icons.svg`
+and related inline SVG modules.
+
+- Project: Tabler Icons
+- Upstream: https://github.com/tabler/tabler-icons
+- License: MIT License
+- Copyright: Copyright (c) 2020-2026 Paweł Kuna
+
+MIT License
+
+Copyright (c) 2020-2026 Paweł Kuna
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/licenses/asset-provenance.json

@@ -0,0 +1,193 @@
+{
+  "schemaVersion": 1,
+  "updatedAt": "2026-06-17",
+  "entries": [
+    {
+      "id": "google-font-preview-assets",
+      "paths": [
+        "css/fonts/**"
+      ],
+      "assetType": "generated font preview assets",
+      "classification": "third-party-generated",
+      "owner": "Google Fonts contributors; preview subset CSS generated by Taproot",
+      "source": "Google Fonts Webfonts API and google/fonts repository METADATA.pb files",
+      "license": "Per-family open font licenses recorded in licenses/GOOGLE_FONTS_NOTICES.md",
+      "transformations": [
+        "Fetch Google Fonts CSS for each family preview subset",
+        "Embed fetched WOFF2 subset as base64 data URL in local CSS",
+        "Record source metadata links and per-family notices in licenses/GOOGLE_FONTS_NOTICES.md"
+      ],
+      "packageInclusion": "included in npm package",
+      "docsInclusion": "used by esp-font-picker demos and local preview CSS",
+      "noticeRequirement": "required",
+      "noticePaths": [
+        "licenses/GOOGLE_FONTS_NOTICES.md"
+      ],
+      "reviewStatus": "manifest-gated"
+    },
+    {
+      "id": "tabler-svg-sprite",
+      "paths": [
+        "assets/icons.svg"
+      ],
+      "assetType": "SVG sprite",
+      "classification": "mixed third-party and Taproot-owned",
+      "owner": "Tabler Icons contributors for adapted symbols; Taproot for taproot-logo symbol",
+      "source": "Tabler Icons SVG paths plus Taproot-owned logo geometry",
+      "license": "MIT for Tabler-derived symbols; Taproot-owned for Taproot brand geometry",
+      "transformations": [
+        "Converted selected SVG icons into <symbol> entries",
+        "Normalized currentColor usage and sprite ids",
+        "Added Taproot-owned taproot-logo symbol"
+      ],
+      "packageInclusion": "not included in npm package",
+      "docsInclusion": "copied to public docs assets by Eleventy and referenced by examples",
+      "noticeRequirement": "required",
+      "noticePaths": [
+        "licenses/THIRD_PARTY_NOTICES.md"
+      ],
+      "reviewStatus": "documented"
+    },
+    {
+      "id": "inline-svg-modules",
+      "paths": [
+        "calendar-icon.ts",
+        "cancel.ts",
+        "caret-right.ts",
+        "caret-up-down.ts",
+        "check.ts",
+        "checkbox-checked.ts",
+        "checkbox-indeterminate.ts",
+        "checkbox-unchecked.ts",
+        "comment.ts",
+        "filter.ts",
+        "left-arrow.ts",
+        "plus.ts",
+        "radio-selected.ts",
+        "radio-unselected.ts",
+        "render-sprite-icon.ts",
+        "right-arrow.ts",
+        "trash.ts",
+        "upload.ts"
+      ],
+      "assetType": "inline SVG templates",
+      "classification": "mixed third-party and Taproot-authored",
+      "owner": "Tabler Icons contributors for adapted icon geometry; Taproot for rendering helpers",
+      "source": "Tabler-style SVG icon geometry and Taproot-authored Lit templates",
+      "license": "MIT for Tabler-derived icon geometry; Taproot-owned source for helpers",
+      "transformations": [
+        "Converted icon paths into Lit html/svg template modules",
+        "Normalized stroke, fill, and currentColor behavior for component use"
+      ],
+      "packageInclusion": "compiled into npm package JavaScript",
+      "docsInclusion": "referenced by component demos and source examples",
+      "noticeRequirement": "required",
+      "noticePaths": [
+        "licenses/THIRD_PARTY_NOTICES.md"
+      ],
+      "reviewStatus": "documented"
+    },
+    {
+      "id": "taproot-brand-assets",
+      "paths": [
+        "assets/apple-touch-icon.png",
+        "assets/espalier-logo.svg",
+        "assets/favicon-96x96.png",
+        "assets/favicon.ico",
+        "assets/favicon.svg"
+      ],
+      "assetType": "brand marks and favicons",
+      "classification": "Taproot-owned",
+      "owner": "Taproot",
+      "source": "Taproot-created Espalier logo and derived favicon exports",
+      "license": "Taproot-owned proprietary brand assets",
+      "transformations": [
+        "Exported favicon and touch-icon raster variants from Taproot-owned logo artwork"
+      ],
+      "packageInclusion": "not included in npm package",
+      "docsInclusion": "copied to public docs assets by Eleventy and used by the docs shell",
+      "noticeRequirement": "none",
+      "noticePaths": [],
+      "reviewStatus": "documented"
+    },
+    {
+      "id": "generated-demo-textures",
+      "paths": [
+        "assets/espalier-geometric-texture.png",
+        "assets/espalier-paper-texture.png"
+      ],
+      "assetType": "demo background textures",
+      "classification": "generated Taproot-owned",
+      "owner": "Taproot",
+      "source": "Generated with the Codex built-in image generation tool for this repository on 2026-06-17",
+      "license": "Taproot-owned generated assets for Espalier documentation examples",
+      "transformations": [
+        "Generated original seamless-style raster texture prompts",
+        "Copied selected PNG outputs into assets/",
+        "Replaced unproven Transparent Textures-derived example files"
+      ],
+      "packageInclusion": "not included in npm package",
+      "docsInclusion": "copied to public docs assets by Eleventy and referenced by component examples",
+      "noticeRequirement": "none",
+      "noticePaths": [],
+      "reviewStatus": "documented"
+    },
+    {
+      "id": "demo-grid-data",
+      "paths": [
+        "assets/data/grid-data.json"
+      ],
+      "assetType": "demo JSON dataset",
+      "classification": "Taproot-authored sample data",
+      "owner": "Taproot",
+      "source": "Deterministic fictitious sample records authored for Espalier demos",
+      "license": "Taproot-owned sample data",
+      "transformations": [
+        "Generated from fixed local name, street, and reserved example.test email token lists"
+      ],
+      "packageInclusion": "not included in npm package",
+      "docsInclusion": "copied to public docs assets by Eleventy and loaded by grid examples",
+      "noticeRequirement": "none",
+      "noticePaths": [],
+      "reviewStatus": "documented"
+    },
+    {
+      "id": "demo-tree-data",
+      "paths": [
+        "assets/data/tree-library-children.json"
+      ],
+      "assetType": "demo JSON dataset",
+      "classification": "Taproot-authored sample data",
+      "owner": "Taproot",
+      "source": "Hand-authored fictitious tree navigation sample for Espalier demos",
+      "license": "Taproot-owned sample data",
+      "transformations": [
+        "None beyond JSON formatting"
+      ],
+      "packageInclusion": "not included in npm package",
+      "docsInclusion": "copied to public docs assets by Eleventy and loaded by tree examples",
+      "noticeRequirement": "none",
+      "noticePaths": [],
+      "reviewStatus": "documented"
+    },
+    {
+      "id": "css-named-color-data",
+      "paths": [
+        "assets/data/color-names.json"
+      ],
+      "assetType": "reference JSON data",
+      "classification": "standards-derived factual data",
+      "owner": "CSS Working Group specification authors for the standard; JSON compilation by Taproot",
+      "source": "CSS named color keywords and sRGB values from the CSS Color specification",
+      "license": "Factual interoperability data compiled by Taproot",
+      "transformations": [
+        "Serialized CSS named color keywords and hex values as JSON for documentation examples"
+      ],
+      "packageInclusion": "not included in npm package",
+      "docsInclusion": "copied to public docs assets by Eleventy and loaded by color guide examples",
+      "noticeRequirement": "none",
+      "noticePaths": [],
+      "reviewStatus": "documented"
+    }
+  ]
+}

package/licenses/open-source-audit/2026-05-30-dependency-license-audit.md

@@ -0,0 +1,180 @@
+# Espalier Dependency and License Audit
+
+**Audit date:** 2026-05-30
+**Repository:** `taproot-controls`
+**Package version audited:** `@taprootio/espalier@1.162.0`
+**Audit status:** Engineering draft for legal/commercial diligence
+
+This audit preserves the open-source dependency/license position for Espalier's
+commercial licensing work. It is not legal advice.
+
+## Executive Summary
+
+Espalier has an unusually small runtime dependency footprint for an enterprise
+front-end framework:
+
+- 1 direct runtime dependency: `@lit-labs/virtualizer`
+- 1 required peer dependency: `lit`
+- Runtime/peer dependency graph licenses found: BSD-3-Clause, MIT, and 0BSD
+- No GPL, LGPL, AGPL, SSPL, source-available, noncommercial, or unknown
+  licenses were found in the runtime/peer graph
+- Direct dev dependencies are also permissively licensed
+- Espalier also includes SVG icon paths adapted from Tabler Icons, which is MIT
+  licensed; the required notice is preserved in `licenses/THIRD_PARTY_NOTICES.md`
+- Installed package snapshot contained 421 unique third-party packages
+  excluding Espalier itself, with no unknown licenses found
+
+This strengthens Espalier's strategic-license position. A small runtime graph
+reduces procurement friction, security-review surface area, third-party notice
+complexity, and license-contamination concerns. For enterprise buyers, the
+runtime story is the commercial headline; the dev/build graph still belongs in
+diligence.
+
+## Do Dev Dependencies Count?
+
+Yes, but they count differently.
+
+Dev dependencies usually do not create customer runtime redistribution
+obligations unless their code, assets, generated text, or bundled output are
+copied into the shipped package. They do count for:
+
+- build-chain and supply-chain diligence
+- security scanning and vulnerability management
+- SBOM generation for the build environment
+- reproducibility and provenance of release artifacts
+- license review of generated assets, docs, codegen output, bundled helpers,
+  and distributed CLI/build artifacts
+
+Recommendation: lead with Espalier's tiny runtime/peer dependency graph in
+commercial conversations, and preserve the dev dependency graph in the
+diligence room for procurement and counsel.
+
+## Audit Inputs
+
+The audit was generated from:
+
+- `package.json`
+- installed package metadata under `node_modules/**/package.json`
+- `npm ls --omit=dev --all --json`
+- `npm ls --all --depth=0 --json`
+- `bun pm ls --all`
+- targeted Node metadata scans for declared direct dependencies, runtime
+  transitive dependencies, and installed package license counts
+
+The workspace currently has no `package-lock.json`; `bun.lock` is the lockfile
+present in the repository. Run the final SBOM/audit from a clean install before
+external delivery.
+
+## Copied Asset Notices
+
+Espalier includes SVG icon paths copied or adapted from Tabler Icons in
+`assets/icons.svg` and related inline SVG modules.
+
+| Material | Upstream | License | Notice file |
+|----------|----------|---------|-------------|
+| Tabler Icons SVG paths | https://github.com/tabler/tabler-icons | MIT | `licenses/THIRD_PARTY_NOTICES.md` |
+
+MIT does not require visible in-product attribution, but it does require
+preserving the upstream copyright notice and permission notice in copies or
+substantial portions of the licensed material. Because Espalier redistributes
+copied SVG path data, the notice file should ship with the package.
+
+## Published Package Dependency Surface
+
+| Role | Package | Version observed | License | Notes |
+|------|---------|------------------|---------|-------|
+| Peer dependency | `lit` | `3.3.2` | BSD-3-Clause | Required framework peer for consumers. |
+| Runtime dependency | `@lit-labs/virtualizer` | `2.1.1` | BSD-3-Clause | Used for virtualized list/grid behavior. |
+
+## Runtime / Peer Dependency Graph
+
+| Package | Version observed | License | Source in graph |
+|---------|------------------|---------|-----------------|
+| `@lit-labs/virtualizer` | `2.1.1` | BSD-3-Clause | Direct dependency |
+| `lit` | `3.3.2` | BSD-3-Clause | Peer dependency and transitive dependency of virtualizer |
+| `@lit/reactive-element` | `2.1.2` | BSD-3-Clause | Transitive via `lit` |
+| `lit-element` | `4.2.2` | BSD-3-Clause | Transitive via `lit` |
+| `lit-html` | `3.3.2` | BSD-3-Clause | Transitive via `lit` / `lit-element` |
+| `@lit-labs/ssr-dom-shim` | `1.5.1` | BSD-3-Clause | Transitive via Lit packages |
+| `@types/trusted-types` | `2.0.7` | MIT | Transitive type support via `lit-html` |
+| `tslib` | `2.8.1` | 0BSD | Transitive via `@lit-labs/virtualizer` |
+
+Runtime finding: no copyleft or unknown licenses found.
+
+## Direct Dev Dependency Licenses
+
+| Package | Version observed | License |
+|---------|------------------|---------|
+| `@11ty/eleventy` | `3.1.5` | MIT |
+| `@custom-elements-manifest/analyzer` | `0.10.10` | MIT |
+| `@js-temporal/polyfill` | `0.5.1` | ISC |
+| `@taprootio/wtfm` | `0.12.3` | ISC |
+| `@types/node` | `25.5.2` | MIT |
+| `@vitest/coverage-v8` | `4.1.2` | MIT |
+| `@wc-toolkit/jsdoc-tags` | `1.1.0` | MIT |
+| `concurrently` | `9.2.1` | MIT |
+| `eleventy-plugin-vento` | `5.4.3` | MIT |
+| `eslint` | `9.39.4` | MIT |
+| `eslint-config-prettier` | `10.1.8` | MIT |
+| `eslint-plugin-lit` | `2.2.1` | MIT |
+| `eslint-plugin-wc` | `3.1.0` | MIT |
+| `glob` | `11.1.0` | BlueOak-1.0.0 |
+| `globals` | `17.4.0` | MIT |
+| `happy-dom` | `20.8.9` | MIT |
+| `lit` | `3.3.2` | BSD-3-Clause |
+| `pagefind` | `1.4.0` | MIT |
+| `prettier` | `3.8.1` | MIT |
+| `rolldown` | `1.0.0-rc.13` | MIT |
+| `tslib` | `2.8.1` | 0BSD |
+| `typescript` | `6.0.2` | Apache-2.0 |
+| `typescript-eslint` | `8.58.0` | MIT |
+| `vite` | `6.4.1` | MIT |
+| `vitest` | `4.1.2` | MIT |
+
+Direct-dev finding: all direct dev dependencies are permissively licensed.
+
+## Installed Package License Snapshot
+
+Installed unique third-party packages scanned, excluding Espalier itself: 421.
+
+| License expression | Package count |
+|--------------------|---------------|
+| MIT | 336 |
+| ISC | 26 |
+| BSD-2-Clause | 17 |
+| Apache-2.0 | 16 |
+| BSD-3-Clause | 15 |
+| BlueOak-1.0.0 | 8 |
+| 0BSD | 1 |
+| (MIT OR CC0-1.0) | 1 |
+| Python-2.0 | 1 |
+
+Installed snapshot finding: no unknown licenses found.
+
+## Review Notes
+
+- `BlueOak-1.0.0` is permissive but less familiar to procurement teams than
+  MIT/BSD/Apache. It appears only in the dev/build graph in this snapshot.
+- `Python-2.0` appears for `argparse@2.0.1` in the dev/build graph. Counsel
+  should confirm notice treatment, but this is not a runtime dependency.
+- `npm ls --omit=dev --all --json` reported extraneous local packages in the
+  current `node_modules` directory: `@taprootio/espalier@1.140.5`,
+  `get-tsconfig@4.13.7`, `resolve-pkg-maps@1.0.0`, `tsx@4.21.0`, and nested
+  `esbuild` platform packages. These are not declared in `package.json`; run
+  the final audit/SBOM from a clean install before publishing diligence
+  materials.
+- The public package currently declares `lit` as a peer dependency while
+  `@lit-labs/virtualizer` also depends on `lit`. This is not a license issue,
+  but release packaging should confirm the dependency tree consumers actually
+  receive.
+
+## Recommended Follow-Ups
+
+- Generate a formal SBOM, preferably SPDX or CycloneDX, from a clean install as
+  part of task 068.
+- Include runtime third-party notices with the compiled public package.
+- Add CI release gating that fails on GPL, LGPL, AGPL, SSPL, unknown,
+  noncommercial, or source-available third-party licenses.
+- Re-run this audit after tasks 044, 046, 065, and 066 because obfuscation,
+  release packaging, React wrappers, and Blazor wrappers may add new
+  dependencies.

package/licenses/open-source-audit/README.md

@@ -0,0 +1,13 @@
+# Espalier Open-Source Audit
+
+This folder preserves dependency and license audit material for Espalier's
+commercial licensing diligence.
+
+Current audit:
+
+- `2026-05-30-dependency-license-audit.md` - dependency footprint, license
+  findings, dev-dependency treatment, caveats, and recommended follow-ups.
+
+These notes are engineering diligence material, not legal advice. Counsel
+should review the final public package, SBOM, and third-party notices before
+customer or partner delivery.

package/notice.cjs

@@ -0,0 +1,30 @@
+/**
+ * Best-effort install-time license notice for @taprootio/espalier.
+ *
+ * Printed on `npm install`. It never fails the install, takes no action, and is
+ * skipped wherever install scripts are disabled (for example
+ * `npm install --ignore-scripts`). It is notice only — using the package is not
+ * contingent on it running.
+ */
+/* global process */
+try {
+  const rule = "-".repeat(68);
+  process.stdout.write(
+    [
+      "",
+      rule,
+      "  @taprootio/espalier is proprietary software — not open source.",
+      "",
+      "  A public npm install grants a 30-day Evaluation license only.",
+      "  Production use requires a paid Order Form.",
+      "",
+      "  Full terms:          the bundled LICENSE file",
+      "  Third-party notices: the bundled licenses/ directory",
+      "  Licensing:           legal@taproot.io",
+      rule,
+      "",
+    ].join("\n") + "\n",
+  );
+} catch {
+  // A notice must never block installation.
+}