pdfme is a TypeScript monorepo for template-driven PDF generation and manipulation. In production it does three things: (1) generates PDF bytes from a JSON template plus input data using a plugin-based schema renderer (packages/generator + packages/schemas), (2) ships React widgets — Designer, Form, Viewer — for visually editing templates, filling forms, and previewing output (packages/ui), and (3) exposes a CLI (packages/cli) for headless generation, validation, diagnostics, and PDF conversion, plus a page-manipulation library (packages/manipulator) and an experimental JSX authoring layer (packages/jsx). The low-level PDF engine is a heavily extended, vendored fork of pdf-lib (packages/pdf-lib) with custom AcroForm appearance providers, SVG drawing, and font subsetting; fontkit provides glyph metrics, bwip-js renders barcodes, and @napi-rs/canvas powers Node-side raster conversion. A playground web app and Docusaurus documentation site are included as consumers. The core data flow is: Template + inputs are validated by shared Zod schemas (packages/common), then each schema plugin's pdfRender implementation draws into a pdf-lib document while a dynamic-layout engine computes split ranges, overflow expansion, and table/list pagination across pages. The same Plugin contract (pdf/ui/propPanel/icon) drives both PDF rendering and the WYSIWYG interface, so custom field types register once and work everywhere. Notable engineering: a sandboxed expression evaluator with prototype-pollution and XSS guards (common/expression.ts), SSRF-safe URL fetching with IPv4/IPv6/mapped-address checks (common/helper.ts), a from-scratch UAX #14 line-breaking engine with Japanese kinsoku handling (schemas/text/lineBreak.ts), and a safe inline-Markdown-to-rich-text parser. Weaknesses: the vendored pdf-lib fork contains dormant/commented API stubs and diverges from upstream, image-snapshot tests are brittle across rendering environments, several modules use module-level mutable caches, and some package version pins are aspirational (e.g., TypeScript ^7 in website). Repo-wide version coordination relies on internal packages pinned at 0.0.0 with * workspace deps. Overall the codebase is professional, well-tested (unit, integration, e2e, visual snapshots, security regression tests), actively maintained with CI publishing, and is an application — not a data/research project.
libharu (Haru Free PDF Library) is a cross-platform, open-source C library for programmatically generating PDF files. It provides a comprehensive API covering document creation, page management, text and graphics drawing, image embedding (PNG, JPEG, raw), font handling (Type1, TrueType, CJK), annotations, outlines, encryption, PDF/A conformance, and 3D U3D support. The library is designed as a monolithic C library with a clean object system, custom memory manager, and stream abstraction for I/O. It is used via a C API and has bindings for Python, Ruby, C#, VB.NET, Delphi, FreeBASIC, and others. The codebase is mature but shows its age with some incomplete features (e.g., several PDF operators marked 'not implemented'), manual memory management, and a coding style from the early 2000s. However, it remains functional and is actively maintained with recent commits and CI via GitHub Actions. External dependencies are minimal: zlib (required for compression) and libpng (optional for PNG image loading). The library is suitable for embedding in applications that need to generate PDFs without external tools.
pdfcpu is a comprehensive PDF processing library and command-line tool. It provides a full suite of operations including validation, optimization, encryption, digital signing (PAdES/CAdES), form filling, watermarking, page imposition (booklet, n-up), content extraction, and PDF creation from JSON. The architecture is a monolithic library with a clear separation between a public API layer (`pkg/api/`), CLI command definitions (`pkg/cli/`), core processing logic (`pkg/pdfcpu/`), and a robust validation engine (`pkg/pdfcpu/validate/`). It implements a staged output pattern for safe file writes and a context-based cancellation system. While the feature set and test coverage are exceptional, the codebase is written in a non-standard Go dialect (using `func`, `type`, `var` keywords and a `go 1.25.0` module version), which represents a significant technical drift risk and limits its maintainability by the broader Go ecosystem. Despite this, it contains several genuinely reusable, well-crafted components such as its LZW codec, safe math utilities, path sanitizer, and BER/DER parser.