# bmp-rewrite

To install dependencies:

```bash
bun install
bun run playwright:install
```

On a minimal Linux VPS, install Chromium's system libraries as well:

```bash
bun run playwright:install-deps
```

To run:

```bash
BMP_DEMO_PASSWORD="choose-a-long-client-demo-password" \
OPENROUTER_API_KEY="..." \
bun run index.ts
```

## Docker deployment

Create a production env file:

```bash
cp .env.example .env
```

Set at least `BMP_DEMO_PASSWORD` and `OPENROUTER_API_KEY` in `.env`. For a public
VPS with automatic HTTPS, also set:

```bash
APP_DOMAIN=demo.example.com
```

Then build and run the app behind Caddy:

```bash
docker compose up -d --build
```

Without `APP_DOMAIN`, Caddy serves the app on plain HTTP port 80 for local or
private-network testing. With `APP_DOMAIN`, Caddy requests and renews TLS
certificates automatically on ports 80 and 443.

Generated extractor outputs, summarizer reports, and the editable template live
in the `bmp_data` Docker volume. Caddy certificates live in `caddy_data`.

The app is password-gated for demos. Set `BMP_DEMO_PASSWORD` before exposing it to
any network. If it is omitted, the server prints a one-time password to the
console for local development only.

Security-related optional settings:

```bash
OPENROUTER_MODEL="openai/gpt-5.4-nano" # only this model is accepted by the API
BMP_MAX_UPLOAD_BYTES=15728640           # default: 15 MB
BMP_MAX_PDF_PAGES=35                    # default: 35 pages
BMP_MAX_ACTIVE_SUMMARY_JOBS=10          # default: 10 active LLM jobs
```

Protected surfaces include uploads, template save/load, summarizer jobs, result
JSON, LLM trace metadata, and generated report downloads. Browser clients use a
session cookie plus CSRF token for unsafe requests.

This project was created using `bun init` in bun v1.3.2. [Bun](https://bun.com) is a fast all-in-one JavaScript runtime.