The web platform with nothing to hide.
One monorepo — framework, office libraries, cryptography and tooling. Zero npm runtime dependencies. No bundler required. All of it readable.
The uncomfortable pitch
Modern web development ships hundreds of transitive packages nobody has read — glued by a bundler nobody can explain, updated by bots, trusted by default. We think that era is ending, and European regulators agree (CRA, NIS2 have entered the chat).
awa is the counter-bet: a complete web stack written in one workshop.
- Framework & tooling — DI factories, components, routing, a dev server with HMR. Plain ES modules resolved by import maps. Apache-2.0.
- Office libraries — read and write PDF 2.0 (PDF/A, PDF/UA-2, PAdES signatures, encryption, redaction), OOXML, ODF, Markdown — entirely in the browser. No conversion server. AGPL / commercial.
- Cryptography — X25519, Ed25519, AES-GCM, and post-quantum ML-KEM, ML-DSA, SLH-DSA — every primitive run against the official NIST ACVP vectors by the test suite. Apache-2.0.
What "zero dependencies" actually buys you
- Your SBOM is the repo. Not 800 mutating lines — the actual code you ship.
- Air-gap deployable. No registry, no bundler, no phone-home. If your network is isolated, awa doesn't care.
node_modulesweather doesn't exist here. No supply-chain Tuesdays, no peer-dependency archaeology.- You can read it. All of it. That's not a slogan; it's the security model.
What it costs
The framework, its tooling and the crypto primitives are Apache-2.0 — free forever, commercial use included. The office libraries are AGPL: also free, if you share your source. Proprietary product? There's a straightforward commercial license, per application, with unlimited developers and deployment. That revenue is what keeps this stack maintained — we'd rather tell you that on the home page than surprise you later.
Made in the EU, provable
Developed and maintained in France. No third-party service, registry or cloud in the runtime code path, zero telemetry — and the compliance receipts (CRA, NIS2, DORA, eIDAS) are being written against the code itself, in the open: follow them as they land. If sovereignty matters to your customers, it stops being a slide and starts being a grep.
Try something real
- Sign a PDF in your browser — then open the network tab. Nothing left your machine. That's the product.
- Turn a Word or OpenDocument file into Markdown — in your browser
- Write Markdown, get a web page
awa, by AwaCloud. One codebase, honestly licensed. Star it, fork it, audit it — that last one especially.