@alxia/react-router 0.11.0 → 0.12.1

package/README.md

@@ -255,7 +255,7 @@ for the types.
 
 With `secureHeaders({ nonce: true })` from `@alxia/secure-headers` in
 `configure`, each request's policy names a fresh nonce, and the context
-carries it. `nonceOf(loadContext)` reads it in `entry.server.tsx`, and React
+carries it. `@alxia/react-router/entry` reads it with `nonceOf(loadContext)`, and React
 Router puts it on every script it renders, so `script-src` needs no
 `'unsafe-inline'`:
 
@@ -271,33 +271,192 @@ configure: (app) =>
 	),
 ```
 
-The template has no `entry.server.tsx`; reveal React Router's, then add
-three lines:
+The template has no `entry.server.tsx`; the package's own is one line:
 
-```sh
-bunx react-router reveal entry.server
+```ts
+// app/entry.server.tsx
+export { handleRequest as default, streamTimeout } from '@alxia/react-router/entry';
 ```
 
-```diff
- // app/entry.server.tsx, as reveal writes it
- import { PassThrough } from "node:stream";
-
-+import { nonceOf } from "@alxia/react-router";
- import type { EntryContext, RouterContextProvider } from "react-router";
- …
-     const { pipe, abort } = renderToPipeableStream(
--      <ServerRouter context={routerContext} url={request.url} />,
-+      <ServerRouter context={routerContext} url={request.url} nonce={nonceOf(loadContext)} />,
-       {
-+        nonce: nonceOf(loadContext),
-         [readyOption]() {
-```
+To customise the entry, reveal React Router's and add the nonce yourself
+([an entry of your own](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/csp-nonce.md#an-entry-of-your-own)).
 
 `nonceOf` returns `undefined` when no middleware set a nonce, so the entry works
 with or without secure-headers: neither package depends on the other. Any
 `derive` that returns a string `nonce` works the same.
 [More](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/csp-nonce.md#a-csp-nonce)
 
+## The document: nonce and boot scripts
+
+`@alxia/react-router/document` renders the CSP nonce in the root, on the
+server and in the browser, with `react` as its only import. The nonce comes
+from `secureHeaders({ nonce: true })` ([A CSP nonce](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/csp-nonce.md)).
+The server render provides it around the router; `useNonce()` reads it there,
+and in the browser reads the one the document's scripts carry, so hydration
+finds the attribute it rendered. `InlineScript` is an inline script with
+that nonce, for a theme's boot script, which must run before the first
+paint:
+
+```tsx
+// app/root.tsx
+import { Links, Meta, Outlet, Scripts, ScrollRestoration } from 'react-router';
+import {
+	CspNonceMeta,
+	InlineScript,
+	useNonce,
+} from '@alxia/react-router/document';
+import { themeBootScript } from '<your theme library>';
+
+const THEME_BOOT = themeBootScript();
+
+export function Layout({ children }: { children: React.ReactNode }) {
+	const nonce = useNonce();
+	return (
+		<html lang="en" suppressHydrationWarning>
+			<head>
+				<meta charSet="utf-8" />
+				<InlineScript code={THEME_BOOT} />
+				<CspNonceMeta />
+				<Meta />
+				<Links nonce={nonce} />
+			</head>
+			<body>
+				{children}
+				<ScrollRestoration />
+				<Scripts />
+			</body>
+		</html>
+	);
+}
+
+export default function App() {
+	return <Outlet />;
+}
+```
+
+`THEME_BOOT` is your theme library's own boot script. With `/entry`,
+`<Scripts>` and `<ScrollRestoration>` take the nonce from `<ServerRouter nonce>`
+and need no prop. `<Links>` does not suppress the hydration warning for its
+critical-CSS `<style nonce>` in development, so pass it `useNonce()`, as above;
+`useNonce()` also serves `InlineScript`, `CspNonceMeta` and any script or style
+the app inserts. An entry of your own
+wraps the router:
+
+```tsx
+// app/entry.server.tsx (inside handleRequest)
+import { nonceOf } from '@alxia/react-router';
+import { DocumentNonce } from '@alxia/react-router/document';
+import { ServerRouter } from 'react-router';
+
+<DocumentNonce nonce={nonceOf(loadContext)}>
+	<ServerRouter context={routerContext} url={request.url} />
+</DocumentNonce>;
+```
+
+> The `InlineScript` code is written unescaped: keep it a constant of the
+> app, never user input. It throws a `TypeError` on `</script` or `<!--`
+> ([the message](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/troubleshooting.md#typeerror-inlinescript-the-code-contains-script-or----which-ends-or-confuses-the-script-element-escape-it-such-as-script-inside-a-string)).
+> A nonced page must never be made `public` by a route's `headers` export: a
+> shared cache would hand the same nonce to every visitor.
+
+### The page's language
+
+`createPageLanguage` gives the root the page's language for `<html lang>` and
+a route's `meta`, and `textDirection` the `dir` that goes with it. The server
+side, negotiating the request's language from a cookie and `Accept-Language`,
+is [`@alxia/language`](https://github.com/softistx/alxia/blob/develop/packages/language/README.md):
+
+```ts
+// app/server.ts
+import { language } from '@alxia/language';
+import { createServer } from '@alxia/react-router';
+
+const server = createServer({
+	configure: (app) =>
+		app.use(language({ supported: ['en', 'fr', 'ar'], fallback: 'en', order: ['cookie', 'header'] })),
+});
+export default server;
+declare module '@alxia/react-router' {
+	interface Register { server: typeof server }
+}
+```
+
+```ts
+// app/language.ts: one instance, imported by the root and the routes
+import { createPageLanguage } from '@alxia/react-router/document';
+
+export const { pageLanguage, metaLanguage, chooseLanguage, useChosenLanguage } =
+	createPageLanguage({ languages: ['en', 'fr', 'ar'], fallback: 'en' });
+```
+
+```tsx
+// app/root.tsx
+import { type AlxiaArgs, withAlxia } from '@alxia/react-router';
+import { textDirection } from '@alxia/react-router/document';
+import { useRouteLoaderData } from 'react-router';
+import { metaLanguage, pageLanguage, useChosenLanguage } from './language';
+import type { Route } from './+types/root';
+
+const titles = { en: 'Home', fr: 'Accueil', ar: 'الرئيسية' };
+
+// the root loader returns alxia.language, set by the middleware
+export const loader = withAlxia(({ alxia }: Route.LoaderArgs & AlxiaArgs) => ({ language: alxia.language }));
+
+export function Layout({ children }: { children: React.ReactNode }) {
+	const data = useRouteLoaderData<typeof loader>('root');
+	const language = pageLanguage(data?.language);
+	useChosenLanguage(); // re-renders the shell when the menu picks a language
+	return (
+		<html lang={language} dir={textDirection(language)} suppressHydrationWarning>
+			{/* … */}
+		</html>
+	);
+}
+
+export const meta: Route.MetaFunction = ({ matches }) => [
+	{ title: titles[metaLanguage(matches)] },
+];
+```
+
+- `pageLanguage(language)` is the supported language, else the fallback. In
+  the browser the one picked with `chooseLanguage(language)` wins, and the
+  last one seen stands in when the root's data is gone. On the server it
+  remembers nothing: one module serves every request.
+- `metaLanguage(matches)` reads `matches[0].loaderData.language`.
+- `useChosenLanguage()` is the picked language, or `undefined`; it
+  re-renders on a pick, and is `undefined` in the server render so
+  hydration matches.
+- `textDirection(tag)` is `'rtl'` for `ar`, `fa`, `he`, `ur`, `ps`, `yi`,
+  `dv`, `ckb`, `sd` and `ug` (and the legacy `iw` and `ji`), else `'ltr'`, reading the base tag whatever its
+  case (`ar-EG`, `AR`). A script subtag is not read: `az-Arab` is `'ltr'`.
+- A fallback outside `languages` throws
+  ([the message](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/troubleshooting.md#typeerror-createpagelanguage-the-fallback--is-not-one-of-the-languages-got-)).
+  An error page keeps the root's data, so it keeps the language, except
+  for a URL that matches no route or a root loader that threw: there it
+  shows the last language seen in the browser, or the fallback ([why](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/troubleshooting.md#the-error-page-shows-in-the-fallback-language)).
+
+[More](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/document.md)
+
+## The entry
+
+`@alxia/react-router/entry` is `entry.server.tsx` for an app on Bun, server
+only: it streams the shell, waits for the whole page for a bot and in SPA
+mode, answers HEAD with no body, and gives the router the response's CSP
+nonce (`nonceOf`) and `DocumentNonce`. It renders with the web stream
+renderer, so no `@react-router/node` and no `node:stream`. `react-dom` and
+`isbot` (needed only without an `isBot` option) are optional peers, which React Router's templates install.
+
+```tsx
+// app/entry.server.tsx
+export { handleRequest as default, streamTimeout } from '@alxia/react-router/entry';
+```
+
+To change `streamTimeout`, the nonce, the bot check or the error report,
+`createEntry({ streamTimeout, nonce, isBot, onError })` returns
+`{ handleRequest, streamTimeout }`.
+
+[More](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/document.md#the-entry)
+
 ## WebSockets
 
 A `ws` route in `configure` connects under `react-router dev`, under
@@ -410,6 +569,9 @@ build, it adds:
 - `build.target: 'esnext'`, where Vite's default targets browsers;
 - in the build only, `resolve.noExternal: true`: every package is bundled
   into `build/server/index.js`, so `build/` runs with no `node_modules`.
+- `/entry` and `/document` inlined, in dev by an alias and in the build, so
+  they share the app's `react-router`, even when the package is listed in
+  `ssr.external`.
 
 ```ts
 // app/server.ts: Bun's modules, bundled as they are
@@ -910,6 +1072,25 @@ From `@alxia/react-router/errors` (`react-router` is its only package import, an
 | `useJsonFetcher(key?, action?)`, `JsonBody` | a fetcher that posts JSON: `{ fetcher, post(body, to?), busy }`; `to` is the action of one call |
 | `StandardSchemaV1` | the Standard Schema v1 type `readInput` takes, declared in `/errors` (type only, so no `@alxia/core`; `readInput`'s output is inferred from the schema's `~standard.types`); a Zod 4, Valibot or ArkType schema fits |
 
+From `@alxia/react-router/document`:
+
+| export | |
+| --- | --- |
+| `DocumentNonce({ nonce, children })`, `DocumentNonceProps` | the provider of this response's CSP nonce, for the server render: wrap the router with `nonceOf(loadContext)` in `entry.server.tsx` |
+| `useNonce()` | the page's CSP nonce: the provider's on the server, the first script or `csp-nonce` meta of the `<head>`'s (else the first `script[nonce]`'s) in the browser (read once and cached), `undefined` when there is none |
+| `InlineScript({ code, nonce? })`, `InlineScriptProps` | an inline `<script>` with `nonce ?? useNonce()`; the code is not escaped, so it is a constant of yours, and `</script` or `<!--` in it throws a `TypeError`; no `nonce` attribute when there is no nonce |
+| `CspNonceMeta()` | `<meta property="csp-nonce" nonce>`, the nonce for what a UI library adds at runtime |
+| `createPageLanguage({ languages, fallback, browser? })` | `PageLanguage`: `pageLanguage`, `metaLanguage`, `chooseLanguage`, `useChosenLanguage`, for `<html lang>`, a route's `meta` and a language menu |
+| `PageLanguage`, `PageLanguageOptions` | the types of the instance and of its options |
+| `textDirection(language)` | `'ltr'` or `'rtl'` for `<html dir>`, from the base language |
+
+From `@alxia/react-router/entry`:
+
+| export | |
+| --- | --- |
+| `createEntry({ streamTimeout?, nonce?, isBot?, onError? })`, `EntryOptions`, `Entry` | `/entry`: `{ handleRequest, streamTimeout }` (`Entry`), `entry.server.tsx` for Bun on the web stream renderer |
+| `handleRequest`, `streamTimeout`, `HandleRequest` | `/entry`: the default entry (`createEntry()`), its `5_000` and the type of `handleRequest` (assignable to React Router's `ServerEntryModule['default']`) |
+
 The `alxia-react-router` bin, run with `bunx`:
 
 | command | |
@@ -922,6 +1103,7 @@ The `alxia-react-router` bin, run with `bunx`:
 - [Getting started](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/getting-started.md): a new app, the official template or an existing app.
 - [How it works](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/how-it-works.md): dev, the build and `vite preview`, and what the build sets for Bun.
 - [Customising the server](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/customising-the-server.md): `createServer()`, and the escape hatches.
+- [The document](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/document.md): the CSP nonce in the root, `InlineScript` for a theme's boot script with no flash, `CspNonceMeta`, and the entry.
 - [Typing the loaders](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/typing-the-loaders.md): `Register`, and the app's own context keys.
 - [A CSP nonce](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/csp-nonce.md), [Beside the pages](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/beside-the-pages.md) (middlewares, routes, WebSockets, the client's files), [OpenAPI](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/openapi.md), [Testing](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/testing.md) and [Deploying](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/deploying.md), with Docker.
 - [Installable and offline](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/pwa.md): what the subpaths hold, the worker's contract, the worker, what it caches, the offline page, building the worker with `alxia()` or `buildWorker`, the hooks in React, registering the worker and offering an update, serving the worker's script, the web app manifest, and clearing at sign-out.

package/dist/chunks/index-5rt6hnhn.js

@@ -0,0 +1,42 @@
+// src/context.ts
+import { createContext, RouterContextProvider } from "react-router";
+function singleton(name, make) {
+  const registry = globalThis;
+  const key = Symbol.for(`@alxia/react-router:${name}@1`);
+  registry[key] ??= make();
+  return registry[key];
+}
+var shared = singleton("context", () => {
+  const missing = Symbol("alxia context missing");
+  return { missing, context: createContext(missing) };
+});
+var MISSING = shared.missing;
+var alxiaContext2 = shared.context;
+function alxiaOf2(context) {
+  const value = context.get(alxiaContext2);
+  if (value === MISSING) {
+    throw new Error("alxiaOf(): this request has no alxia context. Serve the React Router app through alxia: add alxia() from @alxia/react-router/vite to vite.config.ts's plugins, or, with a server of your own, serve the build through reactRouter() from @alxia/react-router.");
+  }
+  return value;
+}
+Object.defineProperty(RouterContextProvider.prototype, "alxia", {
+  configurable: true,
+  enumerable: false,
+  get() {
+    return alxiaOf2(this);
+  }
+});
+
+// src/nonce.ts
+function nonceOf2(context) {
+  const value = context.get(alxiaContext2);
+  if (typeof value !== "object" || value === null || !("nonce" in value)) {
+    return;
+  }
+  return typeof value.nonce === "string" ? value.nonce : undefined;
+}
+
+export { alxiaContext2, alxiaOf2, nonceOf2 };
+
+//# debugId=BC95EB0B0221673364756E2164756E21
+//# sourceMappingURL=index-5rt6hnhn.js.map

package/dist/chunks/index-5rt6hnhn.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/context.ts", "../src/nonce.ts"],
+  "sourcesContent": [
+    "/**\n * The key under which `reactRouter()` hands every loader, action and\n * middleware the request's alxia context, and the typed way to read it.\n */\nimport type { Alxia, AnyAlxia, ContextOf, RegisteredBase } from '@alxia/core';\nimport { createContext, RouterContextProvider } from 'react-router';\nimport type { ReactRouterServer } from './server';\n\n/**\n * One value per process, whichever copy of this module asks: the server\n * build bundles `/entry` and the chunk it shares with `.` (see\n * `vite/inline.ts`), and the server imports `.` outside the bundle.\n *\n * The key is shared across versions of this package. Its name ends in a\n * shape version (`@1`): a version that changes what is stored under it bumps\n * the suffix, so two copies of different shapes never read each other's.\n */\nfunction singleton<T>(name: string, make: () => T): T {\n\tconst registry = globalThis as Record<symbol, unknown>;\n\tconst key = Symbol.for(`@alxia/react-router:${name}@1`);\n\tregistry[key] ??= make();\n\treturn registry[key] as T;\n}\n\n/**\n * The key `reactRouter()` sets on React Router's context provider, on every\n * request, to what alxia's middlewares built for it, and its default, the\n * \"missing\" sentinel no catch-all replaced. Both are one pair per process,\n * so that a second copy's `alxiaOf` compares with the sentinel the key holds.\n * It lives in this package, so it is one object whichever way the server was\n * built or loaded: a key made in the app's own `app/` folder is copied into\n * React Router's build, and the server that imports it separately sets a\n * different one.\n */\nconst shared = singleton('context', () => {\n\t// `as never` gives the `unique symbol` type without a `declare const`.\n\tconst missing: unique symbol = Symbol('alxia context missing') as never;\n\treturn { missing, context: createContext<unknown>(missing) };\n});\nconst MISSING = shared.missing;\nexport const alxiaContext = shared.context;\n\n/**\n * Names the server whose context `alxiaOf(context)` reads when given no\n * type argument. One React Router build has one server, so it may be\n * declared once, beside it:\n *\n * ```ts\n * // app/server.ts\n * const server = createServer({ configure: (app) => app.use(session) });\n * export default server;\n *\n * declare module '@alxia/react-router' {\n *   interface Register {\n *     server: typeof server;\n *   }\n * }\n * ```\n *\n * Unregistered here, `alxiaOf(context)` reads the app `@alxia/core`'s own\n * `Register` names as its `context`, and `BaseContext` when neither is\n * declared. When both are, this one wins: the server's app is the whole\n * app the pages run behind, the base's context and all `configure` adds.\n */\n// biome-ignore lint/suspicious/noEmptyInterface: an app augments it\nexport interface Register {}\n\n/** The app a server makes, or the app itself. */\nexport type AppOf<Server> =\n\tServer extends ReactRouterServer<infer App> ? App : Server;\n\n/**\n * What `Register` names when it is neither a server nor an app — the\n * module, say, rather than its default export: an app whose context has\n * nothing but this key, so that reading anything of it is a compile error.\n */\nexport type InvalidRegister = Alxia<\n\t{\n\t\treadonly 'Register.server must be typeof server, the default export of createServer()': never;\n\t},\n\t''\n>;\n\n/**\n * The app `alxiaOf` reads for a `Register` interface: its server's, or\n * `InvalidRegister`; with no server, `Core`, the app `@alxia/core`'s\n * `Register` names (a fresh one when it names none).\n */\nexport type RegisteredOf<\n\tR,\n\tCore extends AnyAlxia = RegisteredBase,\n> = R extends {\n\treadonly server: infer Server;\n}\n\t? Server extends AnyAlxia | ReactRouterServer<AnyAlxia>\n\t\t? AppOf<Server>\n\t\t: InvalidRegister\n\t: Core;\n\n/** What `alxiaOf` reads with no type argument: the registered server's app, else core's registered app, else a fresh one. */\nexport type RegisteredApp = RegisteredOf<Register>;\n\n/**\n * What alxia's middlewares built for this request, read in a loader, an action or\n * a middleware, typed by the app: the server `Register` names, or the one\n * given as the type argument — `typeof server`, or an app *before* the\n * catch-all. With neither, the app `@alxia/core`'s `Register` names, and\n * `BaseContext` when nothing is registered.\n *\n * ```ts\n * export async function loader({ context }: Route.LoaderArgs) {\n *   const { user, log } = alxiaOf(context);\n * }\n * ```\n *\n * Throws when the request did not come through `reactRouter()`: under\n * `react-router dev` without the plugin, or a test that calls a loader\n * directly.\n */\nexport function alxiaOf<\n\tApp extends AnyAlxia | ReactRouterServer<AnyAlxia> = RegisteredApp,\n>(context: ProviderLike): AlxiaContextOf<App> {\n\tconst value = context.get(alxiaContext);\n\tif (value === MISSING) {\n\t\tthrow new Error(\n\t\t\t\"alxiaOf(): this request has no alxia context. Serve the React Router app through alxia: add alxia() from @alxia/react-router/vite to vite.config.ts's plugins, or, with a server of your own, serve the build through reactRouter() from @alxia/react-router.\",\n\t\t);\n\t}\n\treturn value as AlxiaContextOf<App>;\n}\n\n/**\n * What `alxiaOf` and `nonceOf` read of a provider: its `get`. Not the whole\n * class, which this package gives an `alxia`: the generated route types'\n * `context` is another declaration of it, without one, and must still pass.\n */\nexport type ProviderLike = Pick<Readonly<RouterContextProvider>, 'get'>;\n\n/** What `alxiaOf<App>(context)` returns, and `context.alxia` is for the registered app. */\nexport type AlxiaContextOf<\n\tApp extends AnyAlxia | ReactRouterServer<AnyAlxia> = RegisteredApp,\n> = ContextOf<AppOf<App>> & {\n\t/** The catch-all's route, which every request reaching React Router matched. */\n\treadonly route: string;\n};\n\ndeclare module 'react-router' {\n\tinterface RouterContextProvider {\n\t\t/**\n\t\t * What alxia's middlewares built for this request — `alxiaOf(context)`,\n\t\t * typed by the app `Register` names (`BaseContext` with none):\n\t\t *\n\t\t * ```ts\n\t\t * export async function loader({ context }: LoaderFunctionArgs) {\n\t\t *   const { user, server } = context.alxia;\n\t\t * }\n\t\t * ```\n\t\t *\n\t\t * Typed with `react-router`'s own argument types. The generated\n\t\t * `Route.LoaderArgs` reads a second declaration of this class (its\n\t\t * `./internal` types point at react-router's development build), which\n\t\t * no augmentation reaches: read `alxiaOf(context)` there. Throws as\n\t\t * `alxiaOf` does on a request that did not come through\n\t\t * `reactRouter()`. Server-side only: a `clientLoader` has none.\n\t\t */\n\t\treadonly alxia: AlxiaContextOf;\n\t}\n}\n\n// A getter on the prototype rather than a value set on each provider: it\n// reads `alxiaContext`, so it holds exactly when that key is set — a\n// provider React Router copies keeps it — and on a provider no\n// `reactRouter()` filled, a test's, it throws `alxiaOf`'s error rather than\n// reading `undefined`.\nObject.defineProperty(RouterContextProvider.prototype, 'alxia', {\n\tconfigurable: true,\n\tenumerable: false,\n\tget(this: Readonly<RouterContextProvider>) {\n\t\treturn alxiaOf(this);\n\t},\n});\n",
+    "/** `nonceOf`: the request's CSP nonce, read from alxia's context if a middleware set one. */\nimport { alxiaContext, type ProviderLike } from './context';\n\n/**\n * This request's CSP nonce, for `entry.server.tsx`: the `nonce` alxia's\n * middlewares put on the context — `secureHeaders({ nonce: true })` from\n * `@alxia/secure-headers`, or a `derive` of your own — or `undefined` when\n * none did, or when the request did not come through alxia. It reads the\n * key if present: neither package depends on the other.\n *\n * ```tsx\n * const nonce = nonceOf(loadContext);\n * <ServerRouter context={routerContext} url={request.url} nonce={nonce} />\n * ```\n */\nexport function nonceOf(context: ProviderLike): string | undefined {\n\tconst value = context.get(alxiaContext);\n\tif (typeof value !== 'object' || value === null || !('nonce' in value)) {\n\t\treturn undefined;\n\t}\n\treturn typeof value.nonce === 'string' ? value.nonce : undefined;\n}\n"
+  ],
+  "mappings": ";AAKA;AAYA,SAAS,SAAY,CAAC,MAAc,MAAkB;AAAA,EACrD,MAAM,WAAW;AAAA,EACjB,MAAM,MAAM,OAAO,IAAI,uBAAuB,QAAQ;AAAA,EACtD,SAAS,SAAS,KAAK;AAAA,EACvB,OAAO,SAAS;AAAA;AAajB,IAAM,SAAS,UAAU,WAAW,MAAM;AAAA,EAEzC,MAAM,UAAyB,OAAO,uBAAuB;AAAA,EAC7D,OAAO,EAAE,SAAS,SAAS,cAAuB,OAAO,EAAE;AAAA,CAC3D;AACD,IAAM,UAAU,OAAO;AAChB,IAAM,gBAAe,OAAO;AA+E5B,SAAS,QAEf,CAAC,SAA4C;AAAA,EAC7C,MAAM,QAAQ,QAAQ,IAAI,aAAY;AAAA,EACtC,IAAI,UAAU,SAAS;AAAA,IACtB,MAAM,IAAI,MACT,+PACD;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AA8CR,OAAO,eAAe,sBAAsB,WAAW,SAAS;AAAA,EAC/D,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,GAAG,GAAwC;AAAA,IAC1C,OAAO,SAAQ,IAAI;AAAA;AAErB,CAAC;;;ACrKM,SAAS,QAAO,CAAC,SAA2C;AAAA,EAClE,MAAM,QAAQ,QAAQ,IAAI,aAAY;AAAA,EACtC,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,EAAE,WAAW,QAAQ;AAAA,IACvE;AAAA,EACD;AAAA,EACA,OAAO,OAAO,MAAM,UAAU,WAAW,MAAM,QAAQ;AAAA;",
+  "debugId": "BC95EB0B0221673364756E2164756E21",
+  "names": []
+}

package/dist/chunks/{index-mppz0806.js → index-6jf7zpxz.js}

@@ -1,11 +1,11 @@
+import {
+  PRECACHE_DEFINE
+} from "./index-59vhfj6n.js";
 import {
   parseBrowserManifest2,
   precacheList2,
   assetPrecache2
 } from "./index-5gqcpyyg.js";
-import {
-  PRECACHE_DEFINE
-} from "./index-59vhfj6n.js";
 import {
   SERVICE_WORKER_URL2,
   OFFLINE_URL2
@@ -115,5 +115,5 @@ ${result.logs.map(String).join(`
 }
 export { buildWorker2 };
 
-//# debugId=763F0D0F0869B4B964756E2164756E21
-//# sourceMappingURL=index-mppz0806.js.map
+//# debugId=705C996D7C991BF164756E2164756E21
+//# sourceMappingURL=index-6jf7zpxz.js.map

package/dist/chunks/{index-mppz0806.js.map → index-6jf7zpxz.js.map}

@@ -6,6 +6,6 @@
     "import { createHash } from 'node:crypto';\nimport {\n\tassetPrecache,\n\ttype PrecacheEntry,\n\tparseBrowserManifest,\n\tprecacheList,\n} from '../model/precache-list';\n\n/** The one React Router browser manifest among the names in build/client/assets. */\nexport function browserManifestFile(files: readonly string[]): string {\n\tconst found = files.filter((file) => /^manifest-[\\w-]+\\.js$/.test(file));\n\tconst [only] = found;\n\tif (found.length !== 1 || only === undefined) {\n\t\tthrow new Error(\n\t\t\t`buildWorker(): expected one React Router browser manifest, build/client/assets/manifest-*.js, found ${found.length}. Run react-router build first.`,\n\t\t);\n\t}\n\treturn only;\n}\n\n/** A file's revision: the first 16 hex characters of its sha256. */\nexport function revisionOf(bytes: Uint8Array): string {\n\treturn createHash('sha256').update(bytes).digest('hex').slice(0, 16);\n}\n\n/**\n * The worker's precache list: the offline page (revisioned by its content),\n * every route's code, then the asset files `include` matches. Each URL once,\n * the first kept.\n */\nexport function workerPrecache(input: {\n\tmanifestSource: string;\n\tassetFiles: readonly string[];\n\toffline?: PrecacheEntry | undefined;\n\tinclude?: RegExp | undefined;\n}): PrecacheEntry[] {\n\tconst all = [\n\t\t...(input.offline ? [input.offline] : []),\n\t\t...precacheList(parseBrowserManifest(input.manifestSource)),\n\t\t...(input.include ? assetPrecache(input.assetFiles, input.include) : []),\n\t];\n\tconst seen = new Set<string>();\n\treturn all.filter(({ url }) => !seen.has(url) && seen.add(url));\n}\n"
   ],
   "mappings": ";;;;;;;;;;;;;;AAAA;AACA;AACA;;;ACFA;AASO,SAAS,mBAAmB,CAAC,OAAkC;AAAA,EACrE,MAAM,QAAQ,MAAM,OAAO,CAAC,SAAS,wBAAwB,KAAK,IAAI,CAAC;AAAA,EACvE,OAAO,QAAQ;AAAA,EACf,IAAI,MAAM,WAAW,KAAK,SAAS,WAAW;AAAA,IAC7C,MAAM,IAAI,MACT,uGAAuG,MAAM,uCAC9G;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAID,SAAS,UAAU,CAAC,OAA2B;AAAA,EACrD,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA;AAQ7D,SAAS,cAAc,CAAC,OAKX;AAAA,EACnB,MAAM,MAAM;AAAA,IACX,GAAI,MAAM,UAAU,CAAC,MAAM,OAAO,IAAI,CAAC;AAAA,IACvC,GAAG,cAAa,sBAAqB,MAAM,cAAc,CAAC;AAAA,IAC1D,GAAI,MAAM,UAAU,eAAc,MAAM,YAAY,MAAM,OAAO,IAAI,CAAC;AAAA,EACvE;AAAA,EACA,MAAM,OAAO,IAAI;AAAA,EACjB,OAAO,IAAI,OAAO,GAAG,UAAU,CAAC,KAAK,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC;AAAA;;;ADCxD,SAAS,SAAS,CACxB,QAAS,WAAiC,QAAQ,WAC3C;AAAA,EACP,IAAI;AAAA,IAAO;AAAA,EACX,MAAM,IAAI,MACT,8GACD;AAAA;AAQD,SAAS,WAAW,CAAC,QAAgB,KAAqB;AAAA,EACzD,MAAM,OAAO,KAAK,QAAQ,GAAG;AAAA,EAC7B,IACC,CAAC,IAAI,WAAW,GAAG,KACnB,6BAA6B,KAAK,GAAG,KACrC,CAAC,KAAK,WAAW,SAAS,GAAG,KAC7B,KAAK,SAAS,GAAG,GAChB;AAAA,IACD,MAAM,IAAI,MAAM,kBAAkB,kBAAkB,SAAS;AAAA,EAC9D;AAAA,EACA,OAAO;AAAA;AAUR,eAAsB,YAAW,CAChC,SACuB;AAAA,EACvB,UAAU;AAAA,EACV,MAAM,OAAO,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,CAAC;AAAA,EAClD,MAAM,SAAS,QAAQ,MAAM,QAAQ,UAAU,cAAc;AAAA,EAC7D,MAAM,SAAS,QAAQ,MAAM,QAAQ,IAAI;AAAA,EACzC,MAAM,YAAY,QAAQ,UAAU,oBAAoB;AAAA,EACxD,MAAM,aAAa,QAAQ,UAAU,cAAc;AAAA,EACnD,IAAI,CAAC,WAAW,MAAM,GAAG;AAAA,IACxB,MAAM,IAAI,MAAM,kBAAkB,QAAQ,sBAAsB;AAAA,EACjE;AAAA,EACA,MAAM,SAAS,KAAK,QAAQ,QAAQ;AAAA,EACpC,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE,MAAM,MAAM,CAAC,CAAC;AAAA,EAClD,MAAM,WAAW,oBAAoB,KAAK;AAAA,EAC1C,IAAI;AAAA,EACJ,IAAI,QAAQ,YAAY,OAAO;AAAA,IAC9B,MAAM,OAAO,YAAY,QAAQ,UAAU;AAAA,IAC3C,IAAI,CAAC,WAAW,IAAI,GAAG;AAAA,MACtB,MAAM,IAAI,MACT,kBAAkB,QAAQ,UAAU,iBAAiB,wCAAwC,mJAC9F;AAAA,IACD;AAAA,IACA,UAAU,EAAE,KAAK,YAAY,UAAU,WAAW,MAAM,SAAS,IAAI,CAAC,EAAE;AAAA,EACzE;AAAA,EACA,MAAM,WAAW,eAAe;AAAA,IAC/B,gBAAgB,MAAM,SAAS,KAAK,QAAQ,QAAQ,GAAG,MAAM;AAAA,IAC7D,YAAY;AAAA,IACZ;AAAA,IACA,SAAS,QAAQ;AAAA,EAClB,CAAC;AAAA,EACD,MAAM,MAAM,YAAY,QAAQ,SAAS;AAAA,EACzC,MAAM,SAAS,MAAM,IAAI,MAAM;AAAA,IAC9B,aAAa,CAAC,MAAM;AAAA,IACpB,QAAQ,QAAQ,GAAG;AAAA,IACnB,QAAQ,SAAS,GAAG;AAAA,IACpB,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,QAAQ,UAAU;AAAA,IAC1B,QAAQ;AAAA,MAEP,wBAAwB;AAAA,OACvB,kBAAkB,KAAK,UAAU,QAAQ;AAAA,IAC3C;AAAA,EACD,CAAC,EAAE,MAAM,CAAC,UAAmB;AAAA,IAC5B,MAAM,SACL,iBAAiB,iBACd,MAAM,OAAO,IAAI,MAAM,EAAE,KAAK;AAAA,CAAI,IAClC,OAAO,KAAK;AAAA,IAChB,MAAM,IAAI,MAAM;AAAA,EAAqC,QAAQ;AAAA,GAC7D;AAAA,EACD,IAAI,CAAC,OAAO,SAAS;AAAA,IACpB,MAAM,IAAI,MACT;AAAA,EAAqC,OAAO,KAAK,IAAI,MAAM,EAAE,KAAK;AAAA,CAAI,GACvE;AAAA,EACD;AAAA,EACA,IAAI,gBAAgB;AAAA,EACpB,aAAa,SAAS,UAAU;AAAA,IAC/B,kBAAkB,MAAM,KAAK,KAAK,QAAQ,GAAG,CAAC,GAAG;AAAA,EAClD;AAAA,EACA,OAAO;AAAA,IACN,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,KAAK,GAAG,GAAG;AAAA,EAC1B;AAAA;",
-  "debugId": "763F0D0F0869B4B964756E2164756E21",
+  "debugId": "705C996D7C991BF164756E2164756E21",
   "names": []
 }

package/dist/chunks/index-y6vpnjr3.js

@@ -0,0 +1,123 @@
+// src/document/inline-script.ts
+import { createElement as createElement2 } from "react";
+
+// src/document/nonce.ts
+import {
+  createContext,
+  createElement,
+  useContext
+} from "react";
+var KEY = Symbol.for("@alxia/react-router:document-nonce@1");
+var registry = globalThis;
+registry[KEY] ??= createContext(undefined);
+var NonceContext = registry[KEY];
+function DocumentNonce2({
+  nonce,
+  children
+}) {
+  return createElement(NonceContext, { value: nonce }, children);
+}
+var HEAD_NONCE = 'head script[nonce], head meta[property="csp-nonce"]';
+var documentNonce;
+function useNonce2() {
+  const serverNonce = useContext(NonceContext);
+  if (typeof document === "undefined")
+    return serverNonce;
+  documentNonce ??= (document.querySelector(HEAD_NONCE) ?? document.querySelector("script[nonce]"))?.nonce ?? "";
+  return documentNonce || undefined;
+}
+
+// src/document/inline-script.ts
+var BREAKS_OUT = /<\/script|<!--/i;
+function InlineScript2({ code, nonce }) {
+  if (BREAKS_OUT.test(code)) {
+    throw new TypeError('InlineScript(): the code contains "</script" or "<!--", which ends or confuses the script element; escape it, such as "<\\/script" inside a string');
+  }
+  const fromDocument = useNonce2();
+  return createElement2("script", {
+    nonce: nonce ?? fromDocument,
+    dangerouslySetInnerHTML: { __html: code }
+  });
+}
+function CspNonceMeta2() {
+  return createElement2("meta", {
+    property: "csp-nonce",
+    nonce: useNonce2()
+  });
+}
+// src/document/page-language.ts
+import { useSyncExternalStore } from "react";
+
+// src/document/language-store.ts
+function createLanguageStore() {
+  const listeners = new Set;
+  let chosen;
+  return {
+    subscribe(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    getSnapshot: () => chosen,
+    choose(language) {
+      chosen = language;
+      for (const listener of listeners)
+        listener();
+    }
+  };
+}
+
+// src/document/page-language.ts
+function createPageLanguage2(options) {
+  const { languages, fallback } = options;
+  if (!languages.includes(fallback)) {
+    throw new TypeError(`createPageLanguage(): the fallback "${fallback}" is not one of the languages; got ${JSON.stringify(languages)}.`);
+  }
+  const isBrowser = options.browser ?? (() => typeof document !== "undefined");
+  const store = createLanguageStore();
+  let last;
+  function pageLanguage(language) {
+    const supported = languages.find((known) => known === language);
+    if (!isBrowser())
+      return supported ?? fallback;
+    const current = store.getSnapshot() ?? supported;
+    if (current)
+      last = current;
+    return last ?? fallback;
+  }
+  return {
+    pageLanguage,
+    metaLanguage(matches) {
+      const root = matches[0];
+      return pageLanguage(root?.loaderData?.language);
+    },
+    chooseLanguage: store.choose,
+    useChosenLanguage: () => useSyncExternalStore(store.subscribe, store.getSnapshot, () => {
+      return;
+    })
+  };
+}
+// src/document/text-direction.ts
+var RTL = new Set([
+  "ar",
+  "fa",
+  "he",
+  "ur",
+  "ps",
+  "yi",
+  "dv",
+  "ckb",
+  "sd",
+  "ug",
+  "iw",
+  "ji"
+]);
+function textDirection2(language) {
+  const base = language.split(/[-_]/, 1)[0]?.toLowerCase() ?? "";
+  return RTL.has(base) ? "rtl" : "ltr";
+}
+export { DocumentNonce2, useNonce2, InlineScript2, CspNonceMeta2, createPageLanguage2, textDirection2 };
+
+//# debugId=49CF940BC2A4321264756E2164756E21
+//# sourceMappingURL=index-y6vpnjr3.js.map

package/dist/chunks/index-y6vpnjr3.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/document/inline-script.ts", "../src/document/nonce.ts", "../src/document/page-language.ts", "../src/document/language-store.ts", "../src/document/text-direction.ts"],
+  "sourcesContent": [
+    "import { createElement, type ReactElement } from 'react';\nimport { useNonce } from './nonce';\n\nconst BREAKS_OUT = /<\\/script|<!--/i;\n\nexport interface InlineScriptProps {\n\t/**\n\t * The script's text, rendered as it is: never escaped, so a `</script`\n\t * or a `<!--` in it is refused (see `InlineScript`).\n\t */\n\tcode: string;\n\t/** The script's nonce; `useNonce()`'s by default. */\n\tnonce?: string | undefined;\n}\n\n/**\n * An inline `<script>` carrying the page's CSP nonce, on the server and in\n * the browser, so hydration finds the attribute it rendered. The code is a\n * constant of the app (a theme's boot script): never put user input in it.\n * With no nonce anywhere, it renders no `nonce` attribute, and the policy\n * must then allow inline scripts some other way.\n *\n * Throws a `TypeError` when the code holds `</script` or `<!--`, which end or\n * confuse the element whatever the nonce: escape them in a string (`<\\/script`).\n */\nexport function InlineScript({ code, nonce }: InlineScriptProps): ReactElement {\n\tif (BREAKS_OUT.test(code)) {\n\t\tthrow new TypeError(\n\t\t\t'InlineScript(): the code contains \"</script\" or \"<!--\", which ends or confuses the script element; escape it, such as \"<\\\\/script\" inside a string',\n\t\t);\n\t}\n\tconst fromDocument = useNonce();\n\treturn createElement('script', {\n\t\tnonce: nonce ?? fromDocument,\n\t\tdangerouslySetInnerHTML: { __html: code },\n\t});\n}\n\n/**\n * `<meta property=\"csp-nonce\" nonce=\"…\">`: the page's nonce for the scripts\n * and styles a library adds at runtime (a UI kit reads it from the DOM).\n */\nexport function CspNonceMeta(): ReactElement {\n\treturn createElement('meta', {\n\t\tproperty: 'csp-nonce',\n\t\tnonce: useNonce(),\n\t});\n}\n",
+    "import {\n\tcreateContext,\n\tcreateElement,\n\ttype ReactNode,\n\tuseContext,\n} from 'react';\n\n/**\n * One context per process, whichever copy of this module asks: a package\n * loaded natively that imports `/document` would otherwise get a second\n * context, and its `useNonce()` would never see the entry's `DocumentNonce`.\n * `/document` imports `react` alone, so the few lines of `src/context.ts`'s\n * singleton are written here. The `@1` suffix is the shape of what is stored\n * under the key: a version that changes it bumps the suffix, never the name.\n */\nconst KEY = Symbol.for('@alxia/react-router:document-nonce@1');\nconst registry = globalThis as Record<symbol, unknown>;\nregistry[KEY] ??= createContext<string | undefined>(undefined);\nconst NonceContext = registry[KEY] as ReturnType<\n\ttypeof createContext<string | undefined>\n>;\n\nexport interface DocumentNonceProps {\n\t/** This response's CSP nonce: `nonceOf(loadContext)` in the entry. */\n\tnonce: string | undefined;\n\tchildren?: ReactNode | undefined;\n}\n\n/**\n * Gives the server render this response's CSP nonce, for `useNonce()` and\n * the components built on it. The entry wraps the router in it, so every\n * boundary reads the nonce, an error page after an action included (it\n * runs no loader). Never put the nonce in loader data: the browser hides\n * it from the page, and loader data would print it in the hydration script\n * and every `.data` answer.\n */\nexport function DocumentNonce({\n\tnonce,\n\tchildren,\n}: DocumentNonceProps): ReactNode {\n\treturn createElement(NonceContext, { value: nonce }, children);\n}\n\nconst HEAD_NONCE = 'head script[nonce], head meta[property=\"csp-nonce\"]';\n\nlet documentNonce: string | undefined;\n\n/**\n * The page's CSP nonce, for what the root renders: an inline script, and\n * React Router's `<Links>`, `<Scripts>` and `<ScrollRestoration>`. On the\n * server, the one `DocumentNonce` provides. In the browser, the one the\n * document carries: React Router's client knows no nonce, and React would\n * find `nonce` on the server's elements and none in its own (a hydration\n * mismatch). It is read from the DOM property of the first script or\n * `csp-nonce` meta in the `<head>` (the browser hides the attribute, not\n * the property), else of the first `script[nonce]` anywhere, once for the\n * document. That first read is cached per module copy, so a test with a\n * DOM keeps it across tests: reset modules, or render the server path with\n * `DocumentNonce`.\n *\n * \"In the browser\" means a global `document`. A server that installs a DOM\n * shim on `globalThis` takes the browser path and finds no nonce: it must not\n * render this hook that way.\n */\nexport function useNonce(): string | undefined {\n\tconst serverNonce = useContext(NonceContext);\n\tif (typeof document === 'undefined') return serverNonce;\n\tdocumentNonce ??=\n\t\t(\n\t\t\tdocument.querySelector<HTMLElement>(HEAD_NONCE) ??\n\t\t\tdocument.querySelector<HTMLElement>('script[nonce]')\n\t\t)?.nonce ?? '';\n\treturn documentNonce || undefined;\n}\n",
+    "import { useSyncExternalStore } from 'react';\nimport { createLanguageStore } from './language-store';\n\nexport interface PageLanguageOptions<L extends string> {\n\t/** The languages the app serves. */\n\treadonly languages: readonly L[];\n\t/** The language of a page whose root data gives none; one of `languages`. */\n\treadonly fallback: NoInfer<L>;\n\t/**\n\t * Whether this is a browser. Default: `typeof document !== 'undefined'`,\n\t * a global `document`: a server with a DOM shim on `globalThis` must pass\n\t * `() => false`, or the instance remembers a language across requests.\n\t */\n\treadonly browser?: (() => boolean) | undefined;\n}\n\nexport interface PageLanguage<L extends string> {\n\t/**\n\t * The page's language from the root loader's `language`. In the browser,\n\t * the one picked with `chooseLanguage` wins, and the last one seen stands\n\t * in when the root's data is gone (a failed navigation takes the root's\n\t * with it): the error page keeps the page's language, not the fallback's.\n\t * On the server it remembers nothing, since one module serves every request.\n\t */\n\tpageLanguage(language: string | undefined): L;\n\t/** The page's language in a route's `meta`, from `matches[0].loaderData.language`. */\n\tmetaLanguage(matches: ReadonlyArray<unknown>): L;\n\t/**\n\t * Records the language picked in a language menu: from then on the page's\n\t * language in the browser, until the next document. Re-renders every\n\t * `useChosenLanguage()`.\n\t */\n\tchooseLanguage(language: L): void;\n\t/** The language picked in this document, if any; re-renders on a new pick. */\n\tuseChosenLanguage(): L | undefined;\n}\n\n/**\n * The page's language for a root route: `<html lang>`, a route's `meta`, and\n * the language menu. An instance, not module state: keep one per app, in a\n * module both the root and the routes import.\n */\nexport function createPageLanguage<const L extends string>(\n\toptions: PageLanguageOptions<L>,\n): PageLanguage<L> {\n\tconst { languages, fallback } = options;\n\tif (!languages.includes(fallback)) {\n\t\tthrow new TypeError(\n\t\t\t`createPageLanguage(): the fallback \"${fallback}\" is not one of the languages; got ${JSON.stringify(languages)}.`,\n\t\t);\n\t}\n\tconst isBrowser = options.browser ?? (() => typeof document !== 'undefined');\n\tconst store = createLanguageStore<L>();\n\tlet last: L | undefined;\n\n\tfunction pageLanguage(language: string | undefined): L {\n\t\tconst supported = languages.find((known) => known === language);\n\t\tif (!isBrowser()) return supported ?? fallback;\n\t\tconst current = store.getSnapshot() ?? supported;\n\t\tif (current) last = current;\n\t\treturn last ?? fallback;\n\t}\n\n\treturn {\n\t\tpageLanguage,\n\t\tmetaLanguage(matches) {\n\t\t\tconst root = matches[0] as\n\t\t\t\t| { loaderData?: { language?: string } }\n\t\t\t\t| undefined;\n\t\t\treturn pageLanguage(root?.loaderData?.language);\n\t\t},\n\t\tchooseLanguage: store.choose,\n\t\tuseChosenLanguage: () =>\n\t\t\tuseSyncExternalStore(store.subscribe, store.getSnapshot, () => undefined),\n\t};\n}\n",
+    "/** The picked language and who listens to it: internal to `createPageLanguage`. */\nexport interface LanguageStore<L extends string> {\n\tsubscribe(listener: () => void): () => void;\n\tgetSnapshot(): L | undefined;\n\tchoose(language: L): void;\n}\n\nexport function createLanguageStore<L extends string>(): LanguageStore<L> {\n\tconst listeners = new Set<() => void>();\n\tlet chosen: L | undefined;\n\treturn {\n\t\tsubscribe(listener) {\n\t\t\tlisteners.add(listener);\n\t\t\treturn () => {\n\t\t\t\tlisteners.delete(listener);\n\t\t\t};\n\t\t},\n\t\tgetSnapshot: () => chosen,\n\t\tchoose(language) {\n\t\t\tchosen = language;\n\t\t\tfor (const listener of listeners) listener();\n\t\t},\n\t};\n}\n",
+    "/**\n * Base languages written right to left. A fixed list: a language is added\n * here when it needs it.\n */\nconst RTL = new Set([\n\t'ar',\n\t'fa',\n\t'he',\n\t'ur',\n\t'ps',\n\t'yi',\n\t'dv',\n\t'ckb',\n\t'sd',\n\t'ug',\n\t// Legacy codes of Hebrew and Yiddish.\n\t'iw',\n\t'ji',\n]);\n\n/**\n * The `dir` of a language tag: `'rtl'` for a right-to-left base language,\n * `'ltr'` for the rest. The base tag is read whatever its case, so `ar-EG`\n * and `AR` are `'rtl'` and `en-US` is `'ltr'`.\n *\n * Known gap: a script subtag is not read, so `az-Arab` (Azerbaijani in the\n * Arabic script) is `'ltr'`, as `az` is.\n */\nexport function textDirection(language: string): 'ltr' | 'rtl' {\n\tconst base = language.split(/[-_]/, 1)[0]?.toLowerCase() ?? '';\n\treturn RTL.has(base) ? 'rtl' : 'ltr';\n}\n"
+  ],
+  "mappings": ";AAAA,0BAAS;;;ACAT;AAAA;AAAA;AAAA;AAAA;AAeA,IAAM,MAAM,OAAO,IAAI,sCAAsC;AAC7D,IAAM,WAAW;AACjB,SAAS,SAAS,cAAkC,SAAS;AAC7D,IAAM,eAAe,SAAS;AAkBvB,SAAS,cAAa;AAAA,EAC5B;AAAA,EACA;AAAA,GACiC;AAAA,EACjC,OAAO,cAAc,cAAc,EAAE,OAAO,MAAM,GAAG,QAAQ;AAAA;AAG9D,IAAM,aAAa;AAEnB,IAAI;AAmBG,SAAS,SAAQ,GAAuB;AAAA,EAC9C,MAAM,cAAc,WAAW,YAAY;AAAA,EAC3C,IAAI,OAAO,aAAa;AAAA,IAAa,OAAO;AAAA,EAC5C,mBAEE,SAAS,cAA2B,UAAU,KAC9C,SAAS,cAA2B,eAAe,IACjD,SAAS;AAAA,EACb,OAAO,iBAAiB;AAAA;;;ADrEzB,IAAM,aAAa;AAsBZ,SAAS,aAAY,GAAG,MAAM,SAA0C;AAAA,EAC9E,IAAI,WAAW,KAAK,IAAI,GAAG;AAAA,IAC1B,MAAM,IAAI,UACT,oJACD;AAAA,EACD;AAAA,EACA,MAAM,eAAe,UAAS;AAAA,EAC9B,OAAO,eAAc,UAAU;AAAA,IAC9B,OAAO,SAAS;AAAA,IAChB,yBAAyB,EAAE,QAAQ,KAAK;AAAA,EACzC,CAAC;AAAA;AAOK,SAAS,aAAY,GAAiB;AAAA,EAC5C,OAAO,eAAc,QAAQ;AAAA,IAC5B,UAAU;AAAA,IACV,OAAO,UAAS;AAAA,EACjB,CAAC;AAAA;;AE9CF;;;ACOO,SAAS,mBAAqC,GAAqB;AAAA,EACzE,MAAM,YAAY,IAAI;AAAA,EACtB,IAAI;AAAA,EACJ,OAAO;AAAA,IACN,SAAS,CAAC,UAAU;AAAA,MACnB,UAAU,IAAI,QAAQ;AAAA,MACtB,OAAO,MAAM;AAAA,QACZ,UAAU,OAAO,QAAQ;AAAA;AAAA;AAAA,IAG3B,aAAa,MAAM;AAAA,IACnB,MAAM,CAAC,UAAU;AAAA,MAChB,SAAS;AAAA,MACT,WAAW,YAAY;AAAA,QAAW,SAAS;AAAA;AAAA,EAE7C;AAAA;;;ADoBM,SAAS,mBAA0C,CACzD,SACkB;AAAA,EAClB,QAAQ,WAAW,aAAa;AAAA,EAChC,IAAI,CAAC,UAAU,SAAS,QAAQ,GAAG;AAAA,IAClC,MAAM,IAAI,UACT,uCAAuC,8CAA8C,KAAK,UAAU,SAAS,IAC9G;AAAA,EACD;AAAA,EACA,MAAM,YAAY,QAAQ,YAAY,MAAM,OAAO,aAAa;AAAA,EAChE,MAAM,QAAQ,oBAAuB;AAAA,EACrC,IAAI;AAAA,EAEJ,SAAS,YAAY,CAAC,UAAiC;AAAA,IACtD,MAAM,YAAY,UAAU,KAAK,CAAC,UAAU,UAAU,QAAQ;AAAA,IAC9D,IAAI,CAAC,UAAU;AAAA,MAAG,OAAO,aAAa;AAAA,IACtC,MAAM,UAAU,MAAM,YAAY,KAAK;AAAA,IACvC,IAAI;AAAA,MAAS,OAAO;AAAA,IACpB,OAAO,QAAQ;AAAA;AAAA,EAGhB,OAAO;AAAA,IACN;AAAA,IACA,YAAY,CAAC,SAAS;AAAA,MACrB,MAAM,OAAO,QAAQ;AAAA,MAGrB,OAAO,aAAa,MAAM,YAAY,QAAQ;AAAA;AAAA,IAE/C,gBAAgB,MAAM;AAAA,IACtB,mBAAmB,MAClB,qBAAqB,MAAM,WAAW,MAAM,aAAa,MAAG;AAAA,MAAG;AAAA,KAAS;AAAA,EAC1E;AAAA;;AEtED,IAAM,MAAM,IAAI,IAAI;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AACD,CAAC;AAUM,SAAS,cAAa,CAAC,UAAiC;AAAA,EAC9D,MAAM,OAAO,SAAS,MAAM,QAAQ,CAAC,EAAE,IAAI,YAAY,KAAK;AAAA,EAC5D,OAAO,IAAI,IAAI,IAAI,IAAI,QAAQ;AAAA;",
+  "debugId": "49CF940BC2A4321264756E2164756E21",
+  "names": []
+}

package/dist/context.d.ts

@@ -5,13 +5,6 @@
 import type { Alxia, AnyAlxia, ContextOf, RegisteredBase } from '@alxia/core';
 import { RouterContextProvider } from 'react-router';
 import type { ReactRouterServer } from './server';
-/**
- * The key `reactRouter()` sets on React Router's context provider, on every
- * request, to what alxia's middlewares built for it. It lives in this package, so
- * it is one object whichever way the server was built or loaded: a key made
- * in the app's own `app/` folder is copied into React Router's build, and
- * the server that imports it separately sets a different one.
- */
 export declare const alxiaContext: import("react-router").RouterContext<unknown>;
 /**
  * Names the server whose context `alxiaOf(context)` reads when given no

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAiB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAKlD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,+CAAkC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,QAAQ;CAAG;AAE5B,iDAAiD;AACjD,MAAM,MAAM,KAAK,CAAC,MAAM,IACvB,MAAM,SAAS,iBAAiB,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC;AAE5D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,CAClC;IACC,QAAQ,CAAC,6EAA6E,EAAE,KAAK,CAAC;CAC9F,EACD,EAAE,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CACvB,CAAC,EACD,IAAI,SAAS,QAAQ,GAAG,cAAc,IACnC,CAAC,SAAS;IACb,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC9B,GACE,MAAM,SAAS,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GACpD,KAAK,CAAC,MAAM,CAAC,GACb,eAAe,GAChB,IAAI,CAAC;AAER,6HAA6H;AAC7H,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CACtB,GAAG,SAAS,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,aAAa,EACjE,OAAO,EAAE,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAQ5C;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;AAExE,2FAA2F;AAC3F,MAAM,MAAM,cAAc,CACzB,GAAG,SAAS,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,aAAa,IAC/D,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,OAAO,QAAQ,cAAc,CAAC;IAC7B,UAAU,qBAAqB;QAC9B;;;;;;;;;;;;;;;;WAgBG;QACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAC/B;CACD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAiB,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAkClD,eAAO,MAAM,YAAY,+CAAiB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,MAAM,WAAW,QAAQ;CAAG;AAE5B,iDAAiD;AACjD,MAAM,MAAM,KAAK,CAAC,MAAM,IACvB,MAAM,SAAS,iBAAiB,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC;AAE5D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,CAClC;IACC,QAAQ,CAAC,6EAA6E,EAAE,KAAK,CAAC;CAC9F,EACD,EAAE,CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,YAAY,CACvB,CAAC,EACD,IAAI,SAAS,QAAQ,GAAG,cAAc,IACnC,CAAC,SAAS;IACb,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC9B,GACE,MAAM,SAAS,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GACpD,KAAK,CAAC,MAAM,CAAC,GACb,eAAe,GAChB,IAAI,CAAC;AAER,6HAA6H;AAC7H,MAAM,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CACtB,GAAG,SAAS,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,aAAa,EACjE,OAAO,EAAE,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAQ5C;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;AAExE,2FAA2F;AAC3F,MAAM,MAAM,cAAc,CACzB,GAAG,SAAS,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,aAAa,IAC/D,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,OAAO,QAAQ,cAAc,CAAC;IAC7B,UAAU,qBAAqB;QAC9B;;;;;;;;;;;;;;;;WAgBG;QACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;KAC/B;CACD"}

package/dist/document/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@alxia/react-router/document`: what a root route renders for the page's
+ * CSP nonce, on the server and in the browser. `react` is its only import
+ * (an optional peer of the package), and nothing runs at the top level but
+ * `createContext`.
+ */
+export { CspNonceMeta, InlineScript, type InlineScriptProps, } from './inline-script';
+export { DocumentNonce, type DocumentNonceProps, useNonce, } from './nonce';
+export { createPageLanguage, type PageLanguage, type PageLanguageOptions, } from './page-language';
+export { textDirection } from './text-direction';
+//# sourceMappingURL=index.d.ts.map

package/dist/document/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/document/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,KAAK,iBAAiB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,aAAa,EACb,KAAK,kBAAkB,EACvB,QAAQ,GACR,MAAM,SAAS,CAAC;AACjB,OAAO,EACN,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,mBAAmB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/document/index.js

@@ -0,0 +1,19 @@
+import {
+  DocumentNonce2,
+  useNonce2,
+  InlineScript2,
+  CspNonceMeta2,
+  createPageLanguage2,
+  textDirection2
+} from "../chunks/index-y6vpnjr3.js";
+export {
+  CspNonceMeta2 as CspNonceMeta,
+  DocumentNonce2 as DocumentNonce,
+  InlineScript2 as InlineScript,
+  createPageLanguage2 as createPageLanguage,
+  textDirection2 as textDirection,
+  useNonce2 as useNonce
+};
+
+//# debugId=3F5BF8C287845B0F64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/document/index.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "3F5BF8C287845B0F64756E2164756E21",
+  "names": []
+}

package/dist/document/inline-script.d.ts

@@ -0,0 +1,27 @@
+import { type ReactElement } from 'react';
+export interface InlineScriptProps {
+    /**
+     * The script's text, rendered as it is: never escaped, so a `</script`
+     * or a `<!--` in it is refused (see `InlineScript`).
+     */
+    code: string;
+    /** The script's nonce; `useNonce()`'s by default. */
+    nonce?: string | undefined;
+}
+/**
+ * An inline `<script>` carrying the page's CSP nonce, on the server and in
+ * the browser, so hydration finds the attribute it rendered. The code is a
+ * constant of the app (a theme's boot script): never put user input in it.
+ * With no nonce anywhere, it renders no `nonce` attribute, and the policy
+ * must then allow inline scripts some other way.
+ *
+ * Throws a `TypeError` when the code holds `</script` or `<!--`, which end or
+ * confuse the element whatever the nonce: escape them in a string (`<\/script`).
+ */
+export declare function InlineScript({ code, nonce }: InlineScriptProps): ReactElement;
+/**
+ * `<meta property="csp-nonce" nonce="…">`: the page's nonce for the scripts
+ * and styles a library adds at runtime (a UI kit reads it from the DOM).
+ */
+export declare function CspNonceMeta(): ReactElement;
+//# sourceMappingURL=inline-script.d.ts.map

package/dist/document/inline-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-script.d.ts","sourceRoot":"","sources":["../../src/document/inline-script.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,OAAO,CAAC;AAKzD,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,iBAAiB,GAAG,YAAY,CAW7E;AAED;;;GAGG;AACH,wBAAgB,YAAY,IAAI,YAAY,CAK3C"}