@nxgt/material-core 0.9.0 → 0.9.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @nxgt/material-core
 
+## 0.9.1
+
+### Patch Changes
+
+- [#541](https://github.com/softistx/nxgt-material/pull/541) [`6d10133`](https://github.com/softistx/nxgt-material/commit/6d1013356e8c42631166b6281081811912e31323) Thanks [@SteveGT96](https://github.com/SteveGT96)! - The roadmaps plan one Vite plugin for the setup, and list the strict Content
+  Security Policy as shipped.
+
 ## 0.9.0
 
 ### Minor Changes

package/docs/roadmap.md

@@ -6,18 +6,33 @@ major they target.
 
 ## Now
 
-- **The page's Content Security Policy nonce** (`/csp-nonce`) — one place
-  both libraries read the nonce from, so every `<style>` they create carries
-  it under a strict `style-src-elem`, and a `build.assetsInlineLimit`
-  (`cspAssetsInlineLimit` in `/vite`) that keeps fonts out of `data:` URIs.
-  Shipped here first; both libraries use it now.
-
-- **Built on first use** (`/lazy-object`) — `buildOnce` and `lazyObject`,
-  with which both libraries build their zod schemas on first use rather
-  than at import, so an app under a strict CSP can configure zod first.
+Nothing is in progress.
 
 ## Next
 
+- **One Vite plugin for the whole setup** — `nxgtMaterial()` is implemented
+  once in `/vite` and re-exported by `@nxgt/material/vite` and
+  `@nxgt/material-vue/vite`, so both libraries get the same one-call setup.
+  Every option is on by default and each can be turned off or refined; the
+  helpers that exist today (`cspAssetsInlineLimit` and the others) stay
+  exported.
+  - `csp`: a nonce placeholder through `html.cspNonce` and
+    `applyCspNonce(html, nonce)`; zod's jitless mode as an inline nonced
+    script in `index.html` (`ZOD_JITLESS_SCRIPT` for server rendering); the
+    recommended policy sent by the dev server as Report-Only.
+  - `fonts`: the KaTeX fonts emitted as files, and `sans: 'inter'` for a
+    self-hosted Inter.
+  - `styles`: a build that fails with the exact fix when the stylesheet import
+    or the `@source` line is missing.
+  - `pdf`: pdfkit's standard fonts handled automatically when
+    `@react-pdf/renderer` is installed, and `bundle: true` (the Nuxt module's
+    `pdf.bundleStandardFonts` today) for a server that has no
+    `node_modules`.
+  - Nuxt: the Nuxt module takes the same options.
+  - Server helpers: `createCspNonce()` (Web Crypto) and `cspPolicy({ ... })`,
+    which returns `{ directives, header }` as `@nxgt/material`'s
+    Content Security Policy guide describes; `NonceProvider`'s `nonce`
+    becomes optional on the client. Ships as minors.
 - **The shared media player** — the player state machine (playback, queue and
   shuffle, chapters, transcript sync, resume position, quality levels, Wake
   Lock), its keyboard shortcuts and the shortcut-help list, so
@@ -46,6 +61,8 @@ major they target.
 
 ## Not planned
 
+- **A Next.js plugin** — the plugin targets Vite only. No supported consumer
+  builds with Next.js, and `withNxgtPrint` stays the config helper for it.
 - **Components.** This package stays framework-free: React components are in
   `@nxgt/material`, Vue ones in `@nxgt/material-vue`.
 - **A fake DOM for tests.** The one the libraries' own tests use is the
@@ -59,6 +76,13 @@ major they target.
 
 ## Shipped
 
+- **The page's Content Security Policy nonce** (`/csp-nonce`) — one place both
+  libraries read the nonce from, so every `<style>` they create carries it
+  under a strict `style-src-elem`, and `cspAssetsInlineLimit` (`/vite`), which
+  keeps fonts out of `data:` URIs. 0.9.0.
+- **Built on first use** (`/lazy-object`) — `buildOnce` and `lazyObject`, with
+  which both libraries build their zod schemas on first use rather than at
+  import, so an app under a strict CSP can configure zod first. 0.9.0.
 - **Debounce, text matching and the async search** (`/debounce`,
   `/text-match`, `/async-search`) — the debounce both libraries'
   `SearchField` kept a copy of each, accent- and case-insensitive matching,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nxgt/material-core",
-	"version": "0.9.0",
+	"version": "0.9.1",
 	"description": "The framework-free core of @nxgt/material and @nxgt/material-vue: the PDF document model and its react-pdf renderer, print formatters, PDF file helpers, the PDF viewer's pure modules, the currency digits, the file-size formatter, the field-blur layers, a field's first focusable control, the aria-describedby joiner, the inert background of a modal layer, Escape forwarded while an overlay closes, the Toaster's touch-hover guard and its focus hand-back, the page's Content Security Policy nonce, an object built on first use, the zod issue messages, the date range presets, the debounce, accent-insensitive text matching and the race-free async search behind Autocomplete and SearchField, the file preview's kind detection and text reader, the pdfkit fonts Vite plugin, a CSP-safe Vite assetsInlineLimit and the Node-only pdfkit fonts resolution for Next.js and Nuxt builds",
 	"license": "MIT",
 	"bugs": {