@prosopo/locale 3.4.3 → 3.6.0

package/.turbo/turbo-build$colon$cjs.log

@@ -1,10 +1,12 @@
 
-> @prosopo/locale@3.4.3 build:cjs
+> @prosopo/locale@3.6.0 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
-{ tsConfigPaths: [] }
-{ externals: [] }
+{
+  tsConfigPaths: [ '/home/runner/work/captcha/captcha/packages/util/tsconfig.json' ]
+}
+{ externals: [ '@prosopo/util' ] }
 The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
@@ -13,20 +15,20 @@ Bundle build started
 rendering chunks...
 computing gzip size...
 dist/cjs/util.cjs                         0.28 kB │ gzip: 0.17 kB
-dist/cjs/useTranslation.cjs               0.35 kB │ gzip: 0.20 kB
-dist/cjs/i18nMiddleware.cjs               0.36 kB │ gzip: 0.21 kB
-dist/cjs/i18SharedOptions.cjs             0.41 kB │ gzip: 0.25 kB
-dist/cjs/translationKey.cjs               0.74 kB │ gzip: 0.38 kB
+dist/cjs/i18SharedOptions.cjs             0.39 kB │ gzip: 0.24 kB
+dist/cjs/i18nMiddleware.cjs               0.51 kB │ gzip: 0.26 kB
+dist/cjs/translationKey.cjs               0.68 kB │ gzip: 0.35 kB
 dist/cjs/process.cjs                      0.78 kB │ gzip: 0.46 kB
-dist/cjs/index.cjs                        0.83 kB │ gzip: 0.27 kB
-dist/cjs/translations.cjs                 0.86 kB │ gzip: 0.46 kB
+dist/cjs/translations.cjs                 0.80 kB │ gzip: 0.40 kB
+dist/cjs/translator.cjs                   0.83 kB │ gzip: 0.45 kB
+dist/cjs/index.cjs                        0.87 kB │ gzip: 0.27 kB
 dist/cjs/_virtual/_rolldown/runtime.cjs   1.00 kB │ gzip: 0.50 kB
 dist/cjs/i18nBackend.cjs                  1.47 kB │ gzip: 0.62 kB
 dist/cjs/loadI18next.cjs                  2.03 kB │ gzip: 0.84 kB
-dist/cjs/i18nFrontend.cjs                 2.47 kB │ gzip: 0.87 kB
-dist/cjs/locales/en/translation.cjs      16.56 kB │ gzip: 5.98 kB
+dist/cjs/i18nFrontend.cjs                 6.07 kB │ gzip: 2.44 kB
+dist/cjs/locales/en/translation.cjs      16.64 kB │ gzip: 6.01 kB
 
-✓ built in 79ms
+✓ built in 40ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/ar/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/ar/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/az/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/az/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/cs/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/cs/translation.json
@@ -41,8 +43,8 @@ dist/cjs/locales/en/translation.cjs      16.56 kB │ gzip: 5.98 kB
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/id/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/id/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/it/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/it/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/ja/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/ja/translation.json
-[copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/jv/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/jv/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/ko/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/ko/translation.json
+[copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/jv/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/jv/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/ml/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/ml/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/ms/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/ms/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/nl/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/nl/translation.json

package/.turbo/turbo-build$colon$tsc.log

@@ -1,14 +1,17 @@
 
-> @prosopo/locale@3.4.3 build:tsc
+> @prosopo/locale@3.6.0 build:tsc
 > tsc --build --verbose
 
-1:03:47 PM - Projects in this build: 
+3:28:19 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
+    * ../util/tsconfig.json
     * tsconfig.json
 
-1:03:48 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+3:28:19 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-1:03:48 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+3:28:19 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-1:03:48 PM - Building project '/home/runner/work/captcha/captcha/packages/locale/tsconfig.json'...
+3:28:19 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+
+3:28:19 PM - Building project '/home/runner/work/captcha/captcha/packages/locale/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,14 +1,16 @@
 
-> @prosopo/locale@3.4.3 build
+> @prosopo/locale@3.6.0 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/locale@3.4.3 build:cross-env
+> @prosopo/locale@3.6.0 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
-{ tsConfigPaths: [] }
-{ externals: [] }
+{
+  tsConfigPaths: [ '/home/runner/work/captcha/captcha/packages/util/tsconfig.json' ]
+}
+{ externals: [ '@prosopo/util' ] }
 The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
 vite v8.1.5 building ssr environment for production...
 Bundle build started
@@ -18,22 +20,22 @@ rendering chunks...
 computing gzip size...
 dist/_virtual/_rolldown/runtime.js   0.04 kB │ gzip: 0.06 kB
 dist/util.js                         0.25 kB │ gzip: 0.16 kB
-dist/i18nMiddleware.js               0.27 kB │ gzip: 0.18 kB
-dist/useTranslation.js               0.30 kB │ gzip: 0.19 kB
-dist/i18SharedOptions.js             0.37 kB │ gzip: 0.25 kB
-dist/index.js                        0.47 kB │ gzip: 0.20 kB
-dist/translationKey.js               0.68 kB │ gzip: 0.37 kB
-dist/translations.js                 0.70 kB │ gzip: 0.39 kB
+dist/i18nMiddleware.js               0.31 kB │ gzip: 0.19 kB
+dist/i18SharedOptions.js             0.35 kB │ gzip: 0.24 kB
+dist/index.js                        0.48 kB │ gzip: 0.20 kB
+dist/translationKey.js               0.63 kB │ gzip: 0.34 kB
+dist/translations.js                 0.74 kB │ gzip: 0.40 kB
 dist/process.js                      0.77 kB │ gzip: 0.46 kB
+dist/translator.js                   0.79 kB │ gzip: 0.44 kB
 dist/i18nBackend.js                  1.01 kB │ gzip: 0.53 kB
-dist/i18nFrontend.js                 1.75 kB │ gzip: 0.78 kB
 dist/loadI18next.js                  1.93 kB │ gzip: 0.83 kB
-dist/locales/en/translation.js      16.32 kB │ gzip: 5.94 kB
+dist/i18nFrontend.js                 5.98 kB │ gzip: 2.42 kB
+dist/locales/en/translation.js      16.41 kB │ gzip: 5.97 kB
 
-✓ built in 82ms
+✓ built in 30ms
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/ar/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/ar/translation.json
-[copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/az/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/az/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/cs/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/cs/translation.json
+[copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/az/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/az/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/de/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/de/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/el/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/el/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/en/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/en/translation.json
@@ -61,5 +63,5 @@ dist/locales/en/translation.js      16.32 kB │ gzip: 5.94 kB
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/th/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/th/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/tr/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/tr/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/uk/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/uk/translation.json
-[copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/vi/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/vi/translation.json
 [copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/zh-CN/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/zh-CN/translation.json
+[copy-plugin] copying /home/runner/work/captcha/captcha/packages/locale/src/locales/vi/translation.json to /home/runner/work/captcha/captcha/packages/locale/dist/locales/vi/translation.json

package/CHANGELOG.md

@@ -1,5 +1,79 @@
 # @prosopo/locale
 
+## 3.6.0
+### Minor Changes
+
+- a9141c3: Stop shipping i18next to the browser. Saves about 22KB gzipped off the widget.
+  
+  The widget was pulling in i18next and four of its plugins — a language detector, an HTTP backend, a chained backend and a resources-to-backend adapter, which between them also dragged in the `cross-fetch` polyfill — to look up 444 short strings with no plurals, no nesting and two interpolated values. That machinery is about 23KB gzipped; the replacement is 1.25KB.
+  
+  `i18nFrontend.ts` now does the job directly: pick a language, fetch the matching `locales/<lang>/translation.json` next to the bundle, and look keys up in it. Behaviour is unchanged in the ways a visitor can see:
+  
+  - language is chosen from the widget's own setting first, then a cookie, then localStorage, then the browser — the same order as before, and the choice is still remembered in both cookie and localStorage
+  - a regional tag like `de-AT` still resolves to `de`
+  - English is still fetched alongside the chosen language, so a key a translation is missing still renders English rather than its key
+  - `{{name}}` placeholders are still filled in, including in a caller's `defaultValue`
+  - if the catalogue cannot be fetched the widget still renders, in English, rather than waiting
+  
+  i18next stays for the server, where `i18next-http-middleware` needs the real instance to read the `Accept-Language` header. `Ti18n` is now a small interface describing the handful of methods this repository actually calls, which both implementations satisfy, so `@prosopo/common` no longer needs i18next for a type either.
+  
+  Covered by 189 tests in `@prosopo/locale`, and the built bundle was checked in a real browser: French picked up from the browser, a switch to German, interpolation, and both fallbacks.
+- a9141c3: Stop loading zod before the widget can draw itself. Takes another 13KB gzipped off the critical path.
+  
+  zod is 14KB gzipped and it was being downloaded and parsed before the checkbox appeared, because six small things on the startup path happened to use it:
+  
+  - two lists of strings in `@prosopo/logger` (log levels, output format)
+  - two lists of strings in `@prosopo/locale` (language codes, translation keys)
+  - two lists of two strings in `@prosopo/types` (start mode, challenge placement)
+  - one four-field object in `@prosopo/load-balancer` (a provider entry)
+  - an `instanceof ZodError` check in `@prosopo/common`
+  - `INPUT_LIMITS`, a plain table of numbers, that happened to live in the same file as zod-based string builders
+  
+  None of these need a validation library. They are now plain TypeScript: a list, a type, and where input is untrusted, a one-line guard. `INPUT_LIMITS` moved to its own file so reading it no longer drags the builders along.
+  
+  zod has not gone anywhere — the real request and response schemas in `@prosopo/types` still use it, and still validate exactly as before. It now arrives with the code that needs it, after the widget is on screen, rather than in front of it.
+  
+  Two API changes for anyone importing these directly:
+  
+  - `LanguageSchema`, `TranslationKeysSchema`, `StartModeSchema` and `Placement` are no longer exported as zod schemas. Use `isLanguage()`, `isStartMode()`, `isPlacement()` to check a value, and `LanguageCodes`, `translationKeys`, `StartModes`, `Placements` for the lists.
+  - `isZodError()` now recognises a zod error by its name rather than `instanceof`. That is strictly more tolerant: the name still matches when an error crosses a realm boundary or comes from a second copy of zod, which `instanceof` misses — it was already the fallback arm of the same check.
+  
+  Two behaviour notes: a malformed entry in the fetched provider list now throws a plain `Error` naming the entry, where it used to throw an untranslated zod error; and the language codes accepted are unchanged.
+  
+  Covered by the existing suites for every package touched (types, types-database, locale, logger, common, load-balancer, all five procaptcha packages, api, cli, api-express-router, server, and the provider's 1322 unit tests), all passing. The built bundle was also loaded in a real browser: the widget renders from the first eight chunks, zod arrives in the second wave, and the provider's error came back translated into German.
+
+### Patch Changes
+
+- Updated dependencies [a9141c3]
+  - @prosopo/util@3.3.11
+
+## 3.5.0
+### Minor Changes
+
+- 59c02da: Replace React with vanilla TS/DOM in the widget.
+  
+  The widget packages no longer depend on react, react-dom, @emotion or
+  react-i18next: every component is now a `mount*` function returning a handle
+  with `update`/`destroy`. `useTranslation` is replaced by `createTranslator`,
+  which exposes i18next's `t` plus the events that used to trigger a re-render.
+  The rendered markup, styling and behaviour are unchanged — only the
+  implementation is.
+  
+  Everything the widget has gained since this rewrite started is carried over,
+  so nothing is lost by dropping React: the shared challenge surface (popup and
+  float placement, escape/outside-click dismissal and the dialog focus trap),
+  the image-tile and puzzle-piece keyboard paths, the checkbox's focus handover
+  across the loading swap, the server-rendered puzzle imagery, `startMode:
+  "manual"` with `window.procaptcha.start()`, `data-bind` / targeted
+  `execute(widgetId)`, the Web Bot Auth "authenticated" badge, the client
+  session id, and the bounded session re-mint and reload handling in the
+  frictionless wrapper.
+
+## 3.4.4
+### Patch Changes
+
+- a22069d: Let a Block access rule name the reason it fired, so the 403 says why instead of "Forbidden"
+
 ## 3.4.3
 ### Patch Changes
 

package/dist/cjs/i18SharedOptions.cjs

@@ -1,9 +1,9 @@
 const require_translations = require("./translations.cjs");
 var i18nSharedOptions = {
 	debug: require("./process.cjs").getProcess()?.env?.PROSOPO_LOG_LEVEL === "debug",
-	fallbackLng: require_translations.LanguageSchema.enum.en,
+	fallbackLng: require_translations.Languages.english,
 	namespace: "translation",
-	supportedLngs: Object.values(require_translations.Languages),
+	supportedLngs: require_translations.LanguageCodes,
 	nonExplicitSupportedLngs: false
 };
 //#endregion

package/dist/cjs/i18nBackend.cjs

@@ -1,9 +1,9 @@
 const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
 const require_util = require("./util.cjs");
 const require_i18SharedOptions = require("./i18SharedOptions.cjs");
-let i18next_http_middleware = require("i18next-http-middleware");
 let i18next = require("i18next");
 i18next = require_runtime.__toESM(i18next, 1);
+let i18next_http_middleware = require("i18next-http-middleware");
 let node_path = require("node:path");
 node_path = require_runtime.__toESM(node_path, 1);
 let i18next_fs_backend_cjs = require("i18next-fs-backend/cjs");

package/dist/cjs/i18nFrontend.cjs

@@ -1,62 +1,176 @@
-const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
 const require_i18SharedOptions = require("./i18SharedOptions.cjs");
-let react_i18next = require("react-i18next");
-let i18next = require("i18next");
-i18next = require_runtime.__toESM(i18next, 1);
-let i18next_browser_languagedetector = require("i18next-browser-languagedetector");
-i18next_browser_languagedetector = require_runtime.__toESM(i18next_browser_languagedetector, 1);
-let i18next_chained_backend = require("i18next-chained-backend");
-i18next_chained_backend = require_runtime.__toESM(i18next_chained_backend, 1);
-let i18next_http_backend = require("i18next-http-backend");
-i18next_http_backend = require_runtime.__toESM(i18next_http_backend, 1);
-let i18next_resources_to_backend = require("i18next-resources-to-backend");
-i18next_resources_to_backend = require_runtime.__toESM(i18next_resources_to_backend, 1);
+let _prosopo_util = require("@prosopo/util");
 //#region src/i18nFrontend.ts
-var reactOptions = {
-	react: { useSuspense: true },
-	detection: {
-		order: [
-			"navigator",
-			"htmlTag",
-			"path",
-			"subdomain"
-		],
-		caches: ["localStorage", "cookie"]
+var NAMESPACE = "translation";
+var FALLBACK_LANGUAGE = require_i18SharedOptions.i18nSharedOptions.fallbackLng;
+var STORAGE_KEY = "i18nextLng";
+var COOKIE_KEY = "i18next";
+var COOKIE_MAX_AGE_SECONDS = 10080 * 60;
+/**
+* How long to wait for a catalogue before rendering untranslated.
+*
+* A widget with no text is worse than a widget in English: every caller
+* supplies a `defaultValue`, and `t()` falls back to the key otherwise, so a
+* catalogue that never arrives degrades rather than blocks.
+*/
+var CATALOGUE_FETCH_TIMEOUT_MS = 1e4;
+var SUPPORTED_LANGUAGES = require_i18SharedOptions.i18nSharedOptions.supportedLngs;
+/**
+* Locale JSON sits next to the bundle that asked for it. The widget is embedded
+* by third parties and cannot know a base URL, but it does know where its own
+* module was served from.
+*/
+var catalogueUrl = (language) => {
+	const moduleUrl = require("url").pathToFileURL(__filename).href;
+	return `${moduleUrl.slice(0, moduleUrl.lastIndexOf("/"))}/locales/${language}/${NAMESPACE}.json`;
+};
+/**
+* `en-GB` is not in the catalogue list but `en` is, so a regional tag resolves
+* to its base language rather than falling all the way back to English.
+*/
+var resolveLanguage = (candidate) => {
+	if (!candidate) return;
+	if (SUPPORTED_LANGUAGES.includes(candidate)) return candidate;
+	const base = candidate.split("-")[0];
+	return base && SUPPORTED_LANGUAGES.includes(base) ? base : void 0;
+};
+var readCookie = () => {
+	try {
+		const match = document.cookie.match(new RegExp(`(?:^|; )${COOKIE_KEY}=([^;]*)`));
+		return match?.[1] ? decodeURIComponent(match[1]) : void 0;
+	} catch {
+		return;
+	}
+};
+var readStorage = () => {
+	try {
+		return localStorage.getItem(STORAGE_KEY) ?? void 0;
+	} catch {
+		return;
+	}
+};
+var navigatorLanguages = () => {
+	try {
+		return navigator.languages?.length ? navigator.languages : [navigator.language];
+	} catch {
+		return [];
+	}
+};
+/**
+* Cookie and localStorage are both written, matching what the widget did when
+* i18next-browser-languagedetector handled this, so a visitor's choice survives
+* across pages that embed the widget. Either store can throw in a sandboxed
+* iframe or with third-party storage blocked; neither is load-bearing.
+*/
+var cacheLanguage = (language) => {
+	try {
+		localStorage.setItem(STORAGE_KEY, language);
+	} catch {}
+	try {
+		document.cookie = `${COOKIE_KEY}=${encodeURIComponent(language)};max-age=${COOKIE_MAX_AGE_SECONDS};path=/`;
+	} catch {}
+};
+var detectLanguage = () => {
+	const candidates = [
+		readCookie(),
+		readStorage(),
+		...navigatorLanguages()
+	];
+	for (const candidate of candidates) {
+		const resolved = resolveLanguage(candidate);
+		if (resolved) return resolved;
+	}
+	return FALLBACK_LANGUAGE;
+};
+var fetchCatalogue = async (language) => {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), CATALOGUE_FETCH_TIMEOUT_MS);
+	try {
+		const response = await fetch(catalogueUrl(language), { signal: controller.signal });
+		if (!response.ok) return {};
+		const body = await response.json();
+		return typeof body === "object" && body !== null ? (0, _prosopo_util.flatten)(body) : {};
+	} catch {
+		return {};
+	} finally {
+		clearTimeout(timer);
 	}
 };
-var getLoadPath = (language, namespace) => {
-	const filename = require("url").pathToFileURL(__filename).href.split("/").pop();
-	return `${require("url").pathToFileURL(__filename).href.replace(`/${filename}`, "")}/locales/${language}/${namespace}.json`;
+var interpolate = (template, options) => options ? template.replace(/\{\{(\w+)\}\}/g, (placeholder, name) => name in options ? String(options[name]) : placeholder) : template;
+var createBrowserI18n = (requested) => {
+	const catalogues = /* @__PURE__ */ new Map();
+	const listeners = /* @__PURE__ */ new Map();
+	let language = resolveLanguage(requested) ?? detectLanguage();
+	let initialised = false;
+	const emit = (event) => {
+		for (const listener of listeners.get(event) ?? []) listener();
+	};
+	/**
+	* The fallback catalogue is fetched alongside the active one so a key
+	* missing from a translation still renders English rather than its key —
+	* the same key-level fallback i18next gave us via `fallbackLng`.
+	*/
+	const loadCatalogues = async (target) => {
+		const wanted = [.../* @__PURE__ */ new Set([target, FALLBACK_LANGUAGE])].filter((candidate) => !catalogues.has(candidate));
+		await Promise.all(wanted.map(async (candidate) => {
+			catalogues.set(candidate, await fetchCatalogue(candidate));
+		}));
+	};
+	const lookup = (candidate, key) => catalogues.get(candidate)?.[key];
+	cacheLanguage(language);
+	const loading = loadCatalogues(language).then(() => {
+		initialised = true;
+		emit("initialized");
+		emit("loaded");
+	});
+	const instance = {
+		get language() {
+			return language;
+		},
+		get isInitialized() {
+			return initialised;
+		},
+		t: (key, options) => interpolate(lookup(language, key) ?? lookup(FALLBACK_LANGUAGE, key) ?? options?.defaultValue ?? key, options),
+		hasLoadedNamespace: (namespace) => namespace === NAMESPACE && catalogues.has(language),
+		changeLanguage: async (next) => {
+			const resolved = resolveLanguage(next) ?? FALLBACK_LANGUAGE;
+			if (resolved !== language) {
+				language = resolved;
+				cacheLanguage(resolved);
+				await loadCatalogues(resolved);
+				emit("loaded");
+				emit("languageChanged");
+			}
+			return instance;
+		},
+		on: (event, listener) => {
+			const existing = listeners.get(event) ?? /* @__PURE__ */ new Set();
+			existing.add(listener);
+			listeners.set(event, existing);
+		},
+		off: (event, listener) => {
+			listeners.get(event)?.delete(listener);
+		},
+		ready: async () => {
+			await loading;
+			return instance;
+		}
+	};
+	return instance;
 };
+/**
+* The widget owns this instance. A host page running its own i18n must not be
+* able to capture the widget's translations, and every widget on the page
+* shares one catalogue fetch.
+*/
+var instance;
 function initializeI18n(i18nLoadedCallback, lng) {
-	if (!i18next.default.isInitialized) {
-		i18next.default.use(i18next_chained_backend.default).use(new i18next_browser_languagedetector.default(null, {
-			order: [
-				"cookie",
-				"localStorage",
-				"navigator"
-			],
-			lookupQuerystring: "lng",
-			lookupCookie: "i18next",
-			lookupLocalStorage: "i18nextLng",
-			caches: ["localStorage", "cookie"]
-		})).use(react_i18next.initReactI18next).init({
-			...require_i18SharedOptions.i18nSharedOptions,
-			...lng ? { lng } : {},
-			backend: {
-				backends: [i18next_http_backend.default, (0, i18next_resources_to_backend.default)((language, namespace) => import(getLoadPath(language, namespace)))],
-				backendOptions: [{ loadPath: getLoadPath("{{lng}}", "{{ns}}") }]
-			},
-			...reactOptions
-		});
-		let notified = false;
-		i18next.default.on("loaded", () => {
-			if (notified) return;
-			notified = true;
-			i18nLoadedCallback?.(i18next.default);
-		});
-	} else i18nLoadedCallback?.(i18next.default);
-	return i18next.default;
+	if (!instance) {
+		const created = createBrowserI18n(lng);
+		instance = created;
+		created.ready().then(() => i18nLoadedCallback?.(created));
+	} else i18nLoadedCallback?.(instance);
+	return instance;
 }
 //#endregion
 exports.default = initializeI18n;

package/dist/cjs/i18nMiddleware.cjs

@@ -1,9 +1,12 @@
+const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
 const require_loadI18next = require("./loadI18next.cjs");
+let i18next = require("i18next");
+i18next = require_runtime.__toESM(i18next, 1);
 let i18next_http_middleware = require("i18next-http-middleware");
 //#region src/i18nMiddleware.ts
 async function i18nMiddleware(options) {
-	const i18n = await require_loadI18next.default(true);
-	return (0, i18next_http_middleware.handle)(i18n, { ...options });
+	await require_loadI18next.default(true);
+	return (0, i18next_http_middleware.handle)(i18next.default, { ...options });
 }
 //#endregion
 exports.default = i18nMiddleware;

package/dist/cjs/index.cjs

@@ -4,11 +4,12 @@ const require_i18nMiddleware = require("./i18nMiddleware.cjs");
 const require_translations = require("./translations.cjs");
 const require_util = require("./util.cjs");
 const require_translationKey = require("./translationKey.cjs");
-const require_useTranslation = require("./useTranslation.cjs");
-exports.LanguageSchema = require_translations.LanguageSchema;
+const require_translator = require("./translator.cjs");
+exports.LanguageCodes = require_translations.LanguageCodes;
 exports.Languages = require_translations.Languages;
-exports.TranslationKeysSchema = require_translationKey.TranslationKeysSchema;
+exports.createTranslator = require_translator.createTranslator;
 exports.i18nMiddleware = require_i18nMiddleware.default;
 exports.isClientSide = require_util.isClientSide;
+exports.isLanguage = require_translations.isLanguage;
 exports.loadI18next = require_loadI18next.default;
-exports.useTranslation = require_useTranslation.default;
+exports.translationKeys = require_translationKey.translationKeys;

package/dist/cjs/locales/en/translation.cjs

@@ -137,6 +137,7 @@ var API = {
 	"SPAM_EMAIL_COUNT_EXCEEDED": "Too many submissions from this email address",
 	"VPN_BLOCKED": "Requests from VPN connections are not allowed for this site",
 	"PROXY_BLOCKED": "Requests from proxy servers are not allowed for this site",
+	"TOO_MANY_LOCALHOST": "Too many CAPTCHA requests from localhost for this site key",
 	"TOR_BLOCKED": "Requests from Tor exit nodes are not allowed for this site",
 	"ABUSER_BLOCKED": "Requests from networks flagged for abuse are not allowed for this site",
 	"DATACENTER_BLOCKED": "Requests from datacenter IP addresses are not allowed for this site",

package/dist/cjs/translationKey.cjs

@@ -1,5 +1,4 @@
 const require_translation = require("./locales/en/translation.cjs");
-let zod = require("zod");
 //#region src/translationKey.ts
 function getLeafFieldPath(obj) {
 	if (typeof obj === "string") return [];
@@ -13,7 +12,7 @@ function getLeafFieldPath(obj) {
 		}));
 	}, []);
 }
-var TranslationKeysSchema = zod.z.enum(getLeafFieldPath(require_translation.default));
+var translationKeys = getLeafFieldPath(require_translation.default);
 //#endregion
-exports.TranslationKeysSchema = TranslationKeysSchema;
 exports.getLeafFieldPath = getLeafFieldPath;
+exports.translationKeys = translationKeys;

package/dist/cjs/translations.cjs

@@ -1,6 +1,3 @@
-const require_runtime = require("./_virtual/_rolldown/runtime.cjs");
-let zod = require("zod");
-zod = require_runtime.__toESM(zod, 1);
 //#region src/translations.ts
 var Languages = {
 	arabic: "ar",
@@ -36,7 +33,9 @@ var Languages = {
 	vietnamese: "vi",
 	chinese: "zh-CN"
 };
-var LanguageSchema = zod.default.enum(Object.values(Languages));
+var LanguageCodes = Object.values(Languages);
+var isLanguage = (value) => LanguageCodes.includes(value);
 //#endregion
-exports.LanguageSchema = LanguageSchema;
+exports.LanguageCodes = LanguageCodes;
 exports.Languages = Languages;
+exports.isLanguage = isLanguage;

package/dist/cjs/translator.cjs

@@ -0,0 +1,29 @@
+const require_i18nFrontend = require("./i18nFrontend.cjs");
+//#region src/translator.ts
+var NAMESPACE = "translation";
+/**
+* Vanilla replacement for the `useTranslation` hook: the instance's `t` plus
+* the three events that used to trigger a React re-render.
+*/
+var createTranslator = (existing) => {
+	const i18n = existing ?? require_i18nFrontend.default();
+	const isReady = () => i18n.isInitialized && i18n.hasLoadedNamespace(NAMESPACE);
+	return {
+		t: (key, options) => i18n.t(key, options),
+		isReady,
+		i18n,
+		subscribe: (listener) => {
+			const events = [
+				"initialized",
+				"loaded",
+				"languageChanged"
+			];
+			for (const event of events) i18n.on(event, listener);
+			return () => {
+				for (const event of events) i18n.off(event, listener);
+			};
+		}
+	};
+};
+//#endregion
+exports.createTranslator = createTranslator;

package/dist/i18SharedOptions.d.ts

@@ -1,8 +1,8 @@
 export declare const i18nSharedOptions: {
     debug: boolean;
-    fallbackLng: string | undefined;
+    fallbackLng: "en";
     namespace: string;
-    supportedLngs: ("ar" | "az" | "cs" | "de" | "el" | "en" | "es" | "fi" | "fr" | "hi" | "hu" | "id" | "it" | "ja" | "jv" | "ko" | "ml" | "ms" | "nl" | "no" | "pl" | "pt-BR" | "pt" | "ro" | "ru" | "sr" | "sv" | "th" | "tr" | "uk" | "vi" | "zh-CN")[];
+    supportedLngs: readonly string[];
     nonExplicitSupportedLngs: boolean;
 };
 //# sourceMappingURL=i18SharedOptions.d.ts.map

package/dist/i18SharedOptions.js

@@ -1,10 +1,10 @@
-import { LanguageSchema, Languages } from "./translations.js";
+import { LanguageCodes, Languages } from "./translations.js";
 import { getProcess } from "./process.js";
 var i18nSharedOptions = {
 	debug: getProcess()?.env?.PROSOPO_LOG_LEVEL === "debug",
-	fallbackLng: LanguageSchema.enum.en,
+	fallbackLng: Languages.english,
 	namespace: "translation",
-	supportedLngs: Object.values(Languages),
+	supportedLngs: LanguageCodes,
 	nonExplicitSupportedLngs: false
 };
 //#endregion

package/dist/i18SharedOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"i18SharedOptions.js","sourceRoot":"","sources":["../src/i18SharedOptions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,QAAQ,GAAG,UAAU,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,KAAK,EAAE,QAAQ,KAAK,OAAO;IAC3B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE;IACnC,SAAS,EAAE,aAAa;IACxB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;IACvC,wBAAwB,EAAE,KAAK;CAC/B,CAAC"}
+{"version":3,"file":"i18SharedOptions.js","sourceRoot":"","sources":["../src/i18SharedOptions.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAM7D,MAAM,QAAQ,GAAG,UAAU,EAAE,EAAE,GAAG,EAAE,iBAAiB,CAAC;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,KAAK,EAAE,QAAQ,KAAK,OAAO;IAC3B,WAAW,EAAE,SAAS,CAAC,OAAO;IAC9B,SAAS,EAAE,aAAa;IACxB,aAAa,EAAE,aAAa;IAC5B,wBAAwB,EAAE,KAAK;CAC/B,CAAC"}

package/dist/i18nBackend.js

@@ -1,8 +1,8 @@
 import "./_virtual/_rolldown/runtime.js";
 import { isServerSide } from "./util.js";
 import { i18nSharedOptions } from "./i18SharedOptions.js";
-import { LanguageDetector } from "i18next-http-middleware";
 import i18n from "i18next";
+import { LanguageDetector } from "i18next-http-middleware";
 import path from "node:path";
 import FSBackend from "i18next-fs-backend/cjs";
 //#region src/i18nBackend.ts