@remit/web-client 0.0.157 → 0.0.159

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/web-client",
-  "version": "0.0.157",
+  "version": "0.0.159",
   "type": "module",
   "description": "Remit web client, published as composable primitives — the app shell, auth shells, and runtime config. A distributor imports what it composes and bundles it.",
   "exports": {
@@ -17,6 +17,7 @@
   "files": [
     "src",
     "harness",
+    "spellcheck",
     "vite.base.ts",
     "public",
     "index.html"
@@ -29,10 +30,13 @@
     "build:dist": "npm run generate:routes && node --import tsx harness/build.mjs",
     "preview": "vite preview",
     "test:typecheck": "npm run generate:routes && tsgo --noEmit && tsgo --noEmit -p tsconfig.node.json",
-    "test:run": "TSX_TSCONFIG_PATH=./tsconfig.test.json node $NODE_TEST_FLAGS --import tsx --import ./test-support/register.mjs --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-exclude='src/test-support/**' --test-coverage-lines=86 --test 'src/**/*.test.ts'",
+    "test:run": "TSX_TSCONFIG_PATH=./tsconfig.test.json node $NODE_TEST_FLAGS --import tsx --import ./test-support/register.mjs --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-exclude='src/**/*.test.ts' --test-coverage-exclude='src/**/*.test.tsx' --test-coverage-exclude='src/test-support/**' --test-coverage-lines=86 --test 'src/**/*.test.ts' 'spellcheck/**/*.test.ts'",
     "test": "npm run test:typecheck && npm run test:run"
   },
   "peerDependencies": {
+    "dictionary-en": "^4",
+    "dictionary-en-gb": "^3",
+    "dictionary-nl": "^2",
     "react": "^19",
     "react-dom": "^19",
     "vite": "^7",
@@ -43,6 +47,15 @@
     "@types/react-dom": "^19"
   },
   "peerDependenciesMeta": {
+    "dictionary-en": {
+      "optional": true
+    },
+    "dictionary-en-gb": {
+      "optional": true
+    },
+    "dictionary-nl": {
+      "optional": true
+    },
     "vite": {
       "optional": true
     },
@@ -101,6 +114,9 @@
     "@types/nodemailer": "*",
     "@types/pngjs": "^6.0.5",
     "@vitejs/plugin-react": "^4",
+    "dictionary-en": "4.0.0",
+    "dictionary-en-gb": "3.0.0",
+    "dictionary-nl": "2.0.0",
     "electrodb": "*",
     "esbuild": "*",
     "expect-env": "*",

package/spellcheck/empty-build.test.ts

@@ -0,0 +1,160 @@
+/**
+ * The self-hoster's opt-out, proven by building it.
+ *
+ * `REMIT_SPELLCHECK_LANGUAGES=` is the documented way to build an image with no
+ * spellchecker — a small box, or an operator who does not want to carry
+ * somebody else's licence obligations. What it has to produce is a *clean*
+ * build: a web client that works, with no `spellcheck/` tree to serve, and none
+ * of the worker's code shipped to browsers that can never start it. Nothing
+ * short of a real build can tell those apart from a broken one, so this runs
+ * vite twice and reads the output.
+ *
+ * The second build is the control. Asserting only that an empty list emits no
+ * worker chunk would pass just as well if the chunk were renamed, if the
+ * composer stopped reaching the worker at all, or if the build quietly produced
+ * nothing — so the same assertions are made against a build that must carry it.
+ */
+
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative, resolve, sep } from "node:path";
+import { after, before, describe, it } from "node:test";
+
+const packageRoot = resolve(import.meta.dirname, "..");
+
+const BUILD_TIMEOUT_MS = 600_000;
+
+const outputs: string[] = [];
+
+// A child process, because the language set is read out of the environment when
+// the plugin configures itself and two builds in one process would share it.
+const build = (languages: string): readonly string[] => {
+	const outDir = mkdtempSync(join(tmpdir(), "spellcheck-build-"));
+	outputs.push(outDir);
+	const result = spawnSync(
+		process.execPath,
+		[
+			"--input-type=module",
+			"-e",
+			`import { build } from "vite";
+			 await build({
+				 logLevel: "warn",
+				 build: { outDir: ${JSON.stringify(outDir)}, emptyOutDir: true },
+			 });`,
+		],
+		{
+			cwd: packageRoot,
+			encoding: "utf8",
+			env: { ...process.env, REMIT_SPELLCHECK_LANGUAGES: languages },
+		},
+	);
+	assert.equal(
+		result.status,
+		0,
+		`vite build with REMIT_SPELLCHECK_LANGUAGES="${languages}" failed:\n${result.stdout}\n${result.stderr}`,
+	);
+	return emitted(outDir);
+};
+
+const emitted = (root: string): readonly string[] => {
+	const found: string[] = [];
+	const walk = (current: string): void => {
+		for (const entry of readdirSync(current, { withFileTypes: true })) {
+			const full = join(current, entry.name);
+			if (entry.isDirectory()) {
+				walk(full);
+				continue;
+			}
+			found.push(relative(root, full).split(sep).join("/"));
+		}
+	};
+	walk(root);
+	return found.sort();
+};
+
+/**
+ * The worker, the port it speaks over, and the bundle vite emits for the `new
+ * Worker(new URL(...))` that reaches it. Vite emits that bundle while
+ * transforming the module rather than while writing the output, so it survives
+ * tree-shaking: its absence means the specifier never resolved there at all.
+ */
+const workerChunks = (files: readonly string[]): readonly string[] =>
+	files.filter((file) => /rich-text-spellcheck-/.test(file));
+
+const spellcheckAssets = (files: readonly string[]): readonly string[] =>
+	files.filter((file) => file.startsWith("spellcheck/"));
+
+describe("a build that carries no dictionaries", () => {
+	let files: readonly string[] = [];
+
+	before(
+		() => {
+			files = build("");
+		},
+		{ timeout: BUILD_TIMEOUT_MS },
+	);
+
+	after(() => {
+		for (const outDir of outputs)
+			rmSync(outDir, { recursive: true, force: true });
+	});
+
+	it("is still a web client", () => {
+		assert.ok(files.includes("index.html"), "the build emitted no index.html");
+		assert.ok(
+			files.some((file) => file.startsWith("assets/") && file.endsWith(".js")),
+			"the build emitted no JavaScript",
+		);
+	});
+
+	it("serves no spellcheck tree", () => {
+		assert.deepEqual(spellcheckAssets(files), []);
+	});
+
+	it("ships no worker to browsers that could never start it", () => {
+		assert.deepEqual(workerChunks(files), []);
+	});
+});
+
+describe("a build that carries one", () => {
+	let files: readonly string[] = [];
+
+	before(
+		() => {
+			files = build("nl");
+		},
+		{ timeout: BUILD_TIMEOUT_MS },
+	);
+
+	it("stages the engine, the dictionary and the notice", () => {
+		// The staged directory is named after a digest of its own contents, so
+		// what is asserted is the tree under it rather than the whole path.
+		const staged = spellcheckAssets(files).map((file) =>
+			file.replace(/^spellcheck\/[0-9a-f]+\//, ""),
+		);
+		// English rides along whether or not it was asked for: it is the language
+		// every account is guaranteed to offer.
+		assert.deepEqual(staged.sort(), [
+			"LICENSE",
+			"NOTICE.txt",
+			"dictionaries/en/LICENSE",
+			"dictionaries/en/index.aff",
+			"dictionaries/en/index.dic",
+			"dictionaries/nl/LICENSE",
+			"dictionaries/nl/index.aff",
+			"dictionaries/nl/index.dic",
+			"hunspell.mjs",
+			"hunspell.wasm",
+			"license.hunspell",
+			"manifest.json",
+		]);
+	});
+
+	// The control for the two assertions above: both names are real, and a build
+	// that should carry them does.
+	it("ships the worker the empty build must not", () => {
+		assert.notDeepEqual(workerChunks(files), []);
+	});
+});

package/spellcheck/languages.test.ts

@@ -0,0 +1,80 @@
+/**
+ * The switch, at the point where a self-hoster's `REMIT_SPELLCHECK_LANGUAGES`
+ * becomes the set the image carries. Everything downstream — the staged files,
+ * the manifest, NOTICE.txt, and what the composer believes it can check — is
+ * that set and nothing else, so a wrong answer here is wrong everywhere at once.
+ */
+
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import {
+	DEFAULT_SPELLCHECK_LANGUAGES,
+	DICTIONARY_SOURCES,
+	resolveLanguages,
+} from "./languages.ts";
+
+const tagsOf = (requested: string | undefined): readonly string[] =>
+	resolveLanguages(requested).map((source) => source.tag);
+
+describe("the language set an image is built with", () => {
+	it("carries the published default when nothing is asked for", () => {
+		assert.deepEqual(
+			tagsOf(undefined),
+			DEFAULT_SPELLCHECK_LANGUAGES.split(","),
+		);
+	});
+
+	// `defaultComposeLanguages` appends `en` to every account, so an image
+	// without it would leave the one language every account offers as the one
+	// language it cannot check.
+	it("carries English whether or not it was asked for", () => {
+		assert.deepEqual(tagsOf("nl"), ["en", "nl"]);
+		assert.equal(tagsOf("en,nl")[0], "en");
+	});
+
+	it("reads a tag the same however it was typed, and carries it once", () => {
+		assert.deepEqual(tagsOf(" nl , EN-gb ,nl, en "), ["en", "nl", "en-GB"]);
+	});
+
+	// The self-hoster's opt-out. An empty list is a legitimate answer and not a
+	// typo to be corrected into the default, so it does not acquire English.
+	it("carries nothing at all when the list is empty", () => {
+		assert.deepEqual(tagsOf(""), []);
+		assert.deepEqual(tagsOf("  "), []);
+		assert.deepEqual(tagsOf(",, ,"), []);
+	});
+
+	it("hands back the whole row, not just the tag", () => {
+		const [english] = resolveLanguages("en");
+		assert.equal(english.package, "dictionary-en");
+		assert.ok(english.licence.length > 0);
+		assert.ok(english.source.startsWith("https://"));
+	});
+
+	// A tag nobody can ship must stop the build rather than quietly produce an
+	// image whose NOTICE.txt is a list of what the operator asked for.
+	it("stops on a tag no dictionary covers, and says which one", () => {
+		assert.throws(
+			() => resolveLanguages("en,nl,fi"),
+			(failed: Error) => {
+				assert.match(failed.message, /"fi"/);
+				assert.match(
+					failed.message,
+					/packages\/web-client\/spellcheck\/languages/,
+				);
+				// The remedy is picking a known tag, so the message lists them.
+				for (const source of DICTIONARY_SOURCES) {
+					assert.ok(
+						failed.message.includes(source.tag),
+						`the failure does not offer ${source.tag}`,
+					);
+				}
+				return true;
+			},
+		);
+	});
+
+	it("stops on an unknown tag even when every other tag is known", () => {
+		assert.throws(() => resolveLanguages("nl,de"), /"de"/);
+	});
+});

package/spellcheck/languages.ts

@@ -0,0 +1,86 @@
+/**
+ * Every dictionary this repo knows how to ship, and everything the image owes
+ * for carrying one. Adding a language is a row here, its `dictionary-*` package
+ * in `devDependencies`, and its tag in `REMIT_SPELLCHECK_LANGUAGES` — no code.
+ *
+ * A `.aff` and a `.dic` are data an engine reads at runtime, so carrying one is
+ * aggregation and reader's own licence is untouched. What each licence does
+ * oblige is that its text travels with the file and that the served bytes are
+ * the upstream source; both are build outputs, generated from this table.
+ */
+
+export interface DictionarySource {
+	/** BCP 47, and the directory name the browser fetches under. */
+	readonly tag: string;
+	readonly package: string;
+	readonly project: string;
+	readonly authors: string;
+	readonly source: string;
+	/** SPDX, with the option taken where upstream offers a choice. */
+	readonly licence: string;
+}
+
+export const DICTIONARY_SOURCES: readonly DictionarySource[] = [
+	{
+		tag: "en",
+		package: "dictionary-en",
+		project: "SCOWL",
+		authors: "Kevin Atkinson and contributors",
+		source: "https://github.com/wooorm/dictionaries/tree/main/dictionaries/en",
+		licence: "MIT AND BSD-3-Clause",
+	},
+	{
+		tag: "en-GB",
+		package: "dictionary-en-gb",
+		project: "SCOWL",
+		authors: "Kevin Atkinson and contributors",
+		source:
+			"https://github.com/wooorm/dictionaries/tree/main/dictionaries/en-GB",
+		licence: "MIT AND BSD-3-Clause",
+	},
+	{
+		tag: "nl",
+		package: "dictionary-nl",
+		project: "OpenTaal",
+		authors: "Stichting OpenTaal",
+		source: "https://github.com/wooorm/dictionaries/tree/main/dictionaries/nl",
+		licence: "CC-BY-3.0",
+	},
+];
+
+/**
+ * What the published image carries. Everything else in the table above is a
+ * language this repo can build and does not; the list is the switch.
+ */
+export const DEFAULT_SPELLCHECK_LANGUAGES = "en,en-GB,nl";
+
+/**
+ * `defaultComposeLanguages` appends `en` to every account's candidate set, so a
+ * build without it would leave the one language every account is guaranteed to
+ * offer as the one with no dictionary. The switch normalises rather than
+ * validates.
+ */
+export const resolveLanguages = (
+	requested: string | undefined,
+): readonly DictionarySource[] => {
+	const asked = (requested ?? DEFAULT_SPELLCHECK_LANGUAGES)
+		.split(",")
+		.map((tag) => tag.trim())
+		.filter((tag) => tag !== "");
+	if (asked.length === 0) return [];
+
+	const known = new Map(
+		DICTIONARY_SOURCES.map((source) => [source.tag.toLowerCase(), source]),
+	);
+	const wanted: DictionarySource[] = [];
+	for (const tag of ["en", ...asked]) {
+		const source = known.get(tag.toLowerCase());
+		if (!source) {
+			throw new Error(
+				`REMIT_SPELLCHECK_LANGUAGES names "${tag}", which no dictionary in packages/web-client/spellcheck/languages.ts covers. Known tags: ${DICTIONARY_SOURCES.map((entry) => entry.tag).join(", ")}.`,
+			);
+		}
+		if (!wanted.includes(source)) wanted.push(source);
+	}
+	return wanted;
+};

package/spellcheck/vite-plugin-licence.test.ts

@@ -0,0 +1,92 @@
+/**
+ * A dictionary whose licence text cannot travel with it must stop the build.
+ *
+ * Every licence in the table obliges the text to ship alongside the files, and
+ * the build generates NOTICE.txt from the same rows — so a package that lost its
+ * licence file (an upstream repackage, a pruned install) would otherwise produce
+ * an image whose notice points at a `LICENSE` nobody staged. That is the one
+ * failure mode a reader cannot see and a distributor is answerable for.
+ *
+ * The dictionary is shadowed rather than the real one damaged: node resolves
+ * from the importer outwards, so a package planted in this directory's own
+ * `node_modules` answers for `dictionary-en-gb` here and nowhere else. That
+ * makes this file its own process — node's test runner gives each file one —
+ * because module resolution is cached per process and a sibling test resolving
+ * the real package first would decide which one this sees.
+ */
+
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, describe, it } from "node:test";
+
+const shadowRoot = join(import.meta.dirname, "node_modules");
+const shadow = join(shadowRoot, "dictionary-en-gb");
+mkdirSync(shadow, { recursive: true });
+writeFileSync(
+	join(shadow, "package.json"),
+	JSON.stringify({ name: "dictionary-en-gb", version: "0.0.0-shadow" }),
+);
+writeFileSync(join(shadow, "index.js"), "");
+writeFileSync(join(shadow, "index.aff"), "SET UTF-8\n");
+writeFileSync(join(shadow, "index.dic"), "1\nword\n");
+
+const engineDir = mkdtempSync(join(tmpdir(), "spellcheck-engine-"));
+for (const name of [
+	"hunspell.wasm",
+	"hunspell.mjs",
+	"LICENSE",
+	"license.hunspell",
+]) {
+	writeFileSync(join(engineDir, name), "stub");
+}
+process.env.REMIT_SPELLCHECK_ENGINE_DIR = engineDir;
+
+const { stageSpellcheck } = await import("./vite-plugin.ts");
+
+after(() => {
+	rmSync(shadow, { recursive: true, force: true });
+	rmSync(shadowRoot, { recursive: true, force: true });
+	rmSync(engineDir, { recursive: true, force: true });
+});
+
+describe("a dictionary that ships no licence text", () => {
+	it("stops the build rather than staging it", () => {
+		assert.throws(() => stageSpellcheck("en-GB", "/"));
+	});
+
+	// The remedy is the whole message: which directory, and why a missing
+	// licence file is fatal rather than something the notice can paper over.
+	it("names the directory and what is wrong with it", () => {
+		assert.throws(
+			() => stageSpellcheck("en-GB", "/"),
+			(failed: Error) => {
+				assert.ok(
+					failed.message.includes(shadow),
+					`the failure does not name the dictionary directory: ${failed.message}`,
+				);
+				assert.match(failed.message, /licence/i);
+				assert.match(failed.message, /NOTICE\.txt/);
+				return true;
+			},
+		);
+	});
+
+	// The languages before the broken one must not reach the output either: a
+	// half-staged tree with a complete-looking notice is worse than no build.
+	it("takes the whole build with it, not just that language", () => {
+		assert.throws(() => stageSpellcheck("en,en-GB", "/"));
+	});
+});
+
+describe("a dictionary that does ship one", () => {
+	it("stages the licence text beside the files it covers", () => {
+		const build = stageSpellcheck("en", "/");
+		const licence = build.files.find(
+			(file) => file.path === "dictionaries/en/LICENSE",
+		);
+		assert.ok(licence);
+		assert.ok(licence.source.byteLength > 0);
+	});
+});

package/spellcheck/vite-plugin.test.ts

@@ -0,0 +1,230 @@
+/**
+ * What the build stages, and whether NOTICE.txt describes it.
+ *
+ * The licence obligation this repo took on is that the notice matches the image
+ * exactly and that the served dictionary is the upstream file — which is the
+ * whole reason the language set is fixed at build time rather than chosen at
+ * run time. A notice that names a dictionary the image does not carry, or omits
+ * one it does, is a licence failure and not a cosmetic one, so the chain from
+ * the resolved set through the manifest to the notice is asserted end to end
+ * rather than at either end.
+ *
+ * This runs in the checkout, against the dictionary packages actually
+ * installed, which is what makes the byte-for-byte and licence-text assertions
+ * mean anything. `npm-scripts/lib/spellcheck-staging.test.mjs` is the other
+ * half: the same function against a synthetic tree shaped like the published
+ * package, where the question is which file gets read and what a distributor is
+ * told when one is missing. Base, `servePath` and the digest belong to that
+ * one.
+ *
+ * The engine is stubbed: what it weighs is gated where it is built
+ * (npm-scripts/build-hunspell.mjs), and staging it here would make every one of
+ * these tests wait on a WebAssembly toolchain.
+ */
+
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { describe, it } from "node:test";
+
+const require = createRequire(import.meta.url);
+
+const ENGINE_FILES = {
+	"hunspell.wasm": "\0asm stub",
+	"hunspell.mjs": "export default () => {};",
+	LICENSE: "Mozilla Public Licence 1.1, stub",
+	"license.hunspell": "Hunspell licence, stub",
+};
+
+const engineDir = mkdtempSync(join(tmpdir(), "spellcheck-engine-"));
+for (const [name, body] of Object.entries(ENGINE_FILES)) {
+	writeFileSync(join(engineDir, name), body);
+}
+
+process.env.REMIT_SPELLCHECK_ENGINE_DIR = engineDir;
+const { stageSpellcheck } = await import("./vite-plugin.ts");
+
+const staged = (requested: string) => stageSpellcheck(requested, "/");
+
+const fileNamed = (
+	build: ReturnType<typeof staged>,
+	path: string,
+): Buffer | undefined => build.files.find((file) => file.path === path)?.source;
+
+const textOf = (build: ReturnType<typeof staged>, path: string): string => {
+	const found = fileNamed(build, path);
+	if (!found) throw new Error(`${path} was not staged`);
+	return found.toString("utf8");
+};
+
+/** The tags NOTICE.txt claims this image carries, read back off the notice. */
+const tagsNoticed = (notice: string): readonly string[] => {
+	const dictionaries = notice.split("\nDictionaries\n")[1];
+	if (dictionaries === undefined) {
+		throw new Error("NOTICE.txt has no Dictionaries section");
+	}
+	return dictionaries
+		.split("\n")
+		.map((line) => /^(\S+) — /.exec(line)?.[1])
+		.filter((tag): tag is string => tag !== undefined);
+};
+
+/** The tags the image actually carries a dictionary for. */
+const tagsStaged = (build: ReturnType<typeof staged>): readonly string[] => [
+	...new Set(
+		build.files
+			.map((file) => /^dictionaries\/([^/]+)\//.exec(file.path)?.[1])
+			.filter((tag): tag is string => tag !== undefined),
+	),
+];
+
+describe("what a build stages", () => {
+	it("stages the engine, both dictionary files and a licence per language", () => {
+		const build = staged("en,nl");
+		const paths = build.files.map((file) => file.path).sort();
+		assert.deepEqual(paths, [
+			"LICENSE",
+			"NOTICE.txt",
+			"dictionaries/en/LICENSE",
+			"dictionaries/en/index.aff",
+			"dictionaries/en/index.dic",
+			"dictionaries/nl/LICENSE",
+			"dictionaries/nl/index.aff",
+			"dictionaries/nl/index.dic",
+			"hunspell.mjs",
+			"hunspell.wasm",
+			"license.hunspell",
+			"manifest.json",
+		]);
+	});
+
+	// GPL and MPL correspondence is discharged by the served file being the
+	// upstream one. Anything that rewrote a dictionary on the way through —
+	// a normaliser, a re-encode, a line-ending fix — would break that quietly.
+	it("serves the upstream dictionary byte for byte", () => {
+		const build = staged("nl");
+		const upstream = dirname(require.resolve("dictionary-nl"));
+		for (const name of ["index.aff", "index.dic"]) {
+			assert.deepEqual(
+				fileNamed(build, `dictionaries/nl/${name}`),
+				readFileSync(join(upstream, name)),
+				`dictionaries/nl/${name} is not the upstream file`,
+			);
+		}
+	});
+});
+
+describe("NOTICE.txt", () => {
+	it("names every language the image carries", () => {
+		const build = staged("en,en-GB,nl");
+		const noticed = tagsNoticed(textOf(build, "NOTICE.txt"));
+		assert.deepEqual([...noticed].sort(), ["en", "en-GB", "nl"]);
+	});
+
+	// Over-claiming is the failure that matters: a notice listing a dictionary
+	// the image does not carry offers a licence text nobody can find, and one
+	// missing a dictionary it does carry ships that dictionary with no licence
+	// at all. Both are the same defect from opposite sides, so the three lists
+	// the build produces are compared to each other rather than to a fixture.
+	it("names only the languages the image carries", () => {
+		for (const requested of ["en", "nl", "en,en-GB,nl"]) {
+			const build = staged(requested);
+			const notice = textOf(build, "NOTICE.txt");
+			const carried = tagsStaged(build);
+			const manifest = JSON.parse(textOf(build, "manifest.json"));
+
+			assert.deepEqual(
+				[...tagsNoticed(notice)].sort(),
+				[...carried].sort(),
+				`NOTICE.txt and the staged dictionaries disagree for "${requested}"`,
+			);
+			assert.deepEqual(
+				manifest.languages.map((language: { tag: string }) => language.tag),
+				build.languages.map((language) => language.tag),
+			);
+			assert.deepEqual(
+				[...carried].sort(),
+				build.languages.map((language) => language.tag).sort(),
+			);
+		}
+	});
+
+	it("points every language at a licence text the image ships", () => {
+		const build = staged("en,en-GB,nl");
+		const notice = textOf(build, "NOTICE.txt");
+		const referenced = [...notice.matchAll(/Licence text: (\S+?),/g)]
+			.map((match) => match[1])
+			.sort();
+		assert.deepEqual(referenced, [
+			"LICENSE",
+			"dictionaries/en-GB/LICENSE",
+			"dictionaries/en/LICENSE",
+			"dictionaries/nl/LICENSE",
+		]);
+		for (const path of referenced) {
+			const licence = fileNamed(build, path);
+			assert.ok(licence, `NOTICE.txt names ${path}, which is not staged`);
+			assert.ok(licence.byteLength > 0, `${path} is empty`);
+		}
+	});
+
+	it("states each licence, its author and the version that was staged", () => {
+		const build = staged("nl");
+		const notice = textOf(build, "NOTICE.txt");
+		const [dutch] = build.languages.filter((language) => language.tag === "nl");
+		assert.match(notice, /nl — OpenTaal/);
+		assert.ok(notice.includes(`Licence: ${dutch.licence}`));
+		assert.ok(notice.includes(`Authors: ${dutch.authors}`));
+		assert.ok(notice.includes(`dictionary-nl@${dutch.version}`));
+		assert.match(dutch.version, /^\d+\.\d+\.\d+/);
+	});
+
+	it("says the served files are the source where a licence requires it", () => {
+		const gpl = textOf(staged("nl,en"), "NOTICE.txt");
+		// Neither English nor Dutch is under a correspondence licence here, so
+		// the sentence must not appear; German would bring it.
+		assert.ok(!gpl.includes("unmodified upstream source"));
+	});
+
+	it("carries the engine's own provenance, checksum included", () => {
+		const notice = textOf(staged("en"), "NOTICE.txt");
+		const pins = readFileSync(
+			join(
+				import.meta.dirname,
+				"..",
+				"..",
+				"..",
+				"docker",
+				"hunspell",
+				"pin.env",
+			),
+			"utf8",
+		);
+		const version = /HUNSPELL_VERSION=(\S+)/.exec(pins)?.[1];
+		const sha = /HUNSPELL_SHA256=(\S+)/.exec(pins)?.[1];
+		assert.ok(version && sha);
+		assert.ok(notice.includes(`Hunspell ${version}`));
+		assert.ok(notice.includes(sha));
+	});
+});
+
+describe("the manifest the app reads", () => {
+	it("describes the engine and every language it staged", () => {
+		const build = staged("en,nl");
+		const manifest = JSON.parse(textOf(build, "manifest.json"));
+		assert.equal(manifest.engine.project, "Hunspell");
+		assert.equal(manifest.engine.licence, "MPL-1.1");
+		assert.deepEqual(
+			manifest.languages.map(
+				(language: { licenceFile: string }) => language.licenceFile,
+			),
+			["dictionaries/en/LICENSE", "dictionaries/nl/LICENSE"],
+		);
+		for (const language of manifest.languages) {
+			assert.ok(fileNamed(build, language.licenceFile));
+			assert.match(language.package, /@\d+\.\d+\.\d+/);
+		}
+	});
+});

package/spellcheck/vite-plugin.ts

@@ -0,0 +1,385 @@
+/**
+ * Turns `REMIT_SPELLCHECK_LANGUAGES` into what the browser fetches: the engine,
+ * one directory per language holding the upstream `.aff`, `.dic` and licence
+ * text byte for byte, a manifest, and the notice generated from it.
+ *
+ * Nothing here is bundled and nothing is fetched at page load. The build's own
+ * job is that the notice describes the image exactly — which is the reason the
+ * language set is fixed at build time at all — so a tag nobody can ship, or a
+ * dictionary whose licence file is missing, fails the build by name.
+ *
+ * Two audiences build this package: this repo, where `npm run build:hunspell`
+ * leaves an engine in `build/hunspell/`, and a distributor building from the
+ * published tarball, which carries neither an engine nor a dictionary. Every
+ * failure below therefore names the file it wanted and both ways past it —
+ * `REMIT_SPELLCHECK_ENGINE_DIR` for an engine built elsewhere, and an empty
+ * `REMIT_SPELLCHECK_LANGUAGES` for a build with no spellchecker at all.
+ */
+
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { Plugin } from "vite";
+import type { DictionarySource } from "./languages.ts";
+import { resolveLanguages } from "./languages.ts";
+
+const require = createRequire(import.meta.url);
+const here = dirname(fileURLToPath(import.meta.url));
+// The repo root when this file is a checkout, and `node_modules` when it is an
+// installed package — which holds neither the engine nor the pins. Nothing is
+// read from here without a fallback and an error that names the alternative.
+const repoRoot = join(here, "..", "..", "..");
+// Where `npm run build:hunspell` leaves the engine. A distributor building the
+// web client from the published package has no such tree, so the location is
+// theirs to name.
+const engineDir =
+	process.env.REMIT_SPELLCHECK_ENGINE_DIR ??
+	join(repoRoot, "build", "hunspell");
+
+const WAYS_OUT = [
+	"Set REMIT_SPELLCHECK_ENGINE_DIR to a directory holding hunspell.wasm, hunspell.mjs, LICENSE, license.hunspell and pin.env — in this repo `npm run build:hunspell` writes one into build/hunspell/.",
+	"Or set REMIT_SPELLCHECK_LANGUAGES= (empty) to build a web client with no spellchecker at all; the browser's own checker stays on either way.",
+].join("\n");
+
+const LICENCE_NAMES = ["LICENSE", "license", "LICENCE", "licence"];
+
+/** The engine's own files, in the order the browser needs them explained. */
+const ENGINE_FILES = [
+	"hunspell.wasm",
+	"hunspell.mjs",
+	"LICENSE",
+	"license.hunspell",
+];
+
+interface StagedFile {
+	readonly path: string;
+	readonly source: Buffer;
+}
+
+interface StagedLanguage extends DictionarySource {
+	readonly version: string;
+	readonly bytes: number;
+	readonly files: readonly StagedFile[];
+}
+
+/**
+ * The pins describe the engine, so they are read from beside it: an engine dir
+ * a distributor points at carries the `pin.env` its own build used, and the
+ * checksum in NOTICE.txt is then the checksum of the bytes being served rather
+ * than of whatever this checkout happens to pin.
+ */
+const pinFile = (): string => {
+	const beside = join(engineDir, "pin.env");
+	if (existsSync(beside)) return beside;
+	const inRepo = join(repoRoot, "docker", "hunspell", "pin.env");
+	if (existsSync(inRepo)) return inRepo;
+	throw new Error(
+		`The engine at ${engineDir} carries no pin.env, and neither does ${inRepo}, so nothing here can say which Hunspell release is being served and NOTICE.txt would have to guess.\n${WAYS_OUT}`,
+	);
+};
+
+let pins: Record<string, string> | null = null;
+
+const readPin = (name: string): string => {
+	const path = pinFile();
+	pins ??= Object.fromEntries(
+		readFileSync(path, "utf8")
+			.split("\n")
+			.flatMap((line) => {
+				const match = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+				return match ? [[match[1], match[2]] as const] : [];
+			}),
+	);
+	const found = pins[name];
+	if (found === undefined) throw new Error(`${path} has no ${name}`);
+	return found;
+};
+
+const licenceIn = (directory: string): string => {
+	const named = LICENCE_NAMES.find((name) => existsSync(join(directory, name)));
+	if (named) return named;
+	const found = readdirSync(directory).find((entry) =>
+		/^licen[cs]e/i.test(entry),
+	);
+	if (found) return found;
+	throw new Error(
+		`${directory} ships no licence file. A dictionary whose licence text cannot travel with it cannot ship, so the build stops here rather than producing a NOTICE.txt that claims one exists.`,
+	);
+};
+
+const stageEngine = (): StagedFile[] =>
+	ENGINE_FILES.map((name) => {
+		const path = join(engineDir, name);
+		if (!existsSync(path)) {
+			throw new Error(
+				`${path} is missing, so this build has no spellchecking engine to serve.\n${WAYS_OUT}`,
+			);
+		}
+		return { path: name, source: readFileSync(path) };
+	});
+
+/**
+ * A `dictionary-*` package is a devDependency of @remit/web-client, which a
+ * consumer of the published tarball never receives — so a missing one is the
+ * ordinary case out here, not a broken install.
+ */
+const dictionaryDir = (source: DictionarySource): string => {
+	try {
+		// Resolved through the package's own entry point: `dictionary-*` declares an
+		// `exports` map, so its package.json is not a resolvable subpath.
+		return dirname(require.resolve(source.package));
+	} catch {
+		throw new Error(
+			`${source.package} is not installed, so the ${source.tag} dictionary cannot be staged. It is a devDependency of @remit/web-client and a consumer of the published package never gets it.\nInstall ${source.package} alongside @remit/web-client, or drop "${source.tag}" from REMIT_SPELLCHECK_LANGUAGES — set it empty to build with no spellchecker at all.`,
+		);
+	}
+};
+
+const stageLanguage = (source: DictionarySource): StagedLanguage => {
+	const directory = dictionaryDir(source);
+	const version = JSON.parse(
+		readFileSync(join(directory, "package.json"), "utf8"),
+	).version;
+	const licence = licenceIn(directory);
+	const at = (name: string) => `dictionaries/${source.tag}/${name}`;
+	const aff = readFileSync(join(directory, "index.aff"));
+	const dic = readFileSync(join(directory, "index.dic"));
+	return {
+		...source,
+		version,
+		bytes: aff.byteLength + dic.byteLength,
+		files: [
+			{ path: at("index.aff"), source: aff },
+			{ path: at("index.dic"), source: dic },
+			{ path: at("LICENSE"), source: readFileSync(join(directory, licence)) },
+		],
+	};
+};
+
+/** A licence that says the served form must be the source says it out loud. */
+const correspondence = (licence: string): boolean =>
+	/GPL|MPL/.test(licence.toUpperCase());
+
+const noticeFor = (
+	engineVersion: string,
+	languages: readonly StagedLanguage[],
+): string => {
+	const blocks = languages.map((language) =>
+		[
+			`${language.tag} — ${language.project}`,
+			`  Authors: ${language.authors}`,
+			`  Source: ${language.source}`,
+			`  Package: ${language.package}@${language.version}`,
+			`  Licence: ${language.licence}`,
+			`  Licence text: dictionaries/${language.tag}/LICENSE, beside this file`,
+			...(correspondence(language.licence)
+				? [
+						`  The served index.aff and index.dic are the unmodified upstream source.`,
+					]
+				: []),
+		].join("\n"),
+	);
+	return [
+		"This build of Remit Reader carries the spelling dictionaries listed below.",
+		"Each stays under its own licence; the licence text travels with the files,",
+		"and nothing in this image modifies a dictionary. Reader itself is MIT.",
+		"",
+		"Engine",
+		"",
+		`  Hunspell ${engineVersion}`,
+		"  Source: https://github.com/hunspell/hunspell",
+		`  Tarball: https://github.com/hunspell/hunspell/releases/download/v${engineVersion}/hunspell-${engineVersion}.tar.gz`,
+		`  sha256: ${readPin("HUNSPELL_SHA256")}`,
+		"  Licence: MPL-1.1 (the option taken from Hunspell's MPL-1.1/GPL-2.0/LGPL-2.1 triple)",
+		"  Licence text: LICENSE, beside this file",
+		"  Build recipe: docker/hunspell/build.sh",
+		"",
+		"Dictionaries",
+		"",
+		...blocks.map((block) => `${block}\n`),
+	].join("\n");
+};
+
+export interface SpellcheckBuild {
+	readonly languages: readonly StagedLanguage[];
+	/** Paths relative to `directory`, which is where all of them are emitted. */
+	readonly files: readonly StagedFile[];
+	/** `spellcheck/<digest>/`, relative to the build's output root. */
+	readonly directory: string;
+	/** What the browser resolves against the document to reach `directory`. */
+	readonly base: string;
+	/** Where the dev server answers for `directory`, always document-rooted. */
+	readonly servePath: string;
+	/** Tag → the bytes opening that language downloads, engine included. */
+	readonly bytes: Readonly<Record<string, number>>;
+}
+
+const EMPTY_BUILD: SpellcheckBuild = {
+	languages: [],
+	files: [],
+	directory: "",
+	base: "",
+	servePath: "",
+	bytes: {},
+};
+
+/**
+ * One digest over everything served, folded into the directory name. Nothing
+ * the browser fetches is versioned otherwise — `hunspell.wasm` and `index.dic`
+ * are the same two paths in every build — and an unversioned path cannot be
+ * cached, which is what left every composer open re-downloading its dictionary.
+ */
+const digestOf = (files: readonly StagedFile[]): string => {
+	const hash = createHash("sha256");
+	for (const file of [...files].sort((left, right) =>
+		left.path.localeCompare(right.path),
+	)) {
+		hash.update(file.path);
+		hash.update("\0");
+		hash.update(file.source);
+	}
+	return hash.digest("hex").slice(0, 16);
+};
+
+const documentRooted = (viteBase: string | undefined): boolean =>
+	viteBase === undefined || viteBase.startsWith("/");
+
+/**
+ * An absolute base names where the app is mounted, and the staged directory
+ * hangs off it. A relative one — Storybook's, always `./` — belongs to a build
+ * published under a path it cannot know here (`/reader/pr/<n>/<sha>/`), so it
+ * gets the directory alone and the document resolves it at run time. An unset
+ * base is vite's own default of `/`, not a relative one.
+ */
+const browserBase = (
+	viteBase: string | undefined,
+	directory: string,
+): string =>
+	documentRooted(viteBase)
+		? `${(viteBase ?? "/").replace(/\/$/, "")}/${directory}`
+		: directory;
+
+export const stageSpellcheck = (
+	requested: string | undefined,
+	viteBase: string | undefined,
+): SpellcheckBuild => {
+	const wanted = resolveLanguages(requested);
+	if (wanted.length === 0) return EMPTY_BUILD;
+
+	// The engine first: it is the file a build outside this repo is most likely
+	// to be missing, and its error is the one that names both ways out.
+	const engine = stageEngine();
+	const engineVersion = readPin("HUNSPELL_VERSION");
+	const languages = wanted.map(stageLanguage);
+	const wasmBytes =
+		engine.find((file) => file.path === "hunspell.wasm")?.source.byteLength ??
+		0;
+
+	const payload = [
+		...engine,
+		...languages.flatMap((language) => language.files),
+	];
+	const directory = `spellcheck/${digestOf(payload)}/`;
+
+	const manifest = {
+		engine: {
+			project: "Hunspell",
+			version: engineVersion,
+			licence: "MPL-1.1",
+			source: "https://github.com/hunspell/hunspell",
+			recipe: "docker/hunspell/build.sh",
+			bytes: wasmBytes,
+		},
+		languages: languages.map((language) => ({
+			tag: language.tag,
+			project: language.project,
+			authors: language.authors,
+			source: language.source,
+			package: `${language.package}@${language.version}`,
+			licence: language.licence,
+			licenceFile: `dictionaries/${language.tag}/LICENSE`,
+			bytes: language.bytes,
+		})),
+	};
+
+	return {
+		languages,
+		directory,
+		base: browserBase(viteBase, directory),
+		servePath: `${(documentRooted(viteBase) ? (viteBase ?? "/") : "/").replace(/\/$/, "")}/${directory}`,
+		bytes: Object.fromEntries(
+			languages.map((language) => [language.tag, wasmBytes + language.bytes]),
+		),
+		files: [
+			...payload,
+			{
+				path: "manifest.json",
+				source: Buffer.from(`${JSON.stringify(manifest, null, "\t")}\n`),
+			},
+			{
+				path: "NOTICE.txt",
+				source: Buffer.from(noticeFor(engineVersion, languages)),
+			},
+		],
+	};
+};
+
+export const spellcheckPlugin = (): Plugin => {
+	let staged: SpellcheckBuild | null = null;
+
+	return {
+		name: "remit-spellcheck",
+		enforce: "pre",
+		config(userConfig) {
+			staged = stageSpellcheck(
+				process.env.REMIT_SPELLCHECK_LANGUAGES,
+				userConfig.base,
+			);
+			return {
+				define: {
+					__REMIT_SPELLCHECK_LANGUAGES__: JSON.stringify(
+						staged.languages.map((language) => language.tag),
+					),
+					__REMIT_SPELLCHECK_BASE__: JSON.stringify(staged.base),
+					__REMIT_SPELLCHECK_BYTES__: JSON.stringify(staged.bytes),
+				},
+			};
+		},
+		configureServer(server) {
+			server.middlewares.use((request, response, next) => {
+				const held = staged;
+				const url = (request.url ?? "").split("?")[0];
+				if (!held || held.servePath === "" || !url.startsWith(held.servePath))
+					return next();
+				const wanted = decodeURIComponent(url.slice(held.servePath.length));
+				const file = held.files.find((entry) => entry.path === wanted);
+				if (!file) return next();
+				response.setHeader("Content-Length", file.source.byteLength);
+				response.setHeader(
+					"Content-Type",
+					wanted.endsWith(".mjs")
+						? "text/javascript; charset=utf-8"
+						: wanted.endsWith(".wasm")
+							? "application/wasm"
+							: wanted.endsWith(".json")
+								? "application/json; charset=utf-8"
+								: "text/plain; charset=utf-8",
+				);
+				response.end(file.source);
+			});
+		},
+		generateBundle() {
+			const held = staged;
+			if (!held) return;
+			for (const file of held.files) {
+				this.emitFile({
+					type: "asset",
+					fileName: `${held.directory}${file.path}`,
+					source: file.source,
+				});
+			}
+		},
+	};
+};

package/spellcheck/worker-stub.ts

@@ -0,0 +1,36 @@
+/**
+ * Keeps the spellchecking worker out of a build that staged no dictionaries.
+ *
+ * Vite emits a worker bundle for whatever module graph reaches a `new
+ * Worker(new URL(...))`, and it emits it while transforming that module —
+ * before tree-shaking, and whether or not anything in the output still imports
+ * it. So a dead branch around the dynamic import is not enough on its own: the
+ * bundle is already a file by the time the branch is dropped. The only way the
+ * worker never becomes an asset is for the specifier never to resolve to it.
+ *
+ * The decision is `resolveLanguages`, the same function the staging plugin
+ * asks, so there is no second answer to what this build carries.
+ */
+
+import type { Plugin } from "vite";
+import { resolveLanguages } from "./languages.ts";
+
+const WORKER_MODULE = "@remit/ui/spellcheck-worker";
+const STUB = "\0remit-spellcheck-absent";
+
+export const spellcheckWorkerStub = (): Plugin => ({
+	name: "remit-spellcheck-worker-stub",
+	enforce: "pre",
+	resolveId(source) {
+		if (source !== WORKER_MODULE) return null;
+		const staged = resolveLanguages(process.env.REMIT_SPELLCHECK_LANGUAGES);
+		return staged.length === 0 ? STUB : null;
+	},
+	load(id) {
+		// The provider's own contract for a language it cannot check: answer null,
+		// start no worker, and leave the browser's checking switched on.
+		return id === STUB
+			? "export const openSpellcheckWorker = async () => null;\n"
+			: null;
+	},
+});

package/src/components/compose/compose-spellcheck.test.ts

@@ -16,10 +16,22 @@ import { composeSpellcheck, spellcheckFailure } from "./compose-spellcheck.js";
 interface WorkerMessage {
 	readonly type: string;
 	readonly language?: string;
+	readonly base?: string;
 }
 
 const opened: { url: string; messages: WorkerMessage[] }[] = [];
 
+/**
+ * What `REMIT_SPELLCHECK_LANGUAGES` writes into the bundle. Nothing defines it
+ * outside a Vite build, so a test that wants a build carrying English says so.
+ */
+const built = (...tags: string[]): void => {
+	Object.defineProperty(globalThis, "__REMIT_SPELLCHECK_LANGUAGES__", {
+		value: tags,
+		configurable: true,
+	});
+};
+
 class FakeWorker {
 	readonly messages: WorkerMessage[] = [];
 	constructor(url: URL) {
@@ -42,24 +54,42 @@ const withWorker = <T>(run: () => Promise<T>): Promise<T> => {
 
 afterEach(() => {
 	opened.length = 0;
+	built();
 });
 
 describe("the checker the composer opens", () => {
 	it("asks the worker for the language the message is in", async () => {
+		built("en", "en-GB", "nl");
 		const provider = await withWorker(() =>
 			composeSpellcheck(() => undefined).provider("en"),
 		);
 
-		assert.equal(provider?.language, "en");
+		assert.equal(
+			provider?.language,
+			"en",
+			"plain English is checked against English, not a region's",
+		);
 		assert.equal(opened.length, 1);
 		assert.match(opened[0].url, /rich-text-spellcheck-worker/);
-		assert.deepEqual(opened[0].messages, [{ type: "open", language: "en" }]);
+		assert.deepEqual(
+			opened[0].messages,
+			[
+				{
+					type: "open",
+					language: "en",
+					base: "http://localhost/spellcheck/",
+					bytesExpected: 0,
+				},
+			],
+			"the worker is told an absolute place to fetch from, resolved against the page",
+		);
 		provider?.close();
 	});
 
 	it("starts no worker for a language the build carries no words for", async () => {
+		built("en", "en-GB", "nl");
 		const provider = await withWorker(() =>
-			composeSpellcheck(() => undefined).provider("nl"),
+			composeSpellcheck(() => undefined).provider("de"),
 		);
 
 		assert.equal(provider, null);
@@ -70,9 +100,14 @@ describe("the checker the composer opens", () => {
 		const reported: PushErrorInput[] = [];
 		const { onStatus } = composeSpellcheck((input) => reported.push(input));
 
-		onStatus?.({ state: "opening", language: "en" });
+		onStatus?.({
+			state: "opening",
+			language: "en",
+			bytesLoaded: 65_536,
+			bytesTotal: 167_936,
+		});
 		onStatus?.({ state: "ready", language: "en" });
-		onStatus?.({ state: "unavailable", language: "nl" });
+		onStatus?.({ state: "unavailable", language: "de" });
 
 		assert.deepEqual(reported, []);
 	});

package/vite.base.ts

@@ -4,6 +4,8 @@ import tailwindcss from "@tailwindcss/vite";
 import { tanstackRouter } from "@tanstack/router-plugin/vite";
 import react from "@vitejs/plugin-react";
 import type { AliasOptions, BuildOptions, PluginOption } from "vite";
+import { spellcheckPlugin } from "./spellcheck/vite-plugin.ts";
+import { spellcheckWorkerStub } from "./spellcheck/worker-stub.ts";
 
 /**
  * The one place the web-client build toolchain is described. Both the dev
@@ -54,4 +56,6 @@ export const webClientPlugins = (routes: RouterPaths = {}): PluginOption[] => [
 	tanstackRouter({ target: "react", autoCodeSplitting: true, ...routes }),
 	react(),
 	tailwindcss(),
+	spellcheckPlugin(),
+	spellcheckWorkerStub(),
 ];