@kywi-software/core 0.1.0

package/dist/host/index.js

@@ -0,0 +1,144 @@
+/**
+ * Kywi host adapter — the session-cookie contract for a Next.js host app.
+ *
+ * This is the SINGLE source of truth for how a Kywi host turns the admin's
+ * login/refresh into httpOnly session cookies and reads them back on every
+ * request. It is intentionally framework-decoupled: it depends only on `jose`
+ * (edge-safe) and structural typing for the cookie target, so it runs unchanged
+ * in the Next.js middleware (edge runtime) AND in a route handler (node), and
+ * core itself never imports `next`.
+ *
+ * A generated Kywi app wires these primitives in two ~40-line files it owns:
+ *
+ *   - middleware.ts               CONTINUES a session: reads the access cookie,
+ *                                 refreshes it from the refresh cookie when
+ *                                 stale, bridges it onto `Authorization` for the
+ *                                 API, and gates `/admin/*`.
+ *   - app/api/v1/[...kywi]/route  ESTABLISHES a session: lifts the tokens a
+ *                                 login/refresh RESPONSE returns into httpOnly
+ *                                 cookies, and clears them on logout.
+ *
+ * Because the tokens live only in httpOnly cookies, an XSS payload cannot read
+ * them. The security-critical crypto (JWT verify, token classification, cookie
+ * options) lives here once; the two host files carry only framework wiring.
+ */
+import { jwtVerify } from 'jose';
+// Re-export the AUTH_SECRET production guard so a generated app can call it at
+// module scope (in middleware.ts / kywi.config.ts) and refuse to build/start in
+// production with a missing or dev-fallback secret. Shares its policy with the
+// CLI/app env-guard, so both agree on what an insecure secret is.
+export { assertProductionAuthSecret, isDevFallbackSecret, DEV_FALLBACK_SECRETS, } from '../auth/auth-secret.js';
+/** httpOnly cookie holding the short-lived access JWT (type=access). */
+export const ACCESS_COOKIE = 'kywi_access_token';
+/** httpOnly cookie holding the long-lived refresh JWT (type=refresh). */
+export const REFRESH_COOKIE = 'kywi_refresh_token';
+// Match core's token TTLs (src/auth/tokens.ts): 15m access, 7d refresh.
+export const ACCESS_TTL_SECONDS = 15 * 60;
+export const REFRESH_TTL_SECONDS = 7 * 24 * 60 * 60;
+/**
+ * Refresh proactively once the access token has fewer than this many seconds of
+ * life left, so an in-flight request never races the expiry boundary.
+ */
+export const NEAR_EXPIRY_SECONDS = 120;
+/**
+ * Endpoints whose 2xx body carries fresh tokens the route handler persists into
+ * cookies. Enumerated explicitly (rather than "any auth/*") so delegated
+ * responses and error responses are never rewritten. `auth/refresh` returns only
+ * an access token; the others also return a refresh token at initial sign-in.
+ */
+export const TOKEN_ISSUING_PATHS = new Set([
+    'auth/login',
+    'auth/register',
+    'auth/refresh',
+    'auth/mfa/verify',
+    'auth/magic-link/verify',
+]);
+// Cache the derived HMAC key per secret so classifyAccessToken doesn't re-encode
+// on every request.
+const keyCache = new Map();
+function keyFor(secret) {
+    let key = keyCache.get(secret);
+    if (!key) {
+        key = new TextEncoder().encode(secret);
+        keyCache.set(secret, key);
+    }
+    return key;
+}
+/**
+ * Classify an access-token cookie value against the host's auth secret (which
+ * must be the same value handed to `createKywiApiHandler`, i.e.
+ * `config.auth.secret`). A well-formed token that only failed verification
+ * because it expired is still refreshable ('stale'); anything else is 'invalid'.
+ */
+export async function classifyAccessToken(token, secret) {
+    if (!token)
+        return 'invalid';
+    try {
+        const { payload } = await jwtVerify(token, keyFor(secret), { algorithms: ['HS256'] });
+        if (payload['type'] !== 'access')
+            return 'invalid';
+        const exp = typeof payload.exp === 'number' ? payload.exp : 0;
+        const secondsLeft = exp - Math.floor(Date.now() / 1000);
+        return secondsLeft <= NEAR_EXPIRY_SECONDS ? 'stale' : 'valid';
+    }
+    catch (err) {
+        // jose stamps expiry failures with ERR_JWT_EXPIRED — those are refreshable.
+        if (err.code === 'ERR_JWT_EXPIRED')
+            return 'stale';
+        return 'invalid';
+    }
+}
+/**
+ * Pull the access/refresh tokens out of a token-issuing endpoint's JSON body
+ * (`{ data: { accessToken, refreshToken } }`). Missing/non-string fields and
+ * non-JSON bodies degrade to an empty object.
+ */
+export function parseSessionTokens(bodyText) {
+    try {
+        const data = JSON.parse(bodyText)?.data;
+        const out = {};
+        if (typeof data?.accessToken === 'string' && data.accessToken)
+            out.accessToken = data.accessToken;
+        if (typeof data?.refreshToken === 'string' && data.refreshToken)
+            out.refreshToken = data.refreshToken;
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+function baseCookieOptions() {
+    return {
+        httpOnly: true,
+        sameSite: 'lax',
+        // Path '/' is load-bearing: the cookies are read by BOTH the /admin/* page
+        // guard and the /api/v1/* bridge, and a cookie carries a single Path, so the
+        // tightest value reaching every guarded surface is '/'. They stay
+        // httpOnly + SameSite=Lax + Secure-in-prod, so the broad Path adds no
+        // exposure to JS or cross-site requests.
+        path: '/',
+        // Dev + Playwright run over http://localhost, so `secure` must stay off
+        // there or the cookie is dropped; enable it in production.
+        secure: process.env['NODE_ENV'] === 'production',
+    };
+}
+/** Cookie options for the access token (maxAge 0 to clear). */
+export function accessCookieOptions(maxAge = ACCESS_TTL_SECONDS) {
+    return { ...baseCookieOptions(), maxAge };
+}
+/** Cookie options for the refresh token (maxAge 0 to clear). */
+export function refreshCookieOptions(maxAge = REFRESH_TTL_SECONDS) {
+    return { ...baseCookieOptions(), maxAge };
+}
+export function setAccessCookie(res, token) {
+    res.cookies.set(ACCESS_COOKIE, token, accessCookieOptions());
+}
+export function setRefreshCookie(res, token) {
+    res.cookies.set(REFRESH_COOKIE, token, refreshCookieOptions());
+}
+/** Expire both session cookies (logout, or a dead/unrefreshable session). */
+export function clearSessionCookies(res) {
+    res.cookies.set(ACCESS_COOKIE, '', accessCookieOptions(0));
+    res.cookies.set(REFRESH_COOKIE, '', refreshCookieOptions(0));
+}
+//# sourceMappingURL=index.js.map

package/dist/host/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAEhC,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,wBAAwB,CAAA;AAE/B,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAA;AAChD,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAA;AAElD,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAA;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAEnD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,YAAY;IACZ,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,wBAAwB;CACzB,CAAC,CAAA;AAUF,iFAAiF;AACjF,oBAAoB;AACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAA;AAC9C,SAAS,MAAM,CAAC,MAAc;IAC5B,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC3B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAyB,EACzB,MAAc;IAEd,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACrF,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAClD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7D,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACvD,OAAO,WAAW,IAAI,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,IAAK,GAAyB,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,OAAO,CAAA;QACzE,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAIjD,IAAI,CAAC;QACH,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+C,EAAE,IAAI,CAAA;QACtF,MAAM,GAAG,GAAoD,EAAE,CAAA;QAC/D,IAAI,OAAO,IAAI,EAAE,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;QACjG,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACrG,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAiBD,SAAS,iBAAiB;IACxB,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAc;QACxB,2EAA2E;QAC3E,6EAA6E;QAC7E,kEAAkE;QAClE,sEAAsE;QACtE,yCAAyC;QACzC,IAAI,EAAE,GAAG;QACT,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,YAAY;KACjD,CAAA;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAG,kBAAkB;IAC7D,OAAO,EAAE,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,mBAAmB;IAC/D,OAAO,EAAE,GAAG,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAmB,EAAE,KAAa;IAChE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,KAAa;IACjE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,GAAmB;IACrD,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC"}

package/dist/host-client/index.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Kywi host adapter — client-side admin helpers (browser only).
+ *
+ * Companion to `@kywi-software/core/host` (server). These run in the admin's
+ * client components. They never touch the session TOKEN: it lives in an httpOnly
+ * cookie the server sets at login and the middleware verifies — JS here cannot
+ * read it (that is the point: an XSS payload cannot exfiltrate it). This module
+ * only tracks the non-sensitive user descriptor (for rendering chrome) and the
+ * active-site preference, and calls the API through a cookie-aware fetch.
+ */
+export interface AdminUser {
+    id: string;
+    role: string;
+    groups: string[];
+}
+export declare function getAdminUser(): AdminUser | null;
+/** Persist the signed-in user descriptor. The access token itself is set by the
+ * server as an httpOnly cookie and is never stored by JS. */
+export declare function setAuth(user: AdminUser): void;
+/** Clear the client-side user descriptor. Clearing the httpOnly token cookie
+ * needs a server round-trip — see {@link signOut}. */
+export declare function clearAuth(): void;
+/**
+ * Full sign-out: ask the server to clear the httpOnly session cookies, then drop
+ * the local user descriptor. Best-effort on the network call — local state is
+ * cleared regardless so the UI never appears "stuck signed in".
+ */
+export declare function signOut(): Promise<void>;
+/** The DB UUID of the admin's currently-selected site, or null. Non-httpOnly so
+ * both client JS and (if needed) server components can read it; it is a UI
+ * preference, never an authorization boundary (the server still enforces
+ * per-site access on every request). */
+export declare function getActiveSiteId(): string | null;
+export declare function setActiveSiteId(siteId: string): void;
+export declare function clearActiveSiteId(): void;
+/**
+ * Fetch wrapper for admin API calls. Auth flows via the httpOnly session cookie:
+ * it is sent automatically (same-origin) and the middleware turns it into the
+ * `Authorization` header core expects — no token is read or attached here. When
+ * an active site is selected, its id is appended as `?siteId=` to every
+ * `/api/v1/*` request that does not already carry one, so the whole admin
+ * repaints for the switched-to site without each caller threading the id.
+ */
+export declare function adminFetch(path: string, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=index.d.ts.map

package/dist/host-client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host-client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,wBAAgB,YAAY,IAAI,SAAS,GAAG,IAAI,CAQ/C;AAED;6DAC6D;AAC7D,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,IAAI,CAE7C;AAED;sDACsD;AACtD,wBAAgB,SAAS,IAAI,IAAI,CAEhC;AAED;;;;GAIG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAO7C;AAID;;;wCAGwC;AACxC,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAQ/C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAIpD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAID;;;;;;;GAOG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIpF"}

package/dist/host-client/index.js

@@ -0,0 +1,108 @@
+/**
+ * Kywi host adapter — client-side admin helpers (browser only).
+ *
+ * Companion to `@kywi-software/core/host` (server). These run in the admin's
+ * client components. They never touch the session TOKEN: it lives in an httpOnly
+ * cookie the server sets at login and the middleware verifies — JS here cannot
+ * read it (that is the point: an XSS payload cannot exfiltrate it). This module
+ * only tracks the non-sensitive user descriptor (for rendering chrome) and the
+ * active-site preference, and calls the API through a cookie-aware fetch.
+ */
+const USER_KEY = 'kywi_user';
+const ACTIVE_SITE_COOKIE = 'kywi_active_site';
+// ~180 days; the active-site selection is a convenience, re-established on the
+// next switch.
+const ACTIVE_SITE_MAX_AGE = 60 * 60 * 24 * 180;
+export function getAdminUser() {
+    if (typeof window === 'undefined')
+        return null;
+    try {
+        const raw = window.localStorage.getItem(USER_KEY);
+        return raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Persist the signed-in user descriptor. The access token itself is set by the
+ * server as an httpOnly cookie and is never stored by JS. */
+export function setAuth(user) {
+    window.localStorage.setItem(USER_KEY, JSON.stringify(user));
+}
+/** Clear the client-side user descriptor. Clearing the httpOnly token cookie
+ * needs a server round-trip — see {@link signOut}. */
+export function clearAuth() {
+    window.localStorage.removeItem(USER_KEY);
+}
+/**
+ * Full sign-out: ask the server to clear the httpOnly session cookies, then drop
+ * the local user descriptor. Best-effort on the network call — local state is
+ * cleared regardless so the UI never appears "stuck signed in".
+ */
+export async function signOut() {
+    try {
+        await fetch('/api/v1/auth/logout', { method: 'POST', credentials: 'same-origin' });
+    }
+    catch {
+        // ignore — clear local state below no matter what
+    }
+    clearAuth();
+}
+// ── Active site ───────────────────────────────────────────────────────────────
+/** The DB UUID of the admin's currently-selected site, or null. Non-httpOnly so
+ * both client JS and (if needed) server components can read it; it is a UI
+ * preference, never an authorization boundary (the server still enforces
+ * per-site access on every request). */
+export function getActiveSiteId() {
+    if (typeof document === 'undefined')
+        return null;
+    const match = document.cookie
+        .split('; ')
+        .find((c) => c.startsWith(`${ACTIVE_SITE_COOKIE}=`));
+    if (!match)
+        return null;
+    const value = decodeURIComponent(match.slice(ACTIVE_SITE_COOKIE.length + 1));
+    return value || null;
+}
+export function setActiveSiteId(siteId) {
+    if (typeof document === 'undefined')
+        return;
+    document.cookie =
+        `${ACTIVE_SITE_COOKIE}=${encodeURIComponent(siteId)}; path=/; max-age=${ACTIVE_SITE_MAX_AGE}; samesite=lax`;
+}
+export function clearActiveSiteId() {
+    if (typeof document === 'undefined')
+        return;
+    document.cookie = `${ACTIVE_SITE_COOKIE}=; path=/; max-age=0; samesite=lax`;
+}
+// ── Cookie-aware API fetch ────────────────────────────────────────────────────
+/**
+ * Fetch wrapper for admin API calls. Auth flows via the httpOnly session cookie:
+ * it is sent automatically (same-origin) and the middleware turns it into the
+ * `Authorization` header core expects — no token is read or attached here. When
+ * an active site is selected, its id is appended as `?siteId=` to every
+ * `/api/v1/*` request that does not already carry one, so the whole admin
+ * repaints for the switched-to site without each caller threading the id.
+ */
+export async function adminFetch(path, init) {
+    const headers = new Headers(init?.headers);
+    if (!headers.has('Content-Type') && init?.body)
+        headers.set('Content-Type', 'application/json');
+    return fetch(withActiveSite(path), { ...init, credentials: 'same-origin', headers });
+}
+function withActiveSite(path) {
+    if (typeof document === 'undefined')
+        return path;
+    if (!path.startsWith('/api/v1/'))
+        return path;
+    const [pathname, query = ''] = path.split('?');
+    const params = new URLSearchParams(query);
+    if (params.has('siteId'))
+        return path;
+    const active = getActiveSiteId();
+    if (!active)
+        return path;
+    params.set('siteId', active);
+    return `${pathname}?${params.toString()}`;
+}
+//# sourceMappingURL=index.js.map

package/dist/host-client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host-client/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,QAAQ,GAAG,WAAW,CAAA;AAC5B,MAAM,kBAAkB,GAAG,kBAAkB,CAAA;AAC7C,+EAA+E;AAC/E,eAAe;AACf,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,CAAA;AAQ9C,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjD,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC,CAAC,CAAC,IAAI,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,OAAO,CAAC,IAAe;IACrC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;sDACsD;AACtD,MAAM,UAAU,SAAS;IACvB,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,SAAS,EAAE,CAAA;AACb,CAAC;AAED,iFAAiF;AAEjF;;;wCAGwC;AACxC,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM;SAC1B,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC,CAAA;IACtD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,KAAK,IAAI,IAAI,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3C,QAAQ,CAAC,MAAM;QACb,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,CAAC,qBAAqB,mBAAmB,gBAAgB,CAAA;AAC/G,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3C,QAAQ,CAAC,MAAM,GAAG,GAAG,kBAAkB,oCAAoC,CAAA;AAC7E,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAkB;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,EAAE,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IAC/F,OAAO,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAA;AACtF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAChD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;IACzC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAA;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5B,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AAC3C,CAAC"}

package/dist/i18n/__tests__/loader-site-override.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=loader-site-override.test.d.ts.map

package/dist/i18n/__tests__/loader-site-override.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader-site-override.test.d.ts","sourceRoot":"","sources":["../../../src/i18n/__tests__/loader-site-override.test.ts"],"names":[],"mappings":""}

package/dist/i18n/__tests__/loader-site-override.test.js

@@ -0,0 +1,81 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { loadResourceBundles, loadSiteResourceBundles } from '../loader.js';
+// Mock fs/promises
+vi.mock('node:fs/promises', () => ({
+    readdir: vi.fn(),
+    readFile: vi.fn(),
+}));
+import { readdir, readFile } from 'node:fs/promises';
+const mockReaddir = readdir;
+const mockReadFile = readFile;
+describe('loadSiteResourceBundles', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('site bundle overrides global bundle for same key', async () => {
+        // Global i18n/en.json
+        mockReaddir.mockImplementation(async (dir) => {
+            if (dir.endsWith('/i18n'))
+                return ['en.json'];
+            if (dir.includes('/i18n/site1'))
+                return ['en.json'];
+            throw new Error('ENOENT');
+        });
+        mockReadFile.mockImplementation(async (path) => {
+            if (path.includes('/i18n/site1/en.json')) {
+                return JSON.stringify({ 'nav.home': 'Site Home Override' });
+            }
+            if (path.endsWith('/i18n/en.json')) {
+                return JSON.stringify({ 'nav.home': 'Home', 'nav.about': 'About' });
+            }
+            throw new Error('ENOENT');
+        });
+        const globalBundles = await loadResourceBundles('/app/i18n');
+        expect(globalBundles.get('en')?.get('nav.home')).toBe('Home');
+        expect(globalBundles.get('en')?.get('nav.about')).toBe('About');
+        const siteBundles = await loadSiteResourceBundles('/app/i18n', 'site1', globalBundles);
+        // Site override wins for nav.home
+        expect(siteBundles.get('en')?.get('nav.home')).toBe('Site Home Override');
+        // Global key still available when not overridden
+        expect(siteBundles.get('en')?.get('nav.about')).toBe('About');
+    });
+    it('returns global bundles unchanged when no site directory exists', async () => {
+        mockReaddir.mockImplementation(async (dir) => {
+            if (dir.endsWith('/i18n'))
+                return ['en.json'];
+            throw new Error('ENOENT');
+        });
+        mockReadFile.mockImplementation(async (path) => {
+            if (path.endsWith('/i18n/en.json')) {
+                return JSON.stringify({ 'nav.home': 'Home' });
+            }
+            throw new Error('ENOENT');
+        });
+        const globalBundles = await loadResourceBundles('/app/i18n');
+        const siteBundles = await loadSiteResourceBundles('/app/i18n', 'site1', globalBundles);
+        expect(siteBundles.get('en')?.get('nav.home')).toBe('Home');
+    });
+    it('site bundle adds keys not in global bundle', async () => {
+        mockReaddir.mockImplementation(async (dir) => {
+            if (dir.endsWith('/i18n'))
+                return ['en.json'];
+            if (dir.includes('/i18n/site1'))
+                return ['en.json'];
+            throw new Error('ENOENT');
+        });
+        mockReadFile.mockImplementation(async (path) => {
+            if (path.includes('/i18n/site1/en.json')) {
+                return JSON.stringify({ 'brand.name': 'My Site' });
+            }
+            if (path.endsWith('/i18n/en.json')) {
+                return JSON.stringify({ 'nav.home': 'Home' });
+            }
+            throw new Error('ENOENT');
+        });
+        const globalBundles = await loadResourceBundles('/app/i18n');
+        const siteBundles = await loadSiteResourceBundles('/app/i18n', 'site1', globalBundles);
+        expect(siteBundles.get('en')?.get('nav.home')).toBe('Home');
+        expect(siteBundles.get('en')?.get('brand.name')).toBe('My Site');
+    });
+});
+//# sourceMappingURL=loader-site-override.test.js.map

package/dist/i18n/__tests__/loader-site-override.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader-site-override.test.js","sourceRoot":"","sources":["../../../src/i18n/__tests__/loader-site-override.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAE3E,mBAAmB;AACnB,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;IAChB,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;CAClB,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAEpD,MAAM,WAAW,GAAG,OAAmC,CAAA;AACvD,MAAM,YAAY,GAAG,QAAoC,CAAA;AAEzD,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,sBAAsB;QACtB,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YAC7C,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QACF,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAA;YAC7D,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC5D,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAE/D,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QACtF,kCAAkC;QAClC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QACzE,iDAAiD;QACjD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YAC7C,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QACF,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QAEtF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,WAAW,CAAC,kBAAkB,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACnD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YAC7C,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAAE,OAAO,CAAC,SAAS,CAAC,CAAA;YACnD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QACF,YAAY,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACzC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAA;YACpD,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3B,CAAC,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,WAAW,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;QAEtF,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3D,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/i18n/__tests__/loader.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=loader.test.d.ts.map

package/dist/i18n/__tests__/loader.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.test.d.ts","sourceRoot":"","sources":["../../../src/i18n/__tests__/loader.test.ts"],"names":[],"mappings":""}

package/dist/i18n/__tests__/loader.test.js

@@ -0,0 +1,21 @@
+import { describe, it, expect } from 'vitest';
+import { parseBundleJson } from '../loader.js';
+describe('parseBundleJson', () => {
+    it('parses flat JSON into Map', () => {
+        const json = { 'nav.home': 'Home', 'nav.about': 'About' };
+        const map = parseBundleJson(json);
+        expect(map.get('nav.home')).toBe('Home');
+        expect(map.get('nav.about')).toBe('About');
+        expect(map.size).toBe(2);
+    });
+    it('handles empty object', () => {
+        const map = parseBundleJson({});
+        expect(map.size).toBe(0);
+    });
+    it('coerces non-string values to string', () => {
+        const json = { 'count': 42 };
+        const map = parseBundleJson(json);
+        expect(map.get('count')).toBe('42');
+    });
+});
+//# sourceMappingURL=loader.test.js.map

package/dist/i18n/__tests__/loader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.test.js","sourceRoot":"","sources":["../../../src/i18n/__tests__/loader.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;QACzD,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,CAAC,CAAA;QAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,EAAS,EAAE,CAAA;QACnC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/i18n/__tests__/locale.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=locale.test.d.ts.map

package/dist/i18n/__tests__/locale.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale.test.d.ts","sourceRoot":"","sources":["../../../src/i18n/__tests__/locale.test.ts"],"names":[],"mappings":""}

package/dist/i18n/__tests__/locale.test.js

@@ -0,0 +1,31 @@
+import { describe, it, expect } from 'vitest';
+import { resolveLocaleFromRequest, parseAcceptLanguage } from '../locale.js';
+describe('parseAcceptLanguage', () => {
+    it('parses simple header', () => {
+        expect(parseAcceptLanguage('en-US,fr;q=0.9')).toEqual(['en-US', 'fr']);
+    });
+    it('sorts by quality', () => {
+        expect(parseAcceptLanguage('fr;q=0.8,en;q=0.9,de;q=0.7')).toEqual(['en', 'fr', 'de']);
+    });
+    it('returns empty for empty string', () => {
+        expect(parseAcceptLanguage('')).toEqual([]);
+    });
+});
+describe('resolveLocaleFromRequest', () => {
+    it('resolves from URL path prefix', () => {
+        expect(resolveLocaleFromRequest('/fr/about', null, 'en', ['en', 'fr'])).toBe('fr');
+    });
+    it('ignores path prefix if not a known locale', () => {
+        expect(resolveLocaleFromRequest('/about', null, 'en', ['en', 'fr'])).toBe('en');
+    });
+    it('falls back to Accept-Language', () => {
+        expect(resolveLocaleFromRequest('/about', 'fr;q=0.9,en;q=0.8', 'en', ['en', 'fr'])).toBe('fr');
+    });
+    it('falls back to site default', () => {
+        expect(resolveLocaleFromRequest('/about', 'de', 'en', ['en', 'fr'])).toBe('en');
+    });
+    it('handles null Accept-Language', () => {
+        expect(resolveLocaleFromRequest('/about', null, 'en', ['en', 'fr'])).toBe('en');
+    });
+});
+//# sourceMappingURL=locale.test.js.map

package/dist/i18n/__tests__/locale.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"locale.test.js","sourceRoot":"","sources":["../../../src/i18n/__tests__/locale.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAE5E,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;IACxE,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC1B,MAAM,CAAC,mBAAmB,CAAC,4BAA4B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IACF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/i18n/__tests__/middleware.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=middleware.test.d.ts.map

package/dist/i18n/__tests__/middleware.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.d.ts","sourceRoot":"","sources":["../../../src/i18n/__tests__/middleware.test.ts"],"names":[],"mappings":""}

package/dist/i18n/__tests__/middleware.test.js

@@ -0,0 +1,55 @@
+import { describe, it, expect } from 'vitest';
+import { createLocaleMiddleware } from '../middleware.js';
+const config = {
+    defaultLocale: 'en',
+    supportedLocales: ['en', 'fr', 'de'],
+    excludePaths: ['/api/', '/_next/', '/admin/'],
+};
+describe('createLocaleMiddleware', () => {
+    const middleware = createLocaleMiddleware(config);
+    it('returns default locale for excluded paths (e.g. /api/...)', () => {
+        const result = middleware.resolve('/api/health', 'fr');
+        expect(result).toEqual({ locale: 'en', shouldRedirect: false });
+    });
+    it('returns locale from URL path prefix with no redirect', () => {
+        const result = middleware.resolve('/fr/about', null);
+        expect(result).toEqual({ locale: 'fr', shouldRedirect: false });
+    });
+    it('returns default locale with no redirect when Accept-Language matches default', () => {
+        const result = middleware.resolve('/about', 'en-US,en;q=0.9');
+        expect(result).toEqual({ locale: 'en', shouldRedirect: false });
+    });
+    it('redirects to locale-prefixed URL when Accept-Language differs from default', () => {
+        const result = middleware.resolve('/about', 'fr;q=0.9,en;q=0.8');
+        expect(result).toEqual({
+            locale: 'fr',
+            shouldRedirect: true,
+            redirectPath: '/fr/about',
+        });
+    });
+    it('returns default locale for paths with no locale prefix and no Accept-Language', () => {
+        const result = middleware.resolve('/about', null);
+        expect(result).toEqual({ locale: 'en', shouldRedirect: false });
+    });
+    it('handles root path "/" correctly', () => {
+        const result = middleware.resolve('/', null);
+        expect(result).toEqual({ locale: 'en', shouldRedirect: false });
+    });
+    it('handles root path "/" with non-default Accept-Language', () => {
+        const result = middleware.resolve('/', 'de');
+        expect(result).toEqual({
+            locale: 'de',
+            shouldRedirect: true,
+            redirectPath: '/de/',
+        });
+    });
+    it('does not redirect for excluded paths even with non-default Accept-Language', () => {
+        const result = middleware.resolve('/_next/static/chunk.js', 'fr');
+        expect(result).toEqual({ locale: 'en', shouldRedirect: false });
+    });
+    it('returns locale from URL path for non-excluded paths with multiple segments', () => {
+        const result = middleware.resolve('/de/blog/my-post', 'fr');
+        expect(result).toEqual({ locale: 'de', shouldRedirect: false });
+    });
+});
+//# sourceMappingURL=middleware.test.js.map

package/dist/i18n/__tests__/middleware.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.test.js","sourceRoot":"","sources":["../../../src/i18n/__tests__/middleware.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,MAAM,MAAM,GAAG;IACb,aAAa,EAAE,IAAI;IACnB,gBAAgB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACpC,YAAY,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC;CAC9C,CAAA;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;IAEjD,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;QACtD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACjD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,IAAI;YACpB,YAAY,EAAE,MAAM;SACrB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAA;QACjE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/i18n/__tests__/resolver.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolver.test.d.ts.map

package/dist/i18n/__tests__/resolver.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.test.d.ts","sourceRoot":"","sources":["../../../src/i18n/__tests__/resolver.test.ts"],"names":[],"mappings":""}