@replohq/sdk 0.6.1 → 0.7.0

package/_vendor/replo-utils/lib/url.d.ts

@@ -55,3 +55,8 @@ export declare const isValidRoutePath: (path: string) => boolean;
  * relative value such as a site path.
  */
 export declare function parseUrl(value: string, base?: string): URL | null;
+/**
+ * File extension from a URL's path, lowercased, defaulting to "jpg" for
+ * extensionless paths (product imagery is the primary consumer).
+ */
+export declare function fileExtensionFromUrl(url: string): string;

package/_vendor/schemas/routing/locale.d.ts

@@ -0,0 +1,45 @@
+import { ReploError } from "../errors";
+import { z } from "zod";
+export declare class LocaleRoutingValidationError extends ReploError {
+}
+/**
+ * Set by the runtime when a visitor explicitly picks a locale (a language
+ * switcher link, or landing on a locale-prefixed URL). Negotiation reads it
+ * ahead of any detection, so an explicit choice always wins.
+ */
+export declare const REPLO_LOCALE_COOKIE = "replo-locale";
+/**
+ * Overrides the visitor's IP-derived country for testing geo behavior without
+ * a VPN — works identically in dev sandboxes and on the published site. At
+ * worst it lets a visitor pick which locale they see, which the locale cookie
+ * already allows deliberately.
+ */
+export declare const REPLO_COUNTRY_OVERRIDE_COOKIE = "replo-country-override";
+export declare function canonicalizeLocaleTag(tag: string): string | null;
+export declare const DOMAIN_HOSTNAME: RegExp;
+export declare const localeRoutingConfigSchema: z.ZodObject<{
+    locales: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    defaultLocale: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    detection: z.ZodDefault<z.ZodEnum<{
+        country: "country";
+        language: "language";
+    }>>;
+    urlMode: z.ZodDefault<z.ZodEnum<{
+        prefixed: "prefixed";
+        hidden: "hidden";
+    }>>;
+    domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        locales: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        defaultLocale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type LocaleRoutingConfig = z.infer<typeof localeRoutingConfigSchema>;
+export type LocaleRoutingConfigInput = z.input<typeof localeRoutingConfigSchema>;
+export type LocaleDetection = LocaleRoutingConfig["detection"];
+export type LocaleUrlMode = LocaleRoutingConfig["urlMode"];
+/**
+ * Validates a locale routing config, returning it with every tag
+ * canonicalized and defaults applied. Throws `LocaleRoutingValidationError`
+ * carrying the first failing check's message.
+ */
+export declare function reploLocaleRouting(input: LocaleRoutingConfigInput): LocaleRoutingConfig;

package/_vendor/schemas/routing/locale.mjs

@@ -0,0 +1,95 @@
+import { ReploError } from '../../../chunk-5M7VU32I.mjs';
+import '../../../chunk-UJCSKKID.mjs';
+import { z } from 'zod';
+
+var LocaleRoutingValidationError = class extends ReploError {
+};
+var REPLO_LOCALE_COOKIE = "replo-locale";
+var REPLO_COUNTRY_OVERRIDE_COOKIE = "replo-country-override";
+var CANONICAL_LOCALE_TAG = /^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|\d{3}))?$/;
+function canonicalizeLocaleTag(tag) {
+  let canonical;
+  try {
+    canonical = Intl.getCanonicalLocales(tag)[0];
+  } catch {
+    return null;
+  }
+  if (!canonical || !CANONICAL_LOCALE_TAG.test(canonical)) {
+    return null;
+  }
+  return canonical;
+}
+var localeTagSchema = z.string().transform((tag, context) => {
+  const canonical = canonicalizeLocaleTag(tag);
+  if (canonical === null) {
+    context.addIssue({
+      code: "custom",
+      message: `"${tag}" is not a locale tag \u2014 use a BCP 47 tag like "en", "fr-CA", or "zh-Hant"`
+    });
+    return z.NEVER;
+  }
+  return canonical;
+});
+var DOMAIN_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,62})?(\.[a-z0-9]([a-z0-9-]{0,62})?)+$/;
+var domainScopeSchema = z.object({
+  locales: z.array(localeTagSchema).min(1),
+  defaultLocale: localeTagSchema.optional()
+}).strict();
+var localeRoutingConfigSchema = z.object({
+  locales: z.array(localeTagSchema).min(2),
+  defaultLocale: localeTagSchema,
+  detection: z.enum(["language", "country"]).default("language"),
+  urlMode: z.enum(["prefixed", "hidden"]).default("prefixed"),
+  domains: z.record(z.string(), domainScopeSchema).optional()
+}).strict().superRefine((config, context) => {
+  const configured = new Set(config.locales);
+  if (configured.size !== config.locales.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["locales"],
+      message: "locales must not repeat after canonicalization"
+    });
+  }
+  if (!configured.has(config.defaultLocale)) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultLocale"],
+      message: `defaultLocale "${config.defaultLocale}" must be one of locales`
+    });
+  }
+  for (const [hostname, scope] of Object.entries(config.domains ?? {})) {
+    if (!DOMAIN_HOSTNAME.test(hostname)) {
+      context.addIssue({
+        code: "custom",
+        path: ["domains", hostname],
+        message: `"${hostname}" must be a bare lowercase hostname like "example.com" \u2014 no scheme, path, or port`
+      });
+    }
+    for (const locale of scope.locales) {
+      if (!configured.has(locale)) {
+        context.addIssue({
+          code: "custom",
+          path: ["domains", hostname, "locales"],
+          message: `"${locale}" is not in the top-level locales list`
+        });
+      }
+    }
+    if (scope.defaultLocale !== void 0 && !scope.locales.includes(scope.defaultLocale)) {
+      context.addIssue({
+        code: "custom",
+        path: ["domains", hostname, "defaultLocale"],
+        message: `defaultLocale "${scope.defaultLocale}" must be one of this domain's locales`
+      });
+    }
+  }
+});
+function reploLocaleRouting(input) {
+  const parsed = localeRoutingConfigSchema.safeParse(input);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  const message = parsed.error.issues[0]?.message ?? "invalid locale routing config";
+  throw new LocaleRoutingValidationError({ message });
+}
+
+export { DOMAIN_HOSTNAME, LocaleRoutingValidationError, REPLO_COUNTRY_OVERRIDE_COOKIE, REPLO_LOCALE_COOKIE, canonicalizeLocaleTag, localeRoutingConfigSchema, reploLocaleRouting };

package/_vendor/schemas/routing/localeNegotiation.d.ts

@@ -0,0 +1,87 @@
+import type { LocaleRoutingConfig } from "./locale";
+/** The locales one request negotiates within, after domain scoping. */
+export interface LocaleScope {
+    locales: string[];
+    defaultLocale: string;
+}
+export interface NegotiatedLocale {
+    locale: string;
+    source: "cookie" | "country" | "language" | "default";
+}
+/**
+ * The scope a request's Host header lands in. A host with no domain entry —
+ * including every dev sandbox and preview host — gets the global scope, which
+ * keeps domain configs inert anywhere the real hostnames don't resolve.
+ */
+export declare function resolveLocaleScope({ host, config, }: {
+    host: string | null;
+    config: LocaleRoutingConfig;
+}): LocaleScope;
+/**
+ * The tags of an `Accept-Language` header, highest preference first. `*` is
+ * dropped — matching anything and matching nothing both fall through to the
+ * default locale — and so is any tag `matchBestFitLocale` would choke on, so
+ * one garbage entry never voids the visitor's real preferences.
+ */
+export declare function parseAcceptLanguage(header: string | null): string[];
+/**
+ * The best supported locale for an ordered list of requested tags, or null
+ * when no requested tag relates to any supported locale. Supported order
+ * breaks ties, so the config's own ordering expresses preference.
+ */
+export declare function matchLocale({ requested, supported, }: {
+    requested: readonly string[];
+    supported: readonly string[];
+}): string | null;
+/**
+ * One request's locale, from the strongest signal available: an explicit
+ * cookie choice, then the detection strategy, then the scope default. Country
+ * detection derives its candidates from the locales' own region subtags —
+ * `CA` finds `en-CA` and `fr-CA` — and breaks multilingual-country ties with
+ * `Accept-Language` among just those candidates. A country matching no locale
+ * falls through to language detection rather than the default, so a German
+ * visitor of a `["en", "fr"]` site still gets a language they asked for.
+ */
+export declare function negotiateLocale({ scope, detection, cookieLocale, countryCode, acceptLanguageHeader, }: {
+    scope: LocaleScope;
+    detection: LocaleRoutingConfig["detection"];
+    cookieLocale: string | null;
+    countryCode: string | null;
+    acceptLanguageHeader: string | null;
+}): NegotiatedLocale;
+export interface PathLocale {
+    locale: string;
+    /** The prefix segment as it appeared in the URL, casing included. */
+    pathSegment: string;
+    /** The pathname with the locale prefix removed; always starts with `/`. */
+    logicalPath: string;
+}
+/**
+ * The configured locale a pathname's first segment names, or null. Matching
+ * is case-insensitive — `/en-ca/about` still identifies `en-CA` — and the
+ * caller decides whether a non-canonical spelling deserves a redirect.
+ */
+export declare function getLocaleFromPath({ pathname, locales, }: {
+    pathname: string;
+    locales: readonly string[];
+}): PathLocale | null;
+/** `/about` under `fr-CA` is `/fr-CA/about`; the root is `/fr-CA` itself. */
+export declare function withLocalePrefix({ locale, path, }: {
+    locale: string;
+    path: string;
+}): string;
+/**
+ * The URL of a logical path in another locale — the one primitive a language
+ * switcher and hreflang alternates need. Within the current host's scope (or
+ * with no domains configured) it is the locale-prefixed path; a locale served
+ * by a different domain gets an absolute URL there, dropping the prefix when
+ * that domain serves only the one locale. Hidden-mode sites use the prefixed
+ * form too: the runtime converts an explicit locale prefix into a cookie plus
+ * a clean-URL redirect on arrival.
+ */
+export declare function localeUrl({ locale, path, config, currentHost, }: {
+    locale: string;
+    path: string;
+    config: LocaleRoutingConfig;
+    currentHost?: string | null;
+}): string;

package/_vendor/schemas/routing/localeNegotiation.mjs

@@ -0,0 +1,141 @@
+import '../../../chunk-UJCSKKID.mjs';
+import { match } from '@formatjs/intl-localematcher';
+import Negotiator from 'negotiator';
+
+function resolveLocaleScope({
+  host,
+  config
+}) {
+  const hostname = host?.trim().toLowerCase().split(":")[0] ?? "";
+  const scope = config.domains?.[hostname];
+  if (!scope) {
+    return { locales: config.locales, defaultLocale: config.defaultLocale };
+  }
+  const firstScopeLocale = scope.locales[0] ?? config.defaultLocale;
+  return {
+    locales: scope.locales,
+    defaultLocale: scope.defaultLocale ?? (scope.locales.includes(config.defaultLocale) ? config.defaultLocale : firstScopeLocale)
+  };
+}
+function parseAcceptLanguage(header) {
+  if (!header) {
+    return [];
+  }
+  const languages = new Negotiator({
+    headers: { "accept-language": header }
+  }).languages();
+  return languages.filter((tag) => tag !== "*" && isStructurallyValidTag(tag));
+}
+function matchLocale({
+  requested,
+  supported
+}) {
+  const wellFormed = requested.filter(isStructurallyValidTag);
+  if (wellFormed.length === 0 || supported.length === 0) {
+    return null;
+  }
+  const result = match(wellFormed, [...supported], "und");
+  return supported.includes(result) ? result : null;
+}
+function negotiateLocale({
+  scope,
+  detection,
+  cookieLocale,
+  countryCode,
+  acceptLanguageHeader
+}) {
+  const fromCookie = cookieLocale ? findTagInsensitive({ tag: cookieLocale, supported: scope.locales }) : null;
+  if (fromCookie) {
+    return { locale: fromCookie, source: "cookie" };
+  }
+  const requested = parseAcceptLanguage(acceptLanguageHeader);
+  if (detection === "country" && countryCode) {
+    const region = countryCode.trim().toUpperCase();
+    const candidates = scope.locales.filter(
+      (locale) => localeRegion(locale) === region
+    );
+    const [firstCandidate] = candidates;
+    if (firstCandidate !== void 0) {
+      return {
+        locale: matchLocale({ requested, supported: candidates }) ?? firstCandidate,
+        source: "country"
+      };
+    }
+  }
+  const fromLanguage = matchLocale({ requested, supported: scope.locales });
+  if (fromLanguage) {
+    return { locale: fromLanguage, source: "language" };
+  }
+  return { locale: scope.defaultLocale, source: "default" };
+}
+function getLocaleFromPath({
+  pathname,
+  locales
+}) {
+  const [, firstSegment = "", ...restSegments] = pathname.split("/");
+  const locale = findTagInsensitive({ tag: firstSegment, supported: locales });
+  if (!locale) {
+    return null;
+  }
+  const rest = restSegments.join("/");
+  return {
+    locale,
+    pathSegment: firstSegment,
+    logicalPath: `/${rest}`
+  };
+}
+function withLocalePrefix({
+  locale,
+  path
+}) {
+  const normalized = path.startsWith("/") ? path : `/${path}`;
+  return normalized === "/" ? `/${locale}` : `/${locale}${normalized}`;
+}
+function localeUrl({
+  locale,
+  path,
+  config,
+  currentHost
+}) {
+  const currentScope = resolveLocaleScope({
+    host: currentHost ?? null,
+    config
+  });
+  if (!config.domains || currentScope.locales.includes(locale)) {
+    return withLocalePrefix({ locale, path });
+  }
+  const hosting = Object.entries(config.domains).find(([, scope2]) => {
+    return scope2.locales.includes(locale);
+  });
+  if (!hosting) {
+    return withLocalePrefix({ locale, path });
+  }
+  const [hostname, scope] = hosting;
+  const normalized = path.startsWith("/") ? path : `/${path}`;
+  const pathPart = scope.locales.length === 1 ? normalized : withLocalePrefix({ locale, path: normalized });
+  return `https://${hostname}${pathPart === "/" ? "" : pathPart}`;
+}
+function findTagInsensitive({
+  tag,
+  supported
+}) {
+  const lowered = tag.toLowerCase();
+  return supported.find((candidate) => candidate.toLowerCase() === lowered) ?? null;
+}
+function isStructurallyValidTag(tag) {
+  try {
+    Intl.getCanonicalLocales(tag);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function localeRegion(locale) {
+  try {
+    return new Intl.Locale(locale).region ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export { getLocaleFromPath, localeUrl, matchLocale, negotiateLocale, parseAcceptLanguage, resolveLocaleScope, withLocalePrefix };

package/_vendor/schemas/routing/rules.mjs

@@ -1,5 +1,5 @@
-import { ReploError } from '../../../chunk-5M7VU32I.mjs';
 import { getParamSegment, getRouteParams, hasRouteParam, matchSource } from '../../../chunk-VPEVERWE.mjs';
+import { ReploError } from '../../../chunk-5M7VU32I.mjs';
 import '../../../chunk-UJCSKKID.mjs';
 import { z } from 'zod';
 

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "branch": "HEAD",
-  "commit": "53885fcc411325244dae08b8ba0697eea8e8b1b5",
-  "builtAt": "2026-08-19T22:25:34.675Z"
+  "commit": "539d866ed8d4f2a8f13f1b3bd23cc3131d96c35f",
+  "builtAt": "2026-08-20T02:24:19.564Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "0.6.1",
+    "version": "0.7.0",
     "branch": "HEAD",
-    "commit": "53885fcc411325244dae08b8ba0697eea8e8b1b5",
-    "builtAt": "2026-08-19T22:25:34.675Z"
+    "commit": "539d866ed8d4f2a8f13f1b3bd23cc3131d96c35f",
+    "builtAt": "2026-08-20T02:24:19.564Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",
@@ -209,6 +209,14 @@
       "types": "./routing/rules.d.ts",
       "default": "./routing/rules.js"
     },
+    "./routing/locale": {
+      "types": "./routing/locale.d.ts",
+      "default": "./routing/locale.js"
+    },
+    "./routing/geo": {
+      "types": "./routing/geo.d.ts",
+      "default": "./routing/geo.js"
+    },
     "./_vendor/schemas/loaderKeys": {
       "types": "./_vendor/schemas/loaderKeys.d.ts",
       "default": "./_vendor/schemas/loaderKeys.mjs"
@@ -216,6 +224,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
+    "@formatjs/intl-localematcher": "^0.8.13",
+    "negotiator": "^1.0.0",
     "tiny-jsonc": "^1.0.2",
     "uuid": "^11.1.0",
     "zod": "^4.3.6"

package/routing/evaluate.d.ts

@@ -1,7 +1,9 @@
 import type { NextRequest } from "next/server";
+import type { LocaleRoutingConfig } from "../_vendor/schemas/routing/locale";
 import type { RedirectRule } from "../_vendor/schemas/routing/rules";
 import { NextResponse } from "next/server";
-export declare function evaluateRouting({ request, rules, }: {
+export declare function evaluateRouting({ request, rules, localeRouting, }: {
     request: NextRequest;
     rules: readonly RedirectRule[];
+    localeRouting?: LocaleRoutingConfig;
 }): NextResponse;

package/routing/evaluate.js

@@ -1,25 +1,66 @@
 import { NextResponse } from "next/server";
+import { REPLO_LOCALE_COOKIE } from "../_vendor/schemas/routing/locale.mjs";
+import {
+  getLocaleFromPath,
+  negotiateLocale,
+  resolveLocaleScope,
+  withLocalePrefix
+} from "../_vendor/schemas/routing/localeNegotiation.mjs";
 import { applyParams, matchSource } from "../_vendor/schemas/routing/match.mjs";
+import { ipCountry } from "./geo";
 function evaluateRouting({
   request,
-  rules
+  rules,
+  localeRouting
 }) {
+  const localeContext = localeRouting ? getLocaleContext({ request, config: localeRouting }) : null;
   for (const rule of rules) {
-    const response = evaluateRedirect({ request, rule });
+    const response = evaluateRedirect({ request, rule, localeContext });
     if (response) {
       return response;
     }
   }
-  return NextResponse.next();
+  return evaluateLocalePhase({ request, localeContext });
+}
+function getLocaleContext({
+  request,
+  config
+}) {
+  const scope = resolveLocaleScope({
+    host: request.headers.get("host"),
+    config
+  });
+  const pathLocale = getLocaleFromPath({
+    pathname: request.nextUrl.pathname,
+    locales: config.locales
+  });
+  const negotiated = negotiateLocale({
+    scope,
+    detection: config.detection,
+    cookieLocale: request.cookies.get(REPLO_LOCALE_COOKIE)?.value ?? null,
+    countryCode: ipCountry(request),
+    acceptLanguageHeader: request.headers.get("accept-language")
+  });
+  return {
+    config,
+    scope,
+    urlMode: scope.locales.length === 1 ? "hidden" : config.urlMode,
+    pathLocale,
+    negotiated
+  };
 }
 function evaluateRedirect({
   request,
-  rule
+  rule,
+  localeContext
 }) {
   const params = matchSource({
     source: rule.source,
     pathname: request.nextUrl.pathname
-  });
+  }) ?? (localeContext?.pathLocale ? matchSource({
+    source: rule.source,
+    pathname: localeContext.pathLocale.logicalPath
+  }) : null);
   if (!params) {
     return null;
   }
@@ -30,11 +71,114 @@ function evaluateRedirect({
   if (url.origin === request.nextUrl.origin && !url.search) {
     url.search = request.nextUrl.search;
   }
+  if (localeContext && url.origin === request.nextUrl.origin) {
+    applyLocaleToDestination({ url, localeContext });
+  }
   const redirectsToCurrentRequest = url.origin === request.nextUrl.origin && normalizePath(url.pathname) === normalizePath(request.nextUrl.pathname) && url.search === request.nextUrl.search;
   if (redirectsToCurrentRequest) {
     return NextResponse.next();
   }
-  return NextResponse.redirect(url, rule.status);
+  const response = NextResponse.redirect(url, rule.status);
+  if (localeContext?.pathLocale && localeContext.urlMode === "hidden" && url.origin === request.nextUrl.origin && localeContext.scope.locales.includes(localeContext.pathLocale.locale)) {
+    setLocaleCookie({ response, locale: localeContext.pathLocale.locale });
+  }
+  return response;
+}
+function applyLocaleToDestination({
+  url,
+  localeContext
+}) {
+  if (localeContext.urlMode !== "prefixed") {
+    return;
+  }
+  if (isLocaleExemptPath(url.pathname)) {
+    return;
+  }
+  const destinationLocale = getLocaleFromPath({
+    pathname: url.pathname,
+    locales: localeContext.config.locales
+  });
+  if (destinationLocale) {
+    if (destinationLocale.pathSegment !== destinationLocale.locale) {
+      url.pathname = withLocalePrefix({
+        locale: destinationLocale.locale,
+        path: destinationLocale.logicalPath
+      });
+    }
+    return;
+  }
+  url.pathname = withLocalePrefix({
+    locale: localeContext.pathLocale?.locale ?? localeContext.negotiated.locale,
+    path: url.pathname
+  });
+}
+function evaluateLocalePhase({
+  request,
+  localeContext
+}) {
+  if (!localeContext) {
+    return NextResponse.next();
+  }
+  const { pathname } = request.nextUrl;
+  if (isLocaleExemptPath(pathname)) {
+    return NextResponse.next();
+  }
+  const { urlMode, pathLocale, negotiated, scope } = localeContext;
+  if (urlMode === "prefixed") {
+    if (!pathLocale) {
+      const url2 = request.nextUrl.clone();
+      url2.pathname = withLocalePrefix({
+        locale: negotiated.locale,
+        path: pathname
+      });
+      return NextResponse.redirect(url2, 307);
+    }
+    if (pathLocale.pathSegment !== pathLocale.locale) {
+      const url2 = request.nextUrl.clone();
+      url2.pathname = withLocalePrefix({
+        locale: pathLocale.locale,
+        path: pathLocale.logicalPath
+      });
+      return NextResponse.redirect(url2, 308);
+    }
+    const response = NextResponse.next();
+    if (pathLocale.locale !== negotiated.locale && request.cookies.get(REPLO_LOCALE_COOKIE)?.value !== pathLocale.locale && scope.locales.includes(pathLocale.locale)) {
+      setLocaleCookie({ response, locale: pathLocale.locale });
+    }
+    return response;
+  }
+  if (pathLocale) {
+    const url2 = request.nextUrl.clone();
+    url2.pathname = pathLocale.logicalPath;
+    const response = NextResponse.redirect(url2, 307);
+    if (scope.locales.includes(pathLocale.locale)) {
+      setLocaleCookie({ response, locale: pathLocale.locale });
+    }
+    return response;
+  }
+  const url = request.nextUrl.clone();
+  url.pathname = withLocalePrefix({
+    locale: negotiated.locale,
+    path: pathname
+  });
+  return NextResponse.rewrite(url);
+}
+function isLocaleExemptPath(pathname) {
+  if (pathname === "/api" || pathname.startsWith("/api/")) {
+    return true;
+  }
+  const lastSegment = pathname.slice(pathname.lastIndexOf("/") + 1);
+  return lastSegment.includes(".");
+}
+function setLocaleCookie({
+  response,
+  locale
+}) {
+  response.cookies.set(REPLO_LOCALE_COOKIE, locale, {
+    path: "/",
+    maxAge: 31536e3,
+    sameSite: "lax"
+  });
 }
 function normalizePath(pathname) {
   const trimmed = pathname.replace(/\/+$/, "");

package/routing/evaluate.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../routing/evaluate.ts"],
-  "sourcesContent": ["import type { NextRequest } from \"next/server\";\nimport type { RedirectRule } from \"schemas/routing/rules\";\n\nimport { NextResponse } from \"next/server\";\n\nimport { applyParams, matchSource } from \"schemas/routing/match\";\n\nexport function evaluateRouting({\n  request,\n  rules,\n}: {\n  request: NextRequest;\n  rules: readonly RedirectRule[];\n}): NextResponse {\n  for (const rule of rules) {\n    const response = evaluateRedirect({ request, rule });\n    if (response) {\n      return response;\n    }\n  }\n  return NextResponse.next();\n}\n\nfunction evaluateRedirect({\n  request,\n  rule,\n}: {\n  request: NextRequest;\n  rule: RedirectRule;\n}): NextResponse | null {\n  const params = matchSource({\n    source: rule.source,\n    pathname: request.nextUrl.pathname,\n  });\n  if (!params) {\n    return null;\n  }\n  const url = new URL(\n    applyParams({ value: rule.destination, params }),\n    request.nextUrl.origin,\n  );\n  if (url.origin === request.nextUrl.origin && !url.search) {\n    url.search = request.nextUrl.search;\n  }\n  // A destination that lands back on the current request would loop. The rule\n  // still consumes the request \u2014 later rules were authored as alternatives to\n  // it, not fallbacks for it \u2014 so the page renders normally instead.\n  const redirectsToCurrentRequest =\n    url.origin === request.nextUrl.origin &&\n    normalizePath(url.pathname) === normalizePath(request.nextUrl.pathname) &&\n    url.search === request.nextUrl.search;\n  if (redirectsToCurrentRequest) {\n    return NextResponse.next();\n  }\n  return NextResponse.redirect(url, rule.status);\n}\n\n/** Trailing slashes carry no meaning, so `/blogs` and `/blogs/` are the same. */\nfunction normalizePath(pathname: string): string {\n  const trimmed = pathname.replace(/\\/+$/, \"\");\n  return trimmed === \"\" ? \"/\" : trimmed;\n}\n"],
-  "mappings": "AAGA,SAAS,oBAAoB;AAE7B,SAAS,aAAa,mBAAmB;AAElC,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAGiB;AACf,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,iBAAiB,EAAE,SAAS,KAAK,CAAC;AACnD,QAAI,UAAU;AACZ,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGwB;AACtB,QAAM,SAAS,YAAY;AAAA,IACzB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ,QAAQ;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI;AAAA,IACd,YAAY,EAAE,OAAO,KAAK,aAAa,OAAO,CAAC;AAAA,IAC/C,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,IAAI,WAAW,QAAQ,QAAQ,UAAU,CAAC,IAAI,QAAQ;AACxD,QAAI,SAAS,QAAQ,QAAQ;AAAA,EAC/B;AAIA,QAAM,4BACJ,IAAI,WAAW,QAAQ,QAAQ,UAC/B,cAAc,IAAI,QAAQ,MAAM,cAAc,QAAQ,QAAQ,QAAQ,KACtE,IAAI,WAAW,QAAQ,QAAQ;AACjC,MAAI,2BAA2B;AAC7B,WAAO,aAAa,KAAK;AAAA,EAC3B;AACA,SAAO,aAAa,SAAS,KAAK,KAAK,MAAM;AAC/C;AAGA,SAAS,cAAc,UAA0B;AAC/C,QAAM,UAAU,SAAS,QAAQ,QAAQ,EAAE;AAC3C,SAAO,YAAY,KAAK,MAAM;AAChC;",
-  "names": []
+  "sourcesContent": ["import type { NextRequest } from \"next/server\";\nimport type { LocaleRoutingConfig } from \"schemas/routing/locale\";\nimport type {\n  LocaleScope,\n  NegotiatedLocale,\n  PathLocale,\n} from \"schemas/routing/localeNegotiation\";\nimport type { RedirectRule } from \"schemas/routing/rules\";\n\nimport { NextResponse } from \"next/server\";\n\nimport { REPLO_LOCALE_COOKIE } from \"schemas/routing/locale\";\nimport {\n  getLocaleFromPath,\n  negotiateLocale,\n  resolveLocaleScope,\n  withLocalePrefix,\n} from \"schemas/routing/localeNegotiation\";\nimport { applyParams, matchSource } from \"schemas/routing/match\";\n\nimport { ipCountry } from \"./geo\";\n\nexport function evaluateRouting({\n  request,\n  rules,\n  localeRouting,\n}: {\n  request: NextRequest;\n  rules: readonly RedirectRule[];\n  localeRouting?: LocaleRoutingConfig;\n}): NextResponse {\n  const localeContext = localeRouting\n    ? getLocaleContext({ request, config: localeRouting })\n    : null;\n  for (const rule of rules) {\n    const response = evaluateRedirect({ request, rule, localeContext });\n    if (response) {\n      return response;\n    }\n  }\n  return evaluateLocalePhase({ request, localeContext });\n}\n\ninterface LocaleContext {\n  config: LocaleRoutingConfig;\n  scope: LocaleScope;\n  /** A single-locale domain serves clean URLs whatever the config says. */\n  urlMode: LocaleRoutingConfig[\"urlMode\"];\n  pathLocale: PathLocale | null;\n  negotiated: NegotiatedLocale;\n}\n\nfunction getLocaleContext({\n  request,\n  config,\n}: {\n  request: NextRequest;\n  config: LocaleRoutingConfig;\n}): LocaleContext {\n  const scope = resolveLocaleScope({\n    host: request.headers.get(\"host\"),\n    config,\n  });\n  // The prefix is read against every configured locale, not just the scope's:\n  // an explicitly requested out-of-scope locale is served rather than fought,\n  // it just never wins negotiation or gets advertised in a cookie.\n  const pathLocale = getLocaleFromPath({\n    pathname: request.nextUrl.pathname,\n    locales: config.locales,\n  });\n  const negotiated = negotiateLocale({\n    scope,\n    detection: config.detection,\n    cookieLocale: request.cookies.get(REPLO_LOCALE_COOKIE)?.value ?? null,\n    countryCode: ipCountry(request),\n    acceptLanguageHeader: request.headers.get(\"accept-language\"),\n  });\n  return {\n    config,\n    scope,\n    urlMode: scope.locales.length === 1 ? \"hidden\" : config.urlMode,\n    pathLocale,\n    negotiated,\n  };\n}\n\nfunction evaluateRedirect({\n  request,\n  rule,\n  localeContext,\n}: {\n  request: NextRequest;\n  rule: RedirectRule;\n  localeContext: LocaleContext | null;\n}): NextResponse | null {\n  // Raw first, so a locale-prefixed source targets exactly that locale; then\n  // the locale-stripped path, so a rule authored against the logical path\n  // covers every locale.\n  const params =\n    matchSource({\n      source: rule.source,\n      pathname: request.nextUrl.pathname,\n    }) ??\n    (localeContext?.pathLocale\n      ? matchSource({\n          source: rule.source,\n          pathname: localeContext.pathLocale.logicalPath,\n        })\n      : null);\n  if (!params) {\n    return null;\n  }\n  const url = new URL(\n    applyParams({ value: rule.destination, params }),\n    request.nextUrl.origin,\n  );\n  if (url.origin === request.nextUrl.origin && !url.search) {\n    url.search = request.nextUrl.search;\n  }\n  if (localeContext && url.origin === request.nextUrl.origin) {\n    applyLocaleToDestination({ url, localeContext });\n  }\n  // A destination that lands back on the current request would loop. The rule\n  // still consumes the request \u2014 later rules were authored as alternatives to\n  // it, not fallbacks for it \u2014 so the page renders normally instead.\n  const redirectsToCurrentRequest =\n    url.origin === request.nextUrl.origin &&\n    normalizePath(url.pathname) === normalizePath(request.nextUrl.pathname) &&\n    url.search === request.nextUrl.search;\n  if (redirectsToCurrentRequest) {\n    return NextResponse.next();\n  }\n  const response = NextResponse.redirect(url, rule.status);\n  // Hidden-mode destinations stay clean, so the locale an explicit prefix\n  // carried would be lost across the hop \u2014 keep it in the cookie instead.\n  if (\n    localeContext?.pathLocale &&\n    localeContext.urlMode === \"hidden\" &&\n    url.origin === request.nextUrl.origin &&\n    localeContext.scope.locales.includes(localeContext.pathLocale.locale)\n  ) {\n    setLocaleCookie({ response, locale: localeContext.pathLocale.locale });\n  }\n  return response;\n}\n\n/**\n * In prefixed mode every page lives under a locale, so an unprefixed\n * same-site destination gets one \u2014 the request's own locale when the URL\n * carried one, the negotiated locale otherwise \u2014 collapsing what would be a\n * second redirect hop. A destination that names a locale is left alone:\n * explicit always wins.\n */\nfunction applyLocaleToDestination({\n  url,\n  localeContext,\n}: {\n  url: URL;\n  localeContext: LocaleContext;\n}) {\n  if (localeContext.urlMode !== \"prefixed\") {\n    return;\n  }\n  if (isLocaleExemptPath(url.pathname)) {\n    return;\n  }\n  const destinationLocale = getLocaleFromPath({\n    pathname: url.pathname,\n    locales: localeContext.config.locales,\n  });\n  if (destinationLocale) {\n    // A non-canonically-cased prefix (`/fr-ca/x`) would otherwise 308 back to\n    // the canonical spelling, re-match the rule, and loop forever \u2014 the loop\n    // guard compares pathnames case-sensitively.\n    if (destinationLocale.pathSegment !== destinationLocale.locale) {\n      url.pathname = withLocalePrefix({\n        locale: destinationLocale.locale,\n        path: destinationLocale.logicalPath,\n      });\n    }\n    return;\n  }\n  url.pathname = withLocalePrefix({\n    locale: localeContext.pathLocale?.locale ?? localeContext.negotiated.locale,\n    path: url.pathname,\n  });\n}\n\nfunction evaluateLocalePhase({\n  request,\n  localeContext,\n}: {\n  request: NextRequest;\n  localeContext: LocaleContext | null;\n}): NextResponse {\n  if (!localeContext) {\n    return NextResponse.next();\n  }\n  const { pathname } = request.nextUrl;\n  if (isLocaleExemptPath(pathname)) {\n    return NextResponse.next();\n  }\n  const { urlMode, pathLocale, negotiated, scope } = localeContext;\n\n  if (urlMode === \"prefixed\") {\n    if (!pathLocale) {\n      const url = request.nextUrl.clone();\n      url.pathname = withLocalePrefix({\n        locale: negotiated.locale,\n        path: pathname,\n      });\n      // Temporary: the same URL legitimately serves different locales to\n      // different visitors, so this must never cache as permanent.\n      return NextResponse.redirect(url, 307);\n    }\n    if (pathLocale.pathSegment !== pathLocale.locale) {\n      const url = request.nextUrl.clone();\n      url.pathname = withLocalePrefix({\n        locale: pathLocale.locale,\n        path: pathLocale.logicalPath,\n      });\n      return NextResponse.redirect(url, 308);\n    }\n    const response = NextResponse.next();\n    // A prefix that differs from what negotiation would pick is an explicit\n    // choice \u2014 keep it sticky. A matching prefix proves nothing: the 307\n    // above manufactures exactly that navigation, and persisting the guess\n    // would freeze the first detection result for a year.\n    if (\n      pathLocale.locale !== negotiated.locale &&\n      request.cookies.get(REPLO_LOCALE_COOKIE)?.value !== pathLocale.locale &&\n      scope.locales.includes(pathLocale.locale)\n    ) {\n      setLocaleCookie({ response, locale: pathLocale.locale });\n    }\n    return response;\n  }\n\n  // Hidden mode: a locale-prefixed URL is the language-switcher mechanism \u2014\n  // adopt the locale as a cookie and settle on the clean URL.\n  if (pathLocale) {\n    const url = request.nextUrl.clone();\n    url.pathname = pathLocale.logicalPath;\n    const response = NextResponse.redirect(url, 307);\n    if (scope.locales.includes(pathLocale.locale)) {\n      setLocaleCookie({ response, locale: pathLocale.locale });\n    }\n    return response;\n  }\n  const url = request.nextUrl.clone();\n  url.pathname = withLocalePrefix({\n    locale: negotiated.locale,\n    path: pathname,\n  });\n  return NextResponse.rewrite(url);\n}\n\n// Requests for files and API routes have no locale variant; prefixing or\n// rewriting them would just 404.\nfunction isLocaleExemptPath(pathname: string): boolean {\n  if (pathname === \"/api\" || pathname.startsWith(\"/api/\")) {\n    return true;\n  }\n  const lastSegment = pathname.slice(pathname.lastIndexOf(\"/\") + 1);\n  return lastSegment.includes(\".\");\n}\n\nfunction setLocaleCookie({\n  response,\n  locale,\n}: {\n  response: NextResponse;\n  locale: string;\n}) {\n  response.cookies.set(REPLO_LOCALE_COOKIE, locale, {\n    path: \"/\",\n    maxAge: 31_536_000,\n    sameSite: \"lax\",\n  });\n}\n\n/** Trailing slashes carry no meaning, so `/blogs` and `/blogs/` are the same. */\nfunction normalizePath(pathname: string): string {\n  const trimmed = pathname.replace(/\\/+$/, \"\");\n  return trimmed === \"\" ? \"/\" : trimmed;\n}\n"],
+  "mappings": "AASA,SAAS,oBAAoB;AAE7B,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,aAAa,mBAAmB;AAEzC,SAAS,iBAAiB;AAEnB,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF,GAIiB;AACf,QAAM,gBAAgB,gBAClB,iBAAiB,EAAE,SAAS,QAAQ,cAAc,CAAC,IACnD;AACJ,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,iBAAiB,EAAE,SAAS,MAAM,cAAc,CAAC;AAClE,QAAI,UAAU;AACZ,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,oBAAoB,EAAE,SAAS,cAAc,CAAC;AACvD;AAWA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGkB;AAChB,QAAM,QAAQ,mBAAmB;AAAA,IAC/B,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,IAChC;AAAA,EACF,CAAC;AAID,QAAM,aAAa,kBAAkB;AAAA,IACnC,UAAU,QAAQ,QAAQ;AAAA,IAC1B,SAAS,OAAO;AAAA,EAClB,CAAC;AACD,QAAM,aAAa,gBAAgB;AAAA,IACjC;AAAA,IACA,WAAW,OAAO;AAAA,IAClB,cAAc,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,SAAS;AAAA,IACjE,aAAa,UAAU,OAAO;AAAA,IAC9B,sBAAsB,QAAQ,QAAQ,IAAI,iBAAiB;AAAA,EAC7D,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,MAAM,QAAQ,WAAW,IAAI,WAAW,OAAO;AAAA,IACxD;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AACF,GAIwB;AAItB,QAAM,SACJ,YAAY;AAAA,IACV,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ,QAAQ;AAAA,EAC5B,CAAC,MACA,eAAe,aACZ,YAAY;AAAA,IACV,QAAQ,KAAK;AAAA,IACb,UAAU,cAAc,WAAW;AAAA,EACrC,CAAC,IACD;AACN,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI;AAAA,IACd,YAAY,EAAE,OAAO,KAAK,aAAa,OAAO,CAAC;AAAA,IAC/C,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,IAAI,WAAW,QAAQ,QAAQ,UAAU,CAAC,IAAI,QAAQ;AACxD,QAAI,SAAS,QAAQ,QAAQ;AAAA,EAC/B;AACA,MAAI,iBAAiB,IAAI,WAAW,QAAQ,QAAQ,QAAQ;AAC1D,6BAAyB,EAAE,KAAK,cAAc,CAAC;AAAA,EACjD;AAIA,QAAM,4BACJ,IAAI,WAAW,QAAQ,QAAQ,UAC/B,cAAc,IAAI,QAAQ,MAAM,cAAc,QAAQ,QAAQ,QAAQ,KACtE,IAAI,WAAW,QAAQ,QAAQ;AACjC,MAAI,2BAA2B;AAC7B,WAAO,aAAa,KAAK;AAAA,EAC3B;AACA,QAAM,WAAW,aAAa,SAAS,KAAK,KAAK,MAAM;AAGvD,MACE,eAAe,cACf,cAAc,YAAY,YAC1B,IAAI,WAAW,QAAQ,QAAQ,UAC/B,cAAc,MAAM,QAAQ,SAAS,cAAc,WAAW,MAAM,GACpE;AACA,oBAAgB,EAAE,UAAU,QAAQ,cAAc,WAAW,OAAO,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AASA,SAAS,yBAAyB;AAAA,EAChC;AAAA,EACA;AACF,GAGG;AACD,MAAI,cAAc,YAAY,YAAY;AACxC;AAAA,EACF;AACA,MAAI,mBAAmB,IAAI,QAAQ,GAAG;AACpC;AAAA,EACF;AACA,QAAM,oBAAoB,kBAAkB;AAAA,IAC1C,UAAU,IAAI;AAAA,IACd,SAAS,cAAc,OAAO;AAAA,EAChC,CAAC;AACD,MAAI,mBAAmB;AAIrB,QAAI,kBAAkB,gBAAgB,kBAAkB,QAAQ;AAC9D,UAAI,WAAW,iBAAiB;AAAA,QAC9B,QAAQ,kBAAkB;AAAA,QAC1B,MAAM,kBAAkB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA;AAAA,EACF;AACA,MAAI,WAAW,iBAAiB;AAAA,IAC9B,QAAQ,cAAc,YAAY,UAAU,cAAc,WAAW;AAAA,IACrE,MAAM,IAAI;AAAA,EACZ,CAAC;AACH;AAEA,SAAS,oBAAoB;AAAA,EAC3B;AAAA,EACA;AACF,GAGiB;AACf,MAAI,CAAC,eAAe;AAClB,WAAO,aAAa,KAAK;AAAA,EAC3B;AACA,QAAM,EAAE,SAAS,IAAI,QAAQ;AAC7B,MAAI,mBAAmB,QAAQ,GAAG;AAChC,WAAO,aAAa,KAAK;AAAA,EAC3B;AACA,QAAM,EAAE,SAAS,YAAY,YAAY,MAAM,IAAI;AAEnD,MAAI,YAAY,YAAY;AAC1B,QAAI,CAAC,YAAY;AACf,YAAMA,OAAM,QAAQ,QAAQ,MAAM;AAClC,MAAAA,KAAI,WAAW,iBAAiB;AAAA,QAC9B,QAAQ,WAAW;AAAA,QACnB,MAAM;AAAA,MACR,CAAC;AAGD,aAAO,aAAa,SAASA,MAAK,GAAG;AAAA,IACvC;AACA,QAAI,WAAW,gBAAgB,WAAW,QAAQ;AAChD,YAAMA,OAAM,QAAQ,QAAQ,MAAM;AAClC,MAAAA,KAAI,WAAW,iBAAiB;AAAA,QAC9B,QAAQ,WAAW;AAAA,QACnB,MAAM,WAAW;AAAA,MACnB,CAAC;AACD,aAAO,aAAa,SAASA,MAAK,GAAG;AAAA,IACvC;AACA,UAAM,WAAW,aAAa,KAAK;AAKnC,QACE,WAAW,WAAW,WAAW,UACjC,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,UAAU,WAAW,UAC/D,MAAM,QAAQ,SAAS,WAAW,MAAM,GACxC;AACA,sBAAgB,EAAE,UAAU,QAAQ,WAAW,OAAO,CAAC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAIA,MAAI,YAAY;AACd,UAAMA,OAAM,QAAQ,QAAQ,MAAM;AAClC,IAAAA,KAAI,WAAW,WAAW;AAC1B,UAAM,WAAW,aAAa,SAASA,MAAK,GAAG;AAC/C,QAAI,MAAM,QAAQ,SAAS,WAAW,MAAM,GAAG;AAC7C,sBAAgB,EAAE,UAAU,QAAQ,WAAW,OAAO,CAAC;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AACA,QAAM,MAAM,QAAQ,QAAQ,MAAM;AAClC,MAAI,WAAW,iBAAiB;AAAA,IAC9B,QAAQ,WAAW;AAAA,IACnB,MAAM;AAAA,EACR,CAAC;AACD,SAAO,aAAa,QAAQ,GAAG;AACjC;AAIA,SAAS,mBAAmB,UAA2B;AACrD,MAAI,aAAa,UAAU,SAAS,WAAW,OAAO,GAAG;AACvD,WAAO;AAAA,EACT;AACA,QAAM,cAAc,SAAS,MAAM,SAAS,YAAY,GAAG,IAAI,CAAC;AAChE,SAAO,YAAY,SAAS,GAAG;AACjC;AAEA,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AACF,GAGG;AACD,WAAS,QAAQ,IAAI,qBAAqB,QAAQ;AAAA,IAChD,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ,CAAC;AACH;AAGA,SAAS,cAAc,UAA0B;AAC/C,QAAM,UAAU,SAAS,QAAQ,QAAQ,EAAE;AAC3C,SAAO,YAAY,KAAK,MAAM;AAChC;",
+  "names": ["url"]
 }

package/routing/geo.d.ts

@@ -0,0 +1,9 @@
+import type { NextRequest } from "next/server";
+/**
+ * The visitor's ISO 3166-1 alpha-2 country, or null when unknown. The
+ * override cookie wins so geo behavior is testable without a VPN — in dev
+ * sandboxes, where the Cloudflare header never exists, and on the published
+ * site alike. At worst the override lets a visitor pick which locale they
+ * see, which the locale cookie already allows deliberately.
+ */
+export declare function ipCountry(request: NextRequest): string | null;

package/routing/geo.js

@@ -0,0 +1,17 @@
+import { REPLO_COUNTRY_OVERRIDE_COOKIE } from "../_vendor/schemas/routing/locale.mjs";
+const COUNTRY_CODE = /^[A-Za-z]{2}$/;
+function ipCountry(request) {
+  const override = request.cookies.get(REPLO_COUNTRY_OVERRIDE_COOKIE)?.value.trim();
+  if (override && COUNTRY_CODE.test(override)) {
+    return override.toUpperCase();
+  }
+  const header = request.headers.get("cf-ipcountry")?.trim().toUpperCase();
+  if (!header || !COUNTRY_CODE.test(header) || header === "XX") {
+    return null;
+  }
+  return header;
+}
+export {
+  ipCountry
+};
+//# sourceMappingURL=geo.js.map

package/routing/geo.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../routing/geo.ts"],
+  "sourcesContent": ["import type { NextRequest } from \"next/server\";\n\nimport { REPLO_COUNTRY_OVERRIDE_COOKIE } from \"schemas/routing/locale\";\n\n// Cloudflare's header uses `XX` for \"unknown\" (`T1` for Tor fails the\n// letters-only check on its own).\nconst COUNTRY_CODE = /^[A-Za-z]{2}$/;\n\n/**\n * The visitor's ISO 3166-1 alpha-2 country, or null when unknown. The\n * override cookie wins so geo behavior is testable without a VPN \u2014 in dev\n * sandboxes, where the Cloudflare header never exists, and on the published\n * site alike. At worst the override lets a visitor pick which locale they\n * see, which the locale cookie already allows deliberately.\n */\nexport function ipCountry(request: NextRequest): string | null {\n  const override = request.cookies\n    .get(REPLO_COUNTRY_OVERRIDE_COOKIE)\n    ?.value.trim();\n  if (override && COUNTRY_CODE.test(override)) {\n    return override.toUpperCase();\n  }\n  const header = request.headers.get(\"cf-ipcountry\")?.trim().toUpperCase();\n  if (!header || !COUNTRY_CODE.test(header) || header === \"XX\") {\n    return null;\n  }\n  return header;\n}\n"],
+  "mappings": "AAEA,SAAS,qCAAqC;AAI9C,MAAM,eAAe;AASd,SAAS,UAAU,SAAqC;AAC7D,QAAM,WAAW,QAAQ,QACtB,IAAI,6BAA6B,GAChC,MAAM,KAAK;AACf,MAAI,YAAY,aAAa,KAAK,QAAQ,GAAG;AAC3C,WAAO,SAAS,YAAY;AAAA,EAC9B;AACA,QAAM,SAAS,QAAQ,QAAQ,IAAI,cAAc,GAAG,KAAK,EAAE,YAAY;AACvE,MAAI,CAAC,UAAU,CAAC,aAAa,KAAK,MAAM,KAAK,WAAW,MAAM;AAC5D,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
+  "names": []
+}

package/routing/locale.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Site-facing entrypoint for locale routing authoring and helpers.
+ *
+ * The schema, negotiation, and URL helpers live in `schemas/routing` so the
+ * Website Builder can import them without depending on a published package,
+ * whose release cycle shouldn't gate editor-only changes. Sites can't import
+ * `schemas` directly — it is workspace-only and reaches generated sites
+ * through the SDK's vendoring step — so `middleware.ts` and language
+ * switchers import from here.
+ */
+export type { LocaleDetection, LocaleRoutingConfig, LocaleRoutingConfigInput, LocaleUrlMode, } from "../_vendor/schemas/routing/locale";
+export { REPLO_COUNTRY_OVERRIDE_COOKIE, REPLO_LOCALE_COOKIE, reploLocaleRouting, } from "../_vendor/schemas/routing/locale";
+export { localeUrl } from "../_vendor/schemas/routing/localeNegotiation";

package/routing/locale.js

@@ -0,0 +1,13 @@
+import {
+  REPLO_COUNTRY_OVERRIDE_COOKIE,
+  REPLO_LOCALE_COOKIE,
+  reploLocaleRouting
+} from "../_vendor/schemas/routing/locale.mjs";
+import { localeUrl } from "../_vendor/schemas/routing/localeNegotiation.mjs";
+export {
+  REPLO_COUNTRY_OVERRIDE_COOKIE,
+  REPLO_LOCALE_COOKIE,
+  localeUrl,
+  reploLocaleRouting
+};
+//# sourceMappingURL=locale.js.map

package/routing/locale.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../routing/locale.ts"],
+  "sourcesContent": ["/**\n * Site-facing entrypoint for locale routing authoring and helpers.\n *\n * The schema, negotiation, and URL helpers live in `schemas/routing` so the\n * Website Builder can import them without depending on a published package,\n * whose release cycle shouldn't gate editor-only changes. Sites can't import\n * `schemas` directly \u2014 it is workspace-only and reaches generated sites\n * through the SDK's vendoring step \u2014 so `middleware.ts` and language\n * switchers import from here.\n */\nexport type {\n  LocaleDetection,\n  LocaleRoutingConfig,\n  LocaleRoutingConfigInput,\n  LocaleUrlMode,\n} from \"schemas/routing/locale\"; /* eslint-disable-line barrel-files/avoid-barrel-files, replo/no-export-from -- site-facing entrypoint intentionally re-exports the authoring API. */\nexport {\n  REPLO_COUNTRY_OVERRIDE_COOKIE,\n  REPLO_LOCALE_COOKIE,\n  reploLocaleRouting,\n} from \"schemas/routing/locale\"; /* eslint-disable-line replo/no-export-from -- site-facing entrypoint intentionally re-exports the authoring API. */\nexport { localeUrl } from \"schemas/routing/localeNegotiation\"; /* eslint-disable-line replo/no-export-from -- site-facing entrypoint intentionally re-exports the authoring API. */\n"],
+  "mappings": "AAgBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAiB;",
+  "names": []
+}