cloudflare-next-intl 0.3.1 → 0.3.3

package/dist/src/client/components/client_provider.d.ts

@@ -5,10 +5,12 @@ interface LocaleContextType {
     messages: TranslationObject;
 }
 export declare const LocaleContext: import("react").Context<LocaleContextType | undefined>;
-export default function LocationzationClientProvider({ language, messages, initialAuthUser, children }: {
+export default function LocationzationClientProvider({ language, messages, initialAuthUser, skipAuthProvider, children }: {
     language: string;
     messages: TranslationObject;
     initialAuthUser?: SerializedAuthUser | null;
+    /** Set when `firebaseAuth.autoWireClientProvider` is `false` — skips wrapping `children` in the client `AuthUserProvider` entirely. */
+    skipAuthProvider?: boolean;
     children: React.ReactNode;
 }): Component;
 export {};

package/dist/src/client/components/client_provider.js

@@ -5,7 +5,15 @@ import { createContext, useMemo } from "react";
 import dynamic from "next/dynamic";
 import config from "@intl-config";
 export const LocaleContext = createContext(undefined);
-export default function LocationzationClientProvider({ language, messages, initialAuthUser = null, children }) {
+// Hoisted to module scope — calling `dynamic()` inside the component body
+// creates a brand-new component identity every render, forcing React to
+// unmount/remount `AuthUserProvider` on every render instead of reusing the
+// existing instance. That remount re-subscribes `onIdTokenChanged`, which
+// Firebase immediately replays with the current user, triggering a state
+// update (and a `getIdToken(true)` refresh) that causes another render —
+// an infinite loop of session-cookie writes, one per render.
+const AuthUserProvider = dynamic(() => import("../../firebase_auth/client/auth_user_provider"));
+export default function LocationzationClientProvider({ language, messages, initialAuthUser = null, skipAuthProvider = false, children }) {
     setLocaleCache(language);
     setMessageForLocaleCache(language, messages);
     // `LocaleContext.Provider` stays the outermost element here — the
@@ -14,8 +22,7 @@ export default function LocationzationClientProvider({ language, messages, initi
     // sibling wrapping it, or those hooks would throw for running outside
     // the provider.
     let providedChildren = children;
-    if (config.firebaseAuth) {
-        const AuthUserProvider = dynamic(() => import("../../firebase_auth/client/auth_user_provider"));
+    if (config.firebaseAuth && !skipAuthProvider) {
         providedChildren = _jsx(AuthUserProvider, { initialUser: initialAuthUser, children: children });
     }
     const contextValue = useMemo(() => ({ language, messages }), [language, messages]);

package/dist/src/client/functions/get_cookie.js

@@ -10,8 +10,22 @@
  */
 export default function getCookie(name) {
     try {
-        const match = document.cookie.match(new RegExp(`(?:^|; )${name}=([^;]*)`));
-        return match ? decodeURIComponent(match[1]) : null;
+        const cookie = document.cookie;
+        const prefix = `${name}=`;
+        let start = -1;
+        if (cookie.startsWith(prefix)) {
+            start = prefix.length;
+        }
+        else {
+            const idx = cookie.indexOf(`; ${prefix}`);
+            if (idx !== -1)
+                start = idx + 2 + prefix.length;
+        }
+        if (start === -1)
+            return null;
+        const end = cookie.indexOf(';', start);
+        const value = end === -1 ? cookie.slice(start) : cookie.slice(start, end);
+        return decodeURIComponent(value);
     }
     catch (e) {
         console.error(`Get cookie on client side error: ${e}`);

package/dist/src/config/middleware.js

@@ -11,13 +11,16 @@ const defaultCookieOption = {
     secure: false, // Send cookie only over HTTPS in production
     sameSite: sameSite, // Protection against CSRF attacks. 'strict' or 'lax' are good choices.
 };
+let userAgentModule;
 async function getIsBotValue(userAgent) {
     if (userAgent === null)
         return false;
-    const { isBot } = await import('next/dist/server/web/spec-extension/user-agent');
+    if (!userAgentModule) {
+        userAgentModule = await import('next/dist/server/web/spec-extension/user-agent');
+    }
     // Unreachable: userAgent is already narrowed to non-null string above,
     // so the ?? '' fallback never triggers.
-    return isBot(userAgent ?? '');
+    return userAgentModule.isBot(userAgent ?? '');
 }
 const getIsBotValueCache = cache(getIsBotValue);
 export const localesSet = new Set(config.locales);

package/dist/src/firebase_auth/client/auth_actions.bench.js

@@ -11,6 +11,7 @@ const fa = {
 vi.mock('@intl-config', () => ({ default: { firebaseAuth: fa } }));
 vi.mock('./firebase_client', () => ({
     getFirebaseAuthClient: vi.fn(async () => ({ auth: {} })),
+    getFirebaseAuthModule: () => import('firebase/auth'),
 }));
 vi.mock('../error_messages/firebase_auth_error_helper', () => ({
     default: vi.fn(() => 'translated error'),

package/dist/src/firebase_auth/client/auth_actions.js

@@ -1,7 +1,7 @@
 'use client';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { getFirebaseAuthClient } from './firebase_client';
+import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import firebaseAuthErrorMessage from '../error_messages/firebase_auth_error_helper';
 function readCredentials(formData) {
     return {
@@ -27,7 +27,7 @@ export function createLoginAction(locale, messages) {
     return async function loginAction(_prevState, formData) {
         requireFirebaseAuthConfig(config.firebaseAuth);
         const { auth } = await getFirebaseAuthClient();
-        const { signInWithEmailAndPassword } = await import('firebase/auth');
+        const { signInWithEmailAndPassword } = await getFirebaseAuthModule();
         const { email, password } = readCredentials(formData);
         try {
             await signInWithEmailAndPassword(auth, email, password);
@@ -57,7 +57,7 @@ export function createSignUpAction(locale, messages) {
     return async function signUpAction(_prevState, formData) {
         requireFirebaseAuthConfig(config.firebaseAuth);
         const { auth } = await getFirebaseAuthClient();
-        const { createUserWithEmailAndPassword } = await import('firebase/auth');
+        const { createUserWithEmailAndPassword } = await getFirebaseAuthModule();
         const { email, password } = readCredentials(formData);
         const confirmPassword = (formData.get('confirmPassword')?.toString() ?? '').trim();
         if (messages.mismatch && password !== confirmPassword) {
@@ -89,7 +89,7 @@ export function createForgotPasswordAction(locale, messages) {
     return async function forgotPasswordAction(_prevState, formData) {
         requireFirebaseAuthConfig(config.firebaseAuth);
         const { auth } = await getFirebaseAuthClient();
-        const { sendPasswordResetEmail } = await import('firebase/auth');
+        const { sendPasswordResetEmail } = await getFirebaseAuthModule();
         const email = (formData.get('email')?.toString() ?? '').trim();
         try {
             await sendPasswordResetEmail(auth, email);

package/dist/src/firebase_auth/client/auth_user_provider.js

@@ -5,18 +5,19 @@ import { useRouter } from 'next/navigation';
 import usePathname from '../../client/hooks/use_path_name';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { getFirebaseAuthClient } from './firebase_client';
+import { getFirebaseAuthClient, getFirebaseAuthModule } from './firebase_client';
 import { setAuthUserCache } from './auth_user_cache';
-import { sessionCookieName } from '../middleware/update_session';
+import { defaultSessionCookieName } from '../middleware/update_session';
+import setCookie from '../../client/functions/set_cookie';
 // `null` default (instead of a `{ loading: true, ... }` stand-in) lets
 // `useAuthUser` distinguish "not wrapped in AuthUserProvider" (throw) from
 // "wrapped, still loading" (`loading: true`).
 export const AuthUserContext = createContext(null);
-function writeSessionCookie(idToken, maxAge) {
-    document.cookie = `${sessionCookieName}=${idToken}; path=/; max-age=${maxAge}`;
+function writeSessionCookie(sessionCookieName, idToken, maxAge) {
+    setCookie({ name: sessionCookieName, value: idToken, maxAge });
 }
-function clearSessionCookie() {
-    document.cookie = `${sessionCookieName}=; path=/; max-age=0`;
+function clearSessionCookie(sessionCookieName) {
+    setCookie({ name: sessionCookieName, value: '', maxAge: 0 });
 }
 /**
  * Client-side auth-state provider for `firebase_auth`. Wrap your root layout
@@ -44,11 +45,20 @@ export default function AuthUserProvider({ initialUser = null, children }) {
     const isAuthPage = fa.isAuthPath(pathname);
     const isWhiteListed = fa.whiteListPaths?.includes(pathname) ?? false;
     const maxAge = fa.sessionCookieMaxAge ?? 60 * 60 * 24 * 5;
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const [state, setState] = useState({
         user: initialUser,
         loading: initialUser === null,
     });
+    // The signed-in state the last successful cookie write left behind, so a
+    // plain token refresh (same state) does not trigger a needless re-render.
     const syncedSignedIn = useRef(undefined);
+    // Consecutive `onIdTokenChanged(null)` callbacks since the last confirmed
+    // user. A single null here can be a transient client-SDK hiccup (e.g. its
+    // token-refresh scheduling misbehaving under local clock skew) rather
+    // than a real sign-out — the server already proved the session valid via
+    // `initialUser`, so redirecting on the very first null caused a
+    // login-then-bounce-home flash whenever the two disagreed.
     const consecutiveNulls = useRef(0);
     const [confirmedSignedOut, setConfirmedSignedOut] = useState(initialUser === null);
     useEffect(() => {
@@ -70,16 +80,16 @@ export default function AuthUserProvider({ initialUser = null, children }) {
         getFirebaseAuthClient().then(async ({ auth }) => {
             if (cancelled)
                 return;
-            const { onIdTokenChanged } = await import('firebase/auth');
+            const { onIdTokenChanged } = await getFirebaseAuthModule();
             unsubscribe = onIdTokenChanged(auth, async (user) => {
                 const isSignedIn = !!user;
                 const previous = syncedSignedIn.current;
                 try {
                     if (user) {
-                        writeSessionCookie(await user.getIdToken(true), maxAge);
+                        writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
                     }
                     else if (previous) {
-                        clearSessionCookie();
+                        clearSessionCookie(sessionCookieName);
                     }
                 }
                 catch (e) {
@@ -112,37 +122,42 @@ export default function AuthUserProvider({ initialUser = null, children }) {
             unsubscribe?.();
         };
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [router, isAuthPage, maxAge]);
+    }, [router, isAuthPage, maxAge, sessionCookieName]);
     const reloadUser = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
         if (!user)
             return;
-        const { reload } = await import('firebase/auth');
-        await reload(user);
-        writeSessionCookie(await user.getIdToken(true), maxAge);
-        setAuthUserCache(user);
-        setState({ user, loading: false });
-    }, [maxAge]);
+        try {
+            const { reload } = await getFirebaseAuthModule();
+            await reload(user);
+            writeSessionCookie(sessionCookieName, await user.getIdToken(true), maxAge);
+            setAuthUserCache(user);
+            setState({ user, loading: false });
+        }
+        catch (e) {
+            console.error('AuthUserProvider: reloadUser failed', e);
+        }
+    }, []);
     const sendVerificationEmail = useCallback(async () => {
         const { auth } = await getFirebaseAuthClient();
         const user = auth.currentUser;
         if (!user)
             return;
-        const { sendEmailVerification } = await import('firebase/auth');
+        const { sendEmailVerification } = await getFirebaseAuthModule();
         await sendEmailVerification(user);
     }, []);
     const logout = useCallback(async () => {
         try {
             const { auth } = await getFirebaseAuthClient();
-            const { signOut } = await import('firebase/auth');
+            const { signOut } = await getFirebaseAuthModule();
             await signOut(auth);
         }
         finally {
-            clearSessionCookie();
+            clearSessionCookie(sessionCookieName);
             window.location.assign(fa.redirectAuthPath);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [fa.redirectAuthPath]);
+    }, [fa.redirectAuthPath, sessionCookieName]);
     return _jsx(AuthUserContext.Provider, { value: { ...state, reloadUser, sendVerificationEmail, logout }, children: children });
 }

package/dist/src/firebase_auth/client/firebase_client.d.ts

@@ -16,3 +16,5 @@ export declare function getFirebaseAuthClientSync(): {
     app: FirebaseApp;
     auth: Auth;
 } | undefined;
+/** Memoized `import('firebase/auth')` — see {@link getFirebaseAuthClient} for why this is worth caching. */
+export declare function getFirebaseAuthModule(): Promise<typeof import('firebase/auth')>;

package/dist/src/firebase_auth/client/firebase_client.js

@@ -38,3 +38,11 @@ export async function getFirebaseAuthClient() {
 export function getFirebaseAuthClientSync() {
     return cached;
 }
+let cachedAuthModule;
+/** Memoized `import('firebase/auth')` — see {@link getFirebaseAuthClient} for why this is worth caching. */
+export function getFirebaseAuthModule() {
+    if (!cachedAuthModule) {
+        cachedAuthModule = import('firebase/auth');
+    }
+    return cachedAuthModule;
+}

package/dist/src/firebase_auth/error_messages/firebase_auth_error_helper.js

@@ -1,5 +1,5 @@
 import { getTranslationsImpl } from '../../general/general_functions';
-import { getMessageCache } from '../../general/cache_variables';
+import { getMessageCache, getTranslationCache } from '../../general/cache_variables';
 import { DEFAULT_MESSAGES_EN } from './default_messages.en';
 const ERROR_CODE_TO_KEY = {
     'auth/invalid-email': 'invalidEmail',
@@ -29,7 +29,8 @@ export default function firebaseAuthErrorMessage(locale, error) {
     const messages = getMessageCache(locale);
     if (messages) {
         try {
-            const t = getTranslationsImpl(locale, messages, 'firebaseAuth');
+            const cacheKey = `${locale}-firebaseAuth`;
+            const t = getTranslationCache(cacheKey) ?? getTranslationsImpl(locale, messages, 'firebaseAuth', cacheKey);
             const translated = t(key);
             if (typeof translated === 'string' && translated !== key)
                 return translated;

package/dist/src/firebase_auth/index.d.ts

@@ -3,7 +3,7 @@ export { default as FirebaseAuthServerProvider } from './server/auth_user_server
 export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
 export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
 export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
-export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { default as updateFirebaseAuthSession, defaultSessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
 export { getFirebaseAuthClient } from './client/firebase_client';
 export type { SerializedAuthUser, AuthFormState, AuthActionMessages, AuthUser } from './types';
 export type { FirebaseAuthRoutingConfig } from '../types/types';

package/dist/src/firebase_auth/index.js

@@ -9,5 +9,5 @@ export { default as FirebaseAuthServerProvider } from './server/auth_user_server
 export { default as useFirebaseAuthUserClient } from './client/use_auth_user';
 export { default as useFirebaseAuthUserServer } from './server/use_auth_user_server';
 export { createLoginAction, createSignUpAction, createForgotPasswordAction } from './client/auth_actions';
-export { default as updateFirebaseAuthSession, sessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
+export { default as updateFirebaseAuthSession, defaultSessionCookieName as firebaseAuthSessionCookieName } from './middleware/update_session';
 export { getFirebaseAuthClient } from './client/firebase_client';

package/dist/src/firebase_auth/middleware/update_session.d.ts

@@ -1,6 +1,6 @@
 import { NextResponse, type NextRequest } from 'next/server';
-export declare const sessionCookieName = "__fa_session__";
-export declare const refreshTokenCookieName = "__fa_refresh_token__";
+export declare const defaultSessionCookieName = "__fa_session__";
+export declare const defaultRefreshTokenCookieName = "__fa_refresh_token__";
 /**
  * Layers Firebase session-cookie validation/refresh and auth redirects onto
  * an already-built middleware response. Called internally by `intlMiddleware`

package/dist/src/firebase_auth/middleware/update_session.js

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server';
 import config from '@intl-config';
-export const sessionCookieName = '__fa_session__';
-export const refreshTokenCookieName = '__fa_refresh_token__';
+export const defaultSessionCookieName = '__fa_session__';
+export const defaultRefreshTokenCookieName = '__fa_refresh_token__';
 const DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 5;
 const DEFAULT_REFRESH_MAX_AGE = 60 * 60 * 24 * 365;
 // Refresh slightly before the real expiry — treating a token as expired
@@ -77,6 +77,21 @@ async function setCachedRefresh(refreshToken, refreshed) {
         // refresh result already returned to the caller.
     }
 }
+// Google's Secure Token API returns 400 with one of these error codes when
+// the refresh token itself is the problem (expired/revoked/malformed/the
+// associated user no longer exists) — this is the ONLY case that should
+// sign the user out. Any other failure (5xx, network error, timeout,
+// unrecognized 400 body) is transient/unexpected and must NOT clear the
+// refresh-token cookie or redirect to login: doing so previously caused a
+// signed-in user with a perfectly valid refresh token to flash to /login
+// and bounce back home the moment their ID token merely expired and a
+// single refresh attempt happened to fail.
+const INVALID_REFRESH_TOKEN_ERRORS = new Set([
+    'INVALID_REFRESH_TOKEN',
+    'TOKEN_EXPIRED',
+    'USER_DISABLED',
+    'USER_NOT_FOUND',
+]);
 /**
  * Mints a fresh ID token from a stored refresh token via Google's Secure
  * Token API. No `firebase/auth` import: this runs in the Edge middleware
@@ -86,15 +101,28 @@ async function setCachedRefresh(refreshToken, refreshed) {
 async function refreshIdToken(apiKey, refreshToken) {
     const cached = await getCachedRefresh(refreshToken);
     if (cached)
-        return cached;
+        return { status: 'refreshed', ...cached };
     try {
         const res = await fetch(`https://securetoken.googleapis.com/v1/token?key=${apiKey}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
         });
-        if (!res.ok)
-            return null;
+        if (!res.ok) {
+            if (res.status === 400) {
+                try {
+                    const errorBody = await res.json();
+                    if (errorBody.error?.message && INVALID_REFRESH_TOKEN_ERRORS.has(errorBody.error.message)) {
+                        return { status: 'invalid' };
+                    }
+                }
+                catch {
+                    // Unparseable body on a 400 — treat as transient rather
+                    // than assuming the token is invalid.
+                }
+            }
+            return { status: 'transient-failure' };
+        }
         const data = await res.json();
         const refreshed = { idToken: data.id_token, refreshToken: data.refresh_token };
         // Not awaited: the cache write is a pure optimization for FUTURE
@@ -103,10 +131,10 @@ async function refreshIdToken(apiKey, refreshToken) {
         // setCachedRefresh already swallows its own errors, so a rejected
         // write here would otherwise surface as an unhandled rejection.
         void setCachedRefresh(refreshToken, refreshed);
-        return refreshed;
+        return { status: 'refreshed', ...refreshed };
     }
     catch {
-        return null;
+        return { status: 'transient-failure' };
     }
 }
 /**
@@ -131,6 +159,8 @@ export default async function updateSession(request, baseResponse, locale) {
     const fa = config.firebaseAuth;
     if (!fa || fa.middlewareEnabled === false)
         return baseResponse;
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
+    const refreshTokenCookieName = fa.refreshTokenCookieName ?? defaultRefreshTokenCookieName;
     const rawPath = request.nextUrl.pathname;
     const requestPrefix = `/${locale}`;
     const path = rawPath === requestPrefix || rawPath.startsWith(`${requestPrefix}/`)
@@ -149,19 +179,30 @@ export default async function updateSession(request, baseResponse, locale) {
     let token = request.cookies.get(sessionCookieName)?.value;
     let refreshedToken = null;
     let clearInvalidSession = false;
+    // A transient refresh failure (network blip, Google 5xx, timeout) means
+    // "couldn't confirm the session right now" — NOT "this user is signed
+    // out". Redirecting to login in that case is the bug this guards
+    // against: it signs a still-valid user out for a one-off hiccup, and
+    // the client SDK (which still has a live session independent of these
+    // cookies) then bounces them straight back, producing a login flash.
+    let refreshWasTransientFailure = false;
     if (token && isJwtExpired(token)) {
         token = undefined;
     }
     if (!token) {
         const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
         if (refreshToken) {
-            refreshedToken = await refreshIdToken(fa.apiKey, refreshToken);
-            if (refreshedToken) {
+            const result = await refreshIdToken(fa.apiKey, refreshToken);
+            if (result.status === 'refreshed') {
+                refreshedToken = { idToken: result.idToken, refreshToken: result.refreshToken };
                 token = refreshedToken.idToken;
             }
-            else {
+            else if (result.status === 'invalid') {
                 clearInvalidSession = true;
             }
+            else {
+                refreshWasTransientFailure = true;
+            }
         }
         else if (request.cookies.get(sessionCookieName)) {
             clearInvalidSession = true;
@@ -169,7 +210,14 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     const hasSession = !!token;
     let response;
-    if (!hasSession) {
+    if (refreshWasTransientFailure) {
+        // Couldn't confirm the session either way — pass through without
+        // forcing a redirect in either direction. The next request (or the
+        // client SDK's own session, independent of these cookies) gets a
+        // chance to resolve this correctly instead of guessing wrong.
+        response = baseResponse;
+    }
+    else if (!hasSession) {
         response = isAuthPage ? baseResponse : buildRedirect(baseResponse, localeUrl(fa.redirectAuthPath));
     }
     else if (isAuthPage) {
@@ -184,11 +232,7 @@ export default async function updateSession(request, baseResponse, locale) {
     }
     if (refreshedToken) {
         response.cookies.set(sessionCookieName, refreshedToken.idToken, {
-            // Not httpOnly: the client provider also writes this cookie
-            // directly (via document.cookie) after `getIdToken(true)`, so it
-            // must stay client-writable — a JS cookie write can never carry
-            // httpOnly anyway, and two same-name cookies with conflicting
-            // flags is what actually caused ambiguity here.
+            httpOnly: true,
             secure: request.nextUrl.protocol === 'https',
             sameSite: 'lax',
             path: '/',

package/dist/src/firebase_auth/server/auth_user_server_provider.d.ts

@@ -3,11 +3,16 @@ import type { SerializedAuthUser } from '../types';
  * Resolves the signed-in user from the session cookie and performs the
  * authoritative pre-render redirect (guest→`redirectAuthPath`, signed-in→
  * `homePath` on auth pages) — middleware only checks cookie *presence*, not
- * validity. Plain async function, not a component: callers decide
- * where/how to use the resolved user relative to their own component tree
- * (see `AuthUserServerProvider` below for the simple case, and
- * `IntlProvider`'s auto-wiring for the case where ordering against
- * `LocaleContext` matters).
+ * validity; a forged, expired, or otherwise invalid-but-present cookie
+ * sails through it. Only this function's token validation
+ * (`getAuthenticatedAppForUser`) catches that, so this redirect must happen
+ * here, before any HTML is sent — relying solely on the client
+ * `AuthUserProvider` effect to redirect afterwards produces a visible
+ * flash (page renders signed-in, then bounces). Plain async function, not
+ * a component: callers decide where/how to use the resolved user relative
+ * to their own component tree (see `AuthUserServerProvider` below for the
+ * simple case, and `IntlProvider`'s auto-wiring for the case where ordering
+ * against `LocaleContext` matters).
  */
 export declare function resolveAuthUserAndRedirect(): Promise<SerializedAuthUser | null>;
 /**

package/dist/src/firebase_auth/server/auth_user_server_provider.js

@@ -10,11 +10,16 @@ const AuthUserProvider = dynamic(() => import('../client/auth_user_provider'));
  * Resolves the signed-in user from the session cookie and performs the
  * authoritative pre-render redirect (guest→`redirectAuthPath`, signed-in→
  * `homePath` on auth pages) — middleware only checks cookie *presence*, not
- * validity. Plain async function, not a component: callers decide
- * where/how to use the resolved user relative to their own component tree
- * (see `AuthUserServerProvider` below for the simple case, and
- * `IntlProvider`'s auto-wiring for the case where ordering against
- * `LocaleContext` matters).
+ * validity; a forged, expired, or otherwise invalid-but-present cookie
+ * sails through it. Only this function's token validation
+ * (`getAuthenticatedAppForUser`) catches that, so this redirect must happen
+ * here, before any HTML is sent — relying solely on the client
+ * `AuthUserProvider` effect to redirect afterwards produces a visible
+ * flash (page renders signed-in, then bounces). Plain async function, not
+ * a component: callers decide where/how to use the resolved user relative
+ * to their own component tree (see `AuthUserServerProvider` below for the
+ * simple case, and `IntlProvider`'s auto-wiring for the case where ordering
+ * against `LocaleContext` matters).
  */
 export async function resolveAuthUserAndRedirect() {
     const fa = config.firebaseAuth;

package/dist/src/firebase_auth/server/firebase_server.js

@@ -2,8 +2,10 @@ import { cookies } from 'next/headers';
 import { cache } from 'react';
 import config from '@intl-config';
 import requireFirebaseAuthConfig from '../require_config';
-import { sessionCookieName } from '../middleware/update_session';
+import { defaultSessionCookieName } from '../middleware/update_session';
 let baseApp;
+let firebaseAppModule;
+let firebaseAuthModule;
 /**
  * Resolves the signed-in user on the server from the session cookie.
  * `initializeServerApp` validates the token with the Auth service, so a
@@ -16,13 +18,18 @@ let baseApp;
 export const getAuthenticatedAppForUser = cache(async function getAuthenticatedAppForUser() {
     const fa = config.firebaseAuth;
     requireFirebaseAuthConfig(fa);
+    const sessionCookieName = fa.sessionCookieName ?? defaultSessionCookieName;
     const authIdToken = (await cookies()).get(sessionCookieName)?.value;
     if (!authIdToken) {
         return { firebaseServerApp: null, currentUser: null };
     }
     try {
-        const { initializeApp, initializeServerApp } = await import('firebase/app');
-        const { getAuth } = await import('firebase/auth');
+        if (!firebaseAppModule)
+            firebaseAppModule = await import('firebase/app');
+        if (!firebaseAuthModule)
+            firebaseAuthModule = await import('firebase/auth');
+        const { initializeApp, initializeServerApp } = firebaseAppModule;
+        const { getAuth } = firebaseAuthModule;
         const firebaseConfig = {
             apiKey: fa.apiKey,
             authDomain: fa.authDomain,

package/dist/src/server/components/server_provider.js

@@ -5,6 +5,7 @@ import dynamic from "next/dynamic";
 import { localesSet } from "../../config/middleware";
 import config from "../../config/intl_config";
 const LocationzationClientProvider = dynamic(() => import("../../client/components/client_provider"));
+let authUserServerProviderModule;
 /**
  * Server component that provides locale/messages context to the rest of the
  * tree. Exported publicly as `IntlProvider` from `cloudflare-next-intl/serverProvider`.
@@ -47,9 +48,12 @@ export default async function LocationzationProvider({ language, messages, child
     }
     const messagesValue = messages ?? await getMessage(language);
     let initialAuthUser = null;
-    if (config.firebaseAuth) {
-        const { resolveAuthUserAndRedirect } = await import("../../firebase_auth/server/auth_user_server_provider");
-        initialAuthUser = await resolveAuthUserAndRedirect();
+    const autoWireClientProvider = config.firebaseAuth?.autoWireClientProvider !== false;
+    if (config.firebaseAuth && autoWireClientProvider) {
+        if (!authUserServerProviderModule) {
+            authUserServerProviderModule = await import("../../firebase_auth/server/auth_user_server_provider");
+        }
+        initialAuthUser = await authUserServerProviderModule.resolveAuthUserAndRedirect();
     }
-    return _jsx(LocationzationClientProvider, { language: language, messages: messagesValue, initialAuthUser: initialAuthUser, children: children });
+    return _jsx(LocationzationClientProvider, { language: language, messages: messagesValue, initialAuthUser: initialAuthUser, skipAuthProvider: !autoWireClientProvider, children: children });
 }

package/dist/src/server/functions/server.js

@@ -5,6 +5,7 @@ import { getLocaleCache, getMessageCache, getTranslationCache, setLocaleCache, s
 import { cache } from "react";
 import { localesSet } from "../../config/middleware";
 const isDev = process.env.NODE_ENV === 'development';
+let nextHeadersModule;
 /**
  * Loads and caches messages for a specific locale using dynamic import.
  * Prevents redundant file loads and handles import errors gracefully.
@@ -104,8 +105,10 @@ async function iGetLocale() {
         // Dynamically import "next/headers" only when needed.
         // This ensures it's loaded only on the server where cookies are accessible,
         // preventing client-side import errors and reducing bundle size.
-        const { cookies } = await import("next/headers");
-        const cookieStore = await cookies();
+        if (!nextHeadersModule) {
+            nextHeadersModule = await import("next/headers");
+        }
+        const cookieStore = await nextHeadersModule.cookies();
         const localeCookie = cookieStore.get(localeCookieName);
         // Use the cookie value or fall back to the default locale.
         const localeValue = localeCookie?.value ?? config.defaultLocale;

package/dist/src/types/types.d.ts

@@ -92,6 +92,17 @@ export interface FirebaseAuthRoutingConfig {
      * middleware redirect logic yourself instead.
      */
     middlewareEnabled?: boolean;
+    /**
+     * Whether `IntlProvider` should automatically wrap your app in the
+     * client `AuthUserProvider` and call `resolveAuthUser` server-side.
+     * Defaults to `true`. Set `false` if you drive auth entirely from your
+     * own middleware (like `middlewareEnabled: false`'s manual-override
+     * case, but for the client/RSC layer) and don't want this package
+     * rendering any auth-related React tree on top of it — e.g. if you
+     * only use `intlMiddleware`'s built-in session-refresh/redirect logic
+     * and have no use for `useAuthUser()`/`AuthUserProvider` at all.
+     */
+    autoWireClientProvider?: boolean;
     /** Firebase project's Web API key (`NEXT_PUBLIC_FIREBASE_API_KEY` equivalent). */
     apiKey: string;
     /** Firebase project's auth domain, e.g. "my-app.firebaseapp.com". */
@@ -120,6 +131,10 @@ export interface FirebaseAuthRoutingConfig {
     sessionCookieMaxAge?: number;
     /** Refresh-token cookie max-age in seconds. Defaults to 365 days (31536000). */
     refreshTokenCookieMaxAge?: number;
+    /** Session cookie name. Defaults to `'__fa_session__'`. Override this if your app already uses a different name for its Firebase ID-token cookie. */
+    sessionCookieName?: string;
+    /** Refresh-token cookie name. Defaults to `'__fa_refresh_token__'`. Override this if your app already uses a different name for its Firebase refresh-token cookie. */
+    refreshTokenCookieName?: string;
 }
 export interface CookieAttributes {
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",