cloudflare-next-intl 0.8.40 → 0.8.41

package/README.md

@@ -389,9 +389,10 @@ export default setIntlConfig({
         privacyPolicyDate: "2026-01-01",
         // privacyPolicyPath: "/privacy-policy", // default; used by the
         // dialogs' auto-rendered link. Set false to disable that link.
-        // Optional: gate the banner to GDPR-region visitors only. Omit both
-        // getCountryCode and generate.getCloudflareContext to disable
-        // country-based gating (consent always implicit).
+        // country-based gating is enabled by default (reads Cloudflare geo
+        // headers; override via countryHeaderNames). Visitors outside GDPR
+        // regions skip the banner and get consent immediately.
+        // countryHeaderNames: ["x-cf-country", "cf-ipcountry"],
         // gdprCountries: [...], // defaults to EU/EEA + UK + Switzerland
         // enableAnalyticsInDevMode: true, // analytics stay off in dev otherwise
         // autoWireDialogs: false, // opt out and render the dialogs yourself

package/dist/src/cookie_consent/gdpr_countries.d.ts

@@ -5,4 +5,4 @@ import type { CookieConsentGetCloudflareContext, ErrorHandlingRoutingConfig } fr
  * (nFADP). ISO 3166-1 alpha-2.
  */
 export declare const defaultGdprCountries: readonly string[];
-export default function resolveRequiresConsent(getCountryCode: (() => string | undefined | Promise<string | undefined>) | undefined, getCloudflareContext: CookieConsentGetCloudflareContext | undefined, gdprCountries: readonly string[] | undefined, errorHandlingConfig?: ErrorHandlingRoutingConfig): Promise<boolean>;
+export default function resolveRequiresConsent(getCountryCode: (() => string | undefined | Promise<string | undefined>) | undefined, getCloudflareContext: CookieConsentGetCloudflareContext | undefined, gdprCountries: readonly string[] | undefined, errorHandlingConfig?: ErrorHandlingRoutingConfig, countryHeaderNames?: readonly string[]): Promise<boolean>;

package/dist/src/cookie_consent/gdpr_countries.js

@@ -1,4 +1,5 @@
 import reportError from '../error_handling/report_error';
+import { getCountry } from '../server/functions/geo';
 /**
  * Default `cookieConsent.gdprCountries` — EU/EEA member states (GDPR),
  * Iceland/Liechtenstein/Norway (EEA), the UK (UK-GDPR), and Switzerland
@@ -31,14 +32,12 @@ function getGdprCountriesSet(gdprCountries) {
     }
     return set;
 }
-export default async function resolveRequiresConsent(getCountryCode, getCloudflareContext, gdprCountries, errorHandlingConfig) {
-    if (!getCountryCode && !getCloudflareContext)
-        return true;
+export default async function resolveRequiresConsent(getCountryCode, getCloudflareContext, gdprCountries, errorHandlingConfig, countryHeaderNames) {
     let countryCode;
     if (getCountryCode) {
         countryCode = await getCountryCode();
     }
-    else {
+    else if (getCloudflareContext) {
         try {
             countryCode = (await getCloudflareContext({ async: true }))?.cf?.country;
         }
@@ -47,6 +46,17 @@ export default async function resolveRequiresConsent(getCountryCode, getCloudfla
             return true;
         }
     }
+    // Neither getter supplied (or one resolved nothing): fall back to the
+    // package's own geo resolution, which reads the Cloudflare country
+    // headers off the current request.
+    if (typeof countryCode !== 'string' || !countryCode) {
+        try {
+            countryCode = await getCountry(undefined, undefined, countryHeaderNames);
+        }
+        catch {
+            return true;
+        }
+    }
     if (typeof countryCode !== 'string' || !countryCode)
         return true;
     return getGdprCountriesSet(gdprCountries).has(countryCode);

package/dist/src/server/components/server_provider.js

@@ -144,7 +144,7 @@ export default async function LocationzationProvider({ language, messages, stati
         // `getCloudflareContext` path in dev; fail-safe to `true`
         // (banner shown) same as an unresolved country would.
         requiresConsent = !isDevEnvironment
-            ? await resolveRequiresConsent(config.cookieConsent.getCountryCode, config.generate?.getCloudflareContext, config.cookieConsent.gdprCountries, config.errorHandling)
+            ? await resolveRequiresConsent(config.cookieConsent.getCountryCode, config.generate?.getCloudflareContext, config.cookieConsent.gdprCountries, config.errorHandling, config.cookieConsent.countryHeaderNames)
             : false;
         const analyticsAllowedInEnv = config.cookieConsent.enableAnalyticsInDevMode === true || !isDevEnvironment;
         if (config.cookieConsent.autoWireAnalytics !== false && analyticsAllowedInEnv) {

package/dist/src/server/components/server_provider_static.js

@@ -87,7 +87,7 @@ export default async function LocationzationProvider({ language, messages, child
         // `getCloudflareContext` path in dev; fail-safe to `true`
         // (banner shown) same as an unresolved country would.
         requiresConsent = !isDevEnvironment
-            ? await resolveRequiresConsent(config.cookieConsent.getCountryCode, config.generate?.getCloudflareContext, config.cookieConsent.gdprCountries, config.errorHandling)
+            ? await resolveRequiresConsent(config.cookieConsent.getCountryCode, config.generate?.getCloudflareContext, config.cookieConsent.gdprCountries, config.errorHandling, config.cookieConsent.countryHeaderNames)
             : false;
         const analyticsAllowedInEnv = config.cookieConsent.enableAnalyticsInDevMode === true || !isDevEnvironment;
         if (config.cookieConsent.autoWireAnalytics !== false && analyticsAllowedInEnv) {

package/dist/src/server/functions/geo.d.ts

@@ -1,24 +1,30 @@
 import type { GenerateRoutingConfig, RequestOrHeaders } from '../../types/types';
+/** Default request headers read to resolve the visitor's country, in order. */
+export declare const defaultCountryHeaderNames: readonly string[];
+/** Default request headers read to resolve the visitor's timezone, in order. */
+export declare const defaultTimezoneHeaderNames: readonly string[];
 /**
  * Resolves the client's ISO 3166-1 alpha-2 country code (e.g. "US", "DE", "UA").
  *
  * Checks in order:
  * 1. Explicit `input` (Request, NextRequest, or Headers) if provided
- * 2. Next.js request headers via `headers()` (`x-cf-country`, `cf-ipcountry`)
+ * 2. Next.js request headers via `headers()` (`headerNames`, default
+ *    `x-cf-country`, `cf-ipcountry`)
  * 3. `generate.getCloudflareContext` or `cf.country` if passed
  * 4. `undefined` if outside request scope or unavailable
  */
-export declare function getCountry(input?: RequestOrHeaders, generate?: GenerateRoutingConfig): Promise<string | undefined>;
+export declare function getCountry(input?: RequestOrHeaders, generate?: GenerateRoutingConfig, headerNames?: readonly string[]): Promise<string | undefined>;
 /**
  * Resolves the client's IANA timezone string (e.g. "America/New_York", "Europe/Kyiv", "UTC").
  *
  * Checks in order:
  * 1. Explicit `input` (Request, NextRequest, or Headers) if provided
- * 2. Next.js request headers via `headers()` (`x-cf-timezone`, `cf-timezone`)
+ * 2. Next.js request headers via `headers()` (`headerNames`, default
+ *    `x-cf-timezone`, `cf-timezone`)
  * 3. `generate.getCloudflareContext` or `cf.timezone` if passed
  * 4. `fallback` (or `undefined`) if outside request scope or unavailable
  */
-export declare function getTimezone(input?: RequestOrHeaders, fallback?: string, generate?: GenerateRoutingConfig): Promise<string | undefined>;
+export declare function getTimezone(input?: RequestOrHeaders, fallback?: string, generate?: GenerateRoutingConfig, headerNames?: readonly string[]): Promise<string | undefined>;
 /**
  * Resolves the Cloudflare environment bindings object from `generate.env` or `generate.getCloudflareContext`.
  */

package/dist/src/server/functions/geo.js

@@ -1,3 +1,7 @@
+/** Default request headers read to resolve the visitor's country, in order. */
+export const defaultCountryHeaderNames = ['x-cf-country', 'cf-ipcountry'];
+/** Default request headers read to resolve the visitor's timezone, in order. */
+export const defaultTimezoneHeaderNames = ['x-cf-timezone', 'cf-timezone'];
 function extractHeader(h, name) {
     if (typeof h.get === 'function') {
         const val = h.get(name);
@@ -7,24 +11,49 @@ function extractHeader(h, name) {
     const val = rec[name] ?? rec[name.toLowerCase()];
     return (typeof val === 'string' && val.length > 0) ? val : undefined;
 }
+// Read lazily (and tolerantly): `@intl-config` may not be set at all in
+// standalone/unit usage of these helpers, and importing the config eagerly
+// would risk a cycle with a config module that itself imports from here.
+async function configuredHeaderNames(key) {
+    try {
+        const config = (await import('../../config/intl_config')).default;
+        return config?.generate?.[key];
+    }
+    catch {
+        return undefined;
+    }
+}
+function extractFromHeaderNames(h, headerNames) {
+    for (const name of headerNames) {
+        const val = extractHeader(h, name);
+        if (val)
+            return val;
+    }
+    return undefined;
+}
 /**
  * Resolves the client's ISO 3166-1 alpha-2 country code (e.g. "US", "DE", "UA").
  *
  * Checks in order:
  * 1. Explicit `input` (Request, NextRequest, or Headers) if provided
- * 2. Next.js request headers via `headers()` (`x-cf-country`, `cf-ipcountry`)
+ * 2. Next.js request headers via `headers()` (`headerNames`, default
+ *    `x-cf-country`, `cf-ipcountry`)
  * 3. `generate.getCloudflareContext` or `cf.country` if passed
  * 4. `undefined` if outside request scope or unavailable
  */
-export async function getCountry(input, generate) {
+export async function getCountry(input, generate, headerNames) {
+    const names = headerNames
+        ?? generate?.countryHeaderNames
+        ?? await configuredHeaderNames('countryHeaderNames')
+        ?? defaultCountryHeaderNames;
     if (input) {
         if ('headers' in input && input.headers) {
-            const country = extractHeader(input.headers, 'x-cf-country') ?? extractHeader(input.headers, 'cf-ipcountry');
+            const country = extractFromHeaderNames(input.headers, names);
             if (country)
                 return country;
         }
         else if (typeof input.get === 'function') {
-            const country = input.get('x-cf-country') ?? input.get('cf-ipcountry') ?? undefined;
+            const country = extractFromHeaderNames(input, names);
             if (country)
                 return country;
         }
@@ -36,7 +65,7 @@ export async function getCountry(input, generate) {
     try {
         const { headers } = await import('next/headers');
         const h = await headers();
-        const country = h.get('x-cf-country') ?? h.get('cf-ipcountry') ?? undefined;
+        const country = extractFromHeaderNames(h, names);
         if (country)
             return country;
     }
@@ -61,19 +90,24 @@ export async function getCountry(input, generate) {
  *
  * Checks in order:
  * 1. Explicit `input` (Request, NextRequest, or Headers) if provided
- * 2. Next.js request headers via `headers()` (`x-cf-timezone`, `cf-timezone`)
+ * 2. Next.js request headers via `headers()` (`headerNames`, default
+ *    `x-cf-timezone`, `cf-timezone`)
  * 3. `generate.getCloudflareContext` or `cf.timezone` if passed
  * 4. `fallback` (or `undefined`) if outside request scope or unavailable
  */
-export async function getTimezone(input, fallback, generate) {
+export async function getTimezone(input, fallback, generate, headerNames) {
+    const names = headerNames
+        ?? generate?.timezoneHeaderNames
+        ?? await configuredHeaderNames('timezoneHeaderNames')
+        ?? defaultTimezoneHeaderNames;
     if (input) {
         if ('headers' in input && input.headers) {
-            const tz = extractHeader(input.headers, 'x-cf-timezone') ?? extractHeader(input.headers, 'cf-timezone');
+            const tz = extractFromHeaderNames(input.headers, names);
             if (tz)
                 return tz;
         }
         else if (typeof input.get === 'function') {
-            const tz = input.get('x-cf-timezone') ?? input.get('cf-timezone') ?? undefined;
+            const tz = extractFromHeaderNames(input, names);
             if (tz)
                 return tz;
         }
@@ -85,7 +119,7 @@ export async function getTimezone(input, fallback, generate) {
     try {
         const { headers } = await import('next/headers');
         const h = await headers();
-        const tz = h.get('x-cf-timezone') ?? h.get('cf-timezone') ?? undefined;
+        const tz = extractFromHeaderNames(h, names);
         if (tz)
             return tz;
     }

package/dist/src/types/types.d.ts

@@ -144,6 +144,19 @@ export interface GenerateRoutingConfig {
      * Set one of the two getters to scope the banner to GDPR regions only.
      */
     getCloudflareContext?: CookieConsentGetCloudflareContext;
+    /**
+     * Request headers read (in order) by `getCountry()` to resolve the
+     * visitor's country. Defaults to `['x-cf-country', 'cf-ipcountry']` —
+     * override when your edge/proxy forwards it under a different name.
+     * `cookieConsent.countryHeaderNames` takes precedence for the
+     * cookie-consent banner's own resolution.
+     */
+    countryHeaderNames?: readonly string[];
+    /**
+     * Request headers read (in order) by `getTimezone()` to resolve the
+     * visitor's IANA timezone. Defaults to `['x-cf-timezone', 'cf-timezone']`.
+     */
+    timezoneHeaderNames?: readonly string[];
 }
 /**
  * Flexible input accepted by `getCountry()` and `getTimezone()`:
@@ -359,14 +372,19 @@ export interface CookieConsentRoutingConfig {
      * over `getCloudflareContext` when both are set.
      */
     getCountryCode?: () => string | undefined | Promise<string | undefined>;
+    /**
+     * Request headers read (in order) to resolve the visitor's country when
+     * neither `getCountryCode` nor `generate.getCloudflareContext` produced
+     * one. Defaults to `['x-cf-country', 'cf-ipcountry']` — override when
+     * your edge/proxy forwards the country under a different name.
+     */
+    countryHeaderNames?: readonly string[];
     /**
      * Country codes (ISO 3166-1 alpha-2) for which the cookie-consent banner
-     * is required. Only consulted when `getCountryCode` or
-     * `generate.getCloudflareContext` is set. Defaults to the EU/EEA + UK +
-     * Switzerland (GDPR/UK-GDPR/nFADP scope). A visitor whose resolved
-     * country isn't in this set is treated as NOT requiring consent; a
-     * country that couldn't be resolved still requires it (fail-safe:
-     * unknown defaults to "ask").
+     * is required. Defaults to the EU/EEA + UK + Switzerland
+     * (GDPR/UK-GDPR/nFADP scope). A visitor whose resolved country isn't in
+     * this set is treated as NOT requiring consent; a country that couldn't
+     * be resolved still requires it (fail-safe: unknown defaults to "ask").
      */
     gdprCountries?: readonly string[];
     /**

package/llms.txt

@@ -11,7 +11,7 @@ other subpath can be used.
 - `.` — everything, re-exported (prefer the flat subpaths below for smaller bundles).
 - `./client` — client-side barrel: `LocaleLink`, `usePathname`, `setCookieClient`, `getCookieClient`.
 - `./server` — server-side barrel: `getMessage`, `getTranslations`, `getLocale`, `getCountry`, `getTimezone`, `resolveEnv`, `IntlProvider`, `Link`, `IntlHelperScript`, `getLocaleStaticParams`.
-- `./geo` / `./getCountry` / `./getTimezone` — country & timezone resolver helpers (`getCountry(input?)`, `getTimezone(input?, fallback?)`, `resolveEnv(generate?)`) for Vinext, OpenNext, and Cloudflare Workers.
+- `./geo` / `./getCountry` / `./getTimezone` — country & timezone resolver helpers (`getCountry(input?, generate?, headerNames?)`, `getTimezone(input?, fallback?, generate?, headerNames?)`, `resolveEnv(generate?)`) for Vinext, OpenNext, and Cloudflare Workers. Custom header names can be configured via `generate.countryHeaderNames`/`generate.timezoneHeaderNames` or passed per-call.
 - `./middleware` — `intlMiddleware` for `middleware.ts`; locale detection/rewrite/redirect and automatic CF header forwarding.
 - `./setIntlConfig` — identity function for typed `RoutingConfig` authoring; use in your `@intl-config` file.
 - `./serverProvider` — `IntlProvider` server component (also under `./server`).
@@ -46,7 +46,7 @@ other subpath can be used.
 - `./CookieConsentDialog` — default cookie-consent banner; accepts per-slot `classNames`/`styles` or a `render` prop for fully custom markup. When `link` is omitted, renders a default link to `cookieConsent.privacyPolicyPath` (defaults to `'/privacy-policy'`; label via `privacyPolicyLinkText`, default `"Privacy Policy"`) — pass `link={null}` for no link, or set `privacyPolicyPath: false` to disable it everywhere.
 - `./PrivacyPolicyUpdateDialog` — "privacy policy updated" banner; auto-enabled only when `cookieConsent.privacyPolicyDate` is set. Same default-link behavior as `CookieConsentDialog` (label default `"Learn more"`).
 - `./cookieConsentAnalytics` — `CookieConsentAnalytics`: gates Cloudflare Web Analytics / Google Ads / Google Analytics / AdSense / Microsoft Clarity behind consent; rendered automatically by `IntlProvider` when `cookieConsent.secrets` or `getSecrets` is set (and `autoWireAnalytics !== false`). Never renders in local dev (`NODE_ENV === 'development'`) unless `cookieConsent.enableAnalyticsInDevMode` is `true`.
-- Country-based gating (`cookieConsent.getCountryCode` / `getCloudflareContext` + `gdprCountries`): resolved server-side by `IntlProvider` into a `requiresConsent` boolean passed to `CookieConsentProvider`. Neither getter set → gating off, consent always implicitly granted. `getCountryCode` (direct country resolver) takes precedence over `getCloudflareContext` (reads `cf.country`) when both are set. `getCloudflareContext` accepts `@opennextjs/cloudflare`'s `getCloudflareContext` function directly (its exact overloaded signature — `CookieConsentGetCloudflareContext`), called internally with `{ async: true }`. Unresolved country (or a `null` context) always requires consent (fail-safe). `./cookieConsent` also exports `defaultGdprCountries` (EU/EEA + UK + Switzerland).
+- Country-based gating (`cookieConsent.countryHeaderNames` / `getCountryCode` / `getCloudflareContext` + `gdprCountries`): resolved server-side by `IntlProvider` into a `requiresConsent` boolean passed to `CookieConsentProvider`. Automatically falls back to request headers (`x-cf-country`, `cf-ipcountry` or custom `countryHeaderNames`) when neither getter is set or when they resolve empty. `getCountryCode` (direct country resolver) takes precedence over `getCloudflareContext` (reads `cf.country`) when both are set. Unresolved country (or a `null` context) always requires consent (fail-safe). `./cookieConsent` also exports `defaultGdprCountries` (EU/EEA + UK + Switzerland).
 
 ## `db*` subpaths (require `db` set on your `RoutingConfig`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.8.40",
+  "version": "0.8.41",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",