next-tongue 0.9.13 → 0.9.15

package/dist/cli/index.js

@@ -32,6 +32,7 @@ export async function runCli(argv) {
             prefix: { type: 'string' },
             export: { type: 'boolean', default: false },
             force: { type: 'boolean', default: false },
+            proxy: { type: 'string' },
             format: { type: 'string' },
             out: { type: 'string' },
             'missing-only': { type: 'boolean', default: false },
@@ -116,11 +117,26 @@ export async function runCli(argv) {
                     process.exitCode = 2;
                     break;
                 }
+                const proxyRaw = typeof values.proxy === 'string' ? values.proxy : undefined;
+                const proxyMode = proxyRaw === 'merge' ||
+                    proxyRaw === 'skip' ||
+                    proxyRaw === 'overwrite'
+                    ? proxyRaw
+                    : undefined;
+                if (proxyRaw != null &&
+                    proxyRaw !== 'merge' &&
+                    proxyRaw !== 'skip' &&
+                    proxyRaw !== 'overwrite') {
+                    console.error(`Invalid --proxy ${JSON.stringify(proxyRaw)} (expected merge|skip|overwrite)`);
+                    process.exitCode = 2;
+                    break;
+                }
                 await cmdInit({
                     ...(typeof values.cwd === 'string' ? { cwd: values.cwd } : {}),
                     ...(typeof values.locales === 'string' ? { locales: values.locales } : {}),
                     ...(typeof values.default === 'string' ? { default: values.default } : {}),
                     ...(prefix ? { prefix } : {}),
+                    ...(proxyMode ? { proxyMode } : {}),
                     export: values.export === true,
                     yes: values.yes === true,
                     force: values.force === true,
@@ -270,7 +286,7 @@ Usage:
   tongue build [--cwd <dir>] [--config <path>] [--json] [--quiet]
   tongue check [--cwd <dir>] [--config <path>] [--locale de] [--reporter pretty|json|github] [--max-warnings N]
   tongue extract [--include app,src] [--placeholder ''] [--prune] [--yes] [--dry-run]
-  tongue init [--locales en,de] [--default en] [--prefix as-needed] [--export] [--yes] [--force] [--dry-run]
+  tongue init [--locales en,de] [--default en] [--prefix as-needed] [--proxy merge|skip|overwrite] [--export] [--yes] [--force] [--dry-run]
   tongue export --format xliff|csv [--locale de] [--out ./translations] [--missing-only]
   tongue import <file.xlf|file.csv> [--dry-run]
   tongue report [--json] [--max-bytes 4kb]

package/dist/cli/init.d.ts

@@ -1,8 +1,11 @@
+export type ProxyMode = 'merge' | 'skip' | 'overwrite';
 export type InitCliOptions = {
     cwd?: string;
     locales?: string;
     default?: string;
     prefix?: 'always' | 'as-needed' | 'never';
+    /** How to treat an existing proxy.ts / middleware.ts. Default: skip. */
+    proxyMode?: ProxyMode;
     export?: boolean;
     yes?: boolean;
     force?: boolean;
@@ -12,8 +15,10 @@ export type InitCliOptions = {
 export declare function cmdInit(opts: InitCliOptions): Promise<void>;
 /** Prefer src/app when present; otherwise app/. */
 export declare function detectAppRoot(cwd: string): Promise<'app' | 'src/app'>;
+/** Where to write a new proxy.ts when none exists. */
+export declare function detectProxyWritePath(appRoot: 'app' | 'src/app'): string;
 /**
  * Where to write proxy.ts. Returns null when the project already has proxy/middleware
- * (caller should compose manually).
+ * (caller should compose or pass `--proxy merge|overwrite`).
  */
 export declare function detectProxyPath(cwd: string, appRoot: 'app' | 'src/app'): Promise<string | null>;

package/dist/cli/init.js

@@ -1,6 +1,7 @@
 import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, join, relative } from 'node:path';
 import * as readline from 'node:readline';
+import { findExistingProxyPath, mergeProxySource, PROXY_CANDIDATES, } from './merge-proxy.js';
 import { resolveInsideProject } from './safe-path.js';
 export async function cmdInit(opts) {
     const cwd = opts.cwd ?? process.cwd();
@@ -36,7 +37,7 @@ export async function cmdInit(opts) {
         console.log(`tongue init: using ${appRoot}/ for App Router files`);
     }
     const hasRootLayout = await hasFile(cwd, `${appRoot}/layout.tsx`, `${appRoot}/layout.ts`, `${appRoot}/layout.jsx`, `${appRoot}/layout.js`);
-    const proxyPath = await detectProxyPath(cwd, appRoot);
+    const existingProxy = await findExistingProxyPath(cwd, (rel) => exists(join(cwd, rel)));
     const plans = [];
     plans.push({
         path: 'tongue.config.ts',
@@ -64,16 +65,55 @@ export default defineConfig({
             content: `${JSON.stringify(sample, null, 2)}\n`,
         });
     }
-    if (proxyPath) {
+    let proxyMode = opts.proxyMode ?? 'skip';
+    if (existingProxy && opts.proxyMode == null && interactive) {
+        const answer = await ask(`Existing ${existingProxy} — merge|skip|overwrite [skip]: `, 'skip');
+        if (answer === 'merge' || answer === 'skip' || answer === 'overwrite') {
+            proxyMode = answer;
+        }
+    }
+    const scaffold = proxyScaffold(locales, defaultLocale, prefix);
+    if (!existingProxy) {
         plans.push({
-            path: proxyPath,
+            path: detectProxyWritePath(appRoot),
             kind: 'create',
-            content: proxyScaffold(locales, defaultLocale, prefix),
+            content: scaffold,
+        });
+    }
+    else if (proxyMode === 'overwrite') {
+        plans.push({
+            path: existingProxy,
+            kind: 'merge',
+            content: scaffold,
         });
     }
+    else if (proxyMode === 'merge') {
+        const abs = join(cwd, existingProxy);
+        const src = await readFile(abs, 'utf8');
+        const merged = mergeProxySource(src, {
+            locales,
+            defaultLocale,
+            prefix,
+        });
+        if (merged.status === 'merged') {
+            plans.push({
+                path: existingProxy,
+                kind: 'merge',
+                content: merged.code,
+            });
+            if (!opts.quiet && merged.note) {
+                console.log(`tongue init: ${merged.note}`);
+            }
+        }
+        else if (!opts.quiet) {
+            console.log(`tongue init: could not merge ${existingProxy} (${merged.reason}). Compose like:\n\n` +
+                scaffold +
+                '\nSee docs/routing-and-proxy.md#composing-with-your-own-proxy-logic.');
+        }
+    }
     else if (!opts.quiet) {
-        console.log('tongue init: existing proxy/middleware detected — do not overwrite. Compose like:\n\n' +
-            proxyScaffold(locales, defaultLocale, prefix) +
+        console.log(`tongue init: existing ${existingProxy} — skipped (pass --proxy merge to wire createProxy, or --proxy overwrite). Compose like:\n\n` +
+            scaffold +
             '\nSee docs/routing-and-proxy.md#composing-with-your-own-proxy-logic / hybrid routing.');
     }
     const layoutPath = `${appRoot}/[locale]/layout.tsx`;
@@ -311,26 +351,20 @@ export async function detectAppRoot(cwd) {
         return 'src/app';
     return 'app';
 }
+/** Where to write a new proxy.ts when none exists. */
+export function detectProxyWritePath(appRoot) {
+    return appRoot.startsWith('src/') ? 'src/proxy.ts' : 'proxy.ts';
+}
 /**
  * Where to write proxy.ts. Returns null when the project already has proxy/middleware
- * (caller should compose manually).
+ * (caller should compose or pass `--proxy merge|overwrite`).
  */
 export async function detectProxyPath(cwd, appRoot) {
-    const existing = [
-        'proxy.ts',
-        'proxy.js',
-        'src/proxy.ts',
-        'src/proxy.js',
-        'middleware.ts',
-        'middleware.js',
-        'src/middleware.ts',
-        'src/middleware.js',
-    ];
-    for (const p of existing) {
+    for (const p of PROXY_CANDIDATES) {
         if (await exists(join(cwd, p)))
             return null;
     }
-    return appRoot.startsWith('src/') ? 'src/proxy.ts' : 'proxy.ts';
+    return detectProxyWritePath(appRoot);
 }
 function wrapNextConfig(src, staticExport) {
     let out = src;

package/dist/cli/merge-proxy.d.ts

@@ -0,0 +1,27 @@
+export type MergeProxyOptions = {
+    locales: readonly string[];
+    defaultLocale: string;
+    prefix: string;
+};
+export type MergeProxyResult = {
+    status: 'unchanged';
+    reason: string;
+    code: string;
+} | {
+    status: 'merged';
+    code: string;
+    note?: string;
+};
+/**
+ * Merge `createProxy({ locales, defaultLocale, prefix })` into an existing
+ * proxy.ts / middleware.ts without wiping user logic.
+ *
+ * - Adds the import + `const tongue = createProxy(...)`.
+ * - Replaces bare `return NextResponse.next()` with `return tongue(<req>)`
+ *   using the handler's first parameter name.
+ * - If already using `createProxy`, leaves the file alone.
+ */
+export declare function mergeProxySource(source: string, opts: MergeProxyOptions): MergeProxyResult;
+export declare const PROXY_CANDIDATES: readonly ["proxy.ts", "proxy.js", "src/proxy.ts", "src/proxy.js", "middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"];
+/** Relative path of an existing proxy/middleware file, or null. */
+export declare function findExistingProxyPath(cwd: string, exists: (rel: string) => Promise<boolean>): Promise<string | null>;

package/dist/cli/merge-proxy.js

@@ -0,0 +1,185 @@
+const CREATE_PROXY_IMPORT = /import\s*\{([^}]*)\}\s*from\s*['"]next-tongue\/proxy['"]/;
+/**
+ * Merge `createProxy({ locales, defaultLocale, prefix })` into an existing
+ * proxy.ts / middleware.ts without wiping user logic.
+ *
+ * - Adds the import + `const tongue = createProxy(...)`.
+ * - Replaces bare `return NextResponse.next()` with `return tongue(<req>)`
+ *   using the handler's first parameter name.
+ * - If already using `createProxy`, leaves the file alone.
+ */
+export function mergeProxySource(source, opts) {
+    if (/\bcreateProxy\s*\(/.test(source)) {
+        return {
+            status: 'unchanged',
+            reason: 'createProxy already present',
+            code: source,
+        };
+    }
+    let code = source.replace(/^\uFEFF/, '');
+    const reqIdent = detectRequestIdent(code) ?? 'req';
+    const tongueIdent = /\btongue\b/.test(code) ? '__tongueProxy' : 'tongue';
+    code = ensureCreateProxyImport(code);
+    code = insertTongueConst(code, tongueIdent, opts);
+    // Only the *last* NextResponse.next() — early returns for /api etc. stay passthrough.
+    const replaced = replaceLastNextReturn(code, tongueIdent, reqIdent);
+    if (replaced) {
+        return {
+            status: 'merged',
+            code: ensureTrailingNewline(replaced),
+            note: `Replaced final NextResponse.next() with ${tongueIdent}(${reqIdent}). ` +
+                `Early next() returns (allow-lists) are kept. ` +
+                `If you stamp CSP/nonce on next(), use createProxy({ wrapResponse }) or mergeProxyResponse — see routing docs.`,
+        };
+    }
+    // No next() — wrap exported handler so user logic runs first, then tongue.
+    const wrapped = wrapExportedHandler(code, tongueIdent, reqIdent);
+    if (wrapped) {
+        return {
+            status: 'merged',
+            code: ensureTrailingNewline(wrapped),
+            note: `Wrapped existing handler: non-passthrough user Response wins (auth/maintenance); ` +
+                `passthrough next() → ${tongueIdent} with mergeProxyResponse (keeps CSP/nonce). ` +
+                `Rewrites to paths under [locale] must include the locale segment.`,
+        };
+    }
+    return {
+        status: 'unchanged',
+        reason: 'could not find NextResponse.next() or an exportable proxy/middleware handler to wrap',
+        code: source,
+    };
+}
+function ensureTrailingNewline(s) {
+    return s.endsWith('\n') ? s : `${s}\n`;
+}
+function ensureCreateProxyImport(code) {
+    if (CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bcreateProxy\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            parts.push('createProxy');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    const importBlock = `import { createProxy } from 'next-tongue/proxy';\n`;
+    // After last import, or at top
+    const lastImport = [...code.matchAll(/^import\s.+;?\s*$/gm)].pop();
+    if (lastImport && lastImport.index != null) {
+        const end = lastImport.index + lastImport[0].length;
+        return code.slice(0, end) + '\n' + importBlock + code.slice(end);
+    }
+    return importBlock + code;
+}
+function insertTongueConst(code, tongueIdent, opts) {
+    if (new RegExp(`\\b(?:const|let|var)\\s+${tongueIdent}\\s*=`).test(code)) {
+        return code;
+    }
+    const decl = `const ${tongueIdent} = createProxy({\n` +
+        `  locales: ${JSON.stringify([...opts.locales])},\n` +
+        `  defaultLocale: ${JSON.stringify(opts.defaultLocale)},\n` +
+        `  prefix: ${JSON.stringify(opts.prefix)},\n` +
+        `});\n`;
+    // Prefer after imports / 'use …' directives
+    const lastImport = [...code.matchAll(/^import\s.+;?\s*$/gm)].pop();
+    if (lastImport && lastImport.index != null) {
+        const end = lastImport.index + lastImport[0].length;
+        return code.slice(0, end) + '\n\n' + decl + code.slice(end);
+    }
+    return decl + '\n' + code;
+}
+function replaceLastNextReturn(code, tongueIdent, reqIdent) {
+    const re = /\breturn\s+NextResponse\.next\s*\(\s*\)\s*;?/g;
+    let last = null;
+    let m;
+    while ((m = re.exec(code)) !== null)
+        last = m;
+    if (!last)
+        return null;
+    return (code.slice(0, last.index) +
+        `return ${tongueIdent}(${reqIdent});` +
+        code.slice(last.index + last[0].length));
+}
+function detectRequestIdent(code) {
+    const m = /export\s+(?:async\s+)?function\s+(?:proxy|middleware)\s*\(\s*([A-Za-z_$][\w$]*)/.exec(code) ??
+        /export\s+const\s+(?:proxy|middleware)\s*=\s*(?:async\s*)?\(\s*([A-Za-z_$][\w$]*)/.exec(code);
+    return m?.[1] ?? null;
+}
+/**
+ * Rename `export function proxy/middleware` → internal, add wrapper that
+ * prefers a non-passthrough user Response then falls back to tongue.
+ */
+function wrapExportedHandler(code, tongueIdent, reqIdent) {
+    const fnRe = /export\s+(async\s+)?function\s+(proxy|middleware)\s*\(/;
+    const m = fnRe.exec(code);
+    if (!m || m.index == null)
+        return null;
+    const asyncKw = m[1] ?? '';
+    const name = m[2];
+    const inner = `__tongue_user_${name}`;
+    let out = code.slice(0, m.index) + `${asyncKw}function ${inner}(` + code.slice(m.index + m[0].length);
+    // Prefer non-passthrough user Response (auth redirect, maintenance rewrite).
+    // Passthrough next() → tongue, then mergeProxyResponse so CSP/nonce on the
+    // user next() are not dropped.
+    out = ensureMergeProxyResponseImport(out);
+    // Outer wrapper is always async — createProxy returns a Promise.
+    out +=
+        `\n\nexport async function ${name}(${reqIdent}: Parameters<typeof ${inner}>[0]) {\n` +
+            `  const __user = ${asyncKw ? 'await ' : ''}${inner}(${reqIdent});\n` +
+            `  if (__user && __user.headers?.get?.('x-middleware-next') !== '1') return __user;\n` +
+            `  const __tongue = await ${tongueIdent}(${reqIdent});\n` +
+            `  return __user ? mergeProxyResponse(__user, __tongue) : __tongue;\n` +
+            `}\n`;
+    return out;
+}
+function ensureMergeProxyResponseImport(code) {
+    if (/\bmergeProxyResponse\b/.test(code) && CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bmergeProxyResponse\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            parts.push('mergeProxyResponse');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    // ensureCreateProxyImport already ran — add mergeProxyResponse to that import
+    if (CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bmergeProxyResponse\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            if (!parts.includes('createProxy'))
+                parts.unshift('createProxy');
+            parts.push('mergeProxyResponse');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    return code;
+}
+export const PROXY_CANDIDATES = [
+    'proxy.ts',
+    'proxy.js',
+    'src/proxy.ts',
+    'src/proxy.js',
+    'middleware.ts',
+    'middleware.js',
+    'src/middleware.ts',
+    'src/middleware.js',
+];
+/** Relative path of an existing proxy/middleware file, or null. */
+export async function findExistingProxyPath(cwd, exists) {
+    for (const p of PROXY_CANDIDATES) {
+        if (await exists(p))
+            return p;
+    }
+    return null;
+}

package/dist/client/index.d.ts

@@ -39,5 +39,7 @@ export declare const defaultLocale: {
 export type { TFunction, Format };
 export type { SanctionedUnit, SimpleUnit, DisplayNameType, } from '../runtime/format.js';
 export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
+/** Isomorphic — safe in client HtmlLang helpers. */
+export { getDir } from '../runtime/locale.js';
 export { translateIssues, defaultFormatPath, } from '../runtime/translate-issues.js';
 export type { TranslateIssue, TranslateIssuesOptions, IssuePathSegment, } from '../runtime/translate-issues.js';

package/dist/client/index.js

@@ -116,4 +116,6 @@ export const defaultLocale = {
     },
 };
 export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
+/** Isomorphic — safe in client HtmlLang helpers. */
+export { getDir } from '../runtime/locale.js';
 export { translateIssues, defaultFormatPath, } from '../runtime/translate-issues.js';

package/dist/compiler/codegen/emit-types.js

@@ -14,6 +14,7 @@ export function emitTypesFile(opts) {
         : 'string';
     return `/* eslint-disable */
 // Generated by next-tongue. Do not edit.
+import type { ReactNode } from 'react';
 declare module 'next-tongue' {
   interface TongueRegister {
     locales: ${localeUnion};
@@ -46,8 +47,8 @@ function argsToType(args) {
             }
             case 'rich':
                 return kind.selfClosing
-                    ? `${JSON.stringify(name)}: () => unknown`
-                    : `${JSON.stringify(name)}: (chunks: unknown) => unknown`;
+                    ? `${JSON.stringify(name)}: () => ReactNode`
+                    : `${JSON.stringify(name)}: (chunks: ReactNode) => ReactNode`;
         }
     });
     return `{ ${fields.join('; ')} }`;

package/dist/navigation/pathname.d.ts

@@ -2,6 +2,8 @@ export type PathnameInput = string | {
     pathname: string;
     params?: Record<string, string | number>;
     query?: Record<string, string | number | undefined>;
+    /** Fragment without requiring `#` (e.g. `'preferences'` or `'#preferences'`). */
+    hash?: string;
 };
 export type GetPathnameArgs = {
     href: PathnameInput;
@@ -15,6 +17,9 @@ export type GetPathnameArgs = {
 };
 /**
  * Build a localized public pathname for links, redirects, and sitemaps.
+ * Query strings and hashes are preserved (stripped before pathnames/prefix,
+ * reattached after). Prefer the object form for typed `pathnames` unions:
+ * `{ pathname: '/dashboard', query: { demo: 1 }, hash: 'prefs' }`.
  */
 export declare function getPathname(args: GetPathnameArgs): string;
 /** Strip a leading locale segment from a pathname. */
@@ -24,3 +29,9 @@ export declare function stripLocalePrefix(pathname: string, locales: readonly st
  * used in `routing.pathnames` (e.g. `/ueber-uns` → `/about` for `de`).
  */
 export declare function toInternalPathname(pathname: string, locale: string, pathnames?: Record<string, Partial<Record<string, string>>>): string;
+/** Split `/path?q=1#hash` into parts (pathnames lookup needs the path alone). */
+export declare function splitPathSearchHash(full: string): {
+    pathname: string;
+    search: string;
+    hash: string;
+};

package/dist/navigation/pathname.js

@@ -1,23 +1,29 @@
 /**
  * Build a localized public pathname for links, redirects, and sitemaps.
+ * Query strings and hashes are preserved (stripped before pathnames/prefix,
+ * reattached after). Prefer the object form for typed `pathnames` unions:
+ * `{ pathname: '/dashboard', query: { demo: 1 }, hash: 'prefs' }`.
  */
 export function getPathname(args) {
     const { href, locale, prefix = 'as-needed', defaultLocale = 'en', pathnames, } = args;
-    let path = resolveHref(href);
+    const { pathname: rawPath, search, hash } = resolveHref(href);
+    let path = rawPath;
     if (pathnames) {
         const localized = pathnames[path]?.[locale];
         if (localized)
             path = localized;
     }
-    if (prefix === 'never')
-        return path;
+    if (prefix === 'never') {
+        return path + search + hash;
+    }
     if (prefix === 'as-needed' && locale === defaultLocale) {
-        return path;
+        return path + search + hash;
     }
     // always, or as-needed for non-default
-    if (path === '/')
-        return `/${locale}`;
-    return `/${locale}${path.startsWith('/') ? path : `/${path}`}`;
+    if (path === '/') {
+        return `/${locale}` + search + hash;
+    }
+    return (`/${locale}${path.startsWith('/') ? path : `/${path}`}` + search + hash);
 }
 /** Strip a leading locale segment from a pathname. */
 export function stripLocalePrefix(pathname, locales) {
@@ -43,14 +49,21 @@ export function toInternalPathname(pathname, locale, pathnames) {
     return pathname;
 }
 function resolveHref(href) {
-    if (typeof href === 'string')
-        return href.startsWith('/') ? href : `/${href}`;
-    let path = href.pathname.startsWith('/') ? href.pathname : `/${href.pathname}`;
+    if (typeof href === 'string') {
+        return splitPathSearchHash(href.startsWith('/') ? href : `/${href}`);
+    }
+    let path = href.pathname.startsWith('/')
+        ? href.pathname
+        : `/${href.pathname}`;
+    // Object pathname should be path-only; tolerate accidental ?/#.
+    const split = splitPathSearchHash(path);
+    path = split.pathname;
     if (href.params) {
         for (const [key, value] of Object.entries(href.params)) {
             path = path.replace(`[${key}]`, encodeURIComponent(String(value)));
         }
     }
+    let search = split.search;
     if (href.query) {
         const qs = new URLSearchParams();
         for (const [key, value] of Object.entries(href.query)) {
@@ -58,8 +71,28 @@ function resolveHref(href) {
                 qs.set(key, String(value));
         }
         const s = qs.toString();
-        if (s)
-            path += `?${s}`;
+        search = s ? `?${s}` : '';
+    }
+    let hash = split.hash;
+    if (href.hash != null && href.hash !== '') {
+        hash = href.hash.startsWith('#') ? href.hash : `#${href.hash}`;
+    }
+    return { pathname: path, search, hash };
+}
+/** Split `/path?q=1#hash` into parts (pathnames lookup needs the path alone). */
+export function splitPathSearchHash(full) {
+    let path = full;
+    let hash = '';
+    let search = '';
+    const hashIdx = path.indexOf('#');
+    if (hashIdx >= 0) {
+        hash = path.slice(hashIdx);
+        path = path.slice(0, hashIdx);
+    }
+    const qIdx = path.indexOf('?');
+    if (qIdx >= 0) {
+        search = path.slice(qIdx);
+        path = path.slice(0, qIdx);
     }
-    return path;
+    return { pathname: path || '/', search, hash };
 }

package/dist/proxy/index.d.ts

@@ -47,6 +47,12 @@ export type CreateProxyOptions = {
     /** Override detection (domain → cookie → Accept-Language → default). */
     resolveLocale?: (req: TongueProxyRequest) => string | undefined | Promise<string | undefined>;
     onLocale?: (locale: string, req: TongueProxyRequest) => void;
+    /**
+     * Post-process every tongue response (redirect / rewrite / next).
+     * Use to re-stamp CSP / nonce headers after locale routing — tongue does
+     * not preserve headers from a prior `NextResponse.next()`.
+     */
+    wrapResponse?: (res: Response, req: TongueProxyRequest) => Response | Promise<Response>;
 };
 /** Default locale cookie name (`SameSite=Lax`). Use with `requestLocale` in API routes. */
 export declare const LOCALE_COOKIE_NAME = "TONGUE_LOCALE";
@@ -57,6 +63,15 @@ export declare const LOCALE_COOKIE_NAME = "TONGUE_LOCALE";
  * @see docs/routing-and-proxy.md
  */
 export declare function createProxy(options: CreateProxyOptions): (req: TongueProxyRequest) => Response | Promise<Response>;
+/**
+ * Copy response headers from a prior `NextResponse.next()` (CSP, nonce, …)
+ * onto a tongue rewrite/redirect/next response. Skips middleware control
+ * headers (`x-middleware-*`, `Location` when tongue already set one).
+ *
+ * Use when you stamp headers on `next()` then call tongue — tongue alone
+ * cannot see those headers.
+ */
+export declare function mergeProxyResponse(prior: Response, tongue: Response): Response;
 /** Map internal path → localized public path for a locale. */
 export declare function publicPathForLocale(internal: string, locale: string, pathnames?: Record<string, Partial<Record<string, string>>>): string;
 /** Resolve `Host` / `x-forwarded-host` against `routing.domains`. */

package/dist/proxy/index.js

@@ -37,78 +37,125 @@ export function createProxy(options) {
     if (!localeSet.has(defaultLocale)) {
         throw new Error(`[next-tongue] createProxy: defaultLocale "${defaultLocale}" is not in locales`);
     }
+    const wrap = options.wrapResponse;
     return async (req) => {
-        const { pathname } = req.nextUrl;
-        const https = isHttpsRequest(req);
-        if (isUnsafePath(pathname)) {
-            return passthrough(cookieCfg, null, https);
-        }
-        const domain = matchDomain(req, domains);
-        const activeLocales = domain?.locales ? [...domain.locales] : locales;
-        const activeDefault = domain?.defaultLocale ?? defaultLocale;
-        const activeSet = new Set(activeLocales);
-        const activeMatcher = activeLocales.length === locales.length
-            ? detectionMatcher
-            : createLocaleMatcher(activeLocales.filter((l) => !excludeDetection.has(l)));
-        const matched = matchLocalePrefix(pathname, localeSet);
-        if (matched && (!domain || activeSet.has(matched.locale))) {
-            const { locale, rest } = matched;
-            const publicRest = rest === '' ? '/' : rest;
-            const internal = toInternalPathname(publicRest, locale, pathnames);
-            if (prefix === 'as-needed' && locale === activeDefault) {
-                // Canonicalize default-locale URLs without the prefix.
-                const dest = publicPathForLocale(internal, locale, pathnames);
-                const redirectUrl = req.nextUrl.clone();
-                redirectUrl.pathname = dest;
-                options.onLocale?.(locale, req);
-                return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
-            }
+        const res = await handleProxyRequest(req, {
+            locales,
+            defaultLocale,
+            prefix,
+            localeDetection,
+            pathnames,
+            domains,
+            cookieCfg,
+            excludeDetection,
+            localeSet,
+            detectionMatcher,
+            options,
+        });
+        return wrap ? await wrap(res, req) : res;
+    };
+}
+async function handleProxyRequest(req, ctx) {
+    const { locales, defaultLocale, prefix, localeDetection, pathnames, domains, cookieCfg, excludeDetection, localeSet, detectionMatcher, options, } = ctx;
+    const { pathname } = req.nextUrl;
+    const https = isHttpsRequest(req);
+    if (isUnsafePath(pathname)) {
+        return passthrough(cookieCfg, null, https);
+    }
+    const domain = matchDomain(req, domains);
+    const activeLocales = domain?.locales ? [...domain.locales] : locales;
+    const activeDefault = domain?.defaultLocale ?? defaultLocale;
+    const activeSet = new Set(activeLocales);
+    const activeMatcher = activeLocales.length === locales.length
+        ? detectionMatcher
+        : createLocaleMatcher(activeLocales.filter((l) => !excludeDetection.has(l)));
+    const matched = matchLocalePrefix(pathname, localeSet);
+    if (matched && (!domain || activeSet.has(matched.locale))) {
+        const { locale, rest } = matched;
+        const publicRest = rest === '' ? '/' : rest;
+        const internal = toInternalPathname(publicRest, locale, pathnames);
+        if (prefix === 'as-needed' && locale === activeDefault) {
+            // Canonicalize default-locale URLs without the prefix.
+            const dest = publicPathForLocale(internal, locale, pathnames);
+            const redirectUrl = req.nextUrl.clone();
+            redirectUrl.pathname = dest;
             options.onLocale?.(locale, req);
-            if (internal !== publicRest) {
-                const url = req.nextUrl.clone();
-                url.pathname = joinLocalePath(locale, internal);
-                return rewriteResponse(url.toString(), cookieCfg, locale, https);
-            }
-            return passthrough(cookieCfg, locale, https);
+            return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
         }
-        const resolved = options.resolveLocale
-            ? await options.resolveLocale(req)
-            : undefined;
-        let locale = sanitizeLocale(resolved, activeLocales) ??
-            (localeDetection
-                ? detectLocale(req, activeLocales, activeDefault, cookieCfg, excludeDetection, activeMatcher, domain)
-                : activeDefault);
-        locale = sanitizeLocale(locale, activeLocales) ?? activeDefault;
         options.onLocale?.(locale, req);
-        const internal = toInternalPathname(pathname, locale, pathnames);
-        // Prefer localized public path when the user hit the internal key.
-        const publicPath = publicPathForLocale(internal, locale, pathnames);
-        if (prefix === 'never') {
+        if (internal !== publicRest) {
             const url = req.nextUrl.clone();
             url.pathname = joinLocalePath(locale, internal);
             return rewriteResponse(url.toString(), cookieCfg, locale, https);
         }
-        if (prefix === 'as-needed' && locale === activeDefault) {
-            // Serve default locale without prefix; rewrite to internal app path.
-            if (pathname !== publicPath && pathnames) {
-                // User visited internal `/about` but public is also `/about` — fine.
-                // If they somehow differ for default locale, redirect to public.
-                if (publicPath !== internal && pathname === internal) {
-                    const redirectUrl = req.nextUrl.clone();
-                    redirectUrl.pathname = publicPath;
-                    return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
-                }
+        return passthrough(cookieCfg, locale, https);
+    }
+    const resolved = options.resolveLocale
+        ? await options.resolveLocale(req)
+        : undefined;
+    let locale = sanitizeLocale(resolved, activeLocales) ??
+        (localeDetection
+            ? detectLocale(req, activeLocales, activeDefault, cookieCfg, excludeDetection, activeMatcher, domain)
+            : activeDefault);
+    locale = sanitizeLocale(locale, activeLocales) ?? activeDefault;
+    options.onLocale?.(locale, req);
+    const internal = toInternalPathname(pathname, locale, pathnames);
+    // Prefer localized public path when the user hit the internal key.
+    const publicPath = publicPathForLocale(internal, locale, pathnames);
+    if (prefix === 'never') {
+        const url = req.nextUrl.clone();
+        url.pathname = joinLocalePath(locale, internal);
+        return rewriteResponse(url.toString(), cookieCfg, locale, https);
+    }
+    if (prefix === 'as-needed' && locale === activeDefault) {
+        // Serve default locale without prefix; rewrite to internal app path.
+        if (pathname !== publicPath && pathnames) {
+            // User visited internal `/about` but public is also `/about` — fine.
+            // If they somehow differ for default locale, redirect to public.
+            if (publicPath !== internal && pathname === internal) {
+                const redirectUrl = req.nextUrl.clone();
+                redirectUrl.pathname = publicPath;
+                return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
             }
-            const url = req.nextUrl.clone();
-            url.pathname = joinLocalePath(activeDefault, internal);
-            return rewriteResponse(url.toString(), cookieCfg, locale, https);
         }
-        // Non-default (or always): redirect to prefixed localized public URL.
-        const destPublic = publicPathForLocale(internal, locale, pathnames);
         const url = req.nextUrl.clone();
-        url.pathname = joinLocalePath(locale, destPublic);
-        return redirectResponse(url.toString(), 307, cookieCfg, locale, https);
-    };
+        url.pathname = joinLocalePath(activeDefault, internal);
+        return rewriteResponse(url.toString(), cookieCfg, locale, https);
+    }
+    // Non-default (or always): redirect to prefixed localized public URL.
+    const destPublic = publicPathForLocale(internal, locale, pathnames);
+    const url = req.nextUrl.clone();
+    url.pathname = joinLocalePath(locale, destPublic);
+    return redirectResponse(url.toString(), 307, cookieCfg, locale, https);
+}
+/**
+ * Copy response headers from a prior `NextResponse.next()` (CSP, nonce, …)
+ * onto a tongue rewrite/redirect/next response. Skips middleware control
+ * headers (`x-middleware-*`, `Location` when tongue already set one).
+ *
+ * Use when you stamp headers on `next()` then call tongue — tongue alone
+ * cannot see those headers.
+ */
+export function mergeProxyResponse(prior, tongue) {
+    const headers = new Headers(tongue.headers);
+    prior.headers.forEach((value, key) => {
+        const k = key.toLowerCase();
+        if (k.startsWith('x-middleware-'))
+            return;
+        if (k === 'location' && headers.has('location'))
+            return;
+        if (k === 'set-cookie') {
+            headers.append(key, value);
+            return;
+        }
+        if (!headers.has(key))
+            headers.set(key, value);
+    });
+    return new Response(tongue.body, {
+        status: tongue.status,
+        statusText: tongue.statusText,
+        headers,
+    });
 }
 /** Map internal path → localized public path for a locale. */
 export function publicPathForLocale(internal, locale, pathnames) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-tongue",
-  "version": "0.9.13",
+  "version": "0.9.15",
   "description": "Compiler-first, type-safe i18n for the Next.js 16 App Router",
   "license": "MIT",
   "type": "module",