next-tongue 0.9.14 → 0.9.15

package/dist/cli/merge-proxy.js

@@ -27,7 +27,9 @@ export function mergeProxySource(source, opts) {
         return {
             status: 'merged',
             code: ensureTrailingNewline(replaced),
-            note: `Replaced final NextResponse.next() with ${tongueIdent}(${reqIdent}). Early next() returns (allow-lists) are kept.`,
+            note: `Replaced final NextResponse.next() with ${tongueIdent}(${reqIdent}). ` +
+                `Early next() returns (allow-lists) are kept. ` +
+                `If you stamp CSP/nonce on next(), use createProxy({ wrapResponse }) or mergeProxyResponse — see routing docs.`,
         };
     }
     // No next() — wrap exported handler so user logic runs first, then tongue.
@@ -36,7 +38,9 @@ export function mergeProxySource(source, opts) {
         return {
             status: 'merged',
             code: ensureTrailingNewline(wrapped),
-            note: `Wrapped existing handler: user Response wins unless it is a passthrough next; otherwise ${tongueIdent} runs.`,
+            note: `Wrapped existing handler: non-passthrough user Response wins (auth/maintenance); ` +
+                `passthrough next() → ${tongueIdent} with mergeProxyResponse (keeps CSP/nonce). ` +
+                `Rewrites to paths under [locale] must include the locale segment.`,
         };
     }
     return {
@@ -117,14 +121,50 @@ function wrapExportedHandler(code, tongueIdent, reqIdent) {
     const name = m[2];
     const inner = `__tongue_user_${name}`;
     let out = code.slice(0, m.index) + `${asyncKw}function ${inner}(` + code.slice(m.index + m[0].length);
+    // Prefer non-passthrough user Response (auth redirect, maintenance rewrite).
+    // Passthrough next() → tongue, then mergeProxyResponse so CSP/nonce on the
+    // user next() are not dropped.
+    out = ensureMergeProxyResponseImport(out);
+    // Outer wrapper is always async — createProxy returns a Promise.
     out +=
-        `\n\nexport ${asyncKw}function ${name}(${reqIdent}: Parameters<typeof ${inner}>[0]) {\n` +
+        `\n\nexport async function ${name}(${reqIdent}: Parameters<typeof ${inner}>[0]) {\n` +
             `  const __user = ${asyncKw ? 'await ' : ''}${inner}(${reqIdent});\n` +
             `  if (__user && __user.headers?.get?.('x-middleware-next') !== '1') return __user;\n` +
-            `  return ${tongueIdent}(${reqIdent});\n` +
+            `  const __tongue = await ${tongueIdent}(${reqIdent});\n` +
+            `  return __user ? mergeProxyResponse(__user, __tongue) : __tongue;\n` +
             `}\n`;
     return out;
 }
+function ensureMergeProxyResponseImport(code) {
+    if (/\bmergeProxyResponse\b/.test(code) && CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bmergeProxyResponse\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            parts.push('mergeProxyResponse');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    // ensureCreateProxyImport already ran — add mergeProxyResponse to that import
+    if (CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bmergeProxyResponse\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            if (!parts.includes('createProxy'))
+                parts.unshift('createProxy');
+            parts.push('mergeProxyResponse');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    return code;
+}
 export const PROXY_CANDIDATES = [
     'proxy.ts',
     'proxy.js',

package/dist/client/index.d.ts

@@ -39,5 +39,7 @@ export declare const defaultLocale: {
 export type { TFunction, Format };
 export type { SanctionedUnit, SimpleUnit, DisplayNameType, } from '../runtime/format.js';
 export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
+/** Isomorphic — safe in client HtmlLang helpers. */
+export { getDir } from '../runtime/locale.js';
 export { translateIssues, defaultFormatPath, } from '../runtime/translate-issues.js';
 export type { TranslateIssue, TranslateIssuesOptions, IssuePathSegment, } from '../runtime/translate-issues.js';

package/dist/client/index.js

@@ -116,4 +116,6 @@ export const defaultLocale = {
     },
 };
 export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
+/** Isomorphic — safe in client HtmlLang helpers. */
+export { getDir } from '../runtime/locale.js';
 export { translateIssues, defaultFormatPath, } from '../runtime/translate-issues.js';

package/dist/compiler/codegen/emit-types.js

@@ -14,6 +14,7 @@ export function emitTypesFile(opts) {
         : 'string';
     return `/* eslint-disable */
 // Generated by next-tongue. Do not edit.
+import type { ReactNode } from 'react';
 declare module 'next-tongue' {
   interface TongueRegister {
     locales: ${localeUnion};
@@ -46,8 +47,8 @@ function argsToType(args) {
             }
             case 'rich':
                 return kind.selfClosing
-                    ? `${JSON.stringify(name)}: () => unknown`
-                    : `${JSON.stringify(name)}: (chunks: unknown) => unknown`;
+                    ? `${JSON.stringify(name)}: () => ReactNode`
+                    : `${JSON.stringify(name)}: (chunks: ReactNode) => ReactNode`;
         }
     });
     return `{ ${fields.join('; ')} }`;

package/dist/navigation/pathname.d.ts

@@ -2,6 +2,8 @@ export type PathnameInput = string | {
     pathname: string;
     params?: Record<string, string | number>;
     query?: Record<string, string | number | undefined>;
+    /** Fragment without requiring `#` (e.g. `'preferences'` or `'#preferences'`). */
+    hash?: string;
 };
 export type GetPathnameArgs = {
     href: PathnameInput;
@@ -15,6 +17,9 @@ export type GetPathnameArgs = {
 };
 /**
  * Build a localized public pathname for links, redirects, and sitemaps.
+ * Query strings and hashes are preserved (stripped before pathnames/prefix,
+ * reattached after). Prefer the object form for typed `pathnames` unions:
+ * `{ pathname: '/dashboard', query: { demo: 1 }, hash: 'prefs' }`.
  */
 export declare function getPathname(args: GetPathnameArgs): string;
 /** Strip a leading locale segment from a pathname. */
@@ -24,3 +29,9 @@ export declare function stripLocalePrefix(pathname: string, locales: readonly st
  * used in `routing.pathnames` (e.g. `/ueber-uns` → `/about` for `de`).
  */
 export declare function toInternalPathname(pathname: string, locale: string, pathnames?: Record<string, Partial<Record<string, string>>>): string;
+/** Split `/path?q=1#hash` into parts (pathnames lookup needs the path alone). */
+export declare function splitPathSearchHash(full: string): {
+    pathname: string;
+    search: string;
+    hash: string;
+};

package/dist/navigation/pathname.js

@@ -1,23 +1,29 @@
 /**
  * Build a localized public pathname for links, redirects, and sitemaps.
+ * Query strings and hashes are preserved (stripped before pathnames/prefix,
+ * reattached after). Prefer the object form for typed `pathnames` unions:
+ * `{ pathname: '/dashboard', query: { demo: 1 }, hash: 'prefs' }`.
  */
 export function getPathname(args) {
     const { href, locale, prefix = 'as-needed', defaultLocale = 'en', pathnames, } = args;
-    let path = resolveHref(href);
+    const { pathname: rawPath, search, hash } = resolveHref(href);
+    let path = rawPath;
     if (pathnames) {
         const localized = pathnames[path]?.[locale];
         if (localized)
             path = localized;
     }
-    if (prefix === 'never')
-        return path;
+    if (prefix === 'never') {
+        return path + search + hash;
+    }
     if (prefix === 'as-needed' && locale === defaultLocale) {
-        return path;
+        return path + search + hash;
     }
     // always, or as-needed for non-default
-    if (path === '/')
-        return `/${locale}`;
-    return `/${locale}${path.startsWith('/') ? path : `/${path}`}`;
+    if (path === '/') {
+        return `/${locale}` + search + hash;
+    }
+    return (`/${locale}${path.startsWith('/') ? path : `/${path}`}` + search + hash);
 }
 /** Strip a leading locale segment from a pathname. */
 export function stripLocalePrefix(pathname, locales) {
@@ -43,14 +49,21 @@ export function toInternalPathname(pathname, locale, pathnames) {
     return pathname;
 }
 function resolveHref(href) {
-    if (typeof href === 'string')
-        return href.startsWith('/') ? href : `/${href}`;
-    let path = href.pathname.startsWith('/') ? href.pathname : `/${href.pathname}`;
+    if (typeof href === 'string') {
+        return splitPathSearchHash(href.startsWith('/') ? href : `/${href}`);
+    }
+    let path = href.pathname.startsWith('/')
+        ? href.pathname
+        : `/${href.pathname}`;
+    // Object pathname should be path-only; tolerate accidental ?/#.
+    const split = splitPathSearchHash(path);
+    path = split.pathname;
     if (href.params) {
         for (const [key, value] of Object.entries(href.params)) {
             path = path.replace(`[${key}]`, encodeURIComponent(String(value)));
         }
     }
+    let search = split.search;
     if (href.query) {
         const qs = new URLSearchParams();
         for (const [key, value] of Object.entries(href.query)) {
@@ -58,8 +71,28 @@ function resolveHref(href) {
                 qs.set(key, String(value));
         }
         const s = qs.toString();
-        if (s)
-            path += `?${s}`;
+        search = s ? `?${s}` : '';
+    }
+    let hash = split.hash;
+    if (href.hash != null && href.hash !== '') {
+        hash = href.hash.startsWith('#') ? href.hash : `#${href.hash}`;
+    }
+    return { pathname: path, search, hash };
+}
+/** Split `/path?q=1#hash` into parts (pathnames lookup needs the path alone). */
+export function splitPathSearchHash(full) {
+    let path = full;
+    let hash = '';
+    let search = '';
+    const hashIdx = path.indexOf('#');
+    if (hashIdx >= 0) {
+        hash = path.slice(hashIdx);
+        path = path.slice(0, hashIdx);
+    }
+    const qIdx = path.indexOf('?');
+    if (qIdx >= 0) {
+        search = path.slice(qIdx);
+        path = path.slice(0, qIdx);
     }
-    return path;
+    return { pathname: path || '/', search, hash };
 }

package/dist/proxy/index.d.ts

@@ -47,6 +47,12 @@ export type CreateProxyOptions = {
     /** Override detection (domain → cookie → Accept-Language → default). */
     resolveLocale?: (req: TongueProxyRequest) => string | undefined | Promise<string | undefined>;
     onLocale?: (locale: string, req: TongueProxyRequest) => void;
+    /**
+     * Post-process every tongue response (redirect / rewrite / next).
+     * Use to re-stamp CSP / nonce headers after locale routing — tongue does
+     * not preserve headers from a prior `NextResponse.next()`.
+     */
+    wrapResponse?: (res: Response, req: TongueProxyRequest) => Response | Promise<Response>;
 };
 /** Default locale cookie name (`SameSite=Lax`). Use with `requestLocale` in API routes. */
 export declare const LOCALE_COOKIE_NAME = "TONGUE_LOCALE";
@@ -57,6 +63,15 @@ export declare const LOCALE_COOKIE_NAME = "TONGUE_LOCALE";
  * @see docs/routing-and-proxy.md
  */
 export declare function createProxy(options: CreateProxyOptions): (req: TongueProxyRequest) => Response | Promise<Response>;
+/**
+ * Copy response headers from a prior `NextResponse.next()` (CSP, nonce, …)
+ * onto a tongue rewrite/redirect/next response. Skips middleware control
+ * headers (`x-middleware-*`, `Location` when tongue already set one).
+ *
+ * Use when you stamp headers on `next()` then call tongue — tongue alone
+ * cannot see those headers.
+ */
+export declare function mergeProxyResponse(prior: Response, tongue: Response): Response;
 /** Map internal path → localized public path for a locale. */
 export declare function publicPathForLocale(internal: string, locale: string, pathnames?: Record<string, Partial<Record<string, string>>>): string;
 /** Resolve `Host` / `x-forwarded-host` against `routing.domains`. */

package/dist/proxy/index.js

@@ -37,78 +37,125 @@ export function createProxy(options) {
     if (!localeSet.has(defaultLocale)) {
         throw new Error(`[next-tongue] createProxy: defaultLocale "${defaultLocale}" is not in locales`);
     }
+    const wrap = options.wrapResponse;
     return async (req) => {
-        const { pathname } = req.nextUrl;
-        const https = isHttpsRequest(req);
-        if (isUnsafePath(pathname)) {
-            return passthrough(cookieCfg, null, https);
-        }
-        const domain = matchDomain(req, domains);
-        const activeLocales = domain?.locales ? [...domain.locales] : locales;
-        const activeDefault = domain?.defaultLocale ?? defaultLocale;
-        const activeSet = new Set(activeLocales);
-        const activeMatcher = activeLocales.length === locales.length
-            ? detectionMatcher
-            : createLocaleMatcher(activeLocales.filter((l) => !excludeDetection.has(l)));
-        const matched = matchLocalePrefix(pathname, localeSet);
-        if (matched && (!domain || activeSet.has(matched.locale))) {
-            const { locale, rest } = matched;
-            const publicRest = rest === '' ? '/' : rest;
-            const internal = toInternalPathname(publicRest, locale, pathnames);
-            if (prefix === 'as-needed' && locale === activeDefault) {
-                // Canonicalize default-locale URLs without the prefix.
-                const dest = publicPathForLocale(internal, locale, pathnames);
-                const redirectUrl = req.nextUrl.clone();
-                redirectUrl.pathname = dest;
-                options.onLocale?.(locale, req);
-                return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
-            }
+        const res = await handleProxyRequest(req, {
+            locales,
+            defaultLocale,
+            prefix,
+            localeDetection,
+            pathnames,
+            domains,
+            cookieCfg,
+            excludeDetection,
+            localeSet,
+            detectionMatcher,
+            options,
+        });
+        return wrap ? await wrap(res, req) : res;
+    };
+}
+async function handleProxyRequest(req, ctx) {
+    const { locales, defaultLocale, prefix, localeDetection, pathnames, domains, cookieCfg, excludeDetection, localeSet, detectionMatcher, options, } = ctx;
+    const { pathname } = req.nextUrl;
+    const https = isHttpsRequest(req);
+    if (isUnsafePath(pathname)) {
+        return passthrough(cookieCfg, null, https);
+    }
+    const domain = matchDomain(req, domains);
+    const activeLocales = domain?.locales ? [...domain.locales] : locales;
+    const activeDefault = domain?.defaultLocale ?? defaultLocale;
+    const activeSet = new Set(activeLocales);
+    const activeMatcher = activeLocales.length === locales.length
+        ? detectionMatcher
+        : createLocaleMatcher(activeLocales.filter((l) => !excludeDetection.has(l)));
+    const matched = matchLocalePrefix(pathname, localeSet);
+    if (matched && (!domain || activeSet.has(matched.locale))) {
+        const { locale, rest } = matched;
+        const publicRest = rest === '' ? '/' : rest;
+        const internal = toInternalPathname(publicRest, locale, pathnames);
+        if (prefix === 'as-needed' && locale === activeDefault) {
+            // Canonicalize default-locale URLs without the prefix.
+            const dest = publicPathForLocale(internal, locale, pathnames);
+            const redirectUrl = req.nextUrl.clone();
+            redirectUrl.pathname = dest;
             options.onLocale?.(locale, req);
-            if (internal !== publicRest) {
-                const url = req.nextUrl.clone();
-                url.pathname = joinLocalePath(locale, internal);
-                return rewriteResponse(url.toString(), cookieCfg, locale, https);
-            }
-            return passthrough(cookieCfg, locale, https);
+            return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
         }
-        const resolved = options.resolveLocale
-            ? await options.resolveLocale(req)
-            : undefined;
-        let locale = sanitizeLocale(resolved, activeLocales) ??
-            (localeDetection
-                ? detectLocale(req, activeLocales, activeDefault, cookieCfg, excludeDetection, activeMatcher, domain)
-                : activeDefault);
-        locale = sanitizeLocale(locale, activeLocales) ?? activeDefault;
         options.onLocale?.(locale, req);
-        const internal = toInternalPathname(pathname, locale, pathnames);
-        // Prefer localized public path when the user hit the internal key.
-        const publicPath = publicPathForLocale(internal, locale, pathnames);
-        if (prefix === 'never') {
+        if (internal !== publicRest) {
             const url = req.nextUrl.clone();
             url.pathname = joinLocalePath(locale, internal);
             return rewriteResponse(url.toString(), cookieCfg, locale, https);
         }
-        if (prefix === 'as-needed' && locale === activeDefault) {
-            // Serve default locale without prefix; rewrite to internal app path.
-            if (pathname !== publicPath && pathnames) {
-                // User visited internal `/about` but public is also `/about` — fine.
-                // If they somehow differ for default locale, redirect to public.
-                if (publicPath !== internal && pathname === internal) {
-                    const redirectUrl = req.nextUrl.clone();
-                    redirectUrl.pathname = publicPath;
-                    return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
-                }
+        return passthrough(cookieCfg, locale, https);
+    }
+    const resolved = options.resolveLocale
+        ? await options.resolveLocale(req)
+        : undefined;
+    let locale = sanitizeLocale(resolved, activeLocales) ??
+        (localeDetection
+            ? detectLocale(req, activeLocales, activeDefault, cookieCfg, excludeDetection, activeMatcher, domain)
+            : activeDefault);
+    locale = sanitizeLocale(locale, activeLocales) ?? activeDefault;
+    options.onLocale?.(locale, req);
+    const internal = toInternalPathname(pathname, locale, pathnames);
+    // Prefer localized public path when the user hit the internal key.
+    const publicPath = publicPathForLocale(internal, locale, pathnames);
+    if (prefix === 'never') {
+        const url = req.nextUrl.clone();
+        url.pathname = joinLocalePath(locale, internal);
+        return rewriteResponse(url.toString(), cookieCfg, locale, https);
+    }
+    if (prefix === 'as-needed' && locale === activeDefault) {
+        // Serve default locale without prefix; rewrite to internal app path.
+        if (pathname !== publicPath && pathnames) {
+            // User visited internal `/about` but public is also `/about` — fine.
+            // If they somehow differ for default locale, redirect to public.
+            if (publicPath !== internal && pathname === internal) {
+                const redirectUrl = req.nextUrl.clone();
+                redirectUrl.pathname = publicPath;
+                return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
             }
-            const url = req.nextUrl.clone();
-            url.pathname = joinLocalePath(activeDefault, internal);
-            return rewriteResponse(url.toString(), cookieCfg, locale, https);
         }
-        // Non-default (or always): redirect to prefixed localized public URL.
-        const destPublic = publicPathForLocale(internal, locale, pathnames);
         const url = req.nextUrl.clone();
-        url.pathname = joinLocalePath(locale, destPublic);
-        return redirectResponse(url.toString(), 307, cookieCfg, locale, https);
-    };
+        url.pathname = joinLocalePath(activeDefault, internal);
+        return rewriteResponse(url.toString(), cookieCfg, locale, https);
+    }
+    // Non-default (or always): redirect to prefixed localized public URL.
+    const destPublic = publicPathForLocale(internal, locale, pathnames);
+    const url = req.nextUrl.clone();
+    url.pathname = joinLocalePath(locale, destPublic);
+    return redirectResponse(url.toString(), 307, cookieCfg, locale, https);
+}
+/**
+ * Copy response headers from a prior `NextResponse.next()` (CSP, nonce, …)
+ * onto a tongue rewrite/redirect/next response. Skips middleware control
+ * headers (`x-middleware-*`, `Location` when tongue already set one).
+ *
+ * Use when you stamp headers on `next()` then call tongue — tongue alone
+ * cannot see those headers.
+ */
+export function mergeProxyResponse(prior, tongue) {
+    const headers = new Headers(tongue.headers);
+    prior.headers.forEach((value, key) => {
+        const k = key.toLowerCase();
+        if (k.startsWith('x-middleware-'))
+            return;
+        if (k === 'location' && headers.has('location'))
+            return;
+        if (k === 'set-cookie') {
+            headers.append(key, value);
+            return;
+        }
+        if (!headers.has(key))
+            headers.set(key, value);
+    });
+    return new Response(tongue.body, {
+        status: tongue.status,
+        statusText: tongue.statusText,
+        headers,
+    });
 }
 /** Map internal path → localized public path for a locale. */
 export function publicPathForLocale(internal, locale, pathnames) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-tongue",
-  "version": "0.9.14",
+  "version": "0.9.15",
   "description": "Compiler-first, type-safe i18n for the Next.js 16 App Router",
   "license": "MIT",
   "type": "module",