next-tongue 0.9.14 → 0.9.16

package/dist/cli/init.js

@@ -188,6 +188,7 @@ export default withTongue(nextConfig);
             ts.compilerOptions = ts.compilerOptions ?? {};
             const paths = { ...(ts.compilerOptions.paths ?? {}) };
             if (!paths['#tongue/*']) {
+                // TypeScript accepts extensionless; Node package imports need *.js (below).
                 paths['#tongue/*'] = ['./.tongue/*'];
             }
             ts.compilerOptions.paths = paths;
@@ -227,7 +228,8 @@ export default withTongue(nextConfig);
         const raw = await readFile(pkgPath, 'utf8');
         try {
             const pkg = JSON.parse(raw);
-            pkg.imports = { ...(pkg.imports ?? {}), '#tongue/*': './.tongue/*' };
+            // Node ESM requires the .js suffix in the mapping target.
+            pkg.imports = { ...(pkg.imports ?? {}), '#tongue/*': './.tongue/*.js' };
             const next = `${JSON.stringify(pkg, null, 2)}\n`;
             if (next !== raw) {
                 plans.push({ path: 'package.json', kind: 'merge', content: next });
@@ -292,7 +294,7 @@ import { TongueProvider } from 'next-tongue/client';
 import { getDir, isLocale } from 'next-tongue/server';
 import { localeParams } from '#tongue/runtime';
 
-// Importing #tongue/runtime auto-runs ensureTongue() (withTongue apps).
+// Required: static #tongue/runtime import wires ensureTongue for getT.
 export const generateStaticParams = localeParams;
 
 export default async function LocaleLayout({
@@ -324,7 +326,7 @@ import { TongueProvider } from 'next-tongue/client';
 import { isLocale } from 'next-tongue/server';
 import { localeParams } from '#tongue/runtime';
 
-// Importing #tongue/runtime auto-runs ensureTongue() (withTongue apps).
+// Required: static #tongue/runtime import wires ensureTongue for getT.
 export const generateStaticParams = localeParams;
 
 export default async function LocaleLayout({

package/dist/cli/merge-proxy.js

@@ -27,7 +27,9 @@ export function mergeProxySource(source, opts) {
         return {
             status: 'merged',
             code: ensureTrailingNewline(replaced),
-            note: `Replaced final NextResponse.next() with ${tongueIdent}(${reqIdent}). Early next() returns (allow-lists) are kept.`,
+            note: `Replaced final NextResponse.next() with ${tongueIdent}(${reqIdent}). ` +
+                `Early next() returns (allow-lists) are kept. ` +
+                `If you stamp CSP/nonce on next(), use createProxy({ wrapResponse }) or mergeProxyResponse — see routing docs.`,
         };
     }
     // No next() — wrap exported handler so user logic runs first, then tongue.
@@ -36,7 +38,9 @@ export function mergeProxySource(source, opts) {
         return {
             status: 'merged',
             code: ensureTrailingNewline(wrapped),
-            note: `Wrapped existing handler: user Response wins unless it is a passthrough next; otherwise ${tongueIdent} runs.`,
+            note: `Wrapped existing handler: non-passthrough user Response wins (auth/maintenance); ` +
+                `passthrough next() → ${tongueIdent} with mergeProxyResponse (keeps CSP/nonce). ` +
+                `Rewrites to paths under [locale] must include the locale segment.`,
         };
     }
     return {
@@ -117,14 +121,50 @@ function wrapExportedHandler(code, tongueIdent, reqIdent) {
     const name = m[2];
     const inner = `__tongue_user_${name}`;
     let out = code.slice(0, m.index) + `${asyncKw}function ${inner}(` + code.slice(m.index + m[0].length);
+    // Prefer non-passthrough user Response (auth redirect, maintenance rewrite).
+    // Passthrough next() → tongue, then mergeProxyResponse so CSP/nonce on the
+    // user next() are not dropped.
+    out = ensureMergeProxyResponseImport(out);
+    // Outer wrapper is always async — createProxy returns a Promise.
     out +=
-        `\n\nexport ${asyncKw}function ${name}(${reqIdent}: Parameters<typeof ${inner}>[0]) {\n` +
+        `\n\nexport async function ${name}(${reqIdent}: Parameters<typeof ${inner}>[0]) {\n` +
             `  const __user = ${asyncKw ? 'await ' : ''}${inner}(${reqIdent});\n` +
             `  if (__user && __user.headers?.get?.('x-middleware-next') !== '1') return __user;\n` +
-            `  return ${tongueIdent}(${reqIdent});\n` +
+            `  const __tongue = await ${tongueIdent}(${reqIdent});\n` +
+            `  return __user ? mergeProxyResponse(__user, __tongue) : __tongue;\n` +
             `}\n`;
     return out;
 }
+function ensureMergeProxyResponseImport(code) {
+    if (/\bmergeProxyResponse\b/.test(code) && CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bmergeProxyResponse\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            parts.push('mergeProxyResponse');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    // ensureCreateProxyImport already ran — add mergeProxyResponse to that import
+    if (CREATE_PROXY_IMPORT.test(code)) {
+        return code.replace(CREATE_PROXY_IMPORT, (full, specs) => {
+            if (/\bmergeProxyResponse\b/.test(specs))
+                return full;
+            const parts = specs
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+            if (!parts.includes('createProxy'))
+                parts.unshift('createProxy');
+            parts.push('mergeProxyResponse');
+            return full.replace(specs, ` ${parts.join(', ')} `);
+        });
+    }
+    return code;
+}
 export const PROXY_CANDIDATES = [
     'proxy.ts',
     'proxy.js',

package/dist/client/index.d.ts

@@ -39,5 +39,7 @@ export declare const defaultLocale: {
 export type { TFunction, Format };
 export type { SanctionedUnit, SimpleUnit, DisplayNameType, } from '../runtime/format.js';
 export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
+/** Isomorphic — safe in client HtmlLang helpers. */
+export { getDir } from '../runtime/locale.js';
 export { translateIssues, defaultFormatPath, } from '../runtime/translate-issues.js';
 export type { TranslateIssue, TranslateIssuesOptions, IssuePathSegment, } from '../runtime/translate-issues.js';

package/dist/client/index.js

@@ -88,7 +88,7 @@ export function useT(namespace) {
  */
 function createLoaderStubT(locale, ns) {
     const fail = (kind) => {
-        throw new TongueError('TONGUE_E_NO_PROVIDER', `useT('${ns}') ${kind} was not rewritten to a per-key import. Ensure withTongue() is applied (loader on SSR + client). Prefer getT on the server for static copy; for dynamic keys use t.dynamic(key, { from: [...] }) with an inline array or a same-file const (imported from arrays are not rewritten).`);
+        throw new TongueError('TONGUE_E_NOT_REWRITTEN', `[next-tongue] useT('${ns}') ${kind} was not rewritten to a per-key import (this is not a missing TongueProvider). Ensure withTongue() applies the loader on SSR + client. For t.dynamic use { from: ['a','b'] }, { from: KEYS }, or { from: [...KEYS] } with a same-file const array — imported from-arrays are not resolved.`);
     };
     const t = Object.assign((..._args) => fail('t()'), {
         rich: () => fail('t.rich()'),
@@ -116,4 +116,6 @@ export const defaultLocale = {
     },
 };
 export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
+/** Isomorphic — safe in client HtmlLang helpers. */
+export { getDir } from '../runtime/locale.js';
 export { translateIssues, defaultFormatPath, } from '../runtime/translate-issues.js';

package/dist/compiler/build.js

@@ -412,7 +412,7 @@ export async function buildMessages(options) {
     await writeFile(join(outDir, 'manifest.json'), JSON.stringify(manifest, null, 2), 'utf8');
     await writeFile(join(outDir, '.hash'), hash, 'utf8');
     // package.json imports helper note — apps map "#tongue/*" themselves / via withTongue
-    await writeFile(join(outDir, 'README.md'), 'Generated by next-tongue. Do not edit. Map `#tongue/*` → this directory.\nImporting `#tongue/runtime` (or calling getT) auto-runs ensureTongue(); an explicit call is optional.\n', 'utf8');
+    await writeFile(join(outDir, 'README.md'), 'Generated by next-tongue. Do not edit.\nMap package.json `"#tongue/*": "./.tongue/*.js"` (Node needs the .js suffix) and tsconfig paths `"#tongue/*": ["./.tongue/*"]`.\nStatically import `#tongue/runtime` in app/[locale]/layout (e.g. localeParams) so ensureTongue() shares the server module graph with getT.\n', 'utf8');
     await clearOutputDir(publishedOutDir);
     try {
         await rename(outDir, publishedOutDir);

package/dist/compiler/codegen/emit-types.js

@@ -14,6 +14,7 @@ export function emitTypesFile(opts) {
         : 'string';
     return `/* eslint-disable */
 // Generated by next-tongue. Do not edit.
+import type { ReactNode } from 'react';
 declare module 'next-tongue' {
   interface TongueRegister {
     locales: ${localeUnion};
@@ -46,8 +47,8 @@ function argsToType(args) {
             }
             case 'rich':
                 return kind.selfClosing
-                    ? `${JSON.stringify(name)}: () => unknown`
-                    : `${JSON.stringify(name)}: (chunks: unknown) => unknown`;
+                    ? `${JSON.stringify(name)}: () => ReactNode`
+                    : `${JSON.stringify(name)}: (chunks: ReactNode) => ReactNode`;
         }
     });
     return `{ ${fields.join('; ')} }`;

package/dist/compiler/dynamic-from.js

@@ -91,7 +91,24 @@ export function resolveFromKeys(fileSource, fromExpr) {
         const arr = takeBalanced(trimmed, 0, '[', ']');
         if (!arr)
             return null;
-        return extractStringLiterals(arr.slice(1, -1));
+        const inner = arr.slice(1, -1);
+        const literals = extractStringLiterals(inner);
+        // `{ from: [...NAV_KEYS] }` or `{ from: ['a', ...REST] }`
+        const spreadIds = [
+            ...inner.matchAll(/\.\.\.\s*([A-Za-z_$][\w$]*)/g),
+        ].map((m) => m[1]);
+        if (spreadIds.length > 0) {
+            const fromSpreads = [];
+            for (const id of spreadIds) {
+                const keys = resolveConstArrayKeys(fileSource, id);
+                if (!keys?.length)
+                    return null;
+                fromSpreads.push(...keys);
+            }
+            const merged = [...literals, ...fromSpreads];
+            return merged.length > 0 ? merged : null;
+        }
+        return literals.length > 0 ? literals : null;
     }
     const ov = /^Object\.values\(\s*([A-Za-z_$][\w$]*)\s*\)$/.exec(trimmed);
     if (ov) {

package/dist/compiler/scan-keys.js

@@ -142,12 +142,17 @@ export function extractFromSource(source, file) {
     const dynamicNamespaces = new Set();
     const undeclaredDynamics = [];
     const translators = new Map();
-    // useT('ns') | getT('ns') | getT(locale, 'ns')
-    const declRe = /(?:const|let|var)\s+(\w+)\s*=\s*(?:await\s+)?(useT|getT)\s*\(\s*(?:[^'"\n,]+,\s*)?(['"])([^'"]*)\3\s*\)/g;
+    // useT('ns') | getT('ns') | getT(locale, 'ns') — tolerate type annotations,
+    // multiline args, and trailing `as const` on the namespace literal.
+    const declRe = /(?:const|let|var)\s+(\w+)\s*(?::[^=;]+)?=\s*(?:await\s+)?(useT|getT)\s*\(/g;
     let m;
     while ((m = declRe.exec(code)) !== null) {
+        const open = m.index + m[0].length - 1;
+        const ns = namespaceFromCallArgs(code, open);
+        if (ns == null)
+            continue;
         translators.set(m[1], {
-            ns: m[4] || '_root',
+            ns: ns || '_root',
             kind: m[2],
         });
     }
@@ -206,6 +211,54 @@ export function extractFromSource(source, file) {
     }
     return { refs: out, dynamicNamespaces, undeclaredDynamics };
 }
+/**
+ * Last string-literal argument to getT/useT is the namespace
+ * (`getT(locale, 'home')` → home, `useT('nav')` → nav).
+ */
+function namespaceFromCallArgs(source, openParen) {
+    let i = openParen + 1;
+    let depth = 1;
+    let inStr = null;
+    let escape = false;
+    let lastString = null;
+    let buf = '';
+    for (; i < source.length; i++) {
+        const c = source[i];
+        if (inStr) {
+            if (escape) {
+                escape = false;
+                buf += c;
+                continue;
+            }
+            if (c === '\\') {
+                escape = true;
+                buf += c;
+                continue;
+            }
+            if (c === inStr) {
+                lastString = buf;
+                inStr = null;
+                buf = '';
+                continue;
+            }
+            buf += c;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            inStr = c;
+            buf = '';
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{')
+            depth++;
+        else if (c === ')' || c === ']' || c === '}') {
+            depth--;
+            if (depth === 0)
+                break;
+        }
+    }
+    return lastString;
+}
 function lineAt(source, index) {
     let line = 1;
     for (let i = 0; i < index && i < source.length; i++) {

package/dist/errors.d.ts

@@ -1,4 +1,6 @@
-export type TongueErrorCode = 'TONGUE_E_CONFIG' | 'TONGUE_E_PARSE' | 'TONGUE_E_ICU_SYNTAX' | 'TONGUE_E_UNSUPPORTED_ICU' | 'TONGUE_E_TYPES_MISSING' | 'TONGUE_E_LOCALE' | 'TONGUE_E_IO' | 'TONGUE_E_BUILD' | 'TONGUE_E_NO_PROVIDER';
+export type TongueErrorCode = 'TONGUE_E_CONFIG' | 'TONGUE_E_PARSE' | 'TONGUE_E_ICU_SYNTAX' | 'TONGUE_E_UNSUPPORTED_ICU' | 'TONGUE_E_TYPES_MISSING' | 'TONGUE_E_LOCALE' | 'TONGUE_E_IO' | 'TONGUE_E_BUILD' | 'TONGUE_E_NO_PROVIDER'
+/** Call-site loader did not rewrite `t()` / `t.dynamic()` (not a missing TongueProvider). */
+ | 'TONGUE_E_NOT_REWRITTEN';
 export declare class TongueError extends Error {
     readonly code: TongueErrorCode;
     readonly file?: string;

package/dist/navigation/config.d.ts

@@ -0,0 +1,6 @@
+export type NavigationConfig = {
+    locales: readonly string[];
+    defaultLocale: string;
+    prefix?: 'always' | 'as-needed' | 'never';
+    pathnames?: Record<string, Partial<Record<string, string>>>;
+};

package/dist/navigation/config.js

@@ -0,0 +1 @@
+export {};

package/dist/navigation/index.d.ts

@@ -1,17 +1,13 @@
 import NextLink from 'next/link';
 import type { ComponentProps, ReactNode } from 'react';
 import type { Locale, Pathname } from '../index.js';
+import type { NavigationConfig } from './config.js';
 import { getPathname as getPathnameImpl, stripLocalePrefix, toInternalPathname, type PathnameInput } from './pathname.js';
 export type { PathnameInput };
+export type { NavigationConfig } from './config.js';
 export { getPathnameImpl as getPathname, stripLocalePrefix, toInternalPathname };
 export { buildLocaleSwitcherOptions, createLocaleSwitcher, } from './locale-switcher.js';
 export type { LocaleSwitcherOption, UseLocaleSwitcherResult, } from './locale-switcher.js';
-export type NavigationConfig = {
-    locales: readonly string[];
-    defaultLocale: string;
-    prefix?: 'always' | 'as-needed' | 'never';
-    pathnames?: Record<string, Partial<Record<string, string>>>;
-};
 type Href = Pathname | PathnameInput;
 /**
  * Create locale-aware navigation helpers bound to routing config.

package/dist/navigation/locale-switcher.d.ts

@@ -1,5 +1,5 @@
 import type { ReactNode } from 'react';
-import type { NavigationConfig } from './index.js';
+import type { NavigationConfig } from './config.js';
 export type LocaleSwitcherOption = {
     locale: string;
     /** Locale name in that locale (`Intl.DisplayNames`). */

package/dist/navigation/pathname.d.ts

@@ -2,6 +2,8 @@ export type PathnameInput = string | {
     pathname: string;
     params?: Record<string, string | number>;
     query?: Record<string, string | number | undefined>;
+    /** Fragment without requiring `#` (e.g. `'preferences'` or `'#preferences'`). */
+    hash?: string;
 };
 export type GetPathnameArgs = {
     href: PathnameInput;
@@ -15,6 +17,9 @@ export type GetPathnameArgs = {
 };
 /**
  * Build a localized public pathname for links, redirects, and sitemaps.
+ * Query strings and hashes are preserved (stripped before pathnames/prefix,
+ * reattached after). Prefer the object form for typed `pathnames` unions:
+ * `{ pathname: '/dashboard', query: { demo: 1 }, hash: 'prefs' }`.
  */
 export declare function getPathname(args: GetPathnameArgs): string;
 /** Strip a leading locale segment from a pathname. */
@@ -24,3 +29,9 @@ export declare function stripLocalePrefix(pathname: string, locales: readonly st
  * used in `routing.pathnames` (e.g. `/ueber-uns` → `/about` for `de`).
  */
 export declare function toInternalPathname(pathname: string, locale: string, pathnames?: Record<string, Partial<Record<string, string>>>): string;
+/** Split `/path?q=1#hash` into parts (pathnames lookup needs the path alone). */
+export declare function splitPathSearchHash(full: string): {
+    pathname: string;
+    search: string;
+    hash: string;
+};

package/dist/navigation/pathname.js

@@ -1,23 +1,29 @@
 /**
  * Build a localized public pathname for links, redirects, and sitemaps.
+ * Query strings and hashes are preserved (stripped before pathnames/prefix,
+ * reattached after). Prefer the object form for typed `pathnames` unions:
+ * `{ pathname: '/dashboard', query: { demo: 1 }, hash: 'prefs' }`.
  */
 export function getPathname(args) {
     const { href, locale, prefix = 'as-needed', defaultLocale = 'en', pathnames, } = args;
-    let path = resolveHref(href);
+    const { pathname: rawPath, search, hash } = resolveHref(href);
+    let path = rawPath;
     if (pathnames) {
         const localized = pathnames[path]?.[locale];
         if (localized)
             path = localized;
     }
-    if (prefix === 'never')
-        return path;
+    if (prefix === 'never') {
+        return path + search + hash;
+    }
     if (prefix === 'as-needed' && locale === defaultLocale) {
-        return path;
+        return path + search + hash;
     }
     // always, or as-needed for non-default
-    if (path === '/')
-        return `/${locale}`;
-    return `/${locale}${path.startsWith('/') ? path : `/${path}`}`;
+    if (path === '/') {
+        return `/${locale}` + search + hash;
+    }
+    return (`/${locale}${path.startsWith('/') ? path : `/${path}`}` + search + hash);
 }
 /** Strip a leading locale segment from a pathname. */
 export function stripLocalePrefix(pathname, locales) {
@@ -43,14 +49,21 @@ export function toInternalPathname(pathname, locale, pathnames) {
     return pathname;
 }
 function resolveHref(href) {
-    if (typeof href === 'string')
-        return href.startsWith('/') ? href : `/${href}`;
-    let path = href.pathname.startsWith('/') ? href.pathname : `/${href.pathname}`;
+    if (typeof href === 'string') {
+        return splitPathSearchHash(href.startsWith('/') ? href : `/${href}`);
+    }
+    let path = href.pathname.startsWith('/')
+        ? href.pathname
+        : `/${href.pathname}`;
+    // Object pathname should be path-only; tolerate accidental ?/#.
+    const split = splitPathSearchHash(path);
+    path = split.pathname;
     if (href.params) {
         for (const [key, value] of Object.entries(href.params)) {
             path = path.replace(`[${key}]`, encodeURIComponent(String(value)));
         }
     }
+    let search = split.search;
     if (href.query) {
         const qs = new URLSearchParams();
         for (const [key, value] of Object.entries(href.query)) {
@@ -58,8 +71,28 @@ function resolveHref(href) {
                 qs.set(key, String(value));
         }
         const s = qs.toString();
-        if (s)
-            path += `?${s}`;
+        search = s ? `?${s}` : '';
+    }
+    let hash = split.hash;
+    if (href.hash != null && href.hash !== '') {
+        hash = href.hash.startsWith('#') ? href.hash : `#${href.hash}`;
+    }
+    return { pathname: path, search, hash };
+}
+/** Split `/path?q=1#hash` into parts (pathnames lookup needs the path alone). */
+export function splitPathSearchHash(full) {
+    let path = full;
+    let hash = '';
+    let search = '';
+    const hashIdx = path.indexOf('#');
+    if (hashIdx >= 0) {
+        hash = path.slice(hashIdx);
+        path = path.slice(0, hashIdx);
+    }
+    const qIdx = path.indexOf('?');
+    if (qIdx >= 0) {
+        search = path.slice(qIdx);
+        path = path.slice(0, qIdx);
     }
-    return path;
+    return { pathname: path || '/', search, hash };
 }

package/dist/navigation/server.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Server-safe navigation helpers. `next-tongue/navigation` is a Client Module
+ * (`createNavigation` uses hooks) — importing it into a Server Component fails.
+ * Use this entry for Footer / layout / not-found Link + redirect.
+ *
+ * Under `prefix: 'as-needed'`, plain `next/link` with unprefixed hrefs is also fine.
+ */
+import NextLink from 'next/link';
+import type { ComponentProps, ReactNode } from 'react';
+import type { Locale, Pathname } from '../index.js';
+import { getPathname as getPathnameImpl, stripLocalePrefix, toInternalPathname, type PathnameInput } from './pathname.js';
+import type { NavigationConfig } from './config.js';
+export type { PathnameInput, NavigationConfig };
+export { getPathnameImpl as getPathname, stripLocalePrefix, toInternalPathname, };
+type Href = Pathname | PathnameInput;
+/**
+ * Server-only `createNavigation`: `Link` requires an explicit `locale` prop
+ * (no `useLocale`). For client hooks use `next-tongue/navigation`.
+ */
+export declare function createNavigation(config: NavigationConfig): {
+    Link: (props: Omit<ComponentProps<typeof NextLink>, "href"> & {
+        href: Href;
+        /** Required on the server — there is no TongueProvider hook here. */
+        locale: Locale;
+        children?: ReactNode;
+    }) => import("react").JSX.Element;
+    redirect: (args: {
+        href: Href;
+        locale: Locale;
+    }) => never;
+    permanentRedirect: (args: {
+        href: Href;
+        locale: Locale;
+    }) => never;
+    getPathname: (args: {
+        href: Href;
+        locale: Locale;
+    }) => string;
+};

package/dist/navigation/server.js

@@ -0,0 +1,55 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * Server-safe navigation helpers. `next-tongue/navigation` is a Client Module
+ * (`createNavigation` uses hooks) — importing it into a Server Component fails.
+ * Use this entry for Footer / layout / not-found Link + redirect.
+ *
+ * Under `prefix: 'as-needed'`, plain `next/link` with unprefixed hrefs is also fine.
+ */
+import NextLink from 'next/link';
+import { redirect as nextRedirect, permanentRedirect as nextPermanentRedirect, } from 'next/navigation';
+import { getPathname as getPathnameImpl, stripLocalePrefix, toInternalPathname, } from './pathname.js';
+export { getPathnameImpl as getPathname, stripLocalePrefix, toInternalPathname, };
+function bindConfig(config) {
+    return {
+        locales: config.locales,
+        defaultLocale: config.defaultLocale,
+        prefix: config.prefix ?? 'as-needed',
+        pathnames: config.pathnames,
+    };
+}
+/**
+ * Server-only `createNavigation`: `Link` requires an explicit `locale` prop
+ * (no `useLocale`). For client hooks use `next-tongue/navigation`.
+ */
+export function createNavigation(config) {
+    const bound = bindConfig(config);
+    function resolve(href, locale) {
+        const args = {
+            href: href,
+            locale,
+            locales: bound.locales,
+            defaultLocale: bound.defaultLocale,
+            prefix: bound.prefix,
+        };
+        if (bound.pathnames)
+            args.pathnames = bound.pathnames;
+        return getPathnameImpl(args);
+    }
+    function Link(props) {
+        const { href, locale, ...rest } = props;
+        return _jsx(NextLink, { href: resolve(href, locale), ...rest });
+    }
+    function redirect(args) {
+        nextRedirect(resolve(args.href, args.locale));
+    }
+    function permanentRedirect(args) {
+        nextPermanentRedirect(resolve(args.href, args.locale));
+    }
+    return {
+        Link,
+        redirect,
+        permanentRedirect,
+        getPathname: (args) => resolve(args.href, args.locale),
+    };
+}

package/dist/proxy/index.d.ts

@@ -47,6 +47,12 @@ export type CreateProxyOptions = {
     /** Override detection (domain → cookie → Accept-Language → default). */
     resolveLocale?: (req: TongueProxyRequest) => string | undefined | Promise<string | undefined>;
     onLocale?: (locale: string, req: TongueProxyRequest) => void;
+    /**
+     * Post-process every tongue response (redirect / rewrite / next).
+     * Use to re-stamp CSP / nonce headers after locale routing — tongue does
+     * not preserve headers from a prior `NextResponse.next()`.
+     */
+    wrapResponse?: (res: Response, req: TongueProxyRequest) => Response | Promise<Response>;
 };
 /** Default locale cookie name (`SameSite=Lax`). Use with `requestLocale` in API routes. */
 export declare const LOCALE_COOKIE_NAME = "TONGUE_LOCALE";
@@ -57,6 +63,15 @@ export declare const LOCALE_COOKIE_NAME = "TONGUE_LOCALE";
  * @see docs/routing-and-proxy.md
  */
 export declare function createProxy(options: CreateProxyOptions): (req: TongueProxyRequest) => Response | Promise<Response>;
+/**
+ * Copy response headers from a prior `NextResponse.next()` (CSP, nonce, …)
+ * onto a tongue rewrite/redirect/next response. Skips middleware control
+ * headers (`x-middleware-*`, `Location` when tongue already set one).
+ *
+ * Use when you stamp headers on `next()` then call tongue — tongue alone
+ * cannot see those headers.
+ */
+export declare function mergeProxyResponse(prior: Response, tongue: Response): Response;
 /** Map internal path → localized public path for a locale. */
 export declare function publicPathForLocale(internal: string, locale: string, pathnames?: Record<string, Partial<Record<string, string>>>): string;
 /** Resolve `Host` / `x-forwarded-host` against `routing.domains`. */

package/dist/proxy/index.js

@@ -37,78 +37,125 @@ export function createProxy(options) {
     if (!localeSet.has(defaultLocale)) {
         throw new Error(`[next-tongue] createProxy: defaultLocale "${defaultLocale}" is not in locales`);
     }
+    const wrap = options.wrapResponse;
     return async (req) => {
-        const { pathname } = req.nextUrl;
-        const https = isHttpsRequest(req);
-        if (isUnsafePath(pathname)) {
-            return passthrough(cookieCfg, null, https);
-        }
-        const domain = matchDomain(req, domains);
-        const activeLocales = domain?.locales ? [...domain.locales] : locales;
-        const activeDefault = domain?.defaultLocale ?? defaultLocale;
-        const activeSet = new Set(activeLocales);
-        const activeMatcher = activeLocales.length === locales.length
-            ? detectionMatcher
-            : createLocaleMatcher(activeLocales.filter((l) => !excludeDetection.has(l)));
-        const matched = matchLocalePrefix(pathname, localeSet);
-        if (matched && (!domain || activeSet.has(matched.locale))) {
-            const { locale, rest } = matched;
-            const publicRest = rest === '' ? '/' : rest;
-            const internal = toInternalPathname(publicRest, locale, pathnames);
-            if (prefix === 'as-needed' && locale === activeDefault) {
-                // Canonicalize default-locale URLs without the prefix.
-                const dest = publicPathForLocale(internal, locale, pathnames);
-                const redirectUrl = req.nextUrl.clone();
-                redirectUrl.pathname = dest;
-                options.onLocale?.(locale, req);
-                return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
-            }
+        const res = await handleProxyRequest(req, {
+            locales,
+            defaultLocale,
+            prefix,
+            localeDetection,
+            pathnames,
+            domains,
+            cookieCfg,
+            excludeDetection,
+            localeSet,
+            detectionMatcher,
+            options,
+        });
+        return wrap ? await wrap(res, req) : res;
+    };
+}
+async function handleProxyRequest(req, ctx) {
+    const { locales, defaultLocale, prefix, localeDetection, pathnames, domains, cookieCfg, excludeDetection, localeSet, detectionMatcher, options, } = ctx;
+    const { pathname } = req.nextUrl;
+    const https = isHttpsRequest(req);
+    if (isUnsafePath(pathname)) {
+        return passthrough(cookieCfg, null, https);
+    }
+    const domain = matchDomain(req, domains);
+    const activeLocales = domain?.locales ? [...domain.locales] : locales;
+    const activeDefault = domain?.defaultLocale ?? defaultLocale;
+    const activeSet = new Set(activeLocales);
+    const activeMatcher = activeLocales.length === locales.length
+        ? detectionMatcher
+        : createLocaleMatcher(activeLocales.filter((l) => !excludeDetection.has(l)));
+    const matched = matchLocalePrefix(pathname, localeSet);
+    if (matched && (!domain || activeSet.has(matched.locale))) {
+        const { locale, rest } = matched;
+        const publicRest = rest === '' ? '/' : rest;
+        const internal = toInternalPathname(publicRest, locale, pathnames);
+        if (prefix === 'as-needed' && locale === activeDefault) {
+            // Canonicalize default-locale URLs without the prefix.
+            const dest = publicPathForLocale(internal, locale, pathnames);
+            const redirectUrl = req.nextUrl.clone();
+            redirectUrl.pathname = dest;
             options.onLocale?.(locale, req);
-            if (internal !== publicRest) {
-                const url = req.nextUrl.clone();
-                url.pathname = joinLocalePath(locale, internal);
-                return rewriteResponse(url.toString(), cookieCfg, locale, https);
-            }
-            return passthrough(cookieCfg, locale, https);
+            return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
         }
-        const resolved = options.resolveLocale
-            ? await options.resolveLocale(req)
-            : undefined;
-        let locale = sanitizeLocale(resolved, activeLocales) ??
-            (localeDetection
-                ? detectLocale(req, activeLocales, activeDefault, cookieCfg, excludeDetection, activeMatcher, domain)
-                : activeDefault);
-        locale = sanitizeLocale(locale, activeLocales) ?? activeDefault;
         options.onLocale?.(locale, req);
-        const internal = toInternalPathname(pathname, locale, pathnames);
-        // Prefer localized public path when the user hit the internal key.
-        const publicPath = publicPathForLocale(internal, locale, pathnames);
-        if (prefix === 'never') {
+        if (internal !== publicRest) {
             const url = req.nextUrl.clone();
             url.pathname = joinLocalePath(locale, internal);
             return rewriteResponse(url.toString(), cookieCfg, locale, https);
         }
-        if (prefix === 'as-needed' && locale === activeDefault) {
-            // Serve default locale without prefix; rewrite to internal app path.
-            if (pathname !== publicPath && pathnames) {
-                // User visited internal `/about` but public is also `/about` — fine.
-                // If they somehow differ for default locale, redirect to public.
-                if (publicPath !== internal && pathname === internal) {
-                    const redirectUrl = req.nextUrl.clone();
-                    redirectUrl.pathname = publicPath;
-                    return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
-                }
+        return passthrough(cookieCfg, locale, https);
+    }
+    const resolved = options.resolveLocale
+        ? await options.resolveLocale(req)
+        : undefined;
+    let locale = sanitizeLocale(resolved, activeLocales) ??
+        (localeDetection
+            ? detectLocale(req, activeLocales, activeDefault, cookieCfg, excludeDetection, activeMatcher, domain)
+            : activeDefault);
+    locale = sanitizeLocale(locale, activeLocales) ?? activeDefault;
+    options.onLocale?.(locale, req);
+    const internal = toInternalPathname(pathname, locale, pathnames);
+    // Prefer localized public path when the user hit the internal key.
+    const publicPath = publicPathForLocale(internal, locale, pathnames);
+    if (prefix === 'never') {
+        const url = req.nextUrl.clone();
+        url.pathname = joinLocalePath(locale, internal);
+        return rewriteResponse(url.toString(), cookieCfg, locale, https);
+    }
+    if (prefix === 'as-needed' && locale === activeDefault) {
+        // Serve default locale without prefix; rewrite to internal app path.
+        if (pathname !== publicPath && pathnames) {
+            // User visited internal `/about` but public is also `/about` — fine.
+            // If they somehow differ for default locale, redirect to public.
+            if (publicPath !== internal && pathname === internal) {
+                const redirectUrl = req.nextUrl.clone();
+                redirectUrl.pathname = publicPath;
+                return redirectResponse(redirectUrl.toString(), 308, cookieCfg, locale, https);
             }
-            const url = req.nextUrl.clone();
-            url.pathname = joinLocalePath(activeDefault, internal);
-            return rewriteResponse(url.toString(), cookieCfg, locale, https);
         }
-        // Non-default (or always): redirect to prefixed localized public URL.
-        const destPublic = publicPathForLocale(internal, locale, pathnames);
         const url = req.nextUrl.clone();
-        url.pathname = joinLocalePath(locale, destPublic);
-        return redirectResponse(url.toString(), 307, cookieCfg, locale, https);
-    };
+        url.pathname = joinLocalePath(activeDefault, internal);
+        return rewriteResponse(url.toString(), cookieCfg, locale, https);
+    }
+    // Non-default (or always): redirect to prefixed localized public URL.
+    const destPublic = publicPathForLocale(internal, locale, pathnames);
+    const url = req.nextUrl.clone();
+    url.pathname = joinLocalePath(locale, destPublic);
+    return redirectResponse(url.toString(), 307, cookieCfg, locale, https);
+}
+/**
+ * Copy response headers from a prior `NextResponse.next()` (CSP, nonce, …)
+ * onto a tongue rewrite/redirect/next response. Skips middleware control
+ * headers (`x-middleware-*`, `Location` when tongue already set one).
+ *
+ * Use when you stamp headers on `next()` then call tongue — tongue alone
+ * cannot see those headers.
+ */
+export function mergeProxyResponse(prior, tongue) {
+    const headers = new Headers(tongue.headers);
+    prior.headers.forEach((value, key) => {
+        const k = key.toLowerCase();
+        if (k.startsWith('x-middleware-'))
+            return;
+        if (k === 'location' && headers.has('location'))
+            return;
+        if (k === 'set-cookie') {
+            headers.append(key, value);
+            return;
+        }
+        if (!headers.has(key))
+            headers.set(key, value);
+    });
+    return new Response(tongue.body, {
+        status: tongue.status,
+        statusText: tongue.statusText,
+        headers,
+    });
 }
 /** Map internal path → localized public path for a locale. */
 export function publicPathForLocale(internal, locale, pathnames) {

package/dist/server/index.d.ts

@@ -2,7 +2,19 @@ import { type Format } from '../runtime/format.js';
 import { type MessageFn, type TFunction } from '../runtime/create-t.js';
 import { getDir, getOgLocale } from '../runtime/locale.js';
 import type { Locale, Namespace } from '../index.js';
-declare let namespaceLoader: ((namespace: string) => Promise<Record<string, MessageFn>>) | undefined;
+/**
+ * Shared across duplicated `next-tongue/server` module instances (Turbopack/webpack
+ * can load the package once via the app graph and again via `#tongue/runtime`'s
+ * dynamic import). Module-local `let` would leave getT seeing an unwired copy.
+ */
+type ServerRuntimeState = {
+    locales: readonly string[];
+    defaultLocale: string;
+    timeZone: string;
+    rootParams: boolean;
+    rootLocaleReader: (() => Promise<string>) | undefined;
+    namespaceLoader: ((namespace: string) => Promise<Record<string, MessageFn>>) | undefined;
+};
 /** @internal Used by generated `.tongue/runtime.js` / tests. */
 export declare function __setServerRuntime(opts: {
     locales: readonly string[];
@@ -11,7 +23,7 @@ export declare function __setServerRuntime(opts: {
     rootParams?: boolean;
     /** Injected in tests instead of `next/root-params`. */
     readRootLocale?: () => Promise<string>;
-    loadNamespace?: typeof namespaceLoader;
+    loadNamespace?: ServerRuntimeState['namespaceLoader'];
 }): void;
 /** Whether `routing.rootParams` is enabled after `ensureTongue()`. */
 export declare function isRootParamsEnabled(): boolean;
@@ -39,8 +51,9 @@ export type MultiT<Ns extends readonly Namespace[]> = {
  * With `routing.rootParams: true`, `getT(ns)` resolves locale from `next/root-params`
  * when the single argument is a configured namespace (not a locale tag).
  *
- * `withTongue()` + generated `#tongue/runtime` auto-wires messages; an explicit
- * `ensureTongue()` call is optional.
+ * Prefer a static `import { localeParams } from '#tongue/runtime'` in the
+ * `[locale]` layout so codegen and getT share one module graph. Lazy load via
+ * getT still works (runtime state lives on `globalThis`).
  */
 export declare function getT<const Ns extends readonly [Namespace, ...Namespace[]]>(locale: Locale | string, namespaces: Ns): Promise<MultiT<Ns>>;
 export declare function getT<N extends Namespace>(locale: Locale | string, namespace: N): Promise<TFunction<N>>;

package/dist/server/index.js

@@ -2,42 +2,54 @@ import { createFormat } from '../runtime/format.js';
 import { createT } from '../runtime/create-t.js';
 import { getDir, getOgLocale, isLocale as isLocaleValue } from '../runtime/locale.js';
 import { TongueError } from '../errors.js';
-let runtimeLocales = [];
-let runtimeDefaultLocale = 'en';
-let runtimeTimeZone = 'UTC';
-let runtimeRootParams = false;
-let rootLocaleReader;
-let namespaceLoader;
+const SERVER_STATE_KEY = '__nextTongueServerRuntime';
+function serverState() {
+    const g = globalThis;
+    let s = g[SERVER_STATE_KEY];
+    if (!s) {
+        s = {
+            locales: [],
+            defaultLocale: 'en',
+            timeZone: 'UTC',
+            rootParams: false,
+            rootLocaleReader: undefined,
+            namespaceLoader: undefined,
+        };
+        g[SERVER_STATE_KEY] = s;
+    }
+    return s;
+}
 /** @internal Used by generated `.tongue/runtime.js` / tests. */
 export function __setServerRuntime(opts) {
-    runtimeLocales = opts.locales;
-    runtimeDefaultLocale = opts.defaultLocale;
-    runtimeTimeZone = opts.timeZone ?? 'UTC';
-    runtimeRootParams = opts.rootParams === true;
-    rootLocaleReader = opts.readRootLocale;
-    namespaceLoader = opts.loadNamespace;
+    const s = serverState();
+    s.locales = opts.locales;
+    s.defaultLocale = opts.defaultLocale;
+    s.timeZone = opts.timeZone ?? 'UTC';
+    s.rootParams = opts.rootParams === true;
+    s.rootLocaleReader = opts.readRootLocale;
+    s.namespaceLoader = opts.loadNamespace;
 }
 /** Whether `routing.rootParams` is enabled after `ensureTongue()`. */
 export function isRootParamsEnabled() {
-    return runtimeRootParams;
+    return serverState().rootParams;
 }
 /** Configured locales after `ensureTongue()` / `__setServerRuntime`. */
 export function getLocales() {
-    return runtimeLocales;
+    return serverState().locales;
 }
 export function getDefaultLocale() {
-    return runtimeDefaultLocale;
+    return serverState().defaultLocale;
 }
 /** @deprecated Prefer `getLocales()`; kept for docs that reference `.value`. */
 export const locales = {
     get value() {
-        return runtimeLocales;
+        return serverState().locales;
     },
 };
 /** @deprecated Prefer `getDefaultLocale()`. */
 export const defaultLocale = {
     get value() {
-        return runtimeDefaultLocale;
+        return serverState().defaultLocale;
     },
 };
 export async function getT(localeOrNs, namespace) {
@@ -57,7 +69,8 @@ export async function getT(localeOrNs, namespace) {
         return getTWithLocale(String(localeOrNs), namespace);
     }
     const single = String(localeOrNs);
-    if (runtimeRootParams && runtimeLocales.length && !runtimeLocales.includes(single)) {
+    const s = serverState();
+    if (s.rootParams && s.locales.length && !s.locales.includes(single)) {
         // Treat as namespace when it is not a configured locale tag.
         const locale = await resolveRootLocale();
         return getTWithLocale(locale, single);
@@ -68,10 +81,11 @@ export async function getT(localeOrNs, namespace) {
 async function getTWithLocale(locale, ns) {
     await ensureRuntime();
     assertLocale(locale);
-    if (!namespaceLoader) {
-        throw new TongueError('TONGUE_E_TYPES_MISSING', 'Message modules not loaded. Wrap next.config with withTongue() and run `tongue build && next build` so `#tongue/runtime` exists. (ensureTongue() is optional — getT loads it automatically.)');
+    const loader = serverState().namespaceLoader;
+    if (!loader) {
+        throw new TongueError('TONGUE_E_TYPES_MISSING', 'Message modules not loaded. Wrap next.config with withTongue(), run `tongue build && next build`, and statically import `#tongue/runtime` in app/[locale]/layout (e.g. `import { localeParams } from \'#tongue/runtime\'`). package.json must map `"#tongue/*": "./.tongue/*.js"`.');
     }
-    const messages = await namespaceLoader(ns);
+    const messages = await loader(ns);
     return createT({
         locale,
         messages,
@@ -82,10 +96,11 @@ async function getTWithLocale(locale, ns) {
 }
 /**
  * Load `#tongue/runtime` and call `ensureTongue()` once when the server runtime
- * is not yet wired (withTongue apps — no per-page ensureTongue boilerplate).
+ * is not yet wired. Prefer a static import in the [locale] layout; this lazy
+ * path uses globalThis so it shares state with that import.
  */
 async function ensureRuntime() {
-    if (namespaceLoader)
+    if (serverState().namespaceLoader)
         return;
     try {
         const importer = new Function('s', 'return import(s)');
@@ -98,14 +113,15 @@ async function ensureRuntime() {
 }
 export async function getFormat(locale, options) {
     await ensureRuntime();
-    const resolved = locale ?? (runtimeRootParams ? await resolveRootLocale() : undefined);
+    const s = serverState();
+    const resolved = locale ?? (s.rootParams ? await resolveRootLocale() : undefined);
     if (resolved == null) {
         throw new TongueError('TONGUE_E_LOCALE', 'getFormat(locale) requires a locale, or routing.rootParams: true');
     }
     assertLocale(resolved);
     return createFormat({
         locale: resolved,
-        timeZone: options?.timeZone ?? runtimeTimeZone,
+        timeZone: options?.timeZone ?? s.timeZone,
     });
 }
 /**
@@ -117,8 +133,9 @@ async function importRootParams() {
     return importer('next/root-params');
 }
 async function resolveRootLocale() {
-    if (rootLocaleReader)
-        return rootLocaleReader();
+    const reader = serverState().rootLocaleReader;
+    if (reader)
+        return reader();
     try {
         const mod = await importRootParams();
         if (typeof mod.locale !== 'function') {
@@ -140,15 +157,16 @@ async function resolveRootLocale() {
 export function isLocale(value) {
     if (typeof value !== 'string' || value === '')
         return false;
+    const configured = serverState().locales;
     // Match assertLocale: empty allow-list means runtime not wired yet.
-    if (!runtimeLocales.length) {
+    if (!configured.length) {
         return !/[\0\r\n\\/]/.test(value) && !value.includes('..');
     }
-    return isLocaleValue(value, runtimeLocales);
+    return isLocaleValue(value, configured);
 }
 /** Use as `export const generateStaticParams = localeParams` on `app/[locale]/layout`. */
 export function localeParams() {
-    return runtimeLocales.map((locale) => ({ locale }));
+    return serverState().locales.map((locale) => ({ locale }));
 }
 export function createTranslator(locale) {
     assertLocale(locale);
@@ -173,7 +191,8 @@ export { isSanctionedUnit, SIMPLE_UNITS } from '../runtime/format.js';
 export { setLocalePreference, } from './locale-preference.js';
 export { requestLocale, LOCALE_COOKIE_NAME, LOCALE_HEADER_NAME, } from './request-locale.js';
 function assertLocale(locale) {
-    if (runtimeLocales.length && !runtimeLocales.includes(locale)) {
-        throw new TongueError('TONGUE_E_LOCALE', `Locale "${locale}" is not in configured locales [${runtimeLocales.join(', ')}]`);
+    const configured = serverState().locales;
+    if (configured.length && !configured.includes(locale)) {
+        throw new TongueError('TONGUE_E_LOCALE', `Locale "${locale}" is not in configured locales [${configured.join(', ')}]`);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-tongue",
-  "version": "0.9.14",
+  "version": "0.9.16",
   "description": "Compiler-first, type-safe i18n for the Next.js 16 App Router",
   "license": "MIT",
   "type": "module",
@@ -76,6 +76,11 @@
       "import": "./dist/navigation/index.js",
       "default": "./dist/navigation/index.js"
     },
+    "./navigation/server": {
+      "types": "./dist/navigation/server.d.ts",
+      "import": "./dist/navigation/server.js",
+      "default": "./dist/navigation/server.js"
+    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "import": "./dist/testing/index.js",