@cookiemunch/next 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog: @cookiemunch/next
+
+Every published release, newest first. Dates are the day the version was cut.
+
+## 0.1.1 (2026-10-30)
+
+- Fixed: `cookieMunchCsp` keeps a manifest's `'sha256-…'` / `'sha384-…'` / `'sha512-…'` hash sources as written instead of treating them as origins.
+
+## 0.1.0 (2026-10-24)
+
+- Added: `<CookieMunchScript cbid culture? blockingMode? env? />`, `cookieMunchCsp({ cbid, extra? })` and `cookieMunchHeaders()` for `next.config`, and the `@cookiemunch/react` hooks re-exported.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cookie Munch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,32 @@
-# Temporary Holding Version
+# @cookiemunch/next
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Cookie Munch for the Next.js App Router: the tag, the Content-Security-Policy, and the React hooks.
+
+```tsx
+// app/layout.tsx
+import { CookieMunchScript } from '@cookiemunch/next';
+
+export default function RootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en">
+      <head>
+        <CookieMunchScript cbid="your-site-id" />
+      </head>
+      <body>{children}</body>
+    </html>
+  );
+}
+```
+
+```js
+// next.config.mjs
+import { cookieMunchHeaders } from '@cookiemunch/next';
+
+export default {
+  headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'script-src': ['https://js.stripe.com'] } }),
+};
+```
+
+`useConsent()`, `useBannerInset()`, `<ConsentGate>` and `<CookieSettingsLink>` are re-exported from
+[`@cookiemunch/react`](https://www.npmjs.com/package/@cookiemunch/react). `useConsent()` tells "not decided
+yet" apart from "refused". Docs: [cookiemunch.net/docs/nextjs](https://cookiemunch.net/docs/nextjs).

package/dist/csp.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The Content-Security-Policy a Next.js site needs for Cookie Munch, from the site's own embed manifest
+ * (`GET /v1/embed?cbid=`, public): every origin the banner, the API and anything the site's config adds
+ * are served from. Merged with your own directives, `'self'` first.
+ *
+ *   // next.config.mjs
+ *   import { cookieMunchHeaders } from '@cookiemunch/next';
+ *   export default { headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'img-src': ['https://images.example.com'] } }) };
+ */
+export interface CspOptions {
+    cbid: string;
+    /** Your own directives, merged in (e.g. `{ 'script-src': ['https://js.stripe.com'] }`). */
+    extra?: Record<string, string[]>;
+    /** The API origin. Default `https://api.cookiemunch.net`. */
+    apiBase?: string;
+    fetch?: typeof fetch;
+}
+interface Manifest {
+    surfaces?: Record<string, {
+        csp?: Record<string, unknown>;
+        requires?: Record<string, unknown>;
+    }>;
+}
+/** The policy as a map, directive → sources (`'self'` first); exported for tests and custom headers. */
+export declare function mergePolicy(manifest: Manifest, extra?: Record<string, string[]>): Map<string, string[]>;
+export declare function policyString(policy: Map<string, string[]>): string;
+/** The `Content-Security-Policy` value for the site. Throws when the manifest cannot be read (a build should fail loudly). */
+export declare function cookieMunchCsp(o: CspOptions): Promise<string>;
+/** `next.config` `headers()`: the policy on every path. */
+export declare function cookieMunchHeaders(o: CspOptions & {
+    source?: string;
+}): Promise<Array<{
+    source: string;
+    headers: Array<{
+        key: string;
+        value: string;
+    }>;
+}>>;
+export {};

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { CookieMunchScript, type CookieMunchScriptProps } from './script.js';
+export { cookieMunchCsp, cookieMunchHeaders, mergePolicy, policyString, type CspOptions } from './csp.js';
+export { ConsentProvider, type ConsentProviderProps, useConsent, useBannerInset, ConsentGate, type ConsentGateProps, CookieSettingsLink, type CookieSettingsLinkProps, isGranted, consentCookie, parseConsentCookie, CONSENT_COOKIE_NAME, } from '@cookiemunch/react';

package/dist/index.js

@@ -0,0 +1,82 @@
+// src/script.tsx
+import { jsx } from "react/jsx-runtime";
+function CookieMunchScript({ cbid, culture, blockingMode = "auto", env, src = "https://cdn.cookiemunch.net" }) {
+  return /* @__PURE__ */ jsx(
+    "script",
+    {
+      id: "CookieMunch",
+      src: `${src.replace(/\/+$/, "")}/consent.js`,
+      "data-cbid": cbid,
+      "data-blockingmode": blockingMode,
+      ...culture ? { "data-culture": culture } : {},
+      ...env ? { "data-env": env } : {}
+    }
+  );
+}
+
+// src/csp.ts
+var ORIGIN = /^(https|wss):\/\/[^\s*'"{]+$/;
+var KEYWORD = /^('self'|'unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:|'sha(256|384|512)-[A-Za-z0-9+/_-]+={0,2}')$/;
+var DIRECTIVE = /^[a-z-]+-src$|^form-action$/;
+function mergePolicy(manifest, extra = {}) {
+  const by = /* @__PURE__ */ new Map();
+  const add = (d, list, keywords) => {
+    if (!DIRECTIVE.test(d) || !Array.isArray(list)) return;
+    const set = by.get(d) ?? /* @__PURE__ */ new Set();
+    by.set(d, set);
+    for (const s of list) if (typeof s === "string" && (ORIGIN.test(s) || keywords && KEYWORD.test(s))) set.add(s);
+  };
+  for (const s of Object.values(manifest.surfaces ?? {})) {
+    for (const [d, l] of Object.entries(s.csp ?? {})) add(d, l, false);
+    for (const [d, l] of Object.entries(s.requires ?? {})) add(d, l, true);
+  }
+  for (const [d, l] of Object.entries(extra)) add(d, l, true);
+  const out = /* @__PURE__ */ new Map([["default-src", ["'self'"]]]);
+  for (const [d, set] of [...by.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    const rest = [...set].filter((s) => s !== "'self'");
+    out.set(d, ["'self'", ...rest.filter((s) => !ORIGIN.test(s)).sort(), ...rest.filter((s) => ORIGIN.test(s)).sort()]);
+  }
+  return out;
+}
+function policyString(policy) {
+  return [...policy.entries()].map(([d, l]) => `${d} ${l.join(" ")}`).join("; ");
+}
+async function cookieMunchCsp(o) {
+  const base = (o.apiBase ?? "https://api.cookiemunch.net").replace(/\/+$/, "");
+  const res = await (o.fetch ?? fetch)(`${base}/v1/embed?cbid=${encodeURIComponent(o.cbid)}`, { headers: { Accept: "application/json", "User-Agent": "cookiemunch-next/0.1.0" } });
+  if (!res.ok) throw new Error(`Cookie Munch: the embed manifest for ${o.cbid} answered ${res.status}`);
+  return policyString(mergePolicy(await res.json(), o.extra));
+}
+async function cookieMunchHeaders(o) {
+  return [{ source: o.source ?? "/(.*)", headers: [{ key: "Content-Security-Policy", value: await cookieMunchCsp(o) }] }];
+}
+
+// src/index.ts
+import {
+  ConsentProvider,
+  useConsent,
+  useBannerInset,
+  ConsentGate,
+  CookieSettingsLink,
+  isGranted,
+  consentCookie,
+  parseConsentCookie,
+  CONSENT_COOKIE_NAME
+} from "@cookiemunch/react";
+export {
+  CONSENT_COOKIE_NAME,
+  ConsentGate,
+  ConsentProvider,
+  CookieMunchScript,
+  CookieSettingsLink,
+  consentCookie,
+  cookieMunchCsp,
+  cookieMunchHeaders,
+  isGranted,
+  mergePolicy,
+  parseConsentCookie,
+  policyString,
+  useBannerInset,
+  useConsent
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/script.tsx","../src/csp.ts","../src/index.ts"],"sourcesContent":["/** The Cookie Munch tag for `app/layout.tsx`, first in `<head>`: a Server Component, nothing runs on the client. */\n\nexport interface CookieMunchScriptProps {\n  /** Your site's id (`data-cbid`). */\n  cbid: string;\n  /** The banner's language, e.g. `de` (`data-culture`). Default: the visitor's. */\n  culture?: string;\n  /** `auto` (the default) blocks third-party scripts until consent; `manual` honours `data-cookieconsent` markup only. */\n  blockingMode?: 'auto' | 'manual';\n  /** `test` on development and preview origins: the banner shows to headless browsers and nothing reaches your log. */\n  env?: 'test';\n  /** The embed's origin. Default `https://cdn.cookiemunch.net`. */\n  src?: string;\n}\n\nexport function CookieMunchScript({ cbid, culture, blockingMode = 'auto', env, src = 'https://cdn.cookiemunch.net' }: CookieMunchScriptProps) {\n  // A plain tag, as the install snippet is: prior-blocking needs it parsed before other scripts, so no\n  // next/script strategy (they all load later).\n  return (\n    <script\n      id=\"CookieMunch\"\n      src={`${src.replace(/\\/+$/, '')}/consent.js`}\n      data-cbid={cbid}\n      data-blockingmode={blockingMode}\n      {...(culture ? { 'data-culture': culture } : {})}\n      {...(env ? { 'data-env': env } : {})}\n    />\n  );\n}\n","/**\n * The Content-Security-Policy a Next.js site needs for Cookie Munch, from the site's own embed manifest\n * (`GET /v1/embed?cbid=`, public): every origin the banner, the API and anything the site's config adds\n * are served from. Merged with your own directives, `'self'` first.\n *\n *   // next.config.mjs\n *   import { cookieMunchHeaders } from '@cookiemunch/next';\n *   export default { headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'img-src': ['https://images.example.com'] } }) };\n */\n\nexport interface CspOptions {\n  cbid: string;\n  /** Your own directives, merged in (e.g. `{ 'script-src': ['https://js.stripe.com'] }`). */\n  extra?: Record<string, string[]>;\n  /** The API origin. Default `https://api.cookiemunch.net`. */\n  apiBase?: string;\n  fetch?: typeof fetch;\n}\n\ninterface Manifest {\n  surfaces?: Record<string, { csp?: Record<string, unknown>; requires?: Record<string, unknown> }>;\n}\n\nconst ORIGIN = /^(https|wss):\\/\\/[^\\s*'\"{]+$/;\n// A hash source ('sha256-…') is a keyword here: copied verbatim, never read as an origin.\nconst KEYWORD = /^('self'|'unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:|'sha(256|384|512)-[A-Za-z0-9+/_-]+={0,2}')$/;\nconst DIRECTIVE = /^[a-z-]+-src$|^form-action$/;\n\n/** The policy as a map, directive → sources (`'self'` first); exported for tests and custom headers. */\nexport function mergePolicy(manifest: Manifest, extra: Record<string, string[]> = {}): Map<string, string[]> {\n  const by = new Map<string, Set<string>>();\n  const add = (d: string, list: unknown, keywords: boolean) => {\n    if (!DIRECTIVE.test(d) || !Array.isArray(list)) return;\n    const set = by.get(d) ?? new Set<string>();\n    by.set(d, set);\n    for (const s of list) if (typeof s === 'string' && (ORIGIN.test(s) || (keywords && KEYWORD.test(s)))) set.add(s);\n  };\n  for (const s of Object.values(manifest.surfaces ?? {})) {\n    for (const [d, l] of Object.entries(s.csp ?? {})) add(d, l, false);\n    for (const [d, l] of Object.entries(s.requires ?? {})) add(d, l, true);\n  }\n  for (const [d, l] of Object.entries(extra)) add(d, l, true);\n  const out = new Map<string, string[]>([['default-src', [\"'self'\"]]]);\n  for (const [d, set] of [...by.entries()].sort(([a], [b]) => a.localeCompare(b))) {\n    const rest = [...set].filter((s) => s !== \"'self'\");\n    out.set(d, [\"'self'\", ...rest.filter((s) => !ORIGIN.test(s)).sort(), ...rest.filter((s) => ORIGIN.test(s)).sort()]);\n  }\n  return out;\n}\n\nexport function policyString(policy: Map<string, string[]>): string {\n  return [...policy.entries()].map(([d, l]) => `${d} ${l.join(' ')}`).join('; ');\n}\n\n/** The `Content-Security-Policy` value for the site. Throws when the manifest cannot be read (a build should fail loudly). */\nexport async function cookieMunchCsp(o: CspOptions): Promise<string> {\n  const base = (o.apiBase ?? 'https://api.cookiemunch.net').replace(/\\/+$/, '');\n  const res = await (o.fetch ?? fetch)(`${base}/v1/embed?cbid=${encodeURIComponent(o.cbid)}`, { headers: { Accept: 'application/json', 'User-Agent': 'cookiemunch-next/0.1.0' } });\n  if (!res.ok) throw new Error(`Cookie Munch: the embed manifest for ${o.cbid} answered ${res.status}`);\n  return policyString(mergePolicy((await res.json()) as Manifest, o.extra));\n}\n\n/** `next.config` `headers()`: the policy on every path. */\nexport async function cookieMunchHeaders(o: CspOptions & { source?: string }): Promise<Array<{ source: string; headers: Array<{ key: string; value: string }> }>> {\n  return [{ source: o.source ?? '/(.*)', headers: [{ key: 'Content-Security-Policy', value: await cookieMunchCsp(o) }] }];\n}\n","// @cookiemunch/next: the tag, the CSP, and the React hooks, for the Next.js App Router.\n// No directive here: the tag and the CSP are server code; the hooks carry their own client boundary.\nexport { CookieMunchScript, type CookieMunchScriptProps } from './script.js';\nexport { cookieMunchCsp, cookieMunchHeaders, mergePolicy, policyString, type CspOptions } from './csp.js';\nexport {\n  ConsentProvider,\n  type ConsentProviderProps,\n  useConsent,\n  useBannerInset,\n  ConsentGate,\n  type ConsentGateProps,\n  CookieSettingsLink,\n  type CookieSettingsLinkProps,\n  isGranted,\n  consentCookie,\n  parseConsentCookie,\n  CONSENT_COOKIE_NAME,\n} from '@cookiemunch/react';\n"],"mappings":";AAmBI;AAJG,SAAS,kBAAkB,EAAE,MAAM,SAAS,eAAe,QAAQ,KAAK,MAAM,8BAA8B,GAA2B;AAG5I,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAG;AAAA,MACH,KAAK,GAAG,IAAI,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC/B,aAAW;AAAA,MACX,qBAAmB;AAAA,MAClB,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,MAC7C,GAAI,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;AAAA;AAAA,EACpC;AAEJ;;;ACLA,IAAM,SAAS;AAEf,IAAM,UAAU;AAChB,IAAM,YAAY;AAGX,SAAS,YAAY,UAAoB,QAAkC,CAAC,GAA0B;AAC3G,QAAM,KAAK,oBAAI,IAAyB;AACxC,QAAM,MAAM,CAAC,GAAW,MAAe,aAAsB;AAC3D,QAAI,CAAC,UAAU,KAAK,CAAC,KAAK,CAAC,MAAM,QAAQ,IAAI,EAAG;AAChD,UAAM,MAAM,GAAG,IAAI,CAAC,KAAK,oBAAI,IAAY;AACzC,OAAG,IAAI,GAAG,GAAG;AACb,eAAW,KAAK,KAAM,KAAI,OAAO,MAAM,aAAa,OAAO,KAAK,CAAC,KAAM,YAAY,QAAQ,KAAK,CAAC,GAAK,KAAI,IAAI,CAAC;AAAA,EACjH;AACA,aAAW,KAAK,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC,GAAG;AACtD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAG,KAAI,GAAG,GAAG,KAAK;AACjE,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAG,KAAI,GAAG,GAAG,IAAI;AAAA,EACvE;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,KAAI,GAAG,GAAG,IAAI;AAC1D,QAAM,MAAM,oBAAI,IAAsB,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,aAAW,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC/E,UAAM,OAAO,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ;AAClD,QAAI,IAAI,GAAG,CAAC,UAAU,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEO,SAAS,aAAa,QAAuC;AAClE,SAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI;AAC/E;AAGA,eAAsB,eAAe,GAAgC;AACnE,QAAM,QAAQ,EAAE,WAAW,+BAA+B,QAAQ,QAAQ,EAAE;AAC5E,QAAM,MAAM,OAAO,EAAE,SAAS,OAAO,GAAG,IAAI,kBAAkB,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,oBAAoB,cAAc,yBAAyB,EAAE,CAAC;AAC/K,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wCAAwC,EAAE,IAAI,aAAa,IAAI,MAAM,EAAE;AACpG,SAAO,aAAa,YAAa,MAAM,IAAI,KAAK,GAAgB,EAAE,KAAK,CAAC;AAC1E;AAGA,eAAsB,mBAAmB,GAAyH;AAChK,SAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,SAAS,SAAS,CAAC,EAAE,KAAK,2BAA2B,OAAO,MAAM,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;AACxH;;;AC7DA;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/script.d.ts

@@ -0,0 +1,14 @@
+/** The Cookie Munch tag for `app/layout.tsx`, first in `<head>`: a Server Component, nothing runs on the client. */
+export interface CookieMunchScriptProps {
+    /** Your site's id (`data-cbid`). */
+    cbid: string;
+    /** The banner's language, e.g. `de` (`data-culture`). Default: the visitor's. */
+    culture?: string;
+    /** `auto` (the default) blocks third-party scripts until consent; `manual` honours `data-cookieconsent` markup only. */
+    blockingMode?: 'auto' | 'manual';
+    /** `test` on development and preview origins: the banner shows to headless browsers and nothing reaches your log. */
+    env?: 'test';
+    /** The embed's origin. Default `https://cdn.cookiemunch.net`. */
+    src?: string;
+}
+export declare function CookieMunchScript({ cbid, culture, blockingMode, env, src }: CookieMunchScriptProps): import("react").JSX.Element;

package/package.json

@@ -1,6 +1,49 @@
 {
   "name": "@cookiemunch/next",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Cookie Munch for the Next.js App Router: the tag, the Content-Security-Policy, and the React hooks",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup && tsc -p tsconfig.json --emitDeclarationOnly --declaration",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@cookiemunch/react": "^0.3.0"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cookie-Munch/next.git"
+  },
+  "homepage": "https://cookiemunch.net/docs/nextjs",
+  "bugs": {
+    "url": "https://github.com/Cookie-Munch/next/issues"
+  },
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "22.20.0",
+    "@types/react": "19.2.17",
+    "@types/react-dom": "19.2.3",
+    "react": "19.2.7",
+    "react-dom": "19.2.7",
+    "tsup": "8.5.1",
+    "typescript": "5.9.3",
+    "vitest": "2.1.9"
+  }
+}