@cookiemunch/next 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Every published release, newest first. Dates are the day the version was cut.
 
+## 0.1.1 (2026-10-30)
+
+- Fixed: `cookieMunchCsp` keeps a manifest's `'sha256-…'` / `'sha384-…'` / `'sha512-…'` hash sources as written instead of treating them as origins.
+
 ## 0.1.0 (2026-10-24)
 
 - Added: `<CookieMunchScript cbid culture? blockingMode? env? />`, `cookieMunchCsp({ cbid, extra? })` and `cookieMunchHeaders()` for `next.config`, and the `@cookiemunch/react` hooks re-exported.

package/dist/csp.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The Content-Security-Policy a Next.js site needs for Cookie Munch, from the site's own embed manifest
+ * (`GET /v1/embed?cbid=`, public): every origin the banner, the API and anything the site's config adds
+ * are served from. Merged with your own directives, `'self'` first.
+ *
+ *   // next.config.mjs
+ *   import { cookieMunchHeaders } from '@cookiemunch/next';
+ *   export default { headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'img-src': ['https://images.example.com'] } }) };
+ */
+export interface CspOptions {
+    cbid: string;
+    /** Your own directives, merged in (e.g. `{ 'script-src': ['https://js.stripe.com'] }`). */
+    extra?: Record<string, string[]>;
+    /** The API origin. Default `https://api.cookiemunch.net`. */
+    apiBase?: string;
+    fetch?: typeof fetch;
+}
+interface Manifest {
+    surfaces?: Record<string, {
+        csp?: Record<string, unknown>;
+        requires?: Record<string, unknown>;
+    }>;
+}
+/** The policy as a map, directive → sources (`'self'` first); exported for tests and custom headers. */
+export declare function mergePolicy(manifest: Manifest, extra?: Record<string, string[]>): Map<string, string[]>;
+export declare function policyString(policy: Map<string, string[]>): string;
+/** The `Content-Security-Policy` value for the site. Throws when the manifest cannot be read (a build should fail loudly). */
+export declare function cookieMunchCsp(o: CspOptions): Promise<string>;
+/** `next.config` `headers()`: the policy on every path. */
+export declare function cookieMunchHeaders(o: CspOptions & {
+    source?: string;
+}): Promise<Array<{
+    source: string;
+    headers: Array<{
+        key: string;
+        value: string;
+    }>;
+}>>;
+export {};

package/dist/index.d.ts

@@ -1,58 +1,3 @@
-import * as react from 'react';
-export { CONSENT_COOKIE_NAME, ConsentGate, ConsentGateProps, ConsentProvider, ConsentProviderProps, CookieSettingsLink, CookieSettingsLinkProps, consentCookie, isGranted, parseConsentCookie, useBannerInset, useConsent } from '@cookiemunch/react';
-
-/** The Cookie Munch tag for `app/layout.tsx`, first in `<head>`: a Server Component, nothing runs on the client. */
-interface CookieMunchScriptProps {
-    /** Your site's id (`data-cbid`). */
-    cbid: string;
-    /** The banner's language, e.g. `de` (`data-culture`). Default: the visitor's. */
-    culture?: string;
-    /** `auto` (the default) blocks third-party scripts until consent; `manual` honours `data-cookieconsent` markup only. */
-    blockingMode?: 'auto' | 'manual';
-    /** `test` on development and preview origins: the banner shows to headless browsers and nothing reaches your log. */
-    env?: 'test';
-    /** The embed's origin. Default `https://cdn.cookiemunch.net`. */
-    src?: string;
-}
-declare function CookieMunchScript({ cbid, culture, blockingMode, env, src }: CookieMunchScriptProps): react.JSX.Element;
-
-/**
- * The Content-Security-Policy a Next.js site needs for Cookie Munch, from the site's own embed manifest
- * (`GET /v1/embed?cbid=`, public): every origin the banner, the API and anything the site's config adds
- * are served from. Merged with your own directives, `'self'` first.
- *
- *   // next.config.mjs
- *   import { cookieMunchHeaders } from '@cookiemunch/next';
- *   export default { headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'img-src': ['https://images.example.com'] } }) };
- */
-interface CspOptions {
-    cbid: string;
-    /** Your own directives, merged in (e.g. `{ 'script-src': ['https://js.stripe.com'] }`). */
-    extra?: Record<string, string[]>;
-    /** The API origin. Default `https://api.cookiemunch.net`. */
-    apiBase?: string;
-    fetch?: typeof fetch;
-}
-interface Manifest {
-    surfaces?: Record<string, {
-        csp?: Record<string, unknown>;
-        requires?: Record<string, unknown>;
-    }>;
-}
-/** The policy as a map, directive → sources (`'self'` first); exported for tests and custom headers. */
-declare function mergePolicy(manifest: Manifest, extra?: Record<string, string[]>): Map<string, string[]>;
-declare function policyString(policy: Map<string, string[]>): string;
-/** The `Content-Security-Policy` value for the site. Throws when the manifest cannot be read (a build should fail loudly). */
-declare function cookieMunchCsp(o: CspOptions): Promise<string>;
-/** `next.config` `headers()`: the policy on every path. */
-declare function cookieMunchHeaders(o: CspOptions & {
-    source?: string;
-}): Promise<Array<{
-    source: string;
-    headers: Array<{
-        key: string;
-        value: string;
-    }>;
-}>>;
-
-export { CookieMunchScript, type CookieMunchScriptProps, type CspOptions, cookieMunchCsp, cookieMunchHeaders, mergePolicy, policyString };
+export { CookieMunchScript, type CookieMunchScriptProps } from './script.js';
+export { cookieMunchCsp, cookieMunchHeaders, mergePolicy, policyString, type CspOptions } from './csp.js';
+export { ConsentProvider, type ConsentProviderProps, useConsent, useBannerInset, ConsentGate, type ConsentGateProps, CookieSettingsLink, type CookieSettingsLinkProps, isGranted, consentCookie, parseConsentCookie, CONSENT_COOKIE_NAME, } from '@cookiemunch/react';

package/dist/index.js

@@ -16,7 +16,7 @@ function CookieMunchScript({ cbid, culture, blockingMode = "auto", env, src = "h
 
 // src/csp.ts
 var ORIGIN = /^(https|wss):\/\/[^\s*'"{]+$/;
-var KEYWORD = /^('self'|'unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:)$/;
+var KEYWORD = /^('self'|'unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:|'sha(256|384|512)-[A-Za-z0-9+/_-]+={0,2}')$/;
 var DIRECTIVE = /^[a-z-]+-src$|^form-action$/;
 function mergePolicy(manifest, extra = {}) {
   const by = /* @__PURE__ */ new Map();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/script.tsx","../src/csp.ts","../src/index.ts"],"sourcesContent":["/** The Cookie Munch tag for `app/layout.tsx`, first in `<head>`: a Server Component, nothing runs on the client. */\n\nexport interface CookieMunchScriptProps {\n  /** Your site's id (`data-cbid`). */\n  cbid: string;\n  /** The banner's language, e.g. `de` (`data-culture`). Default: the visitor's. */\n  culture?: string;\n  /** `auto` (the default) blocks third-party scripts until consent; `manual` honours `data-cookieconsent` markup only. */\n  blockingMode?: 'auto' | 'manual';\n  /** `test` on development and preview origins: the banner shows to headless browsers and nothing reaches your log. */\n  env?: 'test';\n  /** The embed's origin. Default `https://cdn.cookiemunch.net`. */\n  src?: string;\n}\n\nexport function CookieMunchScript({ cbid, culture, blockingMode = 'auto', env, src = 'https://cdn.cookiemunch.net' }: CookieMunchScriptProps) {\n  // A plain tag, as the install snippet is: prior-blocking needs it parsed before other scripts, so no\n  // next/script strategy (they all load later).\n  return (\n    <script\n      id=\"CookieMunch\"\n      src={`${src.replace(/\\/+$/, '')}/consent.js`}\n      data-cbid={cbid}\n      data-blockingmode={blockingMode}\n      {...(culture ? { 'data-culture': culture } : {})}\n      {...(env ? { 'data-env': env } : {})}\n    />\n  );\n}\n","/**\n * The Content-Security-Policy a Next.js site needs for Cookie Munch, from the site's own embed manifest\n * (`GET /v1/embed?cbid=`, public): every origin the banner, the API and anything the site's config adds\n * are served from. Merged with your own directives, `'self'` first.\n *\n *   // next.config.mjs\n *   import { cookieMunchHeaders } from '@cookiemunch/next';\n *   export default { headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'img-src': ['https://images.example.com'] } }) };\n */\n\nexport interface CspOptions {\n  cbid: string;\n  /** Your own directives, merged in (e.g. `{ 'script-src': ['https://js.stripe.com'] }`). */\n  extra?: Record<string, string[]>;\n  /** The API origin. Default `https://api.cookiemunch.net`. */\n  apiBase?: string;\n  fetch?: typeof fetch;\n}\n\ninterface Manifest {\n  surfaces?: Record<string, { csp?: Record<string, unknown>; requires?: Record<string, unknown> }>;\n}\n\nconst ORIGIN = /^(https|wss):\\/\\/[^\\s*'\"{]+$/;\nconst KEYWORD = /^('self'|'unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:)$/;\nconst DIRECTIVE = /^[a-z-]+-src$|^form-action$/;\n\n/** The policy as a map, directive → sources (`'self'` first); exported for tests and custom headers. */\nexport function mergePolicy(manifest: Manifest, extra: Record<string, string[]> = {}): Map<string, string[]> {\n  const by = new Map<string, Set<string>>();\n  const add = (d: string, list: unknown, keywords: boolean) => {\n    if (!DIRECTIVE.test(d) || !Array.isArray(list)) return;\n    const set = by.get(d) ?? new Set<string>();\n    by.set(d, set);\n    for (const s of list) if (typeof s === 'string' && (ORIGIN.test(s) || (keywords && KEYWORD.test(s)))) set.add(s);\n  };\n  for (const s of Object.values(manifest.surfaces ?? {})) {\n    for (const [d, l] of Object.entries(s.csp ?? {})) add(d, l, false);\n    for (const [d, l] of Object.entries(s.requires ?? {})) add(d, l, true);\n  }\n  for (const [d, l] of Object.entries(extra)) add(d, l, true);\n  const out = new Map<string, string[]>([['default-src', [\"'self'\"]]]);\n  for (const [d, set] of [...by.entries()].sort(([a], [b]) => a.localeCompare(b))) {\n    const rest = [...set].filter((s) => s !== \"'self'\");\n    out.set(d, [\"'self'\", ...rest.filter((s) => !ORIGIN.test(s)).sort(), ...rest.filter((s) => ORIGIN.test(s)).sort()]);\n  }\n  return out;\n}\n\nexport function policyString(policy: Map<string, string[]>): string {\n  return [...policy.entries()].map(([d, l]) => `${d} ${l.join(' ')}`).join('; ');\n}\n\n/** The `Content-Security-Policy` value for the site. Throws when the manifest cannot be read (a build should fail loudly). */\nexport async function cookieMunchCsp(o: CspOptions): Promise<string> {\n  const base = (o.apiBase ?? 'https://api.cookiemunch.net').replace(/\\/+$/, '');\n  const res = await (o.fetch ?? fetch)(`${base}/v1/embed?cbid=${encodeURIComponent(o.cbid)}`, { headers: { Accept: 'application/json', 'User-Agent': 'cookiemunch-next/0.1.0' } });\n  if (!res.ok) throw new Error(`Cookie Munch: the embed manifest for ${o.cbid} answered ${res.status}`);\n  return policyString(mergePolicy((await res.json()) as Manifest, o.extra));\n}\n\n/** `next.config` `headers()`: the policy on every path. */\nexport async function cookieMunchHeaders(o: CspOptions & { source?: string }): Promise<Array<{ source: string; headers: Array<{ key: string; value: string }> }>> {\n  return [{ source: o.source ?? '/(.*)', headers: [{ key: 'Content-Security-Policy', value: await cookieMunchCsp(o) }] }];\n}\n","// @cookiemunch/next: the tag, the CSP, and the React hooks, for the Next.js App Router.\n// No directive here: the tag and the CSP are server code; the hooks carry their own client boundary.\nexport { CookieMunchScript, type CookieMunchScriptProps } from './script.js';\nexport { cookieMunchCsp, cookieMunchHeaders, mergePolicy, policyString, type CspOptions } from './csp.js';\nexport {\n  ConsentProvider,\n  type ConsentProviderProps,\n  useConsent,\n  useBannerInset,\n  ConsentGate,\n  type ConsentGateProps,\n  CookieSettingsLink,\n  type CookieSettingsLinkProps,\n  isGranted,\n  consentCookie,\n  parseConsentCookie,\n  CONSENT_COOKIE_NAME,\n} from '@cookiemunch/react';\n"],"mappings":";AAmBI;AAJG,SAAS,kBAAkB,EAAE,MAAM,SAAS,eAAe,QAAQ,KAAK,MAAM,8BAA8B,GAA2B;AAG5I,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAG;AAAA,MACH,KAAK,GAAG,IAAI,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC/B,aAAW;AAAA,MACX,qBAAmB;AAAA,MAClB,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,MAC7C,GAAI,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;AAAA;AAAA,EACpC;AAEJ;;;ACLA,IAAM,SAAS;AACf,IAAM,UAAU;AAChB,IAAM,YAAY;AAGX,SAAS,YAAY,UAAoB,QAAkC,CAAC,GAA0B;AAC3G,QAAM,KAAK,oBAAI,IAAyB;AACxC,QAAM,MAAM,CAAC,GAAW,MAAe,aAAsB;AAC3D,QAAI,CAAC,UAAU,KAAK,CAAC,KAAK,CAAC,MAAM,QAAQ,IAAI,EAAG;AAChD,UAAM,MAAM,GAAG,IAAI,CAAC,KAAK,oBAAI,IAAY;AACzC,OAAG,IAAI,GAAG,GAAG;AACb,eAAW,KAAK,KAAM,KAAI,OAAO,MAAM,aAAa,OAAO,KAAK,CAAC,KAAM,YAAY,QAAQ,KAAK,CAAC,GAAK,KAAI,IAAI,CAAC;AAAA,EACjH;AACA,aAAW,KAAK,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC,GAAG;AACtD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAG,KAAI,GAAG,GAAG,KAAK;AACjE,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAG,KAAI,GAAG,GAAG,IAAI;AAAA,EACvE;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,KAAI,GAAG,GAAG,IAAI;AAC1D,QAAM,MAAM,oBAAI,IAAsB,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,aAAW,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC/E,UAAM,OAAO,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ;AAClD,QAAI,IAAI,GAAG,CAAC,UAAU,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEO,SAAS,aAAa,QAAuC;AAClE,SAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI;AAC/E;AAGA,eAAsB,eAAe,GAAgC;AACnE,QAAM,QAAQ,EAAE,WAAW,+BAA+B,QAAQ,QAAQ,EAAE;AAC5E,QAAM,MAAM,OAAO,EAAE,SAAS,OAAO,GAAG,IAAI,kBAAkB,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,oBAAoB,cAAc,yBAAyB,EAAE,CAAC;AAC/K,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wCAAwC,EAAE,IAAI,aAAa,IAAI,MAAM,EAAE;AACpG,SAAO,aAAa,YAAa,MAAM,IAAI,KAAK,GAAgB,EAAE,KAAK,CAAC;AAC1E;AAGA,eAAsB,mBAAmB,GAAyH;AAChK,SAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,SAAS,SAAS,CAAC,EAAE,KAAK,2BAA2B,OAAO,MAAM,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;AACxH;;;AC5DA;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}
+{"version":3,"sources":["../src/script.tsx","../src/csp.ts","../src/index.ts"],"sourcesContent":["/** The Cookie Munch tag for `app/layout.tsx`, first in `<head>`: a Server Component, nothing runs on the client. */\n\nexport interface CookieMunchScriptProps {\n  /** Your site's id (`data-cbid`). */\n  cbid: string;\n  /** The banner's language, e.g. `de` (`data-culture`). Default: the visitor's. */\n  culture?: string;\n  /** `auto` (the default) blocks third-party scripts until consent; `manual` honours `data-cookieconsent` markup only. */\n  blockingMode?: 'auto' | 'manual';\n  /** `test` on development and preview origins: the banner shows to headless browsers and nothing reaches your log. */\n  env?: 'test';\n  /** The embed's origin. Default `https://cdn.cookiemunch.net`. */\n  src?: string;\n}\n\nexport function CookieMunchScript({ cbid, culture, blockingMode = 'auto', env, src = 'https://cdn.cookiemunch.net' }: CookieMunchScriptProps) {\n  // A plain tag, as the install snippet is: prior-blocking needs it parsed before other scripts, so no\n  // next/script strategy (they all load later).\n  return (\n    <script\n      id=\"CookieMunch\"\n      src={`${src.replace(/\\/+$/, '')}/consent.js`}\n      data-cbid={cbid}\n      data-blockingmode={blockingMode}\n      {...(culture ? { 'data-culture': culture } : {})}\n      {...(env ? { 'data-env': env } : {})}\n    />\n  );\n}\n","/**\n * The Content-Security-Policy a Next.js site needs for Cookie Munch, from the site's own embed manifest\n * (`GET /v1/embed?cbid=`, public): every origin the banner, the API and anything the site's config adds\n * are served from. Merged with your own directives, `'self'` first.\n *\n *   // next.config.mjs\n *   import { cookieMunchHeaders } from '@cookiemunch/next';\n *   export default { headers: () => cookieMunchHeaders({ cbid: 'your-site-id', extra: { 'img-src': ['https://images.example.com'] } }) };\n */\n\nexport interface CspOptions {\n  cbid: string;\n  /** Your own directives, merged in (e.g. `{ 'script-src': ['https://js.stripe.com'] }`). */\n  extra?: Record<string, string[]>;\n  /** The API origin. Default `https://api.cookiemunch.net`. */\n  apiBase?: string;\n  fetch?: typeof fetch;\n}\n\ninterface Manifest {\n  surfaces?: Record<string, { csp?: Record<string, unknown>; requires?: Record<string, unknown> }>;\n}\n\nconst ORIGIN = /^(https|wss):\\/\\/[^\\s*'\"{]+$/;\n// A hash source ('sha256-…') is a keyword here: copied verbatim, never read as an origin.\nconst KEYWORD = /^('self'|'unsafe-inline'|'unsafe-eval'|'wasm-unsafe-eval'|'unsafe-hashes'|data:|blob:|'sha(256|384|512)-[A-Za-z0-9+/_-]+={0,2}')$/;\nconst DIRECTIVE = /^[a-z-]+-src$|^form-action$/;\n\n/** The policy as a map, directive → sources (`'self'` first); exported for tests and custom headers. */\nexport function mergePolicy(manifest: Manifest, extra: Record<string, string[]> = {}): Map<string, string[]> {\n  const by = new Map<string, Set<string>>();\n  const add = (d: string, list: unknown, keywords: boolean) => {\n    if (!DIRECTIVE.test(d) || !Array.isArray(list)) return;\n    const set = by.get(d) ?? new Set<string>();\n    by.set(d, set);\n    for (const s of list) if (typeof s === 'string' && (ORIGIN.test(s) || (keywords && KEYWORD.test(s)))) set.add(s);\n  };\n  for (const s of Object.values(manifest.surfaces ?? {})) {\n    for (const [d, l] of Object.entries(s.csp ?? {})) add(d, l, false);\n    for (const [d, l] of Object.entries(s.requires ?? {})) add(d, l, true);\n  }\n  for (const [d, l] of Object.entries(extra)) add(d, l, true);\n  const out = new Map<string, string[]>([['default-src', [\"'self'\"]]]);\n  for (const [d, set] of [...by.entries()].sort(([a], [b]) => a.localeCompare(b))) {\n    const rest = [...set].filter((s) => s !== \"'self'\");\n    out.set(d, [\"'self'\", ...rest.filter((s) => !ORIGIN.test(s)).sort(), ...rest.filter((s) => ORIGIN.test(s)).sort()]);\n  }\n  return out;\n}\n\nexport function policyString(policy: Map<string, string[]>): string {\n  return [...policy.entries()].map(([d, l]) => `${d} ${l.join(' ')}`).join('; ');\n}\n\n/** The `Content-Security-Policy` value for the site. Throws when the manifest cannot be read (a build should fail loudly). */\nexport async function cookieMunchCsp(o: CspOptions): Promise<string> {\n  const base = (o.apiBase ?? 'https://api.cookiemunch.net').replace(/\\/+$/, '');\n  const res = await (o.fetch ?? fetch)(`${base}/v1/embed?cbid=${encodeURIComponent(o.cbid)}`, { headers: { Accept: 'application/json', 'User-Agent': 'cookiemunch-next/0.1.0' } });\n  if (!res.ok) throw new Error(`Cookie Munch: the embed manifest for ${o.cbid} answered ${res.status}`);\n  return policyString(mergePolicy((await res.json()) as Manifest, o.extra));\n}\n\n/** `next.config` `headers()`: the policy on every path. */\nexport async function cookieMunchHeaders(o: CspOptions & { source?: string }): Promise<Array<{ source: string; headers: Array<{ key: string; value: string }> }>> {\n  return [{ source: o.source ?? '/(.*)', headers: [{ key: 'Content-Security-Policy', value: await cookieMunchCsp(o) }] }];\n}\n","// @cookiemunch/next: the tag, the CSP, and the React hooks, for the Next.js App Router.\n// No directive here: the tag and the CSP are server code; the hooks carry their own client boundary.\nexport { CookieMunchScript, type CookieMunchScriptProps } from './script.js';\nexport { cookieMunchCsp, cookieMunchHeaders, mergePolicy, policyString, type CspOptions } from './csp.js';\nexport {\n  ConsentProvider,\n  type ConsentProviderProps,\n  useConsent,\n  useBannerInset,\n  ConsentGate,\n  type ConsentGateProps,\n  CookieSettingsLink,\n  type CookieSettingsLinkProps,\n  isGranted,\n  consentCookie,\n  parseConsentCookie,\n  CONSENT_COOKIE_NAME,\n} from '@cookiemunch/react';\n"],"mappings":";AAmBI;AAJG,SAAS,kBAAkB,EAAE,MAAM,SAAS,eAAe,QAAQ,KAAK,MAAM,8BAA8B,GAA2B;AAG5I,SACE;AAAA,IAAC;AAAA;AAAA,MACC,IAAG;AAAA,MACH,KAAK,GAAG,IAAI,QAAQ,QAAQ,EAAE,CAAC;AAAA,MAC/B,aAAW;AAAA,MACX,qBAAmB;AAAA,MAClB,GAAI,UAAU,EAAE,gBAAgB,QAAQ,IAAI,CAAC;AAAA,MAC7C,GAAI,MAAM,EAAE,YAAY,IAAI,IAAI,CAAC;AAAA;AAAA,EACpC;AAEJ;;;ACLA,IAAM,SAAS;AAEf,IAAM,UAAU;AAChB,IAAM,YAAY;AAGX,SAAS,YAAY,UAAoB,QAAkC,CAAC,GAA0B;AAC3G,QAAM,KAAK,oBAAI,IAAyB;AACxC,QAAM,MAAM,CAAC,GAAW,MAAe,aAAsB;AAC3D,QAAI,CAAC,UAAU,KAAK,CAAC,KAAK,CAAC,MAAM,QAAQ,IAAI,EAAG;AAChD,UAAM,MAAM,GAAG,IAAI,CAAC,KAAK,oBAAI,IAAY;AACzC,OAAG,IAAI,GAAG,GAAG;AACb,eAAW,KAAK,KAAM,KAAI,OAAO,MAAM,aAAa,OAAO,KAAK,CAAC,KAAM,YAAY,QAAQ,KAAK,CAAC,GAAK,KAAI,IAAI,CAAC;AAAA,EACjH;AACA,aAAW,KAAK,OAAO,OAAO,SAAS,YAAY,CAAC,CAAC,GAAG;AACtD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,CAAC,CAAC,EAAG,KAAI,GAAG,GAAG,KAAK;AACjE,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAG,KAAI,GAAG,GAAG,IAAI;AAAA,EACvE;AACA,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,KAAI,GAAG,GAAG,IAAI;AAC1D,QAAM,MAAM,oBAAI,IAAsB,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;AACnE,aAAW,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAAG;AAC/E,UAAM,OAAO,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,MAAM,MAAM,QAAQ;AAClD,QAAI,IAAI,GAAG,CAAC,UAAU,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,GAAG,KAAK,OAAO,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAAA,EACpH;AACA,SAAO;AACT;AAEO,SAAS,aAAa,QAAuC;AAClE,SAAO,CAAC,GAAG,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI;AAC/E;AAGA,eAAsB,eAAe,GAAgC;AACnE,QAAM,QAAQ,EAAE,WAAW,+BAA+B,QAAQ,QAAQ,EAAE;AAC5E,QAAM,MAAM,OAAO,EAAE,SAAS,OAAO,GAAG,IAAI,kBAAkB,mBAAmB,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,oBAAoB,cAAc,yBAAyB,EAAE,CAAC;AAC/K,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,wCAAwC,EAAE,IAAI,aAAa,IAAI,MAAM,EAAE;AACpG,SAAO,aAAa,YAAa,MAAM,IAAI,KAAK,GAAgB,EAAE,KAAK,CAAC;AAC1E;AAGA,eAAsB,mBAAmB,GAAyH;AAChK,SAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,SAAS,SAAS,CAAC,EAAE,KAAK,2BAA2B,OAAO,MAAM,eAAe,CAAC,EAAE,CAAC,EAAE,CAAC;AACxH;;;AC7DA;AAAA,EACE;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;","names":[]}

package/dist/script.d.ts

@@ -0,0 +1,14 @@
+/** The Cookie Munch tag for `app/layout.tsx`, first in `<head>`: a Server Component, nothing runs on the client. */
+export interface CookieMunchScriptProps {
+    /** Your site's id (`data-cbid`). */
+    cbid: string;
+    /** The banner's language, e.g. `de` (`data-culture`). Default: the visitor's. */
+    culture?: string;
+    /** `auto` (the default) blocks third-party scripts until consent; `manual` honours `data-cookieconsent` markup only. */
+    blockingMode?: 'auto' | 'manual';
+    /** `test` on development and preview origins: the banner shows to headless browsers and nothing reaches your log. */
+    env?: 'test';
+    /** The embed's origin. Default `https://cdn.cookiemunch.net`. */
+    src?: string;
+}
+export declare function CookieMunchScript({ cbid, culture, blockingMode, env, src }: CookieMunchScriptProps): import("react").JSX.Element;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cookiemunch/next",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Cookie Munch for the Next.js App Router: the tag, the Content-Security-Policy, and the React hooks",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,7 +18,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup",
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup && tsc -p tsconfig.json --emitDeclarationOnly --declaration",
     "test": "vitest run"
   },
   "dependencies": {