cloudflare-next-intl 0.6.16 → 0.6.18

package/dist/src/cookie_consent/client/components/cookie_consent_analytics.js

@@ -18,23 +18,24 @@ const ClarityScript = dynamic(() => import('./clarity_script'));
  * `false` — render manually instead if you set `autoWireAnalytics: false`.
  */
 export default function CookieConsentAnalytics({ config }) {
-    const { consent } = useCookieConsent();
+    const { consent, requiresConsent } = useCookieConsent();
+    const granted = consent === true || !requiresConsent;
     useEffect(() => {
-        if (consent === null)
+        if (consent === null && requiresConsent)
             return;
         const w = window;
         if (typeof w.gtag !== 'function')
             return;
-        const state = consent ? 'granted' : 'denied';
+        const state = granted ? 'granted' : 'denied';
         w.gtag('consent', 'update', {
             ad_storage: state,
             ad_user_data: state,
             ad_personalization: state,
             analytics_storage: state,
         });
-    }, [consent]);
+    }, [consent, requiresConsent, granted]);
     const hasGoogle = Boolean(config.googleAnalyticsId || config.googleAdsId || config.googleAdSenseId);
-    return (_jsxs(_Fragment, { children: [hasGoogle && (_jsx("script", { id: "cookie-consent-google-consent-mode", dangerouslySetInnerHTML: { __html: googleConsentModeBootstrapScript(config) } })), consent === true && config.cloudflareBeaconToken && (_jsx("script", { defer: true, src: "https://static.cloudflareinsights.com/beacon.min.js", "data-cf-beacon": config.cloudflareBeaconToken })), consent === true && config.clarityProjectId && _jsx(ClarityScript, { projectId: config.clarityProjectId })] }));
+    return (_jsxs(_Fragment, { children: [hasGoogle && (_jsx("script", { id: "cookie-consent-google-consent-mode", dangerouslySetInnerHTML: { __html: googleConsentModeBootstrapScript(config) } })), granted && config.cloudflareBeaconToken && (_jsx("script", { defer: true, src: "https://static.cloudflareinsights.com/beacon.min.js", "data-cf-beacon": config.cloudflareBeaconToken })), granted && config.clarityProjectId && _jsx(ClarityScript, { projectId: config.clarityProjectId })] }));
 }
 /**
  * Denies storage by default and loads the configured Google tags; the

package/dist/src/cookie_consent/client/components/cookie_consent_dialog.js

@@ -13,8 +13,8 @@ import { defaultCookieDialogClassNames } from './default_dialog_styles';
  * particular design system.
  */
 export default function CookieConsentDialog({ message, link, privacyPolicyLinkText, acceptText, declineText, hideDecline = false, id = 'cookie-consent-dialog', classNames, styles, render, }) {
-    const { consent, isMounted, setConsent, privacyPolicyPath } = useCookieConsent();
-    if (!isMounted || consent !== null)
+    const { consent, requiresConsent, isMounted, setConsent, privacyPolicyPath } = useCookieConsent();
+    if (!isMounted || !requiresConsent || consent !== null)
         return null;
     if (render)
         return _jsx(_Fragment, { children: render({ setConsent }) });

package/dist/src/cookie_consent/client/cookie_consent_provider.js

@@ -65,19 +65,18 @@ export default function CookieConsentProvider({ requiresConsent = true, children
     const [isMounted, setIsMounted] = useState(false);
     const pathname = usePathname();
     useEffect(() => {
-        // `undefined` (no cookie at all) means a genuine first visit — auto-
-        // accept applies. `'null'` (explicitly stored by `setConsent(null)`,
-        // e.g. a "cookie settings" button) means the visitor already decided
-        // once and is being asked to re-decide, so it must NOT auto-accept
-        // again — otherwise it'd immediately flip back to `true` whenever
-        // `requiresConsent` is `false` (e.g. always in dev, see
-        // `resolveRequiresConsent`), reopening then instantly re-closing the
-        // dialog on the next navigation/refresh.
+        // `consent` reflects only what the visitor actually decided — never
+        // auto-set to `true` just because `requiresConsent` is `false`.
+        // Whether the banner shows / analytics unlock for a not-required
+        // visitor is `requiresConsent`'s job (see `CookieConsentDialog`/
+        // `CookieConsentAnalytics`), not something baked into `consent`
+        // itself; otherwise there's no way to tell "not required" apart
+        // from "explicitly accepted" (e.g. the settings button in the nav
+        // bar, which only renders once consent has been decided).
         const rawConsent = getCookie(consentCookieName);
         const storedConsent = parseConsent(rawConsent);
         const isFirstVisit = rawConsent === null;
-        const autoAccepted = isFirstVisit && !requiresConsent;
-        setConsentState(autoAccepted ? true : storedConsent);
+        setConsentState(storedConsent);
         setIsMounted(true);
         if (isFirstVisit || !policyDate)
             return;
@@ -121,6 +120,6 @@ export default function CookieConsentProvider({ requiresConsent = true, children
             acknowledgePrivacyPolicyUpdate();
         }
     }, [pathname, privacyPolicyUpdated, privacyPolicyPath, acknowledgePrivacyPolicyUpdate]);
-    const contextValue = useMemo(() => ({ consent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath }), [consent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath]);
+    const contextValue = useMemo(() => ({ consent, requiresConsent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath }), [consent, requiresConsent, privacyPolicyUpdated, isMounted, setConsent, acknowledgePrivacyPolicyUpdate, privacyPolicyPath]);
     return (_jsx(CookieConsentContext.Provider, { value: contextValue, children: children }));
 }

package/dist/src/cookie_consent/types.d.ts

@@ -4,6 +4,15 @@ export type ConsentValue = boolean | null;
 export interface CookieConsentContextType {
     /** Current consent value; `null` until the visitor decides. */
     consent: ConsentValue;
+    /**
+     * Resolved server-side from `cookieConsent.getCountryCode`/
+     * `gdprCountries` (see `resolveRequiresConsent`). `false` means the
+     * visitor's country doesn't require consent at all — the default
+     * `CookieConsentDialog` stays hidden and `CookieConsentAnalytics`
+     * unlocks immediately, even while `consent` itself is still `null`
+     * (never decided, since there was nothing to decide).
+     */
+    requiresConsent: boolean;
     /**
      * `false` until the client has read the stored consent/date cookies once
      * (always `false` during SSR and the first client render, to avoid a

package/dist/src/server/components/server_provider.d.ts

@@ -17,11 +17,12 @@ import type { TranslationObject } from "../../types/types";
  *   to serve from static rendering / ISR — i.e. the caller already knows
  *   the current route never needs a server-resolved auth user (a public
  *   page: marketing, privacy policy, docs, etc). Concretely, setting this
- *   to `true` skips the internal `resolveAuthUserAndRedirect()` call.
+ *   to `true` (the default) skips the internal `resolveAuthUserAndRedirect()`
+ *   call. Pass `staticSafe: false` to opt back into resolving it.
  *
- *   ── Why this call is normally made, and why skipping it is safe ──
- *   When `firebaseAuth` is configured, `IntlProvider` by default calls
- *   `resolveAuthUserAndRedirect()`, which:
+ *   ── Why this call exists, and why skipping it by default is safe ──
+ *   When `firebaseAuth` is configured and `staticSafe: false` is passed,
+ *   `IntlProvider` calls `resolveAuthUserAndRedirect()`, which:
  *     1. Reads the session cookie via `cookies()` and verifies it against
  *        Firebase (server-side, authoritative check for "who is this?").
  *     2. Reads the current pathname via `headers()` (`x-pathname`, set by
@@ -55,22 +56,21 @@ import type { TranslationObject } from "../../types/types";
  *   render before the real user data appears — never wrong/protected
  *   content, since middleware already gated that; just a delayed value.
  *
- *   ── When to use it ──
- *   Set `staticSafe: true` only on `IntlProvider` calls that wrap routes
- *   you know are always public and don't render auth-dependent UI above
- *   the fold (or can tolerate that UI appearing a moment late). Leave the
- *   default (`false`) for any `IntlProvider` call that also wraps
- *   protected routes or routes where the auth-state flash would be
- *   visually jarring (dashboards, account pages, anything showing
- *   `initialAuthUser`-derived content immediately). If you need
+ *   ── When to opt out (staticSafe: false) ──
+ *   Pass `staticSafe: false` on `IntlProvider` calls that wrap protected
+ *   routes or routes where the auth-state flash would be visually jarring
+ *   (dashboards, account pages, anything showing `initialAuthUser`-derived
+ *   content immediately). Leave the default (`true`) for routes you know
+ *   are always public and don't render auth-dependent UI above the fold
+ *   (or can tolerate that UI appearing a moment late). If you need
  *   different behavior for public vs protected routes within the SAME
  *   app, render `IntlProvider` twice — once per layout/route-group, each
  *   with its own `staticSafe` value — rather than picking one value for
  *   the whole app. If `firebaseAuth.middlewareEnabled` is explicitly
- *   `false` (middleware auth disabled), do NOT set `staticSafe: true` —
+ *   `false` (middleware auth disabled), always pass `staticSafe: false` —
  *   this component becomes the ONLY place performing the auth redirect,
- *   so skipping it there really does remove the security check, not just
- *   the flash.
+ *   so leaving the `true` default there really does remove the security
+ *   check, not just the flash.
  *
  * @example
  * ```tsx

package/dist/src/server/components/server_provider.js

@@ -27,11 +27,12 @@ let authUserServerProviderModule;
  *   to serve from static rendering / ISR — i.e. the caller already knows
  *   the current route never needs a server-resolved auth user (a public
  *   page: marketing, privacy policy, docs, etc). Concretely, setting this
- *   to `true` skips the internal `resolveAuthUserAndRedirect()` call.
+ *   to `true` (the default) skips the internal `resolveAuthUserAndRedirect()`
+ *   call. Pass `staticSafe: false` to opt back into resolving it.
  *
- *   ── Why this call is normally made, and why skipping it is safe ──
- *   When `firebaseAuth` is configured, `IntlProvider` by default calls
- *   `resolveAuthUserAndRedirect()`, which:
+ *   ── Why this call exists, and why skipping it by default is safe ──
+ *   When `firebaseAuth` is configured and `staticSafe: false` is passed,
+ *   `IntlProvider` calls `resolveAuthUserAndRedirect()`, which:
  *     1. Reads the session cookie via `cookies()` and verifies it against
  *        Firebase (server-side, authoritative check for "who is this?").
  *     2. Reads the current pathname via `headers()` (`x-pathname`, set by
@@ -65,22 +66,21 @@ let authUserServerProviderModule;
  *   render before the real user data appears — never wrong/protected
  *   content, since middleware already gated that; just a delayed value.
  *
- *   ── When to use it ──
- *   Set `staticSafe: true` only on `IntlProvider` calls that wrap routes
- *   you know are always public and don't render auth-dependent UI above
- *   the fold (or can tolerate that UI appearing a moment late). Leave the
- *   default (`false`) for any `IntlProvider` call that also wraps
- *   protected routes or routes where the auth-state flash would be
- *   visually jarring (dashboards, account pages, anything showing
- *   `initialAuthUser`-derived content immediately). If you need
+ *   ── When to opt out (staticSafe: false) ──
+ *   Pass `staticSafe: false` on `IntlProvider` calls that wrap protected
+ *   routes or routes where the auth-state flash would be visually jarring
+ *   (dashboards, account pages, anything showing `initialAuthUser`-derived
+ *   content immediately). Leave the default (`true`) for routes you know
+ *   are always public and don't render auth-dependent UI above the fold
+ *   (or can tolerate that UI appearing a moment late). If you need
  *   different behavior for public vs protected routes within the SAME
  *   app, render `IntlProvider` twice — once per layout/route-group, each
  *   with its own `staticSafe` value — rather than picking one value for
  *   the whole app. If `firebaseAuth.middlewareEnabled` is explicitly
- *   `false` (middleware auth disabled), do NOT set `staticSafe: true` —
+ *   `false` (middleware auth disabled), always pass `staticSafe: false` —
  *   this component becomes the ONLY place performing the auth redirect,
- *   so skipping it there really does remove the security check, not just
- *   the flash.
+ *   so leaving the `true` default there really does remove the security
+ *   check, not just the flash.
  *
  * @example
  * ```tsx
@@ -96,7 +96,7 @@ let authUserServerProviderModule;
  * }
  * ```
  */
-export default async function LocationzationProvider({ language, messages, staticSafe = false, children }) {
+export default async function LocationzationProvider({ language, messages, staticSafe = true, children }) {
     if (!localesSet.has(language)) {
         const { notFound } = await import("next/navigation");
         notFound();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-next-intl",
-  "version": "0.6.16",
+  "version": "0.6.18",
   "description": "Optimized Next Intl Package Special for App Router and Cloudflare",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",