feat(react): add react package and example

[JeanMeijer]

Note

Introduce @simpleanalytics/react library and a Vite React example app demonstrating its usage.

• Packages:
  • @simpleanalytics/react: New React package exposing SimpleAnalytics component plus trackEvent and trackPageview; injects SA script with configurable data-* props; includes utilities, types, build (tsup) and publish setup.
• Examples:
  • examples/reactjs: New Vite + React (TS) example app integrating @simpleanalytics/react with basic UI; includes Vite, ESLint, TypeScript configs.
• Tooling:
  • Adds build config (tsup), type declarations, and required project configs/deps for the new package and example.

^{Written by Cursor Bugbot for commit f5bd45b. This will update automatically on new commits. Configure here.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/simpleanalytics/next/@simpleanalytics/react@29

commit: a631bed

[adriaandotcom]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no bugs!

---

To fix the problem, add a permissions: block either at the workflow root (to affect all jobs) or to the specific job that requires it (in this case, the build job). The permissions should follow the principle of least privilege. Since the workflow appears to build and publish a package via a third-party tool and does not (in the shown steps) directly create pull requests, modify issues, or push to repo contents, it’s likely that only contents: read is needed. However, if the publishing tool requires broader GitHub permissions (e.g., contents: write or packages: write), those should be added, ideally after testing. For now, insert the minimal block for safety.

Insert the following block just below the workflow name: and before on: (affecting all jobs), or inside the job as shown in the background—here we will add it at the workflow root for clarity.

To resolve this issue, add an explicit permissions block to the workflow (just below the name or at the root, above on:) or specifically to the build job. Since the current workflow steps do not appear to require write access to repository contents or pull requests, the minimal safe permissions setting is contents: read. This restricts the automatic GITHUB_TOKEN to read-only access, significantly reducing risk. The edit should be made to the beginning of the .github/workflows/publish-preview-react.yaml file, either immediately after name: or within the build job definition.

---

To fix the problem, you should add an explicit permissions block to the workflow, restricting the default token scope to the minimal required privileges. For this workflow, only read access to repository contents is necessary, since all publishing is handled with separate npm authentication and there are no steps that require write access to the repo, issues, or PRs. The best place to add this is right after the workflow name and on fields, before jobs, to apply it globally unless a job overrides it.

• Edit .github/workflows/publish-react.yaml.
• Insert the following lines:

  permissions:
    contents: read

  just after the on: section, before jobs:.

[JeanMeijer]

@adriaandotcom This one is ready. Are you fine with it being in the same repo as the Next.js plugin?