@replohq/sdk 0.1.0 → 0.2.1

package/_vendor/replo-utils/lib/string.d.ts

@@ -0,0 +1,43 @@
+export declare const getValidFilename: (value: string) => string;
+export declare function slugify(text: string): string;
+export declare function metafieldContainsHtml(metafieldValue: string): boolean;
+export declare function capitalizeFirstLetter(inputString: string): string;
+/**
+ * Get url without query params.
+ *
+ * @author Kurt 2024-10-14
+ */
+export declare const getUrlWithoutQueryParams: (url: string) => string | undefined;
+/**
+ * Converts PascalCase strings to readable format with spaces.
+ * E.g., "LandingPage1" -> "Landing Page 1"
+ *
+ * @param pascalCaseString - The PascalCase string to convert
+ * @returns A readable string with spaces between words and numbers
+ */
+export declare const convertPascalCaseToReadable: (pascalCaseString: string) => string;
+export declare function formatWithCatN({ content, startLineNumber, }: {
+    content: string;
+    startLineNumber?: number;
+}): string;
+/**
+ * Escapes special regex characters in a string for use in RegExp constructor
+ */
+export declare function escapeRegExp(string: string): string;
+/**
+ * Skill names are authored as kebab-case slugs in SKILL.md frontmatter
+ * ("site-management", "founder-review"). Anywhere we render the name to the
+ * user — skills app cards, the chat tool feed, the provisioning overlay — we
+ * run it through this so they see "Site Management", "Founder Review", etc.
+ * instead of the raw slug.
+ *
+ * Names that already look human-authored (any whitespace or any uppercase
+ * letter) are returned untouched, so a skill can opt out by writing
+ * `name: My Custom Skill` in frontmatter.
+ */
+export declare function prettifySkillName(name: string): string;
+/**
+ * Safely decodes a URI component, returning the original value if decoding fails.
+ * Returns null if the input is null or undefined, preserving empty strings.
+ */
+export declare function decodeURIComponentSafe(value: string | null | undefined): string | null;

package/_vendor/replo-utils/lib/url.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Builds a URLSearchParams from a record, omitting undefined values. Array
+ * values are appended as repeated keys; scalars are stringified.
+ */
+export declare function buildUrlSearchParams(values: Record<string, string | number | boolean | string[] | undefined>): URLSearchParams;
+export declare function isValidHttpUrl(url: string, options?: {
+    allowBlockedHostnames?: boolean;
+    allowedHostnames?: string[];
+}): boolean;
+/**
+ * Tries to parse and validate the given string as a URL, including protocol-relative
+ * URLs. Returns a URL if parsing is possible, otherwise null.
+ *
+ * Note: Javascript URLs don't recognize protocol-relative URLs (e.g. //google.com)
+ * as valid, so we need special casing here. If protocol-relative, the returned
+ * url will have an https protocol. This default is arbitrary but backed up by best
+ * practice: https://webhint.io/docs/user-guide/hints/hint-no-protocol-relative-urls/
+ */
+export declare function normalizeUrlIncludingProtocolRelative(url: string): URL | null;
+export declare function normalizeCustomDomain(input: string): string;
+/**
+ * Returns true if `origin` is a valid Replo Vercel preview deployment origin.
+ * Matches `https://<slug>.preview.replointernal.com`, e.g.
+ *
+ * Use this when you have a full origin string (e.g. from `request.headers.origin`).
+ */
+export declare function isPreviewOrigin(origin: string): boolean;
+/**
+ * Returns true if `hostname` belongs to a Replo Vercel preview deployment.
+ * Matches `<slug>.preview.replointernal.com`, e.g.
+ *
+ * Use this when you've already parsed the URL and have a bare hostname.
+ */
+export declare function isPreviewInternalHostname(hostname: string): boolean;
+export declare function normalizeUrlScheme(url: string): string;
+/**
+ * Truncates a domain name by shortening the subdomain portion while preserving
+ * the main domain suffix. Useful for displaying long domain names in UI.
+ *
+ * @param domain - The domain to truncate (e.g., "very-long-subdomain.example.com")
+ * @param maxLength - Maximum length of the truncated domain (default: 40)
+ * @returns Truncated domain with ellipsis (e.g., "very-long-sub...example.com")
+ */
+export declare function truncateDomain(domain: string, maxLength?: number): string;
+/**
+ * Validates that a route path is properly formatted and URL-safe.
+ * Routes must start with / and contain only valid slug segments.
+ *
+ * @param path - The route path to validate
+ * @returns true if the path is a valid route, false otherwise
+ */
+export declare const isValidRoutePath: (path: string) => boolean;
+/**
+ * Parses a URL, returning null instead of throwing. Pass `base` to resolve a
+ * relative value such as a site path.
+ */
+export declare function parseUrl(value: string, base?: string): URL | null;

package/_vendor/schemas/money.mjs

@@ -1,6 +1,6 @@
+import { ReploError } from '../../chunk-5M7VU32I.mjs';
 import { __commonJS, __toESM } from '../../chunk-UJCSKKID.mjs';
 import { z } from 'zod';
-import { v4 } from 'uuid';
 
 // ../../node_modules/.pnpm/first-match@0.0.1/node_modules/first-match/index.js
 var require_first_match = __commonJS({
@@ -1859,117 +1859,6 @@ var require_currency_codes = __commonJS({
 
 // ../schemas/money.ts
 var import_currency_codes = __toESM(require_currency_codes());
-function randomUUID() {
-  return v4();
-}
-var ReploError = class _ReploError extends Error {
-  config;
-  id;
-  constructor(config) {
-    super(config.message);
-    this.message = config.message ?? this.constructor.name;
-    this.config = config;
-    this.id = randomUUID();
-    const cause = config.cause;
-    if (cause) {
-      this.cause = cause;
-      if (cause instanceof _ReploError) {
-        this.config.additionalData = {
-          ...this.config.additionalData,
-          ...cause.config.additionalData
-        };
-      }
-    }
-  }
-};
-var errorUserFacingDetailsMessageSchema = z.object({
-  type: z.enum([
-    "toast",
-    "fullPageModal",
-    "shopifyStorePassword",
-    "billing.addPublishedElements",
-    "billing.addShopifyThemeProject",
-    "billing.addReploSite",
-    // Agent Billing ONLY
-    "agentBilling.shopifyThemeBuilder.publishedElements.exceeded",
-    "agentBilling.shopifyThemeBuilder.projects.exceeded",
-    "agentBilling.sites.exceeded",
-    "agentBilling.credits.exceeded",
-    "agentBilling.upgradeRequired"
-  ]),
-  message: z.string(),
-  isRecoverable: z.boolean().optional(),
-  // NOTE (Matt 2024-03-22): We support detail being an array of strings
-  // in FullPageModal only.
-  detail: z.array(z.string()).or(z.string()).optional(),
-  key: z.string(),
-  usage: z.object({
-    current: z.number(),
-    maximum: z.number()
-  }).optional(),
-  plan: z.string().optional(),
-  callToAction: z.discriminatedUnion("type", [
-    z.object({ type: z.literal("reload") }),
-    z.object({ type: z.literal("installApp") }),
-    z.object({ type: z.literal("goToHomepage") }),
-    z.object({ type: z.literal("navigateToProjectEditor") }),
-    z.object({ type: z.literal("closeModal") }),
-    z.object({
-      type: z.literal("navigateToLink"),
-      link: z.discriminatedUnion("type", [
-        z.object({ type: z.literal("errors.wrongJsonExtension") }),
-        z.object({ type: z.literal("errors.chunkingError") }),
-        z.object({ type: z.literal("errors.indexBackupError") }),
-        z.object({
-          type: z.literal("errors.shopifyIntegrationAlreadyAssigned")
-        }),
-        z.object({
-          type: z.literal("errors.shopifyIntegrationMissingAccessScopes"),
-          url: z.string()
-        }),
-        z.object({
-          type: z.literal("customLink"),
-          url: z.string()
-        }),
-        z.object({
-          type: z.literal(
-            "errors.projectConnectedToBillingIntegrationForShopifyWorkspace"
-          )
-        }),
-        z.object({ type: z.literal("errors.themeAssetSizeLimitExceeded") }),
-        z.object({ type: z.literal("errors.themeTotalSizeLimitExceeded") }),
-        z.object({
-          type: z.literal("errors.pageMetafieldDefinitionsChanged")
-        }),
-        z.object({ type: z.literal("settings.billing") })
-      ])
-    })
-  ]).optional()
-}).describe("ErrorUserFacingDetailsWithMessage");
-z.discriminatedUnion("type", [
-  /**
-   * Normal errors, show error UI depending on the type
-   */
-  errorUserFacingDetailsMessageSchema,
-  /**
-   * Errors which should be ignored by the frontend. This is uncommon, usually
-   * you want to show an error in the UI, and if you don't want to then you catch
-   * the error in your route.
-   */
-  z.object({
-    type: z.literal("uncommon_none"),
-    key: z.string(),
-    usage: z.object({
-      current: z.number(),
-      maximum: z.number()
-    }).optional(),
-    message: z.string().optional(),
-    isRecoverable: z.boolean().optional(),
-    detail: z.array(z.string()).or(z.string()).optional()
-  })
-]).describe("ErrorUserFacingDetails");
-
-// ../schemas/money.ts
 var InvalidAmountError = class extends ReploError {
 };
 var UnsupportedCurrencyError = class extends ReploError {

package/_vendor/schemas/routing/match.d.ts

@@ -0,0 +1,38 @@
+/** Captured segment values, keyed by param name. */
+type RouteParams = Record<string, string>;
+/**
+ * The params captured from `pathname`, or null when the source does not match.
+ * An empty object means the source matched with nothing to capture.
+ */
+export declare function matchSource({ source, pathname, }: {
+    source: string;
+    pathname: string;
+}): RouteParams | null;
+/**
+ * Whether a destination carries any `:param`, anywhere — including inside a
+ * query, which splitting on `/` would miss.
+ */
+export declare function hasRouteParam(value: string): boolean;
+/**
+ * Every `:param` in the string, in order, each written back with its modifier.
+ * The modifier is part of the identity: a source's `:page?` may capture
+ * nothing, so a destination's `:page` is not the same param.
+ */
+export declare function getRouteParams(value: string): string[];
+/**
+ * Substitutes captured params into a destination in one pass, so a substituted
+ * value is never rescanned as though it were itself a param. A param the
+ * request never captured collapses to nothing when it was optional, and is
+ * otherwise left in place for the caller to notice.
+ */
+export declare function applyParams({ value, params, }: {
+    value: string;
+    params: RouteParams;
+}): string;
+export interface ParamSegment {
+    name: string;
+    modifier: "*" | "+" | "?" | null;
+}
+/** Reads `:name`, `:name*`, `:name+`, or `:name?`; null for a literal segment. */
+export declare function getParamSegment(segment: string): ParamSegment | null;
+export {};

package/_vendor/schemas/routing/match.mjs

@@ -0,0 +1,2 @@
+export { applyParams, getParamSegment, getRouteParams, hasRouteParam, matchSource } from '../../../chunk-VPEVERWE.mjs';
+import '../../../chunk-UJCSKKID.mjs';

package/_vendor/schemas/routing/rules.d.ts

@@ -0,0 +1,30 @@
+import { ReploError } from "../errors";
+import { z } from "zod";
+export declare class RedirectRuleValidationError extends ReploError {
+}
+export declare const redirectStatusSchema: z.ZodUnion<readonly [z.ZodLiteral<301>, z.ZodLiteral<302>, z.ZodLiteral<307>, z.ZodLiteral<308>]>;
+export declare const redirectRuleSchema: z.ZodObject<{
+    source: z.ZodString;
+    destination: z.ZodString;
+    status: z.ZodUnion<readonly [z.ZodLiteral<301>, z.ZodLiteral<302>, z.ZodLiteral<307>, z.ZodLiteral<308>]>;
+}, z.core.$strict>;
+export type RedirectStatus = z.infer<typeof redirectStatusSchema>;
+export type RedirectRule = z.infer<typeof redirectRuleSchema>;
+/**
+ * Validates a redirect rule, returning it unchanged. Throws
+ * `RedirectRuleValidationError` carrying the first failing check's message.
+ */
+export declare function reploRedirect(input: RedirectRule): RedirectRule;
+export interface RedirectConflict {
+    blockingIndex: number;
+    blockedIndex: number;
+}
+/**
+ * Rules evaluate first-match-wins, so an earlier rule that already matches a
+ * later rule's own source makes the later rule dead. Compared with the later
+ * source's route params replaced, since that is a concrete path the earlier rule
+ * would see at request time.
+ */
+export declare function findRedirectConflicts(rules: readonly {
+    source: string;
+}[]): RedirectConflict[];

package/_vendor/schemas/routing/rules.mjs

@@ -0,0 +1,96 @@
+import { ReploError } from '../../../chunk-5M7VU32I.mjs';
+import { getParamSegment, getRouteParams, hasRouteParam, matchSource } from '../../../chunk-VPEVERWE.mjs';
+import '../../../chunk-UJCSKKID.mjs';
+import { z } from 'zod';
+
+// ../replo-utils/lib/url.ts
+function parseUrl(value, base) {
+  try {
+    return new URL(value, base);
+  } catch {
+    return null;
+  }
+}
+var RedirectRuleValidationError = class extends ReploError {
+};
+var SITE_PATH_ORIGIN = "https://site.invalid";
+var redirectStatusSchema = z.union([
+  z.literal(301),
+  z.literal(302),
+  z.literal(307),
+  z.literal(308)
+]);
+var sourceSchema = z.string().min(1).refine((source) => source.startsWith("/"), {
+  message: "must start with /"
+}).refine((source) => source.split("/").every(hasValidWildcardUsage), {
+  message: '"*" is only meaningful on a param segment \u2014 write "/blog/:rest*", not "/blog/*"'
+});
+function hasValidWildcardUsage(segment) {
+  if (!segment.includes("*")) {
+    return true;
+  }
+  return getParamSegment(segment)?.modifier === "*";
+}
+var destinationSchema = z.string().min(1).refine(
+  (destination) => {
+    const concrete = replaceRouteParamsWithSentinel(destination);
+    if (concrete.startsWith("/")) {
+      return parseUrl(concrete, SITE_PATH_ORIGIN)?.origin === SITE_PATH_ORIGIN;
+    }
+    const protocol = parseUrl(concrete)?.protocol;
+    return protocol === "http:" || protocol === "https:";
+  },
+  {
+    message: "must be a path on this site or an absolute HTTP(S) URL; a destination starting with / must stay on this site"
+  }
+);
+var redirectRuleSchema = z.object({
+  source: sourceSchema,
+  destination: destinationSchema,
+  status: redirectStatusSchema
+}).strict().superRefine(({ source, destination }, context) => {
+  const captured = new Set(getRouteParams(source));
+  for (const routeParam of getRouteParams(destination)) {
+    if (!captured.has(routeParam)) {
+      context.addIssue({
+        code: "custom",
+        path: ["destination"],
+        message: `":${routeParam}" is not captured by this rule's source, so it would be redirected to literally`
+      });
+    }
+  }
+  const concrete = replaceRouteParamsWithSentinel(destination);
+  if (hasRouteParam(destination) && concrete.startsWith("/") && matchSource({ source, pathname: concrete }) !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["destination"],
+      message: "destination is matched by this rule's own source, so the redirect would loop forever"
+    });
+  }
+});
+function reploRedirect(input) {
+  const parsed = redirectRuleSchema.safeParse(input);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  const message = parsed.error.issues[0]?.message ?? "invalid redirect rule";
+  throw new RedirectRuleValidationError({ message });
+}
+function findRedirectConflicts(rules) {
+  const conflicts = [];
+  rules.forEach((blocked, blockedIndex) => {
+    const pathname = replaceRouteParamsWithSentinel(blocked.source);
+    const blockingIndex = rules.findIndex((blocking, index) => {
+      return index < blockedIndex && matchSource({ source: blocking.source, pathname }) !== null;
+    });
+    if (blockingIndex >= 0) {
+      conflicts.push({ blockingIndex, blockedIndex });
+    }
+  });
+  return conflicts;
+}
+function replaceRouteParamsWithSentinel(value) {
+  return value.split("/").map((segment) => getParamSegment(segment) ? "x" : segment).join("/");
+}
+
+export { RedirectRuleValidationError, findRedirectConflicts, redirectRuleSchema, redirectStatusSchema, reploRedirect };

package/chunk-5M7VU32I.mjs

@@ -0,0 +1,115 @@
+import { v4 } from 'uuid';
+import { z } from 'zod';
+
+// ../replo-utils/lib/crypto.ts
+function randomUUID() {
+  return v4();
+}
+var ReploError = class _ReploError extends Error {
+  config;
+  id;
+  constructor(config) {
+    super(config.message);
+    this.message = config.message ?? this.constructor.name;
+    this.config = config;
+    this.id = randomUUID();
+    const cause = config.cause;
+    if (cause) {
+      this.cause = cause;
+      if (cause instanceof _ReploError) {
+        this.config.additionalData = {
+          ...this.config.additionalData,
+          ...cause.config.additionalData
+        };
+      }
+    }
+  }
+};
+var errorUserFacingDetailsMessageSchema = z.object({
+  type: z.enum([
+    "toast",
+    "fullPageModal",
+    "shopifyStorePassword",
+    "billing.addPublishedElements",
+    "billing.addShopifyThemeProject",
+    "billing.addReploSite",
+    // Agent Billing ONLY
+    "agentBilling.shopifyThemeBuilder.publishedElements.exceeded",
+    "agentBilling.shopifyThemeBuilder.projects.exceeded",
+    "agentBilling.sites.exceeded",
+    "agentBilling.credits.exceeded",
+    "agentBilling.upgradeRequired"
+  ]),
+  message: z.string(),
+  isRecoverable: z.boolean().optional(),
+  // NOTE (Matt 2024-03-22): We support detail being an array of strings
+  // in FullPageModal only.
+  detail: z.array(z.string()).or(z.string()).optional(),
+  key: z.string(),
+  usage: z.object({
+    current: z.number(),
+    maximum: z.number()
+  }).optional(),
+  plan: z.string().optional(),
+  callToAction: z.discriminatedUnion("type", [
+    z.object({ type: z.literal("reload") }),
+    z.object({ type: z.literal("installApp") }),
+    z.object({ type: z.literal("goToHomepage") }),
+    z.object({ type: z.literal("navigateToProjectEditor") }),
+    z.object({ type: z.literal("closeModal") }),
+    z.object({
+      type: z.literal("navigateToLink"),
+      link: z.discriminatedUnion("type", [
+        z.object({ type: z.literal("errors.wrongJsonExtension") }),
+        z.object({ type: z.literal("errors.chunkingError") }),
+        z.object({ type: z.literal("errors.indexBackupError") }),
+        z.object({
+          type: z.literal("errors.shopifyIntegrationAlreadyAssigned")
+        }),
+        z.object({
+          type: z.literal("errors.shopifyIntegrationMissingAccessScopes"),
+          url: z.string()
+        }),
+        z.object({
+          type: z.literal("customLink"),
+          url: z.string()
+        }),
+        z.object({
+          type: z.literal(
+            "errors.projectConnectedToBillingIntegrationForShopifyWorkspace"
+          )
+        }),
+        z.object({ type: z.literal("errors.themeAssetSizeLimitExceeded") }),
+        z.object({ type: z.literal("errors.themeTotalSizeLimitExceeded") }),
+        z.object({
+          type: z.literal("errors.pageMetafieldDefinitionsChanged")
+        }),
+        z.object({ type: z.literal("settings.billing") })
+      ])
+    })
+  ]).optional()
+}).describe("ErrorUserFacingDetailsWithMessage");
+z.discriminatedUnion("type", [
+  /**
+   * Normal errors, show error UI depending on the type
+   */
+  errorUserFacingDetailsMessageSchema,
+  /**
+   * Errors which should be ignored by the frontend. This is uncommon, usually
+   * you want to show an error in the UI, and if you don't want to then you catch
+   * the error in your route.
+   */
+  z.object({
+    type: z.literal("uncommon_none"),
+    key: z.string(),
+    usage: z.object({
+      current: z.number(),
+      maximum: z.number()
+    }).optional(),
+    message: z.string().optional(),
+    isRecoverable: z.boolean().optional(),
+    detail: z.array(z.string()).or(z.string()).optional()
+  })
+]).describe("ErrorUserFacingDetails");
+
+export { ReploError };

package/chunk-VPEVERWE.mjs

@@ -0,0 +1,63 @@
+// ../schemas/routing/match.ts
+function matchSource({
+  source,
+  pathname
+}) {
+  const trimmed = source.replace(/\/+$/, "") || "/";
+  let pattern;
+  try {
+    pattern = new URLPattern({ pathname: `${trimmed}{/}?` });
+  } catch {
+    return null;
+  }
+  const match = pattern.exec({
+    pathname: pathname.split(/[?#]/)[0] ?? pathname
+  });
+  if (!match) {
+    return null;
+  }
+  const params = {};
+  for (const [name, value] of Object.entries(match.pathname.groups)) {
+    if (/^\d+$/.test(name)) {
+      continue;
+    }
+    params[name] = value ?? "";
+  }
+  return params;
+}
+var ROUTE_PARAM = /:([A-Za-z0-9_.-]+?)([*+?]?)(?=[/?#]|$)/g;
+function hasRouteParam(value) {
+  return new RegExp(ROUTE_PARAM.source).test(value);
+}
+function getRouteParams(value) {
+  const matches = value.matchAll(new RegExp(ROUTE_PARAM.source, "g"));
+  return [...matches].flatMap(([, name, modifier]) => {
+    return name ? [`${name}${modifier ?? ""}`] : [];
+  });
+}
+function applyParams({
+  value,
+  params
+}) {
+  return value.replace(ROUTE_PARAM, (routeParam, name, modifier) => {
+    const captured = params[name];
+    if (captured !== void 0) {
+      return captured;
+    }
+    return modifier === "*" || modifier === "?" ? "" : routeParam;
+  });
+}
+var PARAM_SEGMENT = /^:([A-Za-z0-9_.-]+)([*+?]?)$/;
+function getParamSegment(segment) {
+  const match = PARAM_SEGMENT.exec(segment);
+  if (!match?.[1]) {
+    return null;
+  }
+  const modifier = match[2];
+  return {
+    name: match[1],
+    modifier: modifier === "*" || modifier === "+" || modifier === "?" ? modifier : null
+  };
+}
+
+export { applyParams, getParamSegment, getRouteParams, hasRouteParam, matchSource };

package/env.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../env.ts"],
-  "sourcesContent": ["import { getCloudflareContext } from \"@opennextjs/cloudflare\";\nimport JSONC from \"tiny-jsonc\";\nimport { z } from \"zod\";\n\nimport { CanopyError } from \"./lib/canopy-error\";\n\ntype Env = {\n  CANOPY_API_HOST: string;\n  PROJECT_ID: string;\n\n  // Base URL of analytics-fire (e.g. https://data.replo.app). Read server-side by\n  // the consent action (`consent/consent-actions.ts`) to forward proof-of-consent\n  // records. Optional: absent in environments where the audit pipeline isn't\n  // wired (e.g. local dev), where consent recording simply no-ops.\n  ANALYTICS_FIRE_API_URL?: string;\n\n  // Base URL of the Replo first-party analytics pixel CDN (e.g.\n  // https://pixel.replo.app). `<ReploFirstPartyPixel>` loads\n  // `${REPLO_ANALYTICS_PIXEL_URL}/latest.js` into the page once analytics consent\n  // is granted; the browser fetches it directly. Optional: absent when the pixel\n  // isn't configured (e.g. lean local dev), where the pixel simply isn't injected.\n  REPLO_ANALYTICS_PIXEL_URL?: string;\n\n  CHECKOUT_PROVIDER?: \"shopify\" | \"stripe\" | \"none\";\n};\n\nconst envSchema = z.object({\n  CANOPY_API_HOST: z.string().min(1),\n  PROJECT_ID: z.uuid(),\n  ANALYTICS_FIRE_API_URL: z.string().optional(),\n  REPLO_ANALYTICS_PIXEL_URL: z.string().optional(),\n  CHECKOUT_PROVIDER: z.enum([\"shopify\", \"stripe\", \"none\"]).optional(),\n});\n\nconst wranglerConfigSchema = z.object({ vars: envSchema });\n\nclass MissingWranglerConfigError extends CanopyError {}\n\n// NOTE (Cole, 2026-07-28, REPL-29501): outside the deployed worker, read wrangler.jsonc directly \u2014 concurrent workerd boots race on the shared .wrangler/state SQLite (SQLITE_BUSY).\nconst isDeployedWorker = () => {\n  return (\n    process.env.NODE_ENV === \"production\" &&\n    process.env.BUILD_ENV !== \"build\" &&\n    process.env.NEXT_PHASE !== \"phase-production-build\"\n  );\n};\n\nexport const getEnv = async (): Promise<Env> => {\n  if (isDeployedWorker()) {\n    const { env } = await getCloudflareContext({ async: true });\n    return envSchema.parse(env);\n  }\n  // NOTE (Cole, 2026-07-29, REPL-29501): client chunks bundle this module (integration-utils has client consumers). A static node:fs broke those chunks in 0.16.3, and a computed specifier fails Turbopack too (\"expression is too dynamic\") \u2014 only the ignore-annotated literal import compiles; postbuild.mjs asserts the annotation survives into dist.\n  const { promises: fs }: typeof import(\"node:fs\") = await import(\n    /* turbopackIgnore: true */ /* webpackIgnore: true */ \"node:fs\"\n  );\n  let raw: string;\n  try {\n    raw = await fs.readFile(`${process.cwd()}/wrangler.jsonc`, \"utf8\");\n  } catch (error) {\n    throw new MissingWranglerConfigError({\n      message:\n        `wrangler.jsonc not found in ${process.cwd()}. It holds this site's Replo project config ` +\n        `(project id, API host) and is required to run outside the deployed worker. ` +\n        `If this clone predates the committed config, open the site in Replo once \u2014 the dev ` +\n        `server regenerates and commits it \u2014 then git pull.`,\n      cause: error,\n    });\n  }\n  return wranglerConfigSchema.parse(JSONC.parse(raw)).vars;\n};\n"],
+  "sourcesContent": ["import { getCloudflareContext } from \"@opennextjs/cloudflare\";\nimport JSONC from \"tiny-jsonc\";\nimport { z } from \"zod\";\n\nimport { CanopyError } from \"./lib/canopy-error\";\n\ntype Env = {\n  CANOPY_API_HOST: string;\n  PROJECT_ID: string;\n\n  // Base URL of analytics-fire (e.g. https://data.replo.app). Read server-side by\n  // the consent action (`consent/consent-actions.ts`) to forward proof-of-consent\n  // records. Optional: absent in environments where the audit pipeline isn't\n  // wired (e.g. local dev), where consent recording simply no-ops.\n  ANALYTICS_FIRE_API_URL?: string;\n\n  // Base URL of the Replo first-party analytics pixel CDN (e.g.\n  // https://pixel.replo.app). `<ReploFirstPartyPixel>` loads\n  // `${REPLO_ANALYTICS_PIXEL_URL}/latest.js` into the page once analytics consent\n  // is granted; the browser fetches it directly. Optional: absent when the pixel\n  // isn't configured (e.g. lean local dev), where the pixel simply isn't injected.\n  REPLO_ANALYTICS_PIXEL_URL?: string;\n\n  CHECKOUT_PROVIDER?: \"shopify\" | \"stripe\" | \"none\";\n};\n\nconst envSchema = z.object({\n  CANOPY_API_HOST: z.string().min(1),\n  PROJECT_ID: z.uuid(),\n  ANALYTICS_FIRE_API_URL: z.string().optional(),\n  REPLO_ANALYTICS_PIXEL_URL: z.string().optional(),\n  CHECKOUT_PROVIDER: z.enum([\"shopify\", \"stripe\", \"none\"]).optional(),\n});\n\nconst wranglerConfigSchema = z.object({ vars: envSchema });\n\nclass MissingWranglerConfigError extends CanopyError {}\n\n// NOTE (Cole, 2026-07-28, REPL-29501): outside the deployed worker, read wrangler.jsonc directly \u2014 concurrent workerd boots race on the shared .wrangler/state SQLite (SQLITE_BUSY).\nconst isDeployedWorker = () => {\n  return (\n    process.env.NODE_ENV === \"production\" &&\n    process.env.BUILD_ENV !== \"build\" &&\n    process.env.NEXT_PHASE !== \"phase-production-build\"\n  );\n};\n\nexport const getEnv = async (): Promise<Env> => {\n  if (isDeployedWorker()) {\n    const { env } = await getCloudflareContext({ async: true });\n    return envSchema.parse(env);\n  }\n  // NOTE (Cole, 2026-07-29, REPL-29501): client chunks bundle this module (integration-utils has client consumers). A static node:fs broke those chunks in 0.16.3, and a computed specifier fails Turbopack too (\"expression is too dynamic\") \u2014 only the ignore-annotated literal import compiles; postbuild.mts asserts the annotation survives into dist.\n  const { promises: fs }: typeof import(\"node:fs\") = await import(\n    /* turbopackIgnore: true */ /* webpackIgnore: true */ \"node:fs\"\n  );\n  let raw: string;\n  try {\n    raw = await fs.readFile(`${process.cwd()}/wrangler.jsonc`, \"utf8\");\n  } catch (error) {\n    throw new MissingWranglerConfigError({\n      message:\n        `wrangler.jsonc not found in ${process.cwd()}. It holds this site's Replo project config ` +\n        `(project id, API host) and is required to run outside the deployed worker. ` +\n        `If this clone predates the committed config, open the site in Replo once \u2014 the dev ` +\n        `server regenerates and commits it \u2014 then git pull.`,\n      cause: error,\n    });\n  }\n  return wranglerConfigSchema.parse(JSONC.parse(raw)).vars;\n};\n"],
   "mappings": "AAAA,SAAS,4BAA4B;AACrC,OAAO,WAAW;AAClB,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAsB5B,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,YAAY,EAAE,KAAK;AAAA,EACnB,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,mBAAmB,EAAE,KAAK,CAAC,WAAW,UAAU,MAAM,CAAC,EAAE,SAAS;AACpE,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEzD,MAAM,mCAAmC,YAAY;AAAC;AAGtD,MAAM,mBAAmB,MAAM;AAC7B,SACE,QAAQ,IAAI,aAAa,gBACzB,QAAQ,IAAI,cAAc,WAC1B,QAAQ,IAAI,eAAe;AAE/B;AAEO,MAAM,SAAS,YAA0B;AAC9C,MAAI,iBAAiB,GAAG;AACtB,UAAM,EAAE,IAAI,IAAI,MAAM,qBAAqB,EAAE,OAAO,KAAK,CAAC;AAC1D,WAAO,UAAU,MAAM,GAAG;AAAA,EAC5B;AAEA,QAAM,EAAE,UAAU,GAAG,IAA8B,MAAM;AAAA;AAAA;AAAA,IACD;AAAA,EACxD;AACA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,CAAC,mBAAmB,MAAM;AAAA,EACnE,SAAS,OAAO;AACd,UAAM,IAAI,2BAA2B;AAAA,MACnC,SACE,+BAA+B,QAAQ,IAAI,CAAC;AAAA,MAI9C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,qBAAqB,MAAM,MAAM,MAAM,GAAG,CAAC,EAAE;AACtD;",
   "names": []
 }

package/next/config.js

@@ -17,6 +17,7 @@ const PLATFORM_SERVER_ACTION_ORIGINS = [
 ];
 function siteConfig(overrides = {}) {
   const isBuild = process.env.BUILD_ENV === "build";
+  const devRoot = process.env.IS_REPLO_SANDBOX ? "/workspace/dev" : process.cwd();
   const {
     turbopack: overrideTurbopack,
     images: overrideImages,
@@ -45,7 +46,7 @@ function siteConfig(overrides = {}) {
     // time; keep dev's watcher on the user app tree.
     turbopack: {
       ...overrideTurbopack,
-      root: isBuild ? "/" : "/workspace/dev"
+      root: isBuild ? "/" : devRoot
     },
     // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull
     // in lodash-es `uniq` here — dedupe inline via a Set instead.

package/next/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../next/config.ts"],
-  "sourcesContent": ["import os from \"os\";\nimport type { NextConfig } from \"next\";\n\n// Origins browsers load sandbox previews from \u2014 PREVIEW_HOSTNAME in the\n// coordinator's wrangler.jsonc plus Daytona's native preview domain. Next 16\n// hard-blocks cross-origin dev requests (HMR WebSocket, Server Actions) from\n// origins missing here.\nconst PLATFORM_DEV_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.daytonaproxy01.net\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst PLATFORM_SERVER_ACTION_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.cloudflare-agent-coordinator.replo.workers.dev\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\n// The canonical Next.js runtime contract shared by every agent-built site.\n// Sites re-export `default` from here through a one-line `next.config.ts` shim,\n// so the platform wiring (sandbox dist dirs, Turbopack root, preview origins,\n// Cloudflare image loader) lives in exactly one place instead of being copied\n// into each template.\n//\n// `overrides` is a per-site customization surface, but it must not be able to\n// silently amputate platform wiring. A plain `...overrides` spread is a shallow\n// merge: a site that sets any nested key (e.g. `experimental.typedRoutes`)\n// would replace the whole `experimental`/`images` block and drop platform\n// defaults like the build-worker OOM guard or the Cloudflare image loader. So\n// load-bearing keys are re-asserted after the spread and the nested blocks are\n// deep-merged: a site can add keys, but platform invariants always win and\n// platform origin lists are preserved (site entries are appended, not swapped).\nexport function siteConfig(overrides: NextConfig = {}): NextConfig {\n  const isBuild = process.env.BUILD_ENV === \"build\";\n  const {\n    turbopack: overrideTurbopack,\n    images: overrideImages,\n    experimental: overrideExperimental,\n    allowedDevOrigins: overrideDevOrigins,\n    ...restOverrides\n  } = overrides;\n\n  const { serverActions: overrideServerActions, ...restOverrideExperimental } =\n    overrideExperimental ?? {};\n\n  return {\n    // Site-overridable defaults.\n    reactStrictMode: true,\n    devIndicators: false,\n    ...restOverrides,\n\n    // Platform invariants \u2014 re-asserted after the spread so a site override\n    // can never break sandbox builds, publish, or the dev server.\n    output: \"standalone\",\n    distDir: isBuild ? \".next\" : \".next-dev\",\n    // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches\n    // required-server-files.json to clear this value before OpenNext bundles,\n    // since \"/\" makes esbuild emit absolute-path requires that break in Workers.\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Leave outputFileTracingRoot\n    // unset outside builds because Next 15.5+ otherwise forces turbopack.root to\n    // \"/\" and makes the dev watcher retain whole-filesystem state.\n    outputFileTracingRoot: isBuild ? \"/\" : undefined,\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Match build tracing at publish\n    // time; keep dev's watcher on the user app tree.\n    turbopack: {\n      ...overrideTurbopack,\n      root: isBuild ? \"/\" : \"/workspace/dev\",\n    },\n    // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull\n    // in lodash-es `uniq` here \u2014 dedupe inline via a Set instead.\n    allowedDevOrigins: Array.from(\n      new Set([...(overrideDevOrigins ?? []), ...PLATFORM_DEV_ORIGINS]),\n    ),\n    images: {\n      ...overrideImages,\n      loader: \"custom\",\n      loaderFile: \"./image-loader.ts\",\n      remotePatterns: overrideImages?.remotePatterns ?? [\n        {\n          protocol: \"https\",\n          hostname: \"**\",\n        },\n      ],\n    },\n    experimental: {\n      ...restOverrideExperimental,\n      // NOTE (Cole, 2026-06-18, REPL-28180): Next sizes its build worker pool\n      // off os.cpus().length = host cores (~64) inside a cgroup-limited sandbox,\n      // not the 2 the container actually has \u2014 a worker swarm that OOMs the\n      // 4 GiB box. availableParallelism() is cgroup-aware. Gated to prod build.\n      cpus: isBuild ? os.availableParallelism() : undefined,\n      serverActions: {\n        ...overrideServerActions,\n        allowedOrigins: Array.from(\n          new Set([\n            ...(overrideServerActions?.allowedOrigins ?? []),\n            ...PLATFORM_SERVER_ACTION_ORIGINS,\n          ]),\n        ),\n      },\n    },\n  };\n}\n\nconst nextConfig: NextConfig = siteConfig();\n\nexport default nextConfig;\n"],
-  "mappings": "AAAA,OAAO,QAAQ;AAOf,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,WAAW,YAAwB,CAAC,GAAe;AACjE,QAAM,UAAU,QAAQ,IAAI,cAAc;AAC1C,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,EAAE,eAAe,uBAAuB,GAAG,yBAAyB,IACxE,wBAAwB,CAAC;AAE3B,SAAO;AAAA;AAAA,IAEL,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,GAAG;AAAA;AAAA;AAAA,IAIH,QAAQ;AAAA,IACR,SAAS,UAAU,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO7B,uBAAuB,UAAU,MAAM;AAAA;AAAA;AAAA,IAGvC,WAAW;AAAA,MACT,GAAG;AAAA,MACH,MAAM,UAAU,MAAM;AAAA,IACxB;AAAA;AAAA;AAAA,IAGA,mBAAmB,MAAM;AAAA,MACvB,oBAAI,IAAI,CAAC,GAAI,sBAAsB,CAAC,GAAI,GAAG,oBAAoB,CAAC;AAAA,IAClE;AAAA,IACA,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,gBAAgB,gBAAgB,kBAAkB;AAAA,QAChD;AAAA,UACE,UAAU;AAAA,UACV,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKH,MAAM,UAAU,GAAG,qBAAqB,IAAI;AAAA,MAC5C,eAAe;AAAA,QACb,GAAG;AAAA,QACH,gBAAgB,MAAM;AAAA,UACpB,oBAAI,IAAI;AAAA,YACN,GAAI,uBAAuB,kBAAkB,CAAC;AAAA,YAC9C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAAyB,WAAW;AAE1C,IAAO,iBAAQ;",
+  "sourcesContent": ["import os from \"os\";\nimport type { NextConfig } from \"next\";\n\n// Origins browsers load sandbox previews from \u2014 PREVIEW_HOSTNAME in the\n// coordinator's wrangler.jsonc plus Daytona's native preview domain. Next 16\n// hard-blocks cross-origin dev requests (HMR WebSocket, Server Actions) from\n// origins missing here.\nconst PLATFORM_DEV_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.daytonaproxy01.net\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst PLATFORM_SERVER_ACTION_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.cloudflare-agent-coordinator.replo.workers.dev\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\n// The canonical Next.js runtime contract shared by every agent-built site.\n// Sites re-export `default` from here through a one-line `next.config.ts` shim,\n// so the platform wiring (sandbox dist dirs, Turbopack root, preview origins,\n// Cloudflare image loader) lives in exactly one place instead of being copied\n// into each template.\n//\n// `overrides` is a per-site customization surface, but it must not be able to\n// silently amputate platform wiring. A plain `...overrides` spread is a shallow\n// merge: a site that sets any nested key (e.g. `experimental.typedRoutes`)\n// would replace the whole `experimental`/`images` block and drop platform\n// defaults like the build-worker OOM guard or the Cloudflare image loader. So\n// load-bearing keys are re-asserted after the spread and the nested blocks are\n// deep-merged: a site can add keys, but platform invariants always win and\n// platform origin lists are preserved (site entries are appended, not swapped).\nexport function siteConfig(overrides: NextConfig = {}): NextConfig {\n  const isBuild = process.env.BUILD_ENV === \"build\";\n  const devRoot = process.env.IS_REPLO_SANDBOX\n    ? \"/workspace/dev\"\n    : process.cwd();\n  const {\n    turbopack: overrideTurbopack,\n    images: overrideImages,\n    experimental: overrideExperimental,\n    allowedDevOrigins: overrideDevOrigins,\n    ...restOverrides\n  } = overrides;\n\n  const { serverActions: overrideServerActions, ...restOverrideExperimental } =\n    overrideExperimental ?? {};\n\n  return {\n    // Site-overridable defaults.\n    reactStrictMode: true,\n    devIndicators: false,\n    ...restOverrides,\n\n    // Platform invariants \u2014 re-asserted after the spread so a site override\n    // can never break sandbox builds, publish, or the dev server.\n    output: \"standalone\",\n    distDir: isBuild ? \".next\" : \".next-dev\",\n    // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches\n    // required-server-files.json to clear this value before OpenNext bundles,\n    // since \"/\" makes esbuild emit absolute-path requires that break in Workers.\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Leave outputFileTracingRoot\n    // unset outside builds because Next 15.5+ otherwise forces turbopack.root to\n    // \"/\" and makes the dev watcher retain whole-filesystem state.\n    outputFileTracingRoot: isBuild ? \"/\" : undefined,\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Match build tracing at publish\n    // time; keep dev's watcher on the user app tree.\n    turbopack: {\n      ...overrideTurbopack,\n      root: isBuild ? \"/\" : devRoot,\n    },\n    // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull\n    // in lodash-es `uniq` here \u2014 dedupe inline via a Set instead.\n    allowedDevOrigins: Array.from(\n      new Set([...(overrideDevOrigins ?? []), ...PLATFORM_DEV_ORIGINS]),\n    ),\n    images: {\n      ...overrideImages,\n      loader: \"custom\",\n      loaderFile: \"./image-loader.ts\",\n      remotePatterns: overrideImages?.remotePatterns ?? [\n        {\n          protocol: \"https\",\n          hostname: \"**\",\n        },\n      ],\n    },\n    experimental: {\n      ...restOverrideExperimental,\n      // NOTE (Cole, 2026-06-18, REPL-28180): Next sizes its build worker pool\n      // off os.cpus().length = host cores (~64) inside a cgroup-limited sandbox,\n      // not the 2 the container actually has \u2014 a worker swarm that OOMs the\n      // 4 GiB box. availableParallelism() is cgroup-aware. Gated to prod build.\n      cpus: isBuild ? os.availableParallelism() : undefined,\n      serverActions: {\n        ...overrideServerActions,\n        allowedOrigins: Array.from(\n          new Set([\n            ...(overrideServerActions?.allowedOrigins ?? []),\n            ...PLATFORM_SERVER_ACTION_ORIGINS,\n          ]),\n        ),\n      },\n    },\n  };\n}\n\nconst nextConfig: NextConfig = siteConfig();\n\nexport default nextConfig;\n"],
+  "mappings": "AAAA,OAAO,QAAQ;AAOf,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,WAAW,YAAwB,CAAC,GAAe;AACjE,QAAM,UAAU,QAAQ,IAAI,cAAc;AAC1C,QAAM,UAAU,QAAQ,IAAI,mBACxB,mBACA,QAAQ,IAAI;AAChB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,EAAE,eAAe,uBAAuB,GAAG,yBAAyB,IACxE,wBAAwB,CAAC;AAE3B,SAAO;AAAA;AAAA,IAEL,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,GAAG;AAAA;AAAA;AAAA,IAIH,QAAQ;AAAA,IACR,SAAS,UAAU,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO7B,uBAAuB,UAAU,MAAM;AAAA;AAAA;AAAA,IAGvC,WAAW;AAAA,MACT,GAAG;AAAA,MACH,MAAM,UAAU,MAAM;AAAA,IACxB;AAAA;AAAA;AAAA,IAGA,mBAAmB,MAAM;AAAA,MACvB,oBAAI,IAAI,CAAC,GAAI,sBAAsB,CAAC,GAAI,GAAG,oBAAoB,CAAC;AAAA,IAClE;AAAA,IACA,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,gBAAgB,gBAAgB,kBAAkB;AAAA,QAChD;AAAA,UACE,UAAU;AAAA,UACV,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKH,MAAM,UAAU,GAAG,qBAAqB,IAAI;AAAA,MAC5C,eAAe;AAAA,QACb,GAAG;AAAA,QACH,gBAAgB,MAAM;AAAA,UACpB,oBAAI,IAAI;AAAA,YACN,GAAI,uBAAuB,kBAAkB,CAAC;AAAA,YAC9C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAAyB,WAAW;AAE1C,IAAO,iBAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@replohq/sdk",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -186,6 +186,14 @@
       "types": "./next/open-next.d.ts",
       "default": "./next/open-next.js"
     },
+    "./routing/evaluate": {
+      "types": "./routing/evaluate.d.ts",
+      "default": "./routing/evaluate.js"
+    },
+    "./routing/rules": {
+      "types": "./routing/rules.d.ts",
+      "default": "./routing/rules.js"
+    },
     "./_vendor/schemas/loaderKeys": {
       "types": "./_vendor/schemas/loaderKeys.d.ts",
       "default": "./_vendor/schemas/loaderKeys.mjs"

package/routing/evaluate.d.ts

@@ -0,0 +1,7 @@
+import type { NextRequest } from "next/server";
+import type { RedirectRule } from "../_vendor/schemas/routing/rules";
+import { NextResponse } from "next/server";
+export declare function evaluateRouting({ request, rules, }: {
+    request: NextRequest;
+    rules: readonly RedirectRule[];
+}): NextResponse;

package/routing/evaluate.js

@@ -0,0 +1,46 @@
+import { NextResponse } from "next/server";
+import { applyParams, matchSource } from "../_vendor/schemas/routing/match.mjs";
+function evaluateRouting({
+  request,
+  rules
+}) {
+  for (const rule of rules) {
+    const response = evaluateRedirect({ request, rule });
+    if (response) {
+      return response;
+    }
+  }
+  return NextResponse.next();
+}
+function evaluateRedirect({
+  request,
+  rule
+}) {
+  const params = matchSource({
+    source: rule.source,
+    pathname: request.nextUrl.pathname
+  });
+  if (!params) {
+    return null;
+  }
+  const url = new URL(
+    applyParams({ value: rule.destination, params }),
+    request.nextUrl.origin
+  );
+  if (url.origin === request.nextUrl.origin && !url.search) {
+    url.search = request.nextUrl.search;
+  }
+  const redirectsToCurrentRequest = url.origin === request.nextUrl.origin && normalizePath(url.pathname) === normalizePath(request.nextUrl.pathname) && url.search === request.nextUrl.search;
+  if (redirectsToCurrentRequest) {
+    return NextResponse.next();
+  }
+  return NextResponse.redirect(url, rule.status);
+}
+function normalizePath(pathname) {
+  const trimmed = pathname.replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+export {
+  evaluateRouting
+};
+//# sourceMappingURL=evaluate.js.map

package/routing/evaluate.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../routing/evaluate.ts"],
+  "sourcesContent": ["import type { NextRequest } from \"next/server\";\nimport type { RedirectRule } from \"schemas/routing/rules\";\n\nimport { NextResponse } from \"next/server\";\n\nimport { applyParams, matchSource } from \"schemas/routing/match\";\n\nexport function evaluateRouting({\n  request,\n  rules,\n}: {\n  request: NextRequest;\n  rules: readonly RedirectRule[];\n}): NextResponse {\n  for (const rule of rules) {\n    const response = evaluateRedirect({ request, rule });\n    if (response) {\n      return response;\n    }\n  }\n  return NextResponse.next();\n}\n\nfunction evaluateRedirect({\n  request,\n  rule,\n}: {\n  request: NextRequest;\n  rule: RedirectRule;\n}): NextResponse | null {\n  const params = matchSource({\n    source: rule.source,\n    pathname: request.nextUrl.pathname,\n  });\n  if (!params) {\n    return null;\n  }\n  const url = new URL(\n    applyParams({ value: rule.destination, params }),\n    request.nextUrl.origin,\n  );\n  if (url.origin === request.nextUrl.origin && !url.search) {\n    url.search = request.nextUrl.search;\n  }\n  // A destination that lands back on the current request would loop. The rule\n  // still consumes the request \u2014 later rules were authored as alternatives to\n  // it, not fallbacks for it \u2014 so the page renders normally instead.\n  const redirectsToCurrentRequest =\n    url.origin === request.nextUrl.origin &&\n    normalizePath(url.pathname) === normalizePath(request.nextUrl.pathname) &&\n    url.search === request.nextUrl.search;\n  if (redirectsToCurrentRequest) {\n    return NextResponse.next();\n  }\n  return NextResponse.redirect(url, rule.status);\n}\n\n/** Trailing slashes carry no meaning, so `/blogs` and `/blogs/` are the same. */\nfunction normalizePath(pathname: string): string {\n  const trimmed = pathname.replace(/\\/+$/, \"\");\n  return trimmed === \"\" ? \"/\" : trimmed;\n}\n"],
+  "mappings": "AAGA,SAAS,oBAAoB;AAE7B,SAAS,aAAa,mBAAmB;AAElC,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAGiB;AACf,aAAW,QAAQ,OAAO;AACxB,UAAM,WAAW,iBAAiB,EAAE,SAAS,KAAK,CAAC;AACnD,QAAI,UAAU;AACZ,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAC3B;AAEA,SAAS,iBAAiB;AAAA,EACxB;AAAA,EACA;AACF,GAGwB;AACtB,QAAM,SAAS,YAAY;AAAA,IACzB,QAAQ,KAAK;AAAA,IACb,UAAU,QAAQ,QAAQ;AAAA,EAC5B,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI;AAAA,IACd,YAAY,EAAE,OAAO,KAAK,aAAa,OAAO,CAAC;AAAA,IAC/C,QAAQ,QAAQ;AAAA,EAClB;AACA,MAAI,IAAI,WAAW,QAAQ,QAAQ,UAAU,CAAC,IAAI,QAAQ;AACxD,QAAI,SAAS,QAAQ,QAAQ;AAAA,EAC/B;AAIA,QAAM,4BACJ,IAAI,WAAW,QAAQ,QAAQ,UAC/B,cAAc,IAAI,QAAQ,MAAM,cAAc,QAAQ,QAAQ,QAAQ,KACtE,IAAI,WAAW,QAAQ,QAAQ;AACjC,MAAI,2BAA2B;AAC7B,WAAO,aAAa,KAAK;AAAA,EAC3B;AACA,SAAO,aAAa,SAAS,KAAK,KAAK,MAAM;AAC/C;AAGA,SAAS,cAAc,UAA0B;AAC/C,QAAM,UAAU,SAAS,QAAQ,QAAQ,EAAE;AAC3C,SAAO,YAAY,KAAK,MAAM;AAChC;",
+  "names": []
+}

package/routing/rules.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Site-facing entrypoint for redirect rule authoring.
+ *
+ * The schema, validators, and matcher live in `schemas/routing` so the Website
+ * Builder can import them without depending on a published package, whose
+ * release cycle shouldn't gate editor-only changes. Sites can't import
+ * `schemas` directly — it is workspace-only and reaches generated sites through
+ * the SDK's vendoring step — so `middleware.ts` keeps importing `reploRedirect`
+ * from here.
+ */
+export type { RedirectRule, RedirectStatus, } from "../_vendor/schemas/routing/rules";
+export { reploRedirect } from "../_vendor/schemas/routing/rules";

package/routing/rules.js

@@ -0,0 +1,5 @@
+import { reploRedirect } from "../_vendor/schemas/routing/rules.mjs";
+export {
+  reploRedirect
+};
+//# sourceMappingURL=rules.js.map

package/routing/rules.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../routing/rules.ts"],
+  "sourcesContent": ["/**\n * Site-facing entrypoint for redirect rule authoring.\n *\n * The schema, validators, and matcher live in `schemas/routing` so the Website\n * Builder can import them without depending on a published package, whose\n * release cycle shouldn't gate editor-only changes. Sites can't import\n * `schemas` directly \u2014 it is workspace-only and reaches generated sites through\n * the SDK's vendoring step \u2014 so `middleware.ts` keeps importing `reploRedirect`\n * from here.\n */\nexport type {\n  RedirectRule,\n  RedirectStatus,\n} from \"schemas/routing/rules\"; /* eslint-disable-line replo/no-export-from -- site-facing entrypoint intentionally re-exports the authoring API. */\nexport { reploRedirect } from \"schemas/routing/rules\"; /* eslint-disable-line replo/no-export-from -- site-facing entrypoint intentionally re-exports the authoring API. */\n"],
+  "mappings": "AAcA,SAAS,qBAAqB;",
+  "names": []
+}