@replohq/sdk 0.1.0

package/consent/script-snippets.js

@@ -0,0 +1,122 @@
+const PROVIDER_SNIPPETS = {
+  GA4: {
+    defaultConsent: ["analytics"],
+    buildTags: (id) => [
+      {
+        kind: "external",
+        src: `https://www.googletagmanager.com/gtag/js?id=${id}`
+      },
+      {
+        kind: "inline",
+        body: `window.dataLayer = window.dataLayer || [];
+function gtag(){dataLayer.push(arguments);}
+gtag('js', new Date());
+gtag('config', '${id}');`
+      }
+    ]
+  },
+  GoogleTagManager: {
+    defaultConsent: ["analytics", "marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`
+      }
+    ]
+  },
+  Meta: {
+    defaultConsent: ["marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`
+      }
+    ]
+  },
+  TikTok: {
+    defaultConsent: ["marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie","holdConsent","revokeConsent","grantConsent"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r="https://analytics.tiktok.com/i18n/pixel/events.js",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement("script");a.type="text/javascript",a.async=!0,a.src=r+"?sdkid="+e+"&lib="+t;var s=document.getElementsByTagName("script")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`
+      }
+    ]
+  },
+  Pinterest: {
+    defaultConsent: ["marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version="3.0";var t=document.createElement("script");t.async=!0,t.src=e;var r=document.getElementsByTagName("script")[0];r.parentNode.insertBefore(t,r)}}("https://s.pinimg.com/ct/core.js");pintrk('load','${id}');pintrk('page');`
+      }
+    ]
+  },
+  Reddit: {
+    defaultConsent: ["marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement("script");t.src="https://www.redditstatic.com/ads/pixel.js",t.async=!0;var s=d.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`
+      }
+    ]
+  },
+  Snapchat: {
+    defaultConsent: ["marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`
+      }
+    ]
+  },
+  Hotjar: {
+    defaultConsent: ["analytics"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`
+      }
+    ]
+  },
+  MicrosoftClarity: {
+    defaultConsent: ["analytics"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src="https://www.clarity.ms/tag/"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,"clarity","script","${id}");`
+      }
+    ]
+  },
+  Segment: {
+    defaultConsent: ["analytics", "marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `!function(){var i="analytics",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error("Segment snippet included twice.");else{analytics.invoked=!0;analytics.methods=["trackSubmit","trackClick","trackLink","trackForm","pageview","identify","reset","group","track","ready","alias","debug","page","screen","once","off","on","addSourceMiddleware","addIntegrationMiddleware","setAnonymousId","addDestinationMiddleware","register"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement("script");t.type="text/javascript";t.async=!0;t.src="https://cdn.segment.com/analytics.js/v1/"+key+"/analytics.min.js";var n=document.getElementsByTagName("script")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey="${id}";analytics.SNIPPET_VERSION="5.2.0";analytics.load("${id}");analytics.page();}}();`
+      }
+    ]
+  },
+  Northbeam: {
+    defaultConsent: ["analytics", "marketing"],
+    buildTags: (id) => [
+      {
+        kind: "inline",
+        body: `(function(){var t;(n=t=t||{}).A="identify",n.B="trackPageView",n.C="fireEmailCaptureEvent",n.D="fireCustomGoal",n.E="firePurchaseEvent",n.F="trackPageViewInitial",n.G="fireSlimPurchaseEvent",n.H="identifyCustomerId";var n="https://j.northbeam.io/ota-sp/${id}.js";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement("script")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`
+      }
+    ]
+  }
+};
+function buildScriptTags({
+  type,
+  identifier
+}) {
+  return PROVIDER_SNIPPETS[type].buildTags(identifier);
+}
+function defaultConsentFor(type) {
+  return PROVIDER_SNIPPETS[type].defaultConsent;
+}
+export {
+  buildScriptTags,
+  defaultConsentFor
+};
+//# sourceMappingURL=script-snippets.js.map

package/consent/script-snippets.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../consent/script-snippets.ts"],
+  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\ntype ProviderType = Exclude<ReploScriptType, \"custom\" | \"snippet\">;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`,\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
+  "mappings": "AAkCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
+  "names": []
+}

package/consent/types.d.ts

@@ -0,0 +1,34 @@
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Segment" | "Northbeam" | "snippet" | "custom";
+export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
+export type ConsentMode = "off" | "simple" | "per-category";
+declare module "react" {
+    interface HtmlHTMLAttributes<T> {
+        "data-replo-consent-mode"?: ConsentMode;
+    }
+}
+export type ScriptTagDescriptor = {
+    kind: "external";
+    src: string;
+    attributes?: {
+        [x: string]: string;
+    };
+} | {
+    kind: "inline";
+    body: string;
+};
+export type ReploScriptEntry = {
+    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Segment" | "Northbeam";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
+} | {
+    type: "snippet";
+    id: string;
+    body: string;
+    requiredConsent: ConsentCategory[];
+} | {
+    type: "custom";
+    id: string;
+    requiredConsent: ConsentCategory[];
+    src?: string;
+    body?: string;
+};

package/consent/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/consent/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/consent/window-api.d.ts

@@ -0,0 +1,41 @@
+import type { ConsentCategory } from "../_vendor/schemas/generated/consent";
+/**
+ * Global, framework-agnostic consent API exposed on `window.Replo.customerPrivacy`,
+ * mirroring Shopify's Customer Privacy API surface so on-page (third-party)
+ * scripts can query consent and react to changes without importing canopy.
+ *
+ * It deliberately lives under our own `window.Replo` namespace rather than
+ * `window.Shopify` to avoid colliding with Shopify's real API on Shopify-backed
+ * sites.
+ */
+type ToggleableCategory = Exclude<ConsentCategory, "necessary">;
+/** Shopify-style tri-state: declared-allowed, declared-denied, or undeclared. */
+type ConsentSignal = "yes" | "no" | "";
+export interface ReploCustomerPrivacyApi {
+    /** Per-category declaration, or "" when the visitor has not decided. */
+    currentVisitorConsent(): Record<ToggleableCategory, ConsentSignal>;
+    analyticsProcessingAllowed(): boolean;
+    marketingAllowed(): boolean;
+    preferencesProcessingAllowed(): boolean;
+    saleOfDataAllowed(): boolean;
+    /** Whether the consent banner should still be shown (mode on + undecided). */
+    shouldShowBanner(): boolean;
+    /** Update a subset of categories; runs the optional callback once persisted. */
+    setTrackingConsent(consent: Partial<Record<ToggleableCategory, boolean>>, callback?: () => void): void;
+}
+declare global {
+    interface Window {
+        Replo?: {
+            customerPrivacy?: ReploCustomerPrivacyApi;
+        };
+    }
+}
+/** DOM event dispatched on `document` whenever consent changes. */
+export declare const CONSENT_CHANGE_EVENT = "visitorConsentCollected";
+/**
+ * Installs `window.Replo.customerPrivacy` and dispatches `visitorConsentCollected`
+ * on `document` whenever consent changes. Idempotent; returns a teardown that
+ * removes the change subscription. Safe to call on the server (no-op).
+ */
+export declare function installConsentWindowApi(): () => void;
+export {};

package/consent/window-api.js

@@ -0,0 +1,73 @@
+"use client";
+import { consentStore, isConsentAllowed } from "./consent-store";
+const CONSENT_CHANGE_EVENT = "visitorConsentCollected";
+function isAllowed(category) {
+  return isConsentAllowed({
+    state: consentStore.getSnapshot(),
+    requiredConsent: [category]
+  });
+}
+function currentVisitorConsent() {
+  const state = consentStore.getSnapshot();
+  const signal = (category) => {
+    if (state.decidedAt === null) {
+      return "";
+    }
+    return state.categories[category] ? "yes" : "no";
+  };
+  return {
+    analytics: signal("analytics"),
+    marketing: signal("marketing"),
+    preferences: signal("preferences"),
+    sale_of_data: signal("sale_of_data")
+  };
+}
+const api = {
+  currentVisitorConsent,
+  analyticsProcessingAllowed: () => isAllowed("analytics"),
+  marketingAllowed: () => isAllowed("marketing"),
+  preferencesProcessingAllowed: () => isAllowed("preferences"),
+  saleOfDataAllowed: () => isAllowed("sale_of_data"),
+  shouldShowBanner: () => {
+    const state = consentStore.getSnapshot();
+    return state.mode !== "off" && state.decidedAt === null;
+  },
+  setTrackingConsent: (consent, callback) => {
+    consentStore.updateCategories({ next: consent });
+    callback?.();
+  }
+};
+function consentChangeDetail() {
+  return {
+    analyticsAllowed: isAllowed("analytics"),
+    marketingAllowed: isAllowed("marketing"),
+    preferencesAllowed: isAllowed("preferences"),
+    saleOfDataAllowed: isAllowed("sale_of_data")
+  };
+}
+let teardown = null;
+function installConsentWindowApi() {
+  if (typeof window === "undefined") {
+    return () => {
+    };
+  }
+  if (teardown) {
+    return teardown;
+  }
+  window.Replo = { ...window.Replo, customerPrivacy: api };
+  const unsubscribe = consentStore.subscribe(() => {
+    document.dispatchEvent(
+      new CustomEvent(CONSENT_CHANGE_EVENT, { detail: consentChangeDetail() })
+    );
+  });
+  teardown = () => {
+    unsubscribe();
+    teardown = null;
+  };
+  return teardown;
+}
+export {
+  CONSENT_CHANGE_EVENT,
+  installConsentWindowApi
+};
+//# sourceMappingURL=window-api.js.map

package/consent/window-api.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../consent/window-api.ts"],
+  "sourcesContent": ["\"use client\";\n\nimport type { ConsentCategory } from \"schemas/generated/consent\";\n\nimport { consentStore, isConsentAllowed } from \"./consent-store\";\n\n/**\n * Global, framework-agnostic consent API exposed on `window.Replo.customerPrivacy`,\n * mirroring Shopify's Customer Privacy API surface so on-page (third-party)\n * scripts can query consent and react to changes without importing canopy.\n *\n * It deliberately lives under our own `window.Replo` namespace rather than\n * `window.Shopify` to avoid colliding with Shopify's real API on Shopify-backed\n * sites.\n */\n\ntype ToggleableCategory = Exclude<ConsentCategory, \"necessary\">;\n\n/** Shopify-style tri-state: declared-allowed, declared-denied, or undeclared. */\ntype ConsentSignal = \"yes\" | \"no\" | \"\";\n\nexport interface ReploCustomerPrivacyApi {\n  /** Per-category declaration, or \"\" when the visitor has not decided. */\n  currentVisitorConsent(): Record<ToggleableCategory, ConsentSignal>;\n  analyticsProcessingAllowed(): boolean;\n  marketingAllowed(): boolean;\n  preferencesProcessingAllowed(): boolean;\n  saleOfDataAllowed(): boolean;\n  /** Whether the consent banner should still be shown (mode on + undecided). */\n  shouldShowBanner(): boolean;\n  /** Update a subset of categories; runs the optional callback once persisted. */\n  setTrackingConsent(\n    consent: Partial<Record<ToggleableCategory, boolean>>,\n    callback?: () => void,\n  ): void;\n}\n\ndeclare global {\n  interface Window {\n    Replo?: { customerPrivacy?: ReploCustomerPrivacyApi };\n  }\n}\n\n/** DOM event dispatched on `document` whenever consent changes. */\nexport const CONSENT_CHANGE_EVENT = \"visitorConsentCollected\";\n\nfunction isAllowed(category: ConsentCategory): boolean {\n  return isConsentAllowed({\n    state: consentStore.getSnapshot(),\n    requiredConsent: [category],\n  });\n}\n\nfunction currentVisitorConsent(): Record<ToggleableCategory, ConsentSignal> {\n  const state = consentStore.getSnapshot();\n  const signal = (category: ToggleableCategory): ConsentSignal => {\n    if (state.decidedAt === null) {\n      return \"\";\n    }\n    return state.categories[category] ? \"yes\" : \"no\";\n  };\n  return {\n    analytics: signal(\"analytics\"),\n    marketing: signal(\"marketing\"),\n    preferences: signal(\"preferences\"),\n    sale_of_data: signal(\"sale_of_data\"),\n  };\n}\n\nconst api: ReploCustomerPrivacyApi = {\n  currentVisitorConsent,\n  analyticsProcessingAllowed: () => isAllowed(\"analytics\"),\n  marketingAllowed: () => isAllowed(\"marketing\"),\n  preferencesProcessingAllowed: () => isAllowed(\"preferences\"),\n  saleOfDataAllowed: () => isAllowed(\"sale_of_data\"),\n  shouldShowBanner: () => {\n    const state = consentStore.getSnapshot();\n    return state.mode !== \"off\" && state.decidedAt === null;\n  },\n  setTrackingConsent: (consent, callback) => {\n    consentStore.updateCategories({ next: consent });\n    callback?.();\n  },\n};\n\nfunction consentChangeDetail() {\n  return {\n    analyticsAllowed: isAllowed(\"analytics\"),\n    marketingAllowed: isAllowed(\"marketing\"),\n    preferencesAllowed: isAllowed(\"preferences\"),\n    saleOfDataAllowed: isAllowed(\"sale_of_data\"),\n  };\n}\n\nlet teardown: (() => void) | null = null;\n\n/**\n * Installs `window.Replo.customerPrivacy` and dispatches `visitorConsentCollected`\n * on `document` whenever consent changes. Idempotent; returns a teardown that\n * removes the change subscription. Safe to call on the server (no-op).\n */\nexport function installConsentWindowApi(): () => void {\n  if (typeof window === \"undefined\") {\n    return () => {\n      // no-op on the server\n    };\n  }\n  if (teardown) {\n    return teardown;\n  }\n  window.Replo = { ...window.Replo, customerPrivacy: api };\n  const unsubscribe = consentStore.subscribe(() => {\n    document.dispatchEvent(\n      new CustomEvent(CONSENT_CHANGE_EVENT, { detail: consentChangeDetail() }),\n    );\n  });\n  teardown = () => {\n    unsubscribe();\n    teardown = null;\n  };\n  return teardown;\n}\n"],
+  "mappings": ";AAIA,SAAS,cAAc,wBAAwB;AAwCxC,MAAM,uBAAuB;AAEpC,SAAS,UAAU,UAAoC;AACrD,SAAO,iBAAiB;AAAA,IACtB,OAAO,aAAa,YAAY;AAAA,IAChC,iBAAiB,CAAC,QAAQ;AAAA,EAC5B,CAAC;AACH;AAEA,SAAS,wBAAmE;AAC1E,QAAM,QAAQ,aAAa,YAAY;AACvC,QAAM,SAAS,CAAC,aAAgD;AAC9D,QAAI,MAAM,cAAc,MAAM;AAC5B,aAAO;AAAA,IACT;AACA,WAAO,MAAM,WAAW,QAAQ,IAAI,QAAQ;AAAA,EAC9C;AACA,SAAO;AAAA,IACL,WAAW,OAAO,WAAW;AAAA,IAC7B,WAAW,OAAO,WAAW;AAAA,IAC7B,aAAa,OAAO,aAAa;AAAA,IACjC,cAAc,OAAO,cAAc;AAAA,EACrC;AACF;AAEA,MAAM,MAA+B;AAAA,EACnC;AAAA,EACA,4BAA4B,MAAM,UAAU,WAAW;AAAA,EACvD,kBAAkB,MAAM,UAAU,WAAW;AAAA,EAC7C,8BAA8B,MAAM,UAAU,aAAa;AAAA,EAC3D,mBAAmB,MAAM,UAAU,cAAc;AAAA,EACjD,kBAAkB,MAAM;AACtB,UAAM,QAAQ,aAAa,YAAY;AACvC,WAAO,MAAM,SAAS,SAAS,MAAM,cAAc;AAAA,EACrD;AAAA,EACA,oBAAoB,CAAC,SAAS,aAAa;AACzC,iBAAa,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAC/C,eAAW;AAAA,EACb;AACF;AAEA,SAAS,sBAAsB;AAC7B,SAAO;AAAA,IACL,kBAAkB,UAAU,WAAW;AAAA,IACvC,kBAAkB,UAAU,WAAW;AAAA,IACvC,oBAAoB,UAAU,aAAa;AAAA,IAC3C,mBAAmB,UAAU,cAAc;AAAA,EAC7C;AACF;AAEA,IAAI,WAAgC;AAO7B,SAAS,0BAAsC;AACpD,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,MAAM;AAAA,IAEb;AAAA,EACF;AACA,MAAI,UAAU;AACZ,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,EAAE,GAAG,OAAO,OAAO,iBAAiB,IAAI;AACvD,QAAM,cAAc,aAAa,UAAU,MAAM;AAC/C,aAAS;AAAA,MACP,IAAI,YAAY,sBAAsB,EAAE,QAAQ,oBAAoB,EAAE,CAAC;AAAA,IACzE;AAAA,EACF,CAAC;AACD,aAAW,MAAM;AACf,gBAAY;AACZ,eAAW;AAAA,EACb;AACA,SAAO;AACT;",
+  "names": []
+}

package/env.d.ts

@@ -0,0 +1,9 @@
+type Env = {
+    CANOPY_API_HOST: string;
+    PROJECT_ID: string;
+    ANALYTICS_FIRE_API_URL?: string;
+    REPLO_ANALYTICS_PIXEL_URL?: string;
+    CHECKOUT_PROVIDER?: "shopify" | "stripe" | "none";
+};
+export declare const getEnv: () => Promise<Env>;
+export {};

package/env.js

@@ -0,0 +1,42 @@
+import { getCloudflareContext } from "@opennextjs/cloudflare";
+import JSONC from "tiny-jsonc";
+import { z } from "zod";
+import { CanopyError } from "./lib/canopy-error";
+const envSchema = z.object({
+  CANOPY_API_HOST: z.string().min(1),
+  PROJECT_ID: z.uuid(),
+  ANALYTICS_FIRE_API_URL: z.string().optional(),
+  REPLO_ANALYTICS_PIXEL_URL: z.string().optional(),
+  CHECKOUT_PROVIDER: z.enum(["shopify", "stripe", "none"]).optional()
+});
+const wranglerConfigSchema = z.object({ vars: envSchema });
+class MissingWranglerConfigError extends CanopyError {
+}
+const isDeployedWorker = () => {
+  return process.env.NODE_ENV === "production" && process.env.BUILD_ENV !== "build" && process.env.NEXT_PHASE !== "phase-production-build";
+};
+const getEnv = async () => {
+  if (isDeployedWorker()) {
+    const { env } = await getCloudflareContext({ async: true });
+    return envSchema.parse(env);
+  }
+  const { promises: fs } = await import(
+    /* turbopackIgnore: true */
+    /* webpackIgnore: true */
+    "node:fs"
+  );
+  let raw;
+  try {
+    raw = await fs.readFile(`${process.cwd()}/wrangler.jsonc`, "utf8");
+  } catch (error) {
+    throw new MissingWranglerConfigError({
+      message: `wrangler.jsonc not found in ${process.cwd()}. It holds this site's Replo project config (project id, API host) and is required to run outside the deployed worker. If this clone predates the committed config, open the site in Replo once \u2014 the dev server regenerates and commits it \u2014 then git pull.`,
+      cause: error
+    });
+  }
+  return wranglerConfigSchema.parse(JSONC.parse(raw)).vars;
+};
+export {
+  getEnv
+};
+//# sourceMappingURL=env.js.map

package/env.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../env.ts"],
+  "sourcesContent": ["import { getCloudflareContext } from \"@opennextjs/cloudflare\";\nimport JSONC from \"tiny-jsonc\";\nimport { z } from \"zod\";\n\nimport { CanopyError } from \"./lib/canopy-error\";\n\ntype Env = {\n  CANOPY_API_HOST: string;\n  PROJECT_ID: string;\n\n  // Base URL of analytics-fire (e.g. https://data.replo.app). Read server-side by\n  // the consent action (`consent/consent-actions.ts`) to forward proof-of-consent\n  // records. Optional: absent in environments where the audit pipeline isn't\n  // wired (e.g. local dev), where consent recording simply no-ops.\n  ANALYTICS_FIRE_API_URL?: string;\n\n  // Base URL of the Replo first-party analytics pixel CDN (e.g.\n  // https://pixel.replo.app). `<ReploFirstPartyPixel>` loads\n  // `${REPLO_ANALYTICS_PIXEL_URL}/latest.js` into the page once analytics consent\n  // is granted; the browser fetches it directly. Optional: absent when the pixel\n  // isn't configured (e.g. lean local dev), where the pixel simply isn't injected.\n  REPLO_ANALYTICS_PIXEL_URL?: string;\n\n  CHECKOUT_PROVIDER?: \"shopify\" | \"stripe\" | \"none\";\n};\n\nconst envSchema = z.object({\n  CANOPY_API_HOST: z.string().min(1),\n  PROJECT_ID: z.uuid(),\n  ANALYTICS_FIRE_API_URL: z.string().optional(),\n  REPLO_ANALYTICS_PIXEL_URL: z.string().optional(),\n  CHECKOUT_PROVIDER: z.enum([\"shopify\", \"stripe\", \"none\"]).optional(),\n});\n\nconst wranglerConfigSchema = z.object({ vars: envSchema });\n\nclass MissingWranglerConfigError extends CanopyError {}\n\n// NOTE (Cole, 2026-07-28, REPL-29501): outside the deployed worker, read wrangler.jsonc directly \u2014 concurrent workerd boots race on the shared .wrangler/state SQLite (SQLITE_BUSY).\nconst isDeployedWorker = () => {\n  return (\n    process.env.NODE_ENV === \"production\" &&\n    process.env.BUILD_ENV !== \"build\" &&\n    process.env.NEXT_PHASE !== \"phase-production-build\"\n  );\n};\n\nexport const getEnv = async (): Promise<Env> => {\n  if (isDeployedWorker()) {\n    const { env } = await getCloudflareContext({ async: true });\n    return envSchema.parse(env);\n  }\n  // NOTE (Cole, 2026-07-29, REPL-29501): client chunks bundle this module (integration-utils has client consumers). A static node:fs broke those chunks in 0.16.3, and a computed specifier fails Turbopack too (\"expression is too dynamic\") \u2014 only the ignore-annotated literal import compiles; postbuild.mjs asserts the annotation survives into dist.\n  const { promises: fs }: typeof import(\"node:fs\") = await import(\n    /* turbopackIgnore: true */ /* webpackIgnore: true */ \"node:fs\"\n  );\n  let raw: string;\n  try {\n    raw = await fs.readFile(`${process.cwd()}/wrangler.jsonc`, \"utf8\");\n  } catch (error) {\n    throw new MissingWranglerConfigError({\n      message:\n        `wrangler.jsonc not found in ${process.cwd()}. It holds this site's Replo project config ` +\n        `(project id, API host) and is required to run outside the deployed worker. ` +\n        `If this clone predates the committed config, open the site in Replo once \u2014 the dev ` +\n        `server regenerates and commits it \u2014 then git pull.`,\n      cause: error,\n    });\n  }\n  return wranglerConfigSchema.parse(JSONC.parse(raw)).vars;\n};\n"],
+  "mappings": "AAAA,SAAS,4BAA4B;AACrC,OAAO,WAAW;AAClB,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAsB5B,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,YAAY,EAAE,KAAK;AAAA,EACnB,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,mBAAmB,EAAE,KAAK,CAAC,WAAW,UAAU,MAAM,CAAC,EAAE,SAAS;AACpE,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEzD,MAAM,mCAAmC,YAAY;AAAC;AAGtD,MAAM,mBAAmB,MAAM;AAC7B,SACE,QAAQ,IAAI,aAAa,gBACzB,QAAQ,IAAI,cAAc,WAC1B,QAAQ,IAAI,eAAe;AAE/B;AAEO,MAAM,SAAS,YAA0B;AAC9C,MAAI,iBAAiB,GAAG;AACtB,UAAM,EAAE,IAAI,IAAI,MAAM,qBAAqB,EAAE,OAAO,KAAK,CAAC;AAC1D,WAAO,UAAU,MAAM,GAAG;AAAA,EAC5B;AAEA,QAAM,EAAE,UAAU,GAAG,IAA8B,MAAM;AAAA;AAAA;AAAA,IACD;AAAA,EACxD;AACA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,CAAC,mBAAmB,MAAM;AAAA,EACnE,SAAS,OAAO;AACd,UAAM,IAAI,2BAA2B;AAAA,MACnC,SACE,+BAA+B,QAAQ,IAAI,CAAC;AAAA,MAI9C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,qBAAqB,MAAM,MAAM,MAAM,GAAG,CAAC,EAAE;AACtD;",
+  "names": []
+}

package/gateways/canopy-api.d.ts

@@ -0,0 +1,83 @@
+import type { Cart } from "../cart/cart-schema";
+import { CanopyError } from "../lib/canopy-error";
+type CanopyApiGatewayErrorConfig = {
+    message: string;
+    statusCode?: number;
+    cause?: unknown;
+    additionalData?: Record<string, unknown>;
+};
+export declare class CanopyApiGatewayError extends CanopyError {
+    statusCode: number;
+    constructor(config: CanopyApiGatewayErrorConfig);
+}
+declare class CanopyApiGateway {
+    private apiHost;
+    private baseUrl;
+    constructor(apiHost: string);
+    private static readonly REQUEST_TIMEOUT_MILLISECONDS;
+    static setup(): Promise<CanopyApiGateway>;
+    private _post;
+    private _get;
+    invokeLoader({ loaderKey, args, }: {
+        loaderKey: string;
+        args: Record<string, unknown>;
+    }): Promise<{
+        data: unknown;
+        meta?: {
+            cache: {
+                hit: boolean;
+                ttlSeconds: number;
+            };
+        } | undefined;
+    }>;
+    private _cartPost;
+    cartGet({ cartId }: {
+        cartId: string;
+    }): Promise<Cart | null>;
+    cartCreate(options?: {
+        lines?: {
+            merchandiseId: string;
+            quantity: number;
+            attributes?: {
+                key: string;
+                value: string;
+            }[];
+            sellingPlanId?: string | null;
+        }[];
+        discountCodes?: string[];
+    }): Promise<Cart>;
+    cartAddLines({ cartId, lines, }: {
+        cartId: string;
+        lines: {
+            merchandiseId: string;
+            quantity: number;
+            attributes?: {
+                key: string;
+                value: string;
+            }[];
+            sellingPlanId?: string | null;
+        }[];
+    }): Promise<Cart>;
+    cartUpdateLines({ cartId, lines, }: {
+        cartId: string;
+        lines: {
+            lineId: string;
+            quantity: number;
+            attributes?: {
+                key: string;
+                value: string;
+            }[];
+            sellingPlanId?: string | null;
+        }[];
+    }): Promise<Cart>;
+    cartRemoveLines({ cartId, lineIds, }: {
+        cartId: string;
+        lineIds: string[];
+    }): Promise<Cart>;
+    cartUpdateDiscountCodes({ cartId, discountCodes, }: {
+        cartId: string;
+        discountCodes: string[];
+    }): Promise<Cart>;
+}
+export declare function getCanopyApiGateway(): Promise<CanopyApiGateway>;
+export {};