@replohq/sdk 0.2.0 → 0.3.0

package/_vendor/schemas/generated/consent.d.ts

@@ -1,4 +1,4 @@
-export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Segment" | "Northbeam" | "snippet" | "custom";
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "snippet" | "custom";
 export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
 export type ConsentMode = "off" | "simple" | "per-category";
 export type ScriptTagDescriptor = {
@@ -12,7 +12,7 @@ export type ScriptTagDescriptor = {
     body: string;
 };
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Segment" | "Northbeam";
+    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam";
     identifier: string;
     requiredConsent?: ConsentCategory[];
 } | {

package/consent/script-snippets.js

@@ -87,6 +87,18 @@ gtag('config', '${id}');`
       }
     ]
   },
+  Contentsquare: {
+    defaultConsent: ["analytics"],
+    // The UXA tag is a single async external script keyed by the 13-char tag id;
+    // it bootstraps the Contentsquare `_uxa` queue itself once loaded.
+    buildTags: (id) => [
+      {
+        kind: "external",
+        src: `https://t.contentsquare.net/uxa/${id}.js`,
+        attributes: { async: "true" }
+      }
+    ]
+  },
   Segment: {
     defaultConsent: ["analytics", "marketing"],
     buildTags: (id) => [

package/consent/script-snippets.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../consent/script-snippets.ts"],
-  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\ntype ProviderType = Exclude<ReploScriptType, \"custom\" | \"snippet\">;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`,\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
-  "mappings": "AAkCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
+  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\ntype ProviderType = Exclude<ReploScriptType, \"custom\" | \"snippet\">;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Contentsquare: {\n    defaultConsent: [\"analytics\"],\n    // The UXA tag is a single async external script keyed by the 13-char tag id;\n    // it bootstraps the Contentsquare `_uxa` queue itself once loaded.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://t.contentsquare.net/uxa/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`,\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
+  "mappings": "AAkCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,gBAAgB,CAAC,WAAW;AAAA;AAAA;AAAA,IAG5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,mCAAmC,EAAE;AAAA,QAC1C,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
   "names": []
 }

package/consent/types.d.ts

@@ -1,4 +1,4 @@
-export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Segment" | "Northbeam" | "snippet" | "custom";
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "snippet" | "custom";
 export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
 export type ConsentMode = "off" | "simple" | "per-category";
 declare module "react" {
@@ -17,7 +17,7 @@ export type ScriptTagDescriptor = {
     body: string;
 };
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Segment" | "Northbeam";
+    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam";
     identifier: string;
     requiredConsent?: ConsentCategory[];
 } | {

package/env.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../env.ts"],
-  "sourcesContent": ["import { getCloudflareContext } from \"@opennextjs/cloudflare\";\nimport JSONC from \"tiny-jsonc\";\nimport { z } from \"zod\";\n\nimport { CanopyError } from \"./lib/canopy-error\";\n\ntype Env = {\n  CANOPY_API_HOST: string;\n  PROJECT_ID: string;\n\n  // Base URL of analytics-fire (e.g. https://data.replo.app). Read server-side by\n  // the consent action (`consent/consent-actions.ts`) to forward proof-of-consent\n  // records. Optional: absent in environments where the audit pipeline isn't\n  // wired (e.g. local dev), where consent recording simply no-ops.\n  ANALYTICS_FIRE_API_URL?: string;\n\n  // Base URL of the Replo first-party analytics pixel CDN (e.g.\n  // https://pixel.replo.app). `<ReploFirstPartyPixel>` loads\n  // `${REPLO_ANALYTICS_PIXEL_URL}/latest.js` into the page once analytics consent\n  // is granted; the browser fetches it directly. Optional: absent when the pixel\n  // isn't configured (e.g. lean local dev), where the pixel simply isn't injected.\n  REPLO_ANALYTICS_PIXEL_URL?: string;\n\n  CHECKOUT_PROVIDER?: \"shopify\" | \"stripe\" | \"none\";\n};\n\nconst envSchema = z.object({\n  CANOPY_API_HOST: z.string().min(1),\n  PROJECT_ID: z.uuid(),\n  ANALYTICS_FIRE_API_URL: z.string().optional(),\n  REPLO_ANALYTICS_PIXEL_URL: z.string().optional(),\n  CHECKOUT_PROVIDER: z.enum([\"shopify\", \"stripe\", \"none\"]).optional(),\n});\n\nconst wranglerConfigSchema = z.object({ vars: envSchema });\n\nclass MissingWranglerConfigError extends CanopyError {}\n\n// NOTE (Cole, 2026-07-28, REPL-29501): outside the deployed worker, read wrangler.jsonc directly \u2014 concurrent workerd boots race on the shared .wrangler/state SQLite (SQLITE_BUSY).\nconst isDeployedWorker = () => {\n  return (\n    process.env.NODE_ENV === \"production\" &&\n    process.env.BUILD_ENV !== \"build\" &&\n    process.env.NEXT_PHASE !== \"phase-production-build\"\n  );\n};\n\nexport const getEnv = async (): Promise<Env> => {\n  if (isDeployedWorker()) {\n    const { env } = await getCloudflareContext({ async: true });\n    return envSchema.parse(env);\n  }\n  // NOTE (Cole, 2026-07-29, REPL-29501): client chunks bundle this module (integration-utils has client consumers). A static node:fs broke those chunks in 0.16.3, and a computed specifier fails Turbopack too (\"expression is too dynamic\") \u2014 only the ignore-annotated literal import compiles; postbuild.mjs asserts the annotation survives into dist.\n  const { promises: fs }: typeof import(\"node:fs\") = await import(\n    /* turbopackIgnore: true */ /* webpackIgnore: true */ \"node:fs\"\n  );\n  let raw: string;\n  try {\n    raw = await fs.readFile(`${process.cwd()}/wrangler.jsonc`, \"utf8\");\n  } catch (error) {\n    throw new MissingWranglerConfigError({\n      message:\n        `wrangler.jsonc not found in ${process.cwd()}. It holds this site's Replo project config ` +\n        `(project id, API host) and is required to run outside the deployed worker. ` +\n        `If this clone predates the committed config, open the site in Replo once \u2014 the dev ` +\n        `server regenerates and commits it \u2014 then git pull.`,\n      cause: error,\n    });\n  }\n  return wranglerConfigSchema.parse(JSONC.parse(raw)).vars;\n};\n"],
+  "sourcesContent": ["import { getCloudflareContext } from \"@opennextjs/cloudflare\";\nimport JSONC from \"tiny-jsonc\";\nimport { z } from \"zod\";\n\nimport { CanopyError } from \"./lib/canopy-error\";\n\ntype Env = {\n  CANOPY_API_HOST: string;\n  PROJECT_ID: string;\n\n  // Base URL of analytics-fire (e.g. https://data.replo.app). Read server-side by\n  // the consent action (`consent/consent-actions.ts`) to forward proof-of-consent\n  // records. Optional: absent in environments where the audit pipeline isn't\n  // wired (e.g. local dev), where consent recording simply no-ops.\n  ANALYTICS_FIRE_API_URL?: string;\n\n  // Base URL of the Replo first-party analytics pixel CDN (e.g.\n  // https://pixel.replo.app). `<ReploFirstPartyPixel>` loads\n  // `${REPLO_ANALYTICS_PIXEL_URL}/latest.js` into the page once analytics consent\n  // is granted; the browser fetches it directly. Optional: absent when the pixel\n  // isn't configured (e.g. lean local dev), where the pixel simply isn't injected.\n  REPLO_ANALYTICS_PIXEL_URL?: string;\n\n  CHECKOUT_PROVIDER?: \"shopify\" | \"stripe\" | \"none\";\n};\n\nconst envSchema = z.object({\n  CANOPY_API_HOST: z.string().min(1),\n  PROJECT_ID: z.uuid(),\n  ANALYTICS_FIRE_API_URL: z.string().optional(),\n  REPLO_ANALYTICS_PIXEL_URL: z.string().optional(),\n  CHECKOUT_PROVIDER: z.enum([\"shopify\", \"stripe\", \"none\"]).optional(),\n});\n\nconst wranglerConfigSchema = z.object({ vars: envSchema });\n\nclass MissingWranglerConfigError extends CanopyError {}\n\n// NOTE (Cole, 2026-07-28, REPL-29501): outside the deployed worker, read wrangler.jsonc directly \u2014 concurrent workerd boots race on the shared .wrangler/state SQLite (SQLITE_BUSY).\nconst isDeployedWorker = () => {\n  return (\n    process.env.NODE_ENV === \"production\" &&\n    process.env.BUILD_ENV !== \"build\" &&\n    process.env.NEXT_PHASE !== \"phase-production-build\"\n  );\n};\n\nexport const getEnv = async (): Promise<Env> => {\n  if (isDeployedWorker()) {\n    const { env } = await getCloudflareContext({ async: true });\n    return envSchema.parse(env);\n  }\n  // NOTE (Cole, 2026-07-29, REPL-29501): client chunks bundle this module (integration-utils has client consumers). A static node:fs broke those chunks in 0.16.3, and a computed specifier fails Turbopack too (\"expression is too dynamic\") \u2014 only the ignore-annotated literal import compiles; postbuild.mts asserts the annotation survives into dist.\n  const { promises: fs }: typeof import(\"node:fs\") = await import(\n    /* turbopackIgnore: true */ /* webpackIgnore: true */ \"node:fs\"\n  );\n  let raw: string;\n  try {\n    raw = await fs.readFile(`${process.cwd()}/wrangler.jsonc`, \"utf8\");\n  } catch (error) {\n    throw new MissingWranglerConfigError({\n      message:\n        `wrangler.jsonc not found in ${process.cwd()}. It holds this site's Replo project config ` +\n        `(project id, API host) and is required to run outside the deployed worker. ` +\n        `If this clone predates the committed config, open the site in Replo once \u2014 the dev ` +\n        `server regenerates and commits it \u2014 then git pull.`,\n      cause: error,\n    });\n  }\n  return wranglerConfigSchema.parse(JSONC.parse(raw)).vars;\n};\n"],
   "mappings": "AAAA,SAAS,4BAA4B;AACrC,OAAO,WAAW;AAClB,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAsB5B,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACjC,YAAY,EAAE,KAAK;AAAA,EACnB,wBAAwB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5C,2BAA2B,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/C,mBAAmB,EAAE,KAAK,CAAC,WAAW,UAAU,MAAM,CAAC,EAAE,SAAS;AACpE,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEzD,MAAM,mCAAmC,YAAY;AAAC;AAGtD,MAAM,mBAAmB,MAAM;AAC7B,SACE,QAAQ,IAAI,aAAa,gBACzB,QAAQ,IAAI,cAAc,WAC1B,QAAQ,IAAI,eAAe;AAE/B;AAEO,MAAM,SAAS,YAA0B;AAC9C,MAAI,iBAAiB,GAAG;AACtB,UAAM,EAAE,IAAI,IAAI,MAAM,qBAAqB,EAAE,OAAO,KAAK,CAAC;AAC1D,WAAO,UAAU,MAAM,GAAG;AAAA,EAC5B;AAEA,QAAM,EAAE,UAAU,GAAG,IAA8B,MAAM;AAAA;AAAA;AAAA,IACD;AAAA,EACxD;AACA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,CAAC,mBAAmB,MAAM;AAAA,EACnE,SAAS,OAAO;AACd,UAAM,IAAI,2BAA2B;AAAA,MACnC,SACE,+BAA+B,QAAQ,IAAI,CAAC;AAAA,MAI9C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,qBAAqB,MAAM,MAAM,MAAM,GAAG,CAAC,EAAE;AACtD;",
   "names": []
 }

package/next/config.js

@@ -17,6 +17,7 @@ const PLATFORM_SERVER_ACTION_ORIGINS = [
 ];
 function siteConfig(overrides = {}) {
   const isBuild = process.env.BUILD_ENV === "build";
+  const devRoot = process.env.IS_REPLO_SANDBOX ? "/workspace/dev" : process.cwd();
   const {
     turbopack: overrideTurbopack,
     images: overrideImages,
@@ -45,7 +46,7 @@ function siteConfig(overrides = {}) {
     // time; keep dev's watcher on the user app tree.
     turbopack: {
       ...overrideTurbopack,
-      root: isBuild ? "/" : "/workspace/dev"
+      root: isBuild ? "/" : devRoot
     },
     // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull
     // in lodash-es `uniq` here — dedupe inline via a Set instead.

package/next/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../next/config.ts"],
-  "sourcesContent": ["import os from \"os\";\nimport type { NextConfig } from \"next\";\n\n// Origins browsers load sandbox previews from \u2014 PREVIEW_HOSTNAME in the\n// coordinator's wrangler.jsonc plus Daytona's native preview domain. Next 16\n// hard-blocks cross-origin dev requests (HMR WebSocket, Server Actions) from\n// origins missing here.\nconst PLATFORM_DEV_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.daytonaproxy01.net\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst PLATFORM_SERVER_ACTION_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.cloudflare-agent-coordinator.replo.workers.dev\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\n// The canonical Next.js runtime contract shared by every agent-built site.\n// Sites re-export `default` from here through a one-line `next.config.ts` shim,\n// so the platform wiring (sandbox dist dirs, Turbopack root, preview origins,\n// Cloudflare image loader) lives in exactly one place instead of being copied\n// into each template.\n//\n// `overrides` is a per-site customization surface, but it must not be able to\n// silently amputate platform wiring. A plain `...overrides` spread is a shallow\n// merge: a site that sets any nested key (e.g. `experimental.typedRoutes`)\n// would replace the whole `experimental`/`images` block and drop platform\n// defaults like the build-worker OOM guard or the Cloudflare image loader. So\n// load-bearing keys are re-asserted after the spread and the nested blocks are\n// deep-merged: a site can add keys, but platform invariants always win and\n// platform origin lists are preserved (site entries are appended, not swapped).\nexport function siteConfig(overrides: NextConfig = {}): NextConfig {\n  const isBuild = process.env.BUILD_ENV === \"build\";\n  const {\n    turbopack: overrideTurbopack,\n    images: overrideImages,\n    experimental: overrideExperimental,\n    allowedDevOrigins: overrideDevOrigins,\n    ...restOverrides\n  } = overrides;\n\n  const { serverActions: overrideServerActions, ...restOverrideExperimental } =\n    overrideExperimental ?? {};\n\n  return {\n    // Site-overridable defaults.\n    reactStrictMode: true,\n    devIndicators: false,\n    ...restOverrides,\n\n    // Platform invariants \u2014 re-asserted after the spread so a site override\n    // can never break sandbox builds, publish, or the dev server.\n    output: \"standalone\",\n    distDir: isBuild ? \".next\" : \".next-dev\",\n    // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches\n    // required-server-files.json to clear this value before OpenNext bundles,\n    // since \"/\" makes esbuild emit absolute-path requires that break in Workers.\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Leave outputFileTracingRoot\n    // unset outside builds because Next 15.5+ otherwise forces turbopack.root to\n    // \"/\" and makes the dev watcher retain whole-filesystem state.\n    outputFileTracingRoot: isBuild ? \"/\" : undefined,\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Match build tracing at publish\n    // time; keep dev's watcher on the user app tree.\n    turbopack: {\n      ...overrideTurbopack,\n      root: isBuild ? \"/\" : \"/workspace/dev\",\n    },\n    // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull\n    // in lodash-es `uniq` here \u2014 dedupe inline via a Set instead.\n    allowedDevOrigins: Array.from(\n      new Set([...(overrideDevOrigins ?? []), ...PLATFORM_DEV_ORIGINS]),\n    ),\n    images: {\n      ...overrideImages,\n      loader: \"custom\",\n      loaderFile: \"./image-loader.ts\",\n      remotePatterns: overrideImages?.remotePatterns ?? [\n        {\n          protocol: \"https\",\n          hostname: \"**\",\n        },\n      ],\n    },\n    experimental: {\n      ...restOverrideExperimental,\n      // NOTE (Cole, 2026-06-18, REPL-28180): Next sizes its build worker pool\n      // off os.cpus().length = host cores (~64) inside a cgroup-limited sandbox,\n      // not the 2 the container actually has \u2014 a worker swarm that OOMs the\n      // 4 GiB box. availableParallelism() is cgroup-aware. Gated to prod build.\n      cpus: isBuild ? os.availableParallelism() : undefined,\n      serverActions: {\n        ...overrideServerActions,\n        allowedOrigins: Array.from(\n          new Set([\n            ...(overrideServerActions?.allowedOrigins ?? []),\n            ...PLATFORM_SERVER_ACTION_ORIGINS,\n          ]),\n        ),\n      },\n    },\n  };\n}\n\nconst nextConfig: NextConfig = siteConfig();\n\nexport default nextConfig;\n"],
-  "mappings": "AAAA,OAAO,QAAQ;AAOf,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,WAAW,YAAwB,CAAC,GAAe;AACjE,QAAM,UAAU,QAAQ,IAAI,cAAc;AAC1C,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,EAAE,eAAe,uBAAuB,GAAG,yBAAyB,IACxE,wBAAwB,CAAC;AAE3B,SAAO;AAAA;AAAA,IAEL,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,GAAG;AAAA;AAAA;AAAA,IAIH,QAAQ;AAAA,IACR,SAAS,UAAU,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO7B,uBAAuB,UAAU,MAAM;AAAA;AAAA;AAAA,IAGvC,WAAW;AAAA,MACT,GAAG;AAAA,MACH,MAAM,UAAU,MAAM;AAAA,IACxB;AAAA;AAAA;AAAA,IAGA,mBAAmB,MAAM;AAAA,MACvB,oBAAI,IAAI,CAAC,GAAI,sBAAsB,CAAC,GAAI,GAAG,oBAAoB,CAAC;AAAA,IAClE;AAAA,IACA,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,gBAAgB,gBAAgB,kBAAkB;AAAA,QAChD;AAAA,UACE,UAAU;AAAA,UACV,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKH,MAAM,UAAU,GAAG,qBAAqB,IAAI;AAAA,MAC5C,eAAe;AAAA,QACb,GAAG;AAAA,QACH,gBAAgB,MAAM;AAAA,UACpB,oBAAI,IAAI;AAAA,YACN,GAAI,uBAAuB,kBAAkB,CAAC;AAAA,YAC9C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAAyB,WAAW;AAE1C,IAAO,iBAAQ;",
+  "sourcesContent": ["import os from \"os\";\nimport type { NextConfig } from \"next\";\n\n// Origins browsers load sandbox previews from \u2014 PREVIEW_HOSTNAME in the\n// coordinator's wrangler.jsonc plus Daytona's native preview domain. Next 16\n// hard-blocks cross-origin dev requests (HMR WebSocket, Server Actions) from\n// origins missing here.\nconst PLATFORM_DEV_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.daytonaproxy01.net\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst PLATFORM_SERVER_ACTION_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.cloudflare-agent-coordinator.replo.workers.dev\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\n// The canonical Next.js runtime contract shared by every agent-built site.\n// Sites re-export `default` from here through a one-line `next.config.ts` shim,\n// so the platform wiring (sandbox dist dirs, Turbopack root, preview origins,\n// Cloudflare image loader) lives in exactly one place instead of being copied\n// into each template.\n//\n// `overrides` is a per-site customization surface, but it must not be able to\n// silently amputate platform wiring. A plain `...overrides` spread is a shallow\n// merge: a site that sets any nested key (e.g. `experimental.typedRoutes`)\n// would replace the whole `experimental`/`images` block and drop platform\n// defaults like the build-worker OOM guard or the Cloudflare image loader. So\n// load-bearing keys are re-asserted after the spread and the nested blocks are\n// deep-merged: a site can add keys, but platform invariants always win and\n// platform origin lists are preserved (site entries are appended, not swapped).\nexport function siteConfig(overrides: NextConfig = {}): NextConfig {\n  const isBuild = process.env.BUILD_ENV === \"build\";\n  const devRoot = process.env.IS_REPLO_SANDBOX\n    ? \"/workspace/dev\"\n    : process.cwd();\n  const {\n    turbopack: overrideTurbopack,\n    images: overrideImages,\n    experimental: overrideExperimental,\n    allowedDevOrigins: overrideDevOrigins,\n    ...restOverrides\n  } = overrides;\n\n  const { serverActions: overrideServerActions, ...restOverrideExperimental } =\n    overrideExperimental ?? {};\n\n  return {\n    // Site-overridable defaults.\n    reactStrictMode: true,\n    devIndicators: false,\n    ...restOverrides,\n\n    // Platform invariants \u2014 re-asserted after the spread so a site override\n    // can never break sandbox builds, publish, or the dev server.\n    output: \"standalone\",\n    distDir: isBuild ? \".next\" : \".next-dev\",\n    // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches\n    // required-server-files.json to clear this value before OpenNext bundles,\n    // since \"/\" makes esbuild emit absolute-path requires that break in Workers.\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Leave outputFileTracingRoot\n    // unset outside builds because Next 15.5+ otherwise forces turbopack.root to\n    // \"/\" and makes the dev watcher retain whole-filesystem state.\n    outputFileTracingRoot: isBuild ? \"/\" : undefined,\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Match build tracing at publish\n    // time; keep dev's watcher on the user app tree.\n    turbopack: {\n      ...overrideTurbopack,\n      root: isBuild ? \"/\" : devRoot,\n    },\n    // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull\n    // in lodash-es `uniq` here \u2014 dedupe inline via a Set instead.\n    allowedDevOrigins: Array.from(\n      new Set([...(overrideDevOrigins ?? []), ...PLATFORM_DEV_ORIGINS]),\n    ),\n    images: {\n      ...overrideImages,\n      loader: \"custom\",\n      loaderFile: \"./image-loader.ts\",\n      remotePatterns: overrideImages?.remotePatterns ?? [\n        {\n          protocol: \"https\",\n          hostname: \"**\",\n        },\n      ],\n    },\n    experimental: {\n      ...restOverrideExperimental,\n      // NOTE (Cole, 2026-06-18, REPL-28180): Next sizes its build worker pool\n      // off os.cpus().length = host cores (~64) inside a cgroup-limited sandbox,\n      // not the 2 the container actually has \u2014 a worker swarm that OOMs the\n      // 4 GiB box. availableParallelism() is cgroup-aware. Gated to prod build.\n      cpus: isBuild ? os.availableParallelism() : undefined,\n      serverActions: {\n        ...overrideServerActions,\n        allowedOrigins: Array.from(\n          new Set([\n            ...(overrideServerActions?.allowedOrigins ?? []),\n            ...PLATFORM_SERVER_ACTION_ORIGINS,\n          ]),\n        ),\n      },\n    },\n  };\n}\n\nconst nextConfig: NextConfig = siteConfig();\n\nexport default nextConfig;\n"],
+  "mappings": "AAAA,OAAO,QAAQ;AAOf,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,WAAW,YAAwB,CAAC,GAAe;AACjE,QAAM,UAAU,QAAQ,IAAI,cAAc;AAC1C,QAAM,UAAU,QAAQ,IAAI,mBACxB,mBACA,QAAQ,IAAI;AAChB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,EAAE,eAAe,uBAAuB,GAAG,yBAAyB,IACxE,wBAAwB,CAAC;AAE3B,SAAO;AAAA;AAAA,IAEL,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,GAAG;AAAA;AAAA;AAAA,IAIH,QAAQ;AAAA,IACR,SAAS,UAAU,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO7B,uBAAuB,UAAU,MAAM;AAAA;AAAA;AAAA,IAGvC,WAAW;AAAA,MACT,GAAG;AAAA,MACH,MAAM,UAAU,MAAM;AAAA,IACxB;AAAA;AAAA;AAAA,IAGA,mBAAmB,MAAM;AAAA,MACvB,oBAAI,IAAI,CAAC,GAAI,sBAAsB,CAAC,GAAI,GAAG,oBAAoB,CAAC;AAAA,IAClE;AAAA,IACA,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,gBAAgB,gBAAgB,kBAAkB;AAAA,QAChD;AAAA,UACE,UAAU;AAAA,UACV,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKH,MAAM,UAAU,GAAG,qBAAqB,IAAI;AAAA,MAC5C,eAAe;AAAA,QACb,GAAG;AAAA,QACH,gBAAgB,MAAM;AAAA,UACpB,oBAAI,IAAI;AAAA,YACN,GAAI,uBAAuB,kBAAkB,CAAC;AAAA,YAC9C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAAyB,WAAW;AAE1C,IAAO,iBAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@replohq/sdk",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",