@replohq/sdk 0.6.1 → 0.8.0

package/_vendor/replo-utils/lib/url.d.ts

@@ -55,3 +55,8 @@ export declare const isValidRoutePath: (path: string) => boolean;
  * relative value such as a site path.
  */
 export declare function parseUrl(value: string, base?: string): URL | null;
+/**
+ * File extension from a URL's path, lowercased, defaulting to "jpg" for
+ * extensionless paths (product imagery is the primary consumer).
+ */
+export declare function fileExtensionFromUrl(url: string): string;

package/_vendor/schemas/generated/consent.d.ts

@@ -1,4 +1,4 @@
-export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "snippet" | "custom";
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Cookiebot" | "snippet" | "custom" | "consentPlatform";
 export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
 export type ConsentMode = "off" | "simple" | "per-category";
 export type ScriptTagDescriptor = {
@@ -16,6 +16,10 @@ export type ReploScriptEntry = {
     type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+} | {
+    type: "Cookiebot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
 } | {
     type: "snippet";
     id: string;
@@ -28,6 +32,19 @@ export type ReploScriptEntry = {
     requiredConsent: ConsentCategory[];
     src?: string;
     body?: string;
+} | {
+    type: "consentPlatform";
+    id: string;
+    src: string;
+    attributes?: {
+        [x: string]: string;
+    };
+    blockingAttribute: {
+        name: string;
+        values: {
+            [x: string]: string;
+        };
+    };
 };
 export type ConsentAction = "accept" | "reject" | "update" | "withdraw";
 export type ConsentRecordRequest = {

package/_vendor/schemas/routing/locale.d.ts

@@ -0,0 +1,45 @@
+import { ReploError } from "../errors";
+import { z } from "zod";
+export declare class LocaleRoutingValidationError extends ReploError {
+}
+/**
+ * Set by the runtime when a visitor explicitly picks a locale (a language
+ * switcher link, or landing on a locale-prefixed URL). Negotiation reads it
+ * ahead of any detection, so an explicit choice always wins.
+ */
+export declare const REPLO_LOCALE_COOKIE = "replo-locale";
+/**
+ * Overrides the visitor's IP-derived country for testing geo behavior without
+ * a VPN — works identically in dev sandboxes and on the published site. At
+ * worst it lets a visitor pick which locale they see, which the locale cookie
+ * already allows deliberately.
+ */
+export declare const REPLO_COUNTRY_OVERRIDE_COOKIE = "replo-country-override";
+export declare function canonicalizeLocaleTag(tag: string): string | null;
+export declare const DOMAIN_HOSTNAME: RegExp;
+export declare const localeRoutingConfigSchema: z.ZodObject<{
+    locales: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    defaultLocale: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    detection: z.ZodDefault<z.ZodEnum<{
+        country: "country";
+        language: "language";
+    }>>;
+    urlMode: z.ZodDefault<z.ZodEnum<{
+        prefixed: "prefixed";
+        hidden: "hidden";
+    }>>;
+    domains: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        locales: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        defaultLocale: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type LocaleRoutingConfig = z.infer<typeof localeRoutingConfigSchema>;
+export type LocaleRoutingConfigInput = z.input<typeof localeRoutingConfigSchema>;
+export type LocaleDetection = LocaleRoutingConfig["detection"];
+export type LocaleUrlMode = LocaleRoutingConfig["urlMode"];
+/**
+ * Validates a locale routing config, returning it with every tag
+ * canonicalized and defaults applied. Throws `LocaleRoutingValidationError`
+ * carrying the first failing check's message.
+ */
+export declare function reploLocaleRouting(input: LocaleRoutingConfigInput): LocaleRoutingConfig;

package/_vendor/schemas/routing/locale.mjs

@@ -0,0 +1,95 @@
+import { ReploError } from '../../../chunk-5M7VU32I.mjs';
+import '../../../chunk-UJCSKKID.mjs';
+import { z } from 'zod';
+
+var LocaleRoutingValidationError = class extends ReploError {
+};
+var REPLO_LOCALE_COOKIE = "replo-locale";
+var REPLO_COUNTRY_OVERRIDE_COOKIE = "replo-country-override";
+var CANONICAL_LOCALE_TAG = /^[a-z]{2,3}(-[A-Z][a-z]{3})?(-([A-Z]{2}|\d{3}))?$/;
+function canonicalizeLocaleTag(tag) {
+  let canonical;
+  try {
+    canonical = Intl.getCanonicalLocales(tag)[0];
+  } catch {
+    return null;
+  }
+  if (!canonical || !CANONICAL_LOCALE_TAG.test(canonical)) {
+    return null;
+  }
+  return canonical;
+}
+var localeTagSchema = z.string().transform((tag, context) => {
+  const canonical = canonicalizeLocaleTag(tag);
+  if (canonical === null) {
+    context.addIssue({
+      code: "custom",
+      message: `"${tag}" is not a locale tag \u2014 use a BCP 47 tag like "en", "fr-CA", or "zh-Hant"`
+    });
+    return z.NEVER;
+  }
+  return canonical;
+});
+var DOMAIN_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,62})?(\.[a-z0-9]([a-z0-9-]{0,62})?)+$/;
+var domainScopeSchema = z.object({
+  locales: z.array(localeTagSchema).min(1),
+  defaultLocale: localeTagSchema.optional()
+}).strict();
+var localeRoutingConfigSchema = z.object({
+  locales: z.array(localeTagSchema).min(2),
+  defaultLocale: localeTagSchema,
+  detection: z.enum(["language", "country"]).default("language"),
+  urlMode: z.enum(["prefixed", "hidden"]).default("prefixed"),
+  domains: z.record(z.string(), domainScopeSchema).optional()
+}).strict().superRefine((config, context) => {
+  const configured = new Set(config.locales);
+  if (configured.size !== config.locales.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["locales"],
+      message: "locales must not repeat after canonicalization"
+    });
+  }
+  if (!configured.has(config.defaultLocale)) {
+    context.addIssue({
+      code: "custom",
+      path: ["defaultLocale"],
+      message: `defaultLocale "${config.defaultLocale}" must be one of locales`
+    });
+  }
+  for (const [hostname, scope] of Object.entries(config.domains ?? {})) {
+    if (!DOMAIN_HOSTNAME.test(hostname)) {
+      context.addIssue({
+        code: "custom",
+        path: ["domains", hostname],
+        message: `"${hostname}" must be a bare lowercase hostname like "example.com" \u2014 no scheme, path, or port`
+      });
+    }
+    for (const locale of scope.locales) {
+      if (!configured.has(locale)) {
+        context.addIssue({
+          code: "custom",
+          path: ["domains", hostname, "locales"],
+          message: `"${locale}" is not in the top-level locales list`
+        });
+      }
+    }
+    if (scope.defaultLocale !== void 0 && !scope.locales.includes(scope.defaultLocale)) {
+      context.addIssue({
+        code: "custom",
+        path: ["domains", hostname, "defaultLocale"],
+        message: `defaultLocale "${scope.defaultLocale}" must be one of this domain's locales`
+      });
+    }
+  }
+});
+function reploLocaleRouting(input) {
+  const parsed = localeRoutingConfigSchema.safeParse(input);
+  if (parsed.success) {
+    return parsed.data;
+  }
+  const message = parsed.error.issues[0]?.message ?? "invalid locale routing config";
+  throw new LocaleRoutingValidationError({ message });
+}
+
+export { DOMAIN_HOSTNAME, LocaleRoutingValidationError, REPLO_COUNTRY_OVERRIDE_COOKIE, REPLO_LOCALE_COOKIE, canonicalizeLocaleTag, localeRoutingConfigSchema, reploLocaleRouting };

package/_vendor/schemas/routing/localeNegotiation.d.ts

@@ -0,0 +1,87 @@
+import type { LocaleRoutingConfig } from "./locale";
+/** The locales one request negotiates within, after domain scoping. */
+export interface LocaleScope {
+    locales: string[];
+    defaultLocale: string;
+}
+export interface NegotiatedLocale {
+    locale: string;
+    source: "cookie" | "country" | "language" | "default";
+}
+/**
+ * The scope a request's Host header lands in. A host with no domain entry —
+ * including every dev sandbox and preview host — gets the global scope, which
+ * keeps domain configs inert anywhere the real hostnames don't resolve.
+ */
+export declare function resolveLocaleScope({ host, config, }: {
+    host: string | null;
+    config: LocaleRoutingConfig;
+}): LocaleScope;
+/**
+ * The tags of an `Accept-Language` header, highest preference first. `*` is
+ * dropped — matching anything and matching nothing both fall through to the
+ * default locale — and so is any tag `matchBestFitLocale` would choke on, so
+ * one garbage entry never voids the visitor's real preferences.
+ */
+export declare function parseAcceptLanguage(header: string | null): string[];
+/**
+ * The best supported locale for an ordered list of requested tags, or null
+ * when no requested tag relates to any supported locale. Supported order
+ * breaks ties, so the config's own ordering expresses preference.
+ */
+export declare function matchLocale({ requested, supported, }: {
+    requested: readonly string[];
+    supported: readonly string[];
+}): string | null;
+/**
+ * One request's locale, from the strongest signal available: an explicit
+ * cookie choice, then the detection strategy, then the scope default. Country
+ * detection derives its candidates from the locales' own region subtags —
+ * `CA` finds `en-CA` and `fr-CA` — and breaks multilingual-country ties with
+ * `Accept-Language` among just those candidates. A country matching no locale
+ * falls through to language detection rather than the default, so a German
+ * visitor of a `["en", "fr"]` site still gets a language they asked for.
+ */
+export declare function negotiateLocale({ scope, detection, cookieLocale, countryCode, acceptLanguageHeader, }: {
+    scope: LocaleScope;
+    detection: LocaleRoutingConfig["detection"];
+    cookieLocale: string | null;
+    countryCode: string | null;
+    acceptLanguageHeader: string | null;
+}): NegotiatedLocale;
+export interface PathLocale {
+    locale: string;
+    /** The prefix segment as it appeared in the URL, casing included. */
+    pathSegment: string;
+    /** The pathname with the locale prefix removed; always starts with `/`. */
+    logicalPath: string;
+}
+/**
+ * The configured locale a pathname's first segment names, or null. Matching
+ * is case-insensitive — `/en-ca/about` still identifies `en-CA` — and the
+ * caller decides whether a non-canonical spelling deserves a redirect.
+ */
+export declare function getLocaleFromPath({ pathname, locales, }: {
+    pathname: string;
+    locales: readonly string[];
+}): PathLocale | null;
+/** `/about` under `fr-CA` is `/fr-CA/about`; the root is `/fr-CA` itself. */
+export declare function withLocalePrefix({ locale, path, }: {
+    locale: string;
+    path: string;
+}): string;
+/**
+ * The URL of a logical path in another locale — the one primitive a language
+ * switcher and hreflang alternates need. Within the current host's scope (or
+ * with no domains configured) it is the locale-prefixed path; a locale served
+ * by a different domain gets an absolute URL there, dropping the prefix when
+ * that domain serves only the one locale. Hidden-mode sites use the prefixed
+ * form too: the runtime converts an explicit locale prefix into a cookie plus
+ * a clean-URL redirect on arrival.
+ */
+export declare function localeUrl({ locale, path, config, currentHost, }: {
+    locale: string;
+    path: string;
+    config: LocaleRoutingConfig;
+    currentHost?: string | null;
+}): string;

package/_vendor/schemas/routing/localeNegotiation.mjs

@@ -0,0 +1,141 @@
+import '../../../chunk-UJCSKKID.mjs';
+import { match } from '@formatjs/intl-localematcher';
+import Negotiator from 'negotiator';
+
+function resolveLocaleScope({
+  host,
+  config
+}) {
+  const hostname = host?.trim().toLowerCase().split(":")[0] ?? "";
+  const scope = config.domains?.[hostname];
+  if (!scope) {
+    return { locales: config.locales, defaultLocale: config.defaultLocale };
+  }
+  const firstScopeLocale = scope.locales[0] ?? config.defaultLocale;
+  return {
+    locales: scope.locales,
+    defaultLocale: scope.defaultLocale ?? (scope.locales.includes(config.defaultLocale) ? config.defaultLocale : firstScopeLocale)
+  };
+}
+function parseAcceptLanguage(header) {
+  if (!header) {
+    return [];
+  }
+  const languages = new Negotiator({
+    headers: { "accept-language": header }
+  }).languages();
+  return languages.filter((tag) => tag !== "*" && isStructurallyValidTag(tag));
+}
+function matchLocale({
+  requested,
+  supported
+}) {
+  const wellFormed = requested.filter(isStructurallyValidTag);
+  if (wellFormed.length === 0 || supported.length === 0) {
+    return null;
+  }
+  const result = match(wellFormed, [...supported], "und");
+  return supported.includes(result) ? result : null;
+}
+function negotiateLocale({
+  scope,
+  detection,
+  cookieLocale,
+  countryCode,
+  acceptLanguageHeader
+}) {
+  const fromCookie = cookieLocale ? findTagInsensitive({ tag: cookieLocale, supported: scope.locales }) : null;
+  if (fromCookie) {
+    return { locale: fromCookie, source: "cookie" };
+  }
+  const requested = parseAcceptLanguage(acceptLanguageHeader);
+  if (detection === "country" && countryCode) {
+    const region = countryCode.trim().toUpperCase();
+    const candidates = scope.locales.filter(
+      (locale) => localeRegion(locale) === region
+    );
+    const [firstCandidate] = candidates;
+    if (firstCandidate !== void 0) {
+      return {
+        locale: matchLocale({ requested, supported: candidates }) ?? firstCandidate,
+        source: "country"
+      };
+    }
+  }
+  const fromLanguage = matchLocale({ requested, supported: scope.locales });
+  if (fromLanguage) {
+    return { locale: fromLanguage, source: "language" };
+  }
+  return { locale: scope.defaultLocale, source: "default" };
+}
+function getLocaleFromPath({
+  pathname,
+  locales
+}) {
+  const [, firstSegment = "", ...restSegments] = pathname.split("/");
+  const locale = findTagInsensitive({ tag: firstSegment, supported: locales });
+  if (!locale) {
+    return null;
+  }
+  const rest = restSegments.join("/");
+  return {
+    locale,
+    pathSegment: firstSegment,
+    logicalPath: `/${rest}`
+  };
+}
+function withLocalePrefix({
+  locale,
+  path
+}) {
+  const normalized = path.startsWith("/") ? path : `/${path}`;
+  return normalized === "/" ? `/${locale}` : `/${locale}${normalized}`;
+}
+function localeUrl({
+  locale,
+  path,
+  config,
+  currentHost
+}) {
+  const currentScope = resolveLocaleScope({
+    host: currentHost ?? null,
+    config
+  });
+  if (!config.domains || currentScope.locales.includes(locale)) {
+    return withLocalePrefix({ locale, path });
+  }
+  const hosting = Object.entries(config.domains).find(([, scope2]) => {
+    return scope2.locales.includes(locale);
+  });
+  if (!hosting) {
+    return withLocalePrefix({ locale, path });
+  }
+  const [hostname, scope] = hosting;
+  const normalized = path.startsWith("/") ? path : `/${path}`;
+  const pathPart = scope.locales.length === 1 ? normalized : withLocalePrefix({ locale, path: normalized });
+  return `https://${hostname}${pathPart === "/" ? "" : pathPart}`;
+}
+function findTagInsensitive({
+  tag,
+  supported
+}) {
+  const lowered = tag.toLowerCase();
+  return supported.find((candidate) => candidate.toLowerCase() === lowered) ?? null;
+}
+function isStructurallyValidTag(tag) {
+  try {
+    Intl.getCanonicalLocales(tag);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function localeRegion(locale) {
+  try {
+    return new Intl.Locale(locale).region ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export { getLocaleFromPath, localeUrl, matchLocale, negotiateLocale, parseAcceptLanguage, resolveLocaleScope, withLocalePrefix };

package/_vendor/schemas/routing/rules.mjs

@@ -1,5 +1,5 @@
-import { ReploError } from '../../../chunk-5M7VU32I.mjs';
 import { getParamSegment, getRouteParams, hasRouteParam, matchSource } from '../../../chunk-VPEVERWE.mjs';
+import { ReploError } from '../../../chunk-5M7VU32I.mjs';
 import '../../../chunk-UJCSKKID.mjs';
 import { z } from 'zod';
 

package/analytics/analytics-provider.js

@@ -53,6 +53,7 @@ function AnalyticsProvider({
     return combineSinks(
       getAnalyticsSinks({
         consent: {
+          cmp: consent.cmp,
           mode: consent.mode,
           categories: consent.categories,
           decidedAt: consent.decidedAt
@@ -62,6 +63,7 @@ function AnalyticsProvider({
       })
     );
   }, [
+    consent.cmp,
     consent.mode,
     consent.categories,
     consent.decidedAt,

package/analytics/analytics-provider.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../analytics/analytics-provider.tsx"],
-  "sourcesContent": ["\"use client\";\n\nimport type React from \"react\";\nimport type { CheckoutProvider } from \"../lib/integration-utils\";\nimport type { AnalyticsSink } from \"./analytics-sink\";\nimport type { PageMetadata } from \"./utils/navigation-tracker\";\n\nimport { createContext, useContext, useEffect, useMemo, useRef } from \"react\";\n\nimport { useConsent } from \"../consent/consent-store\";\nimport { useRegisteredScripts } from \"../consent/script-registration-store\";\nimport { getAnalyticsSinks } from \"./get-analytics-sinks\";\nimport { NavigationTracker } from \"./utils/navigation-tracker\";\n\nfunction combineSinks(sinks: AnalyticsSink[]): AnalyticsSink {\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  const broadcast = async (method: keyof AnalyticsSink, ...args: any[]) => {\n    if (typeof window !== \"undefined\") {\n      console.debug(\n        \"[analytics] broadcast\",\n        method,\n        \"to\",\n        sinks.length,\n        \"sinks\",\n        { args },\n      );\n    }\n\n    await Promise.all(\n      sinks.map(async (sink) => {\n        try {\n          // Legacy cast - may or may not be necessary\n          // oxlint-disable-next-line replo/no-as-cast, typescript/no-explicit-any -- legacy any/cast, may or may not be needed\n          const sinkMethod = sink[method] as (...args: any[]) => Promise<void>;\n          await sinkMethod.apply(sink, args);\n        } catch {\n          if (typeof window !== \"undefined\") {\n            console.warn(\"[analytics] sink error\", { method, sink });\n          }\n        }\n      }),\n    );\n  };\n\n  return {\n    pageView: (...args) => broadcast(\"pageView\", ...args),\n    purchase: (...args) => broadcast(\"purchase\", ...args),\n    click: (...args) => broadcast(\"click\", ...args),\n    productViewed: (...args) => broadcast(\"productViewed\", ...args),\n    addToCart: (...args) => broadcast(\"addToCart\", ...args),\n    removeFromCart: (...args) => broadcast(\"removeFromCart\", ...args),\n    viewCart: (...args) => broadcast(\"viewCart\", ...args),\n    startCheckout: (...args) => broadcast(\"startCheckout\", ...args),\n    viewCollection: (...args) => broadcast(\"viewCollection\", ...args),\n  };\n}\n\ninterface AnalyticsContextType {\n  analytics: AnalyticsSink | null;\n}\n\nconst AnalyticsContext = createContext<AnalyticsContextType | null>(null);\n\nexport function AnalyticsProvider({\n  children,\n  checkoutProvider,\n}: React.PropsWithChildren<{ checkoutProvider?: CheckoutProvider }>) {\n  const consent = useConsent();\n  const registeredScripts = useRegisteredScripts();\n\n  // Sinks are derived from consent + which managed scripts are on the page, so\n  // the set rebuilds whenever the visitor changes consent or a script mounts.\n  const analytics = useMemo(() => {\n    return combineSinks(\n      getAnalyticsSinks({\n        consent: {\n          mode: consent.mode,\n          categories: consent.categories,\n          decidedAt: consent.decidedAt,\n        },\n        registeredScripts,\n        checkoutProvider,\n      }),\n    );\n  }, [\n    consent.mode,\n    consent.categories,\n    consent.decidedAt,\n    registeredScripts,\n    checkoutProvider,\n  ]);\n\n  // The navigation tracker is set up once, but always dispatches to the latest\n  // combined sink via a ref so consent/registration changes take effect.\n  const analyticsRef = useRef(analytics);\n  analyticsRef.current = analytics;\n  const navigationTracker = useRef<NavigationTracker | null>(null);\n\n  // eslint-disable-next-line replo/no-use-effect -- one-time SPA navigation tracking setup; dispatches through analyticsRef to stay current\n  useEffect(() => {\n    if (typeof window === \"undefined\") {\n      return;\n    }\n    navigationTracker.current = new NavigationTracker(\n      (metadata: PageMetadata) => {\n        void analyticsRef.current.pageView(metadata);\n      },\n    );\n    navigationTracker.current.init();\n\n    return () => {\n      navigationTracker.current?.cleanup();\n    };\n  }, []);\n\n  return (\n    <AnalyticsContext.Provider value={{ analytics }}>\n      {children}\n    </AnalyticsContext.Provider>\n  );\n}\n\nclass AnalyticsContextError extends Error {\n  constructor({ message }: { message: string }) {\n    super(message);\n  }\n}\n\n/**\n * Returns the AnalyticsSink from the nearest AnalyticsProvider.\n * Throws if used outside of an AnalyticsProvider.\n */\nexport function useAnalytics(): AnalyticsSink | null {\n  const context = useContext(AnalyticsContext);\n  if (!context) {\n    throw new AnalyticsContextError({\n      message: \"useAnalytics must be used within <AnalyticsProvider>\",\n    });\n  }\n  return context.analytics;\n}\n\n/**\n * Returns the AnalyticsSink if an AnalyticsProvider is present, or null otherwise.\n * Does not throw -- safe to use in components that may render with or without analytics.\n */\nexport function useAnalyticsOptional(): AnalyticsSink | null {\n  const context = useContext(AnalyticsContext);\n  return context?.analytics ?? null;\n}\n"],
-  "mappings": ";AAoHI;AA7GJ,SAAS,eAAe,YAAY,WAAW,SAAS,cAAc;AAEtE,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AACrC,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAElC,SAAS,aAAa,OAAuC;AAE3D,QAAM,YAAY,OAAO,WAAgC,SAAgB;AACvE,QAAI,OAAO,WAAW,aAAa;AACjC,cAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA,EAAE,KAAK;AAAA,MACT;AAAA,IACF;AAEA,UAAM,QAAQ;AAAA,MACZ,MAAM,IAAI,OAAO,SAAS;AACxB,YAAI;AAGF,gBAAM,aAAa,KAAK,MAAM;AAC9B,gBAAM,WAAW,MAAM,MAAM,IAAI;AAAA,QACnC,QAAQ;AACN,cAAI,OAAO,WAAW,aAAa;AACjC,oBAAQ,KAAK,0BAA0B,EAAE,QAAQ,KAAK,CAAC;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,IAAI,SAAS,UAAU,YAAY,GAAG,IAAI;AAAA,IACpD,UAAU,IAAI,SAAS,UAAU,YAAY,GAAG,IAAI;AAAA,IACpD,OAAO,IAAI,SAAS,UAAU,SAAS,GAAG,IAAI;AAAA,IAC9C,eAAe,IAAI,SAAS,UAAU,iBAAiB,GAAG,IAAI;AAAA,IAC9D,WAAW,IAAI,SAAS,UAAU,aAAa,GAAG,IAAI;AAAA,IACtD,gBAAgB,IAAI,SAAS,UAAU,kBAAkB,GAAG,IAAI;AAAA,IAChE,UAAU,IAAI,SAAS,UAAU,YAAY,GAAG,IAAI;AAAA,IACpD,eAAe,IAAI,SAAS,UAAU,iBAAiB,GAAG,IAAI;AAAA,IAC9D,gBAAgB,IAAI,SAAS,UAAU,kBAAkB,GAAG,IAAI;AAAA,EAClE;AACF;AAMA,MAAM,mBAAmB,cAA2C,IAAI;AAEjE,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AACF,GAAqE;AACnE,QAAM,UAAU,WAAW;AAC3B,QAAM,oBAAoB,qBAAqB;AAI/C,QAAM,YAAY,QAAQ,MAAM;AAC9B,WAAO;AAAA,MACL,kBAAkB;AAAA,QAChB,SAAS;AAAA,UACP,MAAM,QAAQ;AAAA,UACd,YAAY,QAAQ;AAAA,UACpB,WAAW,QAAQ;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF,CAAC;AAID,QAAM,eAAe,OAAO,SAAS;AACrC,eAAa,UAAU;AACvB,QAAM,oBAAoB,OAAiC,IAAI;AAG/D,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,aAAa;AACjC;AAAA,IACF;AACA,sBAAkB,UAAU,IAAI;AAAA,MAC9B,CAAC,aAA2B;AAC1B,aAAK,aAAa,QAAQ,SAAS,QAAQ;AAAA,MAC7C;AAAA,IACF;AACA,sBAAkB,QAAQ,KAAK;AAE/B,WAAO,MAAM;AACX,wBAAkB,SAAS,QAAQ;AAAA,IACrC;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,iBAAiB,UAAjB,EAA0B,OAAO,EAAE,UAAU,GAC3C,UACH;AAEJ;AAEA,MAAM,8BAA8B,MAAM;AAAA,EACxC,YAAY,EAAE,QAAQ,GAAwB;AAC5C,UAAM,OAAO;AAAA,EACf;AACF;AAMO,SAAS,eAAqC;AACnD,QAAM,UAAU,WAAW,gBAAgB;AAC3C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,sBAAsB;AAAA,MAC9B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,QAAQ;AACjB;AAMO,SAAS,uBAA6C;AAC3D,QAAM,UAAU,WAAW,gBAAgB;AAC3C,SAAO,SAAS,aAAa;AAC/B;",
+  "sourcesContent": ["\"use client\";\n\nimport type React from \"react\";\nimport type { CheckoutProvider } from \"../lib/integration-utils\";\nimport type { AnalyticsSink } from \"./analytics-sink\";\nimport type { PageMetadata } from \"./utils/navigation-tracker\";\n\nimport { createContext, useContext, useEffect, useMemo, useRef } from \"react\";\n\nimport { useConsent } from \"../consent/consent-store\";\nimport { useRegisteredScripts } from \"../consent/script-registration-store\";\nimport { getAnalyticsSinks } from \"./get-analytics-sinks\";\nimport { NavigationTracker } from \"./utils/navigation-tracker\";\n\nfunction combineSinks(sinks: AnalyticsSink[]): AnalyticsSink {\n  // oxlint-disable-next-line typescript/no-explicit-any -- legacy any, may or may not be needed\n  const broadcast = async (method: keyof AnalyticsSink, ...args: any[]) => {\n    if (typeof window !== \"undefined\") {\n      console.debug(\n        \"[analytics] broadcast\",\n        method,\n        \"to\",\n        sinks.length,\n        \"sinks\",\n        { args },\n      );\n    }\n\n    await Promise.all(\n      sinks.map(async (sink) => {\n        try {\n          // Legacy cast - may or may not be necessary\n          // oxlint-disable-next-line replo/no-as-cast, typescript/no-explicit-any -- legacy any/cast, may or may not be needed\n          const sinkMethod = sink[method] as (...args: any[]) => Promise<void>;\n          await sinkMethod.apply(sink, args);\n        } catch {\n          if (typeof window !== \"undefined\") {\n            console.warn(\"[analytics] sink error\", { method, sink });\n          }\n        }\n      }),\n    );\n  };\n\n  return {\n    pageView: (...args) => broadcast(\"pageView\", ...args),\n    purchase: (...args) => broadcast(\"purchase\", ...args),\n    click: (...args) => broadcast(\"click\", ...args),\n    productViewed: (...args) => broadcast(\"productViewed\", ...args),\n    addToCart: (...args) => broadcast(\"addToCart\", ...args),\n    removeFromCart: (...args) => broadcast(\"removeFromCart\", ...args),\n    viewCart: (...args) => broadcast(\"viewCart\", ...args),\n    startCheckout: (...args) => broadcast(\"startCheckout\", ...args),\n    viewCollection: (...args) => broadcast(\"viewCollection\", ...args),\n  };\n}\n\ninterface AnalyticsContextType {\n  analytics: AnalyticsSink | null;\n}\n\nconst AnalyticsContext = createContext<AnalyticsContextType | null>(null);\n\nexport function AnalyticsProvider({\n  children,\n  checkoutProvider,\n}: React.PropsWithChildren<{ checkoutProvider?: CheckoutProvider }>) {\n  const consent = useConsent();\n  const registeredScripts = useRegisteredScripts();\n\n  // Sinks are derived from consent + which managed scripts are on the page, so\n  // the set rebuilds whenever the visitor changes consent or a script mounts.\n  const analytics = useMemo(() => {\n    return combineSinks(\n      getAnalyticsSinks({\n        consent: {\n          cmp: consent.cmp,\n          mode: consent.mode,\n          categories: consent.categories,\n          decidedAt: consent.decidedAt,\n        },\n        registeredScripts,\n        checkoutProvider,\n      }),\n    );\n  }, [\n    consent.cmp,\n    consent.mode,\n    consent.categories,\n    consent.decidedAt,\n    registeredScripts,\n    checkoutProvider,\n  ]);\n\n  // The navigation tracker is set up once, but always dispatches to the latest\n  // combined sink via a ref so consent/registration changes take effect.\n  const analyticsRef = useRef(analytics);\n  analyticsRef.current = analytics;\n  const navigationTracker = useRef<NavigationTracker | null>(null);\n\n  // eslint-disable-next-line replo/no-use-effect -- one-time SPA navigation tracking setup; dispatches through analyticsRef to stay current\n  useEffect(() => {\n    if (typeof window === \"undefined\") {\n      return;\n    }\n    navigationTracker.current = new NavigationTracker(\n      (metadata: PageMetadata) => {\n        void analyticsRef.current.pageView(metadata);\n      },\n    );\n    navigationTracker.current.init();\n\n    return () => {\n      navigationTracker.current?.cleanup();\n    };\n  }, []);\n\n  return (\n    <AnalyticsContext.Provider value={{ analytics }}>\n      {children}\n    </AnalyticsContext.Provider>\n  );\n}\n\nclass AnalyticsContextError extends Error {\n  constructor({ message }: { message: string }) {\n    super(message);\n  }\n}\n\n/**\n * Returns the AnalyticsSink from the nearest AnalyticsProvider.\n * Throws if used outside of an AnalyticsProvider.\n */\nexport function useAnalytics(): AnalyticsSink | null {\n  const context = useContext(AnalyticsContext);\n  if (!context) {\n    throw new AnalyticsContextError({\n      message: \"useAnalytics must be used within <AnalyticsProvider>\",\n    });\n  }\n  return context.analytics;\n}\n\n/**\n * Returns the AnalyticsSink if an AnalyticsProvider is present, or null otherwise.\n * Does not throw -- safe to use in components that may render with or without analytics.\n */\nexport function useAnalyticsOptional(): AnalyticsSink | null {\n  const context = useContext(AnalyticsContext);\n  return context?.analytics ?? null;\n}\n"],
+  "mappings": ";AAsHI;AA/GJ,SAAS,eAAe,YAAY,WAAW,SAAS,cAAc;AAEtE,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AACrC,SAAS,yBAAyB;AAClC,SAAS,yBAAyB;AAElC,SAAS,aAAa,OAAuC;AAE3D,QAAM,YAAY,OAAO,WAAgC,SAAgB;AACvE,QAAI,OAAO,WAAW,aAAa;AACjC,cAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA,EAAE,KAAK;AAAA,MACT;AAAA,IACF;AAEA,UAAM,QAAQ;AAAA,MACZ,MAAM,IAAI,OAAO,SAAS;AACxB,YAAI;AAGF,gBAAM,aAAa,KAAK,MAAM;AAC9B,gBAAM,WAAW,MAAM,MAAM,IAAI;AAAA,QACnC,QAAQ;AACN,cAAI,OAAO,WAAW,aAAa;AACjC,oBAAQ,KAAK,0BAA0B,EAAE,QAAQ,KAAK,CAAC;AAAA,UACzD;AAAA,QACF;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,IAAI,SAAS,UAAU,YAAY,GAAG,IAAI;AAAA,IACpD,UAAU,IAAI,SAAS,UAAU,YAAY,GAAG,IAAI;AAAA,IACpD,OAAO,IAAI,SAAS,UAAU,SAAS,GAAG,IAAI;AAAA,IAC9C,eAAe,IAAI,SAAS,UAAU,iBAAiB,GAAG,IAAI;AAAA,IAC9D,WAAW,IAAI,SAAS,UAAU,aAAa,GAAG,IAAI;AAAA,IACtD,gBAAgB,IAAI,SAAS,UAAU,kBAAkB,GAAG,IAAI;AAAA,IAChE,UAAU,IAAI,SAAS,UAAU,YAAY,GAAG,IAAI;AAAA,IACpD,eAAe,IAAI,SAAS,UAAU,iBAAiB,GAAG,IAAI;AAAA,IAC9D,gBAAgB,IAAI,SAAS,UAAU,kBAAkB,GAAG,IAAI;AAAA,EAClE;AACF;AAMA,MAAM,mBAAmB,cAA2C,IAAI;AAEjE,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AACF,GAAqE;AACnE,QAAM,UAAU,WAAW;AAC3B,QAAM,oBAAoB,qBAAqB;AAI/C,QAAM,YAAY,QAAQ,MAAM;AAC9B,WAAO;AAAA,MACL,kBAAkB;AAAA,QAChB,SAAS;AAAA,UACP,KAAK,QAAQ;AAAA,UACb,MAAM,QAAQ;AAAA,UACd,YAAY,QAAQ;AAAA,UACpB,WAAW,QAAQ;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,GAAG;AAAA,IACD,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF,CAAC;AAID,QAAM,eAAe,OAAO,SAAS;AACrC,eAAa,UAAU;AACvB,QAAM,oBAAoB,OAAiC,IAAI;AAG/D,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,aAAa;AACjC;AAAA,IACF;AACA,sBAAkB,UAAU,IAAI;AAAA,MAC9B,CAAC,aAA2B;AAC1B,aAAK,aAAa,QAAQ,SAAS,QAAQ;AAAA,MAC7C;AAAA,IACF;AACA,sBAAkB,QAAQ,KAAK;AAE/B,WAAO,MAAM;AACX,wBAAkB,SAAS,QAAQ;AAAA,IACrC;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SACE,oBAAC,iBAAiB,UAAjB,EAA0B,OAAO,EAAE,UAAU,GAC3C,UACH;AAEJ;AAEA,MAAM,8BAA8B,MAAM;AAAA,EACxC,YAAY,EAAE,QAAQ,GAAwB;AAC5C,UAAM,OAAO;AAAA,EACf;AACF;AAMO,SAAS,eAAqC;AACnD,QAAM,UAAU,WAAW,gBAAgB;AAC3C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,sBAAsB;AAAA,MAC9B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,SAAO,QAAQ;AACjB;AAMO,SAAS,uBAA6C;AAC3D,QAAM,UAAU,WAAW,gBAAgB;AAC3C,SAAO,SAAS,aAAa;AAC/B;",
   "names": []
 }

package/analytics/get-analytics-sinks.d.ts

@@ -16,6 +16,7 @@ import type { AnalyticsSink } from "./analytics-sink";
  *   egress / processing), so it counts as `analytics`-category tracking and is
  *   gated by that consent. It is an implicit sink this scaffold always ships
  *   (not tied to a registered entry) and is never editable in the miniapp.
+ *   Under a delegated platform, `analytics` reflects that platform's answer.
  *
  * Third-party provider sinks are created only when a matching `<ReploScripts>`
  * entry is registered AND its required consent is granted.

package/analytics/get-analytics-sinks.js

@@ -22,7 +22,10 @@ function getAnalyticsSinks({
   checkoutProvider
 }) {
   const sinks = [new WindowSink()];
-  const firstPartyAllowed = consent.mode === "off" || consent.categories.analytics;
+  const firstPartyAllowed = isConsentAllowed({
+    state: consent,
+    requiredConsent: ["analytics"]
+  });
   if (firstPartyAllowed) {
     sinks.push(new ReploSink());
   }

package/analytics/get-analytics-sinks.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../analytics/get-analytics-sinks.ts"],
-  "sourcesContent": ["import type { ReploScriptType } from \"schemas/generated/consent\";\nimport type { ConsentState } from \"../consent/consent-store\";\nimport type { RegisteredScript } from \"../consent/script-registration-store\";\nimport type { CheckoutProvider } from \"../lib/integration-utils\";\nimport type { AnalyticsSink } from \"./analytics-sink\";\n\nimport { isConsentAllowed } from \"../consent/consent-store\";\nimport { GA4Sink } from \"./sinks/ga4-sink\";\nimport { MetaSink } from \"./sinks/meta-sink\";\nimport { PinterestSink } from \"./sinks/pinterest-sink\";\nimport { RedditSink } from \"./sinks/reddit-sink\";\nimport { ReploSink } from \"./sinks/replo-sink\";\nimport { SnapchatSink } from \"./sinks/snapchat-sink\";\nimport { TikTokSink } from \"./sinks/tiktok-sink\";\nimport { WindowSink } from \"./sinks/window-sink\";\nimport { gateShopifyOwnedFunnelEvents } from \"./utils/shopify-funnel-gate\";\n\n/**\n * Named providers that have a corresponding ecommerce-event sink. The other\n * managed providers (GoogleTagManager, Hotjar, MicrosoftClarity, Segment) and\n * generic `snippet`/`custom` entries load scripts but do not map to\n * `AnalyticsSink` events today, so they never produce a sink here.\n */\nconst PROVIDER_SINK_FACTORIES: Partial<\n  Record<ReploScriptType, () => AnalyticsSink>\n> = {\n  GA4: () => new GA4Sink(),\n  Meta: () => new MetaSink(),\n  TikTok: () => new TikTokSink(),\n  Snapchat: () => new SnapchatSink(),\n  Pinterest: () => new PinterestSink(),\n  Reddit: () => new RedditSink(),\n};\n\n/**\n * Builds the set of analytics sinks that may fire given the current consent\n * state and which managed scripts are registered on the page.\n *\n * Consent gates data egress, not in-page plumbing:\n * - `WindowSink` is a local `CustomEvent` bus (no data leaves the device), so it\n *   always ships regardless of consent. Its consumers self-gate: managed pixels\n *   are already gated at the injection layer (they never mount without consent,\n *   so they never subscribe), and unmanaged custom scripts are the author's\n *   responsibility.\n * - `ReploSink` forwards into Replo's first-party analytics pipeline (real\n *   egress / processing), so it counts as `analytics`-category tracking and is\n *   gated by that consent. It is an implicit sink this scaffold always ships\n *   (not tied to a registered entry) and is never editable in the miniapp.\n *\n * Third-party provider sinks are created only when a matching `<ReploScripts>`\n * entry is registered AND its required consent is granted.\n */\nexport function getAnalyticsSinks({\n  consent,\n  registeredScripts,\n  checkoutProvider,\n}: {\n  consent: ConsentState;\n  registeredScripts: RegisteredScript[];\n  checkoutProvider?: CheckoutProvider;\n}): AnalyticsSink[] {\n  const sinks: AnalyticsSink[] = [new WindowSink()];\n\n  const firstPartyAllowed =\n    consent.mode === \"off\" || consent.categories.analytics;\n  if (firstPartyAllowed) {\n    sinks.push(new ReploSink());\n  }\n\n  // When Shopify hosts checkout, its native channels report the checkout-funnel\n  // events to ad platforms server-side. Suppress those events on third-party\n  // storefront pixels so they don't double-count Shopify's copy.\n  const shopifyOwnsCheckout = checkoutProvider === \"shopify\";\n\n  const addedTypes = new Set<ReploScriptType>();\n  for (const script of registeredScripts) {\n    const factory = PROVIDER_SINK_FACTORIES[script.type];\n    if (!factory || addedTypes.has(script.type)) {\n      continue;\n    }\n    if (\n      isConsentAllowed({\n        state: consent,\n        requiredConsent: script.requiredConsent,\n      })\n    ) {\n      const sink = factory();\n      sinks.push(\n        shopifyOwnsCheckout ? gateShopifyOwnedFunnelEvents(sink) : sink,\n      );\n      addedTypes.add(script.type);\n    }\n  }\n\n  return sinks;\n}\n"],
-  "mappings": "AAMA,SAAS,wBAAwB;AACjC,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAC3B,SAAS,iBAAiB;AAC1B,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,oCAAoC;AAQ7C,MAAM,0BAEF;AAAA,EACF,KAAK,MAAM,IAAI,QAAQ;AAAA,EACvB,MAAM,MAAM,IAAI,SAAS;AAAA,EACzB,QAAQ,MAAM,IAAI,WAAW;AAAA,EAC7B,UAAU,MAAM,IAAI,aAAa;AAAA,EACjC,WAAW,MAAM,IAAI,cAAc;AAAA,EACnC,QAAQ,MAAM,IAAI,WAAW;AAC/B;AAoBO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIoB;AAClB,QAAM,QAAyB,CAAC,IAAI,WAAW,CAAC;AAEhD,QAAM,oBACJ,QAAQ,SAAS,SAAS,QAAQ,WAAW;AAC/C,MAAI,mBAAmB;AACrB,UAAM,KAAK,IAAI,UAAU,CAAC;AAAA,EAC5B;AAKA,QAAM,sBAAsB,qBAAqB;AAEjD,QAAM,aAAa,oBAAI,IAAqB;AAC5C,aAAW,UAAU,mBAAmB;AACtC,UAAM,UAAU,wBAAwB,OAAO,IAAI;AACnD,QAAI,CAAC,WAAW,WAAW,IAAI,OAAO,IAAI,GAAG;AAC3C;AAAA,IACF;AACA,QACE,iBAAiB;AAAA,MACf,OAAO;AAAA,MACP,iBAAiB,OAAO;AAAA,IAC1B,CAAC,GACD;AACA,YAAM,OAAO,QAAQ;AACrB,YAAM;AAAA,QACJ,sBAAsB,6BAA6B,IAAI,IAAI;AAAA,MAC7D;AACA,iBAAW,IAAI,OAAO,IAAI;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO;AACT;",
+  "sourcesContent": ["import type { ReploScriptType } from \"schemas/generated/consent\";\nimport type { ConsentState } from \"../consent/consent-store\";\nimport type { RegisteredScript } from \"../consent/script-registration-store\";\nimport type { CheckoutProvider } from \"../lib/integration-utils\";\nimport type { AnalyticsSink } from \"./analytics-sink\";\n\nimport { isConsentAllowed } from \"../consent/consent-store\";\nimport { GA4Sink } from \"./sinks/ga4-sink\";\nimport { MetaSink } from \"./sinks/meta-sink\";\nimport { PinterestSink } from \"./sinks/pinterest-sink\";\nimport { RedditSink } from \"./sinks/reddit-sink\";\nimport { ReploSink } from \"./sinks/replo-sink\";\nimport { SnapchatSink } from \"./sinks/snapchat-sink\";\nimport { TikTokSink } from \"./sinks/tiktok-sink\";\nimport { WindowSink } from \"./sinks/window-sink\";\nimport { gateShopifyOwnedFunnelEvents } from \"./utils/shopify-funnel-gate\";\n\n/**\n * Named providers that have a corresponding ecommerce-event sink. The other\n * managed providers (GoogleTagManager, Hotjar, MicrosoftClarity, Segment) and\n * generic `snippet`/`custom` entries load scripts but do not map to\n * `AnalyticsSink` events today, so they never produce a sink here.\n */\nconst PROVIDER_SINK_FACTORIES: Partial<\n  Record<ReploScriptType, () => AnalyticsSink>\n> = {\n  GA4: () => new GA4Sink(),\n  Meta: () => new MetaSink(),\n  TikTok: () => new TikTokSink(),\n  Snapchat: () => new SnapchatSink(),\n  Pinterest: () => new PinterestSink(),\n  Reddit: () => new RedditSink(),\n};\n\n/**\n * Builds the set of analytics sinks that may fire given the current consent\n * state and which managed scripts are registered on the page.\n *\n * Consent gates data egress, not in-page plumbing:\n * - `WindowSink` is a local `CustomEvent` bus (no data leaves the device), so it\n *   always ships regardless of consent. Its consumers self-gate: managed pixels\n *   are already gated at the injection layer (they never mount without consent,\n *   so they never subscribe), and unmanaged custom scripts are the author's\n *   responsibility.\n * - `ReploSink` forwards into Replo's first-party analytics pipeline (real\n *   egress / processing), so it counts as `analytics`-category tracking and is\n *   gated by that consent. It is an implicit sink this scaffold always ships\n *   (not tied to a registered entry) and is never editable in the miniapp.\n *   Under a delegated platform, `analytics` reflects that platform's answer.\n *\n * Third-party provider sinks are created only when a matching `<ReploScripts>`\n * entry is registered AND its required consent is granted.\n */\nexport function getAnalyticsSinks({\n  consent,\n  registeredScripts,\n  checkoutProvider,\n}: {\n  consent: ConsentState;\n  registeredScripts: RegisteredScript[];\n  checkoutProvider?: CheckoutProvider;\n}): AnalyticsSink[] {\n  const sinks: AnalyticsSink[] = [new WindowSink()];\n\n  const firstPartyAllowed = isConsentAllowed({\n    state: consent,\n    requiredConsent: [\"analytics\"],\n  });\n  if (firstPartyAllowed) {\n    sinks.push(new ReploSink());\n  }\n\n  // When Shopify hosts checkout, its native channels report the checkout-funnel\n  // events to ad platforms server-side. Suppress those events on third-party\n  // storefront pixels so they don't double-count Shopify's copy.\n  const shopifyOwnsCheckout = checkoutProvider === \"shopify\";\n\n  const addedTypes = new Set<ReploScriptType>();\n  for (const script of registeredScripts) {\n    const factory = PROVIDER_SINK_FACTORIES[script.type];\n    if (!factory || addedTypes.has(script.type)) {\n      continue;\n    }\n    if (\n      isConsentAllowed({\n        state: consent,\n        requiredConsent: script.requiredConsent,\n      })\n    ) {\n      const sink = factory();\n      sinks.push(\n        shopifyOwnsCheckout ? gateShopifyOwnedFunnelEvents(sink) : sink,\n      );\n      addedTypes.add(script.type);\n    }\n  }\n\n  return sinks;\n}\n"],
+  "mappings": "AAMA,SAAS,wBAAwB;AACjC,SAAS,eAAe;AACxB,SAAS,gBAAgB;AACzB,SAAS,qBAAqB;AAC9B,SAAS,kBAAkB;AAC3B,SAAS,iBAAiB;AAC1B,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,oCAAoC;AAQ7C,MAAM,0BAEF;AAAA,EACF,KAAK,MAAM,IAAI,QAAQ;AAAA,EACvB,MAAM,MAAM,IAAI,SAAS;AAAA,EACzB,QAAQ,MAAM,IAAI,WAAW;AAAA,EAC7B,UAAU,MAAM,IAAI,aAAa;AAAA,EACjC,WAAW,MAAM,IAAI,cAAc;AAAA,EACnC,QAAQ,MAAM,IAAI,WAAW;AAC/B;AAqBO,SAAS,kBAAkB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AACF,GAIoB;AAClB,QAAM,QAAyB,CAAC,IAAI,WAAW,CAAC;AAEhD,QAAM,oBAAoB,iBAAiB;AAAA,IACzC,OAAO;AAAA,IACP,iBAAiB,CAAC,WAAW;AAAA,EAC/B,CAAC;AACD,MAAI,mBAAmB;AACrB,UAAM,KAAK,IAAI,UAAU,CAAC;AAAA,EAC5B;AAKA,QAAM,sBAAsB,qBAAqB;AAEjD,QAAM,aAAa,oBAAI,IAAqB;AAC5C,aAAW,UAAU,mBAAmB;AACtC,UAAM,UAAU,wBAAwB,OAAO,IAAI;AACnD,QAAI,CAAC,WAAW,WAAW,IAAI,OAAO,IAAI,GAAG;AAC3C;AAAA,IACF;AACA,QACE,iBAAiB;AAAA,MACf,OAAO;AAAA,MACP,iBAAiB,OAAO;AAAA,IAC1B,CAAC,GACD;AACA,YAAM,OAAO,QAAQ;AACrB,YAAM;AAAA,QACJ,sBAAsB,6BAA6B,IAAI,IAAI;AAAA,MAC7D;AACA,iBAAW,IAAI,OAAO,IAAI;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO;AACT;",
   "names": []
 }

package/analytics/replo-pixel-script.d.ts

@@ -5,6 +5,10 @@
  * consent-correct without the pixel loading unconditionally in `<head>` the way
  * the legacy scaffold does. `analytics` consent here matches the
  * `firstPartyAllowed` gate that controls whether `ReploSink` is created at all.
+ *
+ * Under a consent platform the tag is rendered regardless and `InjectedScript`
+ * stamps the blocking attributes at effect time, since delegation is not yet
+ * set here.
  */
 export declare function ReploPixelScript({ pixelUrl, apiUrl, projectId, }: {
     pixelUrl: string;

package/analytics/replo-pixel-script.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx } from "react/jsx-runtime";
+import { findDelegatedPlatform } from "../consent/consent-platform";
 import { isConsentAllowed, useConsent } from "../consent/consent-store";
 import { InjectedScript } from "../consent/replo-scripts";
 const PIXEL_SCRIPT_ID = "replo:first-party-pixel";
@@ -9,7 +10,7 @@ function ReploPixelScript({
   projectId
 }) {
   const consent = useConsent();
-  if (!isConsentAllowed({ state: consent, requiredConsent: ["analytics"] })) {
+  if (!findDelegatedPlatform() && !isConsentAllowed({ state: consent, requiredConsent: ["analytics"] })) {
     return null;
   }
   const descriptors = [
@@ -22,7 +23,14 @@ function ReploPixelScript({
       }
     }
   ];
-  return /* @__PURE__ */ jsx(InjectedScript, { baseId: PIXEL_SCRIPT_ID, descriptors });
+  return /* @__PURE__ */ jsx(
+    InjectedScript,
+    {
+      baseId: PIXEL_SCRIPT_ID,
+      descriptors,
+      requiredConsent: ["analytics"]
+    }
+  );
 }
 export {
   ReploPixelScript

package/analytics/replo-pixel-script.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../analytics/replo-pixel-script.tsx"],
-  "sourcesContent": ["\"use client\";\n\nimport type { ScriptTagDescriptor } from \"schemas/generated/consent\";\n\nimport { isConsentAllowed, useConsent } from \"../consent/consent-store\";\nimport { InjectedScript } from \"../consent/replo-scripts\";\n\n// Stable injection id so re-renders and React Strict Mode double-invokes never\n// inject the pixel twice (the loader itself also guards via `__reploPixelLoaded`).\nconst PIXEL_SCRIPT_ID = \"replo:first-party-pixel\";\n\n/**\n * Consent-gated injector for Replo's first-party analytics pixel. The loaded\n * script sets `window.ReploPixel`, which the always-on `ReploSink` forwards\n * events into, so gating it on `analytics` consent keeps the first-party sink\n * consent-correct without the pixel loading unconditionally in `<head>` the way\n * the legacy scaffold does. `analytics` consent here matches the\n * `firstPartyAllowed` gate that controls whether `ReploSink` is created at all.\n */\nexport function ReploPixelScript({\n  pixelUrl,\n  apiUrl,\n  projectId,\n}: {\n  pixelUrl: string;\n  apiUrl: string;\n  projectId: string;\n}) {\n  const consent = useConsent();\n  if (!isConsentAllowed({ state: consent, requiredConsent: [\"analytics\"] })) {\n    return null;\n  }\n\n  const descriptors: ScriptTagDescriptor[] = [\n    {\n      kind: \"external\",\n      src: `${pixelUrl}/latest.js`,\n      attributes: {\n        \"data-api-url\": apiUrl,\n        \"data-project-id\": projectId,\n      },\n    },\n  ];\n\n  return <InjectedScript baseId={PIXEL_SCRIPT_ID} descriptors={descriptors} />;\n}\n"],
-  "mappings": ";AA4CS;AAxCT,SAAS,kBAAkB,kBAAkB;AAC7C,SAAS,sBAAsB;AAI/B,MAAM,kBAAkB;AAUjB,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,UAAU,WAAW;AAC3B,MAAI,CAAC,iBAAiB,EAAE,OAAO,SAAS,iBAAiB,CAAC,WAAW,EAAE,CAAC,GAAG;AACzE,WAAO;AAAA,EACT;AAEA,QAAM,cAAqC;AAAA,IACzC;AAAA,MACE,MAAM;AAAA,MACN,KAAK,GAAG,QAAQ;AAAA,MAChB,YAAY;AAAA,QACV,gBAAgB;AAAA,QAChB,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,oBAAC,kBAAe,QAAQ,iBAAiB,aAA0B;AAC5E;",
+  "sourcesContent": ["\"use client\";\n\nimport type { ScriptTagDescriptor } from \"schemas/generated/consent\";\n\nimport { findDelegatedPlatform } from \"../consent/consent-platform\";\nimport { isConsentAllowed, useConsent } from \"../consent/consent-store\";\nimport { InjectedScript } from \"../consent/replo-scripts\";\n\n// Stable injection id so re-renders and React Strict Mode double-invokes never\n// inject the pixel twice (the loader itself also guards via `__reploPixelLoaded`).\nconst PIXEL_SCRIPT_ID = \"replo:first-party-pixel\";\n\n/**\n * Consent-gated injector for Replo's first-party analytics pixel. The loaded\n * script sets `window.ReploPixel`, which the always-on `ReploSink` forwards\n * events into, so gating it on `analytics` consent keeps the first-party sink\n * consent-correct without the pixel loading unconditionally in `<head>` the way\n * the legacy scaffold does. `analytics` consent here matches the\n * `firstPartyAllowed` gate that controls whether `ReploSink` is created at all.\n *\n * Under a consent platform the tag is rendered regardless and `InjectedScript`\n * stamps the blocking attributes at effect time, since delegation is not yet\n * set here.\n */\nexport function ReploPixelScript({\n  pixelUrl,\n  apiUrl,\n  projectId,\n}: {\n  pixelUrl: string;\n  apiUrl: string;\n  projectId: string;\n}) {\n  const consent = useConsent();\n  if (\n    !findDelegatedPlatform() &&\n    !isConsentAllowed({ state: consent, requiredConsent: [\"analytics\"] })\n  ) {\n    return null;\n  }\n\n  const descriptors: ScriptTagDescriptor[] = [\n    {\n      kind: \"external\",\n      src: `${pixelUrl}/latest.js`,\n      attributes: {\n        \"data-api-url\": apiUrl,\n        \"data-project-id\": projectId,\n      },\n    },\n  ];\n\n  return (\n    <InjectedScript\n      baseId={PIXEL_SCRIPT_ID}\n      descriptors={descriptors}\n      requiredConsent={[\"analytics\"]}\n    />\n  );\n}\n"],
+  "mappings": ";AAqDI;AAjDJ,SAAS,6BAA6B;AACtC,SAAS,kBAAkB,kBAAkB;AAC7C,SAAS,sBAAsB;AAI/B,MAAM,kBAAkB;AAcjB,SAAS,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,UAAU,WAAW;AAC3B,MACE,CAAC,sBAAsB,KACvB,CAAC,iBAAiB,EAAE,OAAO,SAAS,iBAAiB,CAAC,WAAW,EAAE,CAAC,GACpE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAqC;AAAA,IACzC;AAAA,MACE,MAAM;AAAA,MACN,KAAK,GAAG,QAAQ;AAAA,MAChB,YAAY;AAAA,QACV,gBAAgB;AAAA,QAChB,mBAAmB;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SACE;AAAA,IAAC;AAAA;AAAA,MACC,QAAQ;AAAA,MACR;AAAA,MACA,iBAAiB,CAAC,WAAW;AAAA;AAAA,EAC/B;AAEJ;",
   "names": []
 }

package/analytics/utils/analytics-utils.js

@@ -1,3 +1,4 @@
+const QUEUE_TIMEOUT_MS = 3e4;
 function createEventQueue(checkPixelReady, sendEvent, pixelName) {
   const queue = [];
   let flushTimer = null;
@@ -35,11 +36,9 @@ function createEventQueue(checkPixelReady, sendEvent, pixelName) {
     timeoutTimer = window.setTimeout(() => {
       queue.length = 0;
       permanentlyDisabled = true;
-      console.debug(
-        `Analytics queue timed out after 30 seconds for ${pixelName}`
-      );
+      console.debug(`Analytics queue timed out for ${pixelName}`);
       cleanup();
-    }, 3e4);
+    }, QUEUE_TIMEOUT_MS);
   };
   return (event, params = {}) => {
     if (permanentlyDisabled) {
@@ -100,12 +99,12 @@ function createMethodQueue(checkInstanceReady, options) {
       permanentlyDisabled = true;
       if (typeof window !== "undefined") {
         console.debug(
-          `[analytics] ${queueName} timed out after 30 seconds and has been disabled`
+          `[analytics] ${queueName} timed out and has been disabled`
         );
       }
       options?.onTimeout?.();
       cleanup();
-    }, 3e4);
+    }, QUEUE_TIMEOUT_MS);
   };
   return (method, ...args) => {
     if (permanentlyDisabled) {