@replohq/sdk 1.1.0 → 1.2.1

package/consent/script-snippets.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../consent/script-snippets.ts"],
-  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\n// Cookiebot's loader is built by its consent-platform preset, not here.\ntype ProviderType = Exclude<\n  ReploScriptType,\n  \"custom\" | \"snippet\" | \"consentPlatform\" | \"Cookiebot\"\n>;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Contentsquare: {\n    defaultConsent: [\"analytics\"],\n    // The UXA tag is a single async external script keyed by the 13-char tag id;\n    // it bootstraps the Contentsquare `_uxa` queue itself once loaded.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://t.contentsquare.net/uxa/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    // No trackPageViewInitial self-fire: NorthbeamSink owns every pageview\n    // (initial + soft navigations) via the NavigationTracker broadcast.\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a);})()`,\n      },\n    ],\n  },\n  Converge: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    // No $page_load self-fire: ConvergeSink owns every pageview (initial +\n    // soft navigations) via the NavigationTracker broadcast.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://static.runconverge.com/pixels/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n      {\n        kind: \"inline\",\n        body: `window.cvg||(c=window.cvg=function(){c.process?c.process.apply(c,arguments):c.queue.push(arguments)},c.queue=[]);`,\n      },\n    ],\n  },\n  Gorgias: {\n    // Support chat stores the visitor's chat session, which is a functional\n    // preference rather than analytics or ad tracking.\n    defaultConsent: [\"preferences\"],\n    // The id attribute matches Gorgias's official v3 install snippet; their\n    // customization scripts and support tooling look the tag up by that id.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://config.gorgias.chat/bundle-loader/${id}`,\n        attributes: { id: \"gorgias-chat-widget-install-v3\" },\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
-  "mappings": "AAsCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,gBAAgB,CAAC,WAAW;AAAA;AAAA;AAAA,IAG5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,mCAAmC,EAAE;AAAA,QAC1C,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA;AAAA;AAAA,IAGzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,aAAa,WAAW;AAAA;AAAA;AAAA,IAGzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,yCAAyC,EAAE;AAAA,QAChD,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA;AAAA;AAAA,IAGP,gBAAgB,CAAC,aAAa;AAAA;AAAA;AAAA,IAG9B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,6CAA6C,EAAE;AAAA,QACpD,YAAY,EAAE,IAAI,iCAAiC;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
+  "sourcesContent": ["import type {\n  ConsentCategory,\n  ReploScriptType,\n  ScriptTagDescriptor,\n} from \"schemas/generated/consent\";\n\n// Identifier providers: those whose script the runtime synthesizes from an ID.\n// `snippet` (pasted whole) and `custom` carry their own bodies instead.\n// Cookiebot's loader is built by its consent-platform preset, not here.\ntype ProviderType = Exclude<\n  ReploScriptType,\n  \"custom\" | \"snippet\" | \"consentPlatform\" | \"Cookiebot\"\n>;\n\n/**\n * Runtime-safe per-provider data for the consent system. This is the subset of\n * the website-builder miniapp's `scriptConstants.ts` that must ship in the\n * customer site bundle: how to materialize each provider's script tags, and the\n * default consent category that gates it. Miniapp-only concerns (LLM detection\n * schemas, logos, marketing copy) intentionally stay in the miniapp.\n *\n * Unlike the miniapp's `buildSnippet`, which returns a JSX *string* for the\n * agent to paste into `layout.tsx`, this returns structured descriptors so the\n * runtime can inject real DOM nodes (inline `<script>` bodies set via React's\n * `dangerouslySetInnerHTML` never execute).\n */\ntype ProviderSnippet = {\n  defaultConsent: ConsentCategory[];\n  buildTags: (identifier: string) => ScriptTagDescriptor[];\n};\n\n/**\n * NOTE (Ryan, 2026-05-28, REPL-27515): `defaultConsent` is net-new,\n * legally-sensitive categorization that does not exist elsewhere in the repo.\n * These are conservative defaults a customer can override per entry via\n * `requiredConsent`; container/CDP providers that fan out to multiple vendors\n * (GTM, Segment) require the union of categories they can serve.\n */\nconst PROVIDER_SNIPPETS: Record<ProviderType, ProviderSnippet> = {\n  GA4: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://www.googletagmanager.com/gtag/js?id=${id}`,\n      },\n      {\n        kind: \"inline\",\n        body: `window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', '${id}');`,\n      },\n    ],\n  },\n  GoogleTagManager: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','${id}');`,\n      },\n    ],\n  },\n  Meta: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,document,'script','https://connect.facebook.net/en_US/fbevents.js');fbq('init','${id}');fbq('track','PageView');`,\n      },\n    ],\n  },\n  TikTok: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d,t){w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=[\"page\",\"track\",\"identify\",\"instances\",\"debug\",\"on\",\"off\",\"once\",\"ready\",\"alias\",\"group\",\"enableCookie\",\"disableCookie\",\"holdConsent\",\"revokeConsent\",\"grantConsent\"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e};ttq.load=function(e,n){var r=\"https://analytics.tiktok.com/i18n/pixel/events.js\",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var a=document.createElement(\"script\");a.type=\"text/javascript\",a.async=!0,a.src=r+\"?sdkid=\"+e+\"&lib=\"+t;var s=document.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(a,s)};ttq.load('${id}');ttq.page();}(window,document,'ttq');`,\n      },\n    ],\n  },\n  Pinterest: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version=\"3.0\";var t=document.createElement(\"script\");t.async=!0,t.src=e;var r=document.getElementsByTagName(\"script\")[0];r.parentNode.insertBefore(t,r)}}(\"https://s.pinimg.com/ct/core.js\");pintrk('load','${id}');pintrk('page');`,\n      },\n    ],\n  },\n  Reddit: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement(\"script\");t.src=\"https://www.redditstatic.com/ads/pixel.js\",t.async=!0;var s=d.getElementsByTagName(\"script\")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','${id}');rdt('track','PageVisit');`,\n      },\n    ],\n  },\n  Snapchat: {\n    defaultConsent: [\"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(e,t,n){if(e.snaptr)return;var a=e.snaptr=function(){a.handleRequest?a.handleRequest.apply(a,arguments):a.queue.push(arguments)};a.queue=[];var s='script';var r=t.createElement(s);r.async=!0;r.src=n;var u=t.getElementsByTagName(s)[0];u.parentNode.insertBefore(r,u);})(window,document,'https://sc-static.net/scevent.min.js');snaptr('init','${id}',{});snaptr('track','PAGE_VIEW');`,\n      },\n    ],\n  },\n  Hotjar: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(h,o,t,j,a,r){h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};h._hjSettings={hjid:${id},hjsv:6};a=o.getElementsByTagName('head')[0];r=o.createElement('script');r.async=1;r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;a.appendChild(r);})(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');`,\n      },\n    ],\n  },\n  MicrosoftClarity: {\n    defaultConsent: [\"analytics\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(c,l,a,r,i,t,y){c[a]=c[a]||function(){(c[a].q=c[a].q||[]).push(arguments)};t=l.createElement(r);t.async=1;t.src=\"https://www.clarity.ms/tag/\"+i;y=l.getElementsByTagName(r)[0];y.parentNode.insertBefore(t,y);})(window,document,\"clarity\",\"script\",\"${id}\");`,\n      },\n    ],\n  },\n  Contentsquare: {\n    defaultConsent: [\"analytics\"],\n    // The UXA tag is a single async external script keyed by the 13-char tag id;\n    // it bootstraps the Contentsquare `_uxa` queue itself once loaded.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://t.contentsquare.net/uxa/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n    ],\n  },\n  Segment: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `!function(){var i=\"analytics\",analytics=window[i]=window[i]||[];if(!analytics.initialize)if(analytics.invoked)window.console&&console.error&&console.error(\"Segment snippet included twice.\");else{analytics.invoked=!0;analytics.methods=[\"trackSubmit\",\"trackClick\",\"trackLink\",\"trackForm\",\"pageview\",\"identify\",\"reset\",\"group\",\"track\",\"ready\",\"alias\",\"debug\",\"page\",\"screen\",\"once\",\"off\",\"on\",\"addSourceMiddleware\",\"addIntegrationMiddleware\",\"setAnonymousId\",\"addDestinationMiddleware\",\"register\"];analytics.factory=function(e){return function(){var t=Array.prototype.slice.call(arguments);t.unshift(e);analytics.push(t);return analytics}};for(var e=0;e<analytics.methods.length;e++){var key=analytics.methods[e];analytics[key]=analytics.factory(key)}analytics.load=function(key,e){var t=document.createElement(\"script\");t.type=\"text/javascript\";t.async=!0;t.src=\"https://cdn.segment.com/analytics.js/v1/\"+key+\"/analytics.min.js\";var n=document.getElementsByTagName(\"script\")[0];n.parentNode.insertBefore(t,n);analytics._loadOptions=e};analytics._writeKey=\"${id}\";analytics.SNIPPET_VERSION=\"5.2.0\";analytics.load(\"${id}\");analytics.page();}}();`,\n      },\n    ],\n  },\n  Northbeam: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"inline\",\n        body: `(function(){var t;(n=t=t||{}).A=\"identify\",n.B=\"trackPageView\",n.C=\"fireEmailCaptureEvent\",n.D=\"fireCustomGoal\",n.E=\"firePurchaseEvent\",n.F=\"trackPageViewInitial\",n.G=\"fireSlimPurchaseEvent\",n.H=\"identifyCustomerId\";var n=\"https://j.northbeam.io/ota-sp/${id}.js\";function r(n){for(var e=[],t=1;t<arguments.length;t++)e[t-1]=arguments[t];i.push({fnName:n,args:e})}var e,i=[],a=((e={})[t.F]=function(n){r(t.F,n)},(a={_q:i})[t.A]=function(n,e){return r(t.A,n,e)},a[t.B]=function(){return r(t.B)},a[t.C]=function(n,e){return r(t.C,n,e)},a[t.D]=function(n,e){return r(t.D,n,e)},a[t.E]=function(n){return r(t.E,n)},a[t.G]=function(n){return r(t.G,n)},a[t.H]=function(n,e){return r(t.H,n,e)},Object.assign(function(n){for(var e=[],t=1;t<arguments.length;t++)e.push(arguments[t]);return r.apply(null,[n].concat(e))},a));window.Northbeam=a,(a=document.createElement(\"script\")).async=!0,a.src=n,document.head.appendChild(a),e.trackPageViewInitial(window.location.href);})()`,\n      },\n    ],\n  },\n  Converge: {\n    defaultConsent: [\"analytics\", \"marketing\"],\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://static.runconverge.com/pixels/${id}.js`,\n        attributes: { async: \"true\" },\n      },\n      {\n        kind: \"inline\",\n        body: `window.cvg||(c=window.cvg=function(){c.process?c.process.apply(c,arguments):c.queue.push(arguments)},c.queue=[]);cvg({method:\"track\",eventName:\"$page_load\"});`,\n      },\n    ],\n  },\n  Gorgias: {\n    // Support chat stores the visitor's chat session, which is a functional\n    // preference rather than analytics or ad tracking.\n    defaultConsent: [\"preferences\"],\n    // The id attribute matches Gorgias's official v3 install snippet; their\n    // customization scripts and support tooling look the tag up by that id.\n    buildTags: (id) => [\n      {\n        kind: \"external\",\n        src: `https://config.gorgias.chat/bundle-loader/${id}`,\n        attributes: { id: \"gorgias-chat-widget-install-v3\" },\n      },\n    ],\n  },\n};\n\n/**\n * Snippet providers don't synthesize tags (the user pastes the provider-issued\n * snippet as the entry's `body`), but they still get a first-class default\n * consent categorization like identifier providers.\n */\n/**\n * Returns the structured tag descriptors for a named provider. A single provider\n * can produce multiple tags (e.g. GA4 = external loader + inline config), which\n * the runtime injects in order.\n */\nexport function buildScriptTags({\n  type,\n  identifier,\n}: {\n  type: ProviderType;\n  identifier: string;\n}): ScriptTagDescriptor[] {\n  return PROVIDER_SNIPPETS[type].buildTags(identifier);\n}\n\n/**\n * The default consent categories that gate an identifier-provider script when an\n * entry does not specify `requiredConsent`. `snippet` and `custom` entries carry\n * `requiredConsent` explicitly (the runtime has no default for them), so this is\n * only consulted for identifier providers. Overridable per entry by the customer.\n */\nexport function defaultConsentFor(type: ProviderType): ConsentCategory[] {\n  return PROVIDER_SNIPPETS[type].defaultConsent;\n}\n"],
+  "mappings": "AAsCA,MAAM,oBAA2D;AAAA,EAC/D,KAAK;AAAA,IACH,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,+CAA+C,EAAE;AAAA,MACxD;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA;AAAA;AAAA,kBAAqI,EAAE;AAAA,MAC/I;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,sUAAsU,EAAE;AAAA,MAChV;AAAA,IACF;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,uYAAuY,EAAE;AAAA,MACjZ;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+7BAA+7B,EAAE;AAAA,MACz8B;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,0WAA0W,EAAE;AAAA,MACpX;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gVAAgV,EAAE;AAAA,MAC1V;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,+VAA+V,EAAE;AAAA,MACzW;AAAA,IACF;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,yGAAyG,EAAE;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAAA,EACA,kBAAkB;AAAA,IAChB,gBAAgB,CAAC,WAAW;AAAA,IAC5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iQAAiQ,EAAE;AAAA,MAC3Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,eAAe;AAAA,IACb,gBAAgB,CAAC,WAAW;AAAA;AAAA;AAAA,IAG5B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,mCAAmC,EAAE;AAAA,QAC1C,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA,IACP,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,iiCAAiiC,EAAE,uDAAuD,EAAE;AAAA,MACpmC;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW;AAAA,IACT,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,MAAM,gQAAgQ,EAAE;AAAA,MAC1Q;AAAA,IACF;AAAA,EACF;AAAA,EACA,UAAU;AAAA,IACR,gBAAgB,CAAC,aAAa,WAAW;AAAA,IACzC,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,yCAAyC,EAAE;AAAA,QAChD,YAAY,EAAE,OAAO,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA,EACA,SAAS;AAAA;AAAA;AAAA,IAGP,gBAAgB,CAAC,aAAa;AAAA;AAAA;AAAA,IAG9B,WAAW,CAAC,OAAO;AAAA,MACjB;AAAA,QACE,MAAM;AAAA,QACN,KAAK,6CAA6C,EAAE;AAAA,QACpD,YAAY,EAAE,IAAI,iCAAiC;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AACF,GAG0B;AACxB,SAAO,kBAAkB,IAAI,EAAE,UAAU,UAAU;AACrD;AAQO,SAAS,kBAAkB,MAAuC;AACvE,SAAO,kBAAkB,IAAI,EAAE;AACjC;",
   "names": []
 }

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "branch": "HEAD",
-  "commit": "3596a406ee1c678085915d00db96f52ad3f9ac76",
-  "builtAt": "2026-09-01T19:49:23.848Z"
+  "commit": "8534cbe94f47e7d47bbb1c214bf02f58289cc1a8",
+  "builtAt": "2026-09-02T20:05:57.576Z"
 };

package/next/config.js

@@ -1,4 +1,6 @@
+import { existsSync } from "fs";
 import os from "os";
+import path from "path";
 const PLATFORM_DEV_ORIGINS = [
   "localhost:*",
   "*.localhost:*",
@@ -15,6 +17,23 @@ const PLATFORM_SERVER_ACTION_ORIGINS = [
   "*.preview.reploapi.com",
   "*.preview-staging.reploapi.com"
 ];
+const DEFAULT_PAGE_EXTENSIONS = ["tsx", "ts", "jsx", "js"];
+const DEVELOPMENT_ONLY_PAGE_EXTENSIONS = ["dev.jsx", "dev.tsx"];
+const BUILD_ONLY_PAGE_EXTENSIONS = ["published.tsx"];
+const PUBLISH_TSCONFIG_FILENAME = "tsconfig.publish.json";
+function resolvePageExtensions(configuredExtensions) {
+  const baseExtensions = (configuredExtensions ?? DEFAULT_PAGE_EXTENSIONS).filter((extension) => {
+    return !DEVELOPMENT_ONLY_PAGE_EXTENSIONS.includes(extension) && !BUILD_ONLY_PAGE_EXTENSIONS.includes(extension);
+  });
+  return process.env.BUILD_ENV === "build" ? [...BUILD_ONLY_PAGE_EXTENSIONS, ...baseExtensions] : [...DEVELOPMENT_ONLY_PAGE_EXTENSIONS, ...baseExtensions];
+}
+function resolvePublishTypescriptConfig(configured) {
+  if (process.env.BUILD_ENV !== "build") {
+    return configured;
+  }
+  const tsconfigPath = path.join(process.cwd(), PUBLISH_TSCONFIG_FILENAME);
+  return existsSync(tsconfigPath) ? { ...configured, tsconfigPath: PUBLISH_TSCONFIG_FILENAME } : configured;
+}
 function siteConfig(overrides = {}) {
   const isBuild = process.env.BUILD_ENV === "build";
   const devRoot = process.env.IS_REPLO_SANDBOX ? "/workspace/dev" : process.cwd();
@@ -23,6 +42,8 @@ function siteConfig(overrides = {}) {
     images: overrideImages,
     experimental: overrideExperimental,
     allowedDevOrigins: overrideDevOrigins,
+    pageExtensions: overridePageExtensions,
+    typescript: overrideTypescript,
     ...restOverrides
   } = overrides;
   const { serverActions: overrideServerActions, ...restOverrideExperimental } = overrideExperimental ?? {};
@@ -35,6 +56,8 @@ function siteConfig(overrides = {}) {
     // can never break sandbox builds, publish, or the dev server.
     output: "standalone",
     distDir: isBuild ? ".next" : ".next-dev",
+    pageExtensions: resolvePageExtensions(overridePageExtensions),
+    typescript: resolvePublishTypescriptConfig(overrideTypescript),
     // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches
     // required-server-files.json to clear this value before OpenNext bundles,
     // since "/" makes esbuild emit absolute-path requires that break in Workers.

package/next/config.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../next/config.ts"],
-  "sourcesContent": ["import os from \"os\";\nimport type { NextConfig } from \"next\";\n\n// Origins browsers load sandbox previews from \u2014 PREVIEW_HOSTNAME in the\n// coordinator's wrangler.jsonc plus Daytona's native preview domain. Next 16\n// hard-blocks cross-origin dev requests (HMR WebSocket, Server Actions) from\n// origins missing here.\nconst PLATFORM_DEV_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.daytonaproxy01.net\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst PLATFORM_SERVER_ACTION_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.cloudflare-agent-coordinator.replo.workers.dev\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\n// The canonical Next.js runtime contract shared by every agent-built site.\n// Sites re-export `default` from here through a one-line `next.config.ts` shim,\n// so the platform wiring (sandbox dist dirs, Turbopack root, preview origins,\n// Cloudflare image loader) lives in exactly one place instead of being copied\n// into each template.\n//\n// `overrides` is a per-site customization surface, but it must not be able to\n// silently amputate platform wiring. A plain `...overrides` spread is a shallow\n// merge: a site that sets any nested key (e.g. `experimental.typedRoutes`)\n// would replace the whole `experimental`/`images` block and drop platform\n// defaults like the build-worker OOM guard or the Cloudflare image loader. So\n// load-bearing keys are re-asserted after the spread and the nested blocks are\n// deep-merged: a site can add keys, but platform invariants always win and\n// platform origin lists are preserved (site entries are appended, not swapped).\nexport function siteConfig(overrides: NextConfig = {}): NextConfig {\n  const isBuild = process.env.BUILD_ENV === \"build\";\n  const devRoot = process.env.IS_REPLO_SANDBOX\n    ? \"/workspace/dev\"\n    : process.cwd();\n  const {\n    turbopack: overrideTurbopack,\n    images: overrideImages,\n    experimental: overrideExperimental,\n    allowedDevOrigins: overrideDevOrigins,\n    ...restOverrides\n  } = overrides;\n\n  const { serverActions: overrideServerActions, ...restOverrideExperimental } =\n    overrideExperimental ?? {};\n\n  return {\n    // Site-overridable defaults.\n    reactStrictMode: true,\n    devIndicators: false,\n    ...restOverrides,\n\n    // Platform invariants \u2014 re-asserted after the spread so a site override\n    // can never break sandbox builds, publish, or the dev server.\n    output: \"standalone\",\n    distDir: isBuild ? \".next\" : \".next-dev\",\n    // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches\n    // required-server-files.json to clear this value before OpenNext bundles,\n    // since \"/\" makes esbuild emit absolute-path requires that break in Workers.\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Leave outputFileTracingRoot\n    // unset outside builds because Next 15.5+ otherwise forces turbopack.root to\n    // \"/\" and makes the dev watcher retain whole-filesystem state.\n    outputFileTracingRoot: isBuild ? \"/\" : undefined,\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Match build tracing at publish\n    // time; keep dev's watcher on the user app tree.\n    turbopack: {\n      ...overrideTurbopack,\n      root: isBuild ? \"/\" : devRoot,\n    },\n    // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull\n    // in lodash-es `uniq` here \u2014 dedupe inline via a Set instead.\n    allowedDevOrigins: Array.from(\n      new Set([...(overrideDevOrigins ?? []), ...PLATFORM_DEV_ORIGINS]),\n    ),\n    images: {\n      ...overrideImages,\n      loader: \"custom\",\n      loaderFile: \"./image-loader.ts\",\n      remotePatterns: overrideImages?.remotePatterns ?? [\n        {\n          protocol: \"https\",\n          hostname: \"**\",\n        },\n      ],\n    },\n    experimental: {\n      ...restOverrideExperimental,\n      // NOTE (Cole, 2026-06-18, REPL-28180): Next sizes its build worker pool\n      // off os.cpus().length = host cores (~64) inside a cgroup-limited sandbox,\n      // not the 2 the container actually has \u2014 a worker swarm that OOMs the\n      // 4 GiB box. availableParallelism() is cgroup-aware. Gated to prod build.\n      cpus: isBuild ? os.availableParallelism() : undefined,\n      serverActions: {\n        ...overrideServerActions,\n        allowedOrigins: Array.from(\n          new Set([\n            ...(overrideServerActions?.allowedOrigins ?? []),\n            ...PLATFORM_SERVER_ACTION_ORIGINS,\n          ]),\n        ),\n      },\n    },\n  };\n}\n\nconst nextConfig: NextConfig = siteConfig();\n\nexport default nextConfig;\n"],
-  "mappings": "AAAA,OAAO,QAAQ;AAOf,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgBO,SAAS,WAAW,YAAwB,CAAC,GAAe;AACjE,QAAM,UAAU,QAAQ,IAAI,cAAc;AAC1C,QAAM,UAAU,QAAQ,IAAI,mBACxB,mBACA,QAAQ,IAAI;AAChB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,EAAE,eAAe,uBAAuB,GAAG,yBAAyB,IACxE,wBAAwB,CAAC;AAE3B,SAAO;AAAA;AAAA,IAEL,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,GAAG;AAAA;AAAA;AAAA,IAIH,QAAQ;AAAA,IACR,SAAS,UAAU,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO7B,uBAAuB,UAAU,MAAM;AAAA;AAAA;AAAA,IAGvC,WAAW;AAAA,MACT,GAAG;AAAA,MACH,MAAM,UAAU,MAAM;AAAA,IACxB;AAAA;AAAA;AAAA,IAGA,mBAAmB,MAAM;AAAA,MACvB,oBAAI,IAAI,CAAC,GAAI,sBAAsB,CAAC,GAAI,GAAG,oBAAoB,CAAC;AAAA,IAClE;AAAA,IACA,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,gBAAgB,gBAAgB,kBAAkB;AAAA,QAChD;AAAA,UACE,UAAU;AAAA,UACV,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKH,MAAM,UAAU,GAAG,qBAAqB,IAAI;AAAA,MAC5C,eAAe;AAAA,QACb,GAAG;AAAA,QACH,gBAAgB,MAAM;AAAA,UACpB,oBAAI,IAAI;AAAA,YACN,GAAI,uBAAuB,kBAAkB,CAAC;AAAA,YAC9C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAAyB,WAAW;AAE1C,IAAO,iBAAQ;",
+  "sourcesContent": ["import { existsSync } from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\nimport type { NextConfig } from \"next\";\n\n// Origins browsers load sandbox previews from \u2014 PREVIEW_HOSTNAME in the\n// coordinator's wrangler.jsonc plus Daytona's native preview domain. Next 16\n// hard-blocks cross-origin dev requests (HMR WebSocket, Server Actions) from\n// origins missing here.\nconst PLATFORM_DEV_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.daytonaproxy01.net\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst PLATFORM_SERVER_ACTION_ORIGINS = [\n  \"localhost:*\",\n  \"*.localhost:*\",\n  \"*.lvh.me:*\",\n  \"*.cloudflare-agent-coordinator.replo.workers.dev\",\n  \"*.preview.reploapi.com\",\n  \"*.preview-staging.reploapi.com\",\n];\n\nconst DEFAULT_PAGE_EXTENSIONS = [\"tsx\", \"ts\", \"jsx\", \"js\"];\n// Routed only by the sandbox dev server: site-component previews and page drafts.\nconst DEVELOPMENT_ONLY_PAGE_EXTENSIONS = [\"dev.jsx\", \"dev.tsx\"];\n// Routed only by publish builds: the live copy of every page.\nconst BUILD_ONLY_PAGE_EXTENSIONS = [\"published.tsx\"];\nconst PUBLISH_TSCONFIG_FILENAME = \"tsconfig.publish.json\";\n\n// Pair routing is a platform invariant, not an editor nicety: without it a\n// build silently drops every page.published.tsx, so the site ships missing\n// routes. A site's own extensions are kept, but platform ones are filtered out\n// of the input and re-prepended so a site can never drop pair routing.\n// Behaviorally identical to @replohq/sandbox-runtime's wrapper, which\n// starter-scaffolded sites use instead of this function.\nfunction resolvePageExtensions(configuredExtensions: string[] | undefined) {\n  const baseExtensions = (\n    configuredExtensions ?? DEFAULT_PAGE_EXTENSIONS\n  ).filter((extension) => {\n    return (\n      !DEVELOPMENT_ONLY_PAGE_EXTENSIONS.includes(extension) &&\n      !BUILD_ONLY_PAGE_EXTENSIONS.includes(extension)\n    );\n  });\n\n  return process.env.BUILD_ENV === \"build\"\n    ? [...BUILD_ONLY_PAGE_EXTENSIONS, ...baseExtensions]\n    : [...DEVELOPMENT_ONLY_PAGE_EXTENSIONS, ...baseExtensions];\n}\n\n// Drafts are excluded from the publish typecheck so unfinished pages never\n// block a publish; live files stay checked. Overrides the site's own\n// tsconfigPath during publish builds when the publish tsconfig is present.\nfunction resolvePublishTypescriptConfig(configured: NextConfig[\"typescript\"]) {\n  if (process.env.BUILD_ENV !== \"build\") {\n    return configured;\n  }\n\n  const tsconfigPath = path.join(process.cwd(), PUBLISH_TSCONFIG_FILENAME);\n  return existsSync(tsconfigPath)\n    ? { ...configured, tsconfigPath: PUBLISH_TSCONFIG_FILENAME }\n    : configured;\n}\n\n// The canonical Next.js runtime contract shared by every agent-built site.\n// Sites re-export `default` from here through a one-line `next.config.ts` shim,\n// so the platform wiring (sandbox dist dirs, Turbopack root, preview origins,\n// Cloudflare image loader) lives in exactly one place instead of being copied\n// into each template.\n//\n// `overrides` is a per-site customization surface, but it must not be able to\n// silently amputate platform wiring. A plain `...overrides` spread is a shallow\n// merge: a site that sets any nested key (e.g. `experimental.typedRoutes`)\n// would replace the whole `experimental`/`images` block and drop platform\n// defaults like the build-worker OOM guard or the Cloudflare image loader. So\n// load-bearing keys are re-asserted after the spread and the nested blocks are\n// deep-merged: a site can add keys, but platform invariants always win and\n// platform origin lists are preserved (site entries are appended, not swapped).\nexport function siteConfig(overrides: NextConfig = {}): NextConfig {\n  const isBuild = process.env.BUILD_ENV === \"build\";\n  const devRoot = process.env.IS_REPLO_SANDBOX\n    ? \"/workspace/dev\"\n    : process.cwd();\n  const {\n    turbopack: overrideTurbopack,\n    images: overrideImages,\n    experimental: overrideExperimental,\n    allowedDevOrigins: overrideDevOrigins,\n    pageExtensions: overridePageExtensions,\n    typescript: overrideTypescript,\n    ...restOverrides\n  } = overrides;\n\n  const { serverActions: overrideServerActions, ...restOverrideExperimental } =\n    overrideExperimental ?? {};\n\n  return {\n    // Site-overridable defaults.\n    reactStrictMode: true,\n    devIndicators: false,\n    ...restOverrides,\n\n    // Platform invariants \u2014 re-asserted after the spread so a site override\n    // can never break sandbox builds, publish, or the dev server.\n    output: \"standalone\",\n    distDir: isBuild ? \".next\" : \".next-dev\",\n    pageExtensions: resolvePageExtensions(overridePageExtensions),\n    typescript: resolvePublishTypescriptConfig(overrideTypescript),\n    // NOTE (Cole, 2026-04-30, REPL-26637): The publish tool patches\n    // required-server-files.json to clear this value before OpenNext bundles,\n    // since \"/\" makes esbuild emit absolute-path requires that break in Workers.\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Leave outputFileTracingRoot\n    // unset outside builds because Next 15.5+ otherwise forces turbopack.root to\n    // \"/\" and makes the dev watcher retain whole-filesystem state.\n    outputFileTracingRoot: isBuild ? \"/\" : undefined,\n    // NOTE (Patrick Lu, 2026-07-06, REPL-28775): Match build tracing at publish\n    // time; keep dev's watcher on the user app tree.\n    turbopack: {\n      ...overrideTurbopack,\n      root: isBuild ? \"/\" : devRoot,\n    },\n    // @replohq/sdk ships as raw source with zero workspace deps, so we can't pull\n    // in lodash-es `uniq` here \u2014 dedupe inline via a Set instead.\n    allowedDevOrigins: Array.from(\n      new Set([...(overrideDevOrigins ?? []), ...PLATFORM_DEV_ORIGINS]),\n    ),\n    images: {\n      ...overrideImages,\n      loader: \"custom\",\n      loaderFile: \"./image-loader.ts\",\n      remotePatterns: overrideImages?.remotePatterns ?? [\n        {\n          protocol: \"https\",\n          hostname: \"**\",\n        },\n      ],\n    },\n    experimental: {\n      ...restOverrideExperimental,\n      // NOTE (Cole, 2026-06-18, REPL-28180): Next sizes its build worker pool\n      // off os.cpus().length = host cores (~64) inside a cgroup-limited sandbox,\n      // not the 2 the container actually has \u2014 a worker swarm that OOMs the\n      // 4 GiB box. availableParallelism() is cgroup-aware. Gated to prod build.\n      cpus: isBuild ? os.availableParallelism() : undefined,\n      serverActions: {\n        ...overrideServerActions,\n        allowedOrigins: Array.from(\n          new Set([\n            ...(overrideServerActions?.allowedOrigins ?? []),\n            ...PLATFORM_SERVER_ACTION_ORIGINS,\n          ]),\n        ),\n      },\n    },\n  };\n}\n\nconst nextConfig: NextConfig = siteConfig();\n\nexport default nextConfig;\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,OAAO,QAAQ;AACf,OAAO,UAAU;AAOjB,MAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,0BAA0B,CAAC,OAAO,MAAM,OAAO,IAAI;AAEzD,MAAM,mCAAmC,CAAC,WAAW,SAAS;AAE9D,MAAM,6BAA6B,CAAC,eAAe;AACnD,MAAM,4BAA4B;AAQlC,SAAS,sBAAsB,sBAA4C;AACzE,QAAM,kBACJ,wBAAwB,yBACxB,OAAO,CAAC,cAAc;AACtB,WACE,CAAC,iCAAiC,SAAS,SAAS,KACpD,CAAC,2BAA2B,SAAS,SAAS;AAAA,EAElD,CAAC;AAED,SAAO,QAAQ,IAAI,cAAc,UAC7B,CAAC,GAAG,4BAA4B,GAAG,cAAc,IACjD,CAAC,GAAG,kCAAkC,GAAG,cAAc;AAC7D;AAKA,SAAS,+BAA+B,YAAsC;AAC5E,MAAI,QAAQ,IAAI,cAAc,SAAS;AACrC,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,KAAK,KAAK,QAAQ,IAAI,GAAG,yBAAyB;AACvE,SAAO,WAAW,YAAY,IAC1B,EAAE,GAAG,YAAY,cAAc,0BAA0B,IACzD;AACN;AAgBO,SAAS,WAAW,YAAwB,CAAC,GAAe;AACjE,QAAM,UAAU,QAAQ,IAAI,cAAc;AAC1C,QAAM,UAAU,QAAQ,IAAI,mBACxB,mBACA,QAAQ,IAAI;AAChB,QAAM;AAAA,IACJ,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,mBAAmB;AAAA,IACnB,gBAAgB;AAAA,IAChB,YAAY;AAAA,IACZ,GAAG;AAAA,EACL,IAAI;AAEJ,QAAM,EAAE,eAAe,uBAAuB,GAAG,yBAAyB,IACxE,wBAAwB,CAAC;AAE3B,SAAO;AAAA;AAAA,IAEL,iBAAiB;AAAA,IACjB,eAAe;AAAA,IACf,GAAG;AAAA;AAAA;AAAA,IAIH,QAAQ;AAAA,IACR,SAAS,UAAU,UAAU;AAAA,IAC7B,gBAAgB,sBAAsB,sBAAsB;AAAA,IAC5D,YAAY,+BAA+B,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAO7D,uBAAuB,UAAU,MAAM;AAAA;AAAA;AAAA,IAGvC,WAAW;AAAA,MACT,GAAG;AAAA,MACH,MAAM,UAAU,MAAM;AAAA,IACxB;AAAA;AAAA;AAAA,IAGA,mBAAmB,MAAM;AAAA,MACvB,oBAAI,IAAI,CAAC,GAAI,sBAAsB,CAAC,GAAI,GAAG,oBAAoB,CAAC;AAAA,IAClE;AAAA,IACA,QAAQ;AAAA,MACN,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,gBAAgB,gBAAgB,kBAAkB;AAAA,QAChD;AAAA,UACE,UAAU;AAAA,UACV,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,MAKH,MAAM,UAAU,GAAG,qBAAqB,IAAI;AAAA,MAC5C,eAAe;AAAA,QACb,GAAG;AAAA,QACH,gBAAgB,MAAM;AAAA,UACpB,oBAAI,IAAI;AAAA,YACN,GAAI,uBAAuB,kBAAkB,CAAC;AAAA,YAC9C,GAAG;AAAA,UACL,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,aAAyB,WAAW;AAE1C,IAAO,iBAAQ;",
   "names": []
 }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "1.1.0",
+    "version": "1.2.1",
     "branch": "HEAD",
-    "commit": "3596a406ee1c678085915d00db96f52ad3f9ac76",
-    "builtAt": "2026-09-01T19:49:23.848Z"
+    "commit": "8534cbe94f47e7d47bbb1c214bf02f58289cc1a8",
+    "builtAt": "2026-09-02T20:05:57.576Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",