@replohq/sdk 1.9.2 → 1.9.4

package/analytics/replo-pixel-script.js

@@ -1,16 +1,18 @@
 "use client";
 import { jsx } from "react/jsx-runtime";
-import { findDelegatedPlatform } from "../consent/consent-platform";
-import { isConsentAllowed, useConsent } from "../consent/consent-store";
 import { InjectedScript } from "../consent/replo-scripts";
+import { useIsBlockedByNativeConsent } from "../consent/use-is-blocked-by-native-consent";
 const PIXEL_SCRIPT_ID = "replo:first-party-pixel";
+const PIXEL_REQUIRED_CONSENT = ["analytics"];
 function ReploPixelScript({
   pixelUrl,
   apiUrl,
   projectId
 }) {
-  const consent = useConsent();
-  if (!findDelegatedPlatform() && !isConsentAllowed({ state: consent, requiredConsent: ["analytics"] })) {
+  const isBlockedByNativeConsent = useIsBlockedByNativeConsent(
+    PIXEL_REQUIRED_CONSENT
+  );
+  if (isBlockedByNativeConsent) {
     return null;
   }
   const descriptors = [
@@ -28,7 +30,7 @@ function ReploPixelScript({
     {
       baseId: PIXEL_SCRIPT_ID,
       descriptors,
-      requiredConsent: ["analytics"]
+      requiredConsent: PIXEL_REQUIRED_CONSENT
     }
   );
 }

package/consent/consent-store.d.ts

@@ -6,11 +6,10 @@ import type { ConsentCategories } from "./cookie";
  * all share the same state regardless of where they sit in the React tree — no
  * provider-ancestor relationship is required.
  *
- * Consent-dependent work (script injection, banner visibility) happens on the
- * client (effects / post-mount), so there is no SSR/hydration mismatch. The
- * client reads the (non-httpOnly) consent cookie directly, so no server seed is
- * needed. The whole-site `mode` comes from the `data-replo-consent-mode`
- * attribute on `<html>`.
+ * SSR and the first hydration render use a `mode: "off"` snapshot, which allows
+ * every category under native consent. Irreversible consent work must wait for
+ * client hydration, when the cookie-backed snapshot is available. The
+ * whole-site `mode` comes from `data-replo-consent-mode` on `<html>`.
  */
 export interface ConsentState {
     /** Which platform owns consent. Absent means Replo's native banner; "external" is a generic `consentPlatform` entry. */

package/consent/replo-scripts.js

@@ -11,7 +11,6 @@ import {
   isConsentPlatformEntry,
   OPTIONAL_CONSENT_CATEGORIES
 } from "./consent-platform";
-import { isConsentAllowed, useConsent } from "./consent-store";
 import { injectScriptDescriptors } from "./inject-script-descriptors";
 import {
   registerScript,
@@ -19,6 +18,7 @@ import {
   unregisterScript
 } from "./script-registration-store";
 import { buildScriptTags, defaultConsentFor } from "./script-snippets";
+import { useIsBlockedByNativeConsent } from "./use-is-blocked-by-native-consent";
 import { installConsentWindowApi } from "./window-api";
 function scriptId(entry) {
   if (entry.type === "custom") {
@@ -90,10 +90,9 @@ class ScriptRegistration extends Component {
   }
 }
 function ManagedScript({ entry }) {
-  const consent = useConsent();
   const requiredConsent = requiredConsentFor(entry);
   const id = scriptId(entry);
-  const isBlockedByNativeConsent = !findDelegatedPlatform() && !isConsentAllowed({ state: consent, requiredConsent });
+  const isBlockedByNativeConsent = useIsBlockedByNativeConsent(requiredConsent);
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx(
       ScriptRegistration,

package/consent/test-helpers.d.ts

@@ -0,0 +1,11 @@
+import type { ReactNode } from "react";
+import type { ConsentCategories } from "./cookie";
+export declare function clearConsentCookie(): void;
+export declare function writeConsentCookie({ categories, consentId, }: {
+    categories: ConsentCategories;
+    consentId: string;
+}): void;
+export declare function hydrateFromServer(element: ReactNode): {
+    root: import("react-dom/client").Root;
+    serverHtml: string;
+};

package/consent/test-helpers.js

@@ -0,0 +1,29 @@
+import { flushSync } from "react-dom";
+import { hydrateRoot } from "react-dom/client";
+import { renderToString } from "react-dom/server";
+import { CONSENT_COOKIE_NAME, serializeConsentCookieValue } from "./cookie";
+function clearConsentCookie() {
+  document.cookie = `${CONSENT_COOKIE_NAME}=; path=/; max-age=0`;
+}
+function writeConsentCookie({
+  categories,
+  consentId
+}) {
+  document.cookie = `${CONSENT_COOKIE_NAME}=${serializeConsentCookieValue({
+    categories,
+    decidedAt: 1e3,
+    consentId
+  })}; path=/`;
+}
+function hydrateFromServer(element) {
+  const serverHtml = renderToString(element);
+  const container = document.createElement("div");
+  container.innerHTML = serverHtml;
+  const root = flushSync(() => hydrateRoot(container, element));
+  return { root, serverHtml };
+}
+export {
+  clearConsentCookie,
+  hydrateFromServer,
+  writeConsentCookie
+};

package/consent/use-is-blocked-by-native-consent.d.ts

@@ -0,0 +1,2 @@
+import type { ConsentCategory } from "../_vendor/schemas/generated/consent";
+export declare function useIsBlockedByNativeConsent(requiredConsent: ConsentCategory[]): boolean;

package/consent/use-is-blocked-by-native-consent.js

@@ -0,0 +1,11 @@
+import { useIsHydrated } from "../hooks/use-is-hydrated";
+import { findDelegatedPlatform } from "./consent-platform";
+import { isConsentAllowed, useConsent } from "./consent-store";
+function useIsBlockedByNativeConsent(requiredConsent) {
+  const isHydrated = useIsHydrated();
+  const consent = useConsent();
+  return !findDelegatedPlatform() && (!isHydrated || !isConsentAllowed({ state: consent, requiredConsent }));
+}
+export {
+  useIsBlockedByNativeConsent
+};

package/hooks/use-is-hydrated.d.ts

@@ -0,0 +1,2 @@
+/** False during SSR and hydration, then true for client renders. */
+export declare function useIsHydrated(): boolean;

package/hooks/use-is-hydrated.js

@@ -0,0 +1,11 @@
+import { useSyncExternalStore } from "react";
+const subscribe = () => () => {
+};
+const getClientSnapshot = () => true;
+const getServerSnapshot = () => false;
+function useIsHydrated() {
+  return useSyncExternalStore(subscribe, getClientSnapshot, getServerSnapshot);
+}
+export {
+  useIsHydrated
+};

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "branch": "HEAD",
-  "commit": "b00423087f2b01a9cc8fb4700d453161b9ec846c",
-  "builtAt": "2026-09-17T18:32:43.736Z"
+  "commit": "aa07173168356fbdc7ade4a24770a38f85a887f6",
+  "builtAt": "2026-09-18T16:24:49.114Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "1.9.2",
+  "version": "1.9.4",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "1.9.2",
+    "version": "1.9.4",
     "branch": "HEAD",
-    "commit": "b00423087f2b01a9cc8fb4700d453161b9ec846c",
-    "builtAt": "2026-09-17T18:32:43.736Z"
+    "commit": "aa07173168356fbdc7ade4a24770a38f85a887f6",
+    "builtAt": "2026-09-18T16:24:49.114Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",

package/routing/evaluate.js

@@ -123,7 +123,7 @@ function evaluateLocalePhase({
   if (isLocaleExemptPath(pathname)) {
     return NextResponse.next();
   }
-  const { urlMode, pathLocale, negotiated, scope } = localeContext;
+  const { urlMode, pathLocale, negotiated, scope, config } = localeContext;
   if (urlMode === "prefixed") {
     if (!pathLocale) {
       const url2 = request.nextUrl.clone();
@@ -133,12 +133,13 @@ function evaluateLocalePhase({
       });
       return NextResponse.redirect(url2, 307);
     }
-    if (pathLocale.pathSegment !== pathLocale.locale) {
+    const canonicalPath = canonicalPrefixedPathname({
+      pathLocale,
+      locales: config.locales
+    });
+    if (canonicalPath !== pathname) {
       const url2 = request.nextUrl.clone();
-      url2.pathname = withLocalePrefix({
-        locale: pathLocale.locale,
-        path: pathLocale.logicalPath
-      });
+      url2.pathname = canonicalPath;
       return NextResponse.redirect(url2, 308);
     }
     const response = NextResponse.next();
@@ -163,6 +164,20 @@ function evaluateLocalePhase({
   });
   return NextResponse.rewrite(url);
 }
+function canonicalPrefixedPathname({
+  pathLocale,
+  locales
+}) {
+  const nestedLocale = getLocaleFromPath({
+    pathname: pathLocale.logicalPath,
+    locales
+  });
+  const chosen = nestedLocale ?? pathLocale;
+  return withLocalePrefix({
+    locale: chosen.locale,
+    path: chosen.logicalPath
+  });
+}
 function isLocaleExemptPath(pathname) {
   if (pathname === "/api" || pathname.startsWith("/api/")) {
     return true;

package/routing/locale.d.ts

@@ -10,4 +10,4 @@
  */
 export type { LocaleDetection, LocaleRoutingConfig, LocaleRoutingConfigInput, LocaleUrlMode, } from "../_vendor/schemas/routing/locale";
 export { REPLO_COUNTRY_OVERRIDE_COOKIE, REPLO_LOCALE_COOKIE, reploLocaleRouting, } from "../_vendor/schemas/routing/locale";
-export { localeUrl } from "../_vendor/schemas/routing/localeNegotiation";
+export { getLocaleFromPath, localeUrl, } from "../_vendor/schemas/routing/localeNegotiation";

package/routing/locale.js

@@ -3,10 +3,14 @@ import {
   REPLO_LOCALE_COOKIE,
   reploLocaleRouting
 } from "../_vendor/schemas/routing/locale.mjs";
-import { localeUrl } from "../_vendor/schemas/routing/localeNegotiation.mjs";
+import {
+  getLocaleFromPath,
+  localeUrl
+} from "../_vendor/schemas/routing/localeNegotiation.mjs";
 export {
   REPLO_COUNTRY_OVERRIDE_COOKIE,
   REPLO_LOCALE_COOKIE,
+  getLocaleFromPath,
   localeUrl,
   reploLocaleRouting
 };