@replohq/sdk 1.9.3 → 1.9.5

package/README.md

@@ -41,6 +41,13 @@ export default function RootLayout({ children }: React.PropsWithChildren) {
 `ReploProvider` is an async Server Component. Components that use SDK hooks or
 loaders must render beneath it.
 
+## Buy now checkout
+
+Use `useBuyNow` from `@replohq/sdk/cart/hooks/use-buy-now` to send a shopper
+directly to checkout. Shopify checkout applies selling plans and discount codes.
+Stripe checkout ignores both, logs a server warning when either is supplied,
+and still creates the checkout session.
+
 ## Data loaders
 
 Data loaders retrieve data from integrations configured for the Replo project.

package/analytics/replo-pixel-script.js

@@ -1,16 +1,18 @@
 "use client";
 import { jsx } from "react/jsx-runtime";
-import { findDelegatedPlatform } from "../consent/consent-platform";
-import { isConsentAllowed, useConsent } from "../consent/consent-store";
 import { InjectedScript } from "../consent/replo-scripts";
+import { useIsBlockedByNativeConsent } from "../consent/use-is-blocked-by-native-consent";
 const PIXEL_SCRIPT_ID = "replo:first-party-pixel";
+const PIXEL_REQUIRED_CONSENT = ["analytics"];
 function ReploPixelScript({
   pixelUrl,
   apiUrl,
   projectId
 }) {
-  const consent = useConsent();
-  if (!findDelegatedPlatform() && !isConsentAllowed({ state: consent, requiredConsent: ["analytics"] })) {
+  const isBlockedByNativeConsent = useIsBlockedByNativeConsent(
+    PIXEL_REQUIRED_CONSENT
+  );
+  if (isBlockedByNativeConsent) {
     return null;
   }
   const descriptors = [
@@ -28,7 +30,7 @@ function ReploPixelScript({
     {
       baseId: PIXEL_SCRIPT_ID,
       descriptors,
-      requiredConsent: ["analytics"]
+      requiredConsent: PIXEL_REQUIRED_CONSENT
     }
   );
 }

package/analytics/utils/analytics-utils.js

@@ -53,6 +53,9 @@ function createAnalyticsQueue({
       return;
     }
     if (isReady()) {
+      if (queue.length > 0) {
+        flush();
+      }
       send(payload);
     } else {
       queue.push(payload);
@@ -124,6 +127,9 @@ function createMethodQueue(checkInstanceReady, options) {
     }
     const instance = checkInstanceReady();
     if (instance) {
+      if (queue.length > 0) {
+        flush();
+      }
       const methodFunction = instance[method];
       if (typeof methodFunction === "function") {
         void methodFunction.apply(instance, args);

package/cart/buy-now-action.js

@@ -48,6 +48,11 @@ async function buyNowWithRecoveryAction(input) {
     };
   });
   if (checkoutProvider === "stripe") {
+    if (discountCodes.length > 0 || lineItems.some((lineItem) => Boolean(lineItem.sellingPlanId))) {
+      console.warn(
+        "[Replo] Stripe buy now does not support selling plans or discount codes; those options were ignored."
+      );
+    }
     const env = await getEnv();
     const temporaryCartId = input.checkoutAttemptId ?? uuidv4();
     const body = {

package/cart/cart-schema.d.ts

@@ -78,4 +78,83 @@ export declare const cartSchema: z.ZodObject<{
         country: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+export declare const clientCartSchema: z.ZodObject<{
+    id: z.ZodString;
+    cost: z.ZodObject<{
+        subtotalAmount: z.ZodNumber;
+        totalAmount: z.ZodNumber;
+        currencyCode: z.ZodString;
+    }, z.core.$strip>;
+    checkoutUrl: z.ZodOptional<z.ZodString>;
+    discountCodes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        code: z.ZodString;
+        applicable: z.ZodBoolean;
+    }, z.core.$strip>>>;
+    discountAllocations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        discountedAmount: z.ZodNumber;
+        title: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>;
+    buyerIdentity: z.ZodOptional<z.ZodObject<{
+        country: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    lines: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        quantity: z.ZodNumber;
+        attributes: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            value: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
+        }, z.core.$strip>>;
+        sellingPlanAllocation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            sellingPlan: z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                description: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
+            priceAdjustments: z.ZodArray<z.ZodObject<{
+                compareAtPrice: z.ZodObject<{
+                    amount: z.ZodNumber;
+                    currencyCode: z.ZodString;
+                }, z.core.$strip>;
+                perDeliveryPrice: z.ZodObject<{
+                    amount: z.ZodNumber;
+                    currencyCode: z.ZodString;
+                }, z.core.$strip>;
+                price: z.ZodObject<{
+                    amount: z.ZodNumber;
+                    currencyCode: z.ZodString;
+                }, z.core.$strip>;
+                unitPrice: z.ZodNullable<z.ZodObject<{
+                    amount: z.ZodNumber;
+                    currencyCode: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            checkoutChargeAmount: z.ZodObject<{
+                amount: z.ZodNumber;
+                currencyCode: z.ZodString;
+            }, z.core.$strip>;
+            remainingBalanceChargeAmount: z.ZodObject<{
+                amount: z.ZodNumber;
+                currencyCode: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>>>;
+        merchandise: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodString;
+            price: z.ZodNumber;
+            compareAtPrice: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            image: z.ZodNullable<z.ZodObject<{
+                url: z.ZodString;
+                altText: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            selectedOptions: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strip>>;
+            product: z.ZodObject<{
+                id: z.ZodString;
+                title: z.ZodString;
+            }, z.core.$loose>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type Cart = z.infer<typeof cartSchema>;

package/cart/cart-schema.js

@@ -69,6 +69,16 @@ const cartSchema = z.object({
   discountAllocations: z.array(cartDiscountAllocationSchema).optional(),
   buyerIdentity: z.object({ country: z.string().nullable() }).optional()
 });
+const clientCartSchema = cartSchema.extend({
+  lines: z.array(
+    cartLineSchema.extend({
+      merchandise: cartLineMerchandiseSchema.extend({
+        product: cartLineMerchandiseSchema.shape.product.loose()
+      }).nullable()
+    })
+  )
+});
 export {
-  cartSchema
+  cartSchema,
+  clientCartSchema
 };

package/cart/hooks/use-buy-now.d.ts

@@ -21,7 +21,8 @@ export interface VariantBuyNowInfo {
 /**
  * React hook that returns a `buyNow` function for express checkout flows.
  * Handles creating the cart/checkout session server-side and redirecting
- * the browser to checkout.
+ * the browser to checkout. Stripe checkout ignores selling plans and discount
+ * codes, logging a server-side warning when either is supplied.
  *
  * @example
  *

package/cart/utils/cart-utils.js

@@ -66,7 +66,8 @@ function calculateCartTotals({
 }) {
   const lineItemSubtotal = calculateLineItemsSubtotal(lineItems);
   const compareAtSubtotal = lineItems.reduce((sum, item) => {
-    return sum + getCartLinePricing(item).compareAtPrice * item.quantity;
+    const { compareAtPrice, finalPrice } = getCartLinePricing(item);
+    return sum + Math.max(compareAtPrice, finalPrice) * item.quantity;
   }, 0);
   const total = cart?.cost.totalAmount ?? lineItemSubtotal;
   const discountAmount = (cart?.discountAllocations ?? []).reduce(

package/cart/utils/cookie-cart-persistence.js

@@ -1,10 +1,28 @@
 "use server";
 import { cookies } from "next/headers";
+import { parseJsonOrNull } from "../../_vendor/replo-utils/lib/json.mjs";
+import { CanopyError } from "../../lib/canopy-error";
+import { clientCartSchema } from "../cart-schema";
 import { getCartCookieOptions } from "../gateways/cart-constants";
 import { recalculateCartCost } from "./cart-utils";
+const MAX_CART_COOKIE_SIZE_BYTES = 3900;
+class CartCookieSizeError extends CanopyError {
+}
 async function saveCartToCookie(cart, cookieName) {
+  const serializedCart = JSON.stringify(cart);
+  const serializedSizeBytes = encodeURIComponent(serializedCart).length;
+  if (serializedSizeBytes > MAX_CART_COOKIE_SIZE_BYTES) {
+    throw new CartCookieSizeError({
+      message: `[Replo] ${cookieName} exceeds the browser cookie size limit; cart changes were not persisted.`,
+      additionalData: {
+        cookieName,
+        serializedSizeBytes,
+        maxSizeBytes: MAX_CART_COOKIE_SIZE_BYTES
+      }
+    });
+  }
   const cookieStore = await cookies();
-  cookieStore.set(cookieName, JSON.stringify(cart), getCartCookieOptions());
+  cookieStore.set(cookieName, serializedCart, getCartCookieOptions());
 }
 async function loadCartFromCookie(cookieName) {
   const cookieStore = await cookies();
@@ -12,13 +30,13 @@ async function loadCartFromCookie(cookieName) {
   if (!cartCookie?.value) {
     return null;
   }
-  try {
-    return JSON.parse(cartCookie.value);
-  } catch (error) {
-    console.warn("Failed to parse cart cookie:", error);
-    await clearCartCookie(cookieName);
-    return null;
+  const result = clientCartSchema.safeParse(parseJsonOrNull(cartCookie.value));
+  if (result.success) {
+    return result.data;
   }
+  console.warn("Failed to parse cart cookie:", result.error);
+  await clearCartCookie(cookieName);
+  return null;
 }
 async function clearCartCookie(cookieName) {
   const cookieStore = await cookies();

package/consent/consent-action.d.ts

@@ -1,5 +1,16 @@
 import type { ConsentAction } from "../_vendor/schemas/generated/consent";
 import type { ConsentCategories } from "./cookie";
+/**
+ * Pure mapping from a consent decision (previous state vs the resulting state)
+ * to the legal-record `action` written to the proof-of-consent audit log.
+ *
+ * Only non-necessary categories matter (`necessary` is always granted). The
+ * mapping is:
+ *   - first decision (`decidedAt === null`), some category granted -> "accept"
+ *   - first decision, nothing granted                            -> "reject"
+ *   - later decision moving from some consent to none            -> "withdraw"
+ *   - any other later change                                     -> "update"
+ */
 export declare function deriveConsentAction({ previous, next, }: {
     previous: {
         decidedAt: number | null;

package/consent/consent-action.js

@@ -1,23 +1,15 @@
-const NON_NECESSARY_CATEGORIES = [
-  "analytics",
-  "marketing",
-  "preferences",
-  "sale_of_data"
-];
+import { OPTIONAL_CONSENT_CATEGORIES } from "./consent-platform";
+function hasAnyGranted(categories) {
+  return OPTIONAL_CONSENT_CATEGORIES.some((category) => categories[category]);
+}
 function deriveConsentAction({
   previous,
   next
 }) {
-  const anyGranted = NON_NECESSARY_CATEGORIES.some(
-    (category) => next[category]
-  );
   if (previous.decidedAt === null) {
-    return anyGranted ? "accept" : "reject";
-  }
-  if (!anyGranted) {
-    return "withdraw";
+    return hasAnyGranted(next) ? "accept" : "reject";
   }
-  return "update";
+  return hasAnyGranted(previous.categories) && !hasAnyGranted(next) ? "withdraw" : "update";
 }
 export {
   deriveConsentAction

package/consent/consent-store.d.ts

@@ -6,11 +6,10 @@ import type { ConsentCategories } from "./cookie";
  * all share the same state regardless of where they sit in the React tree — no
  * provider-ancestor relationship is required.
  *
- * Consent-dependent work (script injection, banner visibility) happens on the
- * client (effects / post-mount), so there is no SSR/hydration mismatch. The
- * client reads the (non-httpOnly) consent cookie directly, so no server seed is
- * needed. The whole-site `mode` comes from the `data-replo-consent-mode`
- * attribute on `<html>`.
+ * SSR and the first hydration render use a `mode: "off"` snapshot, which allows
+ * every category under native consent. Irreversible consent work must wait for
+ * client hydration, when the cookie-backed snapshot is available. The
+ * whole-site `mode` comes from `data-replo-consent-mode` on `<html>`.
  */
 export interface ConsentState {
     /** Which platform owns consent. Absent means Replo's native banner; "external" is a generic `consentPlatform` entry. */

package/consent/replo-scripts.js

@@ -11,7 +11,6 @@ import {
   isConsentPlatformEntry,
   OPTIONAL_CONSENT_CATEGORIES
 } from "./consent-platform";
-import { isConsentAllowed, useConsent } from "./consent-store";
 import { injectScriptDescriptors } from "./inject-script-descriptors";
 import {
   registerScript,
@@ -19,6 +18,7 @@ import {
   unregisterScript
 } from "./script-registration-store";
 import { buildScriptTags, defaultConsentFor } from "./script-snippets";
+import { useIsBlockedByNativeConsent } from "./use-is-blocked-by-native-consent";
 import { installConsentWindowApi } from "./window-api";
 function scriptId(entry) {
   if (entry.type === "custom") {
@@ -90,10 +90,9 @@ class ScriptRegistration extends Component {
   }
 }
 function ManagedScript({ entry }) {
-  const consent = useConsent();
   const requiredConsent = requiredConsentFor(entry);
   const id = scriptId(entry);
-  const isBlockedByNativeConsent = !findDelegatedPlatform() && !isConsentAllowed({ state: consent, requiredConsent });
+  const isBlockedByNativeConsent = useIsBlockedByNativeConsent(requiredConsent);
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx(
       ScriptRegistration,

package/consent/test-helpers.d.ts

@@ -0,0 +1,11 @@
+import type { ReactNode } from "react";
+import type { ConsentCategories } from "./cookie";
+export declare function clearConsentCookie(): void;
+export declare function writeConsentCookie({ categories, consentId, }: {
+    categories: ConsentCategories;
+    consentId: string;
+}): void;
+export declare function hydrateFromServer(element: ReactNode): {
+    root: import("react-dom/client").Root;
+    serverHtml: string;
+};

package/consent/test-helpers.js

@@ -0,0 +1,29 @@
+import { flushSync } from "react-dom";
+import { hydrateRoot } from "react-dom/client";
+import { renderToString } from "react-dom/server";
+import { CONSENT_COOKIE_NAME, serializeConsentCookieValue } from "./cookie";
+function clearConsentCookie() {
+  document.cookie = `${CONSENT_COOKIE_NAME}=; path=/; max-age=0`;
+}
+function writeConsentCookie({
+  categories,
+  consentId
+}) {
+  document.cookie = `${CONSENT_COOKIE_NAME}=${serializeConsentCookieValue({
+    categories,
+    decidedAt: 1e3,
+    consentId
+  })}; path=/`;
+}
+function hydrateFromServer(element) {
+  const serverHtml = renderToString(element);
+  const container = document.createElement("div");
+  container.innerHTML = serverHtml;
+  const root = flushSync(() => hydrateRoot(container, element));
+  return { root, serverHtml };
+}
+export {
+  clearConsentCookie,
+  hydrateFromServer,
+  writeConsentCookie
+};

package/consent/use-is-blocked-by-native-consent.d.ts

@@ -0,0 +1,2 @@
+import type { ConsentCategory } from "../_vendor/schemas/generated/consent";
+export declare function useIsBlockedByNativeConsent(requiredConsent: ConsentCategory[]): boolean;

package/consent/use-is-blocked-by-native-consent.js

@@ -0,0 +1,11 @@
+import { useIsHydrated } from "../hooks/use-is-hydrated";
+import { findDelegatedPlatform } from "./consent-platform";
+import { isConsentAllowed, useConsent } from "./consent-store";
+function useIsBlockedByNativeConsent(requiredConsent) {
+  const isHydrated = useIsHydrated();
+  const consent = useConsent();
+  return !findDelegatedPlatform() && (!isHydrated || !isConsentAllowed({ state: consent, requiredConsent }));
+}
+export {
+  useIsBlockedByNativeConsent
+};

package/hooks/use-is-hydrated.d.ts

@@ -0,0 +1,2 @@
+/** False during SSR and hydration, then true for client renders. */
+export declare function useIsHydrated(): boolean;

package/hooks/use-is-hydrated.js

@@ -0,0 +1,11 @@
+import { useSyncExternalStore } from "react";
+const subscribe = () => () => {
+};
+const getClientSnapshot = () => true;
+const getServerSnapshot = () => false;
+function useIsHydrated() {
+  return useSyncExternalStore(subscribe, getClientSnapshot, getServerSnapshot);
+}
+export {
+  useIsHydrated
+};

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "1.9.3",
+  "version": "1.9.5",
   "branch": "HEAD",
-  "commit": "c32fdfc2a6a7ee4c9353574f7c61b940fe0bbb19",
-  "builtAt": "2026-09-18T15:00:53.352Z"
+  "commit": "0a035b21ce1b041469758df14644035659d54252",
+  "builtAt": "2026-09-18T18:40:51.491Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "1.9.3",
+  "version": "1.9.5",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "1.9.3",
+    "version": "1.9.5",
     "branch": "HEAD",
-    "commit": "c32fdfc2a6a7ee4c9353574f7c61b940fe0bbb19",
-    "builtAt": "2026-09-18T15:00:53.352Z"
+    "commit": "0a035b21ce1b041469758df14644035659d54252",
+    "builtAt": "2026-09-18T18:40:51.491Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",