@replohq/sdk 2.18.2 → 2.18.3

package/cart/cart-actions.js

@@ -1,5 +1,6 @@
 "use server";
 import { cookies } from "next/headers";
+import { readBuyerIp } from "../lib/buyer-ip";
 import { getCheckoutProvider } from "../lib/integration-utils";
 import { REPLO_ATTRIBUTION_PROPERTY } from "./cart-types";
 import {
@@ -23,7 +24,8 @@ async function reconcileExistingCart(cart, country) {
   if (country && reconciledCart.buyerIdentity?.country !== country) {
     return await cartGateway.updateCartBuyerIdentity({
       cartId: reconciledCart.id,
-      buyerIdentity: { country }
+      buyerIdentity: { country },
+      buyerIp: await readBuyerIp()
     });
   }
   return reconciledCart;
@@ -51,9 +53,10 @@ async function getCartAction() {
   const cartGateway = await getCartGateway();
   const sharedToken = checkoutProvider === "shopify" ? cookieStore.get(SHARED_SHOPIFY_CART_COOKIE_NAME)?.value : void 0;
   if (sharedToken) {
-    const sharedCart = await cartGateway.getCart(
-      `${SHOPIFY_CART_ID_PREFIX}${sharedToken}`
-    );
+    const sharedCart = await cartGateway.getCart({
+      cartId: `${SHOPIFY_CART_ID_PREFIX}${sharedToken}`,
+      buyerIp: await readBuyerIp()
+    });
     if (sharedCart) {
       return sharedCart;
     }
@@ -62,7 +65,10 @@ async function getCartAction() {
   if (!existingCartId) {
     return null;
   }
-  const cart = await cartGateway.getCart(existingCartId);
+  const cart = await cartGateway.getCart({
+    cartId: existingCartId,
+    buyerIp: await readBuyerIp()
+  });
   if (!cart) {
     try {
       cookieStore.set(SHOPIFY_CART_COOKIE_NAME, "", {
@@ -92,7 +98,8 @@ async function createCartAction(options) {
     lines,
     discountCodes,
     attributes,
-    buyerIdentity: country ? { country } : void 0
+    buyerIdentity: country ? { country } : void 0,
+    buyerIp: await readBuyerIp()
   });
   if (cart && !skipStoringCart) {
     try {
@@ -117,7 +124,8 @@ async function createCartAction(options) {
 }
 async function addToCartAction(lines, cartId) {
   const cartGateway = await getCartGateway();
-  const cart = await cartGateway.addToCart({ lines, cartId });
+  const buyerIp = await readBuyerIp();
+  const cart = await cartGateway.addToCart({ lines, cartId, buyerIp });
   if (!cart || await getCheckoutProvider() !== "shopify" || cart.attributes?.some(
     (attribute) => attribute.key === REPLO_ATTRIBUTION_PROPERTY.key
   )) {
@@ -125,29 +133,50 @@ async function addToCartAction(lines, cartId) {
   }
   const attributedCart = await cartGateway.replaceCartAttributes({
     cartId: cart.id,
-    attributes: [...cart.attributes ?? [], REPLO_ATTRIBUTION_PROPERTY]
+    attributes: [...cart.attributes ?? [], REPLO_ATTRIBUTION_PROPERTY],
+    buyerIp
   });
   return attributedCart ?? cart;
 }
 async function updateCartLineItemAction(line, cartId) {
   const cartGateway = await getCartGateway();
-  return await cartGateway.updateCartLineItem({ line, cartId });
+  return await cartGateway.updateCartLineItem({
+    line,
+    cartId,
+    buyerIp: await readBuyerIp()
+  });
 }
 async function removeCartLineItemsAction(lineIds, cartId) {
   const cartGateway = await getCartGateway();
-  return await cartGateway.removeCartLineItems({ lineIds, cartId });
+  return await cartGateway.removeCartLineItems({
+    lineIds,
+    cartId,
+    buyerIp: await readBuyerIp()
+  });
 }
 async function updateCartDiscountCodesAction(discountCodes, cartId) {
   const cartGateway = await getCartGateway();
-  return await cartGateway.updateCartDiscountCodes({ discountCodes, cartId });
+  return await cartGateway.updateCartDiscountCodes({
+    discountCodes,
+    cartId,
+    buyerIp: await readBuyerIp()
+  });
 }
 async function updateCartNoteAction(note, cartId) {
   const cartGateway = await getCartGateway();
-  return await cartGateway.updateCartNote({ note, cartId });
+  return await cartGateway.updateCartNote({
+    note,
+    cartId,
+    buyerIp: await readBuyerIp()
+  });
 }
 async function replaceCartAttributesAction(attributes, cartId) {
   const cartGateway = await getCartGateway();
-  return await cartGateway.replaceCartAttributes({ attributes, cartId });
+  return await cartGateway.replaceCartAttributes({
+    attributes,
+    cartId,
+    buyerIp: await readBuyerIp()
+  });
 }
 export {
   addToCartAction,

package/cart/checkout-actions.js

@@ -19,7 +19,7 @@ async function getCrossSellsAction(input) {
   if (await getCheckoutProvider() !== "stripe") {
     return [];
   }
-  return await (await getCanopyApiGateway()).findCrossSells(input);
+  return await getCanopyApiGateway().findCrossSells(input);
 }
 export {
   createCheckoutSessionAction,

package/cart/checkout-session-actions.js

@@ -1,10 +1,10 @@
 "use server";
 import { getCanopyApiGateway } from "../gateways/canopy-api";
 async function updateCheckoutShippingAction(input) {
-  return await (await getCanopyApiGateway()).updateCheckoutShipping(input);
+  return await getCanopyApiGateway().updateCheckoutShipping(input);
 }
 async function addCrossSellAction(input) {
-  return await (await getCanopyApiGateway()).addCrossSell(input);
+  return await getCanopyApiGateway().addCrossSell(input);
 }
 export {
   addCrossSellAction,

package/cart/gateways/cart-gateway.d.ts

@@ -1,6 +1,11 @@
 import type { AddToCartPayload, Cart, CartBuyerIdentity, CartLinePayload, RemoveFromCartPayload, ReplaceCartAttributesPayload, UpdateCartDiscountCodesPayload, UpdateCartLineItemPayload, UpdateCartNotePayload } from "../cart-types";
+/** `buyerIp` is the shopper's IP; Shopify carts forward it, others ignore it. */
 export interface CartGateway {
-    getCart(cartId: string): Promise<Cart | null>;
+    getCart(request: {
+        cartId: string;
+    } & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
     /**
      * Bring a stored cart back in line with its source of truth. Cookie carts
      * reprice against the catalog and drop unavailable lines (persisting the
@@ -8,7 +13,7 @@ export interface CartGateway {
      * cart unchanged.
      */
     reconcileStoredCart(cart: Cart): Promise<Cart>;
-    createCart(options?: {
+    createCart(options: {
         lines?: CartLinePayload[];
         discountCodes?: string[];
         attributes?: {
@@ -16,16 +21,32 @@ export interface CartGateway {
             value: string;
         }[];
         buyerIdentity?: CartBuyerIdentity;
+    } & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
+    addToCart(cartPayload: AddToCartPayload & {
+        buyerIp: string | null;
     }): Promise<Cart | null>;
-    addToCart(cartPayload: AddToCartPayload): Promise<Cart | null>;
     updateCartBuyerIdentity(payload: {
         cartId: string;
         buyerIdentity: CartBuyerIdentity;
+    } & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
+    updateCartLineItem(cartPayload: UpdateCartLineItemPayload & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
+    removeCartLineItems(cartPayload: RemoveFromCartPayload & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
+    updateCartDiscountCodes(cartPayload: UpdateCartDiscountCodesPayload & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
+    updateCartNote(cartPayload: UpdateCartNotePayload & {
+        buyerIp: string | null;
+    }): Promise<Cart | null>;
+    replaceCartAttributes(cartPayload: ReplaceCartAttributesPayload & {
+        buyerIp: string | null;
     }): Promise<Cart | null>;
-    updateCartLineItem(cartPayload: UpdateCartLineItemPayload): Promise<Cart | null>;
-    removeCartLineItems(cartPayload: RemoveFromCartPayload): Promise<Cart | null>;
-    updateCartDiscountCodes(cartPayload: UpdateCartDiscountCodesPayload): Promise<Cart | null>;
-    updateCartNote(cartPayload: UpdateCartNotePayload): Promise<Cart | null>;
-    replaceCartAttributes(cartPayload: ReplaceCartAttributesPayload): Promise<Cart | null>;
 }
 export declare function getCartGateway(): Promise<CartGateway>;

package/cart/gateways/cookie-cart-gateway.d.ts

@@ -27,8 +27,10 @@ export declare abstract class CookieBasedCartGateway implements CartGateway {
     private reconcile;
     private reconcileForWrite;
     reconcileStoredCart(cart: Cart): Promise<Cart>;
-    getCart(cartId: string): Promise<Cart | null>;
-    createCart({ lines, }?: {
+    getCart({ cartId }: {
+        cartId: string;
+    }): Promise<Cart | null>;
+    createCart({ lines, }: {
         lines?: CartLinePayload[];
         discountCodes?: string[];
         buyerIdentity?: CartBuyerIdentity;

package/cart/gateways/cookie-cart-gateway.js

@@ -51,7 +51,7 @@ class CookieBasedCartGateway {
     }
     return reconciledCart;
   }
-  async getCart(cartId) {
+  async getCart({ cartId }) {
     try {
       const cart = await loadCartFromCookie(this.config.cookieName);
       return cart?.id === cartId ? cart : null;
@@ -65,7 +65,7 @@ class CookieBasedCartGateway {
   }
   async createCart({
     lines
-  } = {}) {
+  }) {
     try {
       const cart = await createCartWithPersistence({
         cookieName: this.config.cookieName,
@@ -146,7 +146,7 @@ class CookieBasedCartGateway {
       `${this.config.gatewayName} cart gateway does not yet support discount codes`
     );
     try {
-      return await this.getCart(cartPayload.cartId);
+      return await this.getCart({ cartId: cartPayload.cartId });
     } catch (error) {
       console.warn("Failed to fetch cart for discount code update:", error);
       return null;
@@ -155,7 +155,7 @@ class CookieBasedCartGateway {
   async updateCartBuyerIdentity({
     cartId
   }) {
-    return this.getCart(cartId);
+    return this.getCart({ cartId });
   }
   async updateCartNote({
     cartId,

package/cart/gateways/resolver-cart-gateway.js

@@ -4,18 +4,21 @@ class ResolverCartGateway {
   async reconcileStoredCart(cart) {
     return cart;
   }
-  async getCart(cartId) {
-    const gateway = await getCanopyApiGateway();
-    return await gateway.cartGet({ cartId });
+  async getCart({
+    cartId,
+    buyerIp
+  }) {
+    return await getCanopyApiGateway().cartGet({ cartId, buyerIp });
   }
   async createCart({
     lines,
     discountCodes,
     attributes,
-    buyerIdentity
-  } = {}) {
+    buyerIdentity,
+    buyerIp
+  }) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartCreate({
         lines: lines?.map((line) => ({
           merchandiseId: line.id,
@@ -28,7 +31,8 @@ class ResolverCartGateway {
         })),
         discountCodes,
         attributes,
-        country: buyerIdentity?.country
+        country: buyerIdentity?.country,
+        buyerIp
       });
     } catch (error) {
       console.warn("Failed to create cart via canopy-api:", error);
@@ -37,9 +41,10 @@ class ResolverCartGateway {
   }
   async addToCart(cartPayload) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartAddLines({
         cartId: cartPayload.cartId,
+        buyerIp: cartPayload.buyerIp,
         lines: cartPayload.lines.map((line) => ({
           merchandiseId: line.id,
           quantity: line.quantity,
@@ -57,9 +62,10 @@ class ResolverCartGateway {
   }
   async updateCartLineItem(cartPayload) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartUpdateLines({
         cartId: cartPayload.cartId,
+        buyerIp: cartPayload.buyerIp,
         lines: [
           {
             lineId: cartPayload.line.id,
@@ -79,9 +85,10 @@ class ResolverCartGateway {
   }
   async removeCartLineItems(cartPayload) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartRemoveLines({
         cartId: cartPayload.cartId,
+        buyerIp: cartPayload.buyerIp,
         lineIds: cartPayload.lineIds
       });
     } catch (error) {
@@ -91,9 +98,10 @@ class ResolverCartGateway {
   }
   async updateCartDiscountCodes(cartPayload) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartUpdateDiscountCodes({
         cartId: cartPayload.cartId,
+        buyerIp: cartPayload.buyerIp,
         discountCodes: cartPayload.discountCodes
       });
     } catch (error) {
@@ -103,13 +111,15 @@ class ResolverCartGateway {
   }
   async updateCartBuyerIdentity({
     cartId,
-    buyerIdentity
+    buyerIdentity,
+    buyerIp
   }) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartUpdateBuyerIdentity({
         cartId,
-        country: buyerIdentity.country
+        country: buyerIdentity.country,
+        buyerIp
       });
     } catch (error) {
       console.warn(
@@ -121,9 +131,10 @@ class ResolverCartGateway {
   }
   async updateCartNote(cartPayload) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartUpdateNote({
         cartId: cartPayload.cartId,
+        buyerIp: cartPayload.buyerIp,
         note: cartPayload.note
       });
     } catch (error) {
@@ -133,9 +144,10 @@ class ResolverCartGateway {
   }
   async replaceCartAttributes(cartPayload) {
     try {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.cartReplaceAttributes({
         cartId: cartPayload.cartId,
+        buyerIp: cartPayload.buyerIp,
         attributes: cartPayload.attributes.map((attribute) => ({
           key: attribute.key,
           value: String(attribute.value)

package/cart/gateways/stripe-cart-gateway.js

@@ -19,7 +19,7 @@ class StripeCartGateway extends CookieBasedCartGateway {
     cartIdGenerator: stripeCartIdGenerator,
     gatewayName: "Stripe",
     reconcileLines: async (lines) => {
-      const gateway = await getCanopyApiGateway();
+      const gateway = getCanopyApiGateway();
       return await gateway.reconcileCartLines({ lines });
     }
   };

package/cart/start-stripe-checkout.js

@@ -37,7 +37,7 @@ async function startStripeCheckout({
       "[Replo] Stripe buy now does not support selling plans or discount codes; those options were ignored."
     );
   }
-  const outcome = await (await getCanopyApiGateway()).createStripeCheckoutSession({
+  const outcome = await getCanopyApiGateway().createStripeCheckoutSession({
     checkoutAttemptId: checkoutAttemptId ?? uuidv4(),
     lines: lineItems.map((item) => ({
       variantId: item.variantId,

package/gateways/canopy-api.d.ts

@@ -89,16 +89,13 @@ export type CheckoutAddress = {
 };
 export declare function shouldIncludeInactiveProducts(): boolean;
 declare class CanopyApiGateway {
-    private apiHost;
-    private baseUrl;
-    constructor(apiHost: string);
     private static readonly REQUEST_TIMEOUT_MILLISECONDS;
-    static setup(): Promise<CanopyApiGateway>;
     private _post;
     private _get;
-    invokeLoader({ loaderKey, args, }: {
+    invokeLoader({ loaderKey, args, buyerIp, }: {
         loaderKey: string;
         args: Record<string, unknown>;
+        buyerIp: string | null;
     }): Promise<{
         data: unknown;
         meta?: {
@@ -121,10 +118,12 @@ declare class CanopyApiGateway {
         }[];
     }): Promise<ReconciledCartLine[]>;
     private _cartPost;
-    cartGet({ cartId }: {
+    cartGet({ cartId, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
     }): Promise<Cart | null>;
-    cartCreate(options?: {
+    cartCreate({ buyerIp, ...options }: {
+        buyerIp: string | null;
         lines?: {
             merchandiseId: string;
             quantity: number;
@@ -141,8 +140,9 @@ declare class CanopyApiGateway {
         }[];
         country?: StorefrontCountryCode;
     }): Promise<Cart>;
-    cartAddLines({ cartId, lines, }: {
+    cartAddLines({ cartId, lines, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         lines: {
             merchandiseId: string;
             quantity: number;
@@ -153,8 +153,9 @@ declare class CanopyApiGateway {
             sellingPlanId?: string | null;
         }[];
     }): Promise<Cart>;
-    cartUpdateLines({ cartId, lines, }: {
+    cartUpdateLines({ cartId, lines, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         lines: {
             lineId: string;
             quantity: number;
@@ -165,24 +166,29 @@ declare class CanopyApiGateway {
             sellingPlanId?: string | null;
         }[];
     }): Promise<Cart>;
-    cartRemoveLines({ cartId, lineIds, }: {
+    cartRemoveLines({ cartId, lineIds, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         lineIds: string[];
     }): Promise<Cart>;
-    cartUpdateDiscountCodes({ cartId, discountCodes, }: {
+    cartUpdateDiscountCodes({ cartId, discountCodes, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         discountCodes: string[];
     }): Promise<Cart>;
-    cartUpdateBuyerIdentity({ cartId, country, }: {
+    cartUpdateBuyerIdentity({ cartId, country, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         country: StorefrontCountryCode;
     }): Promise<Cart>;
-    cartUpdateNote({ cartId, note, }: {
+    cartUpdateNote({ cartId, note, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         note: string;
     }): Promise<Cart>;
-    cartReplaceAttributes({ cartId, attributes, }: {
+    cartReplaceAttributes({ cartId, attributes, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         attributes: {
             key: string;
             value: string;
@@ -223,5 +229,5 @@ declare class CanopyApiGateway {
         variantId: string;
     }): Promise<AddCrossSellOutcome>;
 }
-export declare function getCanopyApiGateway(): Promise<CanopyApiGateway>;
+export declare function getCanopyApiGateway(): CanopyApiGateway;
 export {};

package/gateways/canopy-api.js

@@ -92,19 +92,12 @@ const addCrossSellOutcomeSchema = z.discriminatedUnion("type", [
 function shouldIncludeInactiveProducts() {
   return Boolean(process.env.IS_REPLO_SANDBOX);
 }
+function buyerIpHeaders(buyerIp) {
+  return buyerIp ? { "x-replo-buyer-ip": buyerIp } : {};
+}
 class CanopyApiGateway {
-  apiHost;
-  baseUrl;
-  constructor(apiHost) {
-    this.apiHost = apiHost;
-    this.baseUrl = buildBaseUrl(apiHost);
-  }
   static REQUEST_TIMEOUT_MILLISECONDS = 1e4;
-  static async setup() {
-    const env = await getEnv();
-    return new CanopyApiGateway(env.CANOPY_API_HOST);
-  }
-  async _post(url, body) {
+  async _post(url, body, headers) {
     const abortController = new AbortController();
     const timeoutId = setTimeout(() => {
       abortController.abort();
@@ -112,7 +105,7 @@ class CanopyApiGateway {
     try {
       return await fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...headers },
         body: JSON.stringify(body),
         signal: abortController.signal
       });
@@ -121,7 +114,7 @@ class CanopyApiGateway {
       if (process.env.NODE_ENV !== "production") {
         message += `
 
-apiHost: ${this.apiHost}
+apiHost: ${(await getEnv()).CANOPY_API_HOST}
 If you're running locally, make sure the canopy-api cloudflare worker is running. You may need to restart the dev server.`;
       }
       throw new UnknownCanopyApiError({ message, cause: error });
@@ -141,7 +134,7 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
       if (process.env.NODE_ENV !== "production") {
         message += `
 
-apiHost: ${this.apiHost}
+apiHost: ${(await getEnv()).CANOPY_API_HOST}
 If you're running locally, make sure the canopy-api cloudflare worker is running. You may need to restart the dev server.`;
       }
       throw new UnknownCanopyApiError({ message, cause: error });
@@ -151,15 +144,20 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }
   async invokeLoader({
     loaderKey,
-    args
+    args,
+    buyerIp
   }) {
     const env = await getEnv();
-    const response = await this._post(`${this.baseUrl}/api/v1/loaders/invoke`, {
-      projectId: env.PROJECT_ID,
-      loaderKey,
-      args,
-      includeInactiveProducts: shouldIncludeInactiveProducts()
-    });
+    const response = await this._post(
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/loaders/invoke`,
+      {
+        projectId: env.PROJECT_ID,
+        loaderKey,
+        args,
+        includeInactiveProducts: shouldIncludeInactiveProducts()
+      },
+      buyerIpHeaders(buyerIp)
+    );
     if (!response.ok) {
       const errorBody = await response.text().catch(() => "");
       throw new CanopyApiGatewayError({
@@ -174,8 +172,9 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }) {
     const env = await getEnv();
     const response = await this._post(
-      `${this.baseUrl}/api/v1/product-catalog/reconcile-cart-lines`,
-      { projectId: env.PROJECT_ID, lines }
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/product-catalog/reconcile-cart-lines`,
+      { projectId: env.PROJECT_ID, lines },
+      {}
     );
     if (!response.ok) {
       const errorBody = await response.text().catch(() => "");
@@ -186,9 +185,13 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
     }
     return reconcileCartLinesResponseSchema.parse(await response.json()).lines;
   }
-  async _cartPost(path, body) {
+  async _cartPost({
+    path,
+    body,
+    buyerIp
+  }) {
     const env = await getEnv();
-    const url = `${this.baseUrl}/api/v1/cart${path}`;
+    const url = `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/cart${path}`;
     const abortController = new AbortController();
     const timeoutId = setTimeout(() => {
       abortController.abort();
@@ -198,7 +201,8 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
       response = await fetch(url, {
         method: "POST",
         headers: {
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          ...buyerIpHeaders(buyerIp)
         },
         body: JSON.stringify({ ...body, projectId: env.PROJECT_ID }),
         signal: abortController.signal
@@ -221,9 +225,12 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
     const json = await response.json();
     return cartSchema.parse(json.data);
   }
-  async cartGet({ cartId }) {
+  async cartGet({
+    cartId,
+    buyerIp
+  }) {
     try {
-      return await this._cartPost("/get", { cartId });
+      return await this._cartPost({ path: "/get", body: { cartId }, buyerIp });
     } catch (error) {
       if (error instanceof CanopyApiGatewayError && error.statusCode === 404) {
         return null;
@@ -231,55 +238,97 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
       throw error;
     }
   }
-  async cartCreate(options) {
-    return this._cartPost("/create", {
-      lines: options?.lines,
-      discountCodes: options?.discountCodes,
-      attributes: options?.attributes,
-      country: options?.country
+  async cartCreate({
+    buyerIp,
+    ...options
+  }) {
+    return this._cartPost({
+      path: "/create",
+      body: {
+        lines: options.lines,
+        discountCodes: options.discountCodes,
+        attributes: options.attributes,
+        country: options.country
+      },
+      buyerIp
     });
   }
   async cartAddLines({
     cartId,
-    lines
+    lines,
+    buyerIp
   }) {
-    return this._cartPost("/add-lines", { cartId, lines });
+    return this._cartPost({
+      path: "/add-lines",
+      body: { cartId, lines },
+      buyerIp
+    });
   }
   async cartUpdateLines({
     cartId,
-    lines
+    lines,
+    buyerIp
   }) {
-    return this._cartPost("/update-lines", { cartId, lines });
+    return this._cartPost({
+      path: "/update-lines",
+      body: { cartId, lines },
+      buyerIp
+    });
   }
   async cartRemoveLines({
     cartId,
-    lineIds
+    lineIds,
+    buyerIp
   }) {
-    return this._cartPost("/remove-lines", { cartId, lineIds });
+    return this._cartPost({
+      path: "/remove-lines",
+      body: { cartId, lineIds },
+      buyerIp
+    });
   }
   async cartUpdateDiscountCodes({
     cartId,
-    discountCodes
+    discountCodes,
+    buyerIp
   }) {
-    return this._cartPost("/update-discount-codes", { cartId, discountCodes });
+    return this._cartPost({
+      path: "/update-discount-codes",
+      body: { cartId, discountCodes },
+      buyerIp
+    });
   }
   async cartUpdateBuyerIdentity({
     cartId,
-    country
+    country,
+    buyerIp
   }) {
-    return this._cartPost("/update-buyer-identity", { cartId, country });
+    return this._cartPost({
+      path: "/update-buyer-identity",
+      body: { cartId, country },
+      buyerIp
+    });
   }
   async cartUpdateNote({
     cartId,
-    note
+    note,
+    buyerIp
   }) {
-    return this._cartPost("/update-note", { cartId, note });
+    return this._cartPost({
+      path: "/update-note",
+      body: { cartId, note },
+      buyerIp
+    });
   }
   async cartReplaceAttributes({
     cartId,
-    attributes
+    attributes,
+    buyerIp
   }) {
-    return this._cartPost("/replace-attributes", { cartId, attributes });
+    return this._cartPost({
+      path: "/replace-attributes",
+      body: { cartId, attributes },
+      buyerIp
+    });
   }
   async _stripeCheckoutPost({
     path,
@@ -288,8 +337,9 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }) {
     const env = await getEnv();
     const response = await this._post(
-      `${this.baseUrl}/api/v1/stripe-checkout/${path}`,
-      { projectId: env.PROJECT_ID, ...body }
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/stripe-checkout/${path}`,
+      { projectId: env.PROJECT_ID, ...body },
+      {}
     );
     if (!response.ok) {
       throw new CanopyApiGatewayError({
@@ -308,7 +358,7 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }) {
     const env = await getEnv();
     const response = await this._post(
-      `${this.baseUrl}/api/v1/stripe-checkout/create-session`,
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/stripe-checkout/create-session`,
       {
         cartId: checkoutAttemptId,
         checkoutAttemptId,
@@ -317,7 +367,8 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
         successUrl,
         cancelUrl,
         ...uiMode === "form" ? { uiMode } : {}
-      }
+      },
+      {}
     );
     if (!response.ok) {
       const restart = response.status === 409 ? restartCheckoutSchema.safeParse(await response.json()) : null;
@@ -362,8 +413,8 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
     });
   }
 }
-async function getCanopyApiGateway() {
-  return CanopyApiGateway.setup();
+function getCanopyApiGateway() {
+  return new CanopyApiGateway();
 }
 export {
   CanopyApiGatewayError,

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "2.18.2",
+  "version": "2.18.3",
   "branch": "HEAD",
-  "commit": "b67d568983a09c8048085ad6e81a8d5a8195658e",
-  "builtAt": "2026-11-03T21:12:47.031Z"
+  "commit": "00c3d9662c0d5daa0cfd0ef03bb3b182e0cc0652",
+  "builtAt": "2026-11-03T23:49:23.685Z"
 };

package/lib/buyer-ip.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The shopper's IP, for canopy to pass to Shopify so it throttles and
+ * bot-checks each shopper separately; canopy only sees this site's server.
+ * Server actions only: it reads the incoming request.
+ */
+export declare function readBuyerIp(): Promise<string | null>;

package/lib/buyer-ip.js

@@ -0,0 +1,7 @@
+import { headers } from "next/headers";
+async function readBuyerIp() {
+  return (await headers()).get("cf-connecting-ip");
+}
+export {
+  readBuyerIp
+};

package/loaders/invoke-loader-action.js

@@ -1,10 +1,15 @@
 "use server";
+import { readBuyerIp } from "../lib/buyer-ip";
 import { fetchValidatedLoaderOutput } from "./loader-output";
 async function invokeLoaderAction({
   loaderKey,
   args
 }) {
-  return fetchValidatedLoaderOutput({ loaderKey, args });
+  return fetchValidatedLoaderOutput({
+    loaderKey,
+    args,
+    buyerIp: await readBuyerIp()
+  });
 }
 export {
   invokeLoaderAction

package/loaders/invoke-loader-server.js

@@ -49,7 +49,11 @@ async function invokeLoaderServer({
       try {
         return {
           kind: "data",
-          data: await fetchValidatedLoaderOutput({ loaderKey, args })
+          data: await fetchValidatedLoaderOutput({
+            loaderKey,
+            args,
+            buyerIp: null
+          })
         };
       } catch (error) {
         if (error instanceof LoaderOutputError) {

package/loaders/invoke-loader.js

@@ -13,7 +13,11 @@ async function invokeUntypedLoader({
   try {
     if (process.env.NEXT_RUNTIME) {
       const { fetchValidatedLoaderOutput } = await import("./loader-output");
-      return await fetchValidatedLoaderOutput({ loaderKey, args });
+      return await fetchValidatedLoaderOutput({
+        loaderKey,
+        args,
+        buyerIp: null
+      });
     }
     const { invokeLoaderAction } = await import("./invoke-loader-action");
     return await invokeLoaderAction({ loaderKey, args });

package/loaders/loader-output.d.ts

@@ -25,7 +25,8 @@ export declare class LoaderOutputError extends CanopyError {
  * before any request, since JSON would drop them and canopy-api would reject
  * the rest. The log matters because `PrefetchedLoaders` swallows rejections.
  */
-export declare function fetchValidatedLoaderOutput({ loaderKey, args, }: {
+export declare function fetchValidatedLoaderOutput({ loaderKey, args, buyerIp, }: {
     loaderKey: string;
     args: Record<string, unknown>;
+    buyerIp: string | null;
 }): Promise<unknown>;

package/loaders/loader-output.js

@@ -92,15 +92,19 @@ class LoaderOutputError extends CanopyError {
 }
 async function fetchValidatedLoaderOutput({
   loaderKey,
-  args
+  args,
+  buyerIp
 }) {
   const argsError = getLoaderArgsError({ loaderKey, args });
   if (argsError !== null) {
     console.error(argsError.message);
     throw argsError;
   }
-  const gateway = await getCanopyApiGateway();
-  const { data } = await gateway.invokeLoader({ loaderKey, args });
+  const { data } = await getCanopyApiGateway().invokeLoader({
+    loaderKey,
+    args,
+    buyerIp
+  });
   const knownKey = dataLoaderKeySchema.safeParse(loaderKey);
   if (!knownKey.success) {
     return data;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "2.18.2",
+  "version": "2.18.3",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "2.18.2",
+    "version": "2.18.3",
     "branch": "HEAD",
-    "commit": "b67d568983a09c8048085ad6e81a8d5a8195658e",
-    "builtAt": "2026-11-03T21:12:47.031Z"
+    "commit": "00c3d9662c0d5daa0cfd0ef03bb3b182e0cc0652",
+    "builtAt": "2026-11-03T23:49:23.685Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",