@replohq/sdk 2.18.2 → 2.19.0

package/consent/usercentrics-consent.js

@@ -0,0 +1,96 @@
+import * as v from "valibot";
+const usercentricsDetailsSchema = v.object({
+  consent: v.optional(v.object({ type: v.optional(v.string()) })),
+  services: v.record(
+    v.string(),
+    v.object({
+      name: v.string(),
+      essential: v.optional(v.boolean()),
+      consent: v.object({ given: v.boolean() })
+    })
+  )
+});
+const usercentricsBaseInfoSchema = v.array(
+  v.object({
+    name: v.string(),
+    isEssential: v.optional(v.boolean()),
+    consent: v.object({
+      status: v.boolean(),
+      history: v.optional(v.array(v.object({ type: v.optional(v.string()) })))
+    })
+  })
+);
+function usercentricsCategories(services) {
+  const optionalServices = services.filter((service) => !service.essential);
+  const acceptedAll = optionalServices.length > 0 && optionalServices.every((service) => service.given);
+  return {
+    necessary: true,
+    analytics: acceptedAll,
+    marketing: acceptedAll,
+    preferences: acceptedAll,
+    sale_of_data: acceptedAll
+  };
+}
+async function readUsercentricsServices() {
+  if (window.__ucCmp?.getConsentDetails) {
+    const details = v.safeParse(
+      usercentricsDetailsSchema,
+      await window.__ucCmp.getConsentDetails()
+    );
+    if (!details.success) {
+      console.warn("[Replo] Unreadable Usercentrics consent details");
+      return null;
+    }
+    return {
+      services: Object.values(details.output.services).map((service) => ({
+        name: service.name,
+        given: service.consent.given,
+        essential: service.essential === true
+      })),
+      isExplicit: details.output.consent?.type === "EXPLICIT"
+    };
+  }
+  const rawBaseInfo = window.UC_UI?.getServicesBaseInfo?.();
+  if (rawBaseInfo === void 0) {
+    return null;
+  }
+  const baseInfo = v.safeParse(usercentricsBaseInfoSchema, rawBaseInfo);
+  if (!baseInfo.success) {
+    console.warn("[Replo] Unreadable Usercentrics service info");
+    return null;
+  }
+  return {
+    services: baseInfo.output.map((service) => ({
+      name: service.name,
+      given: service.consent.status,
+      essential: service.isEssential === true
+    })),
+    isExplicit: baseInfo.output.some((service) => {
+      return service.consent.history?.at(-1)?.type === "explicit";
+    })
+  };
+}
+async function readUsercentricsChange(previous) {
+  const answer = await readUsercentricsServices();
+  if (!answer) {
+    return null;
+  }
+  const categories = usercentricsCategories(answer.services);
+  const grantedUsercentricsServices = answer.services.filter((service) => service.given).map((service) => service.name).sort();
+  const isUnchanged = categories.analytics === previous.categories.analytics && grantedUsercentricsServices.join() === previous.grantedUsercentricsServices.join();
+  const isDecided = answer.isExplicit || answer.services.some((service) => service.given && !service.essential);
+  if (isUnchanged && (previous.decidedAt !== null || !isDecided)) {
+    return null;
+  }
+  return {
+    categories,
+    decidedAt: isDecided ? Date.now() : null,
+    grantedUsercentricsServices,
+    hasDowngrade: previous.grantedUsercentricsServices.some((name) => {
+      return !grantedUsercentricsServices.includes(name);
+    })
+  };
+}
+export {
+  readUsercentricsChange
+};

package/consent/window-api.js

@@ -30,7 +30,7 @@ const api = {
   saleOfDataAllowed: () => isAllowed("sale_of_data"),
   shouldShowBanner: () => {
     const state = consentStore.getSnapshot();
-    if (state.cmp === "cookiebot" || state.cmp === "external") {
+    if (state.cmp && state.cmp !== "replo") {
       return false;
     }
     return state.mode !== "off" && state.decidedAt === null;

package/gateways/canopy-api.d.ts

@@ -89,16 +89,13 @@ export type CheckoutAddress = {
 };
 export declare function shouldIncludeInactiveProducts(): boolean;
 declare class CanopyApiGateway {
-    private apiHost;
-    private baseUrl;
-    constructor(apiHost: string);
     private static readonly REQUEST_TIMEOUT_MILLISECONDS;
-    static setup(): Promise<CanopyApiGateway>;
     private _post;
     private _get;
-    invokeLoader({ loaderKey, args, }: {
+    invokeLoader({ loaderKey, args, buyerIp, }: {
         loaderKey: string;
         args: Record<string, unknown>;
+        buyerIp: string | null;
     }): Promise<{
         data: unknown;
         meta?: {
@@ -121,10 +118,12 @@ declare class CanopyApiGateway {
         }[];
     }): Promise<ReconciledCartLine[]>;
     private _cartPost;
-    cartGet({ cartId }: {
+    cartGet({ cartId, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
     }): Promise<Cart | null>;
-    cartCreate(options?: {
+    cartCreate({ buyerIp, ...options }: {
+        buyerIp: string | null;
         lines?: {
             merchandiseId: string;
             quantity: number;
@@ -141,8 +140,9 @@ declare class CanopyApiGateway {
         }[];
         country?: StorefrontCountryCode;
     }): Promise<Cart>;
-    cartAddLines({ cartId, lines, }: {
+    cartAddLines({ cartId, lines, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         lines: {
             merchandiseId: string;
             quantity: number;
@@ -153,8 +153,9 @@ declare class CanopyApiGateway {
             sellingPlanId?: string | null;
         }[];
     }): Promise<Cart>;
-    cartUpdateLines({ cartId, lines, }: {
+    cartUpdateLines({ cartId, lines, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         lines: {
             lineId: string;
             quantity: number;
@@ -165,24 +166,29 @@ declare class CanopyApiGateway {
             sellingPlanId?: string | null;
         }[];
     }): Promise<Cart>;
-    cartRemoveLines({ cartId, lineIds, }: {
+    cartRemoveLines({ cartId, lineIds, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         lineIds: string[];
     }): Promise<Cart>;
-    cartUpdateDiscountCodes({ cartId, discountCodes, }: {
+    cartUpdateDiscountCodes({ cartId, discountCodes, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         discountCodes: string[];
     }): Promise<Cart>;
-    cartUpdateBuyerIdentity({ cartId, country, }: {
+    cartUpdateBuyerIdentity({ cartId, country, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         country: StorefrontCountryCode;
     }): Promise<Cart>;
-    cartUpdateNote({ cartId, note, }: {
+    cartUpdateNote({ cartId, note, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         note: string;
     }): Promise<Cart>;
-    cartReplaceAttributes({ cartId, attributes, }: {
+    cartReplaceAttributes({ cartId, attributes, buyerIp, }: {
         cartId: string;
+        buyerIp: string | null;
         attributes: {
             key: string;
             value: string;
@@ -223,5 +229,5 @@ declare class CanopyApiGateway {
         variantId: string;
     }): Promise<AddCrossSellOutcome>;
 }
-export declare function getCanopyApiGateway(): Promise<CanopyApiGateway>;
+export declare function getCanopyApiGateway(): CanopyApiGateway;
 export {};

package/gateways/canopy-api.js

@@ -92,19 +92,12 @@ const addCrossSellOutcomeSchema = z.discriminatedUnion("type", [
 function shouldIncludeInactiveProducts() {
   return Boolean(process.env.IS_REPLO_SANDBOX);
 }
+function buyerIpHeaders(buyerIp) {
+  return buyerIp ? { "x-replo-buyer-ip": buyerIp } : {};
+}
 class CanopyApiGateway {
-  apiHost;
-  baseUrl;
-  constructor(apiHost) {
-    this.apiHost = apiHost;
-    this.baseUrl = buildBaseUrl(apiHost);
-  }
   static REQUEST_TIMEOUT_MILLISECONDS = 1e4;
-  static async setup() {
-    const env = await getEnv();
-    return new CanopyApiGateway(env.CANOPY_API_HOST);
-  }
-  async _post(url, body) {
+  async _post(url, body, headers) {
     const abortController = new AbortController();
     const timeoutId = setTimeout(() => {
       abortController.abort();
@@ -112,7 +105,7 @@ class CanopyApiGateway {
     try {
       return await fetch(url, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: { "Content-Type": "application/json", ...headers },
         body: JSON.stringify(body),
         signal: abortController.signal
       });
@@ -121,7 +114,7 @@ class CanopyApiGateway {
       if (process.env.NODE_ENV !== "production") {
         message += `
 
-apiHost: ${this.apiHost}
+apiHost: ${(await getEnv()).CANOPY_API_HOST}
 If you're running locally, make sure the canopy-api cloudflare worker is running. You may need to restart the dev server.`;
       }
       throw new UnknownCanopyApiError({ message, cause: error });
@@ -141,7 +134,7 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
       if (process.env.NODE_ENV !== "production") {
         message += `
 
-apiHost: ${this.apiHost}
+apiHost: ${(await getEnv()).CANOPY_API_HOST}
 If you're running locally, make sure the canopy-api cloudflare worker is running. You may need to restart the dev server.`;
       }
       throw new UnknownCanopyApiError({ message, cause: error });
@@ -151,15 +144,20 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }
   async invokeLoader({
     loaderKey,
-    args
+    args,
+    buyerIp
   }) {
     const env = await getEnv();
-    const response = await this._post(`${this.baseUrl}/api/v1/loaders/invoke`, {
-      projectId: env.PROJECT_ID,
-      loaderKey,
-      args,
-      includeInactiveProducts: shouldIncludeInactiveProducts()
-    });
+    const response = await this._post(
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/loaders/invoke`,
+      {
+        projectId: env.PROJECT_ID,
+        loaderKey,
+        args,
+        includeInactiveProducts: shouldIncludeInactiveProducts()
+      },
+      buyerIpHeaders(buyerIp)
+    );
     if (!response.ok) {
       const errorBody = await response.text().catch(() => "");
       throw new CanopyApiGatewayError({
@@ -174,8 +172,9 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }) {
     const env = await getEnv();
     const response = await this._post(
-      `${this.baseUrl}/api/v1/product-catalog/reconcile-cart-lines`,
-      { projectId: env.PROJECT_ID, lines }
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/product-catalog/reconcile-cart-lines`,
+      { projectId: env.PROJECT_ID, lines },
+      {}
     );
     if (!response.ok) {
       const errorBody = await response.text().catch(() => "");
@@ -186,9 +185,13 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
     }
     return reconcileCartLinesResponseSchema.parse(await response.json()).lines;
   }
-  async _cartPost(path, body) {
+  async _cartPost({
+    path,
+    body,
+    buyerIp
+  }) {
     const env = await getEnv();
-    const url = `${this.baseUrl}/api/v1/cart${path}`;
+    const url = `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/cart${path}`;
     const abortController = new AbortController();
     const timeoutId = setTimeout(() => {
       abortController.abort();
@@ -198,7 +201,8 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
       response = await fetch(url, {
         method: "POST",
         headers: {
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          ...buyerIpHeaders(buyerIp)
         },
         body: JSON.stringify({ ...body, projectId: env.PROJECT_ID }),
         signal: abortController.signal
@@ -221,9 +225,12 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
     const json = await response.json();
     return cartSchema.parse(json.data);
   }
-  async cartGet({ cartId }) {
+  async cartGet({
+    cartId,
+    buyerIp
+  }) {
     try {
-      return await this._cartPost("/get", { cartId });
+      return await this._cartPost({ path: "/get", body: { cartId }, buyerIp });
     } catch (error) {
       if (error instanceof CanopyApiGatewayError && error.statusCode === 404) {
         return null;
@@ -231,55 +238,97 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
       throw error;
     }
   }
-  async cartCreate(options) {
-    return this._cartPost("/create", {
-      lines: options?.lines,
-      discountCodes: options?.discountCodes,
-      attributes: options?.attributes,
-      country: options?.country
+  async cartCreate({
+    buyerIp,
+    ...options
+  }) {
+    return this._cartPost({
+      path: "/create",
+      body: {
+        lines: options.lines,
+        discountCodes: options.discountCodes,
+        attributes: options.attributes,
+        country: options.country
+      },
+      buyerIp
     });
   }
   async cartAddLines({
     cartId,
-    lines
+    lines,
+    buyerIp
   }) {
-    return this._cartPost("/add-lines", { cartId, lines });
+    return this._cartPost({
+      path: "/add-lines",
+      body: { cartId, lines },
+      buyerIp
+    });
   }
   async cartUpdateLines({
     cartId,
-    lines
+    lines,
+    buyerIp
   }) {
-    return this._cartPost("/update-lines", { cartId, lines });
+    return this._cartPost({
+      path: "/update-lines",
+      body: { cartId, lines },
+      buyerIp
+    });
   }
   async cartRemoveLines({
     cartId,
-    lineIds
+    lineIds,
+    buyerIp
   }) {
-    return this._cartPost("/remove-lines", { cartId, lineIds });
+    return this._cartPost({
+      path: "/remove-lines",
+      body: { cartId, lineIds },
+      buyerIp
+    });
   }
   async cartUpdateDiscountCodes({
     cartId,
-    discountCodes
+    discountCodes,
+    buyerIp
   }) {
-    return this._cartPost("/update-discount-codes", { cartId, discountCodes });
+    return this._cartPost({
+      path: "/update-discount-codes",
+      body: { cartId, discountCodes },
+      buyerIp
+    });
   }
   async cartUpdateBuyerIdentity({
     cartId,
-    country
+    country,
+    buyerIp
   }) {
-    return this._cartPost("/update-buyer-identity", { cartId, country });
+    return this._cartPost({
+      path: "/update-buyer-identity",
+      body: { cartId, country },
+      buyerIp
+    });
   }
   async cartUpdateNote({
     cartId,
-    note
+    note,
+    buyerIp
   }) {
-    return this._cartPost("/update-note", { cartId, note });
+    return this._cartPost({
+      path: "/update-note",
+      body: { cartId, note },
+      buyerIp
+    });
   }
   async cartReplaceAttributes({
     cartId,
-    attributes
+    attributes,
+    buyerIp
   }) {
-    return this._cartPost("/replace-attributes", { cartId, attributes });
+    return this._cartPost({
+      path: "/replace-attributes",
+      body: { cartId, attributes },
+      buyerIp
+    });
   }
   async _stripeCheckoutPost({
     path,
@@ -288,8 +337,9 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }) {
     const env = await getEnv();
     const response = await this._post(
-      `${this.baseUrl}/api/v1/stripe-checkout/${path}`,
-      { projectId: env.PROJECT_ID, ...body }
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/stripe-checkout/${path}`,
+      { projectId: env.PROJECT_ID, ...body },
+      {}
     );
     if (!response.ok) {
       throw new CanopyApiGatewayError({
@@ -308,7 +358,7 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
   }) {
     const env = await getEnv();
     const response = await this._post(
-      `${this.baseUrl}/api/v1/stripe-checkout/create-session`,
+      `${buildBaseUrl(env.CANOPY_API_HOST)}/api/v1/stripe-checkout/create-session`,
       {
         cartId: checkoutAttemptId,
         checkoutAttemptId,
@@ -317,7 +367,8 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
         successUrl,
         cancelUrl,
         ...uiMode === "form" ? { uiMode } : {}
-      }
+      },
+      {}
     );
     if (!response.ok) {
       const restart = response.status === 409 ? restartCheckoutSchema.safeParse(await response.json()) : null;
@@ -362,8 +413,8 @@ If you're running locally, make sure the canopy-api cloudflare worker is running
     });
   }
 }
-async function getCanopyApiGateway() {
-  return CanopyApiGateway.setup();
+function getCanopyApiGateway() {
+  return new CanopyApiGateway();
 }
 export {
   CanopyApiGatewayError,

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "2.18.2",
+  "version": "2.19.0",
   "branch": "HEAD",
-  "commit": "b67d568983a09c8048085ad6e81a8d5a8195658e",
-  "builtAt": "2026-11-03T21:12:47.031Z"
+  "commit": "377fd6358bd4e3d0d32ff03942701a9cede4e0e9",
+  "builtAt": "2026-11-06T19:28:13.532Z"
 };

package/lib/buyer-ip.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The shopper's IP, for canopy to pass to Shopify so it throttles and
+ * bot-checks each shopper separately; canopy only sees this site's server.
+ * Server actions only: it reads the incoming request.
+ */
+export declare function readBuyerIp(): Promise<string | null>;

package/lib/buyer-ip.js

@@ -0,0 +1,7 @@
+import { headers } from "next/headers";
+async function readBuyerIp() {
+  return (await headers()).get("cf-connecting-ip");
+}
+export {
+  readBuyerIp
+};

package/loaders/invoke-loader-action.js

@@ -1,10 +1,15 @@
 "use server";
+import { readBuyerIp } from "../lib/buyer-ip";
 import { fetchValidatedLoaderOutput } from "./loader-output";
 async function invokeLoaderAction({
   loaderKey,
   args
 }) {
-  return fetchValidatedLoaderOutput({ loaderKey, args });
+  return fetchValidatedLoaderOutput({
+    loaderKey,
+    args,
+    buyerIp: await readBuyerIp()
+  });
 }
 export {
   invokeLoaderAction

package/loaders/invoke-loader-server.js

@@ -49,7 +49,11 @@ async function invokeLoaderServer({
       try {
         return {
           kind: "data",
-          data: await fetchValidatedLoaderOutput({ loaderKey, args })
+          data: await fetchValidatedLoaderOutput({
+            loaderKey,
+            args,
+            buyerIp: null
+          })
         };
       } catch (error) {
         if (error instanceof LoaderOutputError) {

package/loaders/invoke-loader.js

@@ -13,7 +13,11 @@ async function invokeUntypedLoader({
   try {
     if (process.env.NEXT_RUNTIME) {
       const { fetchValidatedLoaderOutput } = await import("./loader-output");
-      return await fetchValidatedLoaderOutput({ loaderKey, args });
+      return await fetchValidatedLoaderOutput({
+        loaderKey,
+        args,
+        buyerIp: null
+      });
     }
     const { invokeLoaderAction } = await import("./invoke-loader-action");
     return await invokeLoaderAction({ loaderKey, args });

package/loaders/loader-output.d.ts

@@ -25,7 +25,8 @@ export declare class LoaderOutputError extends CanopyError {
  * before any request, since JSON would drop them and canopy-api would reject
  * the rest. The log matters because `PrefetchedLoaders` swallows rejections.
  */
-export declare function fetchValidatedLoaderOutput({ loaderKey, args, }: {
+export declare function fetchValidatedLoaderOutput({ loaderKey, args, buyerIp, }: {
     loaderKey: string;
     args: Record<string, unknown>;
+    buyerIp: string | null;
 }): Promise<unknown>;

package/loaders/loader-output.js

@@ -92,15 +92,19 @@ class LoaderOutputError extends CanopyError {
 }
 async function fetchValidatedLoaderOutput({
   loaderKey,
-  args
+  args,
+  buyerIp
 }) {
   const argsError = getLoaderArgsError({ loaderKey, args });
   if (argsError !== null) {
     console.error(argsError.message);
     throw argsError;
   }
-  const gateway = await getCanopyApiGateway();
-  const { data } = await gateway.invokeLoader({ loaderKey, args });
+  const { data } = await getCanopyApiGateway().invokeLoader({
+    loaderKey,
+    args,
+    buyerIp
+  });
   const knownKey = dataLoaderKeySchema.safeParse(loaderKey);
   if (!knownKey.success) {
     return data;

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "2.18.2",
+  "version": "2.19.0",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "2.18.2",
+    "version": "2.19.0",
     "branch": "HEAD",
-    "commit": "b67d568983a09c8048085ad6e81a8d5a8195658e",
-    "builtAt": "2026-11-03T21:12:47.031Z"
+    "commit": "377fd6358bd4e3d0d32ff03942701a9cede4e0e9",
+    "builtAt": "2026-11-06T19:28:13.532Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",