@replohq/sdk 2.18.3 → 2.19.0

package/_vendor/replo-utils/lib/crypto.d.ts

@@ -22,4 +22,9 @@ export declare function getHmacSha256Hex({ rawBody, signingKey, }: {
     rawBody: string;
     signingKey: string;
 }): Promise<string>;
+export declare function isValidHmacSha256Hex({ rawBody, signingKey, signature, }: {
+    rawBody: string;
+    signingKey: string;
+    signature: string;
+}): Promise<boolean>;
 export declare function deterministicUUID(value: string): string;

package/_vendor/schemas/generated/consent.d.ts

@@ -1,4 +1,4 @@
-export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "X" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "Mixpanel" | "HubSpot" | "Attentive" | "Alia" | "Cookiebot" | "snippet" | "custom" | "consentPlatform";
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "X" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "Mixpanel" | "HubSpot" | "Attentive" | "Alia" | "Cookiebot" | "Usercentrics" | "snippet" | "custom" | "consentPlatform";
 export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
 export type ConsentMode = "off" | "simple" | "per-category";
 export type ScriptTagDescriptor = {
@@ -30,37 +30,49 @@ export type ReploScriptEntry = {
     type: "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot" | "Attentive" | "Alia";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "GA4";
     identifier: string;
     requiredConsent?: ConsentCategory[];
     runtimeOwner?: ScriptRuntimeOwner;
+    usercentricsService?: string;
 } | {
     type: "X";
     identifier: string;
     events?: Partial<XPixelEvents>;
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "Mixpanel";
     identifier: string;
     region?: MixpanelRegion;
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "Cookiebot";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+} | {
+    type: "Usercentrics";
+    identifier: string;
+    loaderVersion?: "v2" | "v3";
+    runtimeOwner?: ScriptRuntimeOwner;
+    reploUsercentricsService?: string;
 } | {
     type: "snippet";
     id: string;
     body: string;
     module?: boolean;
     requiredConsent: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "custom";
     id: string;
     requiredConsent: ConsentCategory[];
     src?: string;
     body?: string;
+    usercentricsService?: string;
 } | {
     type: "consentPlatform";
     id: string;

package/analytics/analytics-provider.js

@@ -37,7 +37,8 @@ function AnalyticsProvider({
           cmp: consent.cmp,
           mode: consent.mode,
           categories: consent.categories,
-          decidedAt: consent.decidedAt
+          decidedAt: consent.decidedAt,
+          grantedUsercentricsServices: consent.grantedUsercentricsServices
         },
         registeredScripts,
         checkoutProvider
@@ -49,6 +50,7 @@ function AnalyticsProvider({
     consent.mode,
     consent.categories,
     consent.decidedAt,
+    consent.grantedUsercentricsServices,
     registeredScripts,
     checkoutProvider,
     additionalSinks

package/analytics/get-analytics-sinks.js

@@ -1,3 +1,4 @@
+import { findDelegatedPlatform } from "../consent/consent-platform";
 import { isConsentAllowed } from "../consent/consent-store";
 import { snippetScriptId } from "../consent/script-registration-store";
 import { ConvergeSink } from "./sinks/converge-sink";
@@ -51,11 +52,12 @@ function getAnalyticsSinks({
   checkoutProvider
 }) {
   const sinks = [new WindowSink()];
-  const firstPartyAllowed = isConsentAllowed({
+  const isReploPixelAllowed = isConsentAllowed({
     state: consent,
-    requiredConsent: ["analytics"]
+    requiredConsent: ["analytics"],
+    usercentricsService: findDelegatedPlatform()?.reploUsercentricsService ?? null
   });
-  if (firstPartyAllowed) {
+  if (isReploPixelAllowed) {
     sinks.push(new ReploSink());
   }
   const shopifyOwnsCheckout = checkoutProvider === "shopify";
@@ -68,7 +70,8 @@ function getAnalyticsSinks({
     }
     if (isConsentAllowed({
       state: consent,
-      requiredConsent: script.requiredConsent
+      requiredConsent: script.requiredConsent,
+      usercentricsService: script.usercentricsService
     })) {
       const sink = factory();
       const gated = shopifyOwnsCheckout && !SHOPIFY_FUNNEL_GATE_EXEMPT_PROVIDERS.has(script.type);

package/analytics/replo-pixel-script.d.ts

@@ -4,11 +4,11 @@
  * events into, so gating it on `analytics` consent keeps the first-party sink
  * consent-correct without the pixel loading unconditionally in `<head>` the way
  * the legacy scaffold does. `analytics` consent here matches the
- * `firstPartyAllowed` gate that controls whether `ReploSink` is created at all.
+ * `isReploPixelAllowed` gate that controls whether `ReploSink` is created at all.
  *
- * Under a consent platform the tag is rendered regardless and `InjectedScript`
- * stamps the blocking attributes at mount time, since delegation is not yet
- * set here.
+ * Under a consent platform the tag is injected regardless, with its blocking
+ * attributes read in the effect because this renders before `ReploScripts`
+ * publishes the platform.
  */
 export declare function ReploPixelScript({ pixelUrl, apiUrl, projectId, siteVersion, }: {
     pixelUrl: string;
@@ -16,4 +16,4 @@ export declare function ReploPixelScript({ pixelUrl, apiUrl, projectId, siteVers
     projectId: string;
     /** Publish id of the running site; absent on unpublished or older deploys. */
     siteVersion?: string;
-}): import("react/jsx-runtime").JSX.Element | null;
+}): null;

package/analytics/replo-pixel-script.js

@@ -1,6 +1,7 @@
 "use client";
-import { jsx } from "react/jsx-runtime";
-import { InjectedScript } from "../consent/replo-scripts";
+import { useEffect } from "react";
+import { findDelegatedPlatform } from "../consent/consent-platform";
+import { injectGatedScript } from "../consent/inject-script-descriptors";
 import { useIsBlockedByNativeConsent } from "../consent/use-is-blocked-by-native-consent";
 const PIXEL_SCRIPT_ID = "replo:first-party-pixel";
 const PIXEL_REQUIRED_CONSENT = ["analytics"];
@@ -13,28 +14,28 @@ function ReploPixelScript({
   const isBlockedByNativeConsent = useIsBlockedByNativeConsent(
     PIXEL_REQUIRED_CONSENT
   );
-  if (isBlockedByNativeConsent) {
-    return null;
-  }
-  const descriptors = [
-    {
-      kind: "external",
-      src: `${pixelUrl}/latest.js`,
-      attributes: {
-        "data-api-url": apiUrl,
-        "data-project-id": projectId,
-        ...siteVersion ? { "data-site-version": siteVersion } : {}
-      }
+  useEffect(() => {
+    if (isBlockedByNativeConsent) {
+      return;
     }
-  ];
-  return /* @__PURE__ */ jsx(
-    InjectedScript,
-    {
+    injectGatedScript({
       baseId: PIXEL_SCRIPT_ID,
-      descriptors,
-      requiredConsent: PIXEL_REQUIRED_CONSENT
-    }
-  );
+      descriptors: [
+        {
+          kind: "external",
+          src: `${pixelUrl}/latest.js`,
+          attributes: {
+            "data-api-url": apiUrl,
+            "data-project-id": projectId,
+            ...siteVersion ? { "data-site-version": siteVersion } : {}
+          }
+        }
+      ],
+      requiredConsent: PIXEL_REQUIRED_CONSENT,
+      usercentricsService: findDelegatedPlatform()?.reploUsercentricsService ?? null
+    });
+  }, [isBlockedByNativeConsent, pixelUrl, apiUrl, projectId, siteVersion]);
+  return null;
 }
 export {
   ReploPixelScript

package/consent/consent-platform.d.ts

@@ -7,15 +7,21 @@ export interface ConsentPlatformConfig {
         name: string;
         values: Partial<Record<ConsentCategory, string>>;
     };
-    /** Cookiebot preset only: enables consent read-back and runScripts re-scan. */
-    isCookiebot: boolean;
+    /** Presets read the visitor's answer back; a generic platform only reports grants. */
+    kind: "cookiebot" | "usercentrics" | "generic";
+    /** Usercentrics only: the service that releases Replo's own pixel, or null until one is chosen. */
+    reploUsercentricsService: string | null;
+    /** The GTM container that loads this platform, which therefore can't wait for it. */
+    loaderContainerId: string | null;
 }
 /** Whether this entry connects a consent platform (vs a tracker it would gate). */
-export declare function isConsentPlatformEntry(entry: ReploScriptEntry): boolean;
+export declare function isConsentPlatformEntry(entry: ReploScriptEntry): entry is Extract<ReploScriptEntry, {
+    type: "Cookiebot" | "Usercentrics" | "consentPlatform";
+}>;
 /** The connected platform's config, or null when Replo's banner owns consent. */
 export declare function findConsentPlatform(scripts: ReploScriptEntry[]): ConsentPlatformConfig | null;
 /** Blocks a gated script; `text/plain` is unconditional so an unmapped category fails closed. */
-export declare function getBlockingAttributes(config: ConsentPlatformConfig, requiredConsent: ConsentCategory[]): Record<string, string>;
+export declare function getBlockingAttributes(config: ConsentPlatformConfig, requiredConsent: ConsentCategory[], usercentricsService: string | null): Record<string, string>;
 /** The bits of Cookiebot's `window.Cookiebot` global we read. */
 interface CookiebotGlobal {
     consent?: Partial<Record<CookiebotCategory, boolean>>;
@@ -26,6 +32,14 @@ type CookiebotCategory = "necessary" | "preferences" | "statistics" | "marketing
 declare global {
     interface Window {
         Cookiebot?: CookiebotGlobal;
+        __ucCmp?: {
+            getConsentDetails?: () => Promise<unknown>;
+            refreshScripts?: () => Promise<unknown>;
+        };
+        UC_UI?: {
+            getServicesBaseInfo?: () => unknown;
+            enableScriptsForServicesWithConsent?: () => unknown;
+        };
     }
 }
 type OptionalConsentCategory = Exclude<ConsentCategory, "necessary">;
@@ -36,12 +50,13 @@ export declare function findDelegatedPlatform(): ConsentPlatformConfig | null;
 export declare function getDelegatedConsent(): {
     categories: ConsentCategories;
     decidedAt: number | null;
+    grantedUsercentricsServices?: string[];
 };
 /** Inline marker a generic CMP executes when it releases one consent category. */
 export declare function buildGrantMarker(category: OptionalConsentCategory): ScriptTagDescriptor;
 /** Latches the platform as the consent backend; un-delegating would need a reload, as native revocation already does. */
 export declare function enableConsentDelegation(config: ConsentPlatformConfig): void;
-/** Cookiebot-only re-scan; other platforms rely on the loader injecting after every tag. */
+/** Re-scan for late tags; a generic platform relies on the loader injecting after every tag. */
 export declare function activateBlockedScripts(): void;
 /** Subscribe to delegated-consent changes. Returns an unsubscribe function. */
 export declare function subscribeToConsentDelegation(listener: () => void): () => void;

package/consent/consent-platform.js

@@ -23,17 +23,45 @@ function cookiebotPreset(identifier) {
       name: "data-cookieconsent",
       values: COOKIEBOT_CATEGORY_BY_CONSENT
     },
-    isCookiebot: true
+    kind: "cookiebot",
+    reploUsercentricsService: null,
+    loaderContainerId: null
+  };
+}
+const USERCENTRICS_LOADER_URL = {
+  v2: "https://app.usercentrics.eu/browser-ui/latest/loader.js",
+  v3: "https://web.cmp.usercentrics.eu/ui/loader.js"
+};
+function usercentricsPreset(entry) {
+  return {
+    id: "usercentrics",
+    loader: entry.runtimeOwner ? [] : [
+      {
+        kind: "external",
+        src: USERCENTRICS_LOADER_URL[entry.loaderVersion ?? "v3"],
+        attributes: {
+          id: "usercentrics-cmp",
+          "data-settings-id": entry.identifier
+        }
+      }
+    ],
+    blockingAttribute: { name: "data-usercentrics", values: {} },
+    kind: "usercentrics",
+    reploUsercentricsService: entry.reploUsercentricsService ?? null,
+    loaderContainerId: entry.runtimeOwner?.type === "gtm" ? entry.runtimeOwner.containerId : null
   };
 }
 function isConsentPlatformEntry(entry) {
-  return entry.type === "Cookiebot" || entry.type === "consentPlatform";
+  return entry.type === "Cookiebot" || entry.type === "Usercentrics" || entry.type === "consentPlatform";
 }
 function findConsentPlatform(scripts) {
   for (const entry of scripts) {
     if (entry.type === "Cookiebot") {
       return cookiebotPreset(entry.identifier);
     }
+    if (entry.type === "Usercentrics") {
+      return usercentricsPreset(entry);
+    }
     if (entry.type === "consentPlatform") {
       return {
         id: entry.id,
@@ -41,17 +69,25 @@ function findConsentPlatform(scripts) {
           { kind: "external", src: entry.src, attributes: entry.attributes }
         ],
         blockingAttribute: entry.blockingAttribute,
-        isCookiebot: false
+        kind: "generic",
+        reploUsercentricsService: null,
+        loaderContainerId: null
       };
     }
   }
   return null;
 }
-function getBlockingAttributes(config, requiredConsent) {
+function getBlockingAttributes(config, requiredConsent, usercentricsService) {
   const gated = requiredConsent.filter((category) => category !== "necessary");
   if (gated.length === 0) {
     return {};
   }
+  if (config.kind === "usercentrics") {
+    return {
+      type: "text/plain",
+      ...usercentricsService ? { [config.blockingAttribute.name]: usercentricsService } : {}
+    };
+  }
   const tokens = [
     ...new Set(
       gated.flatMap(
@@ -69,6 +105,11 @@ const COOKIEBOT_EVENTS = [
   "CookiebotOnAccept",
   "CookiebotOnDecline"
 ];
+const USERCENTRICS_EVENTS = [
+  "UC_CONSENT",
+  "UC_UI_INITIALIZED",
+  "UC_UI_CMP_EVENT"
+];
 const OPTIONAL_CONSENT_CATEGORIES = [
   "analytics",
   "marketing",
@@ -79,6 +120,8 @@ const genericConsentCategorySchema = v.picklist(OPTIONAL_CONSENT_CATEGORIES);
 const GENERIC_CONSENT_GRANTED_EVENT = "reploConsentCategoryGranted";
 let delegatedPlatform = null;
 let listeningToCookiebot = false;
+let listeningToUsercentrics = false;
+let grantedUsercentricsServices = [];
 let listeningToGenericPlatform = false;
 let categories = DENIED_CATEGORIES;
 let decidedAt = null;
@@ -89,7 +132,7 @@ function findDelegatedPlatform() {
   return delegatedPlatform;
 }
 function getDelegatedConsent() {
-  return { categories, decidedAt };
+  return delegatedPlatform?.kind === "usercentrics" ? { categories, decidedAt, grantedUsercentricsServices } : { categories, decidedAt };
 }
 function readCookiebotConsent() {
   const cookiebot = typeof window === "undefined" ? void 0 : window.Cookiebot;
@@ -130,6 +173,27 @@ function handleCookiebotEvent() {
     reloadPage();
   }
 }
+async function handleUsercentricsEvent() {
+  const { readUsercentricsChange } = await import("./usercentrics-consent");
+  const change = await readUsercentricsChange({
+    categories,
+    decidedAt,
+    grantedUsercentricsServices
+  });
+  if (!change) {
+    return;
+  }
+  categories = change.categories;
+  grantedUsercentricsServices = change.grantedUsercentricsServices;
+  decidedAt = change.decidedAt;
+  notifyConsentListeners();
+  if (change.hasDowngrade) {
+    reloadPage();
+  }
+}
+function onUsercentricsEvent() {
+  void handleUsercentricsEvent();
+}
 function handleGenericConsentActivation(event) {
   if (!(event instanceof CustomEvent)) {
     return;
@@ -153,28 +217,40 @@ function enableConsentDelegation(config) {
     return;
   }
   delegatedPlatform = config;
-  if (config.isCookiebot && !listeningToCookiebot) {
+  if (config.kind === "cookiebot" && !listeningToCookiebot) {
     listeningToCookiebot = true;
     for (const event of COOKIEBOT_EVENTS) {
       window.addEventListener(event, handleCookiebotEvent);
     }
   }
-  if (!config.isCookiebot && !listeningToGenericPlatform) {
+  if (config.kind === "usercentrics" && !listeningToUsercentrics) {
+    listeningToUsercentrics = true;
+    for (const event of USERCENTRICS_EVENTS) {
+      window.addEventListener(event, onUsercentricsEvent);
+    }
+  }
+  if (config.kind === "generic" && !listeningToGenericPlatform) {
     listeningToGenericPlatform = true;
     document.addEventListener(
       GENERIC_CONSENT_GRANTED_EVENT,
       handleGenericConsentActivation
     );
   }
-  if (config.isCookiebot) {
+  if (config.kind === "cookiebot") {
     readCookiebotConsent();
   }
+  if (config.kind === "usercentrics" && (window.__ucCmp || window.UC_UI)) {
+    onUsercentricsEvent();
+  }
 }
 function activateBlockedScripts() {
-  if (!delegatedPlatform?.isCookiebot) {
-    return;
+  if (delegatedPlatform?.kind === "cookiebot") {
+    window.Cookiebot?.runScripts?.();
+  }
+  if (delegatedPlatform?.kind === "usercentrics") {
+    void window.__ucCmp?.refreshScripts?.();
+    window.UC_UI?.enableScriptsForServicesWithConsent?.();
   }
-  window.Cookiebot?.runScripts?.();
 }
 function subscribeToConsentDelegation(listener) {
   listeners.add(listener);
@@ -191,6 +267,11 @@ function resetConsentPlatformForTests() {
       window.removeEventListener(event, handleCookiebotEvent);
     }
   }
+  if (typeof window !== "undefined" && listeningToUsercentrics) {
+    for (const event of USERCENTRICS_EVENTS) {
+      window.removeEventListener(event, onUsercentricsEvent);
+    }
+  }
   if (typeof document !== "undefined" && listeningToGenericPlatform) {
     document.removeEventListener(
       GENERIC_CONSENT_GRANTED_EVENT,
@@ -199,7 +280,9 @@ function resetConsentPlatformForTests() {
   }
   delegatedPlatform = null;
   listeningToCookiebot = false;
+  listeningToUsercentrics = false;
   listeningToGenericPlatform = false;
+  grantedUsercentricsServices = [];
   categories = DENIED_CATEGORIES;
   decidedAt = null;
   reloadPage = reloadCurrentPage;

package/consent/consent-store.d.ts

@@ -13,7 +13,7 @@ import type { ConsentCategories } from "./cookie";
  */
 export interface ConsentState {
     /** Which platform owns consent. Absent means Replo's native banner; "external" is a generic `consentPlatform` entry. */
-    cmp?: "replo" | "cookiebot" | "external";
+    cmp?: "replo" | "cookiebot" | "usercentrics" | "external";
     mode: ConsentMode;
     categories: ConsentCategories;
     /** Epoch ms when the visitor last made a choice, or null if undecided. */
@@ -24,6 +24,8 @@ export interface ConsentState {
      * next interaction lazily backfills it).
      */
     consentId?: string;
+    /** Usercentrics only: the services granted right now, including essentials that are granted automatically. */
+    grantedUsercentricsServices?: string[];
 }
 export declare const consentStore: {
     getSnapshot(): ConsentState;
@@ -62,8 +64,11 @@ export declare function useConsent(options?: UseConsentOptions): UseConsentResul
 /**
  * Whether a script requiring `requiredConsent` may load now. `mode === "off"`
  * allows everything only under Replo's banner; a delegated CMP answers instead.
+ * On Usercentrics a gated script names its service, or null for none, and only
+ * that service releases it. Omitting it means no one script: follow categories.
  */
-export declare function isConsentAllowed({ state, requiredConsent, }: {
+export declare function isConsentAllowed({ state, requiredConsent, usercentricsService, }: {
     state: ConsentState;
     requiredConsent: ConsentCategory[];
+    usercentricsService?: string | null;
 }): boolean;

package/consent/consent-store.js

@@ -35,6 +35,14 @@ function resolveMode() {
   return isConsentMode(attribute) ? attribute : "off";
 }
 const DEFAULT_CONSENT_POLICY_VERSION = 1;
+const DELEGATED_CMP_BY_KIND = {
+  cookiebot: "cookiebot",
+  usercentrics: "usercentrics",
+  generic: "external"
+};
+function isDelegatedCmp(cmp) {
+  return cmp !== void 0 && cmp !== "replo";
+}
 function computeSnapshot() {
   if (typeof window === "undefined") {
     return SERVER_SNAPSHOT;
@@ -43,7 +51,7 @@ function computeSnapshot() {
   const platform = findDelegatedPlatform();
   if (platform) {
     return {
-      cmp: platform.isCookiebot ? "cookiebot" : "external",
+      cmp: DELEGATED_CMP_BY_KIND[platform.kind],
       mode,
       ...getDelegatedConsent()
     };
@@ -87,7 +95,7 @@ function commit({
   policyVersion = DEFAULT_CONSENT_POLICY_VERSION
 }) {
   const previous = consentStore.getSnapshot();
-  if (previous.cmp === "cookiebot" || previous.cmp === "external") {
+  if (isDelegatedCmp(previous.cmp)) {
     return;
   }
   const decidedAt = Date.now();
@@ -186,9 +194,13 @@ function useConsent(options = {}) {
 }
 function isConsentAllowed({
   state,
-  requiredConsent
+  requiredConsent,
+  usercentricsService
 }) {
-  if (state.cmp !== "cookiebot" && state.cmp !== "external" && state.mode === "off") {
+  if (state.cmp === "usercentrics" && usercentricsService !== void 0 && requiredConsent.some((category) => category !== "necessary")) {
+    return usercentricsService !== null && (state.grantedUsercentricsServices?.includes(usercentricsService) ?? false);
+  }
+  if (!isDelegatedCmp(state.cmp) && state.mode === "off") {
     return true;
   }
   if (requiredConsent.length === 0) {

package/consent/inject-script-descriptors.d.ts

@@ -1,4 +1,4 @@
-import type { ScriptTagDescriptor } from "../_vendor/schemas/generated/consent";
+import type { ConsentCategory, ScriptTagDescriptor } from "../_vendor/schemas/generated/consent";
 /**
  * Creates and appends the script nodes for `descriptors`, skipping node ids
  * already in the document, and returns only the nodes created by this call.
@@ -11,3 +11,10 @@ export declare function injectScriptDescriptors({ baseId, descriptors, extraAttr
     /** Applied last, so a consent platform's `text/plain` beats a descriptor's own type. */
     extraAttributes?: Record<string, string>;
 }): HTMLScriptElement[];
+/** Injects a script gated by whichever consent platform owns the page. */
+export declare function injectGatedScript({ baseId, descriptors, requiredConsent, usercentricsService, }: {
+    baseId: string;
+    descriptors: ScriptTagDescriptor[];
+    requiredConsent: ConsentCategory[];
+    usercentricsService: string | null;
+}): void;

package/consent/inject-script-descriptors.js

@@ -1,3 +1,8 @@
+import {
+  activateBlockedScripts,
+  findDelegatedPlatform,
+  getBlockingAttributes
+} from "./consent-platform";
 function injectScriptDescriptors({
   baseId,
   descriptors,
@@ -37,6 +42,23 @@ function injectScriptDescriptors({
   });
   return createdNodes;
 }
+function injectGatedScript({
+  baseId,
+  descriptors,
+  requiredConsent,
+  usercentricsService
+}) {
+  const platform = findDelegatedPlatform();
+  const blockingAttributes = platform ? getBlockingAttributes(platform, requiredConsent, usercentricsService) : {};
+  const createdNodes = injectScriptDescriptors({
+    baseId,
+    descriptors,
+    extraAttributes: blockingAttributes
+  });
+  if ("type" in blockingAttributes && createdNodes.length > 0) {
+    activateBlockedScripts();
+  }
+}
 function buildModuleShim(body) {
   return [
     'var moduleScript = document.createElement("script");',
@@ -46,5 +68,6 @@ function buildModuleShim(body) {
   ].join("\n");
 }
 export {
+  injectGatedScript,
   injectScriptDescriptors
 };

package/consent/replo-scripts.d.ts

@@ -1,4 +1,5 @@
-import type { ConsentCategory, ReploScriptEntry, ScriptTagDescriptor } from "../_vendor/schemas/generated/consent";
+import type { ScriptTagDescriptor } from "../_vendor/schemas/generated/consent";
+import type { ConsentCategory, ReploScriptEntry } from "./types";
 import { Component } from "react";
 /**
  * Injects the resolved tags into `document.head` once a caller has decided
@@ -15,6 +16,7 @@ type InjectedScriptProps = {
     descriptors: ScriptTagDescriptor[];
     /** Used under a delegated platform to derive the attributes that gate the tag. */
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 };
 export declare class InjectedScript extends Component<InjectedScriptProps> {
     componentDidMount(): void;
@@ -25,13 +27,15 @@ export declare class InjectedScript extends Component<InjectedScriptProps> {
  * Authored once in `app/layout.tsx`; the agent/miniapp only edit the `scripts`
  * array. Each entry registers itself and is gated + injected per consent.
  *
- * A consent-platform entry (`Cookiebot`, or a generic `consentPlatform`) takes
+ * A consent-platform entry (`Cookiebot`, `Usercentrics`, or a generic `consentPlatform`) takes
  * over consent site-wide: scripts carry the platform's blocking attributes, its
  * loader injects after them so its startup scan sees the full set, and Replo's
  * own gates follow the platform instead of the native banner.
  *
  * A GA4 entry's `runtimeOwner` leaves `gtag.js` to a GTM container or other
  * loader, which must keep loading it; `dataLayer`, config and sink still start.
+ * A Usercentrics entry's leaves the platform's loader to it the same way, and a
+ * GTM owner's container runs without waiting for consent.
  */
 export declare function ReploScripts({ scripts }: {
     scripts: ReploScriptEntry[];

package/consent/replo-scripts.js

@@ -2,16 +2,13 @@
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { Component } from "react";
 import {
-  activateBlockedScripts,
   buildGrantMarker,
   enableConsentDelegation,
   findConsentPlatform,
-  findDelegatedPlatform,
-  getBlockingAttributes,
   isConsentPlatformEntry,
   OPTIONAL_CONSENT_CATEGORIES
 } from "./consent-platform";
-import { injectScriptDescriptors } from "./inject-script-descriptors";
+import { injectGatedScript } from "./inject-script-descriptors";
 import {
   registerScript,
   snippetScriptId,
@@ -32,11 +29,14 @@ function scriptId(entry) {
   }
   return `${entry.type}:${entry.identifier}`;
 }
-function requiredConsentFor(entry) {
+function requiredConsentFor(entry, loaderContainerId) {
   if (entry.type === "custom" || entry.type === "snippet") {
     return entry.requiredConsent;
   }
-  if (entry.type === "consentPlatform" || entry.type === "Cookiebot") {
+  if (isConsentPlatformEntry(entry)) {
+    return [];
+  }
+  if (entry.type === "GoogleTagManager" && entry.identifier === loaderContainerId) {
     return [];
   }
   return entry.requiredConsent ?? defaultConsentFor(entry.type);
@@ -54,25 +54,20 @@ function descriptorsFor(entry) {
   if (entry.type === "snippet") {
     return [{ kind: "inline", body: entry.body, module: entry.module }];
   }
-  if (entry.type === "consentPlatform" || entry.type === "Cookiebot") {
+  if (isConsentPlatformEntry(entry)) {
     return [];
   }
   return buildScriptTags(entry);
 }
 class InjectedScript extends Component {
   componentDidMount() {
-    const { baseId, descriptors, requiredConsent = [] } = this.props;
-    const platform = findDelegatedPlatform();
-    const blockingAttributes = platform ? getBlockingAttributes(platform, requiredConsent) : {};
-    const blockedByPlatform = "type" in blockingAttributes;
-    const createdNodes = injectScriptDescriptors({
-      baseId,
-      descriptors,
-      extraAttributes: blockingAttributes
+    const { requiredConsent = [], usercentricsService = null } = this.props;
+    injectGatedScript({
+      baseId: this.props.baseId,
+      descriptors: this.props.descriptors,
+      requiredConsent,
+      usercentricsService
     });
-    if (blockedByPlatform && createdNodes.length > 0) {
-      activateBlockedScripts();
-    }
   }
   render() {
     return null;
@@ -89,23 +84,28 @@ class ScriptRegistration extends Component {
     return null;
   }
 }
-function registrationFor(entry) {
+function registrationFor(entry, loaderContainerId) {
   const id = scriptId(entry);
-  const requiredConsent = requiredConsentFor(entry);
+  const requiredConsent = requiredConsentFor(entry, loaderContainerId);
+  const usercentricsService = "usercentricsService" in entry && entry.usercentricsService ? entry.usercentricsService : null;
   if (entry.type === "X") {
     return {
       id,
       type: "X",
       requiredConsent,
+      usercentricsService,
       pixelId: entry.identifier,
       events: entry.events ?? {}
     };
   }
-  return { id, type: entry.type, requiredConsent };
+  return { id, type: entry.type, requiredConsent, usercentricsService };
 }
-function ManagedScript({ entry }) {
-  const registration = registrationFor(entry);
-  const { id, requiredConsent } = registration;
+function ManagedScript({
+  entry,
+  loaderContainerId
+}) {
+  const registration = registrationFor(entry, loaderContainerId);
+  const { id, requiredConsent, usercentricsService } = registration;
   const isBlockedByNativeConsent = useIsBlockedByNativeConsent(requiredConsent);
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx(
@@ -120,7 +120,8 @@ function ManagedScript({ entry }) {
       {
         baseId: id,
         descriptors: descriptorsFor(entry),
-        requiredConsent
+        requiredConsent,
+        usercentricsService: usercentricsService ?? void 0
       }
     )
   ] });
@@ -145,8 +146,15 @@ function ReploScripts({ scripts }) {
   }
   return /* @__PURE__ */ jsxs(Fragment, { children: [
     /* @__PURE__ */ jsx(ConsentWindowApi, {}),
-    scripts.filter((entry) => !isConsentPlatformEntry(entry)).map((entry) => /* @__PURE__ */ jsx(ManagedScript, { entry }, scriptId(entry))),
-    platform && !platform.isCookiebot && OPTIONAL_CONSENT_CATEGORIES.map((category) => /* @__PURE__ */ jsx(
+    scripts.filter((entry) => !isConsentPlatformEntry(entry)).map((entry) => /* @__PURE__ */ jsx(
+      ManagedScript,
+      {
+        entry,
+        loaderContainerId: platform?.loaderContainerId ?? null
+      },
+      scriptId(entry)
+    )),
+    platform && platform.kind === "generic" && OPTIONAL_CONSENT_CATEGORIES.map((category) => /* @__PURE__ */ jsx(
       InjectedScript,
       {
         baseId: `consent-platform:${platform.id}:grant:${category}`,

package/consent/script-registration-store.d.ts

@@ -9,6 +9,8 @@ import type { ConsentCategory, ReploScriptType, XPixelEvents } from "../_vendor/
 export type RegisteredScript = {
     id: string;
     requiredConsent: ConsentCategory[];
+    /** Null unless the entry names a Usercentrics service. */
+    usercentricsService: string | null;
 } & ({
     type: Exclude<ReploScriptType, "X">;
 } | {

package/consent/script-snippets.d.ts

@@ -1,5 +1,5 @@
 import type { ConsentCategory, ReploScriptEntry, ReploScriptType, ScriptTagDescriptor } from "../_vendor/schemas/generated/consent";
-type ProviderType = Exclude<ReploScriptType, "custom" | "snippet" | "consentPlatform" | "Cookiebot">;
+type ProviderType = Exclude<ReploScriptType, "custom" | "snippet" | "consentPlatform" | "Cookiebot" | "Usercentrics">;
 type ProviderScriptEntry = Extract<ReploScriptEntry, {
     type: ProviderType;
 }>;

package/consent/types.d.ts

@@ -1,4 +1,4 @@
-export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "X" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot" | "Mixpanel" | "Attentive" | "Alia" | "Cookiebot" | "snippet" | "custom" | "consentPlatform";
+export type ReploScriptType = "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "X" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot" | "Mixpanel" | "Attentive" | "Alia" | "Cookiebot" | "Usercentrics" | "snippet" | "custom" | "consentPlatform";
 export type ConsentCategory = "necessary" | "analytics" | "marketing" | "preferences" | "sale_of_data";
 export type ConsentMode = "off" | "simple" | "per-category";
 declare module "react" {
@@ -24,9 +24,11 @@ export type XPixelEvents = {
     purchase?: string;
 };
 /**
- * Another loader owns GA4's `gtag.js`. The SDK keeps `dataLayer`, the config
- * call and the analytics sink but never injects `gtag.js`, so if the GTM
- * container (or other code) stops loading it, events queue and never send.
+ * Another loader owns GA4's `gtag.js` or the Usercentrics loader. On GA4 the
+ * SDK keeps `dataLayer`, the config call and the analytics sink but never injects
+ * `gtag.js`, so if the GTM container (or other code) stops loading it, events
+ * queue and never send. On Usercentrics the SDK still blocks scripts and follows
+ * the visitor's answer, so if nothing loads it, gated scripts stay off.
  */
 export type ScriptRuntimeOwner = {
     type: "gtm";
@@ -39,37 +41,49 @@ export type ReploScriptEntry = {
     type: "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot" | "Attentive" | "Alia";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "GA4";
     identifier: string;
     requiredConsent?: ConsentCategory[];
     runtimeOwner?: ScriptRuntimeOwner;
+    usercentricsService?: string;
 } | {
     type: "X";
     identifier: string;
     events?: XPixelEvents;
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "Cookiebot";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+} | {
+    type: "Usercentrics";
+    identifier: string;
+    loaderVersion?: "v2" | "v3";
+    runtimeOwner?: ScriptRuntimeOwner;
+    reploUsercentricsService?: string;
 } | {
     type: "Mixpanel";
     identifier: string;
     region?: MixpanelRegion;
     requiredConsent?: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "snippet";
     id: string;
     body: string;
     module?: boolean;
     requiredConsent: ConsentCategory[];
+    usercentricsService?: string;
 } | {
     type: "custom";
     id: string;
     requiredConsent: ConsentCategory[];
     src?: string;
     body?: string;
+    usercentricsService?: string;
 } | {
     type: "consentPlatform";
     id: string;

package/consent/usercentrics-consent.d.ts

@@ -0,0 +1,15 @@
+import type { ConsentCategories } from "./cookie";
+/**
+ * The visitor's answer as Replo consent, or null when there's nothing to apply:
+ * the platform isn't ready, its answer is unreadable, or nothing changed.
+ */
+export declare function readUsercentricsChange(previous: {
+    categories: ConsentCategories;
+    decidedAt: number | null;
+    grantedUsercentricsServices: string[];
+}): Promise<{
+    categories: ConsentCategories;
+    decidedAt: number | null;
+    grantedUsercentricsServices: string[];
+    hasDowngrade: boolean;
+} | null>;

package/consent/usercentrics-consent.js

@@ -0,0 +1,96 @@
+import * as v from "valibot";
+const usercentricsDetailsSchema = v.object({
+  consent: v.optional(v.object({ type: v.optional(v.string()) })),
+  services: v.record(
+    v.string(),
+    v.object({
+      name: v.string(),
+      essential: v.optional(v.boolean()),
+      consent: v.object({ given: v.boolean() })
+    })
+  )
+});
+const usercentricsBaseInfoSchema = v.array(
+  v.object({
+    name: v.string(),
+    isEssential: v.optional(v.boolean()),
+    consent: v.object({
+      status: v.boolean(),
+      history: v.optional(v.array(v.object({ type: v.optional(v.string()) })))
+    })
+  })
+);
+function usercentricsCategories(services) {
+  const optionalServices = services.filter((service) => !service.essential);
+  const acceptedAll = optionalServices.length > 0 && optionalServices.every((service) => service.given);
+  return {
+    necessary: true,
+    analytics: acceptedAll,
+    marketing: acceptedAll,
+    preferences: acceptedAll,
+    sale_of_data: acceptedAll
+  };
+}
+async function readUsercentricsServices() {
+  if (window.__ucCmp?.getConsentDetails) {
+    const details = v.safeParse(
+      usercentricsDetailsSchema,
+      await window.__ucCmp.getConsentDetails()
+    );
+    if (!details.success) {
+      console.warn("[Replo] Unreadable Usercentrics consent details");
+      return null;
+    }
+    return {
+      services: Object.values(details.output.services).map((service) => ({
+        name: service.name,
+        given: service.consent.given,
+        essential: service.essential === true
+      })),
+      isExplicit: details.output.consent?.type === "EXPLICIT"
+    };
+  }
+  const rawBaseInfo = window.UC_UI?.getServicesBaseInfo?.();
+  if (rawBaseInfo === void 0) {
+    return null;
+  }
+  const baseInfo = v.safeParse(usercentricsBaseInfoSchema, rawBaseInfo);
+  if (!baseInfo.success) {
+    console.warn("[Replo] Unreadable Usercentrics service info");
+    return null;
+  }
+  return {
+    services: baseInfo.output.map((service) => ({
+      name: service.name,
+      given: service.consent.status,
+      essential: service.isEssential === true
+    })),
+    isExplicit: baseInfo.output.some((service) => {
+      return service.consent.history?.at(-1)?.type === "explicit";
+    })
+  };
+}
+async function readUsercentricsChange(previous) {
+  const answer = await readUsercentricsServices();
+  if (!answer) {
+    return null;
+  }
+  const categories = usercentricsCategories(answer.services);
+  const grantedUsercentricsServices = answer.services.filter((service) => service.given).map((service) => service.name).sort();
+  const isUnchanged = categories.analytics === previous.categories.analytics && grantedUsercentricsServices.join() === previous.grantedUsercentricsServices.join();
+  const isDecided = answer.isExplicit || answer.services.some((service) => service.given && !service.essential);
+  if (isUnchanged && (previous.decidedAt !== null || !isDecided)) {
+    return null;
+  }
+  return {
+    categories,
+    decidedAt: isDecided ? Date.now() : null,
+    grantedUsercentricsServices,
+    hasDowngrade: previous.grantedUsercentricsServices.some((name) => {
+      return !grantedUsercentricsServices.includes(name);
+    })
+  };
+}
+export {
+  readUsercentricsChange
+};

package/consent/window-api.js

@@ -30,7 +30,7 @@ const api = {
   saleOfDataAllowed: () => isAllowed("sale_of_data"),
   shouldShowBanner: () => {
     const state = consentStore.getSnapshot();
-    if (state.cmp === "cookiebot" || state.cmp === "external") {
+    if (state.cmp && state.cmp !== "replo") {
       return false;
     }
     return state.mode !== "off" && state.decidedAt === null;

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "2.18.3",
+  "version": "2.19.0",
   "branch": "HEAD",
-  "commit": "00c3d9662c0d5daa0cfd0ef03bb3b182e0cc0652",
-  "builtAt": "2026-11-03T23:49:23.685Z"
+  "commit": "377fd6358bd4e3d0d32ff03942701a9cede4e0e9",
+  "builtAt": "2026-11-06T19:28:13.532Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "2.18.3",
+  "version": "2.19.0",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "2.18.3",
+    "version": "2.19.0",
     "branch": "HEAD",
-    "commit": "00c3d9662c0d5daa0cfd0ef03bb3b182e0cc0652",
-    "builtAt": "2026-11-03T23:49:23.685Z"
+    "commit": "377fd6358bd4e3d0d32ff03942701a9cede4e0e9",
+    "builtAt": "2026-11-06T19:28:13.532Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",