@replohq/sdk 2.2.0 → 2.2.1

package/consent/consent-platform.js

@@ -1,4 +1,4 @@
-import * as z from "zod";
+import * as v from "valibot";
 import { DENIED_CATEGORIES } from "./cookie";
 const COOKIEBOT_CATEGORY_BY_CONSENT = {
   analytics: "statistics",
@@ -75,7 +75,7 @@ const OPTIONAL_CONSENT_CATEGORIES = [
   "preferences",
   "sale_of_data"
 ];
-const genericConsentCategorySchema = z.enum(OPTIONAL_CONSENT_CATEGORIES);
+const genericConsentCategorySchema = v.picklist(OPTIONAL_CONSENT_CATEGORIES);
 const GENERIC_CONSENT_GRANTED_EVENT = "reploConsentCategoryGranted";
 let delegatedPlatform = null;
 let listeningToCookiebot = false;
@@ -134,11 +134,11 @@ function handleGenericConsentActivation(event) {
   if (!(event instanceof CustomEvent)) {
     return;
   }
-  const result = genericConsentCategorySchema.safeParse(event.detail);
-  if (!result.success || categories[result.data]) {
+  const result = v.safeParse(genericConsentCategorySchema, event.detail);
+  if (!result.success || categories[result.output]) {
     return;
   }
-  categories = { ...categories, [result.data]: true };
+  categories = { ...categories, [result.output]: true };
   decidedAt = Date.now();
   notifyConsentListeners();
 }

package/consent/cookie.d.ts

@@ -1,4 +1,5 @@
 import type { ConsentCategory } from "../_vendor/schemas/generated/consent";
+import * as v from "valibot";
 /**
  * Pure (non-React, framework-agnostic) consent cookie helpers used by the client
  * store (`consent-store.ts`).
@@ -6,20 +7,21 @@ import type { ConsentCategory } from "../_vendor/schemas/generated/consent";
 export declare const CONSENT_COOKIE_NAME = "replo_consent";
 export declare const CONSENT_COOKIE_VERSION = 1;
 export declare const CONSENT_COOKIE_MAX_AGE_SECONDS: number;
+declare const persistedCookieSchema: v.ObjectSchema<{
+    readonly version: v.LiteralSchema<1, undefined>;
+    readonly decidedAt: v.OptionalSchema<v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.FiniteAction<number, undefined>]>, () => number>;
+    /** Persistent pseudonymous per-browser id; absent on pre-id (legacy) cookies. */
+    readonly consentId: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    readonly categories: v.ObjectSchema<{
+        readonly analytics: v.BooleanSchema<undefined>;
+        readonly marketing: v.BooleanSchema<undefined>;
+        readonly preferences: v.BooleanSchema<undefined>;
+        readonly sale_of_data: v.BooleanSchema<undefined>;
+    }, undefined>;
+}, undefined>;
 export type ConsentCategories = Record<ConsentCategory, boolean>;
 /** Persisted cookie payload. `necessary` is always granted and never stored. */
-export interface ConsentCookiePayload {
-    version: number;
-    decidedAt: number;
-    /** Persistent pseudonymous per-browser id; absent on pre-id (legacy) cookies. */
-    consentId?: string;
-    categories: {
-        analytics: boolean;
-        marketing: boolean;
-        preferences: boolean;
-        sale_of_data: boolean;
-    };
-}
+export type ConsentCookiePayload = v.InferOutput<typeof persistedCookieSchema>;
 export declare const DENIED_CATEGORIES: ConsentCategories;
 export declare const GRANTED_CATEGORIES: ConsentCategories;
 /**
@@ -34,3 +36,4 @@ export declare function serializeConsentCookieValue({ categories, decidedAt, con
     decidedAt: number;
     consentId?: string;
 }): string;
+export {};

package/consent/cookie.js

@@ -1,17 +1,17 @@
 import { parseJsonOrNull } from "../_vendor/replo-utils/lib/json.mjs";
-import * as z from "zod";
+import * as v from "valibot";
 const CONSENT_COOKIE_NAME = "replo_consent";
 const CONSENT_COOKIE_VERSION = 1;
 const CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 180;
-const persistedCookieSchema = z.object({
-  version: z.literal(CONSENT_COOKIE_VERSION),
-  decidedAt: z.number().optional(),
-  consentId: z.string().optional(),
-  categories: z.object({
-    analytics: z.boolean(),
-    marketing: z.boolean(),
-    preferences: z.boolean(),
-    sale_of_data: z.boolean()
+const persistedCookieSchema = v.object({
+  version: v.literal(CONSENT_COOKIE_VERSION),
+  decidedAt: v.optional(v.pipe(v.number(), v.finite()), () => Date.now()),
+  consentId: v.optional(v.string()),
+  categories: v.object({
+    analytics: v.boolean(),
+    marketing: v.boolean(),
+    preferences: v.boolean(),
+    sale_of_data: v.boolean()
   })
 });
 const DENIED_CATEGORIES = {
@@ -40,14 +40,14 @@ function parseConsentCookie(rawCookie) {
   } catch {
     return null;
   }
-  const result = persistedCookieSchema.safeParse(parseJsonOrNull(decoded));
+  const result = v.safeParse(persistedCookieSchema, parseJsonOrNull(decoded));
   if (!result.success) {
     return null;
   }
-  const { decidedAt, categories, consentId } = result.data;
+  const { decidedAt, categories, consentId } = result.output;
   return {
     version: CONSENT_COOKIE_VERSION,
-    decidedAt: decidedAt ?? Date.now(),
+    decidedAt,
     consentId,
     categories
   };

package/integrations/mailchimp.d.ts

@@ -1,19 +1,10 @@
 import React from "react";
-import * as z from "zod";
+import * as v from "valibot";
 import { CanopyError } from "../lib/canopy-error";
-declare const mailchimpSubscribeErrorCodeSchema: z.ZodEnum<{
-    notConnected: "notConnected";
-    listNotFound: "listNotFound";
-    invalidEmail: "invalidEmail";
-    invalidRequest: "invalidRequest";
-    emailNotSubscribable: "emailNotSubscribable";
-    mergeFieldsInvalid: "mergeFieldsInvalid";
-    rateLimited: "rateLimited";
-    upstreamError: "upstreamError";
-}>;
+declare const mailchimpSubscribeErrorCodeSchema: v.PicklistSchema<["notConnected", "listNotFound", "invalidEmail", "invalidRequest", "emailNotSubscribable", "mergeFieldsInvalid", "rateLimited", "upstreamError"], undefined>;
 /** `pending` means Mailchimp emailed a confirmation link the visitor must click. */
 export type MailchimpSubscribeStatus = "subscribed" | "pending";
-export type MailchimpSubscribeErrorCode = z.infer<typeof mailchimpSubscribeErrorCodeSchema>;
+export type MailchimpSubscribeErrorCode = v.InferOutput<typeof mailchimpSubscribeErrorCodeSchema>;
 export declare class MailchimpSubscribeError extends CanopyError {
     readonly code: MailchimpSubscribeErrorCode;
     constructor({ code, message, cause, }: {

package/integrations/mailchimp.js

@@ -2,10 +2,10 @@
 import React from "react";
 import { useMutation } from "@tanstack/react-query";
 import { parseJsonOrNull } from "../_vendor/replo-utils/lib/json.mjs";
-import * as z from "zod";
+import * as v from "valibot";
 import { CanopyError } from "../lib/canopy-error";
 import { useCanopyClientConfig } from "../providers/canopy-client-config";
-const mailchimpSubscribeErrorCodeSchema = z.enum([
+const mailchimpSubscribeErrorCodeSchema = v.picklist([
   "notConnected",
   "listNotFound",
   "invalidEmail",
@@ -15,12 +15,12 @@ const mailchimpSubscribeErrorCodeSchema = z.enum([
   "rateLimited",
   "upstreamError"
 ]);
-const mailchimpSubscribeSuccessSchema = z.object({
-  status: z.enum(["subscribed", "pending"])
+const mailchimpSubscribeSuccessSchema = v.object({
+  status: v.picklist(["subscribed", "pending"])
 });
-const mailchimpSubscribeFailureSchema = z.object({
+const mailchimpSubscribeFailureSchema = v.object({
   key: mailchimpSubscribeErrorCodeSchema,
-  message: z.string()
+  message: v.string()
 });
 class MailchimpSubscribeError extends CanopyError {
   code;
@@ -65,24 +65,28 @@ async function postSubscribe({
   }
   const body = parseJsonOrNull(responseText);
   if (!response.ok) {
-    const failure = mailchimpSubscribeFailureSchema.safeParse(body);
+    const failure = v.safeParse(mailchimpSubscribeFailureSchema, body);
     throw new MailchimpSubscribeError(
-      failure.success ? { code: failure.data.key, message: failure.data.message, cause: null } : {
+      failure.success ? {
+        code: failure.output.key,
+        message: failure.output.message,
+        cause: null
+      } : {
         code: "upstreamError",
         message: `The Mailchimp subscribe endpoint failed with status ${response.status}`,
-        cause: failure.error
+        cause: new v.ValiError(failure.issues)
       }
     );
   }
-  const success = mailchimpSubscribeSuccessSchema.safeParse(body);
+  const success = v.safeParse(mailchimpSubscribeSuccessSchema, body);
   if (!success.success) {
     throw new MailchimpSubscribeError({
       code: "upstreamError",
       message: "The Mailchimp subscribe endpoint returned an unexpected response",
-      cause: success.error
+      cause: new v.ValiError(success.issues)
     });
   }
-  return success.data.status;
+  return success.output.status;
 }
 function useMailchimpSubscribe({
   listId,

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "branch": "HEAD",
-  "commit": "425a057ac5f569a875e63976fa5a936dc651e292",
-  "builtAt": "2026-10-20T23:04:33.045Z"
+  "commit": "cb0991cc863d256c3df479ed294f1a2dc48dba29",
+  "builtAt": "2026-10-20T23:18:54.483Z"
 };

package/loaders/preview-placeholder.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Sample-data substitution for previewing dynamic routes inside the editor.
+ *
+ * When the editor previews an unfilled Next.js dynamic route (the literal
+ * `/products/[handle]` URL), the page receives the bracket token itself as its
+ * param, every lookup misses, and the preview 404s. Loader invocations detect
+ * that exact case — editor iframe + a bracket-token arg — and substitute a
+ * type-correct sample fixture so the page renders its real layout with sample
+ * data. A `replo:preview:placeholder-render` message tells the embedding
+ * editor the preview is showing sample data (mirrors `replo:preview:status`
+ * from NextErrorReporter).
+ *
+ * Substitution is gated to editor iframes only: production traffic to a
+ * bracket URL still misses lookups and 404s, so this can never soft-404 a
+ * published site.
+ */
+import type { FullCollection, FullProduct, PaginatedProducts } from "./loader-schemas";
 export declare function hasUnfilledRouteParam(args: Record<string, unknown>): boolean;
 /**
  * Sample data for a loader invoked with an unfilled dynamic-route param, or
@@ -13,8 +30,9 @@ export declare function resolvePreviewPlaceholderData({ loaderKey, args, }: {
     loaderKey: string;
     args: Record<string, unknown>;
 }): unknown;
+type PreviewableLoaderData = FullProduct | FullCollection | PaginatedProducts;
 /** Whether loader output is one of this module's sample fixtures. */
-export declare function isPreviewPlaceholderData(data: unknown): boolean;
+export declare function isPreviewPlaceholderData(data: PreviewableLoaderData): boolean;
 /**
  * Notify the embedding editor when a loader component rendered sample data.
  * The single reporting path: inspecting rendered data (rather than hooking
@@ -22,4 +40,5 @@ export declare function isPreviewPlaceholderData(data: unknown): boolean;
  * hydration never re-invokes the loader on the client. Receivers treat the
  * message as idempotent, so no dedupe is needed.
  */
-export declare function useReportPreviewPlaceholderRender(data: unknown): void;
+export declare function useReportPreviewPlaceholderRender(data: PreviewableLoaderData): void;
+export {};

package/loaders/preview-placeholder.js

@@ -1,5 +1,4 @@
 import { useEffect } from "react";
-import * as z from "zod";
 import { DATA_LOADER_KEYS } from "./loader-keys";
 const PLACEHOLDER_RENDER_MESSAGE_TYPE = "replo:preview:placeholder-render";
 const UNFILLED_ROUTE_PARAM_RE = /^\[{1,2}(?:\.\.\.)?[^\]]+\]{1,2}$/;
@@ -184,17 +183,9 @@ function resolvePreviewPlaceholderData({
   }
   return window.parent === window ? null : placeholderData;
 }
-const placeholderIdSchema = z.object({ id: z.string() });
-const placeholderProductsSchema = z.object({
-  products: z.array(z.object({ id: z.string() })).min(1)
-});
 function isPreviewPlaceholderData(data) {
-  const withId = placeholderIdSchema.safeParse(data);
-  if (withId.success) {
-    return withId.data.id.startsWith(SAMPLE_ID_PREFIX);
-  }
-  const withProducts = placeholderProductsSchema.safeParse(data);
-  return withProducts.success && (withProducts.data.products[0]?.id.startsWith(SAMPLE_ID_PREFIX) ?? false);
+  const id = "products" in data ? data.products[0]?.id : data.id;
+  return id?.startsWith(SAMPLE_ID_PREFIX) ?? false;
 }
 function useReportPreviewPlaceholderRender(data) {
   useEffect(() => {

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "2.2.0",
+    "version": "2.2.1",
     "branch": "HEAD",
-    "commit": "425a057ac5f569a875e63976fa5a936dc651e292",
-    "builtAt": "2026-10-20T23:04:33.045Z"
+    "commit": "cb0991cc863d256c3df479ed294f1a2dc48dba29",
+    "builtAt": "2026-10-20T23:18:54.483Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",
@@ -300,6 +300,7 @@
     "server-only": "^0.0.1",
     "tiny-jsonc": "^1.0.2",
     "uuid": "^11.1.0",
+    "valibot": "^1.5.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6"
   },