@replohq/sdk 2.3.0 → 2.4.0

package/_vendor/schemas/generated/consent.d.ts

@@ -19,11 +19,22 @@ export type XPixelEvents = {
     startCheckout?: string;
     purchase?: string;
 };
+export type ScriptRuntimeOwner = {
+    type: "gtm";
+    containerId: string;
+} | {
+    type: "external";
+};
 export type MixpanelRegion = "us" | "eu" | "in";
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot";
+    type: "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
+} | {
+    type: "GA4";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+    runtimeOwner?: ScriptRuntimeOwner;
 } | {
     type: "X";
     identifier: string;

package/consent/replo-scripts.d.ts

@@ -29,6 +29,9 @@ export declare class InjectedScript extends Component<InjectedScriptProps> {
  * over consent site-wide: scripts carry the platform's blocking attributes, its
  * loader injects after them so its startup scan sees the full set, and Replo's
  * own gates follow the platform instead of the native banner.
+ *
+ * A GA4 entry's `runtimeOwner` leaves `gtag.js` to a GTM container or other
+ * loader, which must keep loading it; `dataLayer`, config and sink still start.
  */
 export declare function ReploScripts({ scripts }: {
     scripts: ReploScriptEntry[];

package/consent/script-snippets.d.ts

@@ -13,7 +13,11 @@ export declare function isXEventIdForPixel({ eventId, pixelId, }: {
     eventId: string;
     pixelId: string;
 }): boolean;
-/** The runtime injects these tags in order after consent allows tracking. */
+/**
+ * The runtime injects these tags in order after consent allows tracking. A GA4
+ * entry with a `runtimeOwner` drops only `gtag.js`; the inline tag still
+ * queues the config call for the owner's copy to send.
+ */
 export declare function buildScriptTags(entry: ProviderScriptEntry): ScriptTagDescriptor[];
 /**
  * The default consent categories that gate an identifier-provider script when an

package/consent/script-snippets.js

@@ -186,6 +186,9 @@ function isXEventIdForPixel({
 }
 function buildScriptTags(entry) {
   const tags = PROVIDER_SNIPPETS[entry.type].buildTags(entry.identifier, entry);
+  if (entry.type === "GA4" && entry.runtimeOwner) {
+    return tags.filter((tag) => tag.kind !== "external");
+  }
   if (entry.type === "X") {
     const pageViewId = entry.events?.pageView?.trim();
     if (pageViewId && isXEventIdForPixel({ eventId: pageViewId, pixelId: entry.identifier })) {

package/consent/types.d.ts

@@ -23,16 +23,36 @@ export type XPixelEvents = {
     startCheckout?: string;
     purchase?: string;
 };
+/**
+ * Another loader owns GA4's `gtag.js`. The SDK keeps `dataLayer`, the config
+ * call and the analytics sink but never injects `gtag.js`, so if the GTM
+ * container (or other code) stops loading it, events queue and never send.
+ */
+export type ScriptRuntimeOwner = {
+    type: "gtm";
+    containerId: string;
+} | {
+    type: "external";
+};
 export type MixpanelRegion = "us" | "eu" | "in";
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot" | "Cookiebot";
+    type: "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
+} | {
+    type: "GA4";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+    runtimeOwner?: ScriptRuntimeOwner;
 } | {
     type: "X";
     identifier: string;
     events?: XPixelEvents;
     requiredConsent?: ConsentCategory[];
+} | {
+    type: "Cookiebot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
 } | {
     type: "Mixpanel";
     identifier: string;
@@ -42,6 +62,7 @@ export type ReploScriptEntry = {
     type: "snippet";
     id: string;
     body: string;
+    module?: boolean;
     requiredConsent: ConsentCategory[];
 } | {
     type: "custom";

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "branch": "HEAD",
-  "commit": "0f7d0830fdc9d0b6c299ee8b9497a749d41aee95",
-  "builtAt": "2026-10-21T20:51:42.391Z"
+  "commit": "a20152029da76f3b8edd0d538187209442f20e23",
+  "builtAt": "2026-10-22T05:49:26.854Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "2.3.0",
+    "version": "2.4.0",
     "branch": "HEAD",
-    "commit": "0f7d0830fdc9d0b6c299ee8b9497a749d41aee95",
-    "builtAt": "2026-10-21T20:51:42.391Z"
+    "commit": "a20152029da76f3b8edd0d538187209442f20e23",
+    "builtAt": "2026-10-22T05:49:26.854Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",