@replohq/sdk 2.3.0 → 2.5.0

package/_vendor/replo-utils/lib/crypto.d.ts

@@ -22,3 +22,4 @@ export declare function getHmacSha256Hex({ rawBody, signingKey, }: {
     rawBody: string;
     signingKey: string;
 }): Promise<string>;
+export declare function deterministicUUID(value: string): string;

package/_vendor/schemas/generated/consent.d.ts

@@ -19,11 +19,22 @@ export type XPixelEvents = {
     startCheckout?: string;
     purchase?: string;
 };
+export type ScriptRuntimeOwner = {
+    type: "gtm";
+    containerId: string;
+} | {
+    type: "external";
+};
 export type MixpanelRegion = "us" | "eu" | "in";
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot";
+    type: "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
+} | {
+    type: "GA4";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+    runtimeOwner?: ScriptRuntimeOwner;
 } | {
     type: "X";
     identifier: string;

package/_vendor/schemas/moneyFormat.mjs

@@ -1,4 +1,4 @@
-import { ReploError } from '../../chunk-CKRRL66R.mjs';
+import { ReploError } from '../../chunk-AE5H7AJS.mjs';
 import { __commonJS, __toESM } from '../../chunk-UJCSKKID.mjs';
 
 var require_first_match = __commonJS({

package/_vendor/schemas/routing/locale.mjs

@@ -1,5 +1,5 @@
 import '../../../chunk-XSMYSAKY.mjs';
-import { ReploError } from '../../../chunk-CKRRL66R.mjs';
+import { ReploError } from '../../../chunk-AE5H7AJS.mjs';
 import '../../../chunk-XGXJOHUY.mjs';
 import '../../../chunk-XWWFRIXV.mjs';
 import '../../../chunk-OPKMOW43.mjs';

package/_vendor/schemas/routing/rules.mjs

@@ -1,6 +1,6 @@
 import { getParamSegment, getRouteParams, hasRouteParam, matchSource } from '../../../chunk-VPEVERWE.mjs';
 import '../../../chunk-XSMYSAKY.mjs';
-import { ReploError } from '../../../chunk-CKRRL66R.mjs';
+import { ReploError } from '../../../chunk-AE5H7AJS.mjs';
 import '../../../chunk-XGXJOHUY.mjs';
 import '../../../chunk-XWWFRIXV.mjs';
 import '../../../chunk-OPKMOW43.mjs';

package/cart/cart-actions.js

@@ -10,6 +10,11 @@ import {
   loadCartFromCookie,
   saveCartToCookie
 } from "./utils/cookie-cart-persistence";
+import {
+  SHARED_SHOPIFY_CART_COOKIE_NAME,
+  SHOPIFY_CART_ID_PREFIX,
+  shareShopifyCart
+} from "./utils/shopify-shared-cart";
 const SHOPIFY_CART_COOKIE_NAME = "replo_cart_id";
 async function reconcileExistingCart(cart, country) {
   const cartGateway = await getCartGateway();
@@ -42,11 +47,20 @@ async function getCartAction() {
     return await loadCartFromCookie(REPLO_CART_COOKIE_NAME);
   }
   const cookieStore = await cookies();
+  const cartGateway = await getCartGateway();
+  const sharedToken = checkoutProvider === "shopify" ? cookieStore.get(SHARED_SHOPIFY_CART_COOKIE_NAME)?.value : void 0;
+  if (sharedToken) {
+    const sharedCart = await cartGateway.getCart(
+      `${SHOPIFY_CART_ID_PREFIX}${sharedToken}`
+    );
+    if (sharedCart) {
+      return sharedCart;
+    }
+  }
   const existingCartId = cookieStore.get(SHOPIFY_CART_COOKIE_NAME)?.value;
   if (!existingCartId) {
     return null;
   }
-  const cartGateway = await getCartGateway();
   const cart = await cartGateway.getCart(existingCartId);
   if (!cart) {
     try {
@@ -58,6 +72,9 @@ async function getCartAction() {
       console.warn("Failed to delete cart cookie:", error);
     }
   }
+  if (cart && checkoutProvider === "shopify") {
+    await shareShopifyCart(cart);
+  }
   return cart;
 }
 async function createCartAction(options) {
@@ -87,6 +104,9 @@ async function createCartAction(options) {
           cart.id,
           getCartCookieOptions()
         );
+        if (checkoutProvider === "shopify") {
+          await shareShopifyCart(cart);
+        }
       }
     } catch (cookieError) {
       console.warn("Failed to set cart cookie:", cookieError);

package/cart/utils/shopify-shared-cart.d.ts

@@ -0,0 +1,9 @@
+import type { Cart } from "../cart-types";
+export declare const SHARED_SHOPIFY_CART_COOKIE_NAME = "replo_shared_cart";
+export declare const SHOPIFY_CART_ID_PREFIX = "gid://shopify/Cart/";
+/**
+ * Shopify reports the store's primary domain as the checkout URL host, so a
+ * site served from a subdomain of it (shop.brand.com next to brand.com) can
+ * share its cart with the theme without any per-site configuration.
+ */
+export declare function shareShopifyCart(cart: Cart): Promise<void>;

package/cart/utils/shopify-shared-cart.js

@@ -0,0 +1,33 @@
+import { cookies, headers } from "next/headers";
+const SHARED_SHOPIFY_CART_COOKIE_NAME = "replo_shared_cart";
+const SHOPIFY_CART_ID_PREFIX = "gid://shopify/Cart/";
+async function shareShopifyCart(cart) {
+  if (process.env.IS_REPLO_SANDBOX || !cart.id.startsWith(SHOPIFY_CART_ID_PREFIX) || !cart.checkoutUrl || !URL.canParse(cart.checkoutUrl)) {
+    return;
+  }
+  const domain = new URL(cart.checkoutUrl).hostname.toLowerCase().replace(/^www\./, "");
+  const host = (await headers()).get("host")?.toLowerCase().split(":")[0];
+  if (!host?.endsWith(`.${domain}`)) {
+    return;
+  }
+  try {
+    (await cookies()).set(
+      SHARED_SHOPIFY_CART_COOKIE_NAME,
+      cart.id.slice(SHOPIFY_CART_ID_PREFIX.length),
+      {
+        domain: `.${domain}`,
+        path: "/",
+        secure: true,
+        httpOnly: false,
+        sameSite: "lax",
+        maxAge: 60 * 60 * 24 * 30
+      }
+    );
+  } catch {
+  }
+}
+export {
+  SHARED_SHOPIFY_CART_COOKIE_NAME,
+  SHOPIFY_CART_ID_PREFIX,
+  shareShopifyCart
+};

package/consent/replo-scripts.d.ts

@@ -29,6 +29,9 @@ export declare class InjectedScript extends Component<InjectedScriptProps> {
  * over consent site-wide: scripts carry the platform's blocking attributes, its
  * loader injects after them so its startup scan sees the full set, and Replo's
  * own gates follow the platform instead of the native banner.
+ *
+ * A GA4 entry's `runtimeOwner` leaves `gtag.js` to a GTM container or other
+ * loader, which must keep loading it; `dataLayer`, config and sink still start.
  */
 export declare function ReploScripts({ scripts }: {
     scripts: ReploScriptEntry[];

package/consent/script-snippets.d.ts

@@ -13,7 +13,11 @@ export declare function isXEventIdForPixel({ eventId, pixelId, }: {
     eventId: string;
     pixelId: string;
 }): boolean;
-/** The runtime injects these tags in order after consent allows tracking. */
+/**
+ * The runtime injects these tags in order after consent allows tracking. A GA4
+ * entry with a `runtimeOwner` drops only `gtag.js`; the inline tag still
+ * queues the config call for the owner's copy to send.
+ */
 export declare function buildScriptTags(entry: ProviderScriptEntry): ScriptTagDescriptor[];
 /**
  * The default consent categories that gate an identifier-provider script when an

package/consent/script-snippets.js

@@ -186,6 +186,9 @@ function isXEventIdForPixel({
 }
 function buildScriptTags(entry) {
   const tags = PROVIDER_SNIPPETS[entry.type].buildTags(entry.identifier, entry);
+  if (entry.type === "GA4" && entry.runtimeOwner) {
+    return tags.filter((tag) => tag.kind !== "external");
+  }
   if (entry.type === "X") {
     const pageViewId = entry.events?.pageView?.trim();
     if (pageViewId && isXEventIdForPixel({ eventId: pageViewId, pixelId: entry.identifier })) {

package/consent/types.d.ts

@@ -23,16 +23,36 @@ export type XPixelEvents = {
     startCheckout?: string;
     purchase?: string;
 };
+/**
+ * Another loader owns GA4's `gtag.js`. The SDK keeps `dataLayer`, the config
+ * call and the analytics sink but never injects `gtag.js`, so if the GTM
+ * container (or other code) stops loading it, events queue and never send.
+ */
+export type ScriptRuntimeOwner = {
+    type: "gtm";
+    containerId: string;
+} | {
+    type: "external";
+};
 export type MixpanelRegion = "us" | "eu" | "in";
 export type ReploScriptEntry = {
-    type: "GA4" | "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot" | "Cookiebot";
+    type: "GoogleTagManager" | "Meta" | "TikTok" | "Pinterest" | "Reddit" | "Snapchat" | "Hotjar" | "MicrosoftClarity" | "Contentsquare" | "Segment" | "Northbeam" | "Gorgias" | "Converge" | "HubSpot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
+} | {
+    type: "GA4";
     identifier: string;
     requiredConsent?: ConsentCategory[];
+    runtimeOwner?: ScriptRuntimeOwner;
 } | {
     type: "X";
     identifier: string;
     events?: XPixelEvents;
     requiredConsent?: ConsentCategory[];
+} | {
+    type: "Cookiebot";
+    identifier: string;
+    requiredConsent?: ConsentCategory[];
 } | {
     type: "Mixpanel";
     identifier: string;
@@ -42,6 +62,7 @@ export type ReploScriptEntry = {
     type: "snippet";
     id: string;
     body: string;
+    module?: boolean;
     requiredConsent: ConsentCategory[];
 } | {
     type: "custom";

package/lib/buildMetadata.js

@@ -1,7 +1,7 @@
 export const BUILD_METADATA = {
   "packageName": "@replohq/sdk",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "branch": "HEAD",
-  "commit": "0f7d0830fdc9d0b6c299ee8b9497a749d41aee95",
-  "builtAt": "2026-10-21T20:51:42.391Z"
+  "commit": "f408d4d2ca21640258e7b9a8d20c5a92515cf9d6",
+  "builtAt": "2026-10-22T19:30:37.074Z"
 };

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@replohq/sdk",
-  "version": "2.3.0",
+  "version": "2.5.0",
   "reploBuild": {
     "packageName": "@replohq/sdk",
-    "version": "2.3.0",
+    "version": "2.5.0",
     "branch": "HEAD",
-    "commit": "0f7d0830fdc9d0b6c299ee8b9497a749d41aee95",
-    "builtAt": "2026-10-21T20:51:42.391Z"
+    "commit": "f408d4d2ca21640258e7b9a8d20c5a92515cf9d6",
+    "builtAt": "2026-10-22T19:30:37.074Z"
   },
   "description": "Replo SDK — cart, analytics, and data loaders for agent-built Next.js sites.",
   "license": "SEE LICENSE IN LICENSE",