Consent and scripts

ReploScripts injects managed scripts and gates each one on consent. You edit the script array, and never hand-write <script> tags for managed scripts. @replohq/sdk/consent/replo-scripts

`ReploScripts`

The single registry component for all managed tracking scripts on the site. Authored once in app/layout.tsx; the agent/miniapp only edit the scripts array. Each entry registers itself and is gated + injected per consent. A consent-platform entry (Cookiebot, Usercentrics, or a generic consentPlatform) takes over consent site-wide: scripts carry the platform’s blocking attributes, its loader injects after them so its startup scan sees the full set, and Replo’s own gates follow the platform instead of the native banner. A GA4 entry’s runtimeOwner leaves gtag.js to a GTM container or other loader, which must keep loading it; dataLayer, config and sink still start. A Usercentrics entry’s leaves the platform’s loader to it the same way, and a GTM owner’s container runs without waiting for consent.

import { ReploScripts } from "@replohq/sdk/consent/replo-scripts";

ReploScripts: ({ scripts }: { scripts: ReploScriptEntry[]; }) => JSX.Element

Also exported

Export	Kind	Type
`InjectedScript`	component	`({ baseId, descriptors, requiredConsent, usercentricsService, }: InjectedScriptProps) => null`

@replohq/sdk/consent/consent-store

`ConsentState`

Framework-agnostic, cookie-backed consent store. Lives as a single module singleton so ReploScripts, the site’s consent banner, and AnalyticsProvider all share the same state regardless of where they sit in the React tree — no provider-ancestor relationship is required. SSR and the first hydration render use a mode: "off" snapshot, which allows every category under native consent. Irreversible consent work must wait for client hydration, when the cookie-backed snapshot is available. The whole-site mode comes from data-replo-consent-mode on <html>.

import type { ConsentState } from "@replohq/sdk/consent/consent-store";

Field	Type	Required	Description
`categories`	`ConsentCategories`	Yes
`cmp`	`"cookiebot" \| "usercentrics" \| "replo" \| "external"`	No	Which platform owns consent. Absent means Replo’s native banner; “external” is a generic `consentPlatform` entry.
`consentId`	`string`	No	Persistent pseudonymous per-browser id linking a visitor’s consent history. Absent until the first `commit()` (and on legacy pre-id cookies, until the next interaction lazily backfills it).
`decidedAt`	`number`	Yes	Epoch ms when the visitor last made a choice, or null if undecided.
`grantedUsercentricsServices`	`string[]`	No	Usercentrics only: the services granted right now, including essentials that are granted automatically.
`mode`	`ConsentMode`	Yes

`isConsentAllowed`

Whether a script requiring requiredConsent may load now. mode === "off" allows everything only under Replo’s banner; a delegated CMP answers instead. On Usercentrics a gated script names its service, or null for none, and only that service releases it. Omitting it means no one script: follow categories.

import { isConsentAllowed } from "@replohq/sdk/consent/consent-store";

isConsentAllowed: ({ state, requiredConsent, usercentricsService, }: { state: ConsentState; requiredConsent: ConsentCategory[]; usercentricsService?: string | null; }) => boolean

Also exported

Export	Kind	Type
`consentStore`	function	`{ getSnapshot(): ConsentState; getServerSnapshot(): ConsentState; subscribe(listener: () => void): () => void; accept(options?: { policyVersion?: number; }): void; reject(options?: { policyVersion?: number; }): void; updateCategories({ next, policyVersion, }: { next: Partial<ConsentCategories>; policyVersion?: number; }): void; reset(): void; }`
`useConsent`	hook	`(options?: UseConsentOptions) => UseConsentResult`
`UseConsentOptions`	type	`{ version?: number }`
`UseConsentResult`	type	`{ accept: () => void; categories: ConsentCategories; cmp?: "cookiebot" \| "usercentrics" \| "replo" \| "external"; consentId?: string; decidedAt: number; grantedUsercentricsServices?: string[]; mode: ConsentMode; reject: () => void; updateCategories: (next: Partial<ConsentCategories>) => void }`

@replohq/sdk/consent/types

`ScriptRuntimeOwner`

Another loader owns GA4’s gtag.js or the Usercentrics loader. On GA4 the SDK keeps dataLayer, the config call and the analytics sink but never injects gtag.js, so if the GTM container (or other code) stops loading it, events queue and never send. On Usercentrics the SDK still blocks scripts and follows the visitor’s answer, so if nothing loads it, gated scripts stay off.

import type { ScriptRuntimeOwner } from "@replohq/sdk/consent/types";

ScriptRuntimeOwner: { type: "gtm"; containerId: string; } | { type: "external"; }

Also exported

Export	Kind	Type
`ConsentCategory`	type	`"necessary" \| "analytics" \| "marketing" \| "preferences" \| "sale_of_data"`
`ConsentMode`	type	`"off" \| "simple" \| "per-category"`
`MixpanelRegion`	type	`"us" \| "eu" \| "in"`
`ReploScriptEntry`	type	—
`ReploScriptType`	type	`"Cookiebot" \| "Usercentrics" \| "consentPlatform" \| "GoogleTagManager" \| "Meta" \| "TikTok" \| "Pinterest" \| "Reddit" \| "Snapchat" \| "Hotjar" \| "MicrosoftClarity" \| "Contentsquare" \| "Segment" \| "Northbeam" \| "Gorgias" \| "Converge" \| "HubSpot" \| "Attentive" \| "Alia" \| "GA4" \| "X" \| "Mixpanel" \| "snippet" \| "custom"`
`ScriptTagDescriptor`	type	`{ kind: "external"; src: string; attributes?: { [x: string]: string; }; } \| { kind: "inline"; body: string; }`
`XPixelEvents`	type	`{ pageView?: string; productViewed?: string; addToCart?: string; startCheckout?: string; purchase?: string; }`

Git

Replo SDK

Full SDK Reference

Consent and scripts

`ReploScripts`

`ConsentState`

`isConsentAllowed`

`ScriptRuntimeOwner`

​consent/replo-scripts

​ReploScripts

​consent/consent-store

​ConsentState

​isConsentAllowed

​consent/types

​ScriptRuntimeOwner

`consent/replo-scripts`

`ReploScripts`

`consent/consent-store`

`ConsentState`

`isConsentAllowed`

`consent/types`

`ScriptRuntimeOwner`