@chordcommerce/analytics 1.21.1 → 1.21.2

package/README.md

@@ -168,15 +168,34 @@ This package uses [semantic-release](https://github.com/semantic-release/semanti
 
 ### How it works
 
+The repo has a single CI workflow (`.github/workflows/ci.yml`) with two jobs:
+
+1. **`test`** — Runs lint, prettier, build, and tests for all packages. Triggers on every push to `main`/`beta` and on every pull request.
+2. **`release`** — Runs only on `main` and `beta` branches, after `test` passes. Runs `semantic-release` to determine if a new version should be published.
+
+The release flow:
+
 1. Merge a PR into `main` (stable) or `beta` (pre-release).
-2. The **Test** GitHub Actions workflow runs.
-3. On success, the **Semantic Release** workflow runs automatically.
-4. `semantic-release` analyzes commit messages since the last release and determines the version bump.
-5. The package is published to npm and GitHub Packages, CHANGELOG.md is updated, and a Git tag is created.
+2. The `test` job runs. If it passes, the `release` job starts.
+3. `semantic-release` analyzes commit messages since the last release tag.
+4. If releasable commits exist, the package is published to npm and GitHub Packages, CHANGELOG.md is updated, and a Git tag is created.
+5. If no releasable commits exist, `semantic-release` exits cleanly and nothing is published.
+
+### PR titles must follow conventional commits
+
+When using GitHub's **squash merge** (the default), the PR title becomes the first line of the squash commit message. Semantic-release only parses the **first line** to determine the version bump, so **the PR title must use a conventional commit prefix** (e.g., `fix: resolve consent race condition`). Individual commit messages in the PR body are ignored.
+
+If the PR title does not start with a releasable prefix, no release will be published even if the individual commits within the PR use `fix:` or `feat:`.
+
+### When a release happens (and when it doesn't)
 
-### Commit message conventions
+A release is published **only** when all three conditions are met:
 
-This repo enforces [Conventional Commits](https://www.conventionalcommits.org/) via commitlint. The commit message prefix determines the version bump:
+1. A push lands on `main` or `beta` (via merged PR or direct push)
+2. Tests pass
+3. There are new commits since the last release tag with a releasable prefix (checked against the **first line** of each commit message)
+
+**Releasable commit prefixes** (these trigger a version bump):
 
 | Prefix                     | Version Bump          | Example                                                   |
 | -------------------------- | --------------------- | --------------------------------------------------------- |
@@ -184,19 +203,35 @@ This repo enforces [Conventional Commits](https://www.conventionalcommits.org/)
 | `feat:`                    | Minor (1.0.0 → 1.1.0) | `feat: add trackOrderCompleted method`                    |
 | `BREAKING CHANGE:` in body | Major (1.0.0 → 2.0.0) | Commit body contains `BREAKING CHANGE: remove legacy API` |
 
-Other prefixes (`chore:`, `ci:`, `docs:`, `refactor:`, `test:`, etc.) do **not** trigger a release.
+**Non-releasable prefixes** (these do NOT trigger a release):
+
+`chore:`, `ci:`, `docs:`, `refactor:`, `test:`, `style:`, `build:`, `perf:`
+
+If a merge to `main` or `beta` contains only non-releasable commits, the release job runs but `semantic-release` determines no release is needed and exits without publishing.
 
 ### Monorepo scoping
 
-This repo uses [semantic-release-monorepo](https://github.com/pmowrer/semantic-release-monorepo) to scope releases to individual packages. Only commits that touch files within a package's directory (e.g., `packages/core/`) are considered when determining the next version. Commits that only modify root-level files like `.github/workflows/`, `.nvmrc`, or other packages will not trigger a release for this package.
+This repo uses [semantic-release-monorepo](https://github.com/pmowrer/semantic-release-monorepo) to scope releases to individual packages. Only commits that touch files within a package's directory (e.g., `packages/core/`) are considered when determining the next version. A `feat:` commit that only modifies `.github/workflows/` or another package's directory will **not** trigger a release for `@chordcommerce/analytics`.
 
 ### Pre-releases
 
-Merging to `beta` creates pre-release versions (e.g., `1.21.0-beta.1`). Use this for testing before promoting to `main`.
+Merging to `beta` creates pre-release versions (e.g., `1.22.0-beta.1`). Use this for testing before promoting to `main`. Only `main` and `beta` are currently configured for automatic releases in the CI workflow. Additional prerelease branches (e.g., `alpha`) can be enabled by adding them to both the workflow's branch filter in `ci.yml` and the semantic-release branch config.
+
+### Beta release workflow
+
+1. Create a feature branch off `beta` and do your work.
+2. Create a PR targeting the `beta` branch and merge it.
+3. The CI workflow runs tests, then `semantic-release` publishes a beta version (e.g., `1.22.0-beta.1`).
+4. Install with: `npm install @chordcommerce/analytics@beta`
+
+### Promoting beta to production
+
+1. Create a PR from `beta` → `main` and merge it.
+2. The CI workflow runs tests, then `semantic-release` publishes a stable version on `main`.
 
 ### Dry run
 
-You can preview what a release would do without publishing by manually triggering the Semantic Release workflow in GitHub Actions with `dryRun` set to `true`.
+You can preview what a release would do without publishing by manually triggering the CI workflow in GitHub Actions with `dryRun` set to `true`.
 
 ## Support
 

package/dist/cjs/client/cdp.js

@@ -80,15 +80,9 @@ var addCdpSnippet = function (options) { return __awaiter(void 0, void 0, void 0
                 _a.sent();
                 initialConsent = null;
                 if (!options.consent) return [3 /*break*/, 3];
-                if (options.debug && options.enableLogging) {
-                    console.log('[Chord Analytics DEBUG]: Setting up consent management');
-                }
                 return [4 /*yield*/, (0, index_js_1.addCdpConsent)(options).init()];
             case 2:
                 initialConsent = _a.sent();
-                if (options.debug && options.enableLogging) {
-                    console.log('[Chord Analytics DEBUG]: Consent management setup complete');
-                }
                 _a.label = 3;
             case 3:
                 if (options.debug && options.enableLogging) {

package/dist/cjs/client/consent/index.js

@@ -152,7 +152,7 @@ var addCdpConsent = function (options) {
      * or null if consent setup failed or was blocked.
      */
     var init = function () { return __awaiter(void 0, void 0, void 0, function () {
-        var canBeTracked, result, error_1;
+        var canBeTracked, error_1;
         return __generator(this, function (_a) {
             switch (_a.label) {
                 case 0:
@@ -180,17 +180,10 @@ var addCdpConsent = function (options) {
                 case 2:
                     _a.trys.push([2, 4, , 5]);
                     return [4 /*yield*/, setupConsentManagement()];
-                case 3:
-                    result = _a.sent();
-                    if (options.debug && options.enableLogging) {
-                        console.log('[Chord Analytics DEBUG]: setupConsentManagement() returned:', JSON.stringify(result));
-                    }
-                    return [2 /*return*/, result];
+                case 3: return [2 /*return*/, _a.sent()];
                 case 4:
                     error_1 = _a.sent();
-                    if (options.debug && options.enableLogging) {
-                        console.error('[Chord Analytics DEBUG]: Error setting up consent management:', error_1);
-                    }
+                    console.error('Error setting up consent management:', error_1);
                     return [2 /*return*/, null];
                 case 5: return [2 /*return*/];
             }

package/dist/cjs/client/consent/onetrust-api.d.ts

@@ -71,6 +71,16 @@ export declare const getOneTrustActiveGroups: () => string | undefined;
  * getNormalizedActiveGroupIds() // ["C0001", "C0003"]
  */
 export declare const getNormalizedActiveGroupIds: () => string[];
+/**
+ * Check if OnetrustActiveGroups is populated with actual consent categories.
+ *
+ * OneTrust sets window.OnetrustActiveGroups after the API object is available,
+ * so this guards against a race condition where the API exists but consent
+ * categories have not yet been populated.
+ *
+ * @returns true if OnetrustActiveGroups is a non-empty string with at least one group ID
+ */
+export declare const hasActiveGroups: () => boolean;
 /**
  * Get all configured consent groups from OneTrust.
  *

package/dist/cjs/client/consent/onetrust-api.js

@@ -8,7 +8,7 @@
  * Modeled after analytics-next's onetrust-api.ts
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.coerceConsentModel = exports.getNormalizedCategories = exports.getAllGroups = exports.getNormalizedActiveGroupIds = exports.getOneTrustActiveGroups = exports.getOneTrustGlobal = exports.OtConsentModel = void 0;
+exports.coerceConsentModel = exports.getNormalizedCategories = exports.getAllGroups = exports.hasActiveGroups = exports.getNormalizedActiveGroupIds = exports.getOneTrustActiveGroups = exports.getOneTrustGlobal = exports.OtConsentModel = void 0;
 /**
  * OneTrust consent model types
  */
@@ -70,6 +70,19 @@ var getNormalizedActiveGroupIds = function () {
     return groups.trim().split(',').filter(Boolean);
 };
 exports.getNormalizedActiveGroupIds = getNormalizedActiveGroupIds;
+/**
+ * Check if OnetrustActiveGroups is populated with actual consent categories.
+ *
+ * OneTrust sets window.OnetrustActiveGroups after the API object is available,
+ * so this guards against a race condition where the API exists but consent
+ * categories have not yet been populated.
+ *
+ * @returns true if OnetrustActiveGroups is a non-empty string with at least one group ID
+ */
+var hasActiveGroups = function () {
+    return (0, exports.getNormalizedActiveGroupIds)().length > 0;
+};
+exports.hasActiveGroups = hasActiveGroups;
 /**
  * Get all configured consent groups from OneTrust.
  *

package/dist/cjs/client/consent/onetrust.js

@@ -63,7 +63,7 @@ var onetrustConsentAdapter = function (options) {
         },
         userCanBeTracked: userCanBeTracked,
         getCategories: function () { return (0, onetrust_api_js_1.getNormalizedCategories)(); },
-        isConsentReady: function () { return !!(0, onetrust_api_js_1.getOneTrustGlobal)(); },
+        isConsentReady: function () { return !!(0, onetrust_api_js_1.getOneTrustGlobal)() && (0, onetrust_api_js_1.hasActiveGroups)(); },
         getConsentModel: function () {
             var api = (0, onetrust_api_js_1.getOneTrustGlobal)();
             if (!api)

package/dist/client/cdp.js

@@ -44,13 +44,7 @@ export const addCdpSnippet = (options) => __awaiter(void 0, void 0, void 0, func
     yield cdpReadyPromise;
     let initialConsent = null;
     if (options.consent) {
-        if (options.debug && options.enableLogging) {
-            console.log('[Chord Analytics DEBUG]: Setting up consent management');
-        }
         initialConsent = yield addCdpConsent(options).init();
-        if (options.debug && options.enableLogging) {
-            console.log('[Chord Analytics DEBUG]: Consent management setup complete');
-        }
     }
     if (options.debug && options.enableLogging) {
         console.log('[Chord Analytics DEBUG]: CDP snippet added, initialConsent:', JSON.stringify(initialConsent));

package/dist/client/consent/index.js

@@ -121,17 +121,12 @@ export const addCdpConsent = (options) => {
                 return null;
             }
         }
+        // Set up consent management and wait for it to complete
         try {
-            const result = yield setupConsentManagement();
-            if (options.debug && options.enableLogging) {
-                console.log('[Chord Analytics DEBUG]: setupConsentManagement() returned:', JSON.stringify(result));
-            }
-            return result;
+            return yield setupConsentManagement();
         }
         catch (error) {
-            if (options.debug && options.enableLogging) {
-                console.error('[Chord Analytics DEBUG]: Error setting up consent management:', error);
-            }
+            console.error('Error setting up consent management:', error);
             return null;
         }
     });

package/dist/client/consent/onetrust-api.d.ts

@@ -71,6 +71,16 @@ export declare const getOneTrustActiveGroups: () => string | undefined;
  * getNormalizedActiveGroupIds() // ["C0001", "C0003"]
  */
 export declare const getNormalizedActiveGroupIds: () => string[];
+/**
+ * Check if OnetrustActiveGroups is populated with actual consent categories.
+ *
+ * OneTrust sets window.OnetrustActiveGroups after the API object is available,
+ * so this guards against a race condition where the API exists but consent
+ * categories have not yet been populated.
+ *
+ * @returns true if OnetrustActiveGroups is a non-empty string with at least one group ID
+ */
+export declare const hasActiveGroups: () => boolean;
 /**
  * Get all configured consent groups from OneTrust.
  *

package/dist/client/consent/onetrust-api.js

@@ -64,6 +64,18 @@ export const getNormalizedActiveGroupIds = () => {
         return [];
     return groups.trim().split(',').filter(Boolean);
 };
+/**
+ * Check if OnetrustActiveGroups is populated with actual consent categories.
+ *
+ * OneTrust sets window.OnetrustActiveGroups after the API object is available,
+ * so this guards against a race condition where the API exists but consent
+ * categories have not yet been populated.
+ *
+ * @returns true if OnetrustActiveGroups is a non-empty string with at least one group ID
+ */
+export const hasActiveGroups = () => {
+    return getNormalizedActiveGroupIds().length > 0;
+};
 /**
  * Get all configured consent groups from OneTrust.
  *

package/dist/client/consent/onetrust.js

@@ -1,4 +1,4 @@
-import { getOneTrustGlobal, getNormalizedCategories, coerceConsentModel, } from './onetrust-api.js';
+import { getOneTrustGlobal, getNormalizedCategories, coerceConsentModel, hasActiveGroups, } from './onetrust-api.js';
 /**
  * Returns whether the user can currently be tracked.
  * Uses duck typing to check if OneTrust is fully loaded.
@@ -60,7 +60,7 @@ export const onetrustConsentAdapter = (options) => {
         },
         userCanBeTracked,
         getCategories: () => getNormalizedCategories(),
-        isConsentReady: () => !!getOneTrustGlobal(),
+        isConsentReady: () => !!getOneTrustGlobal() && hasActiveGroups(),
         getConsentModel: () => {
             const api = getOneTrustGlobal();
             if (!api)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chordcommerce/analytics",
   "description": "Chord Commerce event tracking",
-  "version": "1.21.1",
+  "version": "1.21.2",
   "author": "Chord Commerce <help@chord.co> (https://www.chord.co)",
   "type": "module",
   "main": "dist/index.js",