@chordcommerce/analytics 1.22.0-beta.3 → 1.22.1-beta.1

package/dist/cjs/client/cdp.js

@@ -45,7 +45,7 @@ var utils_js_1 = require("./utils.js");
  * Returns initial consent configuration to be tracked after CDP is fully ready.
  */
 var addCdpSnippet = function (options) { return __awaiter(void 0, void 0, void 0, function () {
-    var normalizedCDPDomain, cdpReadyPromise, s, initialConsent;
+    var normalizedCDPDomain, cdpReadyPromise, escapedNamespace, existingScript, s, initialConsent;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -65,14 +65,20 @@ var addCdpSnippet = function (options) { return __awaiter(void 0, void 0, void 0
                     };
                     checkCdpReady();
                 });
-                s = document.createElement('script');
-                s.async = true;
-                s.src = "".concat(normalizedCDPDomain, "/p.js");
-                s.setAttribute('data-debug', "".concat(!!options.debug));
-                s.setAttribute('data-init-only', 'true');
-                s.setAttribute('data-namespace', "_".concat(options.namespace));
-                s.setAttribute('data-write-key', options.cdpWriteKey);
-                document.head.appendChild(s);
+                escapedNamespace = typeof CSS !== 'undefined' && typeof CSS.escape === 'function'
+                    ? CSS.escape("_".concat(options.namespace))
+                    : "_".concat(options.namespace);
+                existingScript = document.querySelector("script[data-namespace=\"".concat(escapedNamespace, "\"]"));
+                if (!existingScript) {
+                    s = document.createElement('script');
+                    s.async = true;
+                    s.src = "".concat(normalizedCDPDomain, "/p.js");
+                    s.setAttribute('data-debug', "".concat(!!options.debug));
+                    s.setAttribute('data-init-only', 'true');
+                    s.setAttribute('data-namespace', "_".concat(options.namespace));
+                    s.setAttribute('data-write-key', options.cdpWriteKey);
+                    document.head.appendChild(s);
+                }
                 // Wait for CDP to be ready before setting up consent
                 return [4 /*yield*/, cdpReadyPromise];
             case 1:

package/dist/cjs/client/index.d.ts

@@ -1,6 +1,5 @@
 import type { AnyAnalytics, EventProperties, Options, ValidateResult, ChordAnalyticsOptions, AnyOptions, CartViewedInput, IdentifyTraits, CheckoutStartedInput, CheckoutStepCompletedInput, CheckoutStepViewedInput, EmailCapturedInput, ProductListViewedInput, ProductListFilteredInput, ProductAddedInput, ProductClickedInput, VariantClickedInput, ProductRemovedInput, ProductViewedInput, ProductsSearchedInput, CouponAppliedInput, CouponDeniedInput, CouponEnteredInput, CouponRemovedInput, SignedInInput, SignedOutInput, SignedUpInput, LoginStartedInput, ObjectTypes, OrderCompletedInput, SubscriptionCancelledInput, NavigationClickedInput, PaymentInfoEnteredInput } from '../types/index.js';
 import { AnalyticsMiddleware } from '../types/client.js';
-import { type IdentifierSyncOptions, type ShopifyCart } from './identifiers.js';
 export interface ChordAnalyticsSnippet {
     _loadOptions: ChordAnalyticsOptions<ObjectTypes>;
     invoked: boolean;
@@ -170,18 +169,6 @@ export declare class ChordAnalytics<T extends ObjectTypes = ObjectTypes> {
      * @returns A cleanup function to remove the listener
      */
     setupWebPixelListener: () => (() => void);
-    /**
-     * Sync CDP anonymous ID and Google Client ID to Shopify cart attributes.
-     * This enables server-side events (webhooks) to correlate with client-side tracking.
-     *
-     * By default, syncs:
-     * - `_cdpAnonymousId`: from the `__eventn_id` cookie (Chord/Jitsu CDP)
-     * - `_googleClientId`: from the `_ga` cookie (Google Analytics)
-     *
-     * @param options - Optional configuration for the sync
-     * @returns The updated cart, or undefined if no update was needed or an error occurred
-     */
-    syncIdentifiersToCart: (options?: IdentifierSyncOptions) => Promise<ShopifyCart | undefined>;
     trackCartViewed: (props: CartViewedInput<T>, options?: AnyOptions) => Promise<void>;
     trackCheckoutStarted: (props: CheckoutStartedInput<T>, options?: AnyOptions) => Promise<void>;
     trackCheckoutStepCompleted: (props: CheckoutStepCompletedInput, options?: AnyOptions) => Promise<void>;

package/dist/cjs/client/index.js

@@ -61,7 +61,6 @@ var cdp_js_1 = require("./cdp.js");
 var index_js_1 = require("./consent/index.js");
 var index_js_2 = require("../validators/index.js");
 var utils_js_1 = require("../utils.js");
-var identifiers_js_1 = require("./identifiers.js");
 var DEBUG_MODE_STORAGE_KEY = 'chordcommerce/analytics/debug';
 var CONSENT_QUEUE_STORAGE_KEY = 'chordcommerce/analytics/consent-queue';
 var CONSENT_QUEUE_TTL_MS = 5 * 60 * 1000; // 5 minutes
@@ -70,7 +69,7 @@ var CONSENT_QUEUE_MAX_EVENTS = 50; // Max number of events to queue
 var ChordAnalytics = /** @class */ (function () {
     function ChordAnalytics(options) {
         var _this = this;
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d;
         /**
          * Allows snippet.js to detect whether this library has been initialized yet.
          */
@@ -825,6 +824,18 @@ var ChordAnalytics = /** @class */ (function () {
                     return;
                 if (event.data.source !== 'chord-web-pixel')
                     return;
+                // Validate origin — only accept messages from the same hostname or from
+                // null-origin sandboxed iframes (Shopify web pixel sandbox has origin "null")
+                try {
+                    if (event.origin && event.origin !== 'null') {
+                        var eventHostname = new URL(event.origin).hostname;
+                        if (eventHostname !== window.location.hostname)
+                            return;
+                    }
+                }
+                catch (_a) {
+                    return;
+                }
                 var message = event.data;
                 if (_this.options.enableLogging && _this.options.debug) {
                     // eslint-disable-next-line no-console
@@ -833,20 +844,26 @@ var ChordAnalytics = /** @class */ (function () {
                 try {
                     switch (message.type) {
                         case 'track': {
-                            var _a = message.payload, eventName = _a[0], properties = _a[1];
+                            var _b = message.payload, eventName = _b[0], properties = _b[1];
                             if (eventName) {
-                                _this.track(eventName, properties);
+                                Promise.resolve(_this.track(eventName, properties)).catch(function (err) {
+                                    return _this.logger('[Chord Analytics]: Error in web pixel track:', err);
+                                });
                             }
                             break;
                         }
                         case 'identify': {
-                            var _b = message.payload, userId = _b[0], traits = _b[1];
-                            _this.identify(userId, traits);
+                            var _c = message.payload, userId = _c[0], traits = _c[1];
+                            Promise.resolve(_this.identify(userId, traits)).catch(function (err) {
+                                return _this.logger('[Chord Analytics]: Error in web pixel identify:', err);
+                            });
                             break;
                         }
                         case 'page': {
                             var properties = message.payload[0];
-                            _this.page(properties);
+                            Promise.resolve(_this.page(undefined, properties)).catch(function (err) {
+                                return _this.logger('[Chord Analytics]: Error in web pixel page:', err);
+                            });
                             break;
                         }
                         default:
@@ -868,31 +885,6 @@ var ChordAnalytics = /** @class */ (function () {
                 }
             };
         };
-        /**
-         * Sync CDP anonymous ID and Google Client ID to Shopify cart attributes.
-         * This enables server-side events (webhooks) to correlate with client-side tracking.
-         *
-         * By default, syncs:
-         * - `_cdpAnonymousId`: from the `__eventn_id` cookie (Chord/Jitsu CDP)
-         * - `_googleClientId`: from the `_ga` cookie (Google Analytics)
-         *
-         * @param options - Optional configuration for the sync
-         * @returns The updated cart, or undefined if no update was needed or an error occurred
-         */
-        this.syncIdentifiersToCart = function (options) { return __awaiter(_this, void 0, void 0, function () {
-            var result;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, (0, identifiers_js_1.syncIdentifiersToCart)(options)];
-                    case 1:
-                        result = _a.sent();
-                        if (result) {
-                            this.logger('[Chord Analytics]: Identifiers synced to cart');
-                        }
-                        return [2 /*return*/, result];
-                }
-            });
-        }); };
         // TODO: Add support for props.products
         this.trackCartViewed = function (props, options) { return __awaiter(_this, void 0, void 0, function () {
             var cart, payload, formattedPayload;
@@ -1455,12 +1447,6 @@ var ChordAnalytics = /** @class */ (function () {
         if (shouldEnableWebPixel) {
             this.setupWebPixelListener();
         }
-        // Sync identifiers to cart: explicit true/false takes precedence,
-        // otherwise auto-detect by checking for window.Shopify.shop (Liquid storefront)
-        var shouldEnableIdentifierSync = (_f = (_e = this.options) === null || _e === void 0 ? void 0 : _e.enableIdentifierSync) !== null && _f !== void 0 ? _f : (typeof window !== 'undefined' && !!((_g = window.Shopify) === null || _g === void 0 ? void 0 : _g.shop));
-        if (shouldEnableIdentifierSync) {
-            this.syncIdentifiersToCart();
-        }
     }
     /**
      * Initialize CDP snippet and wait for it to be ready.

package/dist/cjs/index.d.ts

@@ -1,3 +1,2 @@
 export * from './client/index.js';
-export * from './client/identifiers.js';
 export * from './types/index.js';

package/dist/cjs/index.js

@@ -15,5 +15,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./client/index.js"), exports);
-__exportStar(require("./client/identifiers.js"), exports);
 __exportStar(require("./types/index.js"), exports);

package/dist/cjs/types/client.d.ts

@@ -34,20 +34,7 @@ export interface ChordAnalyticsOptions<T extends ObjectTypes = ObjectTypes> {
     awaitConsent?: boolean;
     debug?: boolean;
     enableLogging?: boolean;
-    /**
-     * Controls the postMessage listener for events from the Shopify Custom Web
-     * Pixel sandbox. Enabled by default in browser environments. The listener
-     * only processes messages with source === 'chord-web-pixel', so it is safe
-     * to leave enabled on non-Shopify sites. Set to false to explicitly disable.
-     */
     enableWebPixelListener?: boolean;
-    /**
-     * Controls syncing CDP anonymous ID and Google Client ID to Shopify cart
-     * attributes. When true, always enables sync. When false, always disables it.
-     * When undefined (default), auto-detects by checking for window.Shopify.shop
-     * which is present on Shopify Liquid storefronts.
-     */
-    enableIdentifierSync?: boolean;
     formatters: ChordAnalyticsFormatters<T>;
     namespace?: string;
     stripNull?: boolean;

package/dist/client/cdp.js

@@ -32,14 +32,21 @@ export const addCdpSnippet = (options) => __awaiter(void 0, void 0, void 0, func
         };
         checkCdpReady();
     });
-    const s = document.createElement('script');
-    s.async = true;
-    s.src = `${normalizedCDPDomain}/p.js`;
-    s.setAttribute('data-debug', `${!!options.debug}`);
-    s.setAttribute('data-init-only', 'true');
-    s.setAttribute('data-namespace', `_${options.namespace}`);
-    s.setAttribute('data-write-key', options.cdpWriteKey);
-    document.head.appendChild(s);
+    // Guard against duplicate script injection (e.g. React StrictMode remounts)
+    const escapedNamespace = typeof CSS !== 'undefined' && typeof CSS.escape === 'function'
+        ? CSS.escape(`_${options.namespace}`)
+        : `_${options.namespace}`;
+    const existingScript = document.querySelector(`script[data-namespace="${escapedNamespace}"]`);
+    if (!existingScript) {
+        const s = document.createElement('script');
+        s.async = true;
+        s.src = `${normalizedCDPDomain}/p.js`;
+        s.setAttribute('data-debug', `${!!options.debug}`);
+        s.setAttribute('data-init-only', 'true');
+        s.setAttribute('data-namespace', `_${options.namespace}`);
+        s.setAttribute('data-write-key', options.cdpWriteKey);
+        document.head.appendChild(s);
+    }
     // Wait for CDP to be ready before setting up consent
     yield cdpReadyPromise;
     let initialConsent = null;

package/dist/client/index.d.ts

@@ -1,6 +1,5 @@
 import type { AnyAnalytics, EventProperties, Options, ValidateResult, ChordAnalyticsOptions, AnyOptions, CartViewedInput, IdentifyTraits, CheckoutStartedInput, CheckoutStepCompletedInput, CheckoutStepViewedInput, EmailCapturedInput, ProductListViewedInput, ProductListFilteredInput, ProductAddedInput, ProductClickedInput, VariantClickedInput, ProductRemovedInput, ProductViewedInput, ProductsSearchedInput, CouponAppliedInput, CouponDeniedInput, CouponEnteredInput, CouponRemovedInput, SignedInInput, SignedOutInput, SignedUpInput, LoginStartedInput, ObjectTypes, OrderCompletedInput, SubscriptionCancelledInput, NavigationClickedInput, PaymentInfoEnteredInput } from '../types/index.js';
 import { AnalyticsMiddleware } from '../types/client.js';
-import { type IdentifierSyncOptions, type ShopifyCart } from './identifiers.js';
 export interface ChordAnalyticsSnippet {
     _loadOptions: ChordAnalyticsOptions<ObjectTypes>;
     invoked: boolean;
@@ -170,18 +169,6 @@ export declare class ChordAnalytics<T extends ObjectTypes = ObjectTypes> {
      * @returns A cleanup function to remove the listener
      */
     setupWebPixelListener: () => (() => void);
-    /**
-     * Sync CDP anonymous ID and Google Client ID to Shopify cart attributes.
-     * This enables server-side events (webhooks) to correlate with client-side tracking.
-     *
-     * By default, syncs:
-     * - `_cdpAnonymousId`: from the `__eventn_id` cookie (Chord/Jitsu CDP)
-     * - `_googleClientId`: from the `_ga` cookie (Google Analytics)
-     *
-     * @param options - Optional configuration for the sync
-     * @returns The updated cart, or undefined if no update was needed or an error occurred
-     */
-    syncIdentifiersToCart: (options?: IdentifierSyncOptions) => Promise<ShopifyCart | undefined>;
     trackCartViewed: (props: CartViewedInput<T>, options?: AnyOptions) => Promise<void>;
     trackCheckoutStarted: (props: CheckoutStartedInput<T>, options?: AnyOptions) => Promise<void>;
     trackCheckoutStepCompleted: (props: CheckoutStepCompletedInput, options?: AnyOptions) => Promise<void>;