npm package: @gocharles/axeptio-then-segment
Description: Axeptio CMP + Segment analytics.js bootstrap with Google Consent Mode defaults
Latest version: 3.0.5

# @gocharles/axeptio-then-segment

Axeptio (CMP) + Segment (`analytics.js` 4.x snippet) + Google Consent Mode defaults (`denied` until the CMP completes).

Segment loads **after-cookies-choice**: `analytics.min.js` is injected after Axeptio emits `cookies:complete` (user accepts or refuses). Consent categories and Google Consent Mode are attached on each Segment payload via source middleware.

## Consumption (public npm)

Published as **[@gocharles/axeptio-then-segment](https://www.npmjs.com/package/@gocharles/axeptio-then-segment)** on the public registry. No `.npmrc` or token is required to **install**.

### Apps with a bundler (Vite, Gatsby, webpack, etc.)

```bash
npm install @gocharles/axeptio-then-segment
```

```ts
import { initAxeptioThenSegment } from '@gocharles/axeptio-then-segment'
```

CommonJS:

```js
const { initAxeptioThenSegment } = require('@gocharles/axeptio-then-segment')
```

Types are included (`dist/index.d.ts`). Pin a semver range in `package.json` (e.g. `^3.0.0` vs exact version).

### Browser only (no build step)

Load the IIFE from a **CDN that mirrors npm** (path inside the package: `dist/axeptio-then-segment.iife.min.js`).

**jsDelivr** (pin the version in production):

```text
https://cdn.jsdelivr.net/npm/@gocharles/axeptio-then-segment@3.0.0/dist/axeptio-then-segment.iife.min.js
```

**unpkg** (equivalent):

```text
https://unpkg.com/@gocharles/axeptio-then-segment@3.0.0/dist/axeptio-then-segment.iife.min.js
```

Then call the global (same options as `initAxeptioThenSegment`):

```html
<script src="https://cdn.jsdelivr.net/npm/@gocharles/axeptio-then-segment@3.0.0/dist/axeptio-then-segment.iife.min.js" crossorigin="anonymous"></script>
<script>
  AxeptioThenSegment.init({
    axeptioClientId: '…',
    segmentWriteKey: '…',
    cookiesVersion: '…',
    trackInitialPageView: true,
  })
</script>
```

Using `@latest` in the URL is possible but any new publish will immediately affect that URL; prefer a fixed version for production pages.

### Alternatives

- **GitHub Release asset** (attached by CI on each version tag):
  `https://github.com/gocharles/axeptio-then-segment/releases/latest/download/axeptio-then-segment.iife.min.js`
  or a pinned URL under `releases/download/vX.Y.Z/…`.

## API

- **`cookiesVersion`** (required) — Axeptio cookies / project configuration identifier from your Axeptio back-office.
- **`trackInitialPageView`** (optional) — queue `analytics.page()` when Segment first loads after the CMP completes (common on static HTML hosts).

## Local build

```bash
npm ci
npm run build
```

| Output | Role |
|--------|------|
| `dist/index.mjs`, `dist/index.js` | ESM / CJS |
| `dist/index.d.ts` | Types |
| `dist/axeptio-then-segment.iife.min.js` | Script tag / CDN |

## Examples

See [`examples/`](examples/README.md).

## Publishing (maintainers)

### Automated (GitHub Actions)

1. In the GitHub repo **Settings → Secrets and variables → Actions**, add **`NPM_TOKEN`**: an [npm access token](https://docs.npmjs.com/creating-and-access-tokens) able to publish **`@gocharles/axeptio-then-segment`** (e.g. **Automation** token, or **Granular** with **Read and write** on this package and **Bypass 2FA** if your account uses 2FA).
2. Ensure **`version`** in `package.json` matches the release you are about to tag.
3. Push a tag: `git tag v3.0.0 && git push origin v3.0.0` (same version as in `package.json`, with a `v` prefix).

The [release workflow](.github/workflows/release.yml) runs **`npm publish --access public`** and creates a GitHub Release with the IIFE attached.

### Manual

```bash
npm login
npm publish --access public
```

(`prepublishOnly` runs `npm run build` automatically.)

### `403 Forbidden` — “Two-factor authentication or granular access token with bypass 2fa…”

npm **blocks publish** unless either:

1. **You pass a one-time code** (account with 2FA enabled):

   ```bash
   npm publish --access public --otp=123456
   ```

   Replace `123456` with the current code from your authenticator app (valid for a short time).

2. **CI / token** — use an **Automation** token, or a **Granular** token with **Read and write** on `@gocharles/axeptio-then-segment` and **Bypass 2FA** enabled (npm recommends [Trusted Publishing](https://docs.npmjs.com/trusted-publishers) long term).

Also ensure your npm user is a **member of the `@gocharles` org** with permission to publish this package.