Related Ticket

https://parcellab.atlassian.net/browse/REQ-6294

The bug

The React and Vue loaders registered a global window error listener for the whole duration of the parcelLab bundle download, and treated whatever it caught as a parcelLab load failure:

window.addEventListener("error", onScriptError);   // fires for ANY page error
container.appendChild(scriptEl);
...
function onLoadComplete() {
  cleanup();
  if (err) { reject(err); }   // <- unrelated error kills init

window's error event fires for every uncaught exception anywhere on the host page. On unisport.pl, Bazaarvoice threw not configured for the domain, our bundle then loaded perfectly well, and the loader threw it away — so initialize() was never called and Track & Trace never rendered. Nothing compared the event against our script.

Unisport is just the visible victim. Any customer running a third-party script that throws — analytics, chat, session replay, ad tags, A/B testing, cookie banners — is exposed to the same latent failure.

The fix

Delete the listener and lean on a signal that is already precise.

The plugin bundle publishes its global as its final statement (Object.defineProperty(window, "parcelLabTrackAndTrace", …)). A script that throws mid-execution still fires load, so the global being absent means our code failed — and nothing on the host page can cause it. v5 already had this check sitting unused next to the buggy one; v3 had none and now does.

Also fixed on the same path

Scope

All four loaders had the bug, not just the one named in the ticket: v3 and v5, React and Vue.

Tests

44 tests (vitest + jsdom), 19 of which fail against the previous code — so they genuinely pin the regression rather than just describing the new behaviour.

The suite covers, per loader: init survives an unrelated third-party error; no global error listener is registered at all; genuine failures (bundle loaded but global missing, script 404, timeout) still surface; bootstrap happens exactly once.

Because v3/ and v5/ are committed build artifacts that npm publishes, the tests also run against the built output, not just src/. And CI now rebuilds and fails if the committed artifacts have drifted from src/ — this repo's easiest mistake is fixing src/ and shipping nothing.

Reviewer notes

• The diff is large mostly because of package-lock.json and the regenerated Vue bundles. The behavioural change is the four files in src/.
• This repo has no npm release automation. Merging only redeploys the web component to the CDN; the React/Vue packages go to GitHub Packages via a manual npm publish. So merging this does not ship it to customers — someone has to publish. The published 1.0.6 dates from 2026-01-05 and main has moved since, so it's worth diffing before publishing.

Follow-ups, deliberately not in this PR

• react/react-dom/vue are peerDependencies without peerDependenciesMeta.optional, so since npm 7 a React-only customer gets Vue 3 installed for nothing.
• Multiple mounted instances still each inject their own <script>/<link>; no cross-instance dedupe.
• AC Configure Renovate #1 on the ticket (bootstrap telemetry) is not addressed — it needs a collection endpoint decision first, since a failed bootstrap means no plugin and therefore no existing reporting channel.

Test plan

• npm test — 44 passing
• Verified 19 tests fail when the sources are reverted to main
• Verified the build is byte-reproducible across runs, so the CI drift check is stable
• Confirmed no onScriptError and no eval( remain in any published artifact
• Smoke-test a real React storefront against a prerelease before publishing