From 613d8de14ab078f94084840e26b322b7f562af83 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 14:24:28 -0500
Subject: [PATCH 01/56] wip

---
 .github/workflows/ci.yml                      |   8 -
 .vscode/launch.json                           |   2 +-
 packages/browser/src/core/analytics/index.ts  |   6 +-
 packages/browser/src/index.ts                 |   6 +-
 .../consent-tools-integration-tests/README.md |   9 +
 .../public/consent-tools-vanilla-opt-out.html |  10 +
 .../public/consent-tools-vanilla.html         |   6 +-
 .../public/onetrust.html                      |   4 +-
 .../consent-tools-vanilla-opt-out/index.ts    |  17 +
 .../consent-tools-vanilla/index.ts            |  17 +-
 .../page-bundles/helpers/mock-cmp-wrapper.ts  |  21 +
 .../src/page-bundles/helpers/mock-cmp.ts      | 110 +++++
 .../src/page-objects/base-page.ts             |  67 ++-
 .../src/page-objects/consent-tools-vanilla.ts |  19 +-
 .../src/page-objects/onetrust.ts              |  18 -
 .../consent-tools-vanilla-opt-out.test.ts     |  60 +++
 .../src/tests/consent-tools-vanilla.test.ts   |  33 +-
 .../src/tests/onetrust.test.ts                |  17 +-
 .../wdio.conf.local.ts                        |  20 +-
 .../domain/__tests__/consent-stamping.test.ts |   5 +-
 .../domain/__tests__/create-wrapper.test.ts   | 202 ++-------
 .../domain/__tests__/disable-segment.test.ts  |   2 +-
 .../__tests__/analytics-service.test.ts       | 393 ++++++++++++++++--
 .../src/domain/analytics/analytics-service.ts | 102 +++--
 .../src/domain/blocking-helpers.ts            | 118 ++++++
 .../src/domain/blocking-middleware.ts         |  81 ++++
 .../src/domain/config-helpers.ts              |  22 +
 .../src/domain/consent-stamping.ts            |  15 +-
 .../src/domain/create-wrapper.ts              | 183 +++-----
 .../src/domain/disable-segment.ts             |  18 -
 .../src/domain/load-cancellation.ts           |  31 --
 .../consent-tools/src/domain/load-context.ts  |  81 ++++
 .../consent-tools/src/domain/logger.ts        |  20 +
 .../src/domain/pruned-categories.ts           |  37 +-
 .../domain/validation/options-validators.ts   |   6 +-
 .../src/test-helpers/mocks/analytics-mock.ts  |   2 +-
 .../consent-tools/src/types/settings.ts       |  13 +-
 .../consent-tools/src/types/wrapper.ts        |  59 ++-
 .../src/domain/__tests__/wrapper.test.ts      |  19 +-
 .../src/domain/consent-model.ts               |  15 +
 .../src/domain/wrapper.ts                     |  24 +-
 .../src/lib/onetrust-api.ts                   |  11 +
 .../src/test-helpers/mocks.ts                 |  24 +-
 .../pages/index-consent-opt-out.html          | 201 +++++++++
 .../pages/index-consent.html                  |   7 +-
 45 files changed, 1566 insertions(+), 575 deletions(-)
 create mode 100644 packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html
 create mode 100644 packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts
 create mode 100644 packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts
 create mode 100644 packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
 create mode 100644 packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
 create mode 100644 packages/consent/consent-tools/src/domain/blocking-helpers.ts
 create mode 100644 packages/consent/consent-tools/src/domain/blocking-middleware.ts
 create mode 100644 packages/consent/consent-tools/src/domain/config-helpers.ts
 delete mode 100644 packages/consent/consent-tools/src/domain/disable-segment.ts
 delete mode 100644 packages/consent/consent-tools/src/domain/load-cancellation.ts
 create mode 100644 packages/consent/consent-tools/src/domain/load-context.ts
 create mode 100644 packages/consent/consent-tools/src/domain/logger.ts
 create mode 100644 packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
 create mode 100644 playgrounds/standalone-playground/pages/index-consent-opt-out.html

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e27e2ab49..e3a49f5f3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,18 +54,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-
       - uses: browser-actions/setup-chrome@v1
       - uses: actions/setup-node@v3
         with:
           node-version: 16
           cache: 'yarn'
       - run: yarn install --immutable
-      - name: Turbo cache
-        uses: actions/cache@v3
-        with:
-          path: node_modules/.cache/turbo
-          key: ${{ runner.os }}-turbo-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-turbo-
       - run: yarn turbo run --filter='consent-tools-integration-tests' test:int
diff --git a/.vscode/launch.json b/.vscode/launch.json
index 248b1f89d..d4571ebbb 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -48,7 +48,7 @@
       "internalConsoleOptions": "neverOpen",
       "program": "${workspaceFolder}/node_modules/jest/bin/jest",
       "skipFiles": [
-        "<node_internals>/**"
+        "<node_internals>/**" 
       ]
     },
     {
diff --git a/packages/browser/src/core/analytics/index.ts b/packages/browser/src/core/analytics/index.ts
index a7675c131..f66a20d1e 100644
--- a/packages/browser/src/core/analytics/index.ts
+++ b/packages/browser/src/core/analytics/index.ts
@@ -64,14 +64,14 @@ const global: any = getGlobal()
 const _analytics = global?.analytics
 
 function createDefaultQueue(
-  name: string,
+  writeKey: string,
   retryQueue = false,
   disablePersistance = false
 ) {
   const maxAttempts = retryQueue ? 10 : 1
   const priorityQueue = disablePersistance
     ? new PriorityQueue(maxAttempts, [])
-    : new PersistedPriorityQueue(maxAttempts, name)
+    : new PersistedPriorityQueue(maxAttempts, `${writeKey}:event-queue`)
   return new EventQueue(priorityQueue)
 }
 
@@ -184,7 +184,7 @@ export class Analytics
     this.queue =
       queue ??
       createDefaultQueue(
-        `${settings.writeKey}:event-queue`,
+        settings.writeKey,
         options?.retryQueue,
         disablePersistance
       )
diff --git a/packages/browser/src/index.ts b/packages/browser/src/index.ts
index fdd552aa8..26a3987a4 100644
--- a/packages/browser/src/index.ts
+++ b/packages/browser/src/index.ts
@@ -8,6 +8,10 @@ export * from './core/plugin'
 export * from './core/user'
 
 export type { AnalyticsSnippet } from './browser/standalone-interface'
-export type { MiddlewareFunction } from './plugins/middleware'
+export type {
+  MiddlewareFunction,
+  DestinationMiddlewareFunction,
+  MiddlewareParams,
+} from './plugins/middleware'
 export { getGlobalAnalytics } from './lib/global-analytics-helper'
 export { UniversalStorage, Store, StorageObject } from './core/storage'
diff --git a/packages/consent/consent-tools-integration-tests/README.md b/packages/consent/consent-tools-integration-tests/README.md
index 65e606551..ad5181ac2 100644
--- a/packages/consent/consent-tools-integration-tests/README.md
+++ b/packages/consent/consent-tools-integration-tests/README.md
@@ -18,3 +18,12 @@ Why is this using wd.io instead of playwright?
 ```
 yarn . test:int
 ```
+
+### Debugging Tips:
+- Webdriver.io has the handy `browser.debug()` command.
+
+- You can serve the static pages by themselves (without webdriver.io) with the following:
+```
+yarn webpack -w &
+npx live-server .
+```
diff --git a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html
new file mode 100644
index 000000000..a17c8329a
--- /dev/null
+++ b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html lang="en">
+
+<body>
+  <h1>Hello World - Serving Analytics (Consent Tools Vanilla Opt Out)</h1>
+  <h2>Please Check Network tab</h2>
+  <p>This page can used as playground or run by webdriver.io</p>
+  <script src="/public/dist/consent-tools-vanilla-opt-out.bundle.js"></script>
+</body>
+
diff --git a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html
index b7ba6dcc3..997fa47ed 100644
--- a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html
+++ b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html
@@ -1,14 +1,10 @@
 <!DOCTYPE html>
 <html lang="en">
 
-<head>
-  <script src="dist/consent-tools-vanilla.bundle.js"></script>
-</head>
-
 <body>
   <h1>Hello World - Serving Analytics</h1>
   <h2>Please Check Network tab</h2>
   <p>This page can used as playground or run by webdriver.io</p>
+  <script src="/public/dist/consent-tools-vanilla.bundle.js"></script>
 </body>
 
-</html>
diff --git a/packages/consent/consent-tools-integration-tests/public/onetrust.html b/packages/consent/consent-tools-integration-tests/public/onetrust.html
index 4bed046ee..11065d04e 100644
--- a/packages/consent/consent-tools-integration-tests/public/onetrust.html
+++ b/packages/consent/consent-tools-integration-tests/public/onetrust.html
@@ -5,7 +5,7 @@
   <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript" charset="UTF-8"
     data-domain-script="80ca7b5c-e72f-4bd0-972a-b74d052a0820-test"></script>
 
-  <script src="/@segment/analytics-consent-wrapper-onetrust/dist/umd/analytics-onetrust.umd.js"></script>
+  <script src="/node_modules/@segment/analytics-consent-wrapper-onetrust/dist/umd/analytics-onetrust.umd.js"></script>
 
   <script>
     !(function () {
@@ -55,7 +55,7 @@
             var t = document.createElement('script')
             t.type = 'text/javascript'
             t.async = !0
-            t.src = '/@segment/analytics-next/dist/umd/standalone.js' // modified
+            t.src = '/node_modules/@segment/analytics-next/dist/umd/standalone.js' // modified
             var n = document.getElementsByTagName('script')[0]
             n.parentNode.insertBefore(t, n)
             analytics._loadOptions = e
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts
new file mode 100644
index 000000000..7734721bc
--- /dev/null
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts
@@ -0,0 +1,17 @@
+import { AnalyticsBrowser } from '@segment/analytics-next'
+import { initMockConsentManager } from '../helpers/mock-cmp'
+import { withMockCMP } from '../helpers/mock-cmp-wrapper'
+
+initMockConsentManager({
+  isOptIn: false,
+})
+
+const analytics = new AnalyticsBrowser()
+
+withMockCMP(analytics).load(
+  {
+    writeKey: '9lSrez3BlfLAJ7NOChrqWtILiATiycoc',
+  },
+  { initialPageview: true }
+)
+;(window as any).analytics = analytics
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
index f04602e81..da3a88cc6 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
@@ -1,17 +1,14 @@
 import { AnalyticsBrowser } from '@segment/analytics-next'
-import { createWrapper } from '@segment/analytics-consent-tools'
+import { initMockConsentManager } from '../helpers/mock-cmp'
+import { withMockCMP } from '../helpers/mock-cmp-wrapper'
 
-const fakeCategories = { FooCategory1: true, FooCategory2: true }
-
-const withCMP = createWrapper({
-  getCategories: () => fakeCategories,
-})
+initMockConsentManager({ isOptIn: true })
 
 const analytics = new AnalyticsBrowser()
 
-withCMP(analytics).load({
-  writeKey: 'foo',
-})
-
 // for testing
 ;(window as any).analytics = analytics
+
+withMockCMP(analytics).load({
+  writeKey: 'foo',
+})
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts
new file mode 100644
index 000000000..342c20fbe
--- /dev/null
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts
@@ -0,0 +1,21 @@
+import { createWrapper, resolveWhen } from '@segment/analytics-consent-tools'
+
+export const withMockCMP = (analyticsInstance: any) =>
+  createWrapper({
+    enableDebugLogging: true,
+    shouldLoadWrapper: async () => {
+      await resolveWhen(() => window.MockCMP.isLoaded, 500)
+    },
+    getCategories: () => window.MockCMP.getCategories(),
+    registerOnConsentChanged: (fn) => {
+      window.MockCMP.onConsentChange(fn)
+    },
+    shouldLoadSegment: async (ctx) => {
+      if (!window.MockCMP.isOptIn) {
+        // if opt out, load immediately
+        return ctx.load({ optIn: false })
+      }
+      await window.MockCMP.waitForAlertBoxClose()
+      ctx.load({ optIn: true })
+    },
+  })(analyticsInstance)
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
new file mode 100644
index 000000000..faef9c748
--- /dev/null
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
@@ -0,0 +1,110 @@
+const constants = {
+  giveConsentId: 'give-consent',
+  denyConsentId: 'deny-consent',
+}
+export type MockConsentManager = ReturnType<typeof initMockConsentManager>
+
+declare global {
+  interface Window {
+    MockCMP: MockConsentManager
+  }
+}
+type ConsentChangeFn = (categories: Record<string, boolean>) => void
+
+/**
+ * This is a mock consent manager that simulates a consent manager that is loaded asynchronously.
+ * Similar to OneTrust, TrustArc, etc.
+ * sets a global `window.MockCMP` object that can be used to interact with the mock consent manager.
+ */
+export const initMockConsentManager = (settings: { isOptIn: boolean }) => {
+  // if opt-in is true, all categories are set to true by default
+  let categories = {
+    FooCategory1: settings.isOptIn,
+    FooCategory2: settings.isOptIn,
+  }
+  console.log('initMockConsentManager', settings.isOptIn, categories)
+  let onConsentChange = (_categories: Record<string, boolean>) =>
+    undefined as void
+
+  const createAlertBox = () => {
+    const container = document.createElement('div')
+    container.id = 'alert-box'
+    container.innerHTML = `
+      <button id="${constants.giveConsentId}">Give consent</button>
+      <button id="${constants.denyConsentId}">Deny consent</button>
+      `
+    return container
+  }
+
+  const alertBox = createAlertBox()
+  let loaded = false
+  setTimeout(() => {
+    loaded = true
+    mockCMPPublicAPI.openAlertBox()
+  }, 300)
+
+  /**
+   * similar to window.OneTrust
+   */
+  const mockCMPPublicAPI = {
+    get isLoaded() {
+      return loaded
+    },
+    get isOptIn() {
+      return settings.isOptIn
+    },
+    setCategories: (newCategories: Record<string, boolean>) => {
+      categories = { ...categories, ...newCategories }
+      onConsentChange(categories)
+      return categories
+    },
+    waitForAlertBoxClose() {
+      return new Promise<void>((resolve) => {
+        document
+          .getElementById('give-consent')!
+          .addEventListener('click', () => {
+            resolve()
+          })
+
+        document
+          .getElementById('deny-consent')!
+          .addEventListener('click', () => {
+            resolve()
+          })
+      })
+    },
+    getCategories: () => categories,
+    openAlertBox: () => {
+      document.body.appendChild(alertBox)
+      document
+        .getElementById(constants.giveConsentId)!
+        .addEventListener('click', () => {
+          mockCMPPublicAPI.setCategories({
+            FooCategory1: true,
+            FooCategory2: true,
+          })
+          mockCMPPublicAPI.closeAlertBox()
+        })
+      document
+        .getElementById(constants.denyConsentId)!
+        .addEventListener('click', () => {
+          mockCMPPublicAPI.setCategories({
+            FooCategory1: false,
+            FooCategory2: false,
+          })
+          mockCMPPublicAPI.closeAlertBox()
+        })
+    },
+    closeAlertBox: () => {
+      document.body.removeChild(alertBox)
+    },
+    onConsentChange: (fn: ConsentChangeFn) => {
+      onConsentChange = (...args: Parameters<ConsentChangeFn>) => {
+        console.log('Consent Changed', args)
+        fn(...args)
+      }
+    },
+  }
+  window.MockCMP = mockCMPPublicAPI
+  return mockCMPPublicAPI
+}
diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
index 0da5da67d..3c34a4862 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
@@ -1,5 +1,7 @@
 import { CDNSettingsBuilder } from '@internal/test-helpers'
+import type { SegmentEvent } from '@segment/analytics-next'
 import assert from 'assert'
+import type { Matches } from 'webdriverio'
 
 const waitUntilReady = () =>
   browser.waitUntil(
@@ -12,23 +14,62 @@ const waitUntilReady = () =>
 export abstract class BasePage {
   constructor(protected page: string) {}
 
+  segmentTrackingApiReqs: Matches[] = []
+
   async load(): Promise<void> {
     const baseURL = browser.options.baseUrl
-    assert(baseURL)
+    await browser.mockClearAll()
     await this.mockCDNSettingsEndpoint()
+    await this.listenForSegmentTrackCalls()
+    assert(baseURL)
+    await browser.url(baseURL + '/public/' + this.page)
     await waitUntilReady()
-    await browser.url(baseURL + '/' + this.page)
   }
 
   async clearStorage() {
     await browser.deleteAllCookies()
-    await browser.execute(() => localStorage.clear())
+    await browser.execute(() => window.localStorage.clear())
+  }
+
+  getAllTrackingEvents(): SegmentEvent[] {
+    const reqBodies = this.segmentTrackingApiReqs.map((el) =>
+      JSON.parse(el.postData!)
+    )
+    return reqBodies
+  }
+
+  getConsentChangedEvents(): SegmentEvent[] {
+    const reqBodies = this.getAllTrackingEvents()
+    const consentEvents = reqBodies.filter(
+      (el) => el.event === 'Segment Consent Preference'
+    )
+    return consentEvents
+  }
+
+  async cleanup() {
+    this.segmentTrackingApiReqs = []
+    await this.clearStorage()
+  }
+
+  async listenForSegmentTrackCalls(): Promise<void> {
+    const mock = await browser.mock('https://api.segment.io/v1/t', {
+      method: 'post',
+    })
+    mock.respond((mock) => {
+      this.segmentTrackingApiReqs.push(mock)
+      // response with status 200
+      return Promise.resolve({
+        statusCode: 200,
+        body: JSON.stringify({ success: true }),
+      })
+    })
+    return
   }
 
   /**
    * Mock the CDN Settings endpoint so that this can run offline
    */
-  private mockCDNSettingsEndpoint(): Promise<void> {
+  private async mockCDNSettingsEndpoint(): Promise<void> {
     const settings = new CDNSettingsBuilder({
       writeKey: 'something',
     })
@@ -48,17 +89,13 @@ export abstract class BasePage {
       )
       .build()
 
-    return browser
-      .mock('**/settings')
-      .then((mock) =>
-        mock.respond(settings, {
-          statusCode: 200,
-          headers: {
-            'Content-Type': 'application/json',
-          },
-        })
-      )
-      .catch(console.error)
+    const mock = await browser.mock('**/settings')
+    mock.respond(settings, {
+      statusCode: 200,
+      headers: {
+        'Content-Type': 'application/json',
+      },
+    })
   }
 
   /**
diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
index c90a14700..a347ff6a8 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
@@ -1,9 +1,18 @@
 import { BasePage } from './base-page'
 
-class ConsentToolsVanilla extends BasePage {
-  constructor() {
-    super('consent-tools-vanilla.html')
+export class ConsentToolsVanilla extends BasePage {
+  constructor({ optIn }: { optIn: boolean }) {
+    super(
+      optIn
+        ? 'consent-tools-vanilla.html'
+        : 'consent-tools-vanilla-opt-out.html'
+    )
   }
-}
 
-export default new ConsentToolsVanilla()
+  clickGiveConsent() {
+    return $('#give-consent').click()
+  }
+  clickDenyConsent() {
+    return $('#deny-consent').click()
+  }
+}
diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/onetrust.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/onetrust.ts
index 03551e13e..decf03d75 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/onetrust.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/onetrust.ts
@@ -13,24 +13,6 @@ class OneTrustPage extends BasePage {
   clickAcceptButtonAndClosePopup() {
     return $('#onetrust-accept-btn-handler').click()
   }
-
-  /**
-   * Whenever a consent event is sent, increment a counter
-   */
-  detectConsentChanged() {
-    const getConsentChangedCallCount = (): Promise<number> =>
-      browser.execute(() => window._segmentConsentCalls)
-
-    void browser.execute(() => {
-      window._segmentConsentCalls ??= 0
-      window.analytics.on('track', (name) => {
-        if (name.includes('Segment Consent')) {
-          window._segmentConsentCalls += 1
-        }
-      })
-    })
-    return { getConsentChangedCallCount }
-  }
 }
 
 export default new OneTrustPage()
diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
new file mode 100644
index 000000000..8f4c899c8
--- /dev/null
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
@@ -0,0 +1,60 @@
+/**
+ * Tests targeting @segment/analytics-consent-tools
+ */
+
+import { ConsentToolsVanilla } from '../page-objects/consent-tools-vanilla'
+import { expect } from 'expect'
+
+const page = new ConsentToolsVanilla({ optIn: false })
+
+afterEach(async () => {
+  await page.cleanup()
+})
+it('should not wait for consent before sending track call', async () => {
+  await page.load()
+
+  await browser.execute(() => {
+    return window.analytics.track('hello')
+  })
+
+  let consentChangeEvents = page.getConsentChangedEvents()
+  expect(consentChangeEvents.length).toBe(0)
+
+  const getHelloTrackEvent = () =>
+    page.getAllTrackingEvents().find((el) => el.event === 'hello')
+
+  await browser.waitUntil(() => getHelloTrackEvent(), {
+    interval: 500,
+    timeout: 20000,
+    timeoutMsg: 'Expected a "hello" track call to be made',
+  })
+  expect(getHelloTrackEvent()?.context?.consent.categoryPreferences).toEqual({
+    FooCategory1: false,
+    FooCategory2: false,
+  })
+
+  await page.clickGiveConsent()
+  await browser.waitUntil(() => page.getConsentChangedEvents().length, {
+    interval: 500,
+    timeout: 20000,
+    timeoutMsg: 'Expected a consent change call to be made',
+  })
+  consentChangeEvents = page.getConsentChangedEvents()
+  expect(consentChangeEvents.length).toBe(1)
+  expect(consentChangeEvents[0].event).toEqual('Segment Consent Preference')
+  await browser.execute(() => {
+    return window.analytics.track('sup')
+  })
+  const getSupTrackEvent = () =>
+    page.getAllTrackingEvents().find((el) => el.event === 'sup')
+  await browser.waitUntil(() => getSupTrackEvent(), {
+    interval: 500,
+    timeout: 20000,
+    timeoutMsg: 'Expected a "sup" track call to be made',
+  })
+
+  expect(getSupTrackEvent()?.context?.consent.categoryPreferences).toEqual({
+    FooCategory1: true,
+    FooCategory2: true,
+  })
+})
diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
index 2043ecdf0..f24c2ba94 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
@@ -2,17 +2,42 @@
  * Tests targeting @segment/analytics-consent-tools
  */
 
-import page from '../page-objects/consent-tools-vanilla'
+import { ConsentToolsVanilla } from '../page-objects/consent-tools-vanilla'
 import { expect } from 'expect'
 
-it('should stamp each event', async () => {
+const page = new ConsentToolsVanilla({ optIn: true })
+
+afterEach(async () => {
+  await page.cleanup()
+})
+
+it('should send a track call after waiting for explicit consent', async () => {
   await page.load()
 
-  const ctx = await browser.execute(() => {
+  await page.clickGiveConsent()
+
+  await browser.waitUntil(() => page.getConsentChangedEvents().length, {
+    timeout: 20000,
+    timeoutMsg: 'Expected a consent change call to be made',
+  })
+
+  const consentChangeEvents = page.getConsentChangedEvents()
+  expect(consentChangeEvents.length).toBe(1)
+  expect(consentChangeEvents[0].event).toEqual('Segment Consent Preference')
+
+  await browser.execute(() => {
     return window.analytics.track('hello')
   })
 
-  expect((ctx.event.context as any).consent).toEqual({
+  const getHelloTrackEvents = () =>
+    page.getAllTrackingEvents().find((el) => el.event === 'hello')
+
+  await browser.waitUntil(() => getHelloTrackEvents(), {
+    timeout: 20000,
+    timeoutMsg: 'Expected a track call to be made',
+  })
+
+  expect(getHelloTrackEvents()!.context?.consent).toEqual({
     categoryPreferences: {
       FooCategory1: true,
       FooCategory2: true,
diff --git a/packages/consent/consent-tools-integration-tests/src/tests/onetrust.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/onetrust.test.ts
index bc8d2227c..636434df6 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/onetrust.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/onetrust.test.ts
@@ -12,22 +12,29 @@ declare global {
 }
 
 afterEach(async () => {
-  await page.clearStorage()
+  await page.cleanup()
 })
 
 it('should send a consent changed event when user clicks accept on popup', async () => {
   await page.load()
 
-  const { getConsentChangedCallCount } = await page.detectConsentChanged()
-
   await browser.pause(1000)
-  await expect(getConsentChangedCallCount()).resolves.toBe(0)
+  await expect(page.getConsentChangedEvents().length).toBe(0)
 
   // make a consent selection in the OneTrust popup
   await page.clickAcceptButtonAndClosePopup()
 
   // 1 consent changed event should now be sent
   await browser.waitUntil(
-    async () => (await getConsentChangedCallCount()) === 1
+    () => {
+      return page.getConsentChangedEvents().length === 1
+    },
+    {
+      interval: 100,
+      timeout: 30000,
+      timeoutMsg: `Expected 1 consent changed event to be sent, got: ${
+        page.getConsentChangedEvents().length
+      }`,
+    }
   )
 })
diff --git a/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts b/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
index 6c3d5a4d7..e811c75ca 100644
--- a/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
+++ b/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
@@ -2,11 +2,15 @@ import type { Options } from '@wdio/types'
 
 const PORT = 4567
 
+const isCI = Boolean(process.env.CI)
+
 export const config: Options.Testrunner = {
   afterTest(test, _, { error, passed }) {
     console.log(
       [
-        `${passed ? '✅ Passed' : '❌ Failed'}! ${test.title}`,
+        `${passed ? '✅ Passed' : '❌ Failed'}! ${test.description ?? ''} : ${
+          test.title
+        }`,
         test.file,
         error ? error : '',
       ].join('\n')
@@ -21,11 +25,7 @@ export const config: Options.Testrunner = {
         folders: [
           {
             mount: '/',
-            path: './public',
-          },
-          {
-            mount: '/@segment',
-            path: './node_modules/@segment',
+            path: '.',
           },
         ],
       },
@@ -51,10 +51,14 @@ export const config: Options.Testrunner = {
   maxInstances: 10,
   capabilities: [
     {
-      maxInstances: 5,
+      maxInstances: 1,
       browserName: 'chrome',
       'goog:chromeOptions': {
-        args: process.env.CI ? ['headless', 'disable-gpu'] : [],
+        args: [
+          ...(isCI ? ['headless'] : []),
+          'disable-gpu',
+          'user-data-dir=/tmp',
+        ],
       },
       acceptInsecureCerts: true,
     },
diff --git a/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts b/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts
index 30849914e..81fe24056 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts
@@ -1,8 +1,9 @@
 import { createConsentStampingMiddleware } from '../consent-stamping'
-import { Context, MiddlewareFunction } from '@segment/analytics-next'
+import { Context } from '@segment/analytics-next'
+import { SourceMiddlewareFunction } from '../../types'
 
 describe(createConsentStampingMiddleware, () => {
-  let middlewareFn: MiddlewareFunction
+  let middlewareFn: SourceMiddlewareFunction
   const nextFn = jest.fn()
   const getCategories = jest.fn()
   const payload = {
diff --git a/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts b/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts
index 7c14a5c56..eaedc1fb8 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts
@@ -1,7 +1,7 @@
 import * as ConsentStamping from '../consent-stamping'
-import * as DisableSegment from '../disable-segment'
+import * as DisableSegment from '../blocking-helpers'
 import { createWrapper } from '../create-wrapper'
-import { AbortLoadError, LoadContext } from '../load-cancellation'
+
 import type {
   CreateWrapperSettings,
   AnyAnalytics,
@@ -13,9 +13,6 @@ import { CDNSettingsBuilder } from '@internal/test-helpers'
 import { assertIntegrationsContainOnly } from './assertions/integrations-assertions'
 import { AnalyticsService } from '../analytics'
 
-jest.mock('../disable-segment')
-const disableSegmentMock = jest.mocked(DisableSegment)
-
 const DEFAULT_LOAD_SETTINGS = {
   writeKey: 'foo',
   cdnSettings: { integrations: {} },
@@ -27,7 +24,6 @@ const mockGetCategories: jest.MockedFn<CreateWrapperSettings['getCategories']> =
 const analyticsLoadSpy: jest.MockedFn<AnyAnalytics['load']> = jest.fn()
 const analyticsPageSpy: jest.MockedFn<AnyAnalytics['page']> = jest.fn()
 const addSourceMiddlewareSpy = jest.fn()
-let analyticsOnSpy: jest.MockedFn<AnyAnalytics['on']>
 const analyticsTrackSpy: jest.MockedFn<AnyAnalytics['track']> = jest.fn()
 let consoleErrorSpy: jest.SpiedFunction<typeof console['error']>
 
@@ -47,18 +43,11 @@ let analytics: AnyAnalytics, cdnSettingsBuilder: CDNSettingsBuilder
 beforeEach(() => {
   consoleErrorSpy = jest.spyOn(console, 'error')
   cdnSettingsBuilder = new CDNSettingsBuilder()
-  analyticsOnSpy = jest.fn().mockImplementation((event, fn) => {
-    if (event === 'initialize') {
-      fn(cdnSettingsBuilder.build())
-    } else {
-      console.error('event not recognized')
-    }
-  })
 
   class MockAnalytics implements AnyAnalytics {
+    addDestinationMiddleware = jest.fn()
     page = analyticsPageSpy
     track = analyticsTrackSpy
-    on = analyticsOnSpy
     load = analyticsLoadSpy
     addSourceMiddleware = addSourceMiddlewareSpy
   }
@@ -120,33 +109,6 @@ describe(createWrapper, () => {
 
   describe('shouldLoadSegment', () => {
     describe('Throwing errors / aborting load', () => {
-      const createShouldLoadThatThrows = (
-        ...args: Parameters<LoadContext['abort']>
-      ) => {
-        let err: Error
-        const shouldLoadSegment = jest
-          .fn()
-          .mockImplementation((ctx: LoadContext) => {
-            try {
-              ctx.abort(...args)
-            } catch (_err: any) {
-              err = _err
-            }
-          })
-        return { shouldLoadSegment, getError: () => err }
-      }
-
-      it('should throw a special error if ctx.abort is called', async () => {
-        const { shouldLoadSegment, getError } = createShouldLoadThatThrows({
-          loadSegmentNormally: true,
-        })
-        wrapTestAnalytics({
-          shouldLoadSegment,
-        })
-        await analytics.load(DEFAULT_LOAD_SETTINGS)
-        expect(getError() instanceof AbortLoadError).toBeTruthy()
-      })
-
       it.each([{ loadSegmentNormally: true }, { loadSegmentNormally: false }])(
         `should not log a console error or throw an error if ctx.abort is called (%p)`,
         async (args) => {
@@ -159,10 +121,22 @@ describe(createWrapper, () => {
         }
       )
 
+      it('should throw an error if both ctx.abort and ctx.load are called', async () => {
+        wrapTestAnalytics({
+          shouldLoadSegment: (ctx) => {
+            ctx.abort({ loadSegmentNormally: true })
+            ctx.load({ optIn: true })
+          },
+        })
+        await expect(() =>
+          analytics.load(DEFAULT_LOAD_SETTINGS)
+        ).rejects.toThrow(/both abort and load should not be called/i)
+      })
+
       it('should pass analytics.load args straight through to the analytics instance if ctx.abort() is called', async () => {
         wrapTestAnalytics({
           shouldLoadSegment: (ctx) => {
-            ctx.abort({
+            return ctx.abort({
               loadSegmentNormally: true,
             })
           },
@@ -182,31 +156,20 @@ describe(createWrapper, () => {
           ...DEFAULT_LOAD_SETTINGS,
           cdnSettings: mockCdnSettings,
         })
-        expect(args[1]).toEqual({ foo: 'bar' } as any)
+        expect(args[1]).toEqual(expect.objectContaining({ foo: 'bar' }) as any)
       })
 
       it('should allow segment loading to be completely aborted via ctx.abort', async () => {
         wrapTestAnalytics({
           shouldLoadSegment: (ctx) => {
-            ctx.abort({
+            return ctx.abort({
               loadSegmentNormally: false, // magic config option
             })
-            throw new Error('Fail')
           },
         })
         await analytics.load(DEFAULT_LOAD_SETTINGS)
         expect(analyticsLoadSpy).not.toBeCalled()
       })
-      it('should throw a validation error if ctx.abort is called incorrectly', async () => {
-        const { getError, shouldLoadSegment } = createShouldLoadThatThrows(
-          undefined as any
-        )
-        wrapTestAnalytics({
-          shouldLoadSegment,
-        })
-        await analytics.load(DEFAULT_LOAD_SETTINGS)
-        expect(getError().message).toMatch(/validation/i)
-      })
 
       it('An unrecognized Error (non-consent) error should bubble up, but we should not log any additional console error', async () => {
         const err = new Error('hello')
@@ -326,19 +289,9 @@ describe(createWrapper, () => {
       ).toThrowError(/validation/i)
     })
 
-    test('analytics.load should reject if categories are in the wrong format', async () => {
-      wrapTestAnalytics({
-        shouldLoadSegment: () => Promise.resolve('sup' as any),
-      })
-      await expect(() => analytics.load(DEFAULT_LOAD_SETTINGS)).rejects.toThrow(
-        /validation/i
-      )
-    })
-
     test('analytics.load should reject if categories are undefined', async () => {
       wrapTestAnalytics({
         getCategories: () => undefined as any,
-        shouldLoadSegment: () => undefined,
       })
       await expect(() => analytics.load(DEFAULT_LOAD_SETTINGS)).rejects.toThrow(
         /validation/i
@@ -403,7 +356,7 @@ describe(createWrapper, () => {
         .build()
 
       wrapTestAnalytics({
-        shouldLoadSegment: () => ({ Foo: true }),
+        getCategories: () => ({ Foo: true }),
       })
       await analytics.load({
         ...DEFAULT_LOAD_SETTINGS,
@@ -430,7 +383,7 @@ describe(createWrapper, () => {
         .build()
 
       wrapTestAnalytics({
-        shouldLoadSegment: () => ({ Foo: true, Bar: true }),
+        getCategories: () => ({ Foo: true, Bar: true }),
       })
       await analytics.load({
         ...DEFAULT_LOAD_SETTINGS,
@@ -457,7 +410,7 @@ describe(createWrapper, () => {
         .build()
 
       wrapTestAnalytics({
-        shouldLoadSegment: () => ({ Foo: true }),
+        getCategories: () => ({ Foo: true }),
       })
       await analytics.load({
         ...DEFAULT_LOAD_SETTINGS,
@@ -567,103 +520,6 @@ describe(createWrapper, () => {
         })
       }
     )
-
-    describe('pruneUnmappedCategories', () => {
-      it('should throw an error if there are no configured categories', async () => {
-        const fn = jest.spyOn(
-          ConsentStamping,
-          'createConsentStampingMiddleware'
-        )
-        const mockCdnSettings = cdnSettingsBuilder
-          .addActionDestinationSettings({
-            creationName: 'Some Other Plugin',
-          })
-          .build()
-
-        wrapTestAnalytics({ pruneUnmappedCategories: true })
-        await analytics.load({
-          ...DEFAULT_LOAD_SETTINGS,
-          cdnSettings: mockCdnSettings,
-        })
-
-        const getCategoriesFn = fn.mock.lastCall![0]
-        await expect(() =>
-          getCategoriesFn()
-        ).rejects.toThrowErrorMatchingInlineSnapshot(
-          `"[Validation] Invariant: No consent categories defined in Segment (Received: [])"`
-        )
-      })
-
-      it('should exclude properties that are not configured based on the allCategories array', async () => {
-        const fn = jest.spyOn(
-          ConsentStamping,
-          'createConsentStampingMiddleware'
-        )
-        const mockCdnSettings = cdnSettingsBuilder
-          .addActionDestinationSettings({
-            creationName: 'Some Other Plugin',
-            consentSettings: {
-              categories: ['Foo'],
-            },
-          })
-          .build()
-
-        ;(mockCdnSettings as any).consentSettings = {
-          allCategories: ['Foo', 'Bar'],
-        }
-
-        wrapTestAnalytics({
-          pruneUnmappedCategories: true,
-          getCategories: () => ({
-            Foo: true,
-            Bar: false,
-            Rand1: false,
-            Rand2: true,
-          }),
-        })
-        await analytics.load({
-          ...DEFAULT_LOAD_SETTINGS,
-          cdnSettings: mockCdnSettings,
-        })
-
-        const getCategoriesFn = fn.mock.lastCall![0]
-        await expect(getCategoriesFn()).resolves.toEqual({
-          Foo: true,
-          Bar: false,
-        })
-      })
-
-      it('should exclude properties that are not configured if integrationCategoryMappings are passed', async () => {
-        const fn = jest.spyOn(
-          ConsentStamping,
-          'createConsentStampingMiddleware'
-        )
-        const mockCdnSettings = cdnSettingsBuilder
-          .addActionDestinationSettings({
-            creationName: 'Some Other Plugin',
-          })
-          .build()
-
-        wrapTestAnalytics({
-          pruneUnmappedCategories: true,
-          getCategories: () => ({
-            Foo: true,
-            Rand1: true,
-            Rand2: false,
-          }),
-          integrationCategoryMappings: {
-            'Some Other Plugin': ['Foo'],
-          },
-        })
-        await analytics.load({
-          ...DEFAULT_LOAD_SETTINGS,
-          cdnSettings: mockCdnSettings,
-        })
-
-        const getCategoriesFn = fn.mock.lastCall![0]
-        await expect(getCategoriesFn()).resolves.toEqual({ Foo: true })
-      })
-    })
   })
 
   describe('registerOnConsentChanged', () => {
@@ -721,10 +577,14 @@ describe(createWrapper, () => {
   })
 
   describe('Disabling Segment Automatically', () => {
+    const segmentShouldBeDisabled = jest.spyOn(
+      DisableSegment,
+      'segmentShouldBeDisabled'
+    )
     // if user has no unmapped destinations and only irrelevant categories, we disable segment.
     // for more tests, see disable-segment.test.ts
     it('should always disable if segmentShouldBeDisabled returns true', async () => {
-      disableSegmentMock.segmentShouldBeDisabled.mockReturnValue(true)
+      segmentShouldBeDisabled.mockReturnValue(true)
       wrapTestAnalytics()
       await analytics.load({
         ...DEFAULT_LOAD_SETTINGS,
@@ -737,7 +597,7 @@ describe(createWrapper, () => {
       ).toBe(true)
     })
     it('should disable if segmentShouldBeDisabled returns false and disable is not overridden', async () => {
-      disableSegmentMock.segmentShouldBeDisabled.mockReturnValue(false)
+      segmentShouldBeDisabled.mockReturnValue(false)
       wrapTestAnalytics()
       await analytics.load({
         ...DEFAULT_LOAD_SETTINGS,
@@ -751,7 +611,7 @@ describe(createWrapper, () => {
     })
 
     it('should be disabled if if a user overrides disabled with boolean: true, and pass through a boolean', async () => {
-      disableSegmentMock.segmentShouldBeDisabled.mockReturnValue(false)
+      segmentShouldBeDisabled.mockReturnValue(false)
       wrapTestAnalytics()
       await analytics.load(
         {
@@ -766,7 +626,7 @@ describe(createWrapper, () => {
     })
 
     it('should return true if segment should be disabled, but a user loads a false value', async () => {
-      disableSegmentMock.segmentShouldBeDisabled.mockReturnValue(true)
+      segmentShouldBeDisabled.mockReturnValue(true)
       wrapTestAnalytics()
       await analytics.load(
         {
@@ -783,7 +643,7 @@ describe(createWrapper, () => {
     })
 
     it('should handle if a user overrides the value with a function', async () => {
-      disableSegmentMock.segmentShouldBeDisabled.mockReturnValue(false)
+      segmentShouldBeDisabled.mockReturnValue(false)
       wrapTestAnalytics()
       await analytics.load(
         {
@@ -800,7 +660,7 @@ describe(createWrapper, () => {
     })
 
     it('should enable if user passes the wrong option to "load"', async () => {
-      disableSegmentMock.segmentShouldBeDisabled.mockReturnValue(false)
+      segmentShouldBeDisabled.mockReturnValue(false)
       wrapTestAnalytics()
       await analytics.load(
         {
diff --git a/packages/consent/consent-tools/src/domain/__tests__/disable-segment.test.ts b/packages/consent/consent-tools/src/domain/__tests__/disable-segment.test.ts
index 33f3226f4..458291e8e 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/disable-segment.test.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/disable-segment.test.ts
@@ -1,5 +1,5 @@
 import { CDNSettingsConsent } from '../../types'
-import { segmentShouldBeDisabled } from '../disable-segment'
+import { segmentShouldBeDisabled } from '../blocking-helpers'
 
 describe('segmentShouldBeDisabled', () => {
   it('should be disabled if user has only consented to irrelevant categories: multiple', () => {
diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 77921fc2c..9b7a59c58 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -5,10 +5,6 @@ import { ValidationError } from '../../validation/validation-error'
 describe(AnalyticsService, () => {
   let analyticsService: AnalyticsService
 
-  beforeEach(() => {
-    analyticsService = new AnalyticsService(analyticsMock)
-  })
-
   describe('constructor', () => {
     it('should throw an error if the analytics instance is not valid', () => {
       // @ts-ignore
@@ -18,22 +14,12 @@ describe(AnalyticsService, () => {
     })
   })
 
-  describe('cdnSettings', () => {
-    it('should be a promise', async () => {
-      expect(analyticsMock.on).toBeCalledTimes(1)
-      expect(analyticsMock.on.mock.lastCall![0]).toBe('initialize')
-      analyticsMock.on.mock.lastCall![1]({ integrations: {} })
-
-      await expect(analyticsService['cdnSettings']).resolves.toEqual({
-        integrations: {},
-      })
-    })
-  })
-
-  describe('loadNormally', () => {
+  describe('load', () => {
     it('loads normally', () => {
-      analyticsService = new AnalyticsService(analyticsMock)
-      analyticsService.loadNormally('foo')
+      analyticsService = new AnalyticsService(analyticsMock, {
+        getCategories: () => ({}),
+      })
+      analyticsService.load('foo')
       expect(analyticsMock.load).toBeCalled()
     })
 
@@ -48,23 +34,52 @@ describe(AnalyticsService, () => {
         load: fn,
         name: 'some instance',
       }
-      analyticsService = new AnalyticsService(_analyticsMock)
-      analyticsService.loadNormally('foo')
+      analyticsService = new AnalyticsService(_analyticsMock, {
+        getCategories: () => ({}),
+      })
+      analyticsService.load('foo')
       expect(that.name).toEqual('some instance')
     })
 
+    describe('updateCDNSettings', () => {
+      it('will gracefully handle updateCDNSettings if passed in', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: () => ({}),
+        })
+        analyticsService.load(
+          {
+            writeKey: 'foo',
+          },
+          {
+            updateCDNSettings: (prevSettings) => ({
+              bar: 'baz',
+              ...prevSettings,
+            }),
+          }
+        )
+        // expect analytics.load to be called with theoptions correct settings
+        const [_settings, options] = analyticsMock.load.mock.lastCall as any
+
+        expect(typeof options.updateCDNSettings).toBe('function')
+        expect(options.updateCDNSettings()).toEqual({ bar: 'baz' })
+      })
+    })
+
     it('will always call the original .load method', () => {
       const ogLoad = jest.fn()
-      analyticsService = new AnalyticsService({
-        ...analyticsMock,
-        load: ogLoad,
-      })
+      analyticsService = new AnalyticsService(
+        {
+          ...analyticsMock,
+          load: ogLoad,
+        },
+        { getCategories: () => ({}) }
+      )
       const replaceLoadMethod = jest.fn()
       analyticsService.replaceLoadMethod(replaceLoadMethod)
-      analyticsService.loadNormally('foo')
+      analyticsService.load('foo')
       expect(ogLoad).toHaveBeenCalled()
       analyticsService.replaceLoadMethod(replaceLoadMethod)
-      analyticsService.loadNormally('foo')
+      analyticsService.load('foo')
       expect(replaceLoadMethod).not.toBeCalled()
     })
   })
@@ -80,38 +95,328 @@ describe(AnalyticsService, () => {
   describe('configureConsentStampingMiddleware', () => {
     // More tests are in create-wrapper.test.ts... should probably move the integration-y tests here
     it('should add the middleware to the analytics instance', () => {
-      analyticsService.configureConsentStampingMiddleware({
+      analyticsService = new AnalyticsService(analyticsMock, {
         getCategories: () => ({
           C0001: true,
         }),
       })
-      expect(analyticsMock.addSourceMiddleware).toBeCalledTimes(1)
-      expect(analyticsMock.addSourceMiddleware).toBeCalledWith(
+      analyticsService.configureConsentStampingMiddleware()
+
+      expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledTimes(1)
+      expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledWith(
         expect.any(Function)
       )
     })
 
     it('should stamp consent', async () => {
-      const payload = {
-        obj: {
-          context: {},
+      analyticsService = new AnalyticsService(analyticsMock, {
+        pruneUnmappedCategories: false,
+        getCategories: () => categories,
+        integrationCategoryMappings: {
+          foo: ['C0001'],
         },
+      })
+
+      analyticsService.configureConsentStampingMiddleware()
+      const categories = {
+        C0001: true,
+        C0002: false,
+        C0003: true,
       }
-      analyticsService.configureConsentStampingMiddleware({
-        getCategories: () => ({
+      // we are generating consent stamping source middleware and adding to the analytics instance, so test
+      // that the addSourceMiddleware function is called with the correct function
+      expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledTimes(1)
+      const sourceMw = analyticsMock.addSourceMiddleware.mock.lastCall![0]
+      expect(sourceMw).toBeInstanceOf(Function)
+      // try running the source middleware
+      const nextFn = jest.fn()
+      await sourceMw({
+        payload: {
+          obj: {
+            context: {},
+          },
+        },
+        next: nextFn,
+      })
+
+      expect(nextFn.mock.lastCall[0]).toMatchInlineSnapshot(`
+        {
+          "obj": {
+            "context": {
+              "consent": {
+                "categoryPreferences": {
+                  "C0001": true,
+                  "C0002": false,
+                  "C0003": true,
+                },
+              },
+            },
+          },
+        }
+      `)
+    })
+
+    describe('pruneUnmappedCategories', () => {
+      it('should prune categories that are not in the consent settings', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          pruneUnmappedCategories: true,
+          getCategories: () => categories,
+          integrationCategoryMappings: {
+            foo: ['C0001'],
+          },
+        })
+
+        analyticsService.configureConsentStampingMiddleware()
+        const categories = {
           C0001: true,
           C0002: false,
-        }),
+          C0003: true,
+        }
+        // we are generating consent stamping source middleware and adding to the analytics instance, so test
+        // that the addSourceMiddleware function is called with the correct function
+        expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledTimes(1)
+        const sourceMw = analyticsMock.addSourceMiddleware.mock.lastCall![0]
+        expect(sourceMw).toBeInstanceOf(Function)
+        // try running the source middleware
+        const nextFn = jest.fn()
+        await sourceMw({
+          payload: {
+            obj: {
+              context: {},
+            },
+          },
+          next: nextFn,
+        })
+        expect(nextFn.mock.lastCall[0]).toMatchInlineSnapshot(`
+          {
+            "obj": {
+              "context": {
+                "consent": {
+                  "categoryPreferences": {
+                    "C0001": true,
+                  },
+                },
+              },
+            },
+          }
+        `)
       })
-      await analyticsMock.addSourceMiddleware.mock.lastCall![0]({
-        payload,
-        next: jest.fn(),
+    })
+  })
+
+  describe('configureBlockingMiddleware', () => {
+    describe('addSourceMiddleware (used to block segment and everything else)', () => {
+      it('should be called with the correct arguments', () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledTimes(1)
+        expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledWith(
+          expect.any(Function)
+        )
       })
-      expect((payload.obj.context as any).consent).toEqual({
-        categoryPreferences: {
-          C0001: true,
-          C0002: false,
-        },
+      it('drops events if user has no unmapped destinations and no relevant categories', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        analyticsService['cdnSettingsDeferred'].resolve({
+          consentSettings: {
+            allCategories: ['Foo'],
+            hasUnmappedDestinations: false,
+          },
+          integrations: {
+            foo: {
+              consentSettings: {
+                categories: ['Foo'], //
+              },
+            },
+          },
+        })
+        expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledTimes(1)
+        const sourceMw = analyticsMock.addSourceMiddleware.mock.lastCall![0]
+        const nextFn = jest.fn()
+        const payload = {
+          obj: {
+            context: {
+              consent: {
+                categoryPreferences: {
+                  C0002: false,
+                  C0003: false,
+                },
+              },
+            },
+          },
+        }
+        const result = await sourceMw({
+          payload,
+          next: nextFn,
+        })
+        expect(nextFn).not.toHaveBeenCalled()
+        expect(result).toBeNull()
+      })
+
+      it('is capable of allowing events through', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        analyticsService['cdnSettingsDeferred'].resolve({
+          consentSettings: {
+            allCategories: ['C0001'],
+            hasUnmappedDestinations: false,
+          },
+          integrations: {
+            foo: {
+              consentSettings: {
+                categories: ['C0001'], //
+              },
+            },
+          },
+        })
+        expect(analyticsMock.addSourceMiddleware).toHaveBeenCalledTimes(1)
+        const sourceMw = analyticsMock.addSourceMiddleware.mock.lastCall![0]
+        const nextFn = jest.fn()
+        const payload = {
+          obj: {
+            context: {
+              consent: {
+                categoryPreferences: {
+                  C0001: true,
+                },
+              },
+            },
+          },
+        }
+        await sourceMw({
+          payload,
+          next: nextFn,
+        })
+        expect(nextFn.mock.lastCall[0]).toEqual(payload)
+      })
+    })
+    describe('addDestinationMiddleware', () => {
+      it('should be called with the correct arguments', () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        expect(analyticsMock.addDestinationMiddleware).toHaveBeenCalledTimes(1)
+        expect(analyticsMock.addDestinationMiddleware).toHaveBeenCalledWith(
+          '*',
+          expect.any(Function)
+        )
+      })
+      it('drops events', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        analyticsService['cdnSettingsDeferred'].resolve({
+          integrations: {
+            foo: {
+              consentSettings: {
+                categories: ['Foo'],
+              },
+            },
+          },
+        })
+
+        const destinationMw =
+          analyticsMock.addDestinationMiddleware.mock.lastCall![1]
+        const nextFn = jest.fn()
+        const payload = {
+          obj: {
+            context: {
+              consent: {
+                categoryPreferences: {
+                  C0001: false,
+                },
+              },
+            },
+          },
+        }
+        const result = await destinationMw({
+          integration: 'foo',
+          payload,
+          next: nextFn,
+        })
+        expect(nextFn).not.toHaveBeenCalled()
+        expect(result).toBeNull()
+      })
+      it('drops events if integrationCategoryMappings are defined', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+          integrationCategoryMappings: {
+            foo: ['C0001'],
+          },
+        })
+
+        analyticsService['cdnSettingsDeferred'].resolve({
+          integrations: {},
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        expect(analyticsMock.addDestinationMiddleware).toHaveBeenCalledTimes(1)
+        expect(analyticsMock.addDestinationMiddleware).toHaveBeenCalledWith(
+          '*',
+          expect.any(Function)
+        )
+        const destinationMw =
+          analyticsMock.addDestinationMiddleware.mock.lastCall![1]
+        const nextFn = jest.fn()
+        const payload = {
+          obj: {
+            context: {
+              consent: {
+                categoryPreferences: {
+                  C0001: false,
+                },
+              },
+            },
+          },
+        }
+        const result = await destinationMw({
+          integration: 'foo',
+          payload,
+          next: nextFn,
+        })
+        expect(nextFn).not.toHaveBeenCalled()
+        expect(result).toBeNull()
+      })
+
+      it('allows events through', async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: jest.fn(),
+          integrationCategoryMappings: {
+            foo: ['C0001'],
+          },
+        })
+
+        analyticsService['cdnSettingsDeferred'].resolve({
+          integrations: {},
+        })
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        const destinationMw =
+          analyticsMock.addDestinationMiddleware.mock.lastCall![1]
+        const nextFn = jest.fn()
+        const payload = {
+          obj: {
+            context: {
+              consent: {
+                categoryPreferences: {
+                  C0001: true,
+                },
+              },
+            },
+          },
+        }
+        await destinationMw({
+          integration: 'foo',
+          payload,
+          next: nextFn,
+        })
+        expect(nextFn.mock.lastCall[0]).toEqual(payload)
       })
     })
   })
diff --git a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
index 3cf35edab..96a233545 100644
--- a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
@@ -1,37 +1,82 @@
+import { createDeferred } from '@segment/analytics-generic-utils'
 import {
   AnyAnalytics,
   Categories,
   CDNSettings,
   CreateWrapperSettings,
+  GetCategoriesFunction,
+  IntegrationCategoryMappings,
   MaybeInitializedAnalytics,
 } from '../../types'
+import { pipe } from '../../utils'
+import { addBlockingMiddleware } from '../blocking-middleware'
 import { createConsentStampingMiddleware } from '../consent-stamping'
-import { getPrunedCategories } from '../pruned-categories'
+import { parseAllCategories, getPrunedCategories } from '../pruned-categories'
 import { validateAnalyticsInstance, validateCategories } from '../validation'
+import { logger } from '../logger'
 
+export interface AnalyticsServiceOptions {
+  getCategories: GetCategoriesFunction
+  pruneUnmappedCategories?: boolean
+  integrationCategoryMappings?: IntegrationCategoryMappings
+  shouldEnableIntegration?: CreateWrapperSettings['shouldEnableIntegration']
+}
 /**
  * This class is a wrapper around the analytics.js library.
  */
 export class AnalyticsService {
-  cdnSettings: Promise<CDNSettings>
-  /**
-   * The original analytics.load fn
-   */
-  loadNormally: AnyAnalytics['load']
+  private options: AnalyticsServiceOptions
+
+  private cdnSettingsDeferred = createDeferred<CDNSettings>()
+
+  private ogAnalyticsLoad: AnyAnalytics['load']
 
   private get analytics() {
-    return getInitializedAnalytics(this._uninitializedAnalytics)
+    return getInitializedAnalytics(this.uninitializedAnalytics)
+  }
+
+  private get cdnSettings(): Promise<CDNSettings> {
+    return this.cdnSettingsDeferred.promise
+  }
+
+  private async getAllCategories(): Promise<string[]> {
+    const allCategories = this.options.integrationCategoryMappings
+      ? parseAllCategories(this.options.integrationCategoryMappings)
+      : (await this.cdnSettings).consentSettings?.allCategories
+
+    return allCategories ?? []
   }
 
-  private _uninitializedAnalytics: AnyAnalytics
+  private uninitializedAnalytics: AnyAnalytics
 
-  constructor(analytics: AnyAnalytics) {
+  constructor(analytics: AnyAnalytics, options: AnalyticsServiceOptions) {
     validateAnalyticsInstance(analytics)
-    this._uninitializedAnalytics = analytics
-    this.loadNormally = analytics.load.bind(this._uninitializedAnalytics)
-    this.cdnSettings = new Promise<CDNSettings>((resolve) =>
-      this.analytics.on('initialize', resolve)
-    )
+    this.options = options
+    this.uninitializedAnalytics = analytics
+
+    // store the raw analytics load instance, because we may replace it later
+    this.ogAnalyticsLoad = analytics.load.bind(this.uninitializedAnalytics)
+  }
+
+  /**
+   * The orignal analytics load function, but also stores the CDN settings on the instance.
+   */
+  load(
+    ...[settings, options]: Parameters<AnyAnalytics['load']>
+  ): ReturnType<AnyAnalytics['load']> {
+    return this.ogAnalyticsLoad(settings, {
+      ...options,
+      updateCDNSettings: pipe(
+        options?.updateCDNSettings || ((id) => id),
+        (cdnSettings) => {
+          logger.debug('CDN settings loaded', cdnSettings)
+          // extract the CDN settings from this call and store it on the instance.
+          // there is an 'initialize' event emitter, but it's called too late for our purposes.
+          this.cdnSettingsDeferred.resolve(cdnSettings)
+          return cdnSettings
+        }
+      ),
+    })
   }
 
   /**
@@ -45,29 +90,26 @@ export class AnalyticsService {
     this.analytics.page()
   }
 
-  configureConsentStampingMiddleware({
-    getCategories,
-    pruneUnmappedCategories,
-    integrationCategoryMappings,
-  }: Pick<
-    CreateWrapperSettings,
-    'getCategories' | 'pruneUnmappedCategories' | 'integrationCategoryMappings'
-  >): void {
+  configureBlockingMiddlewareForOptOut(): void {
+    addBlockingMiddleware(this.cdnSettings, this.analytics, {
+      integrationCategoryMappings: this.options.integrationCategoryMappings,
+      shouldEnableIntegration: this.options.shouldEnableIntegration,
+    })
+  }
+
+  configureConsentStampingMiddleware(): void {
+    const { getCategories, pruneUnmappedCategories } = this.options
     // normalize getCategories pruning is turned on or off
     const getCategoriesForConsentStamping = async (): Promise<Categories> => {
+      const categories = await getCategories()
       if (pruneUnmappedCategories) {
-        return getPrunedCategories(
-          getCategories,
-          await this.cdnSettings,
-          integrationCategoryMappings
-        )
-      } else {
-        return getCategories()
+        return getPrunedCategories(categories, await this.getAllCategories())
       }
+      return categories
     }
 
     const MW = createConsentStampingMiddleware(getCategoriesForConsentStamping)
-    return this.analytics.addSourceMiddleware(MW)
+    this.analytics.addSourceMiddleware(MW)
   }
 
   /**
diff --git a/packages/consent/consent-tools/src/domain/blocking-helpers.ts b/packages/consent/consent-tools/src/domain/blocking-helpers.ts
new file mode 100644
index 000000000..2ddb45ea1
--- /dev/null
+++ b/packages/consent/consent-tools/src/domain/blocking-helpers.ts
@@ -0,0 +1,118 @@
+import {
+  Categories,
+  CDNSettings,
+  CDNSettingsConsent,
+  CreateWrapperSettings,
+} from '../types'
+import { logger } from './logger'
+import { parseConsentCategories } from './config-helpers'
+
+/**
+ * @returns whether or not analytics.js should be completely disabled (never load, or drop cookies)
+ */
+export const segmentShouldBeDisabled = (
+  categories: Categories,
+  consentSettings: CDNSettingsConsent | undefined
+): boolean => {
+  if (!consentSettings || consentSettings.hasUnmappedDestinations) {
+    return false
+  }
+
+  // disable if _all_ of the the consented categories are irrelevant to segment
+  return Object.keys(categories)
+    .filter((c) => categories[c])
+    .every((c) => !consentSettings.allCategories.includes(c))
+}
+
+const isIntegrationCategoryEnabled = (
+  categories: string[],
+  userCategories: Categories
+) => {
+  const isMissingCategories = !categories || !categories.length
+
+  // Enable integration by default if it contains no consent categories data (most likely because consent has not been configured).
+  if (isMissingCategories) {
+    return true
+  }
+  // Enable integration by default if it contains no consent categories data (most likely because consent has not been configured).
+  const isEnabled = categories.every((c) => userCategories[c])
+  return isEnabled
+}
+
+export const shouldEnableIntegrationHelper = (
+  creationName: string,
+  cdnSettings: CDNSettings,
+  userCategories: Categories,
+  filterSettings: DeviceModeFilterSettings = {}
+) => {
+  const { integrationCategoryMappings, shouldEnableIntegration } =
+    filterSettings
+
+  const categories =
+    (integrationCategoryMappings
+      ? integrationCategoryMappings[creationName]
+      : parseConsentCategories(cdnSettings.integrations[creationName])) ?? []
+
+  // allow user to customize consent logic if needed
+  if (shouldEnableIntegration) {
+    return shouldEnableIntegration(categories, userCategories, {
+      creationName,
+    })
+  }
+
+  return isIntegrationCategoryEnabled(categories, userCategories)
+}
+
+export type DeviceModeFilterSettings = Pick<
+  CreateWrapperSettings,
+  'shouldEnableIntegration' | 'integrationCategoryMappings'
+>
+/**
+ * For opt-in tracking, ensure that device mode destinations that are not consented to are not loaded at all..
+ * This means that the destinations are never loaded. By disabling them here,  they can never drop their own cookies or track users.
+ * On the downside, it means that the user will not be able to opt-in to these destinations without a page refresh.
+ */
+export const filterDeviceModeDestinationsForOptIn = (
+  cdnSettings: CDNSettings,
+  consentedCategories: Categories,
+  filterSettings: DeviceModeFilterSettings
+): CDNSettings => {
+  const { remotePlugins, integrations } = cdnSettings
+  const { integrationCategoryMappings, shouldEnableIntegration } =
+    filterSettings
+
+  if (!remotePlugins) {
+    return cdnSettings
+  }
+
+  const cdnSettingsCopy: CDNSettings = {
+    ...cdnSettings,
+    remotePlugins: [...(remotePlugins || [])],
+    integrations: { ...integrations },
+  }
+
+  const _shouldEnableIntegrationHelper = (creationName: string) => {
+    return shouldEnableIntegrationHelper(
+      creationName,
+      cdnSettings,
+      consentedCategories,
+      {
+        integrationCategoryMappings,
+        shouldEnableIntegration,
+      }
+    )
+  }
+  for (const creationName in integrations) {
+    if (!_shouldEnableIntegrationHelper(creationName)) {
+      logger.debug(`Disabled (opt-in): ${creationName}`)
+      cdnSettingsCopy.remotePlugins = remotePlugins.filter(
+        (p) => p.creationName !== creationName
+      )
+      // remove disabled classic destinations and locally-installed action destinations
+      delete cdnSettingsCopy.integrations[creationName]
+    } else {
+      logger.debug(`Enabled (opt-in): ${creationName}`)
+    }
+  }
+  return cdnSettingsCopy
+}
diff --git a/packages/consent/consent-tools/src/domain/blocking-middleware.ts b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
new file mode 100644
index 000000000..ffc7e952d
--- /dev/null
+++ b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
@@ -0,0 +1,81 @@
+import {
+  CDNSettings,
+  DestinationMiddlewareFunction,
+  AnyAnalytics,
+  MaybeInitializedAnalytics,
+  SourceMiddlewareFunction,
+} from '../types'
+import {
+  shouldEnableIntegrationHelper,
+  DeviceModeFilterSettings,
+  segmentShouldBeDisabled,
+} from './blocking-helpers'
+import { logger } from './logger'
+import { parseAllCategories } from './pruned-categories'
+
+// Block all device mode destinations
+export const addBlockingMiddleware = (
+  cdnSettingsP: Promise<CDNSettings>,
+  analyticsInstance: AnyAnalytics | MaybeInitializedAnalytics,
+  filterSettings: DeviceModeFilterSettings
+) => {
+  const blockDeviceMode: DestinationMiddlewareFunction = async ({
+    integration: creationName,
+    payload,
+    next,
+  }) => {
+    const cdnSettings = await cdnSettingsP
+    const eventCategoryPreferences =
+      payload.obj.context.consent!.categoryPreferences
+    const disabled = !shouldEnableIntegrationHelper(
+      creationName,
+      cdnSettings,
+      eventCategoryPreferences,
+      filterSettings
+    )
+    logger.debug(`Device Mode: ${creationName}`, {
+      DROPPED: disabled,
+      payload: payload.obj,
+      filterSettings,
+      eventCategoryPreferences,
+    })
+    if (disabled) return null
+
+    next(payload)
+  }
+  analyticsInstance.addDestinationMiddleware('*', blockDeviceMode)
+
+  // Block segment itsel (Segment.io isn't currently allowed in addDestinationMiddleware)
+  const blockSegmentAndEverythingElse: SourceMiddlewareFunction = async ({
+    payload,
+    next,
+  }) => {
+    const cdnSettings = await cdnSettingsP
+    const eventCategoryPreferences =
+      payload.obj.context.consent!.categoryPreferences
+
+    const consentSettings = filterSettings.integrationCategoryMappings
+      ? {
+          hasUnmappedDestinations: false,
+          allCategories: parseAllCategories(
+            filterSettings.integrationCategoryMappings
+          ),
+        }
+      : cdnSettings.consentSettings
+
+    const disabled = segmentShouldBeDisabled(
+      eventCategoryPreferences,
+      consentSettings
+    )
+    logger.debug('Source Middleware', {
+      DROPPED: disabled,
+      payload: payload.obj,
+      filterSettings,
+      consentSettings,
+      eventCategoryPreferences,
+    })
+    if (disabled) return null
+    next(payload)
+  }
+  analyticsInstance.addSourceMiddleware(blockSegmentAndEverythingElse)
+}
diff --git a/packages/consent/consent-tools/src/domain/config-helpers.ts b/packages/consent/consent-tools/src/domain/config-helpers.ts
new file mode 100644
index 000000000..83dacf211
--- /dev/null
+++ b/packages/consent/consent-tools/src/domain/config-helpers.ts
@@ -0,0 +1,22 @@
+/**
+ * Parse list of categories from `cdnSettings.integration.myIntegration` object
+ * @example
+ * returns ["Analytics", "Advertising"]
+ */
+export const parseConsentCategories = (
+  integration: unknown
+): string[] | undefined => {
+  if (
+    integration &&
+    typeof integration === 'object' &&
+    'consentSettings' in integration &&
+    typeof integration.consentSettings === 'object' &&
+    integration.consentSettings &&
+    'categories' in integration.consentSettings &&
+    Array.isArray(integration.consentSettings.categories)
+  ) {
+    return (integration.consentSettings.categories as string[]) || undefined
+  }
+
+  return undefined
+}
diff --git a/packages/consent/consent-tools/src/domain/consent-stamping.ts b/packages/consent/consent-tools/src/domain/consent-stamping.ts
index bbfa11838..22101fd96 100644
--- a/packages/consent/consent-tools/src/domain/consent-stamping.ts
+++ b/packages/consent/consent-tools/src/domain/consent-stamping.ts
@@ -1,21 +1,26 @@
-import { AnyAnalytics, Categories } from '../types'
+import { Categories, SourceMiddlewareFunction } from '../types'
 import { validateCategories } from './validation'
 
 type CreateConsentMw = (
   getCategories: () => Promise<Categories>
-) => AnyAnalytics['addSourceMiddleware']
+) => SourceMiddlewareFunction
 
 /**
  * Create analytics addSourceMiddleware fn that stamps each event
  */
-export const createConsentStampingMiddleware: CreateConsentMw =
-  (getCategories) =>
-  async ({ payload, next }) => {
+export const createConsentStampingMiddleware: CreateConsentMw = (
+  getCategories
+) => {
+  const fn: SourceMiddlewareFunction = async ({ payload, next }) => {
     const categories = await getCategories()
+
     validateCategories(categories)
     payload.obj.context.consent = {
       ...payload.obj.context.consent,
       categoryPreferences: categories,
     }
+
     next(payload)
   }
+  return fn
+}
diff --git a/packages/consent/consent-tools/src/domain/create-wrapper.ts b/packages/consent/consent-tools/src/domain/create-wrapper.ts
index 77ddf866a..a2542cec0 100644
--- a/packages/consent/consent-tools/src/domain/create-wrapper.ts
+++ b/packages/consent/consent-tools/src/domain/create-wrapper.ts
@@ -3,14 +3,17 @@ import {
   CreateWrapper,
   AnyAnalytics,
   InitOptions,
-  CreateWrapperSettings,
   CDNSettings,
 } from '../types'
 import { validateCategories, validateSettings } from './validation'
 import { pipe } from '../utils'
-import { AbortLoadError, LoadContext } from './load-cancellation'
+import { normalizeShouldLoadSegment } from './load-context'
 import { AnalyticsService } from './analytics'
-import { segmentShouldBeDisabled } from './disable-segment'
+import {
+  filterDeviceModeDestinationsForOptIn,
+  segmentShouldBeDisabled,
+} from './blocking-helpers'
+import { logger } from './logger'
 
 export const createWrapper = <Analytics extends AnyAnalytics>(
   ...[createWrapperSettings]: Parameters<CreateWrapper<Analytics>>
@@ -22,14 +25,22 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
     getCategories,
     shouldLoadSegment,
     integrationCategoryMappings,
-    pruneUnmappedCategories,
     shouldEnableIntegration,
     registerOnConsentChanged,
     shouldLoadWrapper,
+    enableDebugLogging,
   } = createWrapperSettings
 
   return (analytics: Analytics) => {
-    const analyticsService = new AnalyticsService(analytics)
+    const analyticsService = new AnalyticsService(analytics, {
+      integrationCategoryMappings,
+      getCategories,
+    })
+
+    if (enableDebugLogging) {
+      logger.enableDebugLogging()
+    }
+
     const loadWrapper = shouldLoadWrapper?.() || Promise.resolve()
     void loadWrapper.then(() => {
       // Call this function as early as possible. OnConsentChanged events can happen before .load is called.
@@ -39,6 +50,7 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
       )
     })
 
+    // Create new load method to handle consent that will replace the original on the analytics instance
     const loadWithConsent: AnyAnalytics['load'] = async (
       settings,
       options
@@ -56,141 +68,58 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
         return
       }
 
-      // use these categories to disable/enable the appropriate device mode plugins
-      let initialCategories: Categories
-      try {
-        await loadWrapper
-        initialCategories =
-          (await shouldLoadSegment?.(new LoadContext())) ||
-          (await getCategories())
-      } catch (e: unknown) {
-        // consumer can call ctx.abort({ loadSegmentNormally: true })
-        // to load Segment but disable consent requirement
-        if (e instanceof AbortLoadError) {
-          if (e.loadSegmentNormally === true) {
-            analyticsService.loadNormally(settings, options)
-          }
-          // do not load anything, but do not log anything either
-          // if someone calls ctx.abort(), they are handling the error themselves
-          return
-        } else {
-          throw e
+      await loadWrapper
+      const loadCtx = await normalizeShouldLoadSegment(shouldLoadSegment)()
+
+      // if abort is called, we can either load segment normally or not load at all
+      // if user must opt-out of tracking, we load as usual and then rely on the consent blocking middleware to block events
+      if (loadCtx.isAbortCalled) {
+        if (loadCtx.abortLoadOptions?.loadSegmentNormally === true) {
+          analyticsService.load(settings, options)
         }
+        return undefined
       }
 
-      validateCategories(initialCategories)
-
       // register listener to stamp all events with latest consent information
-      analyticsService.configureConsentStampingMiddleware({
-        getCategories,
-        integrationCategoryMappings,
-        pruneUnmappedCategories,
-      })
-
-      const updateCDNSettings: InitOptions['updateCDNSettings'] = (
-        cdnSettings
-      ) => {
-        if (!cdnSettings.remotePlugins) {
-          return cdnSettings
-        }
-
-        return disableIntegrations(
-          cdnSettings,
-          initialCategories,
-          integrationCategoryMappings,
-          shouldEnableIntegration
-        )
+      analyticsService.configureConsentStampingMiddleware()
+
+      // if opt-out, we load as usual and then rely on the consent blocking middleware to block events
+      // if opt-in, we remove all destinations that are not explicitly consented to so they never load in the first place
+      if (loadCtx.loadOptions.optIn === false) {
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        analyticsService.load(settings, options)
+        return undefined
+      } else {
+        const initialCategories = await getCategories()
+        validateCategories(initialCategories)
+
+        analyticsService.load(settings, {
+          ...options,
+          updateCDNSettings: pipe((cdnSettings) => {
+            if (!cdnSettings.remotePlugins) {
+              return cdnSettings
+            }
+
+            return filterDeviceModeDestinationsForOptIn(
+              cdnSettings,
+              initialCategories,
+              { integrationCategoryMappings, shouldEnableIntegration }
+            )
+          }, options?.updateCDNSettings || ((id) => id)),
+          disable: createDisableOption(initialCategories, options?.disable),
+        })
+        return undefined
       }
-
-      return analyticsService.loadNormally(settings, {
-        ...options,
-        updateCDNSettings: pipe(
-          updateCDNSettings,
-          options?.updateCDNSettings || ((id) => id)
-        ),
-        disable: createDisableOption(initialCategories, options?.disable),
-      })
     }
+
     analyticsService.replaceLoadMethod(loadWithConsent)
     return analytics
   }
 }
 
 /**
- * Parse list of categories from `cdnSettings.integration.myIntegration` object
- * @example
- * returns ["Analytics", "Advertising"]
+ * Allow for gracefully passing a custom disable function (without clobbering the default behavior)
  */
-const getConsentCategories = (integration: unknown): string[] | undefined => {
-  if (
-    integration &&
-    typeof integration === 'object' &&
-    'consentSettings' in integration &&
-    typeof integration.consentSettings === 'object' &&
-    integration.consentSettings &&
-    'categories' in integration.consentSettings &&
-    Array.isArray(integration.consentSettings.categories)
-  ) {
-    return (integration.consentSettings.categories as string[]) || undefined
-  }
-
-  return undefined
-}
-
-const disableIntegrations = (
-  cdnSettings: CDNSettings,
-  consentedCategories: Categories,
-  integrationCategoryMappings: CreateWrapperSettings['integrationCategoryMappings'],
-  shouldEnableIntegration: CreateWrapperSettings['shouldEnableIntegration']
-): CDNSettings => {
-  const { remotePlugins, integrations } = cdnSettings
-
-  const isPluginEnabled = (creationName: string) => {
-    const categories = integrationCategoryMappings
-      ? // allow hardcoding of consent category mappings for testing (or other reasons)
-        integrationCategoryMappings[creationName]
-      : getConsentCategories(integrations[creationName])
-
-    // allow user to customize consent logic if needed
-    if (shouldEnableIntegration) {
-      return shouldEnableIntegration(categories || [], consentedCategories, {
-        creationName,
-      })
-    }
-
-    const isMissingCategories = !categories || !categories.length
-
-    // Enable integration by default if it contains no consent categories data (most likely because consent has not been configured).
-    if (isMissingCategories) {
-      return true
-    }
-
-    // Enable if all of its consent categories are consented to
-    const hasUserConsent = categories.every((c) => consentedCategories[c])
-    return hasUserConsent
-  }
-
-  const results = Object.keys(integrations).reduce<CDNSettings>(
-    (acc, creationName) => {
-      if (!isPluginEnabled(creationName)) {
-        // remote disabled action destinations
-        acc.remotePlugins =
-          acc.remotePlugins &&
-          acc.remotePlugins.filter((el) => el.creationName !== creationName)
-        // remove disabled classic destinations and locally-installed action destinations
-        delete acc.integrations[creationName]
-      }
-      return acc
-    },
-    {
-      ...cdnSettings,
-      remotePlugins,
-      integrations: { ...integrations }, // make shallow copy to avoid mutating original
-    }
-  )
-  return results
-}
-
 const createDisableOption = (
   initialCategories: Categories,
   disable: InitOptions['disable']
diff --git a/packages/consent/consent-tools/src/domain/disable-segment.ts b/packages/consent/consent-tools/src/domain/disable-segment.ts
deleted file mode 100644
index 7a06751ab..000000000
--- a/packages/consent/consent-tools/src/domain/disable-segment.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import { Categories, CDNSettingsConsent } from '../types'
-
-/**
- * @returns whether or not analytics.js should be completely disabled (never load, or drop cookies)
- */
-export const segmentShouldBeDisabled = (
-  consentCategories: Categories,
-  consentSettings: CDNSettingsConsent | undefined
-): boolean => {
-  if (!consentSettings || consentSettings.hasUnmappedDestinations) {
-    return false
-  }
-
-  // disable if _all_ of the the consented categories are irrelevant to segment
-  return Object.keys(consentCategories)
-    .filter((c) => consentCategories[c])
-    .every((c) => !consentSettings.allCategories.includes(c))
-}
diff --git a/packages/consent/consent-tools/src/domain/load-cancellation.ts b/packages/consent/consent-tools/src/domain/load-cancellation.ts
deleted file mode 100644
index 0286ac4d1..000000000
--- a/packages/consent/consent-tools/src/domain/load-cancellation.ts
+++ /dev/null
@@ -1,31 +0,0 @@
-import { AnalyticsConsentError } from '../types/errors'
-import { ValidationError } from './validation/validation-error'
-
-/**
- * Thrown when a load should be cancelled.
- */
-export class AbortLoadError extends AnalyticsConsentError {
-  constructor(public loadSegmentNormally: boolean) {
-    super('AbortLoadError', '')
-  }
-}
-
-export interface AbortLoadOptions {
-  /**
-   * Whether or not to disable the consent requirement that is normally enforced by the wrapper.
-   * If true -- load segment normally.
-   */
-  loadSegmentNormally: boolean
-}
-
-export class LoadContext {
-  /**
-   * Abort the load (this function will always throw)
-   */
-  abort(options: AbortLoadOptions): never {
-    if (typeof options !== 'object') {
-      throw new ValidationError('arg should be an object', options)
-    }
-    throw new AbortLoadError(options.loadSegmentNormally)
-  }
-}
diff --git a/packages/consent/consent-tools/src/domain/load-context.ts b/packages/consent/consent-tools/src/domain/load-context.ts
new file mode 100644
index 000000000..caa0a3a28
--- /dev/null
+++ b/packages/consent/consent-tools/src/domain/load-context.ts
@@ -0,0 +1,81 @@
+import { CreateWrapperSettings } from '../types'
+import { AnalyticsConsentError } from '../types/errors'
+import { logger } from './logger'
+import { ValidationError } from './validation/validation-error'
+
+/**
+ * Thrown when a load should be cancelled.
+ */
+export class AbortLoadError extends AnalyticsConsentError {
+  constructor(public loadSegmentNormally: boolean) {
+    super('AbortLoadError', '')
+  }
+}
+
+export interface AbortLoadOptions {
+  /**
+   * Whether or not to disable the consent requirement that is normally enforced by the wrapper.
+   * If true -- load segment normally.
+   */
+  loadSegmentNormally: boolean
+}
+
+export class LoadToken {
+  constructor(public options: LoadOptions) {}
+}
+
+interface LoadOptions {
+  optIn: boolean
+}
+
+export class LoadContext {
+  isAbortCalled = false
+  isLoadCalled = false
+  abortLoadOptions: AbortLoadOptions = {
+    loadSegmentNormally: true,
+  }
+  loadOptions: LoadOptions = {
+    /**
+     * Opt-in consent
+     */
+    optIn: true,
+  }
+
+  /**
+   * Allow analytics.js to be initialized with the consent wrapper.
+   * Note: load just means 'allowed to load' -- we still wait for analytics.load to be explicitly called.
+   */
+  load(options: LoadOptions) {
+    this.isLoadCalled = true
+    this.loadOptions = { ...this.loadOptions, ...options }
+    logger.debug('Load segment w/ consent', this.loadOptions)
+  }
+  /**
+   * Abort the _consent-wrapped_ analytics.js initialization
+   */
+  abort(options?: AbortLoadOptions): void {
+    this.isAbortCalled = true
+    this.abortLoadOptions = { ...this.abortLoadOptions, ...options }
+    logger.debug('Abort consent wrapper', this.loadOptions)
+  }
+
+  validate() {
+    if (this.isAbortCalled && this.isLoadCalled) {
+      throw new ValidationError('both abort and load should not be called')
+    }
+  }
+}
+
+/**
+ * Wrapper for shouldLoadSegment fn
+ */
+export const normalizeShouldLoadSegment = (
+  shouldLoadSegment: CreateWrapperSettings['shouldLoadSegment']
+) => {
+  return async () => {
+    const loadCtx = new LoadContext()
+    await shouldLoadSegment?.(loadCtx)
+    loadCtx.validate()
+    return loadCtx
+  }
+}
diff --git a/packages/consent/consent-tools/src/domain/logger.ts b/packages/consent/consent-tools/src/domain/logger.ts
new file mode 100644
index 000000000..868a49c9b
--- /dev/null
+++ b/packages/consent/consent-tools/src/domain/logger.ts
@@ -0,0 +1,20 @@
+// hacky debug.ts, can be replaced with a proper logging solution
+// @ts-ignore
+
+class Logger {
+  private get debugLoggingEnabled() {
+    return (window as any)['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] === true
+  }
+
+  enableDebugLogging() {
+    ;(window as any)['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
+  }
+
+  debug(...args: any[]): void {
+    if (this.debugLoggingEnabled) {
+      console.log('[consent wrapper debug]', ...args)
+    }
+  }
+}
+
+export const logger = new Logger()
diff --git a/packages/consent/consent-tools/src/domain/pruned-categories.ts b/packages/consent/consent-tools/src/domain/pruned-categories.ts
index f517d279c..7870726fe 100644
--- a/packages/consent/consent-tools/src/domain/pruned-categories.ts
+++ b/packages/consent/consent-tools/src/domain/pruned-categories.ts
@@ -1,29 +1,18 @@
 import { uniq, pick } from '../utils'
-import {
-  CDNSettings,
-  CreateWrapperSettings,
-  Categories,
-  GetCategoriesFunction,
-} from '../types'
+import { Categories, IntegrationCategoryMappings } from '../types'
 import { ValidationError } from './validation/validation-error'
 
-export const getPrunedCategories = async (
-  getCategories: GetCategoriesFunction,
-  cdnSettings: CDNSettings,
-  integrationCategoryMappings?: CreateWrapperSettings['integrationCategoryMappings']
-): Promise<Categories> => {
-  // we don't want to send _every_ category to segment, only the ones that the user has explicitly configured in their integrations
-  let allCategories: string[]
-  // We need to get all the unique categories so we can prune the consent object down to only the categories that are configured
-  // There can be categories that are not included in any integration in the integrations object (e.g. 2 cloud mode categories), which is why we need a special allCategories array
-  if (integrationCategoryMappings) {
-    allCategories = uniq(
-      Object.values(integrationCategoryMappings).reduce((p, n) => p.concat(n))
-    )
-  } else {
-    allCategories = cdnSettings.consentSettings?.allCategories || []
-  }
-
+export const parseAllCategories = (
+  integrationCategoryMappings: IntegrationCategoryMappings
+) => {
+  return uniq(
+    Object.values(integrationCategoryMappings).reduce((p, n) => p.concat(n))
+  )
+}
+export const getPrunedCategories = (
+  categories: Categories,
+  allCategories: string[]
+): Categories => {
   if (!allCategories.length) {
     // No configured integrations found, so no categories will be sent (should not happen unless there's a configuration error)
     throw new ValidationError(
@@ -32,7 +21,5 @@ export const getPrunedCategories = async (
     )
   }
 
-  const categories = await getCategories()
-
   return pick(categories, allCategories)
 }
diff --git a/packages/consent/consent-tools/src/domain/validation/options-validators.ts b/packages/consent/consent-tools/src/domain/validation/options-validators.ts
index 183ac5a52..ac1128a3c 100644
--- a/packages/consent/consent-tools/src/domain/validation/options-validators.ts
+++ b/packages/consent/consent-tools/src/domain/validation/options-validators.ts
@@ -58,11 +58,7 @@ export function validateAnalyticsInstance(
   analytics: unknown
 ): asserts analytics is AnyAnalytics {
   assertIsObject(analytics, 'analytics')
-  if (
-    'load' in analytics &&
-    'on' in analytics &&
-    'addSourceMiddleware' in analytics
-  ) {
+  if ('load' in analytics && 'addSourceMiddleware' in analytics) {
     return
   }
   throw new ValidationError('analytics is not an Analytics instance', analytics)
diff --git a/packages/consent/consent-tools/src/test-helpers/mocks/analytics-mock.ts b/packages/consent/consent-tools/src/test-helpers/mocks/analytics-mock.ts
index 89fdbb9a4..9de2fbbc0 100644
--- a/packages/consent/consent-tools/src/test-helpers/mocks/analytics-mock.ts
+++ b/packages/consent/consent-tools/src/test-helpers/mocks/analytics-mock.ts
@@ -1,9 +1,9 @@
 import { AnyAnalytics } from '../../types'
 
 export const analyticsMock: jest.Mocked<AnyAnalytics> = {
+  addDestinationMiddleware: jest.fn(),
   addSourceMiddleware: jest.fn(),
   page: jest.fn(),
   load: jest.fn(),
-  on: jest.fn(),
   track: jest.fn(),
 }
diff --git a/packages/consent/consent-tools/src/types/settings.ts b/packages/consent/consent-tools/src/types/settings.ts
index 0fc6e7d41..639527d58 100644
--- a/packages/consent/consent-tools/src/types/settings.ts
+++ b/packages/consent/consent-tools/src/types/settings.ts
@@ -1,4 +1,4 @@
-import { LoadContext } from '../domain/load-cancellation'
+import { LoadContext } from '../domain/load-context'
 import type {
   Categories,
   IntegrationCategoryMappings,
@@ -35,8 +35,6 @@ export interface CreateWrapperSettings {
 
   /**
    * Wait until this function resolves/returns before loading analytics.
-   * This function should return a list of initial categories.
-   * If this function returns `undefined`, `getCategories()` function will be called to get initial categories.
    * @example
    * ```ts
    *   // Wrapper waits to load segment / get categories until this function returns / resolves
@@ -56,9 +54,7 @@ export interface CreateWrapperSettings {
    * },
    * ```
    **/
-  shouldLoadSegment?: (
-    ctx: LoadContext
-  ) => Categories | void | Promise<Categories | void>
+  shouldLoadSegment?: (ctx: LoadContext) => void | Promise<void>
 
   /**
    * Fetch the categories which stamp every event. Called each time a new Segment event is dispatched.
@@ -148,4 +144,9 @@ export interface CreateWrapperSettings {
    * ```
    */
   pruneUnmappedCategories?: boolean
+
+  /**
+   * Enable debug logging for the wrapper.
+   */
+  enableDebugLogging?: boolean
 }
diff --git a/packages/consent/consent-tools/src/types/wrapper.ts b/packages/consent/consent-tools/src/types/wrapper.ts
index c10fe1ffc..5573dd7c0 100644
--- a/packages/consent/consent-tools/src/types/wrapper.ts
+++ b/packages/consent/consent-tools/src/types/wrapper.ts
@@ -25,13 +25,68 @@ export type MaybeInitializedAnalytics = {
   initialized?: boolean
 } & OptionalField<AnyAnalytics, 'load'>
 
+export interface SegmentEventStub {
+  context: {
+    consent?: {
+      /**
+       * @example { "CAT001": true }
+       */
+      categoryPreferences: {
+        [category: string]: boolean
+      }
+    }
+  }
+}
+/**
+ * Note: we aren't importing from @segment/analytics-next in src code, because we don't want
+ * to introduce a doependency on the analytics-next package, which would trigger errors for customers if they have skipLibCheck set to false (which is default).
+ * @example { "Amplitude (Actions)":  { .... }}
+ */
+export interface SegmentIntegrations {
+  [creationName: string]: any
+}
+export interface SourceMiddlewareParams {
+  payload: {
+    obj: SegmentEventStub
+  }
+  integrations?: SegmentIntegrations
+  next: (payload: SourceMiddlewareParams['payload'] | null) => void
+}
+
+export type SourceMiddlewareFunction = (
+  middleware: SourceMiddlewareParams
+) => null | void | Promise<void | null>
+
+export interface DestinationMiddlewareParams {
+  payload: SourceMiddlewareParams['payload']
+  next: SourceMiddlewareParams['next']
+  /**
+   * integration name
+   * @example "Amplitude (Actions)"
+   */
+  integration: string
+}
+
+export type DestinationMiddlewareFunction = (
+  middleware: DestinationMiddlewareParams
+) => null | void | Promise<void | null>
+
 /**
  * This interface is a stub of the actual Segment analytics instance.
  * Either `AnalyticsSnippet` _or_ `AnalyticsBrowser`.
  */
 export interface AnyAnalytics {
-  addSourceMiddleware(...args: any[]): any
-  on(event: 'initialize', callback: (cdnSettings: CDNSettings) => void): void
+  // Yes, the typing is strange (any | this resolves to 'any' -- ditto Function | any).
+  // This is to documenting the strict type in the type signature, rather than use it.
+  // internally, we can have stronger typing, but we don't want false positive TS errors in the public API
+  // Again, we don't want to introduce a non-dev dependency on analytics-next
+  addDestinationMiddleware(
+    integrationName: string,
+    middleware: Function | DestinationMiddlewareFunction
+  ): any | this
+  addSourceMiddleware(
+    middleware: Function | SourceMiddlewareFunction
+  ): any | this
   track(event: string, properties?: unknown, ...args: any[]): void
   page(): void
 
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts b/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
index 4f24702fb..fbb9785ff 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
@@ -42,7 +42,6 @@ describe('High level "integration" tests', () => {
       .spyOn(OneTrustAPI, 'getOneTrustGlobal')
       .mockImplementation(() => OneTrustMockGlobal)
     getConsentedGroupIdsSpy.mockReset()
-    analyticsMock.on = jest.fn()
     Object.values(OneTrustMockGlobal).forEach((fn) => fn.mockReset())
     /**
      * Typically, resolveWhen triggers when a predicate is true. We can manually 'check' so we don't have to use timeouts.
@@ -60,14 +59,17 @@ describe('High level "integration" tests', () => {
     it('should load if alert box is closed and groups are defined', async () => {
       withOneTrust(analyticsMock)
 
-      const shouldLoadSegment = Promise.resolve(
-        createWrapperSpyHelper.shouldLoadSegment({} as any)
-      )
-      OneTrustMockGlobal.GetDomainData.mockReturnValueOnce(domainDataMock)
+      OneTrustMockGlobal.GetDomainData.mockReturnValue(domainDataMock)
       OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValueOnce(true)
       getConsentedGroupIdsSpy.mockImplementation(() => [
         domainGroupMock.StrictlyNeccessary.CustomGroupId,
       ])
+      const shouldLoadSegment = Promise.resolve(
+        createWrapperSpyHelper.shouldLoadSegment({
+          load: jest.fn(),
+          abort: jest.fn(),
+        } as any)
+      )
       checkResolveWhen()
       await expect(shouldLoadSegment).resolves.toBeUndefined()
     })
@@ -86,7 +88,7 @@ describe('High level "integration" tests', () => {
 
     it("should load regardless of AlertBox status if showAlertNotice is true (e.g. 'show banner is unchecked')", async () => {
       withOneTrust(analyticsMock)
-      OneTrustMockGlobal.GetDomainData.mockReturnValueOnce({
+      OneTrustMockGlobal.GetDomainData.mockReturnValue({
         ...domainDataMock,
         ShowAlertNotice: false, // meaning, it's open
       })
@@ -94,7 +96,10 @@ describe('High level "integration" tests', () => {
         domainGroupMock.StrictlyNeccessary.CustomGroupId,
       ])
       const shouldLoadSegment = Promise.resolve(
-        createWrapperSpyHelper.shouldLoadSegment({} as any)
+        createWrapperSpyHelper.shouldLoadSegment({
+          load: jest.fn(),
+          abort: jest.fn(),
+        } as any)
       )
       OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValueOnce(false) // alert box is _never open
       checkResolveWhen()
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts b/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
new file mode 100644
index 000000000..4659b5051
--- /dev/null
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
@@ -0,0 +1,15 @@
+import { OtConsentModel } from '../lib/onetrust-api'
+
+export const isOptInConsentModel = (model: OtConsentModel): boolean => {
+  switch (model) {
+    case OtConsentModel.optIn:
+    case OtConsentModel.implicit:
+      return true
+    case OtConsentModel.optOut:
+    case OtConsentModel.custom:
+    case OtConsentModel.notice:
+      return false
+    default:
+      return false
+  }
+}
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
index 3035f7275..f383b7fda 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
@@ -11,10 +11,18 @@ import {
   getConsentedGroupIds,
   getOneTrustGlobal,
 } from '../lib/onetrust-api'
-
+import { isOptInConsentModel } from './consent-model'
 export interface OneTrustSettings {
   integrationCategoryMappings?: CreateWrapperSettings['integrationCategoryMappings']
   disableConsentChangedEvent?: boolean
+  /**
+   * Override configured consent model
+   * - optIn = true (default) - load segment and all destinations without waiting for explicit consent.
+   * - optIn = false (strict/GDPR) - wait for explicit consent before loading segment
+   *
+   * By default, the value is determined by `OneTrust.GetDomainData().ConsentModel` which is set in the OneTrust UI.
+   */
+  optIn?: () => boolean
 }
 
 /**
@@ -32,9 +40,18 @@ export const withOneTrust = <Analytics extends AnyAnalytics>(
       await resolveWhen(() => getOneTrustGlobal() !== undefined, 500)
     },
     // wait for AlertBox to be closed before segment can be loaded. If no consented groups, do not load Segment.
-    shouldLoadSegment: async () => {
+    shouldLoadSegment: async (ctx) => {
+      const OneTrust = getOneTrustGlobal()!
+      const isOptIn =
+        settings.optIn ??
+        isOptInConsentModel(OneTrust.GetDomainData().ConsentModel.Name)
+
+      if (!isOptIn) {
+        return ctx.load({
+          optIn: false,
+        })
+      }
       await resolveWhen(() => {
-        const OneTrust = getOneTrustGlobal()!
         return (
           // if any groups at all are consented to
           Boolean(getConsentedGroupIds().length) &&
@@ -44,6 +61,7 @@ export const withOneTrust = <Analytics extends AnyAnalytics>(
             OneTrust.IsAlertBoxClosed())
         )
       }, 500)
+      return ctx.load({ optIn: true })
     },
     getCategories: () => {
       const results = getNormalizedCategoriesFromGroupData()
diff --git a/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts b/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
index 759a0869d..1e65f2a9c 100644
--- a/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
@@ -21,9 +21,20 @@ type GroupInfoDto = {
 
 type OtConsentChangedEvent = CustomEvent<ConsentGroupIds>
 
+export enum OtConsentModel {
+  optIn = 'opt-in',
+  optOut = 'opt-out',
+  custom = 'custom',
+  notice = 'notice',
+  implicit = 'implicit',
+}
+
 export interface OneTrustDomainData {
   ShowAlertNotice: boolean
   Groups: GroupInfoDto[]
+  ConsentModel: {
+    Name: OtConsentModel
+  }
 }
 /**
  * The data model used by the OneTrust lib
diff --git a/packages/consent/consent-wrapper-onetrust/src/test-helpers/mocks.ts b/packages/consent/consent-wrapper-onetrust/src/test-helpers/mocks.ts
index 488e549ec..a9232367c 100644
--- a/packages/consent/consent-wrapper-onetrust/src/test-helpers/mocks.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/test-helpers/mocks.ts
@@ -1,5 +1,8 @@
-import { OneTrustDomainData, OneTrustGlobal } from '../lib/onetrust-api'
-import { addDebugMockImplementation } from './utils'
+import {
+  OneTrustDomainData,
+  OneTrustGlobal,
+  OtConsentModel,
+} from '../lib/onetrust-api'
 import type { AnyAnalytics } from '@segment/analytics-consent-tools'
 /**
  * This can be used to mock the OneTrust global object in individual tests
@@ -9,17 +12,12 @@ import type { AnyAnalytics } from '@segment/analytics-consent-tools'
  * jest.spyOn(OneTrustAPI, 'getOneTrustGlobal').mockImplementation(() => OneTrustMockGlobal)
  * ````
  */
-export const OneTrustMockGlobal: jest.Mocked<OneTrustGlobal> = {
-  GetDomainData: jest.fn(),
-  IsAlertBoxClosed: jest.fn(),
-  OnConsentChanged: jest.fn(),
-}
 
 export const analyticsMock: jest.Mocked<AnyAnalytics> = {
   page: jest.fn(),
   addSourceMiddleware: jest.fn(),
+  addDestinationMiddleware: jest.fn(),
   load: jest.fn(),
-  on: jest.fn(),
   track: jest.fn(),
 }
 
@@ -37,8 +35,14 @@ export const domainGroupMock = {
 
 export const domainDataMock: jest.Mocked<OneTrustDomainData> = {
   Groups: [domainGroupMock.StrictlyNeccessary],
+  ConsentModel: {
+    Name: OtConsentModel.optIn,
+  },
   ShowAlertNotice: true,
 }
 
-addDebugMockImplementation(OneTrustMockGlobal)
-addDebugMockImplementation(analyticsMock)
+export const OneTrustMockGlobal: jest.Mocked<OneTrustGlobal> = {
+  GetDomainData: jest.fn().mockReturnValue(domainDataMock),
+  IsAlertBoxClosed: jest.fn(),
+  OnConsentChanged: jest.fn(),
+}
diff --git a/playgrounds/standalone-playground/pages/index-consent-opt-out.html b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
new file mode 100644
index 000000000..63b3a4d8d
--- /dev/null
+++ b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
@@ -0,0 +1,201 @@
+<html>
+
+<head>
+
+
+  <!-- Form: WriteKey -->
+  <form method="get">
+    <input type="text" name="writeKey" placeholder="Writekey" />
+    <button>Load</button>
+  </form>
+  <script>
+    const { searchParams } = new URL(document.location);
+    const writeKey = searchParams.get("writeKey");
+    document.querySelector("input").value = writeKey;
+  </script>
+
+  <!-- Form: Clear OneTrust Cookie -->
+  <button id="clear-ot-cookies">Clear OneTrust Cookies & Reload</button>
+  <script>
+    document.getElementById('clear-ot-cookies').addEventListener('click', () => {
+      ['OptanonConsent', 'OptanonAlertBoxClosed'].forEach((name) => {
+        document.cookie =
+          name + "=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;";
+      });
+      window.location.reload();
+      console.log("OneTrust Cookies cleared.");
+    })
+  </script>
+
+  <!-- OneTrust Vendor Script -->
+  <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript"
+    data-domain-script="80ca7b5c-e72f-4bd0-972a-b74d052a0820-test"></script>
+
+  <!-- OneTrust Wrapper -->
+  <script
+    src="/node_modules/@segment/analytics-consent-wrapper-onetrust/dist/umd/analytics-onetrust.umd.development.js">
+    </script>
+  <!-- Segment Snippet (Modified)-->
+  <script>
+    if (writeKey) {
+      !(function () {
+        var analytics = (window.analytics = window.analytics || [])
+        if (!analytics.initialize)
+          if (analytics.invoked)
+            window.console &&
+              console.error &&
+              console.error('Segment snippet included twice.')
+          else {
+            analytics.invoked = !0
+            analytics.methods = [
+              'screen',
+              'register',
+              'deregister',
+              'trackSubmit',
+              'trackClick',
+              'trackLink',
+              'trackForm',
+              'pageview',
+              'identify',
+              'reset',
+              'group',
+              'track',
+              'ready',
+              'alias',
+              'debug',
+              'page',
+              'once',
+              'off',
+              'on',
+              'addSourceMiddleware',
+              'addIntegrationMiddleware',
+              'setAnonymousId',
+              'addDestinationMiddleware',
+              'emit'
+            ]
+            analytics.factory = function (e) {
+              return function () {
+                if (window.analytics.initialized) {
+                  // Sometimes users assigned analytics to a variable before analytics is done loading, resulting in a stale reference.
+                  // If so, proxy any calls to the 'real' analytics instance.
+                  return window.analytics[e].apply(window.analytics, arguments);
+                }
+                var t = Array.prototype.slice.call(arguments)
+                t.unshift(e)
+                analytics.push(t)
+                return analytics
+              }
+            }
+            for (var e = 0; e < analytics.methods.length; e++) {
+              var key = analytics.methods[e]
+              analytics[key] = analytics.factory(key)
+            }
+            analytics.load = function (key, e) {
+              var t = document.createElement('script')
+              t.type = 'text/javascript'
+              t.async = !0
+              t.src = '/node_modules/@segment/analytics-next/dist/umd/standalone.js'
+              var n = document.getElementsByTagName('script')[0]
+              n.parentNode.insertBefore(t, n)
+              analytics._loadOptions = e
+            }
+            analytics.SNIPPET_VERSION = '4.13.1'
+            analytics._writeKey = writeKey
+            window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
+            withOneTrust(analytics, { optIn: () => false }).load()
+            analytics.page()
+          }
+      })()
+    }
+  </script>
+
+</head>
+
+<body>
+  <form>
+    <textarea name="event" id="event">
+{
+  "name": "hi",
+  "properties": { },
+  "traits": { },
+  "options": { }
+}
+    </textarea>
+    <div>
+      <button id="track">Track</button>
+      <button id="identify">Identify</button>
+    </div>
+  </form>
+  <h2>Consent Changed Event</h2>
+  <pre id="consent-changed"></pre>
+  <h2>Logs</h2>
+  <pre id="logs"></pre>
+
+  <script type="text/javascript">
+    const displayConsentLogs = (str) => document.querySelector('#consent-changed').textContent = str
+    analytics.on('track', (name, properties, options) => {
+      if (name.includes("Segment Consent")) {
+        displayConsentLogs("Consent Changed Event Fired")
+        setTimeout(() => displayConsentLogs(''), 3000)
+      }
+    })
+    const displayRegularLogs = (str) => document.querySelector('#logs').textContent = str
+    const logEvent = (promise) => {
+      if (Array.isArray(promise)) {
+        displayRegularLogs('Analytics is not initialized!')
+        setTimeout(() => displayRegularLogs(''), 5000)
+        return
+      }
+      if (promise) {
+        promise.then((ctx) => {
+          ctx.flush()
+          displayRegularLogs(JSON.stringify(
+            ctx.event,
+            null,
+            2
+          ))
+        })
+      }
+    }
+
+
+    document.querySelector('#track').addEventListener('click', async (e) => {
+      e.preventDefault()
+      const contents = document.querySelector('#event').value
+      const evt = JSON.parse(contents)
+      const promise = window.analytics.track(
+        evt.name ?? '',
+        evt.properties ?? {},
+        evt.options ?? {}
+      )
+      logEvent(promise)
+    })
+
+    document
+      .querySelector('#identify')
+      .addEventListener('click', async (e) => {
+        e.preventDefault()
+        const contents = document.querySelector('#event').value
+        const evt = JSON.parse(contents)
+        const promise = window.analytics.identify(
+          evt.name ?? '',
+          evt.properties ?? {},
+          evt.options ?? {}
+        )
+        logEvent(promise)
+      })
+  </script>
+  <style>
+    body {
+      font-family: monospace;
+    }
+
+    #event {
+      margin: 2em 0;
+      min-height: 200px;
+      min-width: 700px;
+    }
+  </style>
+</body>
+
+</html>
\ No newline at end of file
diff --git a/playgrounds/standalone-playground/pages/index-consent.html b/playgrounds/standalone-playground/pages/index-consent.html
index 64afa1da5..3471dc423 100644
--- a/playgrounds/standalone-playground/pages/index-consent.html
+++ b/playgrounds/standalone-playground/pages/index-consent.html
@@ -29,7 +29,8 @@
 
   <!-- OneTrust Vendor Script -->
   <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript"
-    data-domain-script="80ca7b5c-e72f-4bd0-972a-b74d052a0820-test"></script>
+    data-domain-script="189ebd49-0e43-4cd1-8f88-c3f40f8e4996-test"></script>
+
 
   <!-- OneTrust Wrapper -->
   <script
@@ -101,8 +102,10 @@
             }
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
+            window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
             withOneTrust(analytics).load()
             analytics.page()
+
           }
       })()
     }
@@ -197,4 +200,4 @@ <h2>Logs</h2>
   </style>
 </body>
 
-</html>
+</html>
\ No newline at end of file

From 0fa136cd2d0717887f2ce11904554a09d4441c3b Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 17:03:17 -0500
Subject: [PATCH 02/56] wip

---
 .../consent-tools-vanilla-opt-out/index.ts    |  2 +-
 .../consent-tools-vanilla/index.ts            |  2 +-
 .../page-bundles/helpers/mock-cmp-wrapper.ts  |  6 +++---
 .../src/page-bundles/helpers/mock-cmp.ts      | 14 +++++++------
 .../src/page-objects/consent-tools-vanilla.ts | 20 +++++++++++--------
 .../consent-tools-vanilla-opt-out.test.ts     |  4 ++--
 .../src/tests/consent-tools-vanilla.test.ts   |  4 ++--
 .../domain/__tests__/create-wrapper.test.ts   |  2 +-
 .../src/domain/create-wrapper.ts              |  2 +-
 .../consent-tools/src/domain/load-context.ts  |  6 ++++--
 packages/consent/consent-tools/src/index.ts   |  1 +
 .../src/domain/consent-model.ts               | 12 +++++++----
 .../src/domain/wrapper.ts                     | 20 +++++++++----------
 .../pages/index-consent-opt-out.html          |  2 +-
 14 files changed, 55 insertions(+), 42 deletions(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts
index 7734721bc..0d6356765 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-out/index.ts
@@ -3,7 +3,7 @@ import { initMockConsentManager } from '../helpers/mock-cmp'
 import { withMockCMP } from '../helpers/mock-cmp-wrapper'
 
 initMockConsentManager({
-  isOptIn: false,
+  consentModel: 'opt-out',
 })
 
 const analytics = new AnalyticsBrowser()
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
index da3a88cc6..025dc3def 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
@@ -2,7 +2,7 @@ import { AnalyticsBrowser } from '@segment/analytics-next'
 import { initMockConsentManager } from '../helpers/mock-cmp'
 import { withMockCMP } from '../helpers/mock-cmp-wrapper'
 
-initMockConsentManager({ isOptIn: true })
+initMockConsentManager({ consentModel: 'opt-in' })
 
 const analytics = new AnalyticsBrowser()
 
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts
index 342c20fbe..df9395943 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp-wrapper.ts
@@ -11,11 +11,11 @@ export const withMockCMP = (analyticsInstance: any) =>
       window.MockCMP.onConsentChange(fn)
     },
     shouldLoadSegment: async (ctx) => {
-      if (!window.MockCMP.isOptIn) {
+      if (window.MockCMP.consentModel === 'opt-out') {
         // if opt out, load immediately
-        return ctx.load({ optIn: false })
+        return ctx.load({ consentModel: 'opt-out' })
       }
       await window.MockCMP.waitForAlertBoxClose()
-      ctx.load({ optIn: true })
+      ctx.load({ consentModel: 'opt-in' })
     },
   })(analyticsInstance)
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
index faef9c748..57b98ad43 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
@@ -16,13 +16,15 @@ type ConsentChangeFn = (categories: Record<string, boolean>) => void
  * Similar to OneTrust, TrustArc, etc.
  * sets a global `window.MockCMP` object that can be used to interact with the mock consent manager.
  */
-export const initMockConsentManager = (settings: { isOptIn: boolean }) => {
+export const initMockConsentManager = (settings: { consentModel: string }) => {
+  const isOptIn = settings.consentModel === 'opt-in'
   // if opt-in is true, all categories are set to true by default
   let categories = {
-    FooCategory1: settings.isOptIn,
-    FooCategory2: settings.isOptIn,
+    FooCategory1: isOptIn,
+    FooCategory2: isOptIn,
   }
-  console.log('initMockConsentManager', settings.isOptIn, categories)
+  console.log('initMockConsentManager', settings, categories)
+
   let onConsentChange = (_categories: Record<string, boolean>) =>
     undefined as void
 
@@ -50,8 +52,8 @@ export const initMockConsentManager = (settings: { isOptIn: boolean }) => {
     get isLoaded() {
       return loaded
     },
-    get isOptIn() {
-      return settings.isOptIn
+    get consentModel() {
+      return settings.consentModel
     },
     setCategories: (newCategories: Record<string, boolean>) => {
       categories = { ...categories, ...newCategories }
diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
index a347ff6a8..bdf7e3dac 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
@@ -1,14 +1,6 @@
 import { BasePage } from './base-page'
 
 export class ConsentToolsVanilla extends BasePage {
-  constructor({ optIn }: { optIn: boolean }) {
-    super(
-      optIn
-        ? 'consent-tools-vanilla.html'
-        : 'consent-tools-vanilla-opt-out.html'
-    )
-  }
-
   clickGiveConsent() {
     return $('#give-consent').click()
   }
@@ -16,3 +8,15 @@ export class ConsentToolsVanilla extends BasePage {
     return $('#deny-consent').click()
   }
 }
+
+export class ConsentToolsVanillaOptOut extends ConsentToolsVanilla {
+  constructor() {
+    super('consent-tools-vanilla-opt-out.html')
+  }
+}
+
+export class ConsentToolsVanillaOptIn extends ConsentToolsVanilla {
+  constructor() {
+    super('consent-tools-vanilla.html')
+  }
+}
diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
index 8f4c899c8..7f5f2d50e 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
@@ -2,10 +2,10 @@
  * Tests targeting @segment/analytics-consent-tools
  */
 
-import { ConsentToolsVanilla } from '../page-objects/consent-tools-vanilla'
+import { ConsentToolsVanillaOptOut } from '../page-objects/consent-tools-vanilla'
 import { expect } from 'expect'
 
-const page = new ConsentToolsVanilla({ optIn: false })
+const page = new ConsentToolsVanillaOptOut()
 
 afterEach(async () => {
   await page.cleanup()
diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
index f24c2ba94..dce5f6ef4 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
@@ -2,10 +2,10 @@
  * Tests targeting @segment/analytics-consent-tools
  */
 
-import { ConsentToolsVanilla } from '../page-objects/consent-tools-vanilla'
+import { ConsentToolsVanillaOptIn } from '../page-objects/consent-tools-vanilla'
 import { expect } from 'expect'
 
-const page = new ConsentToolsVanilla({ optIn: true })
+const page = new ConsentToolsVanillaOptIn()
 
 afterEach(async () => {
   await page.cleanup()
diff --git a/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts b/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts
index eaedc1fb8..5e786af83 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/create-wrapper.test.ts
@@ -125,7 +125,7 @@ describe(createWrapper, () => {
         wrapTestAnalytics({
           shouldLoadSegment: (ctx) => {
             ctx.abort({ loadSegmentNormally: true })
-            ctx.load({ optIn: true })
+            ctx.load({ consentModel: 'opt-in' })
           },
         })
         await expect(() =>
diff --git a/packages/consent/consent-tools/src/domain/create-wrapper.ts b/packages/consent/consent-tools/src/domain/create-wrapper.ts
index a2542cec0..fed0efab8 100644
--- a/packages/consent/consent-tools/src/domain/create-wrapper.ts
+++ b/packages/consent/consent-tools/src/domain/create-wrapper.ts
@@ -85,7 +85,7 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
 
       // if opt-out, we load as usual and then rely on the consent blocking middleware to block events
       // if opt-in, we remove all destinations that are not explicitly consented to so they never load in the first place
-      if (loadCtx.loadOptions.optIn === false) {
+      if (loadCtx.loadOptions.consentModel === false) {
         analyticsService.configureBlockingMiddlewareForOptOut()
         analyticsService.load(settings, options)
         return undefined
diff --git a/packages/consent/consent-tools/src/domain/load-context.ts b/packages/consent/consent-tools/src/domain/load-context.ts
index caa0a3a28..e1b4778f9 100644
--- a/packages/consent/consent-tools/src/domain/load-context.ts
+++ b/packages/consent/consent-tools/src/domain/load-context.ts
@@ -24,8 +24,10 @@ export class LoadToken {
   constructor(public options: LoadOptions) {}
 }
 
+export type ConsentModel = 'opt-in' | 'opt-out'
+
 interface LoadOptions {
-  optIn: boolean
+  consentModel: ConsentModel
 }
 
 export class LoadContext {
@@ -38,7 +40,7 @@ export class LoadContext {
     /**
      * Opt-in consent
      */
-    optIn: true,
+    consentModel: 'opt-in',
   }
 
   /**
diff --git a/packages/consent/consent-tools/src/index.ts b/packages/consent/consent-tools/src/index.ts
index fdca76598..23bcb2ed4 100644
--- a/packages/consent/consent-tools/src/index.ts
+++ b/packages/consent/consent-tools/src/index.ts
@@ -5,6 +5,7 @@
 export { createWrapper } from './domain/create-wrapper'
 export { resolveWhen } from './utils'
 
+export type { ConsentModel } from './domain/load-context'
 export type {
   Wrapper,
   CreateWrapper,
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts b/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
index 4659b5051..8565da1e4 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
@@ -1,15 +1,19 @@
+import { ConsentModel } from '@segment/analytics-consent-tools'
 import { OtConsentModel } from '../lib/onetrust-api'
 
-export const isOptInConsentModel = (model: OtConsentModel): boolean => {
+/**
+ *  We don't support all consent models, so we need to coerce them to the ones we do support.
+ */
+export const coerceConsentModel = (model: OtConsentModel): ConsentModel => {
   switch (model) {
     case OtConsentModel.optIn:
     case OtConsentModel.implicit:
-      return true
+      return 'opt-in'
     case OtConsentModel.optOut:
     case OtConsentModel.custom:
     case OtConsentModel.notice:
-      return false
+      return 'opt-out'
     default:
-      return false
+      return 'opt-out'
   }
 }
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
index f383b7fda..6524b86ef 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
@@ -11,18 +11,18 @@ import {
   getConsentedGroupIds,
   getOneTrustGlobal,
 } from '../lib/onetrust-api'
-import { isOptInConsentModel } from './consent-model'
+import { coerceConsentModel } from './consent-model'
 export interface OneTrustSettings {
   integrationCategoryMappings?: CreateWrapperSettings['integrationCategoryMappings']
   disableConsentChangedEvent?: boolean
   /**
    * Override configured consent model
-   * - optIn = true (default) - load segment and all destinations without waiting for explicit consent.
-   * - optIn = false (strict/GDPR) - wait for explicit consent before loading segment
+   * - opt-in  (default) - load segment and all destinations without waiting for explicit consent.
+   * - opt-out (strict/GDPR) - wait for explicit consent before loading segment
    *
    * By default, the value is determined by `OneTrust.GetDomainData().ConsentModel` which is set in the OneTrust UI.
    */
-  optIn?: () => boolean
+  consentModel?: () => 'opt-in' | 'opt-out'
 }
 
 /**
@@ -42,13 +42,13 @@ export const withOneTrust = <Analytics extends AnyAnalytics>(
     // wait for AlertBox to be closed before segment can be loaded. If no consented groups, do not load Segment.
     shouldLoadSegment: async (ctx) => {
       const OneTrust = getOneTrustGlobal()!
-      const isOptIn =
-        settings.optIn ??
-        isOptInConsentModel(OneTrust.GetDomainData().ConsentModel.Name)
+      const consentModel =
+        settings.consentModel?.() ||
+        coerceConsentModel(OneTrust.GetDomainData().ConsentModel.Name)
 
-      if (!isOptIn) {
+      if (consentModel === 'opt-out') {
         return ctx.load({
-          optIn: false,
+          consentModel: 'opt-out',
         })
       }
       await resolveWhen(() => {
@@ -61,7 +61,7 @@ export const withOneTrust = <Analytics extends AnyAnalytics>(
             OneTrust.IsAlertBoxClosed())
         )
       }, 500)
-      return ctx.load({ optIn: true })
+      return ctx.load({ consentModel: 'opt-in' })
     },
     getCategories: () => {
       const results = getNormalizedCategoriesFromGroupData()
diff --git a/playgrounds/standalone-playground/pages/index-consent-opt-out.html b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
index 63b3a4d8d..8b3ccd848 100644
--- a/playgrounds/standalone-playground/pages/index-consent-opt-out.html
+++ b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
@@ -102,7 +102,7 @@
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
             window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
-            withOneTrust(analytics, { optIn: () => false }).load()
+            withOneTrust(analytics, { consentModel: () => 'opt-in' }).load()
             analytics.page()
           }
       })()

From f17c83b8164d340e12d11d7e2c24b9243b2bc638 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 17:08:22 -0500
Subject: [PATCH 03/56] revert file

---
 packages/browser/src/core/analytics/index.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/browser/src/core/analytics/index.ts b/packages/browser/src/core/analytics/index.ts
index f66a20d1e..a7675c131 100644
--- a/packages/browser/src/core/analytics/index.ts
+++ b/packages/browser/src/core/analytics/index.ts
@@ -64,14 +64,14 @@ const global: any = getGlobal()
 const _analytics = global?.analytics
 
 function createDefaultQueue(
-  writeKey: string,
+  name: string,
   retryQueue = false,
   disablePersistance = false
 ) {
   const maxAttempts = retryQueue ? 10 : 1
   const priorityQueue = disablePersistance
     ? new PriorityQueue(maxAttempts, [])
-    : new PersistedPriorityQueue(maxAttempts, `${writeKey}:event-queue`)
+    : new PersistedPriorityQueue(maxAttempts, name)
   return new EventQueue(priorityQueue)
 }
 
@@ -184,7 +184,7 @@ export class Analytics
     this.queue =
       queue ??
       createDefaultQueue(
-        settings.writeKey,
+        `${settings.writeKey}:event-queue`,
         options?.retryQueue,
         disablePersistance
       )

From 886955a1e18ef8aeaa0d5ba2b04a67073d4b302d Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 17:11:00 -0500
Subject: [PATCH 04/56] wip

---
 .github/workflows/ci.yml                                  | 8 ++++++++
 .../standalone-playground/pages/index-consent.html        | 7 ++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e3a49f5f3..e27e2ab49 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,10 +54,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+
       - uses: browser-actions/setup-chrome@v1
       - uses: actions/setup-node@v3
         with:
           node-version: 16
           cache: 'yarn'
       - run: yarn install --immutable
+      - name: Turbo cache
+        uses: actions/cache@v3
+        with:
+          path: node_modules/.cache/turbo
+          key: ${{ runner.os }}-turbo-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-turbo-
       - run: yarn turbo run --filter='consent-tools-integration-tests' test:int
diff --git a/playgrounds/standalone-playground/pages/index-consent.html b/playgrounds/standalone-playground/pages/index-consent.html
index 3471dc423..64afa1da5 100644
--- a/playgrounds/standalone-playground/pages/index-consent.html
+++ b/playgrounds/standalone-playground/pages/index-consent.html
@@ -29,8 +29,7 @@
 
   <!-- OneTrust Vendor Script -->
   <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript"
-    data-domain-script="189ebd49-0e43-4cd1-8f88-c3f40f8e4996-test"></script>
-
+    data-domain-script="80ca7b5c-e72f-4bd0-972a-b74d052a0820-test"></script>
 
   <!-- OneTrust Wrapper -->
   <script
@@ -102,10 +101,8 @@
             }
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
-            window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
             withOneTrust(analytics).load()
             analytics.page()
-
           }
       })()
     }
@@ -200,4 +197,4 @@ <h2>Logs</h2>
   </style>
 </body>
 
-</html>
\ No newline at end of file
+</html>

From 747437c064e716b4dcf59f6c82e58fc8e891db08 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 17:12:11 -0500
Subject: [PATCH 05/56] wip

---
 packages/consent/consent-tools/src/domain/create-wrapper.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/create-wrapper.ts b/packages/consent/consent-tools/src/domain/create-wrapper.ts
index fed0efab8..8dc4f12ca 100644
--- a/packages/consent/consent-tools/src/domain/create-wrapper.ts
+++ b/packages/consent/consent-tools/src/domain/create-wrapper.ts
@@ -85,7 +85,7 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
 
       // if opt-out, we load as usual and then rely on the consent blocking middleware to block events
       // if opt-in, we remove all destinations that are not explicitly consented to so they never load in the first place
-      if (loadCtx.loadOptions.consentModel === false) {
+      if (loadCtx.loadOptions.consentModel === 'opt-out') {
         analyticsService.configureBlockingMiddlewareForOptOut()
         analyticsService.load(settings, options)
         return undefined

From 4bc138581f6051d611c5af40cd27de212c259b78 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 17:16:38 -0500
Subject: [PATCH 06/56] wip

---
 .../consent-tools/src/domain/create-wrapper.ts    | 15 +++++++++------
 .../consent/consent-tools/src/utils/ts-helpers.ts |  9 +++++++++
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/create-wrapper.ts b/packages/consent/consent-tools/src/domain/create-wrapper.ts
index 8dc4f12ca..e4b04b7b2 100644
--- a/packages/consent/consent-tools/src/domain/create-wrapper.ts
+++ b/packages/consent/consent-tools/src/domain/create-wrapper.ts
@@ -6,7 +6,7 @@ import {
   CDNSettings,
 } from '../types'
 import { validateCategories, validateSettings } from './validation'
-import { pipe } from '../utils'
+import { assertNever, pipe } from '../utils'
 import { normalizeShouldLoadSegment } from './load-context'
 import { AnalyticsService } from './analytics'
 import {
@@ -85,11 +85,7 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
 
       // if opt-out, we load as usual and then rely on the consent blocking middleware to block events
       // if opt-in, we remove all destinations that are not explicitly consented to so they never load in the first place
-      if (loadCtx.loadOptions.consentModel === 'opt-out') {
-        analyticsService.configureBlockingMiddlewareForOptOut()
-        analyticsService.load(settings, options)
-        return undefined
-      } else {
+      if (loadCtx.loadOptions.consentModel === 'opt-in') {
         const initialCategories = await getCategories()
         validateCategories(initialCategories)
 
@@ -109,6 +105,13 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
           disable: createDisableOption(initialCategories, options?.disable),
         })
         return undefined
+      } else if (loadCtx.loadOptions.consentModel === 'opt-out') {
+        analyticsService.configureBlockingMiddlewareForOptOut()
+        analyticsService.load(settings, options)
+        return undefined
+      } else {
+        // for typescript exhaustiveness
+        assertNever(loadCtx.loadOptions.consentModel)
       }
     }
 
diff --git a/packages/consent/consent-tools/src/utils/ts-helpers.ts b/packages/consent/consent-tools/src/utils/ts-helpers.ts
index 043349bb4..26b4c1b89 100644
--- a/packages/consent/consent-tools/src/utils/ts-helpers.ts
+++ b/packages/consent/consent-tools/src/utils/ts-helpers.ts
@@ -22,3 +22,12 @@ type Compute<T> = { [K in keyof T]: T[K] } & {}
 export type OptionalField<T, K extends keyof T> = Compute<
   Omit<T, K> & Partial<Pick<T, K>>
 >
+
+/**
+ * Helper function for exhaustive checks of discriminated unions.
+ */
+export function assertNever(value: never): never {
+  throw new Error(
+    `Unhandled discriminated union member: ${JSON.stringify(value)}`
+  )
+}

From 651187085bb97f7f8584bb4813aa7a72b48b2205 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Fri, 12 Apr 2024 18:30:28 -0500
Subject: [PATCH 07/56] wip

---
 .../src/tests/consent-tools-vanilla.test.ts   | 31 ++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
index dce5f6ef4..0e139ab78 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
@@ -14,6 +14,20 @@ afterEach(async () => {
 it('should send a track call after waiting for explicit consent', async () => {
   await page.load()
 
+  void browser.execute(() => {
+    return window.analytics.track('buffered')
+  })
+
+  try {
+    // we don't expect any tracking events to go through yet
+    await browser.waitUntil(() => page.getAllTrackingEvents().length, {
+      timeout: 7000,
+    })
+    throw new Error('Expected no track calls to be made')
+  } catch (err) {
+    // expected to fail
+  }
+
   await page.clickGiveConsent()
 
   await browser.waitUntil(() => page.getConsentChangedEvents().length, {
@@ -34,7 +48,7 @@ it('should send a track call after waiting for explicit consent', async () => {
 
   await browser.waitUntil(() => getHelloTrackEvents(), {
     timeout: 20000,
-    timeoutMsg: 'Expected a track call to be made',
+    timeoutMsg: 'Expected a hello track call to be made',
   })
 
   expect(getHelloTrackEvents()!.context?.consent).toEqual({
@@ -43,4 +57,19 @@ it('should send a track call after waiting for explicit consent', async () => {
       FooCategory2: true,
     },
   })
+
+  const getBufferTrackEvents = () =>
+    page.getAllTrackingEvents().find((el) => el.event === 'buffered')
+
+  await browser.waitUntil(() => getBufferTrackEvents(), {
+    timeout: 20000,
+    timeoutMsg: 'Expected a "BUFFER" track call to be made',
+  })
+
+  expect(getBufferTrackEvents()!.context?.consent).toEqual({
+    categoryPreferences: {
+      FooCategory1: true,
+      FooCategory2: true,
+    },
+  })
 })

From 2ca42d8d4adbdd6e30639f262289a071f14945d6 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Sat, 13 Apr 2024 17:43:39 -0500
Subject: [PATCH 08/56] improve logging

---
 .../src/page-bundles/helpers/mock-cmp.ts             |  5 +----
 .../src/domain/analytics/analytics-service.ts        |  1 +
 .../consent-tools/src/domain/blocking-middleware.ts  | 12 ++++++++----
 .../consent/consent-tools/src/domain/load-context.ts |  2 +-
 .../pages/index-consent-opt-out.html                 |  2 +-
 5 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
index 57b98ad43..d20ca788d 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-bundles/helpers/mock-cmp.ts
@@ -101,10 +101,7 @@ export const initMockConsentManager = (settings: { consentModel: string }) => {
       document.body.removeChild(alertBox)
     },
     onConsentChange: (fn: ConsentChangeFn) => {
-      onConsentChange = (...args: Parameters<ConsentChangeFn>) => {
-        console.log('Consent Changed', args)
-        fn(...args)
-      }
+      onConsentChange = fn
     },
   }
   window.MockCMP = mockCMPPublicAPI
diff --git a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
index 96a233545..c98df5a67 100644
--- a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
@@ -129,6 +129,7 @@ export class AnalyticsService {
    * ```
    */
   consentChange(categories: Categories): void {
+    logger.debug('Consent change', categories)
     try {
       validateCategories(categories)
     } catch (e: unknown) {
diff --git a/packages/consent/consent-tools/src/domain/blocking-middleware.ts b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
index ffc7e952d..176dd8451 100644
--- a/packages/consent/consent-tools/src/domain/blocking-middleware.ts
+++ b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
@@ -33,12 +33,14 @@ export const addBlockingMiddleware = (
       eventCategoryPreferences,
       filterSettings
     )
-    logger.debug(`Device Mode: ${creationName}`, {
+
+    logger.debug(`Destination middleware called: ${creationName}`, {
       DROPPED: disabled,
+      categoryPreferences: eventCategoryPreferences,
       payload: payload.obj,
       filterSettings,
-      eventCategoryPreferences,
     })
+
     if (disabled) return null
 
     next(payload)
@@ -67,13 +69,15 @@ export const addBlockingMiddleware = (
       eventCategoryPreferences,
       consentSettings
     )
-    logger.debug('Source Middleware', {
+
+    logger.debug('Source middleware called', {
       DROPPED: disabled,
+      categoryPreferences: eventCategoryPreferences,
       payload: payload.obj,
       filterSettings,
       consentSettings,
-      eventCategoryPreferences,
     })
+
     if (disabled) return null
     next(payload)
   }
diff --git a/packages/consent/consent-tools/src/domain/load-context.ts b/packages/consent/consent-tools/src/domain/load-context.ts
index e1b4778f9..83bd3c1d6 100644
--- a/packages/consent/consent-tools/src/domain/load-context.ts
+++ b/packages/consent/consent-tools/src/domain/load-context.ts
@@ -50,7 +50,7 @@ export class LoadContext {
   load(options: LoadOptions) {
     this.isLoadCalled = true
     this.loadOptions = { ...this.loadOptions, ...options }
-    logger.debug('Load segment w/ consent', this.loadOptions)
+    logger.debug('ctx.load called', this.loadOptions)
   }
   /**
    * Abort the _consent-wrapped_ analytics.js initialization
diff --git a/playgrounds/standalone-playground/pages/index-consent-opt-out.html b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
index 8b3ccd848..b6bd43277 100644
--- a/playgrounds/standalone-playground/pages/index-consent-opt-out.html
+++ b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
@@ -102,7 +102,7 @@
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
             window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
-            withOneTrust(analytics, { consentModel: () => 'opt-in' }).load()
+            withOneTrust(analytics, { consentModel: () => 'opt-out' }).load()
             analytics.page()
           }
       })()

From cbc39e6062c32d932775c1d59ce20999252cc416 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 12:34:10 -0500
Subject: [PATCH 09/56] wip

---
 .../consent-wrapper-onetrust/src/domain/consent-model.ts      | 4 +---
 .../consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts  | 2 --
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts b/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
index 8565da1e4..ba44dd05e 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/consent-model.ts
@@ -10,10 +10,8 @@ export const coerceConsentModel = (model: OtConsentModel): ConsentModel => {
     case OtConsentModel.implicit:
       return 'opt-in'
     case OtConsentModel.optOut:
-    case OtConsentModel.custom:
-    case OtConsentModel.notice:
       return 'opt-out'
-    default:
+    default: // there are some others like 'custom' / 'notice' that should be treated as 'opt-out'
       return 'opt-out'
   }
 }
diff --git a/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts b/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
index 1e65f2a9c..22e182c1c 100644
--- a/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
@@ -24,8 +24,6 @@ type OtConsentChangedEvent = CustomEvent<ConsentGroupIds>
 export enum OtConsentModel {
   optIn = 'opt-in',
   optOut = 'opt-out',
-  custom = 'custom',
-  notice = 'notice',
   implicit = 'implicit',
 }
 

From 3d15cdde80714a83c44d1fd111b269d669eaa482 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 12:42:59 -0500
Subject: [PATCH 10/56] wip

---
 .vscode/launch.json                               |  2 +-
 .../wdio.conf.local.ts                            | 15 ++++-----------
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/.vscode/launch.json b/.vscode/launch.json
index d4571ebbb..248b1f89d 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -48,7 +48,7 @@
       "internalConsoleOptions": "neverOpen",
       "program": "${workspaceFolder}/node_modules/jest/bin/jest",
       "skipFiles": [
-        "<node_internals>/**" 
+        "<node_internals>/**"
       ]
     },
     {
diff --git a/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts b/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
index e811c75ca..48e7e9887 100644
--- a/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
+++ b/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
@@ -2,15 +2,12 @@ import type { Options } from '@wdio/types'
 
 const PORT = 4567
 
-const isCI = Boolean(process.env.CI)
-
 export const config: Options.Testrunner = {
+  specFileRetries: 2,
   afterTest(test, _, { error, passed }) {
     console.log(
       [
-        `${passed ? '✅ Passed' : '❌ Failed'}! ${test.description ?? ''} : ${
-          test.title
-        }`,
+        `${passed ? '✅ Passed' : '❌ Failed'}! ${test.title}`,
         test.file,
         error ? error : '',
       ].join('\n')
@@ -51,14 +48,10 @@ export const config: Options.Testrunner = {
   maxInstances: 10,
   capabilities: [
     {
-      maxInstances: 1,
+      maxInstances: 5,
       browserName: 'chrome',
       'goog:chromeOptions': {
-        args: [
-          ...(isCI ? ['headless'] : []),
-          'disable-gpu',
-          'user-data-dir=/tmp',
-        ],
+        args: process.env.CI ? ['headless', 'disable-gpu'] : [],
       },
       acceptInsecureCerts: true,
     },

From 111f140aa37e98b4f35e6d9b45cbf9ad195142c2 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 13:04:12 -0500
Subject: [PATCH 11/56] wip

---
 .../consent-wrapper-onetrust/README.md        | 26 ++++++++++++++++---
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/packages/consent/consent-wrapper-onetrust/README.md b/packages/consent/consent-wrapper-onetrust/README.md
index 2247587fa..7da9d5ad3 100644
--- a/packages/consent/consent-wrapper-onetrust/README.md
+++ b/packages/consent/consent-wrapper-onetrust/README.md
@@ -8,9 +8,8 @@
 
 ## Configure OneTrust + Segment
 
-
-
 ### Requirements
+
 Ensure that consent is enabled and that you have registered your integration-to-category mappings in Segment, which you can do through the Segment UI.
 
 Note: "categories" are called "groups" in OneTrust.
@@ -21,9 +20,10 @@ If you don't see a "Consent Management" option like the one below, please contac
 
 - Debugging hints: this library expects the [OneTrust Banner SDK](https://community.cookiepro.com/s/article/UUID-d8291f61-aa31-813a-ef16-3f6dec73d643?language=en_US) to be available in order interact with OneTrust. This library derives the group IDs that are active for the current user from the `window.OneTrustActiveGroups` object provided by the OneTrust SDK. [Read this for more information [community.cookiepro.com]](https://community.cookiepro.com/s/article/UUID-66bcaaf1-c7ca-5f32-6760-c75a1337c226?language=en_US).
 
-
 ## For snippet users
+
 ### Add OneTrust snippet and integration to your page
+
 ```html
 <head>
   <!-- OneTrust Cookies Consent Notice start for example.com -->
@@ -34,7 +34,7 @@ If you don't see a "Consent Management" option like the one below, please contac
     data-domain-script="0000-0000-000-0000"
   ></script>
   <script type="text/javascript">
-    function OptanonWrapper() { }
+    function OptanonWrapper() {}
   </script>
 
   <!-- Add Segment's OneTrust Consent Wrapper -->
@@ -54,6 +54,7 @@ If you don't see a "Consent Management" option like the one below, please contac
 ```
 
 #### ⚠️ Reminder: _you must modify_ `analytics.load('....')` from the original Segment snippet. See markup comment in example above.
+
 ## For `npm` library users
 
 1. Ensure that OneTrust Snippet is loaded. [See example above.](#add-onetrust-snippet-and-integration-to-your-page)
@@ -83,6 +84,23 @@ withOneTrust(analytics).load({ writeKey: '<MY_WRITE_KEY'> })
 
 ```
 
+## Settings
+
+### Consent Models
+
+The wrapper has different behavior based on the consent-model returned by onetrust consent-models:
+
+- "opt-in" - (strict, GDPR scenario) -- wait for explicit consent (i.e. alert )
+- "opt-out" - load as usual and then rely on the consent blocking middleware to block events
+
+By default, opt-in / opt-out are based on the following table:
+
+Default behavior can be _manually_ set by doing:
+
+```ts
+withOneTrust(analytics).load(..., { consentModel: () => 'opt-in' | 'opt-out' })
+```
+
 ## Other examples:
 
 > Note: Playgrounds are meant for experimentation / testing, and as such, may be a bit overly complicated.

From 682cf5eda91b40bd5795e2d825cff39795ee7745 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 14:11:53 -0500
Subject: [PATCH 12/56] update readme

---
 packages/consent/consent-tools/README.md      | 31 +++++++++++++++----
 .../consent-wrapper-onetrust/README.md        |  7 +++--
 2 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/packages/consent/consent-tools/README.md b/packages/consent/consent-tools/README.md
index 83b12b762..825a9e0f1 100644
--- a/packages/consent/consent-tools/README.md
+++ b/packages/consent/consent-tools/README.md
@@ -12,19 +12,26 @@ export const withCMP = createWrapper({
     await resolveWhen(() => window.CMP !== undefined, 500)
   },
 
-  // Wrapper waits to load segment / get categories until this function returns / resolves
+  // Allow for control over wrapper + analytics initialization.
+  // Delay any calls to analytics.load() until this function returns / resolves.
   shouldLoadSegment: async (ctx) => {
-    await resolveWhen(
-      () => !window.CMP.popUpVisible(),
-      500
-    )
-
+    /*
     // Optional -- for granular control of initialization
     if (noConsentNeeded) {
       ctx.abort({ loadSegmentNormally: true })
     } else if (allTrackingDisabled) {
       ctx.abort({ loadSegmentNormally: false })
     }
+    */
+    if (window.CMP.ConsentModel === 'opt-out') {
+      return ctx.load({ consentModel: 'opt-out' })
+    } else {
+      await resolveWhen(
+        () => !window.CMP.popUpVisible() && window.CMP.categories.length,
+        500
+      )
+      return ctx.load({ consentModel: 'opt-in' })
+    }
   },
 
   getCategories: () => {
@@ -39,6 +46,17 @@ export const withCMP = createWrapper({
 })
 ```
 
+### Settings / Configuration
+
+See: [settings.ts](src/types/settings.ts)
+
+### Consent Models
+
+The wrapper has different behavior based on the consent-model:
+
+- **opt-in** - (strict, GDPR scenario) -- Unconsented device mode destinations are removed
+- **opt-out** - Device mode destinations are loaded, but with blocking middleware
+
 ## Wrapper Usage API
 
 ## `npm`
@@ -56,6 +74,7 @@ withCMP(analytics).load({
 ```
 
 ## Snippet users (window.analytics)
+
 ### Note: This assumes a project that can consume the library via es6 imports, using a like Webpack.
 
 1. Delete the `analytics.load()` line from the snippet
diff --git a/packages/consent/consent-wrapper-onetrust/README.md b/packages/consent/consent-wrapper-onetrust/README.md
index 7da9d5ad3..b81ae91fa 100644
--- a/packages/consent/consent-wrapper-onetrust/README.md
+++ b/packages/consent/consent-wrapper-onetrust/README.md
@@ -90,10 +90,11 @@ withOneTrust(analytics).load({ writeKey: '<MY_WRITE_KEY'> })
 
 The wrapper has different behavior based on the consent-model returned by onetrust consent-models:
 
-- "opt-in" - (strict, GDPR scenario) -- wait for explicit consent (i.e. alert )
-- "opt-out" - load as usual and then rely on the consent blocking middleware to block events
+- **opt-in** - (strict, GDPR scenario) -- wait for explicit consent (i.e. alert box to be closed) before loading device mode destinations and initializing Segment. If consent is not given (no mapped categories are consented to), then Segment is not loaded.
 
-By default, opt-in / opt-out are based on the following table:
+- **opt-out** - Load segment immediately and all destinations, based on default categories. For device mode destinations, any analytics.js-originated events (e.g analytics.track) will be filtered based on consent.
+
+- **default/other** - opt-out
 
 Default behavior can be _manually_ set by doing:
 

From df678de7a07287c9a45d904f964a93651fc44bb5 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 14:12:39 -0500
Subject: [PATCH 13/56] wip

---
 packages/consent/consent-wrapper-onetrust/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-wrapper-onetrust/README.md b/packages/consent/consent-wrapper-onetrust/README.md
index b81ae91fa..f659cc45f 100644
--- a/packages/consent/consent-wrapper-onetrust/README.md
+++ b/packages/consent/consent-wrapper-onetrust/README.md
@@ -96,7 +96,7 @@ The wrapper has different behavior based on the consent-model returned by onetru
 
 - **default/other** - opt-out
 
-Default behavior can be _manually_ set by doing:
+This wrapper uses the `OneTrust.getDomainData()` API to get the consent model for a given geolocation. Default behavior can be overridden by doing:
 
 ```ts
 withOneTrust(analytics).load(..., { consentModel: () => 'opt-in' | 'opt-out' })

From 3c89acd6b3ea2a55cb124d0e9f5f52a6e00c4720 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 14:13:50 -0500
Subject: [PATCH 14/56] wip

---
 packages/consent/consent-wrapper-onetrust/README.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/consent/consent-wrapper-onetrust/README.md b/packages/consent/consent-wrapper-onetrust/README.md
index f659cc45f..77b7fc438 100644
--- a/packages/consent/consent-wrapper-onetrust/README.md
+++ b/packages/consent/consent-wrapper-onetrust/README.md
@@ -88,8 +88,6 @@ withOneTrust(analytics).load({ writeKey: '<MY_WRITE_KEY'> })
 
 ### Consent Models
 
-The wrapper has different behavior based on the consent-model returned by onetrust consent-models:
-
 - **opt-in** - (strict, GDPR scenario) -- wait for explicit consent (i.e. alert box to be closed) before loading device mode destinations and initializing Segment. If consent is not given (no mapped categories are consented to), then Segment is not loaded.
 
 - **opt-out** - Load segment immediately and all destinations, based on default categories. For device mode destinations, any analytics.js-originated events (e.g analytics.track) will be filtered based on consent.

From d6c18710adb35ecb419ae989ad2835f3fba9c07f Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 15:55:13 -0500
Subject: [PATCH 15/56] wip

---
 .../pages/index-consent-opt-out.html             | 13 +++++++++++--
 .../pages/index-consent.html                     | 16 +++++++++++++---
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/playgrounds/standalone-playground/pages/index-consent-opt-out.html b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
index b6bd43277..6e2a8ed55 100644
--- a/playgrounds/standalone-playground/pages/index-consent-opt-out.html
+++ b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
@@ -28,8 +28,17 @@
   </script>
 
   <!-- OneTrust Vendor Script -->
-  <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript"
-    data-domain-script="80ca7b5c-e72f-4bd0-972a-b74d052a0820-test"></script>
+  <script>
+      (function loadOt() {
+        const otKey = new URL(document.location).searchParams.get("otKey");
+        var t = document.createElement('script')
+        t.type = 'text/javascript'
+        t.src = 'https://cdn.cookielaw.org/scripttemplates/otSDKStub.js'
+        t.setAttribute('data-domain-script', otKey || '09b87b90-1b30-4d68-9610-9d2fe11234f3-test')
+        var n = document.getElementsByTagName('script')[0]
+        n.parentNode.insertBefore(t, n)
+      })()
+  </script>
 
   <!-- OneTrust Wrapper -->
   <script
diff --git a/playgrounds/standalone-playground/pages/index-consent.html b/playgrounds/standalone-playground/pages/index-consent.html
index 64afa1da5..c76b94972 100644
--- a/playgrounds/standalone-playground/pages/index-consent.html
+++ b/playgrounds/standalone-playground/pages/index-consent.html
@@ -28,8 +28,17 @@
   </script>
 
   <!-- OneTrust Vendor Script -->
-  <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript"
-    data-domain-script="80ca7b5c-e72f-4bd0-972a-b74d052a0820-test"></script>
+  <script>
+      (function loadOt() {
+        const otKey = new URL(document.location).searchParams.get("otKey");
+        var t = document.createElement('script')
+        t.type = 'text/javascript'
+        t.src = 'https://cdn.cookielaw.org/scripttemplates/otSDKStub.js'
+        t.setAttribute('data-domain-script', otKey || '09b87b90-1b30-4d68-9610-9d2fe11234f3-test')
+        var n = document.getElementsByTagName('script')[0]
+        n.parentNode.insertBefore(t, n)
+      })()
+  </script>
 
   <!-- OneTrust Wrapper -->
   <script
@@ -101,6 +110,7 @@
             }
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
+            window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
             withOneTrust(analytics).load()
             analytics.page()
           }
@@ -197,4 +207,4 @@ <h2>Logs</h2>
   </style>
 </body>
 
-</html>
+</html>
\ No newline at end of file

From 6e67b45d6934d6bdeaf8460fc134bbb6c8be49e1 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 16:01:26 -0500
Subject: [PATCH 16/56] fix enum

---
 .../consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts b/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
index 22e182c1c..337d25e28 100644
--- a/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/lib/onetrust-api.ts
@@ -24,7 +24,7 @@ type OtConsentChangedEvent = CustomEvent<ConsentGroupIds>
 export enum OtConsentModel {
   optIn = 'opt-in',
   optOut = 'opt-out',
-  implicit = 'implicit',
+  implicit = 'implied consent',
 }
 
 export interface OneTrustDomainData {

From 23921f08abbe894490583d6581cbae1a6b2f1663 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 16:07:47 -0500
Subject: [PATCH 17/56] wip

---
 .../pages/index-consent-no-banner.html        | 212 ------------------
 1 file changed, 212 deletions(-)
 delete mode 100644 playgrounds/standalone-playground/pages/index-consent-no-banner.html

diff --git a/playgrounds/standalone-playground/pages/index-consent-no-banner.html b/playgrounds/standalone-playground/pages/index-consent-no-banner.html
deleted file mode 100644
index 245b493ec..000000000
--- a/playgrounds/standalone-playground/pages/index-consent-no-banner.html
+++ /dev/null
@@ -1,212 +0,0 @@
-<html>
-
-<head>
-
-
-  <!-- Form: WriteKey -->
-  <form method="get">
-    <input type="text" name="writeKey" placeholder="Writekey" />
-    <button>Load</button>
-  </form>
-  <script>
-    const { searchParams } = new URL(document.location);
-    const writeKey = searchParams.get("writeKey");
-    document.querySelector("input").value = writeKey;
-  </script>
-
-  <!-- Form: Clear OneTrust Cookie -->
-  <button id="clear-ot-cookies">Clear OneTrust Cookies & Reload</button>
-  <script>
-    document.getElementById('clear-ot-cookies').addEventListener('click', () => {
-      ['OptanonConsent', 'OptanonAlertBoxClosed'].forEach((name) => {
-        document.cookie =
-          name + "=; Path=/; Expires=Thu, 01 Jan 1970 00:00:01 GMT;";
-      });
-      window.location.reload();
-      console.log("OneTrust Cookies cleared.");
-    })
-  </script>
-
-
-  <!-- OneTrust Vendor Script -->
-  <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" type="text/javascript"
-    data-domain-script="09b87b90-1b30-4d68-9610-9d2fe11234f3-test"></script>
-  <script type="text/javascript">
-    const wk = document.querySelector("input").value
-    console.log('should be on the following url ->', `${window.location.origin + window.location.pathname}?writeKey=${wk || '<writekey>'}&otpreview=true&otgeo=za`)
-    function OptanonWrapper() {
-      // debugging.
-      if (!window.OnetrustActiveGroups.replaceAll(',', '')) {
-        window.OnetrustActiveGroups = ',CAT0001' // very hacky, simulates at least one group if none exist
-      }
-      console.log('ShowAlertNotice: should be false (initially) ->', window.OneTrust.GetDomainData().ShowAlertNotice)
-      console.log('OneTrust.testLog() ->', window.OneTrust.testLog())
-    }
-  </script>
-  <!-- OneTrust Wrapper -->
-  <script
-    src="/node_modules/@segment/analytics-consent-wrapper-onetrust/dist/umd/analytics-onetrust.umd.development.js">
-    </script>
-  <!-- Segment Snippet (Modified)-->
-  <script>
-    if (writeKey) {
-      !(function () {
-        var analytics = (window.analytics = window.analytics || [])
-        if (!analytics.initialize)
-          if (analytics.invoked)
-            window.console &&
-              console.error &&
-              console.error('Segment snippet included twice.')
-          else {
-            analytics.invoked = !0
-            analytics.methods = [
-              'screen',
-              'register',
-              'deregister',
-              'trackSubmit',
-              'trackClick',
-              'trackLink',
-              'trackForm',
-              'pageview',
-              'identify',
-              'reset',
-              'group',
-              'track',
-              'ready',
-              'alias',
-              'debug',
-              'page',
-              'once',
-              'off',
-              'on',
-              'addSourceMiddleware',
-              'addIntegrationMiddleware',
-              'setAnonymousId',
-              'addDestinationMiddleware',
-              'emit'
-            ]
-            analytics.factory = function (e) {
-              return function () {
-                if (window.analytics.initialized) {
-                  // Sometimes users assigned analytics to a variable before analytics is done loading, resulting in a stale reference.
-                  // If so, proxy any calls to the 'real' analytics instance.
-                  return window.analytics[e].apply(window.analytics, arguments);
-                }
-                var t = Array.prototype.slice.call(arguments)
-                t.unshift(e)
-                analytics.push(t)
-                return analytics
-              }
-            }
-            for (var e = 0; e < analytics.methods.length; e++) {
-              var key = analytics.methods[e]
-              analytics[key] = analytics.factory(key)
-            }
-            analytics.load = function (key, e) {
-              var t = document.createElement('script')
-              t.type = 'text/javascript'
-              t.async = !0
-              t.src = '/node_modules/@segment/analytics-next/dist/umd/standalone.js'
-              var n = document.getElementsByTagName('script')[0]
-              n.parentNode.insertBefore(t, n)
-              analytics._loadOptions = e
-            }
-            analytics.SNIPPET_VERSION = '4.13.1'
-            analytics._writeKey = writeKey
-            withOneTrust(analytics).load()
-            analytics.page()
-          }
-      })()
-    }
-  </script>
-
-</head>
-
-<body>
-  <form>
-    <textarea name="event" id="event">
-{
-  "name": "hi",
-  "properties": { },
-  "traits": { },
-  "options": { }
-}
-    </textarea>
-    <div>
-      <button id="track">Track</button>
-      <button id="identify">Identify</button>
-    </div>
-  </form>
-  <h2>Consent Changed Event</h2>
-  <pre id="consent-changed"></pre>
-  <h2>Logs</h2>
-  <pre id="logs"></pre>
-
-  <script type="text/javascript">
-    const displayConsentLogs = (str) => document.querySelector('#consent-changed').textContent = str
-    window.analytics?.on('track', (name, properties, options) => {
-      if (name.includes("Segment Consent")) {
-        displayConsentLogs("Consent Changed Event Fired")
-        setTimeout(() => displayConsentLogs(''), 3000)
-      }
-    })
-    const displayRegularLogs = (str) => document.querySelector('#logs').textContent = str
-    const logEvent = (promise) => {
-      if (Array.isArray(promise)) {
-        displayRegularLogs('Analytics is not initialized!')
-        setTimeout(() => displayRegularLogs(''), 5000)
-        return
-      }
-      if (promise) {
-        promise.then((ctx) => {
-          ctx.flush()
-          displayRegularLogs(JSON.stringify(
-            ctx.event,
-            null,
-            2
-          ))
-        })
-      }
-    }
-
-
-    document.querySelector('#track').addEventListener('click', async (e) => {
-      e.preventDefault()
-      const contents = document.querySelector('#event').value
-      const evt = JSON.parse(contents)
-      const promise = window.analytics.track(
-        evt.name ?? '',
-        evt.properties ?? {},
-        evt.options ?? {}
-      )
-      logEvent(promise)
-    })
-
-    document
-      .querySelector('#identify')
-      .addEventListener('click', async (e) => {
-        e.preventDefault()
-        const contents = document.querySelector('#event').value
-        const evt = JSON.parse(contents)
-        const promise = window.analytics.identify(
-          evt.name ?? '',
-          evt.properties ?? {},
-          evt.options ?? {}
-        )
-        logEvent(promise)
-      })
-  </script>
-  <style>
-    body {
-      font-family: monospace;
-    }
-
-    #event {
-      margin: 2em 0;
-      min-height: 200px;
-      min-width: 700px;
-    }
-  </style>
-</body>
-
-</html>

From 5bc7e18a9e6e3a20ad17e54b246db234b1b87576 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 16:23:41 -0500
Subject: [PATCH 18/56] wip

---
 .../src/domain/__tests__/wrapper.test.ts      | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts b/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
index fbb9785ff..996cf42ab 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
@@ -56,6 +56,88 @@ describe('High level "integration" tests', () => {
   })
 
   describe('shouldLoadSegment', () => {
+    describe('consent model', () => {
+      it('should support opt-in', async () => {
+        withOneTrust(analyticsMock)
+
+        getConsentedGroupIdsSpy.mockImplementation(() => [
+          domainGroupMock.StrictlyNeccessary.CustomGroupId,
+        ])
+
+        OneTrustMockGlobal.GetDomainData.mockReturnValue({
+          ...domainDataMock,
+          ConsentModel: {
+            Name: OneTrustAPI.OtConsentModel.optIn,
+          },
+        })
+        OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValueOnce(true)
+
+        const load = jest.fn()
+        const shouldLoadSegP = createWrapperSpyHelper.shouldLoadSegment({
+          load,
+        } as any)
+        checkResolveWhen()
+        await shouldLoadSegP
+        expect(load).toHaveBeenCalledWith({ consentModel: 'opt-in' })
+      })
+
+      it('should not wait for alert box to be closed if opt-out', async () => {
+        withOneTrust(analyticsMock)
+
+        OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValue(false)
+
+        OneTrustMockGlobal.GetDomainData.mockReturnValue({
+          ...domainDataMock,
+          ConsentModel: {
+            Name: OneTrustAPI.OtConsentModel.optOut,
+          },
+        })
+        const load = jest.fn()
+        void createWrapperSpyHelper.shouldLoadSegment({
+          load,
+        } as any)
+        expect(load).toHaveBeenCalledWith({ consentModel: 'opt-out' })
+      })
+
+      it('should default to opt-out consent model if OneTrust.ConsentModel.Name is unrecognized', async () => {
+        withOneTrust(analyticsMock)
+
+        OneTrustMockGlobal.GetDomainData.mockReturnValue({
+          ...domainDataMock,
+          ConsentModel: {
+            Name: 'foo' as any,
+          },
+        })
+        OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValueOnce(true)
+
+        const load = jest.fn()
+        void createWrapperSpyHelper.shouldLoadSegment({
+          load,
+        } as any)
+        expect(load).toHaveBeenCalledWith({ consentModel: 'opt-out' })
+      })
+      it('should support a configuration that overrides the consent model', async () => {
+        withOneTrust(analyticsMock, { consentModel: () => 'opt-in' })
+        OneTrustMockGlobal.GetDomainData.mockReturnValue({
+          ...domainDataMock,
+          ConsentModel: {
+            Name: OneTrustAPI.OtConsentModel.optOut,
+          },
+        })
+        OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValueOnce(true)
+        getConsentedGroupIdsSpy.mockImplementation(() => [
+          domainGroupMock.StrictlyNeccessary.CustomGroupId,
+        ])
+        const load = jest.fn()
+        const shouldLoadSegP = createWrapperSpyHelper.shouldLoadSegment({
+          load,
+        } as any)
+        checkResolveWhen()
+        await shouldLoadSegP
+        expect(load).toHaveBeenCalledWith({ consentModel: 'opt-in' })
+      })
+    })
+
     it('should load if alert box is closed and groups are defined', async () => {
       withOneTrust(analyticsMock)
 

From 4951ab0140fe17e503cdd5768bdf37bf6e144668 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 16:33:22 -0500
Subject: [PATCH 19/56] remove mockClear because not needed

---
 .../src/page-objects/base-page.ts                                | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
index 3c34a4862..e9568eb84 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
@@ -18,7 +18,6 @@ export abstract class BasePage {
 
   async load(): Promise<void> {
     const baseURL = browser.options.baseUrl
-    await browser.mockClearAll()
     await this.mockCDNSettingsEndpoint()
     await this.listenForSegmentTrackCalls()
     assert(baseURL)

From 39bacb03a94bb5f86c4e6520311b36052a8edfa7 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 16:34:01 -0500
Subject: [PATCH 20/56] wip

---
 .../src/tests/consent-tools-vanilla-opt-out.test.ts            | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
index 7f5f2d50e..4d86e041b 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
@@ -24,7 +24,6 @@ it('should not wait for consent before sending track call', async () => {
     page.getAllTrackingEvents().find((el) => el.event === 'hello')
 
   await browser.waitUntil(() => getHelloTrackEvent(), {
-    interval: 500,
     timeout: 20000,
     timeoutMsg: 'Expected a "hello" track call to be made',
   })
@@ -35,7 +34,6 @@ it('should not wait for consent before sending track call', async () => {
 
   await page.clickGiveConsent()
   await browser.waitUntil(() => page.getConsentChangedEvents().length, {
-    interval: 500,
     timeout: 20000,
     timeoutMsg: 'Expected a consent change call to be made',
   })
@@ -48,7 +46,6 @@ it('should not wait for consent before sending track call', async () => {
   const getSupTrackEvent = () =>
     page.getAllTrackingEvents().find((el) => el.event === 'sup')
   await browser.waitUntil(() => getSupTrackEvent(), {
-    interval: 500,
     timeout: 20000,
     timeoutMsg: 'Expected a "sup" track call to be made',
   })

From 7345b8efd10284dfb5e695fc87155b520875d2c1 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 16:36:35 -0500
Subject: [PATCH 21/56] wip

---
 .../src/domain/__tests__/wrapper.test.ts                        | 2 --
 1 file changed, 2 deletions(-)

diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts b/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
index 996cf42ab..240230518 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/__tests__/wrapper.test.ts
@@ -149,7 +149,6 @@ describe('High level "integration" tests', () => {
       const shouldLoadSegment = Promise.resolve(
         createWrapperSpyHelper.shouldLoadSegment({
           load: jest.fn(),
-          abort: jest.fn(),
         } as any)
       )
       checkResolveWhen()
@@ -180,7 +179,6 @@ describe('High level "integration" tests', () => {
       const shouldLoadSegment = Promise.resolve(
         createWrapperSpyHelper.shouldLoadSegment({
           load: jest.fn(),
-          abort: jest.fn(),
         } as any)
       )
       OneTrustMockGlobal.IsAlertBoxClosed.mockReturnValueOnce(false) // alert box is _never open

From fdcb90b7d22595f459152eee6d92e777264656b2 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 18:46:43 -0500
Subject: [PATCH 22/56] wip

---
 .../consent-tools-integration-tests/wdio.conf.local.ts       | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts b/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
index 48e7e9887..9c7a9f734 100644
--- a/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
+++ b/packages/consent/consent-tools-integration-tests/wdio.conf.local.ts
@@ -51,7 +51,10 @@ export const config: Options.Testrunner = {
       maxInstances: 5,
       browserName: 'chrome',
       'goog:chromeOptions': {
-        args: process.env.CI ? ['headless', 'disable-gpu'] : [],
+        args: [
+          ...(process.env.CI ? ['headless', 'disable-gpu'] : []),
+          'user-data-dir=/tmp',
+        ],
       },
       acceptInsecureCerts: true,
     },

From 5cf6a5072c9fc0364fc50bc16a56e4b3c205e5fb Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 19:08:49 -0500
Subject: [PATCH 23/56] attempt to fix flaky ci tests

---
 .../src/page-objects/consent-tools-vanilla.ts          | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
index bdf7e3dac..56e79a16c 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
@@ -1,11 +1,13 @@
 import { BasePage } from './base-page'
 
 export class ConsentToolsVanilla extends BasePage {
-  clickGiveConsent() {
-    return $('#give-consent').click()
+  async clickGiveConsent() {
+    const button = await $('#give-consent')
+    return button.click()
   }
-  clickDenyConsent() {
-    return $('#deny-consent').click()
+  async clickDenyConsent() {
+    const button = await $('#give-consent')
+    return button.click()
   }
 }
 

From 972ea89fea153962fff3577c40089f1ff98ce3eb Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 19:32:12 -0500
Subject: [PATCH 24/56] add additional mock APIs

---
 .../src/page-objects/base-page.ts             | 32 +++++++++++++++----
 1 file changed, 25 insertions(+), 7 deletions(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
index e9568eb84..0c2ab0033 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
@@ -15,12 +15,12 @@ export abstract class BasePage {
   constructor(protected page: string) {}
 
   segmentTrackingApiReqs: Matches[] = []
+  integrationApiReqs: Matches[] = []
 
   async load(): Promise<void> {
     const baseURL = browser.options.baseUrl
-    await this.mockCDNSettingsEndpoint()
-    await this.listenForSegmentTrackCalls()
     assert(baseURL)
+    await this.mockAPIs()
     await browser.url(baseURL + '/public/' + this.page)
     await waitUntilReady()
   }
@@ -47,10 +47,17 @@ export abstract class BasePage {
 
   async cleanup() {
     this.segmentTrackingApiReqs = []
+    this.integrationApiReqs = []
     await this.clearStorage()
   }
 
-  async listenForSegmentTrackCalls(): Promise<void> {
+  async mockAPIs() {
+    await this.mockSegmentTrackingAPI()
+    await this.mockCDNSettingsAPI()
+    await this.mockNextIntegrationsAPI()
+  }
+
+  private async mockSegmentTrackingAPI(): Promise<void> {
     const mock = await browser.mock('https://api.segment.io/v1/t', {
       method: 'post',
     })
@@ -62,24 +69,35 @@ export abstract class BasePage {
         body: JSON.stringify({ success: true }),
       })
     })
-    return
   }
 
-  /**
-   * Mock the CDN Settings endpoint so that this can run offline
+  private async mockNextIntegrationsAPI(): Promise<void> {
+    const mock = await browser.mock('**/next-integrations/**')
+    mock.respond((mock) => {
+      this.integrationApiReqs.push(mock)
+      return Promise.resolve({
+        statusCode: 200,
+        body: 'console.log("mocked next-integrations")',
+      })
+    })
+  }
+
+  /**   * Mock the CDN Settings endpoint so that this can run offline
    */
-  private async mockCDNSettingsEndpoint(): Promise<void> {
+  private async mockCDNSettingsAPI(): Promise<void> {
     const settings = new CDNSettingsBuilder({
       writeKey: 'something',
     })
       .addActionDestinationSettings(
         {
+          url: 'https://cdn.segment.com/next-integrations/actions/fullstory-plugins/foo.js',
           creationName: 'FullStory',
           consentSettings: {
             categories: ['FooCategory2'],
           },
         },
         {
+          url: 'https://cdn.segment.com/next-integrations/actions/amplitude-plugins/foo.js',
           creationName: 'Actions Amplitude',
           consentSettings: {
             categories: ['FooCategory1'],

From 9c99d6980a1db6fde5c2b97a3529169754b6c49f Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 19:49:58 -0500
Subject: [PATCH 25/56] Update
 packages/consent/consent-tools/src/domain/blocking-middleware.ts

Co-authored-by: Christopher Radek <14189820+chrisradek@users.noreply.github.com>
---
 .../consent/consent-tools/src/domain/blocking-middleware.ts     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/blocking-middleware.ts b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
index 176dd8451..59ae1d7d2 100644
--- a/packages/consent/consent-tools/src/domain/blocking-middleware.ts
+++ b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
@@ -47,7 +47,7 @@ export const addBlockingMiddleware = (
   }
   analyticsInstance.addDestinationMiddleware('*', blockDeviceMode)
 
-  // Block segment itsel (Segment.io isn't currently allowed in addDestinationMiddleware)
+  // Block segment itself (Segment.io isn't currently allowed in addDestinationMiddleware)
   const blockSegmentAndEverythingElse: SourceMiddlewareFunction = async ({
     payload,
     next,

From 568a42d26c06e70af1aa7c3b12867b5aeca8d2a9 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 20:06:54 -0500
Subject: [PATCH 26/56] mock integrations

---
 .../src/page-objects/base-page.ts                         | 8 ++++----
 .../src/tests/consent-tools-vanilla.test.ts               | 5 +++++
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
index 0c2ab0033..b676e6c02 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/base-page.ts
@@ -15,7 +15,7 @@ export abstract class BasePage {
   constructor(protected page: string) {}
 
   segmentTrackingApiReqs: Matches[] = []
-  integrationApiReqs: Matches[] = []
+  fetchIntegrationReqs: Matches[] = []
 
   async load(): Promise<void> {
     const baseURL = browser.options.baseUrl
@@ -47,7 +47,7 @@ export abstract class BasePage {
 
   async cleanup() {
     this.segmentTrackingApiReqs = []
-    this.integrationApiReqs = []
+    this.fetchIntegrationReqs = []
     await this.clearStorage()
   }
 
@@ -74,10 +74,10 @@ export abstract class BasePage {
   private async mockNextIntegrationsAPI(): Promise<void> {
     const mock = await browser.mock('**/next-integrations/**')
     mock.respond((mock) => {
-      this.integrationApiReqs.push(mock)
+      this.fetchIntegrationReqs.push(mock)
       return Promise.resolve({
         statusCode: 200,
-        body: 'console.log("mocked next-integrations")',
+        body: 'console.log("mocking action and classic destinations")',
       })
     })
   }
diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
index 0e139ab78..7aee1ce88 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
@@ -39,6 +39,11 @@ it('should send a track call after waiting for explicit consent', async () => {
   expect(consentChangeEvents.length).toBe(1)
   expect(consentChangeEvents[0].event).toEqual('Segment Consent Preference')
 
+  await browser.waitUntil(() => page.fetchIntegrationReqs.length, {
+    timeout: 20000,
+    timeoutMsg: 'Expected integrations/destinations to be fetched',
+  })
+
   await browser.execute(() => {
     return window.analytics.track('hello')
   })

From d0036bab86603f5882c78def796937ee46b6eadf Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Mon, 15 Apr 2024 20:08:36 -0500
Subject: [PATCH 27/56] wip

---
 .../src/tests/consent-tools-vanilla-opt-out.test.ts          | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
index 4d86e041b..aa5ac764f 100644
--- a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
+++ b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-out.test.ts
@@ -13,6 +13,11 @@ afterEach(async () => {
 it('should not wait for consent before sending track call', async () => {
   await page.load()
 
+  await browser.waitUntil(() => page.fetchIntegrationReqs.length, {
+    timeout: 20000,
+    timeoutMsg: 'Expected integrations/destinations to be fetched',
+  })
+
   await browser.execute(() => {
     return window.analytics.track('hello')
   })

From 2943b5b0a7c09c1cb0c76a7a8542f63f89a1a6ef Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 11:55:30 -0500
Subject: [PATCH 28/56] wip

---
 .../src/domain/analytics/analytics-service.ts         |  3 ++-
 .../consent-tools/src/domain/blocking-middleware.ts   |  2 +-
 .../consent-tools/src/domain/config-helpers.ts        | 11 +++++++++++
 .../consent-tools/src/domain/pruned-categories.ts     | 11 ++---------
 .../consent-wrapper-onetrust/src/domain/wrapper.ts    |  5 +++++
 5 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
index c98df5a67..5b4bf413c 100644
--- a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
@@ -11,9 +11,10 @@ import {
 import { pipe } from '../../utils'
 import { addBlockingMiddleware } from '../blocking-middleware'
 import { createConsentStampingMiddleware } from '../consent-stamping'
-import { parseAllCategories, getPrunedCategories } from '../pruned-categories'
+import { getPrunedCategories } from '../pruned-categories'
 import { validateAnalyticsInstance, validateCategories } from '../validation'
 import { logger } from '../logger'
+import { parseAllCategories } from '../config-helpers'
 
 export interface AnalyticsServiceOptions {
   getCategories: GetCategoriesFunction
diff --git a/packages/consent/consent-tools/src/domain/blocking-middleware.ts b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
index 59ae1d7d2..734fb17ea 100644
--- a/packages/consent/consent-tools/src/domain/blocking-middleware.ts
+++ b/packages/consent/consent-tools/src/domain/blocking-middleware.ts
@@ -11,7 +11,7 @@ import {
   segmentShouldBeDisabled,
 } from './blocking-helpers'
 import { logger } from './logger'
-import { parseAllCategories } from './pruned-categories'
+import { parseAllCategories } from './config-helpers'
 
 // Block all device mode destinations
 export const addBlockingMiddleware = (
diff --git a/packages/consent/consent-tools/src/domain/config-helpers.ts b/packages/consent/consent-tools/src/domain/config-helpers.ts
index 83dacf211..9ead9b06d 100644
--- a/packages/consent/consent-tools/src/domain/config-helpers.ts
+++ b/packages/consent/consent-tools/src/domain/config-helpers.ts
@@ -1,3 +1,6 @@
+import { IntegrationCategoryMappings } from '../types'
+import { uniq } from '../utils'
+
 /**
  * Parse list of categories from `cdnSettings.integration.myIntegration` object
  * @example
@@ -20,3 +23,11 @@ export const parseConsentCategories = (
 
   return undefined
 }
+
+export const parseAllCategories = (
+  integrationCategoryMappings: IntegrationCategoryMappings
+) => {
+  return uniq(
+    Object.values(integrationCategoryMappings).reduce((p, n) => p.concat(n))
+  )
+}
diff --git a/packages/consent/consent-tools/src/domain/pruned-categories.ts b/packages/consent/consent-tools/src/domain/pruned-categories.ts
index 7870726fe..9acb76d75 100644
--- a/packages/consent/consent-tools/src/domain/pruned-categories.ts
+++ b/packages/consent/consent-tools/src/domain/pruned-categories.ts
@@ -1,14 +1,7 @@
-import { uniq, pick } from '../utils'
-import { Categories, IntegrationCategoryMappings } from '../types'
+import { pick } from '../utils'
+import { Categories } from '../types'
 import { ValidationError } from './validation/validation-error'
 
-export const parseAllCategories = (
-  integrationCategoryMappings: IntegrationCategoryMappings
-) => {
-  return uniq(
-    Object.values(integrationCategoryMappings).reduce((p, n) => p.concat(n))
-  )
-}
 export const getPrunedCategories = (
   categories: Categories,
   allCategories: string[]
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
index 6524b86ef..3cf474464 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
@@ -23,6 +23,10 @@ export interface OneTrustSettings {
    * By default, the value is determined by `OneTrust.GetDomainData().ConsentModel` which is set in the OneTrust UI.
    */
   consentModel?: () => 'opt-in' | 'opt-out'
+  /**
+   * Enable debug logging for OneTrust wrapper
+   */
+  enableDebugLogging?: boolean
 }
 
 /**
@@ -78,5 +82,6 @@ export const withOneTrust = <Analytics extends AnyAnalytics>(
           })
         },
     integrationCategoryMappings: settings.integrationCategoryMappings,
+    enableDebugLogging: settings.enableDebugLogging,
   })(analyticsInstance)
 }

From bf5bc5ccd8e4b50035fc618cd848b256dca5bd51 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 12:50:15 -0500
Subject: [PATCH 29/56] remove remotePlugins check

---
 .../domain/__tests__/assertions/integrations-assertions.ts    | 2 +-
 packages/consent/consent-tools/src/domain/create-wrapper.ts   | 4 ----
 packages/consent/consent-tools/src/types/wrapper.ts           | 2 +-
 3 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts b/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts
index a5ff8f31d..fa8935d19 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts
@@ -18,7 +18,7 @@ export const assertIntegrationsContainOnly = (
   updatedCDNSettings: CDNSettings
 ) => {
   expect(updatedCDNSettings.remotePlugins).toEqual(
-    originalCDNSettings.remotePlugins?.filter((p) =>
+    originalCDNSettings.remotePlugins.filter((p) =>
       // enabled consent
       creationNames.includes(p.creationName)
     )
diff --git a/packages/consent/consent-tools/src/domain/create-wrapper.ts b/packages/consent/consent-tools/src/domain/create-wrapper.ts
index e4b04b7b2..02428a3a6 100644
--- a/packages/consent/consent-tools/src/domain/create-wrapper.ts
+++ b/packages/consent/consent-tools/src/domain/create-wrapper.ts
@@ -92,10 +92,6 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
         analyticsService.load(settings, {
           ...options,
           updateCDNSettings: pipe((cdnSettings) => {
-            if (!cdnSettings.remotePlugins) {
-              return cdnSettings
-            }
-
             return filterDeviceModeDestinationsForOptIn(
               cdnSettings,
               initialCategories,
diff --git a/packages/consent/consent-tools/src/types/wrapper.ts b/packages/consent/consent-tools/src/types/wrapper.ts
index 5573dd7c0..b0ae549f7 100644
--- a/packages/consent/consent-tools/src/types/wrapper.ts
+++ b/packages/consent/consent-tools/src/types/wrapper.ts
@@ -134,7 +134,7 @@ export interface CDNSettingsConsent {
 
 export interface CDNSettings {
   integrations: CDNSettingsIntegrations
-  remotePlugins?: CDNSettingsRemotePlugin[]
+  remotePlugins: CDNSettingsRemotePlugin[]
   consentSettings?: CDNSettingsConsent
 }
 

From 9cecb91dc7e897bd162e23e6255d9e1752bedece Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 12:52:49 -0500
Subject: [PATCH 30/56] wip

---
 .../assertions/integrations-assertions.ts     |  2 +-
 .../src/domain/analytics/analytics-service.ts | 51 +++++++++++++++++-
 .../src/domain/create-wrapper.ts              | 53 +++----------------
 .../consent-tools/src/types/wrapper.ts        |  2 +-
 .../src/domain/wrapper.ts                     |  6 +--
 5 files changed, 62 insertions(+), 52 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts b/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts
index fa8935d19..a5ff8f31d 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/assertions/integrations-assertions.ts
@@ -18,7 +18,7 @@ export const assertIntegrationsContainOnly = (
   updatedCDNSettings: CDNSettings
 ) => {
   expect(updatedCDNSettings.remotePlugins).toEqual(
-    originalCDNSettings.remotePlugins.filter((p) =>
+    originalCDNSettings.remotePlugins?.filter((p) =>
       // enabled consent
       creationNames.includes(p.creationName)
     )
diff --git a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
index 5b4bf413c..7e6166ccd 100644
--- a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
@@ -5,6 +5,7 @@ import {
   CDNSettings,
   CreateWrapperSettings,
   GetCategoriesFunction,
+  InitOptions,
   IntegrationCategoryMappings,
   MaybeInitializedAnalytics,
 } from '../../types'
@@ -15,6 +16,10 @@ import { getPrunedCategories } from '../pruned-categories'
 import { validateAnalyticsInstance, validateCategories } from '../validation'
 import { logger } from '../logger'
 import { parseAllCategories } from '../config-helpers'
+import {
+  filterDeviceModeDestinationsForOptIn,
+  segmentShouldBeDisabled,
+} from '../blocking-helpers'
 
 export interface AnalyticsServiceOptions {
   getCategories: GetCategoriesFunction
@@ -48,6 +53,12 @@ export class AnalyticsService {
     return allCategories ?? []
   }
 
+  private async getCategories(): Promise<Categories> {
+    const categories = await this.options.getCategories()
+    validateCategories(categories)
+    return categories
+  }
+
   private uninitializedAnalytics: AnyAnalytics
 
   constructor(analytics: AnyAnalytics, options: AnalyticsServiceOptions) {
@@ -59,6 +70,45 @@ export class AnalyticsService {
     this.ogAnalyticsLoad = analytics.load.bind(this.uninitializedAnalytics)
   }
 
+  /**
+   * Allow for gracefully passing a custom disable function (without clobbering the default behavior)
+   */
+  private createDisableOption = (
+    categories: Categories,
+    disable: InitOptions['disable']
+  ): NonNullable<InitOptions['disable']> => {
+    if (disable === true) {
+      return true
+    }
+    return (cdnSettings: CDNSettings) => {
+      return (
+        segmentShouldBeDisabled(categories, cdnSettings.consentSettings) ||
+        (typeof disable === 'function' ? disable(cdnSettings) : false)
+      )
+    }
+  }
+
+  async loadWithFilteredDeviceModeDestinations(
+    ...[settings, options]: Parameters<AnyAnalytics['load']>
+  ): Promise<ReturnType<AnyAnalytics['load']>> {
+    const initialCategories = await this.getCategories()
+
+    const _filterDeviceModeDestinationsForOptIn = (cdnSettings: CDNSettings) =>
+      filterDeviceModeDestinationsForOptIn(cdnSettings, initialCategories, {
+        shouldEnableIntegration: this.options.shouldEnableIntegration,
+        integrationCategoryMappings: this.options.integrationCategoryMappings,
+      })
+
+    return this.load(settings, {
+      ...options,
+      updateCDNSettings: pipe(
+        _filterDeviceModeDestinationsForOptIn,
+        options?.updateCDNSettings ?? ((id) => id)
+      ),
+      disable: this.createDisableOption(initialCategories, options?.disable),
+    })
+  }
+
   /**
    * The orignal analytics load function, but also stores the CDN settings on the instance.
    */
@@ -72,7 +122,6 @@ export class AnalyticsService {
         (cdnSettings) => {
           logger.debug('CDN settings loaded', cdnSettings)
           // extract the CDN settings from this call and store it on the instance.
-          // there is an 'initialize' event emitter, but it's called too late for our purposes.
           this.cdnSettingsDeferred.resolve(cdnSettings)
           return cdnSettings
         }
diff --git a/packages/consent/consent-tools/src/domain/create-wrapper.ts b/packages/consent/consent-tools/src/domain/create-wrapper.ts
index 02428a3a6..e0e1917ef 100644
--- a/packages/consent/consent-tools/src/domain/create-wrapper.ts
+++ b/packages/consent/consent-tools/src/domain/create-wrapper.ts
@@ -1,18 +1,8 @@
-import {
-  Categories,
-  CreateWrapper,
-  AnyAnalytics,
-  InitOptions,
-  CDNSettings,
-} from '../types'
-import { validateCategories, validateSettings } from './validation'
-import { assertNever, pipe } from '../utils'
+import { CreateWrapper, AnyAnalytics } from '../types'
+import { validateSettings } from './validation'
+import { assertNever } from '../utils'
 import { normalizeShouldLoadSegment } from './load-context'
 import { AnalyticsService } from './analytics'
-import {
-  filterDeviceModeDestinationsForOptIn,
-  segmentShouldBeDisabled,
-} from './blocking-helpers'
 import { logger } from './logger'
 
 export const createWrapper = <Analytics extends AnyAnalytics>(
@@ -34,6 +24,7 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
   return (analytics: Analytics) => {
     const analyticsService = new AnalyticsService(analytics, {
       integrationCategoryMappings,
+      shouldEnableIntegration,
       getCategories,
     })
 
@@ -86,20 +77,10 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
       // if opt-out, we load as usual and then rely on the consent blocking middleware to block events
       // if opt-in, we remove all destinations that are not explicitly consented to so they never load in the first place
       if (loadCtx.loadOptions.consentModel === 'opt-in') {
-        const initialCategories = await getCategories()
-        validateCategories(initialCategories)
-
-        analyticsService.load(settings, {
-          ...options,
-          updateCDNSettings: pipe((cdnSettings) => {
-            return filterDeviceModeDestinationsForOptIn(
-              cdnSettings,
-              initialCategories,
-              { integrationCategoryMappings, shouldEnableIntegration }
-            )
-          }, options?.updateCDNSettings || ((id) => id)),
-          disable: createDisableOption(initialCategories, options?.disable),
-        })
+        await analyticsService.loadWithFilteredDeviceModeDestinations(
+          settings,
+          options
+        )
         return undefined
       } else if (loadCtx.loadOptions.consentModel === 'opt-out') {
         analyticsService.configureBlockingMiddlewareForOptOut()
@@ -115,21 +96,3 @@ export const createWrapper = <Analytics extends AnyAnalytics>(
     return analytics
   }
 }
-
-/**
- * Allow for gracefully passing a custom disable function (without clobbering the default behavior)
- */
-const createDisableOption = (
-  initialCategories: Categories,
-  disable: InitOptions['disable']
-): NonNullable<InitOptions['disable']> => {
-  if (disable === true) {
-    return true
-  }
-  return (cdnSettings: CDNSettings) => {
-    return (
-      segmentShouldBeDisabled(initialCategories, cdnSettings.consentSettings) ||
-      (typeof disable === 'function' ? disable(cdnSettings) : false)
-    )
-  }
-}
diff --git a/packages/consent/consent-tools/src/types/wrapper.ts b/packages/consent/consent-tools/src/types/wrapper.ts
index b0ae549f7..5573dd7c0 100644
--- a/packages/consent/consent-tools/src/types/wrapper.ts
+++ b/packages/consent/consent-tools/src/types/wrapper.ts
@@ -134,7 +134,7 @@ export interface CDNSettingsConsent {
 
 export interface CDNSettings {
   integrations: CDNSettingsIntegrations
-  remotePlugins: CDNSettingsRemotePlugin[]
+  remotePlugins?: CDNSettingsRemotePlugin[]
   consentSettings?: CDNSettingsConsent
 }
 
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
index 3cf474464..f482c3140 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
@@ -17,10 +17,8 @@ export interface OneTrustSettings {
   disableConsentChangedEvent?: boolean
   /**
    * Override configured consent model
-   * - opt-in  (default) - load segment and all destinations without waiting for explicit consent.
-   * - opt-out (strict/GDPR) - wait for explicit consent before loading segment
-   *
-   * By default, the value is determined by `OneTrust.GetDomainData().ConsentModel` which is set in the OneTrust UI.
+   * - `opt-in` (strict/GDPR) - wait for explicit consent before loading segment and all destinations.
+   * - `opt-out`  (default) - load segment and all destinations without waiting for explicit consent.
    */
   consentModel?: () => 'opt-in' | 'opt-out'
   /**

From 419c571775c68d42c19e9ee7433830cbdcde9cd3 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:36:39 -0500
Subject: [PATCH 31/56] wip

---
 .../src/domain/analytics/analytics-service.ts | 38 +++++++++----------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
index 7e6166ccd..a35492138 100644
--- a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
@@ -4,9 +4,7 @@ import {
   Categories,
   CDNSettings,
   CreateWrapperSettings,
-  GetCategoriesFunction,
   InitOptions,
-  IntegrationCategoryMappings,
   MaybeInitializedAnalytics,
 } from '../../types'
 import { pipe } from '../../utils'
@@ -21,17 +19,19 @@ import {
   segmentShouldBeDisabled,
 } from '../blocking-helpers'
 
-export interface AnalyticsServiceOptions {
-  getCategories: GetCategoriesFunction
-  pruneUnmappedCategories?: boolean
-  integrationCategoryMappings?: IntegrationCategoryMappings
-  shouldEnableIntegration?: CreateWrapperSettings['shouldEnableIntegration']
-}
+export type AnalyticsServiceSettings = Pick<
+  CreateWrapperSettings,
+  | 'getCategories'
+  | 'pruneUnmappedCategories'
+  | 'integrationCategoryMappings'
+  | 'shouldEnableIntegration'
+>
+
 /**
  * This class is a wrapper around the analytics.js library.
  */
 export class AnalyticsService {
-  private options: AnalyticsServiceOptions
+  private settings: AnalyticsServiceSettings
 
   private cdnSettingsDeferred = createDeferred<CDNSettings>()
 
@@ -46,24 +46,24 @@ export class AnalyticsService {
   }
 
   private async getAllCategories(): Promise<string[]> {
-    const allCategories = this.options.integrationCategoryMappings
-      ? parseAllCategories(this.options.integrationCategoryMappings)
+    const allCategories = this.settings.integrationCategoryMappings
+      ? parseAllCategories(this.settings.integrationCategoryMappings)
       : (await this.cdnSettings).consentSettings?.allCategories
 
     return allCategories ?? []
   }
 
   private async getCategories(): Promise<Categories> {
-    const categories = await this.options.getCategories()
+    const categories = await this.settings.getCategories()
     validateCategories(categories)
     return categories
   }
 
   private uninitializedAnalytics: AnyAnalytics
 
-  constructor(analytics: AnyAnalytics, options: AnalyticsServiceOptions) {
+  constructor(analytics: AnyAnalytics, options: AnalyticsServiceSettings) {
     validateAnalyticsInstance(analytics)
-    this.options = options
+    this.settings = options
     this.uninitializedAnalytics = analytics
 
     // store the raw analytics load instance, because we may replace it later
@@ -95,8 +95,8 @@ export class AnalyticsService {
 
     const _filterDeviceModeDestinationsForOptIn = (cdnSettings: CDNSettings) =>
       filterDeviceModeDestinationsForOptIn(cdnSettings, initialCategories, {
-        shouldEnableIntegration: this.options.shouldEnableIntegration,
-        integrationCategoryMappings: this.options.integrationCategoryMappings,
+        shouldEnableIntegration: this.settings.shouldEnableIntegration,
+        integrationCategoryMappings: this.settings.integrationCategoryMappings,
       })
 
     return this.load(settings, {
@@ -142,13 +142,13 @@ export class AnalyticsService {
 
   configureBlockingMiddlewareForOptOut(): void {
     addBlockingMiddleware(this.cdnSettings, this.analytics, {
-      integrationCategoryMappings: this.options.integrationCategoryMappings,
-      shouldEnableIntegration: this.options.shouldEnableIntegration,
+      integrationCategoryMappings: this.settings.integrationCategoryMappings,
+      shouldEnableIntegration: this.settings.shouldEnableIntegration,
     })
   }
 
   configureConsentStampingMiddleware(): void {
-    const { getCategories, pruneUnmappedCategories } = this.options
+    const { getCategories, pruneUnmappedCategories } = this.settings
     // normalize getCategories pruning is turned on or off
     const getCategoriesForConsentStamping = async (): Promise<Categories> => {
       const categories = await getCategories()

From b5156b3d5387fbe371506f62765797b5dd43a31f Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:39:34 -0500
Subject: [PATCH 32/56] wip

---
 .../consent-tools/src/domain/analytics/analytics-service.ts   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
index a35492138..6c8f27c77 100644
--- a/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/analytics-service.ts
@@ -148,10 +148,10 @@ export class AnalyticsService {
   }
 
   configureConsentStampingMiddleware(): void {
-    const { getCategories, pruneUnmappedCategories } = this.settings
+    const { pruneUnmappedCategories } = this.settings
     // normalize getCategories pruning is turned on or off
     const getCategoriesForConsentStamping = async (): Promise<Categories> => {
-      const categories = await getCategories()
+      const categories = await this.getCategories()
       if (pruneUnmappedCategories) {
         return getPrunedCategories(categories, await this.getAllCategories())
       }

From 17b68994fe94efb1d2b3197a06686d2b90fcab78 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:40:01 -0500
Subject: [PATCH 33/56] wip

---
 .../consent/consent-tools/src/domain/consent-stamping.ts    | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/consent-stamping.ts b/packages/consent/consent-tools/src/domain/consent-stamping.ts
index 22101fd96..337844b56 100644
--- a/packages/consent/consent-tools/src/domain/consent-stamping.ts
+++ b/packages/consent/consent-tools/src/domain/consent-stamping.ts
@@ -1,5 +1,4 @@
 import { Categories, SourceMiddlewareFunction } from '../types'
-import { validateCategories } from './validation'
 
 type CreateConsentMw = (
   getCategories: () => Promise<Categories>
@@ -12,12 +11,9 @@ export const createConsentStampingMiddleware: CreateConsentMw = (
   getCategories
 ) => {
   const fn: SourceMiddlewareFunction = async ({ payload, next }) => {
-    const categories = await getCategories()
-
-    validateCategories(categories)
     payload.obj.context.consent = {
       ...payload.obj.context.consent,
-      categoryPreferences: categories,
+      categoryPreferences: await getCategories(),
     }
 
     next(payload)

From 7aaae280e1cc7c0b493e8e6080d4b530d204251f Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:54:42 -0500
Subject: [PATCH 34/56] wip

---
 .../domain/__tests__/consent-stamping.test.ts | 26 --------
 .../__tests__/analytics-service.test.ts       | 66 +++++++++++++++++++
 2 files changed, 66 insertions(+), 26 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts b/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts
index 81fe24056..9dcf7f91c 100644
--- a/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts
+++ b/packages/consent/consent-tools/src/domain/__tests__/consent-stamping.test.ts
@@ -41,30 +41,4 @@ describe(createConsentStampingMiddleware, () => {
       Advertising: true,
     })
   })
-
-  it('should throw an error if getCategories returns an invalid value', async () => {
-    middlewareFn = createConsentStampingMiddleware(getCategories)
-    getCategories.mockReturnValue(null as any)
-    await expect(() =>
-      middlewareFn({
-        next: nextFn,
-        // @ts-ignore
-        payload,
-      })
-    ).rejects.toThrowError(/Validation/)
-    expect(nextFn).not.toHaveBeenCalled()
-  })
-
-  it('should throw an error if getCategories returns an invalid async value', async () => {
-    middlewareFn = createConsentStampingMiddleware(getCategories)
-    getCategories.mockResolvedValue(null as any)
-    await expect(() =>
-      middlewareFn({
-        next: nextFn,
-        // @ts-ignore
-        payload,
-      })
-    ).rejects.toThrowError(/Validation/)
-    expect(nextFn).not.toHaveBeenCalled()
-  })
 })
diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 9b7a59c58..87de2d343 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -1,6 +1,8 @@
 import { AnalyticsService, getInitializedAnalytics } from '../analytics-service'
 import { analyticsMock } from '../../../test-helpers/mocks'
 import { ValidationError } from '../../validation/validation-error'
+import { add } from 'lodash'
+import { Context } from '@segment/analytics-next'
 
 describe(AnalyticsService, () => {
   let analyticsService: AnalyticsService
@@ -13,6 +15,70 @@ describe(AnalyticsService, () => {
       )
     })
   })
+  // eslint-disable-next-line jest/valid-describe-callback
+  describe('getCategories validation', () => {
+    ;[() => null, () => Promise.resolve(null)].forEach((getCategories) => {
+      it(`should throw an error if getCategories returns an invalid value like ${getCategories.toString()} in addSourceMiddleware`, async () => {
+        analyticsService = new AnalyticsService(analyticsMock, {
+          getCategories: () => null as any,
+        })
+        analyticsService.configureConsentStampingMiddleware()
+        const addSourceMiddlewareSpy = jest.spyOn(
+          analyticsMock,
+          'addSourceMiddleware'
+        )
+        const middlewareFn = addSourceMiddlewareSpy.mock.calls[0][0]
+        const nextFn = jest.fn()
+        await expect(() =>
+          middlewareFn({
+            next: nextFn,
+            payload: {
+              // @ts-ignore
+              obj: {
+                context: {
+                  ...new Context({ type: 'track' }),
+                  consent: {
+                    categoryPreferences: { C0001: true },
+                  },
+                },
+              },
+            },
+          })
+        ).rejects.toThrowError(/Validation/)
+        expect(nextFn).not.toHaveBeenCalled()
+      })
+    })
+  })
+
+  it('should throw an error if getCategories returns an invalid async value', async () => {
+    analyticsService = new AnalyticsService(analyticsMock, {
+      getCategories: () => null as any,
+    })
+    analyticsService.configureConsentStampingMiddleware()
+    const addSourceMiddlewareSpy = jest.spyOn(
+      analyticsMock,
+      'addSourceMiddleware'
+    )
+    const middlewareFn = addSourceMiddlewareSpy.mock.calls[0][0]
+    const nextFn = jest.fn()
+    await expect(() =>
+      middlewareFn({
+        next: nextFn,
+        payload: {
+          // @ts-ignore
+          obj: {
+            context: {
+              ...new Context({ type: 'track' }),
+              consent: {
+                categoryPreferences: { C0001: true },
+              },
+            },
+          },
+        },
+      })
+    ).rejects.toThrowError(/Validation/)
+    expect(nextFn).not.toHaveBeenCalled()
+  })
 
   describe('load', () => {
     it('loads normally', () => {

From 1781ec06513649ad3f9b8d51f2abaacbaa37ad2d Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:54:53 -0500
Subject: [PATCH 35/56] wip

---
 .../src/domain/analytics/__tests__/analytics-service.test.ts     | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 87de2d343..c6c7a788a 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -33,7 +33,6 @@ describe(AnalyticsService, () => {
           middlewareFn({
             next: nextFn,
             payload: {
-              // @ts-ignore
               obj: {
                 context: {
                   ...new Context({ type: 'track' }),

From 2cd726538cd74fe7fe065259e490b26f19ebdf0f Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:55:31 -0500
Subject: [PATCH 36/56] wip

---
 .../__tests__/analytics-service.test.ts       | 21 ++++++++++---------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index c6c7a788a..a018d8ff2 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -29,19 +29,20 @@ describe(AnalyticsService, () => {
         )
         const middlewareFn = addSourceMiddlewareSpy.mock.calls[0][0]
         const nextFn = jest.fn()
+        const payload = {
+          obj: {
+            context: {
+              ...new Context({ type: 'track' }),
+              consent: {
+                categoryPreferences: { C0001: true },
+              },
+            },
+          },
+        }
         await expect(() =>
           middlewareFn({
             next: nextFn,
-            payload: {
-              obj: {
-                context: {
-                  ...new Context({ type: 'track' }),
-                  consent: {
-                    categoryPreferences: { C0001: true },
-                  },
-                },
-              },
-            },
+            payload,
           })
         ).rejects.toThrowError(/Validation/)
         expect(nextFn).not.toHaveBeenCalled()

From 21bc59b7a9dac3d6b3ae9f2b01e618e3c5490b7b Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:56:33 -0500
Subject: [PATCH 37/56] wip

---
 .../domain/analytics/__tests__/analytics-service.test.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index a018d8ff2..caa3845c0 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -15,12 +15,13 @@ describe(AnalyticsService, () => {
       )
     })
   })
-  // eslint-disable-next-line jest/valid-describe-callback
+
   describe('getCategories validation', () => {
-    ;[() => null, () => Promise.resolve(null)].forEach((getCategories) => {
-      it(`should throw an error if getCategories returns an invalid value like ${getCategories.toString()} in addSourceMiddleware`, async () => {
+    ;[() => null, () => Promise.resolve(null)].forEach((getCategoriesFn) => {
+      it(`should throw an error if getCategories returns an invalid value like ${getCategoriesFn.toString()} in addSourceMiddleware`, async () => {
         analyticsService = new AnalyticsService(analyticsMock, {
-          getCategories: () => null as any,
+          // @ts-ignore
+          getCategories: getCategoriesFn,
         })
         analyticsService.configureConsentStampingMiddleware()
         const addSourceMiddlewareSpy = jest.spyOn(

From bc78dce3385d90830471550ad36a74133fd3ef14 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 14:57:08 -0500
Subject: [PATCH 38/56] wip

---
 .../src/domain/analytics/__tests__/analytics-service.test.ts     | 1 -
 1 file changed, 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index caa3845c0..7ba51315b 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -1,7 +1,6 @@
 import { AnalyticsService, getInitializedAnalytics } from '../analytics-service'
 import { analyticsMock } from '../../../test-helpers/mocks'
 import { ValidationError } from '../../validation/validation-error'
-import { add } from 'lodash'
 import { Context } from '@segment/analytics-next'
 
 describe(AnalyticsService, () => {

From 1fc0f4c2b003dcff9e16fc91acbaf1279aaff19a Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:06:43 -0500
Subject: [PATCH 39/56] wip

---
 .../domain/analytics/__tests__/analytics-service.test.ts | 9 +++++----
 .../src/domain/validation/options-validators.ts          | 7 ++++++-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 7ba51315b..82f02d2fc 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -16,8 +16,9 @@ describe(AnalyticsService, () => {
   })
 
   describe('getCategories validation', () => {
-    ;[() => null, () => Promise.resolve(null)].forEach((getCategoriesFn) => {
-      it(`should throw an error if getCategories returns an invalid value like ${getCategoriesFn.toString()} in addSourceMiddleware`, async () => {
+    it.each([[() => null], [() => Promise.resolve(null)]])(
+      'should throw an error if getCategories returns an invalid value: %p',
+      async (getCategoriesFn) => {
         analyticsService = new AnalyticsService(analyticsMock, {
           // @ts-ignore
           getCategories: getCategoriesFn,
@@ -46,8 +47,8 @@ describe(AnalyticsService, () => {
           })
         ).rejects.toThrowError(/Validation/)
         expect(nextFn).not.toHaveBeenCalled()
-      })
-    })
+      }
+    )
   })
 
   it('should throw an error if getCategories returns an invalid async value', async () => {
diff --git a/packages/consent/consent-tools/src/domain/validation/options-validators.ts b/packages/consent/consent-tools/src/domain/validation/options-validators.ts
index ac1128a3c..7d236a67f 100644
--- a/packages/consent/consent-tools/src/domain/validation/options-validators.ts
+++ b/packages/consent/consent-tools/src/domain/validation/options-validators.ts
@@ -58,7 +58,12 @@ export function validateAnalyticsInstance(
   analytics: unknown
 ): asserts analytics is AnyAnalytics {
   assertIsObject(analytics, 'analytics')
-  if ('load' in analytics && 'addSourceMiddleware' in analytics) {
+  if (
+    'load' in analytics &&
+    'addSourceMiddleware' in analytics &&
+    'addDestinationMiddleware' in analytics &&
+    'track' in analytics
+  ) {
     return
   }
   throw new ValidationError('analytics is not an Analytics instance', analytics)

From 044211a049ab9d359d5467c4f3c0ebe286f5fb33 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:20:48 -0500
Subject: [PATCH 40/56] wip

---
 .../domain/analytics/__tests__/analytics-service.test.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 82f02d2fc..b042ff398 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -16,9 +16,12 @@ describe(AnalyticsService, () => {
   })
 
   describe('getCategories validation', () => {
-    it.each([[() => null], [() => Promise.resolve(null)]])(
-      'should throw an error if getCategories returns an invalid value: %p',
-      async (getCategoriesFn) => {
+    it.each([
+      { fn: () => null, label: 'sync' },
+      { fn: () => Promise.resolve(null), label: 'async' },
+    ])(
+      'should throw an error if getCategories returns an invalid value: $label',
+      async ({ fn: getCategoriesFn }) => {
         analyticsService = new AnalyticsService(analyticsMock, {
           // @ts-ignore
           getCategories: getCategoriesFn,

From edf16aaa85b0111ecac5bf33a841acdaae59fad8 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:21:16 -0500
Subject: [PATCH 41/56] wip

---
 .../src/domain/analytics/__tests__/analytics-service.test.ts    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index b042ff398..750226f63 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -48,7 +48,7 @@ describe(AnalyticsService, () => {
             next: nextFn,
             payload,
           })
-        ).rejects.toThrowError(/Validation/)
+        ).rejects.toThrow(/Validation/)
         expect(nextFn).not.toHaveBeenCalled()
       }
     )

From 68b2744d52e03d0b549894c1674f637c778cabe1 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:21:46 -0500
Subject: [PATCH 42/56] wip

---
 .../src/domain/analytics/__tests__/analytics-service.test.ts    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 750226f63..8679813e1 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -20,7 +20,7 @@ describe(AnalyticsService, () => {
       { fn: () => null, label: 'sync' },
       { fn: () => Promise.resolve(null), label: 'async' },
     ])(
-      'should throw an error if getCategories returns an invalid value: $label',
+      'should throw an error in configureConsentStampingMiddleware if getCategories returns an invalid value: $label',
       async ({ fn: getCategoriesFn }) => {
         analyticsService = new AnalyticsService(analyticsMock, {
           // @ts-ignore

From 5528f9b8af37d2cab1881773c8a370bc429e7f7c Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:22:07 -0500
Subject: [PATCH 43/56] wip

---
 .../src/domain/analytics/__tests__/analytics-service.test.ts    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 8679813e1..c6717d6cf 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -20,7 +20,7 @@ describe(AnalyticsService, () => {
       { fn: () => null, label: 'sync' },
       { fn: () => Promise.resolve(null), label: 'async' },
     ])(
-      'should throw an error in configureConsentStampingMiddleware if getCategories returns an invalid value: $label',
+      'should throw an error in addSourceMiddleware if getCategories returns an invalid value: $label',
       async ({ fn: getCategoriesFn }) => {
         analyticsService = new AnalyticsService(analyticsMock, {
           // @ts-ignore

From eed0621619089492ca4c8ad0441acd1793c0924e Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:22:31 -0500
Subject: [PATCH 44/56] wip

---
 .../domain/analytics/__tests__/analytics-service.test.ts  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index c6717d6cf..9414e359b 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -17,14 +17,14 @@ describe(AnalyticsService, () => {
 
   describe('getCategories validation', () => {
     it.each([
-      { fn: () => null, label: 'sync' },
-      { fn: () => Promise.resolve(null), label: 'async' },
+      { getCategories: () => null, label: 'sync' },
+      { getCategories: () => Promise.resolve(null), label: 'async' },
     ])(
       'should throw an error in addSourceMiddleware if getCategories returns an invalid value: $label',
-      async ({ fn: getCategoriesFn }) => {
+      async ({ getCategories }) => {
         analyticsService = new AnalyticsService(analyticsMock, {
           // @ts-ignore
-          getCategories: getCategoriesFn,
+          getCategories,
         })
         analyticsService.configureConsentStampingMiddleware()
         const addSourceMiddlewareSpy = jest.spyOn(

From 930474fde480ee9a5a55464a6b99afe5f390468d Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:23:18 -0500
Subject: [PATCH 45/56] wip

---
 .../domain/analytics/__tests__/analytics-service.test.ts    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
index 9414e359b..e589a21cf 100644
--- a/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
+++ b/packages/consent/consent-tools/src/domain/analytics/__tests__/analytics-service.test.ts
@@ -17,10 +17,10 @@ describe(AnalyticsService, () => {
 
   describe('getCategories validation', () => {
     it.each([
-      { getCategories: () => null, label: 'sync' },
-      { getCategories: () => Promise.resolve(null), label: 'async' },
+      { test: 'sync', getCategories: () => null },
+      { test: 'async', getCategories: () => Promise.resolve(null) },
     ])(
-      'should throw an error in addSourceMiddleware if getCategories returns an invalid value: $label',
+      'should throw an error in addSourceMiddleware if getCategories returns an invalid value: $test',
       async ({ getCategories }) => {
         analyticsService = new AnalyticsService(analyticsMock, {
           // @ts-ignore

From 3115e4626705c8de646cd5e412a9ce802affff87 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:28:53 -0500
Subject: [PATCH 46/56] wip

---
 packages/consent/consent-tools/package.json   |  1 +
 .../src/domain/wrapper.ts                     |  1 +
 yarn.lock                                     | 25 +++++++++++++++++++
 3 files changed, 27 insertions(+)

diff --git a/packages/consent/consent-tools/package.json b/packages/consent/consent-tools/package.json
index 1ce4507fe..f218a6b1e 100644
--- a/packages/consent/consent-tools/package.json
+++ b/packages/consent/consent-tools/package.json
@@ -47,6 +47,7 @@
     "url": "https://github.com/segmentio/analytics-next"
   },
   "dependencies": {
+    "changeset": "^0.2.6",
     "tslib": "^2.4.1"
   }
 }
diff --git a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
index f482c3140..039e1f032 100644
--- a/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
+++ b/packages/consent/consent-wrapper-onetrust/src/domain/wrapper.ts
@@ -12,6 +12,7 @@ import {
   getOneTrustGlobal,
 } from '../lib/onetrust-api'
 import { coerceConsentModel } from './consent-model'
+
 export interface OneTrustSettings {
   integrationCategoryMappings?: CreateWrapperSettings['integrationCategoryMappings']
   disableConsentChangedEvent?: boolean
diff --git a/yarn.lock b/yarn.lock
index 576eea9a3..e20b11e26 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3909,6 +3909,7 @@ __metadata:
     "@internal/config": "workspace:^"
     "@internal/test-helpers": "workspace:^"
     "@segment/analytics-next": "workspace:^"
+    changeset: ^0.2.6
     tslib: ^2.4.1
   peerDependencies:
     "@segment/analytics-next": ">=1.53.1"
@@ -8751,6 +8752,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"changeset@npm:^0.2.6":
+  version: 0.2.6
+  resolution: "changeset@npm:0.2.6"
+  dependencies:
+    udc: ^1.0.0
+    underscore: ^1.8.3
+  checksum: bb916eff7dc8d281f91762a4e0d324cc3a527535263fd4d0345be9def20e1b112184c29e4312bec4de34814574b33c271ca5d759c4466acd5dc9b9f1733b434f
+  languageName: node
+  linkType: hard
+
 "char-regex@npm:^1.0.2":
   version: 1.0.2
   resolution: "char-regex@npm:1.0.2"
@@ -21308,6 +21319,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"udc@npm:^1.0.0":
+  version: 1.0.1
+  resolution: "udc@npm:1.0.1"
+  checksum: 302b4bd08feab3f75683bcebfe0dde9eabdb2579400ef3feef09132169842ea83e64441e075b0523c91be3ba1f4668fbb8c7d6918e3032be56a967629c4e7db2
+  languageName: node
+  linkType: hard
+
 "unbox-primitive@npm:^1.0.2":
   version: 1.0.2
   resolution: "unbox-primitive@npm:1.0.2"
@@ -21330,6 +21348,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"underscore@npm:^1.8.3":
+  version: 1.13.6
+  resolution: "underscore@npm:1.13.6"
+  checksum: d5cedd14a9d0d91dd38c1ce6169e4455bb931f0aaf354108e47bd46d3f2da7464d49b2171a5cf786d61963204a42d01ea1332a903b7342ad428deaafaf70ec36
+  languageName: node
+  linkType: hard
+
 "undici@npm:^5.22.1":
   version: 5.28.3
   resolution: "undici@npm:5.28.3"

From 8035379fc37c6cd1c5f08238fce417b994ca6c20 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:30:24 -0500
Subject: [PATCH 47/56] wip

---
 .../standalone-playground/pages/index-consent-opt-out.html     | 3 +--
 playgrounds/standalone-playground/pages/index-consent.html     | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/playgrounds/standalone-playground/pages/index-consent-opt-out.html b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
index 6e2a8ed55..ea4d34e80 100644
--- a/playgrounds/standalone-playground/pages/index-consent-opt-out.html
+++ b/playgrounds/standalone-playground/pages/index-consent-opt-out.html
@@ -110,8 +110,7 @@
             }
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
-            window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
-            withOneTrust(analytics, { consentModel: () => 'opt-out' }).load()
+            withOneTrust(analytics, { consentModel: () => 'opt-out', enableDebugLogging: true }).load()
             analytics.page()
           }
       })()
diff --git a/playgrounds/standalone-playground/pages/index-consent.html b/playgrounds/standalone-playground/pages/index-consent.html
index c76b94972..8e234d4af 100644
--- a/playgrounds/standalone-playground/pages/index-consent.html
+++ b/playgrounds/standalone-playground/pages/index-consent.html
@@ -110,8 +110,7 @@
             }
             analytics.SNIPPET_VERSION = '4.13.1'
             analytics._writeKey = writeKey
-            window['SEGMENT_CONSENT_WRAPPER_DEBUG_MODE'] = true
-            withOneTrust(analytics).load()
+            withOneTrust(analytics, { enableDebugLogging: true }).load()
             analytics.page()
           }
       })()

From acd7d53f9d800ade8da35f4c46b6bbe9f8438502 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:31:46 -0500
Subject: [PATCH 48/56] wip

---
 ...tools-vanilla.test.ts => consent-tools-vanilla-opt-in.test.ts} | 0
 .../pages/{index-consent.html => index-consent-opt-in.html}       | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename packages/consent/consent-tools-integration-tests/src/tests/{consent-tools-vanilla.test.ts => consent-tools-vanilla-opt-in.test.ts} (100%)
 rename playgrounds/standalone-playground/pages/{index-consent.html => index-consent-opt-in.html} (100%)

diff --git a/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts b/packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-in.test.ts
similarity index 100%
rename from packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla.test.ts
rename to packages/consent/consent-tools-integration-tests/src/tests/consent-tools-vanilla-opt-in.test.ts
diff --git a/playgrounds/standalone-playground/pages/index-consent.html b/playgrounds/standalone-playground/pages/index-consent-opt-in.html
similarity index 100%
rename from playgrounds/standalone-playground/pages/index-consent.html
rename to playgrounds/standalone-playground/pages/index-consent-opt-in.html

From 64c44ed55ac0105f209f70a47e3f9edd4527a965 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 15:52:50 -0500
Subject: [PATCH 49/56] wip

---
 .../consent/consent-tools/src/domain/blocking-helpers.ts    | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/packages/consent/consent-tools/src/domain/blocking-helpers.ts b/packages/consent/consent-tools/src/domain/blocking-helpers.ts
index 2ddb45ea1..71453fe63 100644
--- a/packages/consent/consent-tools/src/domain/blocking-helpers.ts
+++ b/packages/consent/consent-tools/src/domain/blocking-helpers.ts
@@ -81,10 +81,6 @@ export const filterDeviceModeDestinationsForOptIn = (
   const { integrationCategoryMappings, shouldEnableIntegration } =
     filterSettings
 
-  if (!remotePlugins) {
-    return cdnSettings
-  }
-
   const cdnSettingsCopy: CDNSettings = {
     ...cdnSettings,
     remotePlugins: [...(remotePlugins || [])],
@@ -105,7 +101,7 @@ export const filterDeviceModeDestinationsForOptIn = (
   for (const creationName in integrations) {
     if (!_shouldEnableIntegrationHelper(creationName)) {
       logger.debug(`Disabled (opt-in): ${creationName}`)
-      cdnSettingsCopy.remotePlugins = remotePlugins.filter(
+      cdnSettingsCopy.remotePlugins = remotePlugins?.filter(
         (p) => p.creationName !== creationName
       )
       // remove disabled classic destinations and locally-installed action destinations

From 2eb40f7bf7d95e086f92e2ab017e85310bef335d Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 16:32:01 -0500
Subject: [PATCH 50/56] wip

---
 ...nt-tools-vanilla.html => consent-tools-vanilla-opt-in.html} | 3 ++-
 .../public/consent-tools-vanilla-opt-out.html                  | 1 +
 .../index.ts                                                   | 0
 .../src/page-objects/consent-tools-vanilla.ts                  | 2 +-
 4 files changed, 4 insertions(+), 2 deletions(-)
 rename packages/consent/consent-tools-integration-tests/public/{consent-tools-vanilla.html => consent-tools-vanilla-opt-in.html} (69%)
 rename packages/consent/consent-tools-integration-tests/src/page-bundles/{consent-tools-vanilla => consent-tools-vanilla-opt-in}/index.ts (100%)

diff --git a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-in.html
similarity index 69%
rename from packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html
rename to packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-in.html
index 997fa47ed..dccc86d97 100644
--- a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla.html
+++ b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-in.html
@@ -5,6 +5,7 @@
   <h1>Hello World - Serving Analytics</h1>
   <h2>Please Check Network tab</h2>
   <p>This page can used as playground or run by webdriver.io</p>
-  <script src="/public/dist/consent-tools-vanilla.bundle.js"></script>
+  <script src="/public/dist/consent-tools-vanilla-opt-in.bundle.js"></script>
 </body>
 
+</html>
\ No newline at end of file
diff --git a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html
index a17c8329a..084a52de9 100644
--- a/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html
+++ b/packages/consent/consent-tools-integration-tests/public/consent-tools-vanilla-opt-out.html
@@ -8,3 +8,4 @@ <h2>Please Check Network tab</h2>
   <script src="/public/dist/consent-tools-vanilla-opt-out.bundle.js"></script>
 </body>
 
+</html>
\ No newline at end of file
diff --git a/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts b/packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-in/index.ts
similarity index 100%
rename from packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla/index.ts
rename to packages/consent/consent-tools-integration-tests/src/page-bundles/consent-tools-vanilla-opt-in/index.ts
diff --git a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
index 56e79a16c..a6fc473e5 100644
--- a/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
+++ b/packages/consent/consent-tools-integration-tests/src/page-objects/consent-tools-vanilla.ts
@@ -19,6 +19,6 @@ export class ConsentToolsVanillaOptOut extends ConsentToolsVanilla {
 
 export class ConsentToolsVanillaOptIn extends ConsentToolsVanilla {
   constructor() {
-    super('consent-tools-vanilla.html')
+    super('consent-tools-vanilla-opt-in.html')
   }
 }

From db8e044dd694568eff1a9f8e265756df2fe68552 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 16:36:26 -0500
Subject: [PATCH 51/56] wip

---
 packages/browser/src/index.ts | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/packages/browser/src/index.ts b/packages/browser/src/index.ts
index 26a3987a4..fdd552aa8 100644
--- a/packages/browser/src/index.ts
+++ b/packages/browser/src/index.ts
@@ -8,10 +8,6 @@ export * from './core/plugin'
 export * from './core/user'
 
 export type { AnalyticsSnippet } from './browser/standalone-interface'
-export type {
-  MiddlewareFunction,
-  DestinationMiddlewareFunction,
-  MiddlewareParams,
-} from './plugins/middleware'
+export type { MiddlewareFunction } from './plugins/middleware'
 export { getGlobalAnalytics } from './lib/global-analytics-helper'
 export { UniversalStorage, Store, StorageObject } from './core/storage'

From 0c9fc266a5b493ebb42c901971534d278afca07b Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 16:43:13 -0500
Subject: [PATCH 52/56] update changeset

---
 .changeset/tall-hornets-do.md | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .changeset/tall-hornets-do.md

diff --git a/.changeset/tall-hornets-do.md b/.changeset/tall-hornets-do.md
new file mode 100644
index 000000000..242411abd
--- /dev/null
+++ b/.changeset/tall-hornets-do.md
@@ -0,0 +1,6 @@
+---
+'@segment/analytics-consent-tools': major
+'@segment/analytics-consent-wrapper-onetrust': major
+---
+
+Add opt-out consent-model support, and use opt-out by default

From 465435b3fa75bd03f7770459d86695597428f2a6 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Tue, 16 Apr 2024 16:58:10 -0500
Subject: [PATCH 53/56] wip

---
 packages/consent/consent-tools/src/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/consent/consent-tools/src/index.ts b/packages/consent/consent-tools/src/index.ts
index 23bcb2ed4..e7e7594a7 100644
--- a/packages/consent/consent-tools/src/index.ts
+++ b/packages/consent/consent-tools/src/index.ts
@@ -4,8 +4,8 @@
  */
 export { createWrapper } from './domain/create-wrapper'
 export { resolveWhen } from './utils'
-
 export type { ConsentModel } from './domain/load-context'
+
 export type {
   Wrapper,
   CreateWrapper,

From 18e78cc81039ab70ce6be47deac10126ac48b7a6 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Wed, 17 Apr 2024 13:58:47 -0500
Subject: [PATCH 54/56] update optional peer dep

---
 packages/consent/consent-tools/package.json | 2 +-
 yarn.lock                                   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/consent/consent-tools/package.json b/packages/consent/consent-tools/package.json
index f218a6b1e..375a36a72 100644
--- a/packages/consent/consent-tools/package.json
+++ b/packages/consent/consent-tools/package.json
@@ -27,7 +27,7 @@
     "jest": "yarn run -T jest"
   },
   "peerDependencies": {
-    "@segment/analytics-next": ">=1.53.1"
+    "@segment/analytics-next": ">=1.67.0"
   },
   "peerDependenciesMeta": {
     "@segment/analytics-next": {
diff --git a/yarn.lock b/yarn.lock
index e20b11e26..91989dc5f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3912,7 +3912,7 @@ __metadata:
     changeset: ^0.2.6
     tslib: ^2.4.1
   peerDependencies:
-    "@segment/analytics-next": ">=1.53.1"
+    "@segment/analytics-next": ">=1.67.0"
   peerDependenciesMeta:
     "@segment/analytics-next":
       optional: true

From 3174b4f0709ff031a073e5cf239cae1b209022e7 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Wed, 17 Apr 2024 14:01:05 -0500
Subject: [PATCH 55/56] remove accidental changeset dep

---
 packages/consent/consent-tools/package.json |  1 -
 yarn.lock                                   | 25 ---------------------
 2 files changed, 26 deletions(-)

diff --git a/packages/consent/consent-tools/package.json b/packages/consent/consent-tools/package.json
index 375a36a72..7704e9320 100644
--- a/packages/consent/consent-tools/package.json
+++ b/packages/consent/consent-tools/package.json
@@ -47,7 +47,6 @@
     "url": "https://github.com/segmentio/analytics-next"
   },
   "dependencies": {
-    "changeset": "^0.2.6",
     "tslib": "^2.4.1"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index 91989dc5f..5bc62d89f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3909,7 +3909,6 @@ __metadata:
     "@internal/config": "workspace:^"
     "@internal/test-helpers": "workspace:^"
     "@segment/analytics-next": "workspace:^"
-    changeset: ^0.2.6
     tslib: ^2.4.1
   peerDependencies:
     "@segment/analytics-next": ">=1.67.0"
@@ -8752,16 +8751,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"changeset@npm:^0.2.6":
-  version: 0.2.6
-  resolution: "changeset@npm:0.2.6"
-  dependencies:
-    udc: ^1.0.0
-    underscore: ^1.8.3
-  checksum: bb916eff7dc8d281f91762a4e0d324cc3a527535263fd4d0345be9def20e1b112184c29e4312bec4de34814574b33c271ca5d759c4466acd5dc9b9f1733b434f
-  languageName: node
-  linkType: hard
-
 "char-regex@npm:^1.0.2":
   version: 1.0.2
   resolution: "char-regex@npm:1.0.2"
@@ -21319,13 +21308,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"udc@npm:^1.0.0":
-  version: 1.0.1
-  resolution: "udc@npm:1.0.1"
-  checksum: 302b4bd08feab3f75683bcebfe0dde9eabdb2579400ef3feef09132169842ea83e64441e075b0523c91be3ba1f4668fbb8c7d6918e3032be56a967629c4e7db2
-  languageName: node
-  linkType: hard
-
 "unbox-primitive@npm:^1.0.2":
   version: 1.0.2
   resolution: "unbox-primitive@npm:1.0.2"
@@ -21348,13 +21330,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"underscore@npm:^1.8.3":
-  version: 1.13.6
-  resolution: "underscore@npm:1.13.6"
-  checksum: d5cedd14a9d0d91dd38c1ce6169e4455bb931f0aaf354108e47bd46d3f2da7464d49b2171a5cf786d61963204a42d01ea1332a903b7342ad428deaafaf70ec36
-  languageName: node
-  linkType: hard
-
 "undici@npm:^5.22.1":
   version: 5.28.3
   resolution: "undici@npm:5.28.3"

From f294612a13f501793c9ce8246d858b9429bf5db8 Mon Sep 17 00:00:00 2001
From: Seth Silesky <5115498+silesky@users.noreply.github.com>
Date: Wed, 17 Apr 2024 14:03:01 -0500
Subject: [PATCH 56/56] tweak opt peer dep

---
 packages/consent/consent-wrapper-onetrust/package.json | 2 +-
 yarn.lock                                              | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packages/consent/consent-wrapper-onetrust/package.json b/packages/consent/consent-wrapper-onetrust/package.json
index c4fac1b85..a839ba4ae 100644
--- a/packages/consent/consent-wrapper-onetrust/package.json
+++ b/packages/consent/consent-wrapper-onetrust/package.json
@@ -45,7 +45,7 @@
     "tslib": "^2.4.1"
   },
   "peerDependencies": {
-    "@segment/analytics-next": ">=1.53.1"
+    "@segment/analytics-next": ">=1.67.0"
   },
   "peerDependenciesMeta": {
     "@segment/analytics-next": {
diff --git a/yarn.lock b/yarn.lock
index 5bc62d89f..8ec12b1d8 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3927,7 +3927,7 @@ __metadata:
     "@segment/analytics-consent-tools": 1.2.0
     tslib: ^2.4.1
   peerDependencies:
-    "@segment/analytics-next": ">=1.53.1"
+    "@segment/analytics-next": ">=1.67.0"
   peerDependenciesMeta:
     "@segment/analytics-next":
       optional: true