@hubpav/hwio-web-runtime 0.1.0

package/README.md

@@ -0,0 +1,9 @@
+# @hubpav/hwio-web-runtime
+
+Framework-free browser behaviours for the HARDWARIO websites, one ES module per concern
+(`/consent`, `/forms`, `/turnstile`, `/attribution`, `/theme`, `/track`, `/reveal`,
+`/counter`, `/nav`, `/accordion`) plus `/inline` (static bootstrap scripts with their
+SHA-256 hashes for CSP). Every behaviour registers through `hwioMount()`, so it binds on
+`astro:page-load` and cleans up on `astro:before-swap` when Astro's ClientRouter is present
+and binds once otherwise. Pure logic lives in `*-core` modules and is unit-tested with
+`node --test`.

package/dist/accordion.d.ts

@@ -0,0 +1,2 @@
+/** Exclusive accordion fallback for browsers without <details name="…"> support. */
+export declare function hwioAccordionRuntime(): import("./mount.js").HWioBinder;

package/dist/accordion.js

@@ -0,0 +1,21 @@
+import { hwioMount } from './mount.js';
+/** Exclusive accordion fallback for browsers without <details name="…"> support. */
+export function hwioAccordionRuntime() {
+    let controller = null;
+    function bind() {
+        if ('name' in document.createElement('details'))
+            return; // native exclusive accordion
+        controller ??= new AbortController();
+        document.querySelectorAll('details[name]:not([data-hwio-accordion-bound])').forEach((details) => {
+            details.dataset.hwioAccordionBound = 'true';
+            details.addEventListener('toggle', () => {
+                if (!details.open)
+                    return;
+                const name = details.getAttribute('name');
+                document.querySelectorAll(`details[name="${name}"]`).forEach((other) => { if (other !== details)
+                    other.open = false; });
+            }, { signal: controller.signal });
+        });
+    }
+    return hwioMount('accordion', { bind, cleanup: () => { controller?.abort(); controller = null; } });
+}

package/dist/attribution.d.ts

@@ -0,0 +1,13 @@
+export declare const HWIO_ATTRIBUTION_KEY = "hwio_attribution";
+/** Click identifiers + UTM params; lowercase keys map onto HubSpot contact properties of the same name. */
+export declare const HWIO_ATTRIBUTION_PARAMS: readonly ["utm_source", "utm_medium", "utm_campaign", "utm_term", "utm_content", "gclid", "gbraid", "wbraid", "fbclid", "msclkid", "li_fat_id"];
+export type HWioAttribution = Record<string, string>;
+/** Pure: click identifiers present in a query string (read at submit time, never stored). */
+export declare function hwioAttributionFromSearch(search: string): HWioAttribution;
+/**
+ * First-touch capture into sessionStorage (marketing storage: call only with marketing consent).
+ * Keeps the first value seen in the session so later navigations cannot clobber the campaign.
+ */
+export declare function hwioCaptureAttribution(): void;
+export declare function hwioGetAttribution(): HWioAttribution;
+export declare function hwioGetPageAttribution(): HWioAttribution;

package/dist/attribution.js

@@ -0,0 +1,65 @@
+export const HWIO_ATTRIBUTION_KEY = 'hwio_attribution';
+const LEGACY_ATTRIBUTION_KEY = 'hw_attribution'; // legacy-ok
+const MAX_LEN = 512;
+/** Click identifiers + UTM params; lowercase keys map onto HubSpot contact properties of the same name. */
+export const HWIO_ATTRIBUTION_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'gclid', 'gbraid', 'wbraid', 'fbclid', 'msclkid', 'li_fat_id'];
+/** Pure: click identifiers present in a query string (read at submit time, never stored). */
+export function hwioAttributionFromSearch(search) {
+    const out = {};
+    const params = new URLSearchParams(search);
+    for (const key of HWIO_ATTRIBUTION_PARAMS) {
+        const value = params.get(key);
+        if (value)
+            out[key] = value.slice(0, MAX_LEN);
+    }
+    return out;
+}
+function read() {
+    try {
+        const raw = sessionStorage.getItem(HWIO_ATTRIBUTION_KEY) ?? sessionStorage.getItem(LEGACY_ATTRIBUTION_KEY);
+        return raw ? JSON.parse(raw) : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * First-touch capture into sessionStorage (marketing storage: call only with marketing consent).
+ * Keeps the first value seen in the session so later navigations cannot clobber the campaign.
+ */
+export function hwioCaptureAttribution() {
+    const stored = read();
+    let changed = false;
+    for (const [key, value] of Object.entries(hwioAttributionFromSearch(window.location.search))) {
+        if (!stored[key]) {
+            stored[key] = value;
+            changed = true;
+        }
+    }
+    if (!stored.referrer && document.referrer) {
+        try {
+            if (new URL(document.referrer).host !== window.location.host) {
+                stored.referrer = document.referrer.slice(0, MAX_LEN);
+                changed = true;
+            }
+        }
+        catch {
+            // malformed referrer
+        }
+    }
+    if (changed) {
+        try {
+            sessionStorage.setItem(HWIO_ATTRIBUTION_KEY, JSON.stringify(stored));
+            sessionStorage.removeItem(LEGACY_ATTRIBUTION_KEY);
+        }
+        catch {
+            // best effort
+        }
+    }
+}
+export function hwioGetAttribution() {
+    return read();
+}
+export function hwioGetPageAttribution() {
+    return hwioAttributionFromSearch(window.location.search);
+}

package/dist/consent-core.d.ts

@@ -0,0 +1,26 @@
+export type HWioConsentCategory = 'necessary' | 'preferences' | 'statistics' | 'marketing';
+export type HWioConsentCategories = Record<HWioConsentCategory, boolean>;
+export interface HWioConsentReceipt {
+    version: string;
+    method: string;
+    locale: string;
+    timestamp: string;
+    categories: HWioConsentCategories;
+}
+export declare const HWIO_CONSENT_COOKIE = "hwio_cookie_consent";
+/** Pre-design-system cookie written by www and the Zola sites; migrated in place, never re-prompted. */
+export declare const LEGACY_CONSENT_COOKIE = "hw_cookie_consent";
+export declare const HWIO_CONSENT_MAX_AGE: number;
+export declare function hwioBaseCategories(overrides?: Partial<Record<string, boolean>> | null): HWioConsentCategories;
+/** Parses a raw cookie value; returns null unless it is a receipt of the expected version. */
+export declare function hwioParseReceipt(raw: string | null | undefined, version: string): HWioConsentReceipt | null;
+export declare function hwioMakeReceipt(categories: Partial<Record<string, boolean>>, method: string, version: string, locale: string, now?: Date): HWioConsentReceipt;
+/** Serialises a receipt into the Set-Cookie string (document.cookie assignment form). */
+export declare function hwioCookieString(name: string, receipt: HWioConsentReceipt, secure: boolean): string;
+export declare function hwioExpireCookieString(name: string, domain?: string): string;
+export declare function hwioReadCookie(cookieHeader: string, name: string): string | null;
+export type HWioGoogleConsent = Record<'ad_storage' | 'ad_user_data' | 'ad_personalization' | 'analytics_storage' | 'functionality_storage' | 'personalization_storage' | 'security_storage', 'granted' | 'denied'>;
+export declare function hwioConsentToGoogle(receipt: HWioConsentReceipt | null): HWioGoogleConsent;
+export declare function hwioHasTrackingConsent(receipt: HWioConsentReceipt | null): boolean;
+/** Cookie names that a withdrawn category must delete (GA4, Google Ads, Meta, HubSpot). */
+export declare function hwioDisallowedCookieNames(names: string[], categories: HWioConsentCategories): string[];

package/dist/consent-core.js

@@ -0,0 +1,85 @@
+export const HWIO_CONSENT_COOKIE = 'hwio_cookie_consent';
+/** Pre-design-system cookie written by www and the Zola sites; migrated in place, never re-prompted. */
+export const LEGACY_CONSENT_COOKIE = 'hw_cookie_consent'; // legacy-ok
+export const HWIO_CONSENT_MAX_AGE = 60 * 60 * 24 * 180;
+export function hwioBaseCategories(overrides) {
+    return {
+        necessary: true,
+        preferences: !!overrides?.preferences,
+        statistics: !!overrides?.statistics,
+        marketing: !!overrides?.marketing,
+    };
+}
+function safeDecode(input) {
+    try {
+        return decodeURIComponent(input);
+    }
+    catch {
+        return input;
+    }
+}
+/** Parses a raw cookie value; returns null unless it is a receipt of the expected version. */
+export function hwioParseReceipt(raw, version) {
+    if (!raw)
+        return null;
+    const attempts = [raw];
+    const decoded = safeDecode(raw);
+    if (decoded !== raw)
+        attempts.push(decoded);
+    for (const attempt of attempts) {
+        try {
+            const parsed = JSON.parse(attempt);
+            if (parsed && parsed.version === version) {
+                return {
+                    version,
+                    method: parsed.method ?? 'unknown',
+                    locale: parsed.locale ?? 'en',
+                    timestamp: parsed.timestamp ?? new Date(0).toISOString(),
+                    categories: hwioBaseCategories(parsed.categories),
+                };
+            }
+        }
+        catch {
+            // not JSON, try the next form
+        }
+    }
+    return null;
+}
+export function hwioMakeReceipt(categories, method, version, locale, now = new Date()) {
+    return { version, method, locale, timestamp: now.toISOString(), categories: hwioBaseCategories(categories) };
+}
+/** Serialises a receipt into the Set-Cookie string (document.cookie assignment form). */
+export function hwioCookieString(name, receipt, secure) {
+    return `${name}=${encodeURIComponent(JSON.stringify(receipt))}; Max-Age=${HWIO_CONSENT_MAX_AGE}; Path=/; SameSite=Lax${secure ? '; Secure' : ''}`;
+}
+export function hwioExpireCookieString(name, domain) {
+    return `${name}=; Max-Age=0; Path=/; SameSite=Lax${domain ? `; Domain=${domain}` : ''}`;
+}
+export function hwioReadCookie(cookieHeader, name) {
+    const match = cookieHeader.match(new RegExp('(?:^|;\\s*)' + name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '=([^;]*)'));
+    return match ? match[1] : null;
+}
+export function hwioConsentToGoogle(receipt) {
+    const c = hwioBaseCategories(receipt?.categories);
+    const g = (v) => (v ? 'granted' : 'denied');
+    return {
+        ad_storage: g(c.marketing),
+        ad_user_data: g(c.marketing),
+        ad_personalization: g(c.marketing),
+        analytics_storage: g(c.statistics),
+        functionality_storage: g(c.preferences),
+        personalization_storage: g(c.preferences),
+        security_storage: 'granted',
+    };
+}
+export function hwioHasTrackingConsent(receipt) {
+    return !!receipt && (receipt.categories.statistics || receipt.categories.marketing);
+}
+/** Cookie names that a withdrawn category must delete (GA4, Google Ads, Meta, HubSpot). */
+export function hwioDisallowedCookieNames(names, categories) {
+    return names.filter((name) => {
+        const isStatistics = name === '_ga' || name.startsWith('_ga_') || name === '_gid' || name.startsWith('_gat');
+        const isMarketing = name.startsWith('_gcl_') || name === '_fbp' || name === '_fbc' || name === 'hubspotutk' || name === '__hstc' || name === '__hssc' || name === '__hssrc';
+        return (!categories.statistics && isStatistics) || (!categories.marketing && isMarketing);
+    });
+}

package/dist/consent.d.ts

@@ -0,0 +1,28 @@
+import { type HWioConsentCategory, type HWioConsentReceipt } from './consent-core.js';
+export interface HWioConsentApi {
+    getConsent: () => HWioConsentReceipt | null;
+    allows: (category: HWioConsentCategory | string) => boolean;
+    canTrack: () => boolean;
+    open: () => void;
+    acceptAll: () => void;
+    rejectAll: () => void;
+}
+declare global {
+    interface Window {
+        hwioConsent?: HWioConsentApi;
+        /** Deprecated alias kept while www's local call sites migrate (P2). */
+        hwConsent?: HWioConsentApi;
+        dataLayer?: unknown[];
+        gtag?: (...args: unknown[]) => void;
+        __hwioGtmLoaded?: boolean;
+    }
+}
+/**
+ * Consent runtime. Markup contract (rendered by HWioCookieConsent):
+ *   [data-hwio-consent data-version data-gtm? data-locale]  banner root (hidden attr toggles it)
+ *   [data-hwio-consent-modal]                               settings dialog wrapper (hidden)
+ *   [data-hwio-consent-accept|reject|customize|save|close]  buttons (may appear several times)
+ *   [data-hwio-consent-toggle="preferences|statistics|marketing"] checkboxes
+ *   [data-hwio-cookie-settings] anywhere (footer)            reopens the dialog
+ */
+export declare function hwioConsentRuntime(): HWioConsentApi;

package/dist/consent.js

@@ -0,0 +1,207 @@
+import { hwioMount } from './mount.js';
+import { HWIO_CONSENT_COOKIE, LEGACY_CONSENT_COOKIE, hwioBaseCategories, hwioConsentToGoogle, hwioCookieString, hwioDisallowedCookieNames, hwioExpireCookieString, hwioHasTrackingConsent, hwioMakeReceipt, hwioParseReceipt, hwioReadCookie, } from './consent-core.js';
+const ATTRIBUTION_KEYS = ['hwio_attribution', 'hw_attribution']; // legacy-ok
+const THEME_KEYS = ['hwio_theme', 'hwio_theme_consent_version', 'theme', 'hw_theme_consent_version']; // legacy-ok
+/**
+ * Consent runtime. Markup contract (rendered by HWioCookieConsent):
+ *   [data-hwio-consent data-version data-gtm? data-locale]  banner root (hidden attr toggles it)
+ *   [data-hwio-consent-modal]                               settings dialog wrapper (hidden)
+ *   [data-hwio-consent-accept|reject|customize|save|close]  buttons (may appear several times)
+ *   [data-hwio-consent-toggle="preferences|statistics|marketing"] checkboxes
+ *   [data-hwio-cookie-settings] anywhere (footer)            reopens the dialog
+ */
+export function hwioConsentRuntime() {
+    let version = '';
+    let gtmId = null;
+    let locale = 'en';
+    let current = null;
+    let resolved = false;
+    let root = null;
+    let modal = null;
+    let toggles = [];
+    let controller = null;
+    const secure = () => window.location.protocol === 'https:';
+    function readStored() {
+        const fresh = hwioParseReceipt(hwioReadCookie(document.cookie, HWIO_CONSENT_COOKIE), version);
+        if (fresh)
+            return fresh;
+        const legacy = hwioParseReceipt(hwioReadCookie(document.cookie, LEGACY_CONSENT_COOKIE), version);
+        if (legacy) {
+            // Migrate in place so returning visitors are not asked again.
+            document.cookie = hwioCookieString(HWIO_CONSENT_COOKIE, legacy, secure());
+            document.cookie = hwioExpireCookieString(LEGACY_CONSENT_COOKIE);
+            return legacy;
+        }
+        return null;
+    }
+    function write(categories, method) {
+        const receipt = hwioMakeReceipt(categories, method, version, locale);
+        document.cookie = hwioCookieString(HWIO_CONSENT_COOKIE, receipt, secure());
+        return receipt;
+    }
+    function updateGoogle(receipt) {
+        window.dataLayer = window.dataLayer || [];
+        window.gtag =
+            window.gtag ||
+                function (...args) {
+                    window.dataLayer.push(args);
+                };
+        window.gtag('consent', 'update', hwioConsentToGoogle(receipt));
+    }
+    function loadGtm(receipt) {
+        if (!gtmId || window.__hwioGtmLoaded || !hwioHasTrackingConsent(receipt))
+            return;
+        if (document.querySelector('script[src*="googletagmanager.com/gtm.js"]')) {
+            window.__hwioGtmLoaded = true;
+            return;
+        }
+        window.__hwioGtmLoaded = true;
+        window.dataLayer = window.dataLayer || [];
+        window.dataLayer.push({ 'gtm.start': Date.now(), event: 'gtm.js' });
+        const script = document.createElement('script');
+        script.async = true;
+        script.src = `https://www.googletagmanager.com/gtm.js?id=${gtmId}`;
+        script.addEventListener('error', () => { window.__hwioGtmLoaded = false; }, { once: true });
+        document.head.appendChild(script);
+    }
+    function clearDisallowed(receipt) {
+        const categories = hwioBaseCategories(receipt?.categories);
+        const host = window.location.hostname;
+        const parts = host.split('.');
+        const domains = Array.from(new Set(['', host, ...(parts.length >= 2 ? ['.' + host] : []), ...(parts.length > 2 ? ['.' + parts.slice(-2).join('.')] : [])]));
+        const names = document.cookie.split(';').map((e) => e.split('=')[0].trim()).filter(Boolean);
+        for (const name of hwioDisallowedCookieNames(names, categories)) {
+            for (const domain of domains)
+                document.cookie = hwioExpireCookieString(name, domain || undefined);
+        }
+        try {
+            if (!categories.marketing)
+                ATTRIBUTION_KEYS.forEach((k) => sessionStorage.removeItem(k));
+            if (!categories.preferences)
+                THEME_KEYS.forEach((k) => localStorage.removeItem(k));
+            else {
+                if (localStorage.getItem('hwio_theme'))
+                    localStorage.setItem('hwio_theme_consent_version', version);
+                if (localStorage.getItem('theme'))
+                    localStorage.setItem('hw_theme_consent_version', version); // legacy-ok
+            }
+        }
+        catch {
+            // storage unavailable
+        }
+    }
+    function setToggles(receipt) {
+        const categories = hwioBaseCategories(receipt?.categories);
+        toggles.forEach((input) => {
+            const key = input.dataset.hwioConsentToggle;
+            input.checked = !!key && categories[key];
+        });
+    }
+    function setModal(open) {
+        if (!modal)
+            return;
+        modal.hidden = !open;
+        if (open) {
+            const first = modal.querySelector('input:not([disabled]), button');
+            first?.focus();
+        }
+    }
+    function render() {
+        if (!resolved || !root)
+            return;
+        root.hidden = !!current;
+        if (current)
+            setToggles(current);
+    }
+    function dispatch() {
+        window.dispatchEvent(new CustomEvent('hwio:consentchange', { detail: current }));
+        window.dispatchEvent(new CustomEvent('hw:consentchange', { detail: current })); // legacy-ok
+    }
+    function apply(categories, method) {
+        current = write(categories, method);
+        resolved = true;
+        updateGoogle(current);
+        clearDisallowed(current);
+        loadGtm(current);
+        render();
+        setModal(false);
+        dispatch();
+    }
+    const api = {
+        getConsent: () => current,
+        allows: (category) => category === 'necessary' || !!current?.categories[category],
+        canTrack: () => hwioHasTrackingConsent(current),
+        open: () => { setToggles(current); setModal(true); },
+        acceptAll: () => apply({ preferences: true, statistics: true, marketing: true }, 'accept_all'),
+        rejectAll: () => apply({}, 'reject_all'),
+    };
+    function cleanup() {
+        controller?.abort();
+        controller = null;
+        setModal(false);
+        root = null;
+        modal = null;
+        toggles = [];
+    }
+    function bind() {
+        const nextRoot = document.querySelector('[data-hwio-consent]');
+        if (!nextRoot)
+            return;
+        if (root === nextRoot && controller && !controller.signal.aborted)
+            return;
+        cleanup();
+        root = nextRoot;
+        version = root.dataset.version ?? document.documentElement.dataset.hwioConsentVersion ?? '';
+        gtmId = root.dataset.gtm || null;
+        locale = root.dataset.locale ?? document.documentElement.lang ?? 'en';
+        modal = document.querySelector('[data-hwio-consent-modal]');
+        toggles = Array.from(document.querySelectorAll('[data-hwio-consent-toggle]'));
+        controller = new AbortController();
+        const { signal } = controller;
+        const on = (selector, handler) => document.querySelectorAll(selector).forEach((el) => el.addEventListener('click', handler, { signal }));
+        on('[data-hwio-consent-accept]', api.acceptAll);
+        on('[data-hwio-consent-reject]', api.rejectAll);
+        on('[data-hwio-consent-customize]', api.open);
+        on('[data-hwio-consent-close]', () => setModal(false));
+        on('[data-hwio-consent-save]', () => {
+            const categories = {};
+            toggles.forEach((input) => { categories[input.dataset.hwioConsentToggle ?? ''] = input.checked; });
+            apply(categories, 'granular');
+        });
+        on('[data-hwio-cookie-settings], [data-cookie-settings]', api.open); // legacy-ok: footer buttons of the current sites
+        modal?.addEventListener('click', (event) => { if (event.target === modal)
+            setModal(false); }, { signal });
+        document.addEventListener('keydown', (event) => {
+            if (event.key === 'Escape')
+                setModal(false);
+            if (event.key !== 'Tab' || !modal || modal.hidden)
+                return;
+            const focusables = Array.from(modal.querySelectorAll('a[href], button:not([disabled]), input:not([disabled]), select:not([disabled]), textarea:not([disabled]), [tabindex]:not([tabindex="-1"])')).filter((el) => !el.hidden && el.offsetParent !== null);
+            if (!focusables.length)
+                return;
+            const first = focusables[0], last = focusables[focusables.length - 1], active = document.activeElement;
+            if (event.shiftKey && (active === first || !modal.contains(active))) {
+                event.preventDefault();
+                last.focus();
+            }
+            else if (!event.shiftKey && active === last) {
+                event.preventDefault();
+                first.focus();
+            }
+        }, { signal });
+        if (!resolved) {
+            current = readStored();
+            resolved = true;
+            if (current) {
+                updateGoogle(current);
+                clearDisallowed(current);
+                loadGtm(current);
+            }
+        }
+        render();
+    }
+    window.hwioConsent = api;
+    window.hwConsent = api; // legacy-ok
+    hwioMount('consent', { bind, cleanup });
+    return api;
+}

package/dist/counter.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Count-up for [data-hwio-counter data-target="120" data-suffix="+"]. Renders the final value
+ * without animation under reduced motion; otherwise eases from 0 when the first counter enters view.
+ */
+export declare function hwioCounterRuntime(): import("./mount.js").HWioBinder;

package/dist/counter.js

@@ -0,0 +1,52 @@
+import { hwioMount } from './mount.js';
+/**
+ * Count-up for [data-hwio-counter data-target="120" data-suffix="+"]. Renders the final value
+ * without animation under reduced motion; otherwise eases from 0 when the first counter enters view.
+ */
+export function hwioCounterRuntime() {
+    let observer = null;
+    let frame = 0;
+    function cleanup() {
+        observer?.disconnect();
+        observer = null;
+        if (frame)
+            cancelAnimationFrame(frame);
+        frame = 0;
+    }
+    function bind() {
+        const counters = Array.from(document.querySelectorAll('[data-hwio-counter]:not([data-hwio-counter-bound])'));
+        if (!counters.length)
+            return;
+        counters.forEach((c) => (c.dataset.hwioCounterBound = 'true'));
+        const finish = () => counters.forEach((c) => { c.textContent = `${parseInt(c.dataset.target ?? '0', 10)}${c.dataset.suffix ?? ''}`; c.dataset.hwioCounterActive = 'true'; });
+        if (window.matchMedia('(prefers-reduced-motion: reduce)').matches)
+            return finish();
+        const animate = () => {
+            const start = performance.now();
+            counters.forEach((c) => { c.textContent = `0${c.dataset.suffix ?? ''}`; c.dataset.hwioCounterActive = 'true'; });
+            const step = (now) => {
+                const progress = Math.min((now - start) / 1200, 1);
+                const eased = 1 - Math.pow(1 - progress, 3);
+                counters.forEach((c) => { c.textContent = `${Math.floor(eased * parseInt(c.dataset.target ?? '0', 10))}${c.dataset.suffix ?? ''}`; });
+                if (progress < 1)
+                    frame = requestAnimationFrame(step);
+                else {
+                    frame = 0;
+                    finish();
+                }
+            };
+            frame = requestAnimationFrame(step);
+        };
+        if (!('IntersectionObserver' in window))
+            return animate();
+        observer = new IntersectionObserver((entries) => {
+            if (entries.some((e) => e.isIntersecting)) {
+                observer?.disconnect();
+                observer = null;
+                animate();
+            }
+        }, { threshold: 0.3 });
+        observer.observe(counters[0]);
+    }
+    return hwioMount('counter', { bind, cleanup });
+}

package/dist/forms-core.d.ts

@@ -0,0 +1,53 @@
+export interface HWioSubmitInput {
+    formId: string;
+    locale: string;
+    turnstileToken?: string;
+    hutk?: string;
+    pageUri: string;
+    pageName: string;
+    fields: Record<string, string>;
+    attribution?: Record<string, string>;
+}
+/** The JSON body accepted by the website-forms Worker (submit.hardwario.com / submit.enerooo.cz). */
+export declare function hwioBuildSubmitPayload(input: HWioSubmitInput): {
+    formId: string;
+    locale: string;
+    turnstileToken: string | undefined;
+    hutk: string | undefined;
+    pageUri: string;
+    pageName: string;
+    fields: Record<string, string>;
+    attribution: Record<string, string> | undefined;
+};
+/** Origin + pathname only: keeps raw query-string click ids out of HubSpot's hs_context. */
+export declare function hwioPageUri(location: {
+    origin: string;
+    pathname: string;
+}): string;
+/** GA4 client id from the _ga cookie value (GA1.1.<client id> -> last two dot groups). */
+export declare function hwioGaClientId(cookieHeader: string): string | undefined;
+/**
+ * Folds UI-only qualification fields into the message field ("Label: value" lines) so small
+ * HubSpot forms need no extra properties. Returns the new fields object.
+ */
+export declare function hwioFoldMessageContext(fields: Record<string, string>, context: {
+    name: string;
+    label: string;
+    value: string;
+}[]): Record<string, string>;
+export type HWioFormEvent = 'generate_lead' | 'newsletter_signup';
+export declare function hwioFormEventPayload(input: {
+    event: HWioFormEvent;
+    formId: string;
+    formName: string;
+    formKind?: string;
+    triggerLocation?: string;
+    pagePath: string;
+}): {
+    page_path: string;
+    trigger_location?: string | undefined;
+    event: HWioFormEvent;
+    form_id: string;
+    form_name: string;
+    form_kind: string;
+};

package/dist/forms-core.js

@@ -0,0 +1,53 @@
+/** The JSON body accepted by the website-forms Worker (submit.hardwario.com / submit.enerooo.cz). */
+export function hwioBuildSubmitPayload(input) {
+    const attribution = input.attribution && Object.keys(input.attribution).length ? input.attribution : undefined;
+    return {
+        formId: input.formId,
+        locale: input.locale,
+        turnstileToken: input.turnstileToken,
+        hutk: input.hutk,
+        pageUri: input.pageUri,
+        pageName: input.pageName,
+        fields: input.fields,
+        attribution,
+    };
+}
+/** Origin + pathname only: keeps raw query-string click ids out of HubSpot's hs_context. */
+export function hwioPageUri(location) {
+    return location.origin + location.pathname;
+}
+/** GA4 client id from the _ga cookie value (GA1.1.<client id> -> last two dot groups). */
+export function hwioGaClientId(cookieHeader) {
+    const ga = cookieHeader.match(/(?:^|;\s*)_ga=([^;]+)/)?.[1];
+    const clientId = ga ? ga.split('.').slice(-2).join('.') : '';
+    return /^\d+\.\d+$/.test(clientId) ? clientId : undefined;
+}
+/**
+ * Folds UI-only qualification fields into the message field ("Label: value" lines) so small
+ * HubSpot forms need no extra properties. Returns the new fields object.
+ */
+export function hwioFoldMessageContext(fields, context) {
+    const out = { ...fields };
+    const lines = [];
+    for (const item of context) {
+        if (item.value.trim())
+            lines.push(`${item.label || item.name}: ${item.value.trim()}`);
+        if (item.name)
+            delete out[item.name];
+    }
+    if (lines.length) {
+        const original = out.message?.trim();
+        out.message = `${lines.join('\n')}${original ? `\n\n${original}` : ''}`.slice(0, 5000);
+    }
+    return out;
+}
+export function hwioFormEventPayload(input) {
+    return {
+        event: input.event,
+        form_id: input.formId,
+        form_name: input.formName,
+        form_kind: input.formKind ?? input.formName,
+        ...(input.triggerLocation ? { trigger_location: input.triggerLocation } : {}),
+        page_path: input.pagePath,
+    };
+}

package/dist/forms.d.ts

@@ -0,0 +1,7 @@
+export interface HWioSubmitResult {
+    ok: boolean;
+    status?: number;
+    error?: string;
+}
+export declare function hwioSubmitForm(form: HTMLFormElement, fields: Record<string, string>): Promise<HWioSubmitResult>;
+export declare function hwioFormsRuntime(): import("./mount.js").HWioBinder;

package/dist/forms.js

@@ -0,0 +1,135 @@
+import { hwioMount } from './mount.js';
+import { hwioGetAttribution, hwioGetPageAttribution } from './attribution.js';
+import { hwioBuildSubmitPayload, hwioFoldMessageContext, hwioFormEventPayload, hwioGaClientId, hwioPageUri } from './forms-core.js';
+import { hwioEnsureTurnstileToken, hwioResetTurnstile } from './turnstile.js';
+/**
+ * Self-describing form contract (attributes stay compatible with the current sites):
+ *   <form data-hs-form="contact" data-hs-form-guid="<HubSpot GUID>" data-hs-endpoint="https://submit.hardwario.com/api/submit"
+ *         data-hs-event="generate_lead|newsletter_signup" data-hs-enrich="true"
+ *         data-hs-sending-msg data-hs-success-msg data-hs-error-msg data-form-kind data-inquiry-source>
+ *   inside: [data-hs-status] element, optional .cf-turnstile, optional [data-message-field data-message-label] controls.
+ * `data-hs-enrich="true"` sends the HubSpot cookie, the stored attribution and the GA4 client id,
+ * each gated on the matching consent category. Click ids in the current URL are always sent.
+ */
+async function readHubspotCookie() {
+    const store = window.cookieStore;
+    if (store) {
+        try {
+            return (await store.get('hubspotutk'))?.value;
+        }
+        catch { /* fall through */ }
+    }
+    return document.cookie.match(/(?:^|;\s*)hubspotutk=([^;]+)/)?.[1];
+}
+export async function hwioSubmitForm(form, fields) {
+    const endpoint = form.dataset.hsEndpoint;
+    const formId = form.dataset.hsFormGuid;
+    if (!endpoint || !formId)
+        return { ok: false, error: 'form is missing data-hs-endpoint or data-hs-form-guid' };
+    const locale = fields.hs_language || document.documentElement.lang.slice(0, 2) || 'en';
+    const turnstileToken = fields['cf-turnstile-response'];
+    delete fields['cf-turnstile-response'];
+    const enrich = form.dataset.hsEnrich === 'true';
+    const canEnrich = enrich && window.hwioConsent?.allows('marketing') === true;
+    const canMeasure = enrich && window.hwioConsent?.allows('statistics') === true;
+    const attribution = { ...(canEnrich ? hwioGetAttribution() : {}), ...hwioGetPageAttribution() };
+    if (canMeasure) {
+        const clientId = hwioGaClientId(document.cookie);
+        if (clientId)
+            attribution.ga_client_id = clientId;
+    }
+    const payload = hwioBuildSubmitPayload({
+        formId,
+        locale,
+        turnstileToken,
+        hutk: canEnrich ? await readHubspotCookie() : undefined,
+        pageUri: hwioPageUri(window.location),
+        pageName: document.title,
+        fields,
+        attribution,
+    });
+    try {
+        const res = await fetch(endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });
+        if (!res.ok) {
+            const detail = await res.text().catch(() => '');
+            return { ok: false, status: res.status, error: detail || res.statusText };
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : 'Network error' };
+    }
+}
+function pushFormEvent(form) {
+    const event = form.dataset.hsEvent;
+    if (!event || !window.hwioConsent?.canTrack())
+        return;
+    window.dataLayer = window.dataLayer || [];
+    window.dataLayer.push(hwioFormEventPayload({
+        event,
+        formId: form.dataset.hsFormGuid ?? '',
+        formName: form.dataset.hsForm ?? '',
+        formKind: form.dataset.formKind,
+        triggerLocation: form.dataset.inquirySource,
+        pagePath: window.location.pathname,
+    }));
+}
+export function hwioFormsRuntime() {
+    function bind() {
+        document.querySelectorAll('form[data-hs-form]').forEach((form) => {
+            if (form.dataset.hsBound === 'true')
+                return;
+            form.dataset.hsBound = 'true';
+            const submitBtn = form.querySelector('button[type="submit"]');
+            if (submitBtn && !submitBtn.dataset.originalText)
+                submitBtn.dataset.originalText = submitBtn.textContent ?? '';
+            form.addEventListener('submit', async (e) => {
+                e.preventDefault();
+                const status = form.querySelector('[data-hs-status]');
+                const sending = form.dataset.hsSendingMsg ?? '';
+                const success = form.dataset.hsSuccessMsg ?? '';
+                const error = form.dataset.hsErrorMsg ?? '';
+                const original = submitBtn?.dataset.originalText ?? submitBtn?.textContent ?? '';
+                if (submitBtn) {
+                    submitBtn.disabled = true;
+                    if (sending)
+                        submitBtn.textContent = sending;
+                }
+                if (status) {
+                    status.textContent = '';
+                    status.classList.remove('hs-status-success', 'hs-status-error');
+                    status.hidden = true;
+                }
+                await hwioEnsureTurnstileToken(form);
+                let fields = {};
+                for (const [name, value] of new FormData(form).entries())
+                    if (typeof value === 'string')
+                        fields[name] = value;
+                const context = Array.from(form.querySelectorAll('[data-message-field]')).map((el) => ({
+                    name: el.name,
+                    label: el.dataset.messageLabel?.trim() ?? '',
+                    value: el.value,
+                }));
+                fields = hwioFoldMessageContext(fields, context);
+                const result = await hwioSubmitForm(form, fields);
+                hwioResetTurnstile(form);
+                if (submitBtn) {
+                    submitBtn.disabled = false;
+                    submitBtn.textContent = original;
+                }
+                if (status) {
+                    status.hidden = false;
+                    status.textContent = result.ok ? success : error;
+                    status.classList.add(result.ok ? 'hs-status-success' : 'hs-status-error');
+                }
+                if (result.ok) {
+                    pushFormEvent(form);
+                    form.reset();
+                }
+                else
+                    console.error('form submission failed', result);
+            });
+        });
+    }
+    return hwioMount('forms', { bind, cleanup: () => { } });
+}

package/dist/inline.d.ts

@@ -0,0 +1,8 @@
+export interface HWioInlineScript {
+    code: string;
+    hash: string;
+}
+export declare const consentDefaults: HWioInlineScript;
+export declare const fontGate: HWioInlineScript;
+export declare const themeBootstrap: HWioInlineScript;
+export declare const hwioInlineHashes: string[];

package/dist/inline.js

@@ -0,0 +1,4 @@
+export const consentDefaults = { "code": "(function(){window.dataLayer=window.dataLayer||[];window.gtag=window.gtag||function(){window.dataLayer.push(arguments)};window.gtag('consent','default',{ad_storage:'denied',ad_user_data:'denied',ad_personalization:'denied',analytics_storage:'denied',functionality_storage:'denied',personalization_storage:'denied',security_storage:'granted'})})();", "hash": "sha256-8ypBBYlrPDUYAWyidrG8ZMBi91IYR2VYNNXABFu2aI8=" };
+export const fontGate = { "code": "(function(){var h=document.documentElement,d=h.dataset,fam=d.hwioFontFamily;if(!fam||!('fonts' in document)){h.classList.remove('fonts-loading');h.classList.add('fonts-ready');return}var T=5000;function load(s){return new Promise(function(res,rej){var id=setTimeout(function(){rej(new Error('font timeout'))},T);document.fonts.load('400 1em \"'+fam+'\"',s).then(function(f){clearTimeout(id);res(f)},function(e){clearTimeout(id);rej(e)})})}if(!window.__hwioFontGate){window.__hwioFontGate={state:'loading',ready:Promise.all([load(d.hwioFontSample||'HARDWARIO'),load(d.hwioFontSampleExt||'Řešení Vývojáři Odwiedź')])};document.addEventListener('astro:before-swap',function(ev){var n=ev.newDocument.documentElement;n.classList.add('js');n.classList.remove('fonts-loading');n.classList.toggle('fonts-failed',window.__hwioFontGate.state==='failed');n.classList.add('fonts-ready');var cur=h.getAttribute('data-theme');if(cur)n.setAttribute('data-theme',cur);else n.removeAttribute('data-theme')})}window.__hwioFontGate.ready.then(function(){window.__hwioFontGate.state='ready';h.classList.remove('fonts-loading');h.classList.add('fonts-ready')},function(){window.__hwioFontGate.state='failed';h.classList.remove('fonts-loading');h.classList.add('fonts-failed','fonts-ready')})})();", "hash": "sha256-yZ5zwDTjvBj25m7DRmqzRrznrnc2PqP3T7FWx0ftKO8=" };
+export const themeBootstrap = { "code": "(function(){var h=document.documentElement,d=h.dataset;h.classList.add('js');try{var v=d.hwioConsentVersion;var sv=localStorage.getItem('hwio_theme_consent_version')||localStorage.getItem('hw_theme_consent_version');if(!v||sv!==v)return;var t=localStorage.getItem('hwio_theme')||localStorage.getItem('theme');if(t==='dark'&&d.hwioThemeDark)h.setAttribute('data-theme',d.hwioThemeDark);else if(t==='light'&&d.hwioThemeLight)h.setAttribute('data-theme',d.hwioThemeLight)}catch(e){}})();", "hash": "sha256-JW1fCR5ZsiIO72q9E9VB79Buasr9rvLssoILZij91Yk=" }; // legacy-ok: reads the pre-design-system storage keys once
+export const hwioInlineHashes = [consentDefaults.hash, fontGate.hash, themeBootstrap.hash];

package/dist/mount.d.ts

@@ -0,0 +1,21 @@
+/** A behaviour that can attach to the current document and detach before a view-transition swap. */
+export interface HWioBinder {
+    bind: () => void;
+    cleanup: () => void;
+}
+declare global {
+    interface Window {
+        __hwioRuntimes?: Record<string, HWioBinder>;
+    }
+}
+/**
+ * Registers a behaviour once per page session. With Astro's ClientRouter the module script runs
+ * once, so `bind` re-runs on every `astro:page-load` and `cleanup` before each swap. Without the
+ * router it binds immediately. Binders must be idempotent (mark bound nodes with data-hwio-*-bound).
+ */
+export declare function hwioMount(name: string, binder: HWioBinder): HWioBinder;
+/** Shorthand for behaviours that use one AbortController per page. */
+export declare function hwioPageScope(): {
+    signal: AbortSignal;
+    abort: () => void;
+};

package/dist/mount.js

@@ -0,0 +1,28 @@
+/**
+ * Registers a behaviour once per page session. With Astro's ClientRouter the module script runs
+ * once, so `bind` re-runs on every `astro:page-load` and `cleanup` before each swap. Without the
+ * router it binds immediately. Binders must be idempotent (mark bound nodes with data-hwio-*-bound).
+ */
+export function hwioMount(name, binder) {
+    const registry = (window.__hwioRuntimes ??= {});
+    const existing = registry[name];
+    if (existing) {
+        existing.bind();
+        return existing;
+    }
+    registry[name] = binder;
+    document.addEventListener('astro:before-swap', () => binder.cleanup());
+    document.addEventListener('astro:page-load', () => binder.bind());
+    if (document.readyState === 'loading') {
+        document.addEventListener('DOMContentLoaded', () => binder.bind(), { once: true });
+    }
+    else {
+        binder.bind();
+    }
+    return binder;
+}
+/** Shorthand for behaviours that use one AbortController per page. */
+export function hwioPageScope() {
+    const controller = new AbortController();
+    return { signal: controller.signal, abort: () => controller.abort() };
+}

package/dist/nav.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Header behaviours: keeps aria-expanded on the DaisyUI drawer label in sync with its checkbox,
+ * closes the drawer when a link inside it is followed, and marks the nav link whose section is
+ * in view ([data-hwio-scrollspy] nav with same-page anchors) with aria-current="location".
+ */
+export declare function hwioNavRuntime(): import("./mount.js").HWioBinder;

package/dist/nav.js

@@ -0,0 +1,51 @@
+import { hwioMount } from './mount.js';
+/**
+ * Header behaviours: keeps aria-expanded on the DaisyUI drawer label in sync with its checkbox,
+ * closes the drawer when a link inside it is followed, and marks the nav link whose section is
+ * in view ([data-hwio-scrollspy] nav with same-page anchors) with aria-current="location".
+ */
+export function hwioNavRuntime() {
+    let controller = null;
+    let observer = null;
+    function cleanup() {
+        controller?.abort();
+        controller = null;
+        observer?.disconnect();
+        observer = null;
+    }
+    function bind() {
+        cleanup();
+        controller = new AbortController();
+        const { signal } = controller;
+        document.querySelectorAll('input.drawer-toggle').forEach((input) => {
+            const labels = Array.from(document.querySelectorAll(`label[for="${input.id}"]`));
+            const sync = () => labels.forEach((l) => l.setAttribute('aria-expanded', String(input.checked)));
+            sync();
+            input.addEventListener('change', sync, { signal });
+            const side = input.parentElement?.querySelector('.drawer-side');
+            side?.querySelectorAll('a[href]').forEach((a) => a.addEventListener('click', () => { input.checked = false; sync(); }, { signal }));
+            document.addEventListener('keydown', (e) => { if (e.key === 'Escape' && input.checked) {
+                input.checked = false;
+                sync();
+            } }, { signal });
+        });
+        const nav = document.querySelector('[data-hwio-scrollspy]');
+        if (!nav || !('IntersectionObserver' in window))
+            return;
+        const links = Array.from(nav.querySelectorAll('a[href^="#"]'));
+        const sections = links.map((a) => document.getElementById(a.hash.slice(1))).filter((s) => !!s);
+        if (!sections.length)
+            return;
+        observer = new IntersectionObserver((entries) => {
+            const visible = entries.filter((e) => e.isIntersecting).sort((a, b) => b.intersectionRatio - a.intersectionRatio)[0];
+            if (!visible)
+                return;
+            links.forEach((a) => { if (a.hash.slice(1) === visible.target.id)
+                a.setAttribute('aria-current', 'location');
+            else
+                a.removeAttribute('aria-current'); });
+        }, { rootMargin: '-40% 0px -50% 0px', threshold: [0, 0.25, 0.5] });
+        sections.forEach((s) => observer.observe(s));
+    }
+    return hwioMount('nav', { bind, cleanup });
+}

package/dist/reveal.d.ts

@@ -0,0 +1,2 @@
+/** Scroll reveal for [data-hwio-reveal]: sets data-hwio-revealed once in view; reduced motion reveals immediately. */
+export declare function hwioRevealRuntime(): import("./mount.js").HWioBinder;

package/dist/reveal.js

@@ -0,0 +1,24 @@
+import { hwioMount } from './mount.js';
+/** Scroll reveal for [data-hwio-reveal]: sets data-hwio-revealed once in view; reduced motion reveals immediately. */
+export function hwioRevealRuntime() {
+    let observer = null;
+    function bind() {
+        const targets = Array.from(document.querySelectorAll('[data-hwio-reveal]:not([data-hwio-revealed])'));
+        if (!targets.length)
+            return;
+        if (window.matchMedia('(prefers-reduced-motion: reduce)').matches || !('IntersectionObserver' in window)) {
+            targets.forEach((el) => (el.dataset.hwioRevealed = 'true'));
+            return;
+        }
+        observer ??= new IntersectionObserver((entries) => {
+            entries.forEach((entry) => {
+                if (!entry.isIntersecting)
+                    return;
+                entry.target.dataset.hwioRevealed = 'true';
+                observer?.unobserve(entry.target);
+            });
+        }, { threshold: 0.1, rootMargin: '0px 0px -50px 0px' });
+        targets.forEach((el) => observer.observe(el));
+    }
+    return hwioMount('reveal', { bind, cleanup: () => { observer?.disconnect(); observer = null; } });
+}

package/dist/theme.d.ts

@@ -0,0 +1,10 @@
+export type HWioScheme = 'light' | 'dark';
+export type HWioThemeChoice = HWioScheme | 'system';
+/** The scheme actually in effect: explicit data-theme ending in "-dark", else the OS preference. */
+export declare function hwioResolvedScheme(): HWioScheme;
+export declare function hwioApplyTheme(choice: HWioThemeChoice): void;
+/**
+ * Binds [data-hwio-theme-toggle] buttons (two-state light/dark) and keeps the runtime-only
+ * data-theme across ClientRouter swaps (Astro restores root attributes from server HTML).
+ */
+export declare function hwioThemeRuntime(): import("./mount.js").HWioBinder;

package/dist/theme.js

@@ -0,0 +1,79 @@
+import { hwioMount } from './mount.js';
+const THEME_KEY = 'hwio_theme';
+const THEME_VERSION_KEY = 'hwio_theme_consent_version';
+/** The scheme actually in effect: explicit data-theme ending in "-dark", else the OS preference. */
+export function hwioResolvedScheme() {
+    const theme = document.documentElement.getAttribute('data-theme');
+    if (theme)
+        return theme.endsWith('-dark') ? 'dark' : 'light';
+    if (document.documentElement.classList.contains('dark'))
+        return 'dark'; // legacy-ok: www's class toggle until P2
+    return window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+}
+function themeNames() {
+    const d = document.documentElement.dataset;
+    return { light: d.hwioThemeLight ?? 'hwio', dark: d.hwioThemeDark ?? 'hwio-dark' };
+}
+export function hwioApplyTheme(choice) {
+    const html = document.documentElement;
+    const names = themeNames();
+    if (choice === 'system')
+        html.removeAttribute('data-theme');
+    else
+        html.setAttribute('data-theme', choice === 'dark' ? names.dark : names.light);
+    html.classList.add('hwio-theme-transition');
+    window.setTimeout(() => html.classList.remove('hwio-theme-transition'), 300);
+    try {
+        if (window.hwioConsent?.allows('preferences')) {
+            if (choice === 'system') {
+                localStorage.removeItem(THEME_KEY);
+                localStorage.removeItem(THEME_VERSION_KEY);
+            }
+            else {
+                localStorage.setItem(THEME_KEY, choice);
+                const version = html.dataset.hwioConsentVersion;
+                if (version)
+                    localStorage.setItem(THEME_VERSION_KEY, version);
+            }
+        }
+    }
+    catch {
+        // storage unavailable
+    }
+    window.dispatchEvent(new CustomEvent('hwio:themechange', { detail: { choice, scheme: hwioResolvedScheme() } }));
+}
+/**
+ * Binds [data-hwio-theme-toggle] buttons (two-state light/dark) and keeps the runtime-only
+ * data-theme across ClientRouter swaps (Astro restores root attributes from server HTML).
+ */
+export function hwioThemeRuntime() {
+    let controller = null;
+    let themeBeforeSwap = null;
+    document.addEventListener('astro:before-swap', () => { themeBeforeSwap = document.documentElement.getAttribute('data-theme'); });
+    document.addEventListener('astro:after-swap', () => {
+        document.documentElement.classList.add('js');
+        if (themeBeforeSwap)
+            document.documentElement.setAttribute('data-theme', themeBeforeSwap);
+        else
+            document.documentElement.removeAttribute('data-theme');
+    });
+    function syncPressed() {
+        const dark = hwioResolvedScheme() === 'dark';
+        document.querySelectorAll('[data-hwio-theme-toggle]').forEach((el) => el.setAttribute('aria-pressed', String(dark)));
+    }
+    function bind() {
+        const toggles = Array.from(document.querySelectorAll('[data-hwio-theme-toggle]:not([data-hwio-theme-bound])'));
+        syncPressed();
+        if (!toggles.length)
+            return;
+        controller ??= new AbortController();
+        toggles.forEach((toggle) => {
+            toggle.dataset.hwioThemeBound = 'true';
+            toggle.addEventListener('click', () => {
+                hwioApplyTheme(hwioResolvedScheme() === 'dark' ? 'light' : 'dark');
+                syncPressed();
+            }, { signal: controller.signal });
+        });
+    }
+    return hwioMount('theme', { bind, cleanup: () => { controller?.abort(); controller = null; } });
+}

package/dist/track.d.ts

@@ -0,0 +1,6 @@
+/**
+ * CTA click events for GTM: any [data-track] element pushes cta_click with its id and location.
+ * Consent-gated like the form events. Attribute names are the measurement contract shared with
+ * the GTM containers and CONVERSION.md; do not rename them.
+ */
+export declare function hwioTrackRuntime(): void;

package/dist/track.js

@@ -0,0 +1,22 @@
+/**
+ * CTA click events for GTM: any [data-track] element pushes cta_click with its id and location.
+ * Consent-gated like the form events. Attribute names are the measurement contract shared with
+ * the GTM containers and CONVERSION.md; do not rename them.
+ */
+export function hwioTrackRuntime() {
+    if (window.__hwioTrackBound)
+        return;
+    window.__hwioTrackBound = true;
+    document.addEventListener('click', (event) => {
+        const el = event.target?.closest?.('[data-track]');
+        if (!el || !window.hwioConsent?.canTrack())
+            return;
+        window.dataLayer = window.dataLayer || [];
+        window.dataLayer.push({
+            event: 'cta_click',
+            cta_id: el.getAttribute('data-track'),
+            trigger_location: el.getAttribute('data-track-location') || undefined,
+            page_path: window.location.pathname,
+        });
+    });
+}

package/dist/turnstile.d.ts

@@ -0,0 +1,30 @@
+interface TurnstileApi {
+    render: (el: HTMLElement, opts: {
+        sitekey: string;
+        theme?: 'light' | 'dark' | 'auto';
+    }) => string | undefined;
+    reset: (id?: string) => void;
+    remove: (id: string) => void;
+}
+export type HWioTurnstileForm = HTMLFormElement & {
+    hwioLoadTurnstile?: () => void;
+    hwioTurnstileWidgetId?: string;
+    hwLoadTurnstile?: () => void;
+    hwTurnstileWidgetId?: string;
+};
+declare global {
+    interface Window {
+        turnstile?: TurnstileApi;
+        __hwioTurnstileLoader?: Promise<TurnstileApi>;
+    }
+}
+/**
+ * Lazy explicit Turnstile: the third-party script loads on first form interaction (focus or
+ * pointer-enter) and the widget id is stored on its form so the submit handler resets exactly
+ * the token it consumed. Markup: <div class="cf-turnstile" data-sitekey="..."> inside a <form>.
+ */
+export declare function hwioTurnstileRuntime(): import("./mount.js").HWioBinder;
+/** Waits (bounded) for the lazily rendered widget to produce a token before the form is snapshotted. */
+export declare function hwioEnsureTurnstileToken(form: HWioTurnstileForm, timeoutMs?: number): Promise<void>;
+export declare function hwioResetTurnstile(form: HWioTurnstileForm): void;
+export {};

package/dist/turnstile.js

@@ -0,0 +1,92 @@
+import { hwioMount } from './mount.js';
+import { hwioResolvedScheme } from './theme.js';
+const SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit';
+function loadApi() {
+    if (window.turnstile)
+        return Promise.resolve(window.turnstile);
+    if (window.__hwioTurnstileLoader)
+        return window.__hwioTurnstileLoader;
+    window.__hwioTurnstileLoader = new Promise((resolve, reject) => {
+        const existing = document.querySelector(`script[src="${SRC}"]`);
+        const script = existing ?? document.createElement('script');
+        script.addEventListener('load', () => (window.turnstile ? resolve(window.turnstile) : reject(new Error('Turnstile loaded without its API'))), { once: true });
+        script.addEventListener('error', () => { delete window.__hwioTurnstileLoader; reject(new Error('Turnstile failed to load')); }, { once: true });
+        if (!existing) {
+            script.src = SRC;
+            script.async = true;
+            document.head.appendChild(script);
+        }
+    });
+    return window.__hwioTurnstileLoader;
+}
+/**
+ * Lazy explicit Turnstile: the third-party script loads on first form interaction (focus or
+ * pointer-enter) and the widget id is stored on its form so the submit handler resets exactly
+ * the token it consumed. Markup: <div class="cf-turnstile" data-sitekey="..."> inside a <form>.
+ */
+export function hwioTurnstileRuntime() {
+    let controller = null;
+    let widgetIds = [];
+    function cleanup() {
+        controller?.abort();
+        controller = null;
+        widgetIds.forEach((id) => { try {
+            window.turnstile?.remove(id);
+        }
+        catch { /* gone */ } });
+        widgetIds = [];
+    }
+    function bind() {
+        const containers = Array.from(document.querySelectorAll('.cf-turnstile:not([data-hwio-turnstile-bound])'));
+        if (!containers.length)
+            return;
+        controller ??= new AbortController();
+        const { signal } = controller;
+        containers.forEach((container) => {
+            const form = container.closest('form');
+            if (!form)
+                return;
+            container.dataset.hwioTurnstileBound = 'true';
+            let state = 'idle';
+            const render = (api) => {
+                if (signal.aborted || !container.isConnected || state === 'rendered')
+                    return;
+                state = 'rendered';
+                const id = api.render(container, { sitekey: container.dataset.sitekey ?? '', theme: hwioResolvedScheme() });
+                if (id !== undefined) {
+                    widgetIds.push(id);
+                    form.hwioTurnstileWidgetId = id;
+                    form.hwTurnstileWidgetId = id; // legacy-ok
+                }
+            };
+            const load = () => {
+                if (state !== 'idle')
+                    return;
+                state = 'loading';
+                loadApi().then(render).catch(() => { if (!signal.aborted)
+                    state = 'idle'; });
+            };
+            form.hwioLoadTurnstile = load;
+            form.hwLoadTurnstile = load; // legacy-ok
+            form.addEventListener('focusin', load, { once: true, signal });
+            form.addEventListener('pointerenter', load, { once: true, signal });
+        });
+    }
+    return hwioMount('turnstile', { bind, cleanup });
+}
+/** Waits (bounded) for the lazily rendered widget to produce a token before the form is snapshotted. */
+export async function hwioEnsureTurnstileToken(form, timeoutMs = 4000) {
+    const token = () => form.querySelector('input[name="cf-turnstile-response"]')?.value ?? '';
+    if (!form.querySelector('.cf-turnstile') || token())
+        return;
+    form.hwioLoadTurnstile?.();
+    const start = performance.now();
+    while (!token() && performance.now() - start < timeoutMs) {
+        await new Promise((r) => setTimeout(r, 100));
+    }
+}
+export function hwioResetTurnstile(form) {
+    const id = form.hwioTurnstileWidgetId;
+    if (id)
+        window.turnstile?.reset(id);
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@hubpav/hwio-web-runtime",
+  "version": "0.1.0",
+  "description": "Framework-free browser runtime for the HARDWARIO websites: consent (Consent Mode v2 + GTM), HubSpot forms with Turnstile, attribution, theme, CTA tracking and small behaviours. View-transition safe.",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hardwario/website-ui.git",
+    "directory": "packages/web-runtime"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    "./mount": "./dist/mount.js",
+    "./consent": "./dist/consent.js",
+    "./consent-core": "./dist/consent-core.js",
+    "./forms": "./dist/forms.js",
+    "./forms-core": "./dist/forms-core.js",
+    "./turnstile": "./dist/turnstile.js",
+    "./attribution": "./dist/attribution.js",
+    "./theme": "./dist/theme.js",
+    "./track": "./dist/track.js",
+    "./reveal": "./dist/reveal.js",
+    "./counter": "./dist/counter.js",
+    "./nav": "./dist/nav.js",
+    "./accordion": "./dist/accordion.js",
+    "./inline": "./dist/inline.js",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "build": "node scripts/build-inline.mjs && tsc -p tsconfig.json",
+    "test": "node --test \"test/**/*.test.mjs\""
+  },
+  "devDependencies": {
+    "typescript": "^6.0.3"
+  },
+  "sideEffects": false
+}