@hubpav/hwio-web-runtime 0.7.4 → 0.7.5

package/dist/forms-core.d.ts

@@ -19,6 +19,27 @@ export declare function hwioBuildSubmitPayload(input: HWioSubmitInput): {
     fields: Record<string, string>;
     attribution: Record<string, string> | undefined;
 };
+export interface HWioAttributionInput {
+    /** The form opted into enrichment (`data-hs-enrich="true"`). */
+    enrich: boolean;
+    /** Marketing consent is granted. */
+    marketing: boolean;
+    /** Statistics consent is granted. */
+    statistics: boolean;
+    /** The session copy of the first-touch attribution (`hwio_attribution`). */
+    stored?: Record<string, string>;
+    /** Click ids and UTM parameters in the current page URL. */
+    page?: Record<string, string>;
+    /** GA4 client id from the `_ga` cookie. */
+    gaClientId?: string;
+}
+/**
+ * The attribution sent with a submission (owner decision 2026-10-08). Click ids and UTM
+ * parameters travel only with marketing consent, whether they come from the current URL or
+ * from the stored session copy (the latter on enriched forms only; the URL wins on a clash).
+ * The GA4 client id travels only with statistics consent, on enriched forms.
+ */
+export declare function hwioSubmitAttribution(input: HWioAttributionInput): Record<string, string>;
 /** Origin + pathname only: keeps raw query-string click ids out of HubSpot's hs_context. */
 export declare function hwioPageUri(location: {
     origin: string;

package/dist/forms-core.js

@@ -12,6 +12,20 @@ export function hwioBuildSubmitPayload(input) {
         attribution,
     };
 }
+/**
+ * The attribution sent with a submission (owner decision 2026-10-08). Click ids and UTM
+ * parameters travel only with marketing consent, whether they come from the current URL or
+ * from the stored session copy (the latter on enriched forms only; the URL wins on a clash).
+ * The GA4 client id travels only with statistics consent, on enriched forms.
+ */
+export function hwioSubmitAttribution(input) {
+    const out = {};
+    if (input.marketing)
+        Object.assign(out, input.enrich ? input.stored : undefined, input.page);
+    if (input.enrich && input.statistics && input.gaClientId)
+        out.ga_client_id = input.gaClientId;
+    return out;
+}
 /** Origin + pathname only: keeps raw query-string click ids out of HubSpot's hs_context. */
 export function hwioPageUri(location) {
     return location.origin + location.pathname;

package/dist/forms.js

@@ -1,6 +1,6 @@
 import { hwioMount } from './mount.js';
 import { hwioGetAttribution, hwioGetPageAttribution } from './attribution.js';
-import { hwioBuildSubmitPayload, hwioFoldMessageContext, hwioFormEventPayload, hwioGaClientId, hwioPageUri } from './forms-core.js';
+import { hwioBuildSubmitPayload, hwioFoldMessageContext, hwioFormEventPayload, hwioGaClientId, hwioPageUri, hwioSubmitAttribution } from './forms-core.js';
 import { hwioEnsureTurnstileToken, hwioResetTurnstile } from './turnstile.js';
 /**
  * Self-describing form contract (attributes stay compatible with the current sites):
@@ -9,7 +9,8 @@ import { hwioEnsureTurnstileToken, hwioResetTurnstile } from './turnstile.js';
  *         data-hs-sending-msg data-hs-success-msg data-hs-error-msg data-form-kind data-inquiry-source>
  *   inside: [data-hs-status] element, optional .cf-turnstile, optional [data-message-field data-message-label] controls.
  * `data-hs-enrich="true"` sends the HubSpot cookie, the stored attribution and the GA4 client id,
- * each gated on the matching consent category. Click ids in the current URL are always sent.
+ * each gated on the matching consent category. Click ids and UTM parameters in the current URL
+ * are sent on every form, but only with marketing consent (owner decision 2026-10-08).
  */
 async function readHubspotCookie() {
     const store = window.cookieStore;
@@ -30,14 +31,17 @@ export async function hwioSubmitForm(form, fields) {
     const turnstileToken = fields['cf-turnstile-response'];
     delete fields['cf-turnstile-response'];
     const enrich = form.dataset.hsEnrich === 'true';
-    const canEnrich = enrich && window.hwioConsent?.allows('marketing') === true;
-    const canMeasure = enrich && window.hwioConsent?.allows('statistics') === true;
-    const attribution = { ...(canEnrich ? hwioGetAttribution() : {}), ...hwioGetPageAttribution() };
-    if (canMeasure) {
-        const clientId = hwioGaClientId(document.cookie);
-        if (clientId)
-            attribution.ga_client_id = clientId;
-    }
+    const marketing = window.hwioConsent?.allows('marketing') === true;
+    const statistics = window.hwioConsent?.allows('statistics') === true;
+    const canEnrich = enrich && marketing;
+    const attribution = hwioSubmitAttribution({
+        enrich,
+        marketing,
+        statistics,
+        stored: canEnrich ? hwioGetAttribution() : undefined,
+        page: marketing ? hwioGetPageAttribution() : undefined,
+        gaClientId: enrich && statistics ? hwioGaClientId(document.cookie) : undefined,
+    });
     const payload = hwioBuildSubmitPayload({
         formId,
         locale,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hubpav/hwio-web-runtime",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Framework-free browser runtime for the HARDWARIO websites: consent (Consent Mode v2 + GTM), HubSpot forms with Turnstile, attribution, theme, CTA tracking and small behaviours. View-transition safe.",
   "license": "MIT",
   "type": "module",