Maintenance pass: tsup + vitest migration, CI alignment, multi-form bugfix

[botre]

Summary

Five commits in dependency order:

1. Migrate to tsup and vitest. Drops 8 dev deps (webpack, webpack-cli, ts-loader, jest, ts-jest, @types/jest, husky, pretty-quick) in favor of tsup + vitest + jsdom + @vitest/coverage-v8, mirroring @formspark/formson. jest-environment-jsdom was misclassified under dependencies and would have shipped to consumers — fixed. Bumps prettier 2.8 → 3.8 and typescript 4.9 → 5.9. Node engine constraint moves from >=10 (long EOL) to >=20. tsconfig switched to bundler-mode ES2020. npm audit reports 0 vulnerabilities.

2. Replace continuous-deployment.yml with check.yml + release.yml. Mirrors formson / use-formspark / localview. The previous single workflow only ran on push to master, so PRs were never checked. Action versions brought up to date (actions/checkout@v6, actions/setup-node@v6, phips28/gh-action-bump-version pinned to v11.0.7 instead of @master). npm publish --provenance enabled.

3. Expanded test coverage and README cleanup. Existing spec only covered the singleton guard. Added integration tests that drive the full URL-params → form-input injection path: standard UTM set, custom data-formtrack-params, no-data-formtrack opt-out, params absent from URL, and update-not-duplicate behavior. README: drop stale CI badge, fix "refers traffic" → "drives traffic".

4. Scope input lookup to the form, not the whole document — fixes a real bug. A multi-form integration test surfaced that appendOrUpdateInput called document.getElementById, so when two <form data-formtrack> elements were on the same page they fought over the same ID and only the first form ever got an injected input. Switched to formElement.elements.namedItem(name) (form-local lookup by submitted name). The id attribute is still written for any external consumer that queries it. Added 6 more tests pinning: multiple forms, whitespace/empty entries in data-formtrack-params, URLs with no matching params, empty-string param values being skipped, late-mounted forms picked up by the next poll cycle (using vi.useFakeTimers), and unregister() actually clearing the interval.

5. Preserve the previous UMD surface in the new bundles. The original webpack UMD build used libraryExport: "default" so window.Formtrack and require("@formspark/formtrack") were both the registerPoller function directly. Tsup's IIFE and CJS outputs default to a { default: fn, __esModule: true } namespace — silently breaking any consumer relying on the function surface. Re-exported registerPoller as the default of src/index.ts and added a per-format footer that flattens the namespace back to the function while keeping .default and __esModule for ESM/CJS interop:

   // IIFE
   Formtrack = Object.assign(Formtrack.default, Formtrack);
   // CJS
   module.exports = Object.assign(module.exports.default, module.exports);

   Also enabled minify: true, which (combined with the polyfill compressing well) drops the IIFE bundle from 12.79 KB to 5.23 KB.

Numbers

• Tests: 16/16 pass (was 5/5 before this PR)
• Coverage: 100% statements / branches / functions / lines
• Bundle output: ESM 1.03 KB, CJS 1.55 KB, IIFE 5.23 KB, plus .d.ts and .d.mts
• npm audit: 0 vulnerabilities
• Dev deps removed: 8 (webpack ecosystem + jest ecosystem + husky + pretty-quick)

End-to-end verification of the bundles

Built each format and loaded into a fresh JSDOM instance with ?utm_source=google&utm_campaign=spring&utm_medium=cpc, asserting both API shape and behavior. 13/13 assertions pass:

Bundle	Surface	Auto-registers	Function callable
IIFE (<script> from unpkg)	window.Formtrack is registerPoller	✅ inputs injected	✅
CJS (require())	returns registerPoller directly, with .default back-reference	✅	✅
ESM (import F from)	default export is registerPoller	✅	✅

Test plan

• npm test — 16/16 pass
• npx vitest run --coverage — 100% across all metrics
• npm run build — ESM + CJS + IIFE + DTS build cleanly, minified
• End-to-end JSDOM smoke test across all three bundles — 13/13
• npm audit — 0 vulnerabilities
• Confirm phips28/gh-action-bump-version@v11.0.7 finds the version-bump trigger in your typical commit conventions, otherwise auto-bump won't fire