The 3 KB widget

Strictly optional. The canonical Inkwell integration is a plain HTML form — the widget is progressive enhancement layered on top.

What it adds:

• Inline error rendering on schema-validation failures (no page reload).
• Page-render timestamp captured in a hidden field, feeding the timing signal.
• Optional Turnstile / hCaptcha challenge handler for the quarantine flow.

Install

Add one script tag to your page, after the form:

<script src="https://inkwell.philiprehberger.com/widget/v1.js"
        integrity="sha384-…" crossorigin="anonymous" defer></script>

Immutable versioned URLs (/widget/v1.0.0.js) ship alongside the latest (/widget/v1.js) — pin the version that matches your CSP. The SRI hash for each version is published at /widget/sri.json.

It works without the widget too

Every form submission path is canonically <form action="…">. The widget enhances the UX but never changes the contract — the server doesn't know or care whether the submission came through the widget or a vanilla form post.

Source

The widget lives at widget/ in the source repo and is built into the deployed site's /widget/ directory. ~3 KB gzipped.