@aglyn/plugins-forms 1.0.0-beta.143

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,35 @@
+# @aglyn/plugins-forms
+
+The Forms feature plugin: both halves of a capability that has both.
+
+- **Canvas** — the `form` and `formField` elements, registered into
+  `FORMS_BUNDLE` and offered in the besigner's element picker.
+- **Console** — the Forms catalog and one form's own surface (declaration,
+  metrics, versions, promotion, design preview), contributed through the
+  `ConsoleExtension` registry and rendered by the shell's generic plugin
+  route at `/{orgSlug}/hosts/{host}/forms`.
+
+## Ids
+
+`componentId` is a bare string and is persisted in every screen document:
+`form` and `formField` never change. `pluginId` is persisted beside it and is
+`forms` — see `src/lib/constants/bundle-common.ts` for why that field is not
+cosmetic, and `tools/scripts/backfill-node-plugin-ids.mjs` for the script that
+keeps saved nodes agreeing with it.
+
+## What is NOT here
+
+The MODEL and the CONTRACT stay in core — `libs/aglyn/src/lib/app-utils/
+forms.ts` and `form-contract.ts`. `apps/tenant/app/api/forms/submit/route.ts`
+resolves a form at request time through `@aglyn/tenant-runtime`, which is
+tagged `scope:aglyn` and so may depend only on `scope:aglyn` and
+`scope:shared`; a plugin carries `aglyn:addons` alone, so no core lib can
+reach it. The submit route, the publish-time contract check and the besigner
+editor route are all on the core side of that line.
+
+Form SUBMISSIONS are read in the Inbox, which is `@aglyn/plugins-inbox`: this
+plugin owns what a form IS, and the inbox owns what it collected.
+
+## Running unit tests
+
+`nx test plugins-forms`.

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@aglyn/plugins-forms",
+  "version": "1.0.0-beta.143",
+  "license": "Apache-2.0",
+  "homepage": "https://aglyn.com",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aglyn/aglyn.git",
+    "directory": "libs/plugins/forms"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./*": {
+      "types": "./src/lib/*.d.ts",
+      "default": "./src/lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@aglyn/aglyn": "1.0.0-beta.143",
+    "@aglyn/shared-data-enums": "1.0.0-beta.143",
+    "@aglyn/shared-data-mdi": "1.0.0-beta.143",
+    "@aglyn/shared-ui-email-campaigns": "1.0.0-beta.143",
+    "@aglyn/shared-ui-jsx": "1.0.0-beta.143",
+    "@aglyn/shared-ui-jsx-forms": "1.0.0-beta.143",
+    "@aglyn/shared-ui-snackstack": "1.0.0-beta.143",
+    "@aglyn/shared-util-http": "1.0.0-beta.143",
+    "@aglyn/shared-util-timestamp": "1.0.0-beta.143",
+    "@aglyn/shared-util-tools": "1.0.0-beta.143",
+    "@aglyn/tenant-feature-instance": "1.0.0-beta.143",
+    "@swc/helpers": "0.5.23"
+  },
+  "peerDependencies": {
+    "@mui/material": "^9.3.1",
+    "@mui/x-data-grid": "^9.12.0",
+    "firebase": "^12.18.0",
+    "next": "16.3.3",
+    "react": "^19.2.8"
+  },
+  "sideEffects": false,
+  "types": "./src/index.d.ts",
+  "module": "./src/index.js",
+  "main": "./src/index.js"
+}

package/src/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export * from './lib/constants/bundle-common';
+export * from './lib/plugin';

package/src/index.js

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ export * from "./lib/constants/bundle-common.js";
+export * from "./lib/plugin.js";
+
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../libs/plugins/forms/src/index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nexport * from './lib/constants/bundle-common'\nexport * from './lib/plugin'\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,cAAc,mCAA+B;AAC7C,cAAc,kBAAc"}

package/src/lib/components/form-design-preview.component.d.ts

@@ -0,0 +1,68 @@
+import * as Aglyn from '@aglyn/aglyn';
+export interface FormDesignPreviewProps {
+    formId: string;
+    /** The form document's PUBLISHED `nodes` — what a visitor is served today. */
+    nodes: unknown;
+    /** Which field the document names as the marketing opt-in. */
+    consentFieldName?: string;
+    /** The document has not arrived yet, as against having no design. */
+    loading?: boolean;
+}
+/**
+ * Builds the standalone document the frame is given.
+ *
+ * Exported for the spec: the property that matters — that no author-supplied
+ * string can become markup — is a property of this string, and asserting it
+ * through a rendered component would be asserting it through React's escaping
+ * as well as this function's.
+ */
+export declare function buildFormPreviewDocument(options: {
+    fields: Aglyn.FormFieldDecl[];
+    consentFieldName?: string;
+}): string;
+/**
+ * THE FORM AS THE SUBMIT ROUTE WILL READ IT, DRAWN SAFELY.
+ *
+ * ## What is being previewed
+ *
+ * A form has two halves and they fail differently. The DESIGN — fonts,
+ * spacing, the theme the site draws it in — is previewed by
+ * `Route.FORM_PREVIEW`, which renders the stored nodes through
+ * `AglynNodeRenderer`, the same component tree the published page mounts. That
+ * is a whole-page surface and it stays where it is.
+ *
+ * This is the other half: the CONTRACT. `/api/forms/submit` never sees a
+ * pixel. It sees `FormData` keys, and every coupling it depends on — which
+ * field is the address a lead is created from, which field is the marketing
+ * opt-in — is resolved by NAME. So the question this frame answers is the one
+ * an author cannot answer by looking at the canvas: what names will arrive,
+ * and which of them carry meaning.
+ *
+ * The field list is NOT re-derived here. `formFieldDeclsFromNodes` is the same
+ * function the publish path calls to write the document's `fields` and the
+ * same one adoption uses, including its two rules that are easy to get wrong
+ * — an unnamed field is dropped, and a duplicate name keeps its first
+ * occurrence — so this frame drops and keeps exactly what a real submission
+ * does. A second implementation would be a preview of something else.
+ *
+ * ## Sandboxed, because every string in it is tenant-authored
+ *
+ * Labels, option text and field names are typed by a site's own editors, or
+ * arrive on a marketplace template. They are escaped on the way into the
+ * document AND the document is rendered into an iframe with an EMPTY `sandbox`
+ * attribute — the maximally restrictive form: no scripts, no forms, no popups,
+ * no top-level navigation and, critically, no same-origin. The frame gets an
+ * opaque origin, so nothing inside it can reach the console's cookies, storage
+ * or DOM. `srcDoc` rather than a URL keeps the markup from ever being served
+ * from the console's own origin, where the sandbox attribute would be the only
+ * thing between tenant content and a live session.
+ *
+ * The escaping and the sandbox are not redundant: the escaping is what keeps
+ * the preview a preview of the author's text rather than of their markup, and
+ * the sandbox is what makes being wrong about the escaping survivable.
+ */
+export declare function FormDesignPreview(props: FormDesignPreviewProps): import("react").JSX.Element;
+export declare namespace FormDesignPreview {
+    var displayName: string;
+}
+export default FormDesignPreview;

package/src/lib/components/form-design-preview.component.js

@@ -0,0 +1,238 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ 'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import * as Aglyn from "@aglyn/aglyn";
+// Every character that could close an attribute or open a tag, escaped by the
+// one implementation rather than a fifth copy of it. Subpath, not the library
+// index — see the note there.
+import { escapeHtml } from "@aglyn/shared-util-tools/escape-html";
+import { Box, Stack, Typography } from "@mui/material";
+import { useMemo } from "react";
+/**
+ * The `form` node inside a published design.
+ *
+ * A form document's tree holds exactly one, because the document IS that form
+ * — but the tree is a flat map, so the node has to be found rather than
+ * assumed to be the root.
+ */ function findFormNodeId(nodes) {
+    return Object.keys(nodes != null ? nodes : {}).find((id)=>{
+        var _nodes_id;
+        return (nodes == null ? void 0 : (_nodes_id = nodes[id]) == null ? void 0 : _nodes_id.componentId) === 'form';
+    });
+}
+/**
+ * One field, as the browser will submit it.
+ *
+ * The `name` attribute is the whole point: it is the key `/api/forms/submit`
+ * reads out of the `FormData`, and it is the coupling `checkFormContract`
+ * guards. Rendering the control WITH its name is what makes this a preview of
+ * the contract rather than a picture of some inputs.
+ */ function renderField(field, consentFieldName) {
+    var _field_options;
+    const name = escapeHtml(field.fieldName);
+    const label = escapeHtml(field.label || field.fieldName);
+    const required = field.required ? ' required' : '';
+    const isConsent = Boolean(consentFieldName) && field.fieldName === consentFieldName;
+    const badge = isConsent ? '<span class="badge">marketing consent</span>' : field.required ? '<span class="badge">required</span>' : '';
+    const options = ((_field_options = field.options) != null ? _field_options : []).map((option)=>escapeHtml(option));
+    let control;
+    switch(field.fieldType){
+        case 'textarea':
+            control = `<textarea name="${name}" rows="3"${required}></textarea>`;
+            break;
+        case 'select':
+            control = `<select name="${name}"${required}>${options.map((option)=>`<option value="${option}">${option}</option>`).join('')}</select>`;
+            break;
+        case 'radio':
+            control = `<div class="choices">${options.map((option)=>`<label class="choice"><input type="radio" name="${name}" value="${option}"${required}> ${option}</label>`).join('')}</div>`;
+            break;
+        case 'checkbox':
+            control = `<label class="choice"><input type="checkbox" name="${name}" value="on"${required}> ${label}</label>`;
+            break;
+        case 'rating':
+            // The runtime submits a number; a range says so without pretending to be
+            // the star control the site draws.
+            control = `<input type="range" name="${name}" min="1" max="5"${required}>`;
+            break;
+        case 'email':
+            control = `<input type="email" name="${name}"${required}>`;
+            break;
+        default:
+            control = `<input type="text" name="${name}"${required}>`;
+    }
+    return [
+        '<div class="field">',
+        `<div class="label">${label}${badge}</div>`,
+        control,
+        `<div class="key">name="${name}"</div>`,
+        '</div>'
+    ].join('');
+}
+/** The style block, kept out of the builder so the markup reads as markup. */ const PREVIEW_CSS = `
+  :root { color-scheme: light; }
+  body {
+    margin: 0; padding: 16px;
+    font: 14px/1.5 system-ui, -apple-system, "Segoe UI", sans-serif;
+    color: #1a1a1a; background: #ffffff;
+  }
+  form { display: grid; gap: 16px; max-width: 520px; }
+  .field { display: grid; gap: 4px; }
+  .label { font-weight: 600; display: flex; align-items: center; gap: 8px; }
+  .badge {
+    font-weight: 500; font-size: 11px; letter-spacing: .04em;
+    text-transform: uppercase; padding: 1px 6px; border-radius: 999px;
+    background: #eceff4; color: #55606e;
+  }
+  .key { font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+         font-size: 11px; color: #6b7280; }
+  input[type=text], input[type=email], textarea, select {
+    width: 100%; box-sizing: border-box; padding: 8px;
+    border: 1px solid #c8cdd4; border-radius: 6px; font: inherit;
+    background: #ffffff; color: inherit;
+  }
+  .choices { display: grid; gap: 4px; }
+  .choice { font-weight: 400; display: flex; align-items: center; gap: 6px; }
+  button {
+    justify-self: start; padding: 8px 16px; border-radius: 6px;
+    border: 1px solid #c8cdd4; background: #f4f6f8; font: inherit;
+  }
+  .none { color: #6b7280; }
+`;
+/**
+ * Builds the standalone document the frame is given.
+ *
+ * Exported for the spec: the property that matters — that no author-supplied
+ * string can become markup — is a property of this string, and asserting it
+ * through a rendered component would be asserting it through React's escaping
+ * as well as this function's.
+ */ export function buildFormPreviewDocument(options) {
+    const { fields, consentFieldName } = options;
+    const body = fields.length ? fields.map((field)=>renderField(field, consentFieldName)).join('') : '<p class="none">This design declares no named fields.</p>';
+    return [
+        '<!doctype html><html lang="en"><head><meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width,initial-scale=1">',
+        `<style>${PREVIEW_CSS}</style></head><body>`,
+        // `action` is deliberately absent and the frame is sandboxed, so this
+        // cannot post anywhere even if a reader hits Return in a text field.
+        `<form>${body}<button type="button">Submit</button></form>`,
+        '</body></html>'
+    ].join('');
+}
+/**
+ * THE FORM AS THE SUBMIT ROUTE WILL READ IT, DRAWN SAFELY.
+ *
+ * ## What is being previewed
+ *
+ * A form has two halves and they fail differently. The DESIGN — fonts,
+ * spacing, the theme the site draws it in — is previewed by
+ * `Route.FORM_PREVIEW`, which renders the stored nodes through
+ * `AglynNodeRenderer`, the same component tree the published page mounts. That
+ * is a whole-page surface and it stays where it is.
+ *
+ * This is the other half: the CONTRACT. `/api/forms/submit` never sees a
+ * pixel. It sees `FormData` keys, and every coupling it depends on — which
+ * field is the address a lead is created from, which field is the marketing
+ * opt-in — is resolved by NAME. So the question this frame answers is the one
+ * an author cannot answer by looking at the canvas: what names will arrive,
+ * and which of them carry meaning.
+ *
+ * The field list is NOT re-derived here. `formFieldDeclsFromNodes` is the same
+ * function the publish path calls to write the document's `fields` and the
+ * same one adoption uses, including its two rules that are easy to get wrong
+ * — an unnamed field is dropped, and a duplicate name keeps its first
+ * occurrence — so this frame drops and keeps exactly what a real submission
+ * does. A second implementation would be a preview of something else.
+ *
+ * ## Sandboxed, because every string in it is tenant-authored
+ *
+ * Labels, option text and field names are typed by a site's own editors, or
+ * arrive on a marketplace template. They are escaped on the way into the
+ * document AND the document is rendered into an iframe with an EMPTY `sandbox`
+ * attribute — the maximally restrictive form: no scripts, no forms, no popups,
+ * no top-level navigation and, critically, no same-origin. The frame gets an
+ * opaque origin, so nothing inside it can reach the console's cookies, storage
+ * or DOM. `srcDoc` rather than a URL keeps the markup from ever being served
+ * from the console's own origin, where the sandbox attribute would be the only
+ * thing between tenant content and a live session.
+ *
+ * The escaping and the sandbox are not redundant: the escaping is what keeps
+ * the preview a preview of the author's text rather than of their markup, and
+ * the sandbox is what makes being wrong about the escaping survivable.
+ */ export function FormDesignPreview(props) {
+    const { formId, nodes: rawNodes, consentFieldName, loading } = props;
+    const fields = useMemo(()=>{
+        const decoded = Aglyn.decodeStoredNodes(rawNodes);
+        if (!decoded || !Object.keys(decoded).length) return null;
+        const formNodeId = findFormNodeId(decoded);
+        if (!formNodeId) return null;
+        return Aglyn.formFieldDeclsFromNodes(decoded, formNodeId);
+    }, [
+        rawNodes
+    ]);
+    const previewDocument = useMemo(()=>fields ? buildFormPreviewDocument({
+            fields,
+            consentFieldName
+        }) : null, [
+        fields,
+        consentFieldName
+    ]);
+    if (!previewDocument) {
+        return /*#__PURE__*/ _jsx(Typography, {
+            variant: "body2",
+            color: "text.secondary",
+            children: loading ? 'Loading this form…' : 'Nothing published yet — open this form in the besigner, then ' + 'publish a version to see what it will collect.'
+        });
+    }
+    return /*#__PURE__*/ _jsxs(Stack, {
+        spacing: 1,
+        children: [
+            /*#__PURE__*/ _jsx(Box, {
+                component: "iframe",
+                title: `Preview of form ${formId}`,
+                /*
+         * EMPTY sandbox — every restriction on, nothing allowed back. The
+         * strings below are authored outside this console, so the document is
+         * rendered with no scripts, no form submission, no navigation and an
+         * opaque origin: it cannot reach the console's session, storage or DOM
+         * even though it is drawn inside the console.
+         */ sandbox: "",
+                referrerPolicy: "no-referrer",
+                srcDoc: previewDocument,
+                sx: {
+                    width: '100%',
+                    // Fixed, with the frame's own scrollbar. A sandbox with no scripts
+                    // is a frame that cannot measure or report its content height, and
+                    // an iframe cannot size to its content on its own.
+                    height: 420,
+                    border: 1,
+                    borderColor: 'divider',
+                    borderRadius: 1,
+                    bgcolor: 'common.white'
+                }
+            }),
+            /*#__PURE__*/ _jsx(Typography, {
+                variant: "caption",
+                color: "text.secondary",
+                children: 'These are the names a submission arrives under, read off the ' + 'published design by the same function that writes the form’s ' + 'declared fields. The site’s own styling is not applied here — ' + 'use Preview for that.'
+            })
+        ]
+    });
+}
+FormDesignPreview.displayName = 'FormDesignPreview';
+export default FormDesignPreview;
+
+//# sourceMappingURL=form-design-preview.component.js.map