@mj-biz-apps/forms-ng 0.0.0 → 0.2.0

package/dist/lib/home/home-aggregations.js

@@ -0,0 +1,64 @@
+/** Builds a fast id→name map from the categories result. */
+export function categoryNameMap(categories) {
+    const map = new Map();
+    for (const c of categories) {
+        map.set(c.ID, c.Name);
+    }
+    return map;
+}
+/** Counts responses per form id. */
+export function responseCountMap(responses) {
+    const map = new Map();
+    for (const r of responses) {
+        map.set(r.FormID, (map.get(r.FormID) ?? 0) + 1);
+    }
+    return map;
+}
+/** Coerces a RunView date cell (string or Date) into a Date, or null. */
+export function toDate(value) {
+    if (value == null) {
+        return null;
+    }
+    const d = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+/**
+ * Folds the three simple result sets into display rows, newest first.
+ */
+export function buildFormRows(forms, categories, responses) {
+    const catName = categoryNameMap(categories);
+    const counts = responseCountMap(responses);
+    const rows = forms.map((f) => ({
+        id: f.ID,
+        name: f.Name,
+        status: f.Status,
+        categoryName: f.CategoryID ? (catName.get(f.CategoryID) ?? null) : null,
+        updatedAt: toDate(f.__mj_UpdatedAt),
+        responseCount: counts.get(f.ID) ?? 0,
+    }));
+    return sortByUpdatedDesc(rows);
+}
+/** Newest-updated first; rows without a date sort last, then by name. */
+export function sortByUpdatedDesc(rows) {
+    return [...rows].sort((a, b) => {
+        const at = a.updatedAt?.getTime() ?? 0;
+        const bt = b.updatedAt?.getTime() ?? 0;
+        if (bt !== at) {
+            return bt - at;
+        }
+        return a.name.localeCompare(b.name);
+    });
+}
+/**
+ * Extracts the `FormID` output parameter produced by the authoring/template
+ * actions. Both actions set an output param named `FormID`.
+ */
+export function readFormIdFromParams(params) {
+    if (!params) {
+        return null;
+    }
+    const hit = params.find((p) => p.Name === 'FormID' && (p.Type === 'Output' || p.Type === 'Both'));
+    const value = hit?.Value;
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
+//# sourceMappingURL=home-aggregations.js.map

package/dist/lib/home/home-aggregations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-aggregations.js","sourceRoot":"","sources":["../../../src/lib/home/home-aggregations.ts"],"names":[],"mappings":"AAWA,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAC7B,UAA+C;IAE/C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,gBAAgB,CAC9B,SAA8C;IAE9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,MAAM,CAAC,KAAuC;IAC5D,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAkC,EAClC,UAA+C,EAC/C,SAA8C;IAE9C,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAE3C,MAAM,IAAI,GAAqB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/C,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QACnC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC;KACrC,CAAC,CAAC,CAAC;IAEJ,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAA0C;IAE1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CACzE,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/lib/home/home-models.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Read-models for the Forms home/studio surface (the first-class Explorer
+ * "Forms" tab — FORMS_BUILD_PLAN §3.2).
+ *
+ * These are deliberately decoupled from the generated `mjBizAppsForms*` entity
+ * types: the home grid is read-only and loaded via `RunView` with
+ * `ResultType: 'simple'`, so a small hand-written shape keeps this work
+ * independent of CodeGen output while staying strongly typed (no `any`).
+ */
+/** Entity names (PHASE1_DECOMPOSITION entity-name table). */
+export declare const HOME_ENTITY: {
+    readonly forms: "MJ_BizApps_Forms: Forms";
+    readonly categories: "MJ_BizApps_Forms: Form Categories";
+    readonly responses: "MJ_BizApps_Forms: Form Responses";
+    readonly actions: "MJ: Actions";
+};
+/** Action names (registered by WP-C; see packages/Actions custom/authoring + templates). */
+export declare const HOME_ACTION: {
+    readonly generateFromBrief: "Forms: Generate Form From Brief";
+    readonly createFromTemplate: "Forms: Create Form From Template";
+};
+/** A single row in the Forms home grid. */
+export interface FormSummaryRow {
+    id: string;
+    name: string;
+    status: string;
+    categoryName: string | null;
+    updatedAt: Date | null;
+    responseCount: number;
+}
+/** Raw `Forms` columns pulled by the simple RunView (subset we display). */
+export interface FormSimpleRecord {
+    ID: string;
+    Name: string;
+    Status: string;
+    CategoryID: string | null;
+    __mj_UpdatedAt: Date | string | null;
+}
+/** Raw `Form Categories` columns for name resolution. */
+export interface FormCategorySimpleRecord {
+    ID: string;
+    Name: string;
+}
+/** Raw `Form Responses` columns for per-form counts. */
+export interface FormResponseSimpleRecord {
+    FormID: string;
+}
+/** A starter template the user can scaffold from. */
+export interface StarterTemplateChoice {
+    key: string;
+    label: string;
+    icon: string;
+}
+/**
+ * Curated starter gallery shown in the "From template" picker. Keys MUST match
+ * the keys the `Forms: Create Form From Template` action knows (WP-C
+ * starter-templates.ts: contact, rsvp, nps, lead-capture, application).
+ */
+export declare const STARTER_TEMPLATES: readonly StarterTemplateChoice[];
+//# sourceMappingURL=home-models.d.ts.map

package/dist/lib/home/home-models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-models.d.ts","sourceRoot":"","sources":["../../../src/lib/home/home-models.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,eAAO,MAAM,WAAW;;;;;CAKd,CAAC;AAEX,4FAA4F;AAC5F,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wDAAwD;AACxD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,qBAAqB,EAMpD,CAAC"}

package/dist/lib/home/home-models.js

@@ -0,0 +1,34 @@
+/**
+ * Read-models for the Forms home/studio surface (the first-class Explorer
+ * "Forms" tab — FORMS_BUILD_PLAN §3.2).
+ *
+ * These are deliberately decoupled from the generated `mjBizAppsForms*` entity
+ * types: the home grid is read-only and loaded via `RunView` with
+ * `ResultType: 'simple'`, so a small hand-written shape keeps this work
+ * independent of CodeGen output while staying strongly typed (no `any`).
+ */
+/** Entity names (PHASE1_DECOMPOSITION entity-name table). */
+export const HOME_ENTITY = {
+    forms: 'MJ_BizApps_Forms: Forms',
+    categories: 'MJ_BizApps_Forms: Form Categories',
+    responses: 'MJ_BizApps_Forms: Form Responses',
+    actions: 'MJ: Actions',
+};
+/** Action names (registered by WP-C; see packages/Actions custom/authoring + templates). */
+export const HOME_ACTION = {
+    generateFromBrief: 'Forms: Generate Form From Brief',
+    createFromTemplate: 'Forms: Create Form From Template',
+};
+/**
+ * Curated starter gallery shown in the "From template" picker. Keys MUST match
+ * the keys the `Forms: Create Form From Template` action knows (WP-C
+ * starter-templates.ts: contact, rsvp, nps, lead-capture, application).
+ */
+export const STARTER_TEMPLATES = [
+    { key: 'contact', label: 'Contact form', icon: 'fa-solid fa-envelope' },
+    { key: 'rsvp', label: 'Event RSVP', icon: 'fa-solid fa-calendar-check' },
+    { key: 'nps', label: 'NPS / feedback', icon: 'fa-solid fa-gauge-high' },
+    { key: 'lead-capture', label: 'Lead capture', icon: 'fa-solid fa-magnet' },
+    { key: 'application', label: 'Application', icon: 'fa-solid fa-file-signature' },
+];
+//# sourceMappingURL=home-models.js.map

package/dist/lib/home/home-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-models.js","sourceRoot":"","sources":["../../../src/lib/home/home-models.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,yBAAyB;IAChC,UAAU,EAAE,mCAAmC;IAC/C,SAAS,EAAE,kCAAkC;IAC7C,OAAO,EAAE,aAAa;CACd,CAAC;AAEX,4FAA4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,iBAAiB,EAAE,iCAAiC;IACpD,kBAAkB,EAAE,kCAAkC;CAC9C,CAAC;AAuCX;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IACjE,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,sBAAsB,EAAE;IACvE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACxE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACvE,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,oBAAoB,EAAE;IAC1E,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACxE,CAAC"}

package/dist/lib/home/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Forms home/studio surface public barrel.
+ *
+ * Importing this barrel triggers the
+ * `@RegisterClass(BaseDashboard, 'FormsHomeDashboard')` decorator on the
+ * dashboard component, making it resolvable by the MJ ClassFactory from the
+ * `MJ: Dashboards` metadata record's DriverClass.
+ */
+export * from './home-models';
+export * from './home-aggregations';
+export * from './forms-home.service';
+export * from './forms-home-dashboard.component';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/home/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/home/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC"}

package/dist/lib/home/index.js

@@ -0,0 +1,13 @@
+/**
+ * Forms home/studio surface public barrel.
+ *
+ * Importing this barrel triggers the
+ * `@RegisterClass(BaseDashboard, 'FormsHomeDashboard')` decorator on the
+ * dashboard component, making it resolvable by the MJ ClassFactory from the
+ * `MJ: Dashboards` metadata record's DriverClass.
+ */
+export * from './home-models';
+export * from './home-aggregations';
+export * from './forms-home.service';
+export * from './forms-home-dashboard.component';
+//# sourceMappingURL=index.js.map

package/dist/lib/home/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/home/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kCAAkC,CAAC"}

package/dist/lib/widget/api/form-upload.service.d.ts

@@ -0,0 +1,41 @@
+import * as i0 from "@angular/core";
+/** Metadata the server returns for a successfully-stored upload. */
+export interface UploadedFile {
+    fileId: string;
+    name: string;
+    size: number;
+    contentType: string;
+}
+/** Progress callback: fraction 0–1 of bytes sent, or `null` when indeterminate. */
+export type UploadProgress = (fraction: number | null) => void;
+/**
+ * Build the multipart body for an upload. Pure + framework-free so the field wiring
+ * (which the server matches on) is unit-testable. Field names mirror the WP-B seam:
+ * `file`, `distributionSlug`, `questionId`.
+ */
+export declare function buildUploadFormData(file: File, distributionSlug: string, questionId: string): FormData;
+/**
+ * Parse the raw `POST /forms/upload` JSON response into an {@link UploadedFile},
+ * throwing a respondent-friendly error when the shape is wrong. Pure + testable.
+ */
+export declare function parseUploadResponse(raw: unknown): UploadedFile;
+export declare class FormUploadService {
+    private readonly config;
+    /** True when the widget has an endpoint + token to upload with. */
+    get canUpload(): boolean;
+    /**
+     * Upload one file for a FileUpload question. Resolves with the stored file's
+     * metadata (store `fileId` as the answer) or rejects with a friendly Error the
+     * caller can surface inline for retry.
+     */
+    upload(file: File, distributionSlug: string, questionId: string, onProgress?: UploadProgress): Promise<UploadedFile>;
+    /** The resolved upload endpoint (explicit config wins; else derived from GraphQL URL). */
+    private endpoint;
+    /** XHR POST with upload-progress + typed JSON parsing. */
+    private send;
+    /** Read the XHR body whether it arrived as parsed JSON or a raw string. */
+    private readBody;
+    static ɵfac: i0.ɵɵFactoryDeclaration<FormUploadService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<FormUploadService>;
+}
+//# sourceMappingURL=form-upload.service.d.ts.map

package/dist/lib/widget/api/form-upload.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-upload.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/widget/api/form-upload.service.ts"],"names":[],"mappings":";AAiBA,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;AAE/D;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,GACjB,QAAQ,CAMV;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CAe9D;AAED,qBACa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD,mEAAmE;IACnE,IAAW,SAAS,IAAI,OAAO,CAE9B;IAED;;;;OAIG;IACI,MAAM,CACX,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,MAAM,EACxB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,cAAc,GAC1B,OAAO,CAAC,YAAY,CAAC;IASxB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAIhB,0DAA0D;IAC1D,OAAO,CAAC,IAAI;IAgCZ,2EAA2E;IAC3E,OAAO,CAAC,QAAQ;yCAlEL,iBAAiB;6CAAjB,iBAAiB;CAgF7B"}

package/dist/lib/widget/api/form-upload.service.js

@@ -0,0 +1,124 @@
+/**
+ * Anonymous file-upload transport for FileUpload questions.
+ *
+ * The widget cannot use the GraphQL transport for binary uploads, so it POSTs a
+ * `multipart/form-data` body to MJAPI's `POST /forms/upload` route (seam with WP-B),
+ * authenticated by the SAME anonymous magic-link bearer token the GraphQL transport
+ * uses ({@link FormsApiConfig.token}). The server stores the file as an `MJ: Files`
+ * record scoped to the distribution and returns its `fileId`, which the widget stores
+ * as the question's answer value (mapped to `FormResponseAnswer.FileID` at submit).
+ *
+ * `XMLHttpRequest` is used rather than `fetch` solely because it exposes upload
+ * progress events, which the respondent-facing UI needs for a real progress bar.
+ */
+import { Injectable, inject } from '@angular/core';
+import { FORMS_API_CONFIG, deriveUploadUrl } from './forms-api.config';
+import * as i0 from "@angular/core";
+/**
+ * Build the multipart body for an upload. Pure + framework-free so the field wiring
+ * (which the server matches on) is unit-testable. Field names mirror the WP-B seam:
+ * `file`, `distributionSlug`, `questionId`.
+ */
+export function buildUploadFormData(file, distributionSlug, questionId) {
+    const body = new FormData();
+    body.append('file', file, file.name);
+    body.append('distributionSlug', distributionSlug);
+    body.append('questionId', questionId);
+    return body;
+}
+/**
+ * Parse the raw `POST /forms/upload` JSON response into an {@link UploadedFile},
+ * throwing a respondent-friendly error when the shape is wrong. Pure + testable.
+ */
+export function parseUploadResponse(raw) {
+    if (typeof raw !== 'object' || raw === null) {
+        throw new Error('Upload failed: unexpected server response.');
+    }
+    const obj = raw;
+    const fileId = obj['fileId'];
+    if (typeof fileId !== 'string' || fileId.length === 0) {
+        throw new Error('Upload failed: no file id returned.');
+    }
+    return {
+        fileId,
+        name: typeof obj['name'] === 'string' ? obj['name'] : '',
+        size: typeof obj['size'] === 'number' ? obj['size'] : 0,
+        contentType: typeof obj['contentType'] === 'string' ? obj['contentType'] : '',
+    };
+}
+export class FormUploadService {
+    config = inject(FORMS_API_CONFIG);
+    /** True when the widget has an endpoint + token to upload with. */
+    get canUpload() {
+        return !!this.endpoint() && !!this.config.token;
+    }
+    /**
+     * Upload one file for a FileUpload question. Resolves with the stored file's
+     * metadata (store `fileId` as the answer) or rejects with a friendly Error the
+     * caller can surface inline for retry.
+     */
+    upload(file, distributionSlug, questionId, onProgress) {
+        const url = this.endpoint();
+        if (!url) {
+            return Promise.reject(new Error('Uploads are not available for this form.'));
+        }
+        const body = buildUploadFormData(file, distributionSlug, questionId);
+        return this.send(url, body, onProgress);
+    }
+    /** The resolved upload endpoint (explicit config wins; else derived from GraphQL URL). */
+    endpoint() {
+        return this.config.uploadUrl || deriveUploadUrl(this.config.graphqlUrl);
+    }
+    /** XHR POST with upload-progress + typed JSON parsing. */
+    send(url, body, onProgress) {
+        return new Promise((resolve, reject) => {
+            const xhr = new XMLHttpRequest();
+            xhr.open('POST', url);
+            if (this.config.token) {
+                xhr.setRequestHeader('Authorization', `Bearer ${this.config.token}`);
+            }
+            xhr.responseType = 'json';
+            if (xhr.upload && onProgress) {
+                xhr.upload.onprogress = (e) => onProgress(e.lengthComputable && e.total > 0 ? e.loaded / e.total : null);
+            }
+            xhr.onload = () => {
+                if (xhr.status >= 200 && xhr.status < 300) {
+                    try {
+                        resolve(parseUploadResponse(this.readBody(xhr)));
+                    }
+                    catch (err) {
+                        reject(err instanceof Error ? err : new Error('Upload failed.'));
+                    }
+                }
+                else {
+                    reject(new Error(`Upload failed (HTTP ${xhr.status}). Please try again.`));
+                }
+            };
+            xhr.onerror = () => reject(new Error('Upload failed. Check your connection and try again.'));
+            xhr.onabort = () => reject(new Error('Upload cancelled.'));
+            xhr.send(body);
+        });
+    }
+    /** Read the XHR body whether it arrived as parsed JSON or a raw string. */
+    readBody(xhr) {
+        if (xhr.response && typeof xhr.response === 'object') {
+            return xhr.response;
+        }
+        const text = typeof xhr.responseText === 'string' ? xhr.responseText : '';
+        if (!text) {
+            return null;
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new Error('Upload failed: could not read server response.');
+        }
+    }
+    static ɵfac = function FormUploadService_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || FormUploadService)(); };
+    static ɵprov = /*@__PURE__*/ i0.ɵɵdefineInjectable({ token: FormUploadService, factory: FormUploadService.ɵfac });
+}
+(() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassMetadata(FormUploadService, [{
+        type: Injectable
+    }], null, null); })();
+//# sourceMappingURL=form-upload.service.js.map

package/dist/lib/widget/api/form-upload.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-upload.service.js","sourceRoot":"","sources":["../../../../src/lib/widget/api/form-upload.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;;AAavE;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAU,EACV,gBAAwB,EACxB,UAAkB;IAElB,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO;QACL,MAAM;QACN,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QACxD,IAAI,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,WAAW,EAAE,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;KAC9E,CAAC;AACJ,CAAC;AAGD,MAAM,OAAO,iBAAiB;IACX,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEnD,mEAAmE;IACnE,IAAW,SAAS;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACI,MAAM,CACX,IAAU,EACV,gBAAwB,EACxB,UAAkB,EAClB,UAA2B;QAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,0FAA0F;IAClF,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED,0DAA0D;IAClD,IAAI,CAAC,GAAW,EAAE,IAAc,EAAE,UAA2B;QACnE,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACtB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,GAAG,CAAC,gBAAgB,CAAC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC;YAE1B,IAAI,GAAG,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAgB,EAAQ,EAAE,CACjD,UAAU,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC;YAED,GAAG,CAAC,MAAM,GAAG,GAAS,EAAE;gBACtB,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBAC1C,IAAI,CAAC;wBACH,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACnD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;oBACnE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,MAAM,sBAAsB,CAAC,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC,CAAC;YACF,GAAG,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;YACnG,GAAG,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAEjE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IACnE,QAAQ,CAAC,GAAmB;QAClC,IAAI,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;2GA/EU,iBAAiB;gEAAjB,iBAAiB,WAAjB,iBAAiB;;iFAAjB,iBAAiB;cAD7B,UAAU"}

package/dist/lib/widget/api/forms-api.config.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Connection config for the real GraphQL transport.
+ *
+ * The widget is an embeddable, anonymous custom element: it talks to the MJAPI
+ * GraphQL endpoint directly over `fetch`, authenticated by an anonymous magic-link
+ * bearer token (the per-form public-link token), NOT by an Explorer session. These
+ * two values come from the `<mj-form>` element attributes (`api-url`, `token`).
+ */
+import { InjectionToken } from '@angular/core';
+/** Resolved connection settings for {@link FormsGraphQLApiService}. */
+export interface FormsApiConfig {
+    /** Absolute URL of the MJAPI GraphQL endpoint, e.g. `https://api.example.com/graphql`. */
+    graphqlUrl: string;
+    /**
+     * Anonymous magic-link bearer token carrying the `mj_scopes` for this form. Sent as
+     * `Authorization: Bearer <token>`. Optional only so the widget can render a preview
+     * with no live submit; submission requires it.
+     */
+    token?: string;
+    /**
+     * Absolute URL of the multipart file-upload endpoint (`POST /forms/upload`). Optional:
+     * when omitted it is derived from {@link graphqlUrl} by {@link deriveUploadUrl}, so a
+     * host that only supplies `api-url` still gets working uploads. Sent the same anonymous
+     * bearer {@link token}.
+     */
+    uploadUrl?: string;
+    /**
+     * PUBLIC Cloudflare Turnstile site key (DG-4). Global — one Cloudflare widget across
+     * all forms, NOT per-form — and safe to expose client-side. Only used when a form's
+     * `settings.captchaRequired` is on: the widget renders a challenge against this key and
+     * sends the resulting token as `turnstileToken`. When captcha-required forms are served
+     * with no site key, the widget shows a config-gap message instead of failing silently.
+     * Comes from the `<mj-form>` `turnstile-site-key` attribute.
+     */
+    turnstileSiteKey?: string;
+    /**
+     * Optional override for the Cloudflare Turnstile script URL. Defaults to
+     * {@link DEFAULT_TURNSTILE_SCRIPT_URL}; overridable only for tests/self-hosting.
+     */
+    turnstileScriptUrl: string;
+}
+/** Build a {@link FormsApiConfig}, filling in derived defaults (script URL). */
+export declare function normalizeApiConfig(partial: Omit<FormsApiConfig, 'turnstileScriptUrl'> & {
+    turnstileScriptUrl?: string;
+}): FormsApiConfig;
+/**
+ * Derive the file-upload endpoint from the GraphQL endpoint. MJAPI serves the widget's
+ * anonymous upload route at `/forms/upload` on the same origin as `/graphql`, so we swap
+ * the trailing `/graphql` path segment for `/forms/upload`. Falls back to appending the
+ * path when the URL does not end in `/graphql`.
+ */
+export declare function deriveUploadUrl(graphqlUrl: string): string;
+/** DI token carrying the {@link FormsApiConfig} into the GraphQL transport. */
+export declare const FORMS_API_CONFIG: InjectionToken<FormsApiConfig>;
+//# sourceMappingURL=forms-api.config.d.ts.map

package/dist/lib/widget/api/forms-api.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-api.config.d.ts","sourceRoot":"","sources":["../../../../src/lib/widget/api/forms-api.config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAI/C,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,oBAAoB,CAAC,GAAG;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF,cAAc,CAKhB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAY1D;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,gCAAyD,CAAC"}

package/dist/lib/widget/api/forms-api.config.js

@@ -0,0 +1,40 @@
+/**
+ * Connection config for the real GraphQL transport.
+ *
+ * The widget is an embeddable, anonymous custom element: it talks to the MJAPI
+ * GraphQL endpoint directly over `fetch`, authenticated by an anonymous magic-link
+ * bearer token (the per-form public-link token), NOT by an Explorer session. These
+ * two values come from the `<mj-form>` element attributes (`api-url`, `token`).
+ */
+import { InjectionToken } from '@angular/core';
+import { DEFAULT_TURNSTILE_SCRIPT_URL } from '../core/turnstile-loader';
+/** Build a {@link FormsApiConfig}, filling in derived defaults (script URL). */
+export function normalizeApiConfig(partial) {
+    return {
+        ...partial,
+        turnstileScriptUrl: partial.turnstileScriptUrl?.trim() || DEFAULT_TURNSTILE_SCRIPT_URL,
+    };
+}
+/**
+ * Derive the file-upload endpoint from the GraphQL endpoint. MJAPI serves the widget's
+ * anonymous upload route at `/forms/upload` on the same origin as `/graphql`, so we swap
+ * the trailing `/graphql` path segment for `/forms/upload`. Falls back to appending the
+ * path when the URL does not end in `/graphql`.
+ */
+export function deriveUploadUrl(graphqlUrl) {
+    if (!graphqlUrl) {
+        return '';
+    }
+    try {
+        const url = new URL(graphqlUrl);
+        url.pathname = url.pathname.replace(/\/graphql\/?$/i, '') + '/forms/upload';
+        return url.toString();
+    }
+    catch {
+        // Not an absolute URL — fall back to a plain string swap.
+        return graphqlUrl.replace(/\/graphql\/?$/i, '') + '/forms/upload';
+    }
+}
+/** DI token carrying the {@link FormsApiConfig} into the GraphQL transport. */
+export const FORMS_API_CONFIG = new InjectionToken('FORMS_API_CONFIG');
+//# sourceMappingURL=forms-api.config.js.map

package/dist/lib/widget/api/forms-api.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-api.config.js","sourceRoot":"","sources":["../../../../src/lib/widget/api/forms-api.config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAmCxE,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAChC,OAAqF;IAErF,OAAO;QACL,GAAG,OAAO;QACV,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,4BAA4B;KACvF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,OAAO,UAAU,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,GAAG,eAAe,CAAC;IACpE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,cAAc,CAAiB,kBAAkB,CAAC,CAAC"}

package/dist/lib/widget/api/forms-api.graphql.service.d.ts

@@ -0,0 +1,20 @@
+import type { PublishedFormDefinition, FormSubmissionInput, FormSubmissionResult } from '@mj-biz-apps/forms-entities';
+import type { IFormsApiService } from './forms-api.interface';
+import * as i0 from "@angular/core";
+export declare class FormsGraphQLApiService implements IFormsApiService {
+    private readonly config;
+    /**
+     * Per-widget-instance anonymous session correlator, sent as the `x-session-id` header MJ
+     * core reads into `UserPayload.sessionId` (and thence `FormResponse.AnonymousSessionID`).
+     * Best-effort telemetry ONLY — correctness (dedupe/upsert) rides the stable client
+     * response id in the payload, never this header — so a stripped header degrades gracefully.
+     */
+    private readonly sessionId;
+    loadPublishedForm(distributionSlug: string): Promise<PublishedFormDefinition | null>;
+    submitResponse(input: FormSubmissionInput, existingResponseId?: string): Promise<FormSubmissionResult>;
+    /** POST a GraphQL operation and unwrap its `data`, throwing on transport/GraphQL errors. */
+    private execute;
+    static ɵfac: i0.ɵɵFactoryDeclaration<FormsGraphQLApiService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<FormsGraphQLApiService>;
+}
+//# sourceMappingURL=forms-api.graphql.service.d.ts.map

package/dist/lib/widget/api/forms-api.graphql.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-api.graphql.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/widget/api/forms-api.graphql.service.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;;AAmD9D,qBACa,sBAAuB,YAAW,gBAAgB;IAC7D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAEnD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;IAE3C,iBAAiB,CAC5B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAY7B,cAAc,CACzB,KAAK,EAAE,mBAAmB,EAC1B,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,oBAAoB,CAAC;IAOhC,4FAA4F;YAC9E,OAAO;yCApCV,sBAAsB;6CAAtB,sBAAsB;CAkElC"}

package/dist/lib/widget/api/forms-api.graphql.service.js

@@ -0,0 +1,96 @@
+/**
+ * Real S1 transport — issues the `PublishedForm` / `SubmitFormResponse` GraphQL
+ * operations against the MJAPI endpoint over `fetch`.
+ *
+ * Deliberately uses plain `fetch` rather than `@memberjunction/graphql-dataprovider`:
+ * the widget is a tiny, anonymous, embeddable custom element with no Explorer shell
+ * and no global MJ provider to lean on — it only needs an endpoint URL and an
+ * anonymous bearer token (both supplied as element attributes). This also keeps the
+ * transport strongly typed end-to-end instead of routing through `ExecuteGQL`'s
+ * untyped result.
+ */
+import { Injectable, inject } from '@angular/core';
+import { FORMS_API_CONFIG } from './forms-api.config';
+import { generateClientResponseId } from '../core/client-id';
+import { toInputType } from './submission-mapping';
+import * as i0 from "@angular/core";
+const PUBLISHED_FORM_QUERY = `
+  query PublishedForm($distributionSlug: String!) {
+    PublishedForm(distributionSlug: $distributionSlug) {
+      definitionJSON
+    }
+  }
+`;
+const SUBMIT_RESPONSE_MUTATION = `
+  mutation SubmitFormResponse($input: FormSubmissionInputType!) {
+    SubmitFormResponse(input: $input) {
+      success
+      responseId
+      status
+      confirmationMessage
+      redirectUrl
+      errors { questionId message }
+    }
+  }
+`;
+export class FormsGraphQLApiService {
+    config = inject(FORMS_API_CONFIG);
+    /**
+     * Per-widget-instance anonymous session correlator, sent as the `x-session-id` header MJ
+     * core reads into `UserPayload.sessionId` (and thence `FormResponse.AnonymousSessionID`).
+     * Best-effort telemetry ONLY — correctness (dedupe/upsert) rides the stable client
+     * response id in the payload, never this header — so a stripped header degrades gracefully.
+     */
+    sessionId = generateClientResponseId();
+    async loadPublishedForm(distributionSlug) {
+        const data = await this.execute(PUBLISHED_FORM_QUERY, {
+            distributionSlug,
+        });
+        if (!data.PublishedForm) {
+            return null;
+        }
+        // The full nested pages/questions/options graph is delivered as a JSON string in
+        // `definitionJSON`; parse it into the contract's PublishedFormDefinition.
+        return JSON.parse(data.PublishedForm.definitionJSON);
+    }
+    async submitResponse(input, existingResponseId) {
+        const data = await this.execute(SUBMIT_RESPONSE_MUTATION, {
+            input: toInputType(input, existingResponseId),
+        });
+        return data.SubmitFormResponse;
+    }
+    /** POST a GraphQL operation and unwrap its `data`, throwing on transport/GraphQL errors. */
+    async execute(query, variables) {
+        const headers = {
+            'Content-Type': 'application/json',
+            // Anonymous session correlator (see this.sessionId). Best-effort — captured server-side
+            // into AnonymousSessionID when present; never the idempotency key.
+            'x-session-id': this.sessionId,
+        };
+        if (this.config.token) {
+            headers['Authorization'] = `Bearer ${this.config.token}`;
+        }
+        const response = await fetch(this.config.graphqlUrl, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ query, variables }),
+        });
+        if (!response.ok) {
+            throw new Error(`Forms API request failed: HTTP ${response.status}`);
+        }
+        const envelope = (await response.json());
+        if (envelope.errors && envelope.errors.length > 0) {
+            throw new Error(envelope.errors.map((e) => e.message).join('; '));
+        }
+        if (!envelope.data) {
+            throw new Error('Forms API returned no data');
+        }
+        return envelope.data;
+    }
+    static ɵfac = function FormsGraphQLApiService_Factory(__ngFactoryType__) { return new (__ngFactoryType__ || FormsGraphQLApiService)(); };
+    static ɵprov = /*@__PURE__*/ i0.ɵɵdefineInjectable({ token: FormsGraphQLApiService, factory: FormsGraphQLApiService.ɵfac });
+}
+(() => { (typeof ngDevMode === "undefined" || ngDevMode) && i0.ɵsetClassMetadata(FormsGraphQLApiService, [{
+        type: Injectable
+    }], null, null); })();
+//# sourceMappingURL=forms-api.graphql.service.js.map

package/dist/lib/widget/api/forms-api.graphql.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-api.graphql.service.js","sourceRoot":"","sources":["../../../../src/lib/widget/api/forms-api.graphql.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAQnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;;AA2BnD,MAAM,oBAAoB,GAAG;;;;;;CAM5B,CAAC;AAEF,MAAM,wBAAwB,GAAG;;;;;;;;;;;CAWhC,CAAC;AAGF,MAAM,OAAO,sBAAsB;IAChB,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEnD;;;;;OAKG;IACc,SAAS,GAAG,wBAAwB,EAAE,CAAC;IAEjD,KAAK,CAAC,iBAAiB,CAC5B,gBAAwB;QAExB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,oBAAoB,EAAE;YAC5E,gBAAgB;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,iFAAiF;QACjF,0EAA0E;QAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc,CAA4B,CAAC;IAClF,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,KAA0B,EAC1B,kBAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB,wBAAwB,EAAE;YAChF,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,4FAA4F;IACpF,KAAK,CAAC,OAAO,CACnB,KAAa,EACb,SAAkC;QAElC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,wFAAwF;YACxF,mEAAmE;YACnE,cAAc,EAAE,IAAI,CAAC,SAAS;SAC/B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;QACnE,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;gHAjEU,sBAAsB;gEAAtB,sBAAsB,WAAtB,sBAAsB;;iFAAtB,sBAAsB;cADlC,UAAU"}