{% comment %} The composer's Alpine component. Its own file for the reason templates/contacts/_filter_bar_script.html is: it is a hundred lines of JavaScript and the step it belongs to is already a page. It is included from compose.html's alpine_components block, which base.html renders before Alpine's own deferred script — the window in which a global x-data factory has to be defined for x-data to be able to call it, and the reason it is NOT included from the step partial htmx swaps in. It knows the *shape* of a send_message config — blocks, buttons, quick replies — and nothing about which of them a platform allows. Every limit and every affordance is read out of `config`, which the view fills from apps/broadcasts/composer.py::composer_config, which reads the capability and policy tables. Hard-coding "WhatsApp allows three buttons" here would be the second capability table contract 4 exists to prevent. It also does not validate. The server does, through the flow schema (apps/flows/schema), which rejects unknown keys at any depth — so a hand-crafted POST gets the same treatment as this form, which is the only place validation can honestly live (SECURITY-BASELINE §7). {% endcomment %}