@wildo-ai/saas-website 1.1.5 → 1.1.7

package/src/config/load-website-config.ts

@@ -126,6 +126,30 @@ export interface LoadWebsiteConfigArgs {
   saasConfig: WildoSaasConfig;
 }
 
+/**
+ * The application's one `STATIC_WEBSITE` service, as `[serviceKey, service]`.
+ * Throws when none is declared: the service folder is what owns
+ * `wildo.website.config.ts`, so a website build without one has nothing to load.
+ */
+export function resolveStaticWebsiteServiceEntry(
+  saasConfig: WildoSaasConfig,
+): [string, WildoSaasConfig['services'][string]] {
+  const websiteServiceEntry = Object.entries(saasConfig.services).find(
+    ([, service]) => service.frontendType === AppFrontendType.STATIC_WEBSITE,
+  );
+  if (!websiteServiceEntry) {
+    throw new Error(
+      '[wildo-website-config] No frontend service with `frontendType: STATIC_WEBSITE` is declared in '
+        + 'wildo.saas.config.ts. The marketing-website Astro build / loader requires an authored '
+        + 'STATIC_WEBSITE service because that service folder owns the per-service '
+        + '`wildo.website.config.ts` (publicOrigin, appOrigin, defaultLocale, locales). '
+        + 'Add a STATIC_WEBSITE service in wildo.saas.config.ts and ship the per-service '
+        + 'config file under it.',
+    );
+  }
+  return websiteServiceEntry;
+}
+
 /**
  * Discover and load the per-service marketing-website config.
  *
@@ -169,20 +193,7 @@ export async function loadWebsiteConfig(
   args: LoadWebsiteConfigArgs,
 ): Promise<WildoMarketingWebsiteConfig> {
   const { saasRoot, saasConfig } = args;
-
-  const websiteServiceEntry = Object.entries(saasConfig.services).find(
-    ([, service]) => service.frontendType === AppFrontendType.STATIC_WEBSITE,
-  );
-  if (!websiteServiceEntry) {
-    throw new Error(
-      '[wildo-website-config] No frontend service with `frontendType: STATIC_WEBSITE` is declared in '
-        + 'wildo.saas.config.ts. The marketing-website Astro build / loader requires an authored '
-        + 'STATIC_WEBSITE service because that service folder owns the per-service '
-        + '`wildo.website.config.ts` (publicOrigin, appOrigin, defaultLocale, locales). '
-        + 'Add a STATIC_WEBSITE service in wildo.saas.config.ts and ship the per-service '
-        + 'config file under it.',
-    );
-  }
+  const websiteServiceEntry = resolveStaticWebsiteServiceEntry(saasConfig);
 
   const [websiteServiceKey, websiteService] = websiteServiceEntry;
   const websiteConfigPath = resolvePath(

package/src/config/load-website-pricing-catalog.ts

@@ -0,0 +1,52 @@
+/**
+ * @wildo_source:part:start saas.website.config.pricing-catalog-loader facet:layer:astro facet:family:website facet:audience:app-developer
+ *
+ * `loadWebsitePricingCatalog` — the application's public pricing catalogue, for a website's pricing
+ * page (#1835). Call it in the page's `.astro` frontmatter, pass the result to the bridge island as
+ * `pricingCatalog`, and read it in the section with `useWebsitePricingCatalog()`; build the page's
+ * `AggregateOffer` from the same value with `buildWebsitePricingOfferStructuredData`.
+ *
+ * It walks up to `wildo.saas.config.ts` the way `loadWebsiteSiteContext` does, and reads the billing
+ * catalogue the backend sells from — the `productDefinitions` of the application's shared modules —
+ * through `loadApplicationPublicPricingCatalog`, from SOURCE, so a website image that builds only the
+ * website still sees the current catalogue.
+ *
+ * Separate from `loadWebsiteSiteContext` on purpose: loading the shared graph costs seconds, and only a
+ * pricing page needs it. Every other page's build stays as fast as it was.
+ *
+ * **Node-only.** Lives on the `/config-loader` subpath; it must never reach a React-island bundle.
+ */
+import {
+  loadApplicationPublicPricingCatalog,
+  loadConfig,
+  resolveWorkspaceScope,
+  type WildoSaasConfig,
+} from '@wildo-ai/platform-config-lib';
+import type { PublicPricingCatalog } from '@wildo-ai/saas-models/public-runtime';
+
+export interface LoadWebsitePricingCatalogInput {
+  /** Where to start the walk up to `wildo.saas.config.ts`. Defaults to the working directory. */
+  readonly cwd?: string | undefined;
+  /**
+   * Keep only plans this scope may subscribe to (a `ResourcePrimaryScope` wire value, e.g.
+   * `'organizations'`). Omit when the catalogue sells to one audience.
+   */
+  readonly targetScope?: string | undefined;
+}
+
+export async function loadWebsitePricingCatalog(input: LoadWebsitePricingCatalogInput = {}): Promise<PublicPricingCatalog> {
+  const workspaceScope = resolveWorkspaceScope(input.cwd);
+  if (workspaceScope.saasRoot === null || workspaceScope.saasConfigPath === null) {
+    throw new Error(
+      `[saas-website] No wildo.saas.config.ts found walking up from ${input.cwd ?? process.cwd()}. `
+        + 'Run astro from inside the application workspace.',
+    );
+  }
+  const saasConfig = await loadConfig<WildoSaasConfig>(workspaceScope.saasConfigPath);
+  return loadApplicationPublicPricingCatalog({
+    saasRoot: workspaceScope.saasRoot,
+    saasConfig,
+    ...(input.targetScope === undefined ? {} : { targetScope: input.targetScope }),
+  });
+}
+/** @wildo_source:part:end saas.website.config.pricing-catalog-loader */

package/src/config/load-website-site-context.ts

@@ -0,0 +1,145 @@
+/**
+ * @wildo_source:part:start saas.website.config.site-context-loader facet:layer:astro facet:family:website facet:audience:app-developer
+ *
+ * `loadWebsiteSiteContext` — the ONE way a website workspace builds its
+ * `WebsiteSiteContext`. Called once, from the workspace's
+ * `src/website-site-context.ts`:
+ *
+ * ```ts
+ * import { loadWebsiteSiteContext } from '@wildo-ai/saas-website/config-loader';
+ * import { WEBSITE_ROOT_CONFIG } from './website-root.config';
+ *
+ * export const WEBSITE_SITE_CONTEXT = await loadWebsiteSiteContext({
+ *   rootConfig: WEBSITE_ROOT_CONFIG,
+ *   isDevelopment: import.meta.env?.DEV === true,
+ * });
+ * ```
+ *
+ * It walks up from the working directory to `wildo.saas.config.ts`, finds the
+ * application's single `STATIC_WEBSITE` service, loads that service's
+ * `wildo.website.config.ts` and its materialized provider block, and settles the
+ * two origins the site reaches the product through (see
+ * {@link resolveWebsiteBuildOrigins}).
+ *
+ * **Why the engine owns this.** Every website workspace used to carry its own
+ * copy of this lookup — the scaffolded ones and the hand-written ones alike —
+ * and each copy hardcoded its local API port while the app origin had no local
+ * form at all. The result: under `astro dev`, every "Start free" CTA pointed at a
+ * production-shaped host that resolves to nothing. One loader means one rule.
+ *
+ * **Why it walks up from the working directory, never from `import.meta.url`.**
+ * Astro's prerender pass bundles the calling module into `dist/.prerender/chunks/…`,
+ * where a `new URL('../..', import.meta.url)` anchor resolves to `dist/` rather than
+ * the application root — every prerendered route then failed with "Config file not
+ * found: …/website/dist/wildo.saas.config.ts", while `astro dev` hid it by serving
+ * from `src/`. Every `astro dev` / `astro build` runs with the website package (or
+ * an ancestor) as its working directory, which is inside the application either way.
+ *
+ * **Node-only.** Lives on the `/config-loader` subpath with the other loaders; it
+ * must never reach a React-island bundle.
+ */
+import { resolve as resolvePath } from 'node:path';
+
+import {
+  loadConfig,
+  loadMaterializedFrontendProviders,
+  resolveFrontendServicesArtifactPath,
+  resolveLocalhostApplicationOrigins,
+  resolveWorkspaceScope,
+  type LocalhostApplicationOrigins,
+  type WildoSaasConfig,
+} from '@wildo-ai/platform-config-lib';
+
+import { composeWebsiteSiteContext, type WebsiteSiteContext } from '../astro/website-site-context';
+import type { WebsiteRootConfig } from '../schemas/manifests/website-root-config.shared.schemas';
+import { loadWebsiteConfig, resolveStaticWebsiteServiceEntry } from './load-website-config';
+import type { WildoMarketingWebsiteConfig } from './wildo-website-config.schemas';
+
+/** Explicit per-build origin overrides — what a deploy build passes as build arguments. */
+export interface WebsiteOriginOverrides {
+  /** `PUBLIC_APP_ORIGIN`: this environment's product origin, derived by the deploy workflow. */
+  readonly appOrigin?: string | undefined;
+  /** `PUBLIC_API_ORIGIN`: this environment's API origin. */
+  readonly apiOrigin?: string | undefined;
+}
+
+export interface ResolveWebsiteBuildOriginsInput {
+  /** The authored `wildo.website.config.ts` — the production default. */
+  readonly websiteConfig: WildoMarketingWebsiteConfig;
+  /** `true` under `astro dev`. */
+  readonly isDevelopment: boolean;
+  /** Where the product and API run locally, from the app's own declared ports. */
+  readonly localOrigins: LocalhostApplicationOrigins;
+  /** Explicit overrides, which win over everything. */
+  readonly overrides: WebsiteOriginOverrides;
+}
+
+/**
+ * The `websiteConfig` this BUILD serves, with `appOrigin` and `apiOrigin` settled.
+ *
+ * Precedence, per origin:
+ *
+ * 1. an explicit override (`PUBLIC_APP_ORIGIN` / `PUBLIC_API_ORIGIN`) — the deploy
+ *    workflow derives these per environment, so a staging build links into staging;
+ * 2. under `astro dev`, the locally running product / API, from the ports the
+ *    application declares — so a CTA reaches the process `wildo local dev` started;
+ * 3. the value authored in `wildo.website.config.ts`.
+ *
+ * The result replaces the two fields in `websiteConfig` rather than living beside
+ * it, because every page already forwards `websiteConfig.appOrigin` /
+ * `websiteConfig.apiOrigin` into its island: a second field would be a second
+ * source that pages could read instead. `websiteConfig` in a site context is
+ * therefore "the config as it applies to this build", which the config file was
+ * already half-way to being — it reads `PUBLIC_APP_ORIGIN` itself.
+ */
+export function resolveWebsiteBuildOrigins(input: ResolveWebsiteBuildOriginsInput): WildoMarketingWebsiteConfig {
+  const { websiteConfig, isDevelopment, localOrigins, overrides } = input;
+  const settle = (override: string | undefined, local: string | undefined, authored: string | undefined): string | undefined =>
+    override || (isDevelopment ? local : undefined) || authored;
+  const appOrigin = settle(overrides.appOrigin, localOrigins.app, websiteConfig.appOrigin) ?? websiteConfig.appOrigin;
+  const apiOrigin = settle(overrides.apiOrigin, localOrigins.api, websiteConfig.apiOrigin);
+  return { ...websiteConfig, appOrigin, ...(apiOrigin === undefined ? {} : { apiOrigin }) };
+}
+
+export interface LoadWebsiteSiteContextInput {
+  /** The workspace's `WEBSITE_ROOT_CONFIG`. */
+  readonly rootConfig: WebsiteRootConfig;
+  /** Pass `import.meta.env?.DEV === true` (optional chaining: `astro.config.ts` evaluates the caller before Vite's env exists). */
+  readonly isDevelopment: boolean;
+  /** Where to start the walk up to `wildo.saas.config.ts`. Defaults to the working directory. */
+  readonly cwd?: string | undefined;
+  /** Defaults to `PUBLIC_APP_ORIGIN` / `PUBLIC_API_ORIGIN` from the process environment. */
+  readonly overrides?: WebsiteOriginOverrides | undefined;
+}
+
+export async function loadWebsiteSiteContext(input: LoadWebsiteSiteContextInput): Promise<WebsiteSiteContext> {
+  const workspaceScope = resolveWorkspaceScope(input.cwd);
+  if (workspaceScope.saasRoot === null || workspaceScope.saasConfigPath === null) {
+    throw new Error(
+      `[saas-website] No wildo.saas.config.ts found walking up from ${input.cwd ?? process.cwd()}. `
+        + 'Run astro from inside the application workspace.',
+    );
+  }
+  const saasRoot = workspaceScope.saasRoot;
+  const saasConfig = await loadConfig<WildoSaasConfig>(workspaceScope.saasConfigPath);
+  const [websiteServiceKey] = resolveStaticWebsiteServiceEntry(saasConfig);
+  const websiteConfig = await loadWebsiteConfig({ saasRoot, saasConfig });
+
+  return composeWebsiteSiteContext({
+    rootConfig: input.rootConfig,
+    websiteConfig: resolveWebsiteBuildOrigins({
+      websiteConfig,
+      isDevelopment: input.isDevelopment,
+      localOrigins: resolveLocalhostApplicationOrigins(saasConfig.services),
+      overrides: input.overrides ?? {
+        appOrigin: process.env.PUBLIC_APP_ORIGIN,
+        apiOrigin: process.env.PUBLIC_API_ORIGIN,
+      },
+    }),
+    frontendProviders: loadMaterializedFrontendProviders({
+      artifactPath: resolveFrontendServicesArtifactPath(resolvePath(saasRoot)),
+      serviceKey: websiteServiceKey,
+    }),
+  });
+}
+/** @wildo_source:part:end saas.website.config.site-context-loader */

package/src/config-loader.ts

@@ -33,3 +33,5 @@
  */
 
 export * from './config/load-website-config';
+export * from './config/load-website-site-context';
+export * from './config/load-website-pricing-catalog';

package/src/core/__tests__/contexts.test.tsx

@@ -7,7 +7,7 @@ import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
 } from '../contexts/WebsiteRuntimeContext';
-import { useWebsiteRuntime } from '../contexts/useWebsiteRuntime';
+import { useWebsitePricingCatalog, useWebsiteRuntime } from '../contexts/useWebsiteRuntime';
 import { WebsitePageContextProvider } from '../contexts/WebsitePageContext';
 import { useWebsitePage } from '../contexts/useWebsitePage';
 import { WebsiteSectionContextProvider } from '../contexts/WebsiteSectionContext';
@@ -76,6 +76,25 @@ describe('WebsiteRuntimeContext', () => {
   });
 });
 
+describe('useWebsitePricingCatalog', () => {
+  const wrapperWith = (value: WebsiteRuntimeContextValue) => ({ children }: { children: React.ReactNode }) => (
+    <WebsiteRuntimeContextProvider value={value}>{children}</WebsiteRuntimeContextProvider>
+  );
+
+  it('returns the catalogue the page passed to its island', () => {
+    const catalog = { plans: [] };
+    const { result } = renderHook(() => useWebsitePricingCatalog(), { wrapper: wrapperWith({ ...RUNTIME_FIXTURE, pricingCatalog: catalog }) });
+    expect(result.current).toBe(catalog);
+  });
+
+  it('fails loudly when the page passed none — a pricing section must never render "no plans" for a missing prop', () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    expect(() => renderHook(() => useWebsitePricingCatalog(), { wrapper: wrapperWith(RUNTIME_FIXTURE) })).toThrowError(
+      /did not pass a pricing catalogue/,
+    );
+  });
+});
+
 describe('WebsitePageContext', () => {
   it('provides the page ref through the provider component', () => {
     const pageRef = WebsitePageRefSchema.parse('landing');

package/src/core/__tests__/website-consent.test.tsx

@@ -56,7 +56,8 @@ function provider(ref: string, capability: string, activate: ReturnType<typeof v
     metadata: defineProviderMetadata({ ref, packageName: '@test/providers', tier: ProviderTier.EXTENSION, origin: { kind: ProviderOriginKind.APPLICATION } }),
     providerCapabilities: [capability],
     protocols: ['FRONTEND_SDK'],
-    sdk: { descriptor: { packageName: `@vendor/${ref}` }, activate },
+    // Declared stoppable: a consent-based SDK must be, or it never starts (#1704).
+    sdk: { descriptor: { packageName: `@vendor/${ref}` }, stoppable: true, activate },
   };
 }
 

package/src/core/anonymous-session/InboundContactForm.tsx

@@ -8,15 +8,41 @@
  * the anonymous session (init header) and the backend stamps the lead's `anonymousUserId`
  * so it can later transpose to the visitor's account on signup/login.
  *
- * Labels are injected (optional props with English fallbacks) rather than read from the
- * website runtime context, so the component stays framework-light and unit-testable; the
- * section wrapper passes i18n-resolved strings.
+ * Labels are injected rather than read from the website runtime context, so the component stays framework-light and
+ * unit-testable; the section wrapper passes the strings it resolved through `useWebsiteLabel`. EVERY label is required
+ * and the form carries no words of its own (#1986): a fallback would be English in every locale and would hide the
+ * missing label, while a required prop makes an omission a type error in the section, and a key the pack does not
+ * carry reaches the page as the key itself — which is what `useWebsiteLabel` returns, so somebody authors it.
+ *
+ * Submission challenge (#1735): when the application protects the form with a captcha, each submission carries an
+ * answer — the consented vendor's token when its browser part runs on the page, otherwise the engine's proof of work,
+ * which needs no consent (see `website-submission-challenge.ts`). Nothing for the visitor to click or read: both are
+ * invisible, so the form stays operable by keyboard and screen reader exactly as before. A vendor token the backend
+ * refuses is retried once with the proof of work; a refusal that survives that shows `challengeRefusedMessage`.
  */
 
-import React, { useCallback, useMemo, useState } from "react";
-import { InboundContactFormSchema, buildInboundContactCreateBody, type InboundContactFormValues } from "./inbound-contact-form.schema";
+import React, { useCallback, useState } from "react";
+import { SubmissionChallengeAction, WildoHeaderKeys } from "@wildo-ai/saas-models/public-runtime";
+import {
+  INBOUND_CONTACT_NAME_MAX_LENGTH,
+  INBOUND_CONTACT_PHONE_MAX_LENGTH,
+  InboundContactFormSchema,
+  buildInboundContactCreateBody,
+  type InboundContactFormValues,
+} from "./inbound-contact-form.schema";
 import type { WebsiteAnonymousSessionClient } from "./website-anonymous-session-client";
+import {
+  isSubmissionChallengeRefusal,
+  obtainSubmissionChallengeAnswer,
+  useWebsiteSubmissionChallengeSource,
+  type WebsiteSubmissionChallengeSource,
+} from "./website-submission-challenge";
 
+/**
+ * Every word the form shows. All required (#1986): the section resolves each through `useWebsiteLabel` and lists its
+ * key in `expectedLabelKeys`, so a missing label is a type error in the section or a visible key on the page, never a
+ * silent English substitute.
+ */
 export interface InboundContactFormLabels {
   emailLabel: string;
   firstNameLabel: string;
@@ -28,29 +54,23 @@ export interface InboundContactFormLabels {
   submittingLabel: string;
   successMessage: string;
   errorMessage: string;
+  /** The anti-spam check did not pass, even with the proof of work (#1735). */
+  challengeRefusedMessage: string;
+  /** Shown beside the email field when what was typed is not an email address (#1986). */
+  invalidEmailMessage: string;
 }
 
-const DEFAULT_LABELS: InboundContactFormLabels = {
-  emailLabel: "Email",
-  firstNameLabel: "First name",
-  lastNameLabel: "Last name",
-  phoneLabel: "Phone",
-  marketingConsentLabel: "Keep me updated about news and offers",
-  submitLabel: "Get in touch",
-  submittingLabel: "Sending…",
-  successMessage: "Thanks — we'll be in touch shortly.",
-  errorMessage: "Something went wrong. Please try again.",
-};
-
 type SubmitState = { status: "idle" } | { status: "submitting" } | { status: "success" } | { status: "error"; message: string };
 
 export interface InboundContactFormProps {
   /** The anonymous-session client (constructed by the section wiring from site config). */
   client: WebsiteAnonymousSessionClient;
-  /** Optional i18n-resolved labels; English fallbacks are used per-field when omitted. */
-  labels?: Partial<InboundContactFormLabels>;
+  /** The section's i18n-resolved labels — every one of them (#1986). */
+  labels: InboundContactFormLabels;
   /** Optional callback fired after a successful submission (e.g. analytics). */
   onSubmitted?: () => void;
+  /** The page's captcha, for a form rendered outside a page layout (tests). Defaults to the page's own. */
+  challengeSource?: WebsiteSubmissionChallengeSource;
 }
 
 const EMPTY_VALUES: InboundContactFormValues = {
@@ -61,10 +81,11 @@ const EMPTY_VALUES: InboundContactFormValues = {
   marketingConsent: false,
 };
 
-export function InboundContactForm({ client, labels, onSubmitted }: InboundContactFormProps): React.ReactElement {
-  const resolvedLabels = useMemo(() => ({ ...DEFAULT_LABELS, ...labels }), [labels]);
+export function InboundContactForm({ client, labels, onSubmitted, challengeSource }: InboundContactFormProps): React.ReactElement {
+  const pageChallengeSource = useWebsiteSubmissionChallengeSource();
+  const source = challengeSource ?? pageChallengeSource;
   const [values, setValues] = useState<InboundContactFormValues>(EMPTY_VALUES);
-  const [fieldErrors, setFieldErrors] = useState<Partial<Record<keyof InboundContactFormValues, string>>>({});
+  const [emailInvalid, setEmailInvalid] = useState(false);
   const [submit, setSubmit] = useState<SubmitState>({ status: "idle" });
 
   const setField = useCallback(<K extends keyof InboundContactFormValues>(key: K, value: InboundContactFormValues[K]) => {
@@ -74,38 +95,54 @@ export function InboundContactForm({ client, labels, onSubmitted }: InboundConta
   const handleSubmit = useCallback(
     async (event: React.FormEvent<HTMLFormElement>) => {
       event.preventDefault();
-      setFieldErrors({});
+      setEmailInvalid(false);
 
       const parsed = InboundContactFormSchema.safeParse(values);
       if (!parsed.success) {
-        const nextErrors: Partial<Record<keyof InboundContactFormValues, string>> = {};
-        for (const issue of parsed.error.issues) {
-          const key = issue.path[0] as keyof InboundContactFormValues | undefined;
-          if (key && !nextErrors[key]) nextErrors[key] = issue.message;
-        }
-        setFieldErrors(nextErrors);
+        // The schema's own issue messages are never shown: they are English and nobody authors them (#1986). The email
+        // is the one field a visitor can get wrong, and it has its label. The other fields' only rule is a length the
+        // inputs already enforce with `maxLength`, so reaching a failure there means the values did not come from
+        // typing, and the form answers with its generic error rather than inventing a sentence.
+        const emailFailed = parsed.error.issues.some((issue) => issue.path[0] === "email");
+        setEmailInvalid(emailFailed);
+        if (!emailFailed) setSubmit({ status: "error", message: labels.errorMessage });
         return;
       }
 
       setSubmit({ status: "submitting" });
+      const body = buildInboundContactCreateBody(parsed.data);
+      const send = async (proofOfWorkOnly: boolean): Promise<void> => {
+        const answer = await obtainSubmissionChallengeAnswer({ source, action: SubmissionChallengeAction.INBOUND_CONTACT, client, proofOfWorkOnly });
+        await client.postAnonymous("/inbound-contacts", body, answer === undefined ? undefined : { [WildoHeaderKeys.SUBMISSION_CHALLENGE_RESPONSE]: answer });
+      };
       try {
-        await client.postAnonymous("/inbound-contacts", buildInboundContactCreateBody(parsed.data));
+        try {
+          await send(false);
+        } catch (error) {
+          // A refused challenge is answered ONCE more, with the proof of work: a vendor that scored a real person low,
+          // could not be reached, or a site that did not know the backend protects the form must not lock anyone out.
+          if (!isSubmissionChallengeRefusal(error)) throw error;
+          await send(true);
+        }
         setSubmit({ status: "success" });
         setValues(EMPTY_VALUES);
         onSubmitted?.();
-      } catch {
+      } catch (error) {
         // The backend-only `emailUserMatch` triage signal is never returned here, so a
         // failure exposes no account-existence information — just a generic retry.
-        setSubmit({ status: "error", message: resolvedLabels.errorMessage });
+        setSubmit({
+          status: "error",
+          message: isSubmissionChallengeRefusal(error) ? labels.challengeRefusedMessage : labels.errorMessage,
+        });
       }
     },
-    [client, values, onSubmitted, resolvedLabels.errorMessage],
+    [client, values, onSubmitted, source, labels.errorMessage, labels.challengeRefusedMessage],
   );
 
   if (submit.status === "success") {
     return (
       <div role="status" aria-live="polite">
-        {resolvedLabels.successMessage}
+        {labels.successMessage}
       </div>
     );
   }
@@ -115,42 +152,60 @@ export function InboundContactForm({ client, labels, onSubmitted }: InboundConta
   return (
     <form onSubmit={handleSubmit} noValidate>
       <label>
-        {resolvedLabels.emailLabel}
+        {labels.emailLabel}
         <input
           type="email"
           name="email"
           required
           value={values.email}
           onChange={(e) => setField("email", e.target.value)}
-          aria-invalid={fieldErrors.email ? true : undefined}
+          aria-invalid={emailInvalid ? true : undefined}
         />
-        {fieldErrors.email ? <span role="alert">{fieldErrors.email}</span> : null}
+        {emailInvalid ? <span role="alert">{labels.invalidEmailMessage}</span> : null}
       </label>
 
       <label>
-        {resolvedLabels.firstNameLabel}
-        <input type="text" name="firstName" value={values.firstName ?? ""} onChange={(e) => setField("firstName", e.target.value)} />
+        {labels.firstNameLabel}
+        <input
+          type="text"
+          name="firstName"
+          maxLength={INBOUND_CONTACT_NAME_MAX_LENGTH}
+          value={values.firstName ?? ""}
+          onChange={(e) => setField("firstName", e.target.value)}
+        />
       </label>
 
       <label>
-        {resolvedLabels.lastNameLabel}
-        <input type="text" name="lastName" value={values.lastName ?? ""} onChange={(e) => setField("lastName", e.target.value)} />
+        {labels.lastNameLabel}
+        <input
+          type="text"
+          name="lastName"
+          maxLength={INBOUND_CONTACT_NAME_MAX_LENGTH}
+          value={values.lastName ?? ""}
+          onChange={(e) => setField("lastName", e.target.value)}
+        />
       </label>
 
       <label>
-        {resolvedLabels.phoneLabel}
-        <input type="tel" name="phone" value={values.phone ?? ""} onChange={(e) => setField("phone", e.target.value)} />
+        {labels.phoneLabel}
+        <input
+          type="tel"
+          name="phone"
+          maxLength={INBOUND_CONTACT_PHONE_MAX_LENGTH}
+          value={values.phone ?? ""}
+          onChange={(e) => setField("phone", e.target.value)}
+        />
       </label>
 
       <label>
         <input type="checkbox" name="marketingConsent" checked={values.marketingConsent} onChange={(e) => setField("marketingConsent", e.target.checked)} />
-        {resolvedLabels.marketingConsentLabel}
+        {labels.marketingConsentLabel}
       </label>
 
       {submit.status === "error" ? <div role="alert">{submit.message}</div> : null}
 
       <button type="submit" disabled={isSubmitting}>
-        {isSubmitting ? resolvedLabels.submittingLabel : resolvedLabels.submitLabel}
+        {isSubmitting ? labels.submittingLabel : labels.submitLabel}
       </button>
     </form>
   );

package/src/core/anonymous-session/__tests__/InboundContactForm.labels.test.tsx

@@ -0,0 +1,108 @@
+/**
+ * #1986 — every word the contact form shows is one its section passed.
+ *
+ * The form used to merge an English `DEFAULT_LABELS` under optional props, and showed the schema's own English issue
+ * message beside the email field. Both reached every locale and neither could be found by whoever authors the label
+ * pack. These pins walk the rendered text, so a literal put back into the markup, the schema or a fallback reddens them.
+ */
+import React from 'react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+
+import { InboundContactForm, type InboundContactFormLabels } from '../InboundContactForm';
+import { INBOUND_CONTACT_NAME_MAX_LENGTH, INBOUND_CONTACT_PHONE_MAX_LENGTH } from '../inbound-contact-form.schema';
+import type { WebsiteAnonymousSessionClient } from '../website-anonymous-session-client';
+
+afterEach(() => { cleanup(); });
+
+const LABELS: InboundContactFormLabels = {
+  emailLabel: 'email-label',
+  firstNameLabel: 'first-name-label',
+  lastNameLabel: 'last-name-label',
+  phoneLabel: 'phone-label',
+  marketingConsentLabel: 'marketing-consent-label',
+  submitLabel: 'submit-label',
+  submittingLabel: 'submitting-label',
+  successMessage: 'success-label',
+  errorMessage: 'error-label',
+  challengeRefusedMessage: 'refused-label',
+  invalidEmailMessage: 'invalid-email-label',
+};
+
+const AUTHORED = new Set<string>(Object.values(LABELS));
+
+/** Every non-blank text node under `root`, trimmed. */
+function renderedWords(root: HTMLElement): string[] {
+  const walker = document.createTreeWalker(root, NodeFilter.SHOW_TEXT);
+  const words: string[] = [];
+  for (let node = walker.nextNode(); node; node = walker.nextNode()) {
+    const text = node.textContent?.trim();
+    if (text) words.push(text);
+  }
+  return words;
+}
+
+function clientDouble() {
+  const postAnonymous = vi.fn(async () => ({}));
+  return { client: { postAnonymous, getPublic: vi.fn() } as unknown as WebsiteAnonymousSessionClient, postAnonymous };
+}
+
+function renderForm() {
+  const double = clientDouble();
+  const view = render(<InboundContactForm client={double.client} challengeSource={{ captchaDeclared: false }} labels={LABELS} />);
+  return { ...double, container: view.container };
+}
+
+describe('InboundContactForm — its words are the section\'s (#1986)', () => {
+  it('shows no word of its own in the idle form', () => {
+    const { container } = renderForm();
+    const words = renderedWords(container);
+    expect(words.length).toBeGreaterThan(0);
+    expect(words.filter((word) => !AUTHORED.has(word))).toEqual([]);
+  });
+
+  it('words an invalid email with the section\'s label, never the schema\'s message', async () => {
+    const { container, postAnonymous } = renderForm();
+    fireEvent.change(screen.getByRole('textbox', { name: LABELS.emailLabel }), { target: { value: 'not-an-email' } });
+    fireEvent.click(screen.getByRole('button', { name: LABELS.submitLabel }));
+    expect(await screen.findByRole('alert')).toHaveTextContent(LABELS.invalidEmailMessage);
+    expect(screen.getByRole('textbox', { name: new RegExp(LABELS.emailLabel) })).toHaveAttribute('aria-invalid', 'true');
+    expect(renderedWords(container).filter((word) => !AUTHORED.has(word))).toEqual([]);
+    expect(postAnonymous).not.toHaveBeenCalled();
+  });
+
+  it('answers a length failure no typed input can produce with the generic error, not a schema sentence', async () => {
+    const { container, postAnonymous } = renderForm();
+    fireEvent.change(screen.getByRole('textbox', { name: new RegExp(LABELS.emailLabel) }), { target: { value: 'visitor@example.test' } });
+    // `fireEvent.change` sets the value directly, which is exactly the path `maxLength` cannot stop.
+    fireEvent.change(screen.getByRole('textbox', { name: LABELS.firstNameLabel }), { target: { value: 'x'.repeat(INBOUND_CONTACT_NAME_MAX_LENGTH + 1) } });
+    fireEvent.click(screen.getByRole('button', { name: LABELS.submitLabel }));
+    expect(await screen.findByRole('alert')).toHaveTextContent(LABELS.errorMessage);
+    expect(renderedWords(container).filter((word) => !AUTHORED.has(word) && !/^x+$/.test(word))).toEqual([]);
+    expect(postAnonymous).not.toHaveBeenCalled();
+  });
+
+  it('shows only the section\'s words once sent', async () => {
+    const { container } = renderForm();
+    fireEvent.change(screen.getByRole('textbox', { name: LABELS.emailLabel }), { target: { value: 'visitor@example.test' } });
+    fireEvent.click(screen.getByRole('button', { name: LABELS.submitLabel }));
+    await waitFor(() => expect(screen.getByRole('status')).toBeInTheDocument());
+    expect(renderedWords(container)).toEqual([LABELS.successMessage]);
+  });
+
+  it('stops typing at the schema\'s own length ceilings', () => {
+    renderForm();
+    expect(screen.getByRole('textbox', { name: LABELS.firstNameLabel })).toHaveAttribute('maxLength', String(INBOUND_CONTACT_NAME_MAX_LENGTH));
+    expect(screen.getByRole('textbox', { name: LABELS.lastNameLabel })).toHaveAttribute('maxLength', String(INBOUND_CONTACT_NAME_MAX_LENGTH));
+    expect(screen.getByRole('textbox', { name: LABELS.phoneLabel })).toHaveAttribute('maxLength', String(INBOUND_CONTACT_PHONE_MAX_LENGTH));
+  });
+
+  it('refuses, at compile time, a section that omits a label', () => {
+    const { client } = clientDouble();
+    const { invalidEmailMessage: _omitted, ...incomplete } = LABELS;
+    // @ts-expect-error — every label is required (#1986): an omission is the section's type error, not English.
+    const element = <InboundContactForm client={client} labels={incomplete} />;
+    expect(element).toBeTruthy();
+  });
+});