create-ailk 0.20.0 → 0.22.0

package/templates/apps/web/app/[locale]/checkout/__tests__/pages.test.tsx

@@ -0,0 +1,139 @@
+/**
+ * The standard checkout return pages (#8748 D1, D5, D11; spec
+ * docs/specs/8748-a-standard-spoke-checkout-route-spec.md AC-2).
+ *
+ * Both pages are noindex, render their namespace's copy, read no search
+ * parameter and never import the checkout standard. On any build that is
+ * not a spoke they call `notFound()` before reading a translation.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { render } from "@testing-library/react";
+
+const mockNotFound = jest.fn(() => {
+  throw new Error("NEXT_NOT_FOUND");
+});
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: () => mockNotFound(),
+}));
+
+const mockGetTranslations = jest.fn();
+jest.mock("next-intl/server", () => {
+  const actual = jest.requireActual("next-intl/server");
+  return {
+    ...actual,
+    getTranslations: (arg: unknown) => {
+      mockGetTranslations(arg);
+      return actual.getTranslations(arg);
+    },
+  };
+});
+
+const mockTopology: { value: "hub" | "spoke" } = { value: "spoke" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426), not a runtime input; the seam IS the boundary between a hub and a spoke build, and no env or HTTP surface selects it.
+jest.mock("../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  get TOPOLOGY() {
+    return mockTopology.value;
+  },
+}));
+
+// The thank-you page reads a paid session through the package (#8757 D13);
+// with no `session_id` it never calls it, so a stub is enough here.
+// `virtual`: CI runs this suite before the package's dist is built.
+jest.mock(
+  "@working-theory/spoke-checkout",
+  () => ({ __esModule: true, readPaidCheckoutEmail: jest.fn(async () => null) }),
+  { virtual: true },
+);
+
+import messages from "../../../../messages/en.json";
+import ThankYouPage, {
+  generateMetadata as thankYouMetadata,
+} from "../thank-you/page";
+import UnavailablePage, {
+  generateMetadata as unavailableMetadata,
+} from "../unavailable/page";
+
+type PageModule = {
+  name: string;
+  dir: string;
+  namespace: "checkoutThankYou" | "checkoutUnavailable";
+  Page: typeof ThankYouPage;
+  generateMetadata: typeof thankYouMetadata;
+};
+
+const PAGES: PageModule[] = [
+  {
+    name: "thank-you",
+    dir: "thank-you",
+    namespace: "checkoutThankYou",
+    Page: ThankYouPage,
+    generateMetadata: thankYouMetadata,
+  },
+  {
+    name: "unavailable",
+    dir: "unavailable",
+    namespace: "checkoutUnavailable",
+    Page: UnavailablePage,
+    generateMetadata: unavailableMetadata,
+  },
+];
+
+const params = (): Promise<{ locale: string }> =>
+  Promise.resolve({ locale: "en" });
+
+function source(dir: string): string {
+  return readFileSync(join(__dirname, "..", dir, "page.tsx"), "utf8");
+}
+
+beforeEach(() => {
+  mockNotFound.mockClear();
+  mockGetTranslations.mockClear();
+  mockTopology.value = "spoke";
+});
+
+describe.each(PAGES)("the checkout $name page (#8748 AC-2)", (page) => {
+  it("is noindex", async () => {
+    const metadata = await page.generateMetadata({ params: params() });
+    expect(metadata.robots).toEqual({ index: false, follow: false });
+    expect(metadata.title).toBe(messages[page.namespace].title);
+  });
+
+  it("renders its namespace's title", async () => {
+    const { getByText } = render(await page.Page({ params: params() }));
+    expect(getByText(messages[page.namespace].title)).toBeTruthy();
+  });
+
+  it("never imports lib/checkout, and only the thank-you page reads searchParams (#8757 D13)", () => {
+    const text = source(page.dir);
+    expect(text).not.toMatch(/lib\/checkout["']/);
+    if (page.dir !== "thank-you") expect(text).not.toContain("searchParams");
+  });
+
+  it("calls notFound() before any translation read when the build is a hub (D11)", async () => {
+    mockTopology.value = "hub";
+    await expect(page.Page({ params: params() })).rejects.toThrow(
+      "NEXT_NOT_FOUND",
+    );
+    await expect(page.generateMetadata({ params: params() })).rejects.toThrow(
+      "NEXT_NOT_FOUND",
+    );
+    expect(mockNotFound).toHaveBeenCalledTimes(2);
+    expect(mockGetTranslations).not.toHaveBeenCalled();
+  });
+});
+
+describe("the checkout unavailable page's way out", () => {
+  it("links /contact", async () => {
+    const { container } = render(await UnavailablePage({ params: params() }));
+    const hrefs = [...container.querySelectorAll("a")].map((a) =>
+      a.getAttribute("href"),
+    );
+    expect(hrefs.some((href) => href === "/contact" || href === "/en/contact")).toBe(
+      true,
+    );
+  });
+});

package/templates/apps/web/app/[locale]/checkout/__tests__/thank-you-account.test.tsx

@@ -0,0 +1,136 @@
+/**
+ * The checkout thank-you page's "Open your account" link (#8757 D13, AC-9).
+ *
+ * A `session_id` of a paid session of this site renders the link with the
+ * buyer's email (`accountInviteHref`); anything the package answers `null`
+ * for renders it with no email. The page is noindex, sends no referrer,
+ * renders dynamically, never touches a cookie, and over a visitor's budget
+ * of 10 reads per 10 minutes it makes no Stripe read at all.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { render } from "@testing-library/react";
+import { localeHref } from "@working-theory/ui";
+
+const mockRead = jest.fn<Promise<string | null>, [{ site: string }, string]>();
+// `virtual`: CI runs this suite before the package's dist is built.
+jest.mock(
+  "@working-theory/spoke-checkout",
+  () => ({
+    __esModule: true,
+    readPaidCheckoutEmail: (config: { site: string }, id: string) =>
+      mockRead(config, id),
+  }),
+  { virtual: true },
+);
+
+jest.mock("next/navigation", () => ({
+  __esModule: true,
+  notFound: () => {
+    throw new Error("NEXT_NOT_FOUND");
+  },
+}));
+
+const mockVisitor = { ip: "203.0.113.7" };
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  headers: jest.fn(async () => ({
+    get: (name: string) => (name === "x-forwarded-for" ? mockVisitor.ip : null),
+  })),
+}));
+
+// eslint-disable-next-line no-restricted-syntax -- #507: SIGN_IN_PROVIDER and TOPOLOGY are generated per-build constants (#8757 D13), not runtime inputs; no env or HTTP surface selects them.
+jest.mock("../../../../lib/topology.generated", () => ({
+  __esModule: true,
+  SIGN_IN_PROVIDER: "site",
+  TOPOLOGY: "spoke",
+}));
+
+import { accountInviteHref } from "../../../../lib/account-invite";
+import { checkoutConfig } from "../../../../lib/checkout-config";
+import messages from "../../../../messages/en.json";
+import { __resetRateLimit } from "../../../../src/lib/rate-limit";
+import * as pageModule from "../thank-you/page";
+
+const SESSION = "cs_test_paidOwnSite01";
+const EMAIL = "buyer@example.com";
+
+const params = (): Promise<{ locale: string }> =>
+  Promise.resolve({ locale: "en" });
+const search = (q: Record<string, string>) => Promise.resolve(q);
+
+async function linkHref(
+  q: Record<string, string> = { session_id: SESSION },
+): Promise<string> {
+  const { getByTestId, unmount } = render(
+    await pageModule.default({ params: params(), searchParams: search(q) }),
+  );
+  const link = getByTestId("checkout-open-account");
+  expect(link.textContent).toBe(messages.checkoutThankYou.openAccount);
+  const href = link.getAttribute("href") ?? "";
+  unmount();
+  return href;
+}
+
+beforeEach(() => {
+  mockRead.mockReset();
+  __resetRateLimit();
+  mockVisitor.ip = "203.0.113.7";
+});
+
+describe("the thank-you page's account link (#8757 D13, AC-9)", () => {
+  it("links accountInviteHref(locale, email) for a paid own-site session", async () => {
+    mockRead.mockResolvedValue(EMAIL);
+    expect(await linkHref()).toBe(accountInviteHref("en", EMAIL));
+    expect(mockRead).toHaveBeenCalledWith(
+      { site: checkoutConfig.site },
+      SESSION,
+    );
+  });
+
+  it("links with no email parameter when the read answers null", async () => {
+    mockRead.mockResolvedValue(null);
+    const href = await linkHref();
+    expect(href).not.toContain("email=");
+    expect(href).toBe(localeHref("en", "/account"));
+  });
+
+  it("links with no email and makes no read when there is no session_id", async () => {
+    expect(await linkHref({})).not.toContain("email=");
+    expect(mockRead).not.toHaveBeenCalled();
+  });
+
+  it("makes no read on the 11th visit from one visitor within 10 minutes", async () => {
+    mockRead.mockResolvedValue(EMAIL);
+    for (let i = 0; i < 10; i += 1) await linkHref();
+    expect(mockRead).toHaveBeenCalledTimes(10);
+    const href = await linkHref();
+    expect(mockRead).toHaveBeenCalledTimes(10);
+    expect(href).not.toContain("email=");
+  });
+
+  it("counts each visitor separately", async () => {
+    mockRead.mockResolvedValue(EMAIL);
+    for (let i = 0; i < 10; i += 1) await linkHref();
+    mockVisitor.ip = "198.51.100.9";
+    expect(await linkHref()).toBe(accountInviteHref("en", EMAIL));
+    expect(mockRead).toHaveBeenCalledTimes(11);
+  });
+
+  it("is noindex, sends no referrer and renders dynamically", async () => {
+    const metadata = await pageModule.generateMetadata({ params: params() });
+    expect(metadata.referrer).toBe("no-referrer");
+    expect(metadata.robots).toEqual({ index: false, follow: false });
+    expect(pageModule.dynamic).toBe("force-dynamic");
+  });
+
+  it("never reads or sets a cookie", () => {
+    const text = readFileSync(
+      join(__dirname, "..", "thank-you", "page.tsx"),
+      "utf8",
+    );
+    expect(text).not.toMatch(/\bcookies\b/);
+    expect(text).not.toMatch(/\.set\(/);
+  });
+});

package/templates/apps/web/app/[locale]/checkout/thank-you/page.tsx

@@ -0,0 +1,114 @@
+// The checkout thank-you page — Standard spoke checkout page (#8748).
+// Kept current by `create-ailk update`: do not edit it. This site's checkout
+// data is lib/checkout-config.ts, the one file to edit.
+// Stripe returns a buyer here after paying. It calls neither the hub nor any
+// fulfilment: the webhook is what fulfils the order. It reads the one
+// `session_id` Stripe appended, to offer "Open your account" with the buyer's
+// email (#8757 D13): a paid session of this site, under 24 hours old, read
+// within a per-visitor budget, held per server instance (best effort: the
+// session id's length, not this budget, is what stops guessing). It never
+// sets a cookie and never signs anyone in. It is served on a spoke only: any other build answers notFound().
+import { readPaidCheckoutEmail } from "@working-theory/spoke-checkout";
+import { Button, Container, Link, localeHref } from "@working-theory/ui";
+import { SectionRenderer } from "@working-theory/ui/sections";
+import type { PageSection } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { headers } from "next/headers";
+import { notFound } from "next/navigation";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { accountInviteHref } from "../../../../lib/account-invite";
+import { checkoutConfig } from "../../../../lib/checkout-config";
+import { TOPOLOGY } from "../../../../lib/topology.generated";
+import {
+  checkRateLimit,
+  clientIpFromHeaders,
+} from "../../../../src/lib/rate-limit";
+
+// Next sends `private, no-cache, no-store` for a force-dynamic render, so the
+// page (it can carry an email) is never cached (#8757 D13).
+export const dynamic = "force-dynamic";
+
+/** The Stripe reads one visitor may spend: 10 per 10 minutes (#8757 D13). */
+const PAID_EMAIL_READS = 10;
+const PAID_EMAIL_WINDOW_MS = 10 * 60 * 1000;
+
+interface Props {
+  params: Promise<{ locale: string }>;
+  searchParams?: Promise<Record<string, string | string[] | undefined>>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  if (TOPOLOGY !== "spoke") notFound();
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "checkoutThankYou" });
+  return {
+    title: t("title"),
+    robots: { index: false, follow: false },
+    referrer: "no-referrer",
+  };
+}
+
+/** The buyer's email, or `null` — over the visitor's budget, no Stripe call. */
+async function paidEmail(
+  sessionId: string | string[] | undefined,
+): Promise<string | null> {
+  // A repeated `session_id` is ignored, like a missing one.
+  if (typeof sessionId !== "string" || sessionId === "") return null;
+  const visitor = clientIpFromHeaders(await headers());
+  if (
+    !checkRateLimit(
+      `checkout-paid-email:${visitor}`,
+      PAID_EMAIL_READS,
+      PAID_EMAIL_WINDOW_MS,
+    )
+  ) {
+    return null;
+  }
+  return readPaidCheckoutEmail({ site: checkoutConfig.site }, sessionId);
+}
+
+export default async function Page({
+  params,
+  searchParams,
+}: Props): Promise<ReactElement> {
+  if (TOPOLOGY !== "spoke") notFound();
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "checkoutThankYou" });
+  const sessionId = (await searchParams)?.session_id;
+  const email = await paidEmail(sessionId);
+  const href =
+    (email === null ? null : accountInviteHref(locale, email)) ??
+    localeHref(locale, "/account");
+  const sections: PageSection[] = [
+    {
+      id: "checkout-thank-you",
+      type: "content-block",
+      data: { headline: t("title"), body: t("body") },
+    },
+  ];
+  return (
+    <main id="main">
+      <SectionRenderer
+        sections={sections}
+        locale={locale}
+        leadingSectionOwnsTitle
+      />
+      {/* Session Replay records the DOM, so the link (it can carry the email) is blocked from it. */}
+      <Container className="pb-section">
+        <div data-sentry-block>
+          <Button asChild variant="outline" className="min-h-11">
+            <Link
+              href={href}
+              variant="bare"
+              data-testid="checkout-open-account"
+            >
+              {t("openAccount")}
+            </Link>
+          </Button>
+        </div>
+      </Container>
+    </main>
+  );
+}

package/templates/apps/web/app/[locale]/checkout/unavailable/page.tsx

@@ -0,0 +1,51 @@
+// The checkout unavailable page — Standard spoke checkout page (#8748).
+// Kept current by `create-ailk update`: do not edit it. This site's checkout
+// data is lib/checkout-config.ts, the one file to edit.
+// Every refused buy lands here. It never says why: a reason is a probe's
+// answer, and the buyer needs only that nothing was charged.
+// It is served on a spoke only: any other build answers notFound().
+import { SectionRenderer } from "@working-theory/ui/sections";
+import type { PageSection } from "@working-theory/validation";
+import type { Metadata } from "next";
+import { notFound } from "next/navigation";
+import { getTranslations } from "next-intl/server";
+import type { ReactElement } from "react";
+
+import { TOPOLOGY } from "../../../../lib/topology.generated";
+
+interface Props {
+  params: Promise<{ locale: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  if (TOPOLOGY !== "spoke") notFound();
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "checkoutUnavailable" });
+  return { title: t("title"), robots: { index: false, follow: false } };
+}
+
+export default async function Page({ params }: Props): Promise<ReactElement> {
+  if (TOPOLOGY !== "spoke") notFound();
+  const { locale } = await params;
+  const t = await getTranslations({ locale, namespace: "checkoutUnavailable" });
+  const sections: PageSection[] = [
+    {
+      id: "checkout-unavailable",
+      type: "content-block",
+      data: { headline: t("title"), body: t("body") },
+    },
+    {
+      id: "checkout-unavailable-cta",
+      type: "cta",
+      data: {
+        headline: t("ctaHeadline"),
+        primaryCta: { label: t("ctaLabel"), href: "/contact" },
+      },
+    },
+  ];
+  return (
+    <main id="main">
+      <SectionRenderer sections={sections} locale={locale} leadingSectionOwnsTitle />
+    </main>
+  );
+}

package/templates/apps/web/app/[locale]/clients/__tests__/page-renderer-migration.test.tsx

@@ -79,7 +79,7 @@ describe("ClientsPage — snapshot regression", () => {
     });
     const { container } = render(element);
     expect(container.innerHTML).toMatchInlineSnapshot(
-      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Our Clients","description":"Companies that trust us.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Organization"}]}}</script><main id="main"><div><h1>Our Clients</h1><p data-testid="clients-description" class="mt-block-tight text-lead">Companies that trust us.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) hover:bg-(--color-surface-secondary) active:bg-gray-200 rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></div></main>"`,
+      `"<script type="application/ld+json" data-testid="json-ld">{"@context":"https://schema.org","@type":"CollectionPage","inLanguage":"en","name":"Our Clients","description":"Companies that trust us.","mainEntity":{"@type":"ItemList","itemListElement":[{"@type":"Organization"}]}}</script><main id="main"><div><h1>Our Clients</h1><p data-testid="clients-description" class="mt-block-tight text-lead">Companies that trust us.</p><div data-testid="markdown-view-toggle" class="ailk-markdown-view-toggle mt-block-loose"><div class="flex justify-end mb-3"><div role="radiogroup" aria-label="Page view" data-testid="markdown-view-toggle" class="inline-flex items-center gap-0.5 rounded-lg p-1 bg-(--color-surface-secondary)"><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) bg-(--color-bg) text-(--color-fg) shadow-sm" type="button" role="radio" aria-checked="true" aria-label="Rendered" tabindex="0" data-testid="markdown-view-toggle-rendered">Rendered</button><button class="inline-flex items-center justify-center gap-2 font-medium motion-safe:transition motion-safe:duration-(--button-hover-duration) focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 disabled:cursor-not-allowed disabled:opacity-50 [&amp;>svg]:shrink-0 text-(--color-fg) not-disabled:hover:bg-(--button-hover-quiet-bg) not-disabled:hover:text-(--button-hover-quiet-fg) not-disabled:hover:opacity-(--button-hover-opacity) not-disabled:hover:transform-(--button-hover-transform) not-disabled:hover:shadow-(--button-hover-shadow) not-disabled:active:bg-gray-200 not-disabled:active:text-(--color-fg) rounded-control px-control-x h-(--control-height-thin) text-caption leading-none rounded-md px-3 text-body-sm font-medium transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-(--color-accent) focus-visible:ring-offset-1 min-w-(--control-height-thin) min-h-(--control-height-big) text-(--color-text-muted) hover:text-(--color-fg)" type="button" role="radio" aria-checked="false" aria-label="Markdown" tabindex="-1" data-testid="markdown-view-toggle-markdown">Markdown</button></div></div><div role="status" aria-live="polite" aria-atomic="true" class="sr-only" data-testid="markdown-view-toggle-status">Showing Rendered view</div><div data-testid="markdown-view-rendered"><article data-testid="mdx-body"><div data-testid="mdx-remote" data-source=""></div></article></div></div></div></main>"`,
     );
   });
 });

package/templates/apps/web/app/[locale]/contact/ConversationalIntakeWrapper.tsx

@@ -81,7 +81,11 @@ function fireIntakeTurn(input: Parameters<typeof recordIntakeTurn>[0]): void {
     .catch(() => {});
 }
 
-/** Builds the FormData captureLeadAction expects from the engine's answers. */
+/**
+ * Builds the FormData captureLeadAction expects from the engine's answers.
+ * Called only once the terms turn was accepted, so it posts consent=true
+ * (#8730 D2) — the action checks it for every source.
+ */
 function answersToFormData(answers: Record<string, string>): FormData {
   const formData = new FormData();
   if (answers["name"] !== undefined) formData.set("name", answers["name"]);
@@ -89,6 +93,7 @@ function answersToFormData(answers: Record<string, string>): FormData {
   if (answers["message"] !== undefined)
     formData.set("message", answers["message"]);
   formData.set("source", "conversational-intake");
+  formData.set("consent", "true");
   return formData;
 }
 
@@ -116,6 +121,10 @@ export function ConversationalIntakeWrapper({
         messagePrompt: t("intake.messagePrompt"),
         emailAck: t("intake.emailAck"),
         emailPrompt: t("intake.emailPrompt"),
+        consentAck: t("intake.consentAck"),
+        consentPrompt: t("intake.consentPrompt"),
+        consentAccept: t("intake.consentAccept"),
+        consentDecline: t("intake.consentDecline"),
         skipMessage: t("intake.skipMessage"),
         completionMessage: t("intake.completionMessage"),
       }),
@@ -162,6 +171,13 @@ export function ConversationalIntakeWrapper({
         status: "completed",
         locale,
       });
+      // #8730 D2 — the engine records the tapped pill's label; anything but
+      // the accept label is not acceptance, so nothing is sent and the form,
+      // with its own terms box, takes over.
+      if (answers["consent"] !== t("intake.consentAccept")) {
+        fallBackToForm(answers);
+        return;
+      }
       void (async () => {
         const result = await captureLeadAction(null, answersToFormData(answers));
         if (result?.kind !== "success") {
@@ -200,6 +216,13 @@ export function ConversationalIntakeWrapper({
           action={captureLeadAction}
           text={contactFormText(t)}
           termsHref={localeHref(locale, "/terms")}
+          // #8661 D7 — the same three policy links /contact passes, so the
+          // catalog's three-link statement resolves here too.
+          policies={{
+            terms: localeHref(locale, "/terms"),
+            privacy: localeHref(locale, "/privacy"),
+            working_agreement: localeHref(locale, "/working-agreement"),
+          }}
           initialValues={initialValues}
         />
       </Container>

package/templates/apps/web/app/[locale]/contact/__tests__/ConversationalIntakeWrapper.test.tsx

@@ -94,6 +94,11 @@ async function flushMicrotasks(): Promise<void> {
   });
 }
 
+/** #8730 D2 — the intake's own terms turn: tap the accept pill. */
+function acceptTerms(): void {
+  fireEvent.click(screen.getByTestId(`${TEST_ID}-pill-accept`));
+}
+
 function answer(text: string): void {
   const input = screen.getByTestId(`${TEST_ID}-free-text-input`);
   fireEvent.change(input, { target: { value: text } });
@@ -117,16 +122,18 @@ describe("ConversationalIntakeWrapper — completion (AC1)", () => {
     advanceThinking(); // turn 3 (email) revealed
 
     answer("jane@example.com");
+    advanceThinking(); // turn 4 (terms) revealed
+    acceptTerms();
     advanceThinking(); // completion revealed, onComplete fires
 
     expect(mockSubmit).toHaveBeenCalledTimes(1);
     const body = mockSubmit.mock.calls[0][0] as {
-      siteId: string;
       source: string;
       email: string;
       payload: { name: string; message?: string };
     };
-    expect(body.siteId).toBe("default");
+    // #8747 — no siteId: the API names the workspace itself.
+    expect(body).not.toHaveProperty("siteId");
     expect(body.source).toBe("conversational-intake");
     expect(body.email).toBe("jane@example.com");
     expect(body.payload.name).toBe("Jane Smith");
@@ -147,6 +154,8 @@ describe("ConversationalIntakeWrapper — completion (AC1)", () => {
     answer("I'd like a demo.");
     advanceThinking();
     answer("jane@example.com");
+    advanceThinking(); // turn 4 (terms) revealed
+    acceptTerms();
     advanceThinking();
     await flushMicrotasks();
 
@@ -165,6 +174,68 @@ describe("ConversationalIntakeWrapper — completion (AC1)", () => {
   });
 });
 
+describe("ConversationalIntakeWrapper — the intake's own terms turn (#8730 D2)", () => {
+  /** Answers the three open turns and reveals the terms turn. */
+  function reachTerms(): void {
+    render(<ConversationalIntakeWrapper />);
+    advanceThinking();
+    answer("Jane Smith");
+    advanceThinking();
+    answer("I'd like a demo.");
+    advanceThinking();
+    answer("jane@example.com");
+    advanceThinking(); // turn 4 (terms) revealed
+  }
+
+  it("asks for the terms before it submits, offering accept and decline", () => {
+    reachTerms();
+
+    expect(screen.getByText("intake.consentPrompt")).toBeInTheDocument();
+    expect(screen.getByTestId(`${TEST_ID}-pill-accept`)).toHaveTextContent("intake.consentAccept");
+    expect(screen.getByTestId(`${TEST_ID}-pill-decline`)).toHaveTextContent("intake.consentDecline");
+    expect(mockSubmit).not.toHaveBeenCalled();
+  });
+
+  it("accepting submits the lead carrying consent: true", async () => {
+    mockSubmit.mockResolvedValue({ ok: true, body: { id: "lead_abc123", persisted: "db" } });
+
+    reachTerms();
+    acceptTerms();
+    advanceThinking();
+    await flushMicrotasks();
+
+    expect(mockSubmit).toHaveBeenCalledTimes(1);
+    const body = mockSubmit.mock.calls[0][0] as { source: string; consent: unknown };
+    expect(body.source).toBe("conversational-intake");
+    expect(body.consent).toBe(true);
+  });
+
+  it("declining submits nothing and shows the form, prefilled, with its own terms box", async () => {
+    reachTerms();
+    fireEvent.click(screen.getByTestId(`${TEST_ID}-pill-decline`));
+    advanceThinking();
+    await flushMicrotasks();
+
+    expect(mockSubmit).not.toHaveBeenCalled();
+    const stub = screen.getByTestId("contact-form-stub");
+    expect(JSON.parse(stub.getAttribute("data-initial-values") ?? "{}")).toMatchObject({
+      name: "Jane Smith",
+      email: "jane@example.com",
+      message: "I'd like a demo.",
+    });
+  });
+
+  it("typing anything but the accept answer is not acceptance", async () => {
+    reachTerms();
+    answer("sure, whatever");
+    advanceThinking();
+    await flushMicrotasks();
+
+    expect(mockSubmit).not.toHaveBeenCalled();
+    expect(screen.getByTestId("contact-form-stub")).toBeInTheDocument();
+  });
+});
+
 describe("ConversationalIntakeWrapper — Skip (AC2)", () => {
   it("renders the existing form on Skip, carrying over the answers captured so far", () => {
     render(<ConversationalIntakeWrapper />);
@@ -199,6 +270,8 @@ describe("ConversationalIntakeWrapper — per-turn abandonment analytics (AC3)",
     answer("I'd like a demo.");
     advanceThinking();
     answer("jane@example.com");
+    advanceThinking(); // turn 4 (terms) revealed
+    acceptTerms();
     advanceThinking();
     await flushMicrotasks(); // recordIntakeTurn is dispatched on a later microtask (#6465)
 
@@ -211,10 +284,10 @@ describe("ConversationalIntakeWrapper — per-turn abandonment analytics (AC3)",
       true,
     );
     const inProgress = calls.filter((c) => c.status === "in_progress");
-    expect(inProgress.map((c) => c.turnIndex)).toEqual([1, 2, 3, 4]);
+    expect(inProgress.map((c) => c.turnIndex)).toEqual([1, 2, 3, 4, 5]);
 
     const terminal = calls[calls.length - 1];
-    expect(terminal).toMatchObject({ status: "completed", turnIndex: 4 });
+    expect(terminal).toMatchObject({ status: "completed", turnIndex: 5 });
 
     // PII-free: only turnIndex/status/locale ever leave the client.
     for (const call of mockTrack.mock.calls) {
@@ -317,6 +390,8 @@ describe("ConversationalIntakeWrapper — a failing analytics call never strands
     answer("I'd like a demo.");
     advanceThinking();
     answer("jane@example.com");
+    advanceThinking(); // turn 4 (terms) revealed
+    acceptTerms();
     advanceThinking(); // completion revealed, onComplete fires
     await flushMicrotasks();