create-ailk 0.20.0 → 0.22.0

package/templates/apps/web/app/[locale]/contact/contact-form-magnet.ts

@@ -0,0 +1,77 @@
+/**
+ * contactFormFromConfig — a Contact form magnet's config, as the shared
+ * `LeadCaptureForm` block renders it (#8661 D6).
+ *
+ * Reads the config's first step, which must be a `field` step (a config that
+ * opens with any other step is not a contact form). Answers `null` unless that
+ * step holds fields named `name` and `email`, because `captureLeadAction` needs both;
+ * the page then falls back (section fields, else the built-in config).
+ *
+ * Each `text`, `email`, `tel`, `url`, `textarea` or `select` field is mapped,
+ * in order. `name` and `email` sit side by side (`colSpan: 1`, the built-in
+ * pairing); every other field runs full width. The step's first `consent`
+ * field is the terms statement (its label), and its `copy.cta` the submit
+ * label. Other `consent` fields and `address` fields are not rendered.
+ *
+ * Copy resolves with the one LocalizedString rule every flow surface shares
+ * (`resolveLocalizedString`). Pure: no fetch, no React.
+ */
+import type { ContactFormField } from "@working-theory/ui";
+import { resolveLocalizedString, type FlowConfig } from "@working-theory/validation";
+
+export interface ContactFormView {
+  fields: ContactFormField[];
+  /** The step's first consent field's label — `[Label](key)` tokens intact. */
+  consentStatement?: string;
+  /** The step's `copy.cta`. */
+  submitLabel?: string;
+}
+
+type FieldStep = Extract<FlowConfig["steps"][number], { type: "field" }>;
+type FieldDef = FieldStep["fields"][number];
+
+const RENDERED_TYPES = ["text", "email", "tel", "url", "textarea", "select"] as const;
+type RenderedType = (typeof RENDERED_TYPES)[number];
+
+function isRendered(type: FieldDef["inputType"]): type is RenderedType {
+  return (RENDERED_TYPES as readonly string[]).includes(type);
+}
+
+export function contactFormFromConfig(
+  config: FlowConfig,
+  locale: string,
+): ContactFormView | null {
+  const step = config.steps[0];
+  if (step?.type !== "field") return null;
+  const names = new Set(step.fields.map((f) => f.name));
+  if (!names.has("name") || !names.has("email")) return null;
+
+  const resolve = (value: Record<string, string>): string =>
+    resolveLocalizedString(value, locale, config.defaultLocale);
+
+  const fields: ContactFormField[] = [];
+  for (const field of step.fields) {
+    if (!isRendered(field.inputType)) continue;
+    fields.push({
+      name: field.name,
+      type: field.inputType,
+      label: resolve(field.copy.label),
+      required: field.required ?? false,
+      ...(field.copy.placeholder !== undefined && {
+        placeholder: resolve(field.copy.placeholder),
+      }),
+      ...(field.copy.help !== undefined && { helpText: resolve(field.copy.help) }),
+      ...(field.options !== undefined && {
+        options: field.options.map((o) => ({ value: o.value, label: resolve(o.label) })),
+      }),
+      colSpan: field.name === "name" || field.name === "email" ? 1 : 2,
+    });
+  }
+
+  const consent = step.fields.find((f) => f.inputType === "consent");
+  return {
+    fields,
+    ...(consent !== undefined && { consentStatement: resolve(consent.copy.label) }),
+    ...(step.copy.cta !== undefined && { submitLabel: resolve(step.copy.cta) }),
+  };
+}

package/templates/apps/web/app/[locale]/contact/contact-form-text.ts

@@ -20,6 +20,7 @@ type ContactTextKey =
   | "successMessage"
   | "genericError"
   | "consentStatement"
+  | "consentRequired"
   | "unavailableHeading"
   | "unavailableBody"
   | "unavailableNoEmail";
@@ -43,6 +44,7 @@ export function contactFormText(t: ContactTranslator): LeadCaptureFormText {
     success: t("successMessage"),
     genericError: t("genericError"),
     consentStatement: t("consentStatement"),
+    consentRequired: t("consentRequired"),
     unavailableHeading: t("unavailableHeading"),
     unavailableBody: t("unavailableBody", KEEP_EMAIL_PLACEHOLDER),
     unavailableNoEmail: t("unavailableNoEmail"),

package/templates/apps/web/app/[locale]/contact/contact.actions.ts

@@ -10,13 +10,26 @@
  * Canonical filename: contact.actions.ts (*.actions.ts per ADR 0013 / U0 spec
  * parity-test regex `ACTION_FILE_RE = /\.actions\.ts$/`).
  *
- * Rate-limit enforcement lives in apps/api; the honeypot is checked here.
+ * The honeypot is checked here, and so is a per-visitor limit (#8747): 30
+ * calls per 10 minutes per visitor address, before the write. From a server
+ * action the hub sees this site's egress address, so one visitor could
+ * otherwise drain the hub's per-IP budget for every visitor of the site. With
+ * no readable address the limit is skipped, never shared. The hub keeps its
+ * own per-IP limit on the route.
+ *
+ * The write (#8747): every lead goes through `writeLead`, the site's lead
+ * writer (`src/lib/lead-write.ts`), which marks it `payload.site =
+ * AILK_LEAD_SITE` and `payload.page = "contact"` (spread last, so no form field
+ * can override them) and sends no `siteId` — the API names the workspace
+ * itself, from the spoke key on a hub or its own site alias otherwise.
  *
  * Outcome (#6730 D8): the API's 503 `lead_capture_not_configured` — this
  * deployment has nowhere to put a lead — maps to `{ kind: "unavailable" }`,
- * which the shared `LeadCaptureForm` renders as the site's contact email.
- * Every other non-2xx and every thrown error is the generic `error`; only a
- * 2xx is ever `success`.
+ * which the shared `LeadCaptureForm` renders as the site's contact email. So
+ * does an API that cannot be reached (#8747): a thrown submit, a 502 or a 504
+ * — the message reached nobody, so the visitor is shown the email rather than
+ * a "try again". Every other non-2xx is the generic `error`; only a 2xx is
+ * ever `success`.
  *
  * Extra fields (#6730 D8a): a `contact-form` section can declare fields
  * beyond name/email/message/phone (a `select`, say). Every other string
@@ -33,8 +46,25 @@
  * second `*Action`-suffixed export, which would trip
  * `apps/mcp/__tests__/parity.test.ts`'s Server-Action↔MCP-tool 1:1 count for
  * a capability (lead capture) this repo already has an MCP twin for
- * (`ailkCaptureLead`). Absent (the real `<form>` never sets it) → defaults
- * to `"web"`, unchanged from before.
+ * (`ailkCaptureLead`). Absent (the real `<form>` never sets it) → the
+ * built-in form's one standard source, `"contact-form"` (#8747; it was
+ * `"web"`, and the sites disagreed).
+ *
+ * Source allow-list and terms (#8661 D8, #8730): `/contact` stamps a
+ * submission it drew from the Contact form magnet with a hidden `source` of
+ * `"flow:contact"`, so it lands as an Inbox submission of that magnet (it
+ * reaches the Needs-you queue through the submissions read, not the message
+ * list — `flow:<slug>` is never a message source). The field is
+ * visitor-controlled, so only the contact sources (`CONTACT_LEAD_SOURCES`:
+ * `"contact-form"`, `"conversational-intake"`, `"flow:contact"`) are kept;
+ * anything else is sent as `"contact-form"`, a message source, so no
+ * visitor-set value drops a real message out of Needs-you. The source picks
+ * the stamp and never the gate (#8730 D2): EVERY post must carry
+ * `consent=true` — the form's terms box, or the intake's own terms turn — or
+ * it answers a `consent` field error, merged with the schema's, and nothing
+ * is sent. An accepted post tells the API so (`consent: true`, which the API
+ * requires of a contact lead and records on it); an API `400
+ * consent_required` is shown as the same field error.
  *
  * Visitor forwarding (#7394): on a spoke whose API is a hub, the call
  * carries the visitor's IP and the spoke's `AILK_VISITOR_FORWARD_KEY`
@@ -43,16 +73,53 @@
  * of the spoke host's. No key, no client address, or headers that cannot be
  * read → the call is made with one argument, exactly as before; a failure to
  * read headers never blocks a submission.
+ *
+ * The account link (#8757 D8): after a successful write, the API's 201 may
+ * carry `next` (D6). `{ completion: "invite" }` — the magnet invites the
+ * submitter to their account — answers `{ kind: "success", next: { href,
+ * label } }`, the href from `accountInviteHref` (the request's locale, the
+ * submitter's email, this site's sign-in provider) and the label the
+ * `contact.trackInAccount` message. Anything else — no `next`, a site with no
+ * sign-in, an email the hint schema refuses, a locale or message that cannot
+ * be read — answers exactly `{ kind: "success" }`: a written lead is never
+ * reported as a failure.
+ *
+ * Continue to checkout (#8757 D11): `{ completion: "checkout",
+ * checkoutOffering }` — the magnet sends the submitter on to the offering's
+ * standard checkout — calls `redirect("/api/checkout/<checkoutOffering>")`
+ * (a Server Action redirect, a 303). It runs only after the write resolved
+ * `ok`, and outside any `try`, since `redirect()` throws NEXT_REDIRECT by
+ * design (`checkout.actions.ts`'s rule). The key is re-checked with
+ * `flowCheckoutOfferingSchema` first; one that fails answers `{ kind:
+ * "success" }`, as `lead` does. The standard checkout is served on a spoke
+ * only (`TOPOLOGY`), so any other build answers `{ kind: "success" }` too,
+ * never a redirect to a 404. A failed write never redirects.
  */
 
-import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { visitorForwardHeaders } from "@working-theory/api-client";
 import { LEAD_CAPTURE_HONEYPOT, type LeadCaptureFormState } from "@working-theory/ui";
-import { submitLeadInputSchema } from "@working-theory/validation";
+import {
+  CONTACT_LEAD_SOURCES,
+  flowCheckoutOfferingSchema,
+  leadSubmitNextSchema,
+  submitLeadInputSchema,
+} from "@working-theory/validation";
 import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { getLocale, getTranslations } from "next-intl/server";
 
+import { accountInviteHref } from "../../../lib/account-invite";
 import { consentVisitorHeader, readConsentVisitor } from "../../../lib/consent-visitor";
+import { TOPOLOGY } from "../../../lib/topology.generated";
+import { writeLead } from "../../../src/lib/lead-write";
+import { checkRateLimit, clientIpFromHeaders } from "../../../src/lib/rate-limit";
 
 const GENERIC_ERROR = "Something went wrong, please try again.";
+const RATE_LIMITED = "Too many messages from here. Please try again in a few minutes.";
+
+/** The per-visitor budget (#8747): the consumer sites' own values. */
+const RATE_LIMIT_MAX_CALLS = 30;
+const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
 
 /** Field names the action reads itself — never copied into `payload`. */
 const RESERVED_FIELDS = new Set([
@@ -65,6 +132,11 @@ const RESERVED_FIELDS = new Set([
   "source",
 ]);
 const MAX_EXTRA_FIELDS = 20;
+
+/** The built-in form's source (#8747), and the one an unlisted value becomes. */
+const DEFAULT_SOURCE = "contact-form";
+/** The server's terms-error text. The form block shows its own copy for this key. */
+const CONSENT_REQUIRED = "Please accept the terms to send your message.";
 const MAX_EXTRA_FIELD_LENGTH = 2000;
 
 /**
@@ -85,6 +157,16 @@ function extraFields(formData: FormData): Record<string, string> | null {
   return extra;
 }
 
+/** A 400 whose body names `consent_required` (#8730). */
+function isConsentRequired(res: { status: number; body: unknown }): boolean {
+  return (
+    res.status === 400 &&
+    typeof res.body === "object" &&
+    res.body !== null &&
+    (res.body as { error?: unknown }).error === "consent_required"
+  );
+}
+
 /** A 503 whose body names `lead_capture_not_configured`. */
 function isNotConfigured(res: { status: number; body: unknown }): boolean {
   return (
@@ -95,6 +177,51 @@ function isNotConfigured(res: { status: number; body: unknown }): boolean {
   );
 }
 
+/**
+ * The API could not be reached (#8747): `writeLead`'s `status: 0` (a thrown
+ * submit) or a gateway failure. A 503 that is not `lead_capture_not_configured`
+ * stays the generic error — the API answered.
+ */
+function isApiUnreachable(res: { status: number }): boolean {
+  return res.status === 0 || res.status === 502 || res.status === 504;
+}
+
+/**
+ * #8757 D11 — the offering a `checkout` answer names, when its key passes the
+ * schema and this build serves the standard checkout (a spoke); else `null`.
+ */
+function checkoutOfferingOf(next: unknown): string | null {
+  if (TOPOLOGY !== "spoke") return null;
+  const parsed = leadSubmitNextSchema.safeParse(next);
+  if (!parsed.success || parsed.data.completion !== "checkout") return null;
+  const key = flowCheckoutOfferingSchema.safeParse(parsed.data.checkoutOffering);
+  return key.success ? key.data : null;
+}
+
+/**
+ * #8757 D8 — the success state for a written lead: with the account link when
+ * the API answered `next: { completion: "invite" }` and this site can build
+ * one, else exactly `{ kind: "success" }`. Never throws.
+ */
+async function successState(next: unknown, email: string): Promise<LeadCaptureFormState> {
+  const parsed = leadSubmitNextSchema.safeParse(next);
+  if (!parsed.success || parsed.data.completion !== "invite") return { kind: "success" };
+  let locale = "en";
+  try {
+    locale = await getLocale();
+  } catch {
+    // No request-scoped locale — the default locale's link.
+  }
+  const href = accountInviteHref(locale, email);
+  if (href === null) return { kind: "success" };
+  try {
+    const t = await getTranslations("contact");
+    return { kind: "success", next: { href, label: t("trackInAccount") } };
+  } catch {
+    return { kind: "success" };
+  }
+}
+
 export async function captureLeadAction(
   _prevState: LeadCaptureFormState,
   formData: FormData,
@@ -112,15 +239,27 @@ export async function captureLeadAction(
     phone: formData.get("phone") ?? undefined,
   };
 
+  const posted = formData.get("source");
+  const source =
+    typeof posted === "string" && CONTACT_LEAD_SOURCES.has(posted) ? posted : DEFAULT_SOURCE;
+
+  // #8730 D2 — every source, the intake's included: it asks for the terms
+  // itself and posts consent=true like the form does.
+  const fieldErrors: Record<string, string> = {};
+  if (formData.get("consent") !== "true") {
+    fieldErrors.consent = CONSENT_REQUIRED;
+  }
+
   const parsed = submitLeadInputSchema.safeParse(raw);
   if (!parsed.success) {
-    const fieldErrors: Record<string, string> = {};
     for (const issue of parsed.error.issues) {
       const field = String(issue.path[0] ?? "form");
       if (!fieldErrors[field]) {
         fieldErrors[field] = issue.message;
       }
     }
+  }
+  if (!parsed.success || Object.keys(fieldErrors).length > 0) {
     return { kind: "error", fieldErrors };
   }
 
@@ -128,29 +267,35 @@ export async function captureLeadAction(
   if (extra === null) return { kind: "error", message: GENERIC_ERROR };
 
   const { name, email, message, phone } = parsed.data;
-  const siteId = process.env.AILK_SITE_ID ?? "default";
-  const source = (formData.get("source") as string | null) || "web";
-  const body = {
-    siteId,
-    source,
-    email,
-    payload: {
-      ...extra,
-      name,
-      ...(message !== undefined && { message }),
-      ...(phone !== undefined && { phone }),
-    },
+  const payload = {
+    ...extra,
+    name,
+    ...(message !== undefined && { message }),
+    ...(phone !== undefined && { phone }),
   };
 
-  let init: { headers: Record<string, string> } | undefined;
+  let requestHeaders: Awaited<ReturnType<typeof headers>> | undefined;
   try {
-    const forwarded = visitorForwardHeaders(
-      await headers(),
-      process.env.AILK_VISITOR_FORWARD_KEY,
-    );
-    if (forwarded) init = { headers: forwarded };
+    requestHeaders = await headers();
   } catch {
-    // No request scope to read — submit without forwarding.
+    // No request scope to read — no forwarding, and the visitor is "unknown".
+  }
+
+  // No readable address: skip the per-visitor limit rather than put every
+  // visitor in one shared bucket a single caller could fill. The hub's own
+  // per-IP limit still applies.
+  const visitor = requestHeaders ? clientIpFromHeaders(requestHeaders) : "unknown";
+  if (
+    visitor !== "unknown" &&
+    !checkRateLimit(`contact:${visitor}`, RATE_LIMIT_MAX_CALLS, RATE_LIMIT_WINDOW_MS)
+  ) {
+    return { kind: "error", message: RATE_LIMITED };
+  }
+
+  let init: { headers: Record<string, string> } | undefined;
+  if (requestHeaders) {
+    const forwarded = visitorForwardHeaders(requestHeaders, process.env.AILK_VISITOR_FORWARD_KEY);
+    if (forwarded) init = { headers: forwarded };
   }
 
   // #8438 D12 — the banner's visitor id, so a later form submit links its
@@ -163,20 +308,18 @@ export async function captureLeadAction(
     // No request scope to read — submit with no visitor-link header.
   }
 
-  try {
-    const res = init ? await leads.submit(body, init) : await leads.submit(body);
-    if (!res.ok) {
-      if (isNotConfigured(res)) return { kind: "unavailable" };
-      return { kind: "error", message: GENERIC_ERROR };
+  // writeLead never throws: a thrown submit is logged there by error name
+  // only, with no field values (#4042), and resolves as `status: 0`.
+  const res = await writeLead({ source, email, page: "contact", consent: true, payload }, init);
+  if (!res.ok) {
+    if (isConsentRequired(res)) {
+      return { kind: "error", fieldErrors: { consent: CONSENT_REQUIRED } };
     }
-    return { kind: "success" };
-  } catch (err) {
-    // Log server-side for observability (#4042, sibling of flow.actions.ts's
-    // #3989 fix). The api-client's post() never attaches the request payload
-    // to a thrown error (packages/api-client/src/http.ts), so logging `err`
-    // itself is safe — no submitted form fields (name/email/message/phone)
-    // are included.
-    console.error("[captureLeadAction]", err);
+    if (isNotConfigured(res) || isApiUnreachable(res)) return { kind: "unavailable" };
     return { kind: "error", message: GENERIC_ERROR };
   }
+  // #8757 D11 — after the write, outside any try: redirect() throws by design.
+  const checkoutOffering = checkoutOfferingOf(res.body.next);
+  if (checkoutOffering !== null) redirect(`/api/checkout/${checkoutOffering}`);
+  return successState(res.body.next, email);
 }

package/templates/apps/web/app/[locale]/contact/intake-script.ts

@@ -11,6 +11,12 @@
  * ids ARE the submission adapter's field-mapping contract; renaming a
  * question id here requires updating that mapping too.
  *
+ * A fourth, closed question (`consent`, #8730 D2) asks for the terms before
+ * anything is sent. The engine records a tapped pill as its LABEL, so the
+ * wrapper treats the answer as acceptance only when it equals
+ * `copy.consentAccept` exactly; any other answer — the decline pill or typed
+ * text — sends nothing and shows the form, whose own terms box decides.
+ *
  * Copy is translated (next-intl "contact" namespace, "intake.*" keys —
  * see apps/web/messages/en.json) rather than hardcoded, consistent with
  * ContactForm's own `useTranslations("contact")` usage. The wrapper resolves
@@ -31,10 +37,18 @@ export interface ContactIntakeCopy {
   messagePrompt: string;
   emailAck: string;
   emailPrompt: string;
+  consentAck: string;
+  consentPrompt: string;
+  /** The accept pill's label — the one answer that is terms acceptance. */
+  consentAccept: string;
+  consentDecline: string;
   skipMessage: string;
   completionMessage: string;
 }
 
+/** The accept option's value — its pill's test id is `…-pill-accept`. */
+const INTAKE_CONSENT_ACCEPT = "accept";
+
 export function buildContactIntakeScript(
   copy: ContactIntakeCopy,
 ): IntakeScript {
@@ -59,6 +73,18 @@ export function buildContactIntakeScript(
         acknowledgement: copy.emailAck,
         prompt: copy.emailPrompt,
       },
+      // #8730 D2 — the intake asks for the terms itself. Only the accept
+      // pill's label is acceptance; the wrapper reads `consent` by that id.
+      {
+        id: "consent",
+        kind: "closed",
+        acknowledgement: copy.consentAck,
+        prompt: copy.consentPrompt,
+        options: [
+          { value: INTAKE_CONSENT_ACCEPT, label: copy.consentAccept },
+          { value: "decline", label: copy.consentDecline },
+        ],
+      },
     ],
     skip: { message: copy.skipMessage },
     completion: { message: copy.completionMessage },

package/templates/apps/web/app/[locale]/contact/page.tsx

@@ -11,10 +11,31 @@
 // API, an older API without the status route, or any other failed read is
 // treated as accepting: the form renders, and its submit reports honestly.
 //
+// The form's fields (#8661 D6), first usable wins: the workspace's Contact
+// form magnet (`flows.get("contact")`, the public flow read — the API resolves
+// the workspace, the site alias keyless and a spoke by its key); else the
+// page's `contact-form` section fields when it declares any; else the
+// built-in form: the seeded magnet's own config, its name, email and message
+// labels from the `contact` catalog. The submit label is the magnet's, else
+// the section's; the success message is the section's. A magnet-driven
+// post is stamped `source: "flow:contact"`, so it is an Inbox submission of
+// the Contact form; the other two post as `contact-form` (#8747). The page is rendered on
+// every request, but its two hub reads (the magnet and the capture status) are
+// shared across requests for HUB_READ_TTL_MS (#8731): a visitor view carries no
+// forwarding headers, so on a spoke every view would otherwise count against
+// the spoke server's one per-IP limit at the hub. An Admin edit shows within
+// that window. The terms statement
+// links Terms, Privacy Policy and Working Agreement from a page-built map —
+// a magnet label can name a link key, never an href.
+//
+// A `contact-form` section in the `column` variant (the minimalism Contact
+// page, #8661 D12) gets the stacked form look and a Send that stays enabled,
+// gating the terms box on submit instead.
+//
 // The chat-style intake (ConversationalIntakeWrapper, #4534) remains
 // available to a site that prefers it. JSON-LD and translations handled by
 // renderPage.
-import { leads } from "@working-theory/api-client";
+import { flows, leads } from "@working-theory/api-client";
 import type {
   getMdxSource as defaultGetMdxSource,
   getPageSections as defaultGetPageSections,
@@ -29,17 +50,26 @@ import {
   ContactFallback,
   type ContactFormField,
   LeadCaptureForm,
+  type LeadCaptureFormText,
   localeHref,
 } from "@working-theory/ui";
+import {
+  CONTACT_FORM_FLOW_SLUG,
+  contactFormFlowConfig,
+  flowLeadSource,
+  type FlowConfig,
+} from "@working-theory/validation";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { contactFormFromConfig } from "./contact-form-magnet";
 import { contactFormText } from "./contact-form-text";
 import { captureLeadAction } from "./contact.actions";
 import { readSiteContactEmail } from "./site-contact-email";
 
-export const revalidate = 60;
+// #8661 D6 — rendered on every request; the magnet read behind it is shared for HUB_READ_TTL_MS (#8731).
+export const dynamic = "force-dynamic";
 
 interface Props {
   params: Promise<{ locale: string }>;
@@ -72,14 +102,72 @@ function sectionFields(section: ContactFormSection): ContactFormField[] {
   }));
 }
 
+const BUILT_IN_LABELS = { name: "nameLabel", email: "emailLabel", message: "messageLabel" } as const;
+
+/**
+ * The built-in form: the seeded magnet's own fields, with the labels the
+ * `contact` catalog carries (name, email, message) taken from it, so a
+ * translated site keeps its translated form when the magnet is absent.
+ */
+function builtInFields(text: LeadCaptureFormText, locale: string): ContactFormField[] {
+  const view = contactFormFromConfig(contactFormFlowConfig, locale);
+  return (view?.fields ?? []).map((f) => {
+    const key = BUILT_IN_LABELS[f.name as keyof typeof BUILT_IN_LABELS];
+    return key ? { ...f, label: text[key] } : f;
+  });
+}
+
+/**
+ * How long the two hub reads are shared across requests (#8731). Short, so an
+ * Admin edit to the magnet shows within seconds; long enough that a burst of
+ * views makes one read of each, not one per view.
+ */
+const HUB_READ_TTL_MS = 15_000;
+
+const hubReads = new Map<string, { at: number; read: Promise<unknown> }>();
+
+/**
+ * `read()`'s result, shared per instance for HUB_READ_TTL_MS. Concurrent calls
+ * share one in-flight read. A read that settles to `null` (any failed read,
+ * see the two readers below) is shared the same way, so a burst against an
+ * unreachable hub is not a burst of retries.
+ */
+function sharedHubRead<T>(key: string, read: () => Promise<T>): Promise<T> {
+  const now = Date.now();
+  const hit = hubReads.get(key);
+  if (hit && now - hit.at < HUB_READ_TTL_MS) return hit.read as Promise<T>;
+  const fresh = read();
+  hubReads.set(key, { at: now, read: fresh });
+  return fresh;
+}
+
 /** The API's capture status, or `null` for any failed read (see header). */
-async function readCaptureStatus(): Promise<CaptureStatus | null> {
-  try {
-    const res = await leads.captureStatus();
-    return res.ok && res.body.ok === true ? res.body.data : null;
-  } catch {
-    return null;
-  }
+function readCaptureStatus(): Promise<CaptureStatus | null> {
+  return sharedHubRead("capture-status", async () => {
+    try {
+      const res = await leads.captureStatus();
+      return res.ok && res.body.ok === true ? res.body.data : null;
+    } catch {
+      return null;
+    }
+  });
+}
+
+/**
+ * The served Contact form magnet's config, or `null` for any failed read: a
+ * non-2xx (absent, draft, a build with no flow route) or a throw. The
+ * property access sits inside the `try`, so a client with no `flows` is a
+ * failed read too.
+ */
+function readContactMagnet(): Promise<FlowConfig | null> {
+  return sharedHubRead("contact-magnet", async () => {
+    try {
+      const res = await flows.get(CONTACT_FORM_FLOW_SLUG);
+      return res.ok ? res.body : null;
+    } catch {
+      return null;
+    }
+  });
 }
 
 export async function generateMetadata({
@@ -95,9 +183,10 @@ export default async function Page({
   getPageSections,
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
-  const [status, t] = await Promise.all([
+  const [status, t, magnet] = await Promise.all([
     readCaptureStatus(),
     getTranslations({ locale, namespace: "contact" }),
+    readContactMagnet(),
   ]);
   const accepting = status?.contact ?? true;
   const contactEmail = readSiteContactEmail();
@@ -115,17 +204,32 @@ export default async function Page({
     formSection?.id ??
     (lead?.type === "hero" && lead.data.variant === "split" ? lead.id : undefined);
 
+  // #8661 D6 — the magnet's fields, else the section's, else the built-in form.
+  const served = magnet ? contactFormFromConfig(magnet, locale) : null;
+  const declared = formSection && formSection.data.fields.length > 0 ? formSection : undefined;
+  const fields: ContactFormField[] =
+    served?.fields ?? (declared ? sectionFields(declared) : builtInFields(text, locale));
+  // A magnet's own submit label wins; the section's copy fills what it leaves.
+  const submitLabel = served?.submitLabel ?? formSection?.data.submitLabel;
+  const successMessage = formSection?.data.successMessage;
+  const column = formSection?.data.variant === "column";
+
   const surface = accepting ? (
     <LeadCaptureForm
       action={captureLeadAction}
-      text={text}
+      text={served?.consentStatement ? { ...text, consentStatement: served.consentStatement } : text}
       termsHref={localeHref(locale, "/terms")}
+      policies={{
+        terms: localeHref(locale, "/terms"),
+        privacy: localeHref(locale, "/privacy"),
+        working_agreement: localeHref(locale, "/working-agreement"),
+      }}
       fallbackEmail={fallbackEmail}
-      {...(formSection && {
-        fields: sectionFields(formSection),
-        submitLabel: formSection.data.submitLabel,
-        successMessage: formSection.data.successMessage,
-      })}
+      fields={fields}
+      submitLabel={submitLabel}
+      successMessage={successMessage}
+      {...(served && { source: flowLeadSource(CONTACT_FORM_FLOW_SLUG) })}
+      {...(column && { look: "column" as const, consentGate: "on-submit" as const })}
     />
   ) : (
     <ContactFallback