create-ailk 0.21.0 → 0.23.0

package/templates/apps/web/app/[locale]/contact/contact.actions.ts

@@ -10,13 +10,26 @@
  * Canonical filename: contact.actions.ts (*.actions.ts per ADR 0013 / U0 spec
  * parity-test regex `ACTION_FILE_RE = /\.actions\.ts$/`).
  *
- * Rate-limit enforcement lives in apps/api; the honeypot is checked here.
+ * The honeypot is checked here, and so is a per-visitor limit (#8747): 30
+ * calls per 10 minutes per visitor address, before the write. From a server
+ * action the hub sees this site's egress address, so one visitor could
+ * otherwise drain the hub's per-IP budget for every visitor of the site. With
+ * no readable address the limit is skipped, never shared. The hub keeps its
+ * own per-IP limit on the route.
+ *
+ * The write (#8747): every lead goes through `writeLead`, the site's lead
+ * writer (`src/lib/lead-write.ts`), which marks it `payload.site =
+ * AILK_LEAD_SITE` and `payload.page = "contact"` (spread last, so no form field
+ * can override them) and sends no `siteId` — the API names the workspace
+ * itself, from the spoke key on a hub or its own site alias otherwise.
  *
  * Outcome (#6730 D8): the API's 503 `lead_capture_not_configured` — this
  * deployment has nowhere to put a lead — maps to `{ kind: "unavailable" }`,
- * which the shared `LeadCaptureForm` renders as the site's contact email.
- * Every other non-2xx and every thrown error is the generic `error`; only a
- * 2xx is ever `success`.
+ * which the shared `LeadCaptureForm` renders as the site's contact email. So
+ * does an API that cannot be reached (#8747): a thrown submit, a 502 or a 504
+ * — the message reached nobody, so the visitor is shown the email rather than
+ * a "try again". Every other non-2xx is the generic `error`; only a 2xx is
+ * ever `success`.
  *
  * Extra fields (#6730 D8a): a `contact-form` section can declare fields
  * beyond name/email/message/phone (a `select`, say). Every other string
@@ -33,17 +46,25 @@
  * second `*Action`-suffixed export, which would trip
  * `apps/mcp/__tests__/parity.test.ts`'s Server-Action↔MCP-tool 1:1 count for
  * a capability (lead capture) this repo already has an MCP twin for
- * (`ailkCaptureLead`). Absent (the real `<form>` never sets it) → defaults
- * to `"web"`, unchanged from before.
+ * (`ailkCaptureLead`). Absent (the real `<form>` never sets it) → the
+ * built-in form's one standard source, `"contact-form"` (#8747; it was
+ * `"web"`, and the sites disagreed).
  *
- * Source allow-list and terms (#8661 D8): `/contact` stamps a submission it
- * drew from the Contact form magnet with a hidden `source` of
- * `"flow:contact"`, so it lands as an Inbox submission of that magnet. The
- * field is visitor-controlled, so only `"web"`, `"conversational-intake"` and
- * `"flow:contact"` are kept; anything else is sent as `"web"`. And the terms
- * box is checked here, not only by the client: unless the source is the
- * intake (which renders no box), a post without `consent=true` answers a
- * `consent` field error, merged with the schema's, and nothing is sent.
+ * Source allow-list and terms (#8661 D8, #8730): `/contact` stamps a
+ * submission it drew from the Contact form magnet with a hidden `source` of
+ * `"flow:contact"`, so it lands as an Inbox submission of that magnet (it
+ * reaches the Needs-you queue through the submissions read, not the message
+ * list — `flow:<slug>` is never a message source). The field is
+ * visitor-controlled, so only the contact sources (`CONTACT_LEAD_SOURCES`:
+ * `"contact-form"`, `"conversational-intake"`, `"flow:contact"`) are kept;
+ * anything else is sent as `"contact-form"`, a message source, so no
+ * visitor-set value drops a real message out of Needs-you. The source picks
+ * the stamp and never the gate (#8730 D2): EVERY post must carry
+ * `consent=true` — the form's terms box, or the intake's own terms turn — or
+ * it answers a `consent` field error, merged with the schema's, and nothing
+ * is sent. An accepted post tells the API so (`consent: true`, which the API
+ * requires of a contact lead and records on it); an API `400
+ * consent_required` is shown as the same field error.
  *
  * Visitor forwarding (#7394): on a spoke whose API is a hub, the call
  * carries the visitor's IP and the spoke's `AILK_VISITOR_FORWARD_KEY`
@@ -52,20 +73,53 @@
  * of the spoke host's. No key, no client address, or headers that cannot be
  * read → the call is made with one argument, exactly as before; a failure to
  * read headers never blocks a submission.
+ *
+ * The account link (#8757 D8): after a successful write, the API's 201 may
+ * carry `next` (D6). `{ completion: "invite" }` — the magnet invites the
+ * submitter to their account — answers `{ kind: "success", next: { href,
+ * label } }`, the href from `accountInviteHref` (the request's locale, the
+ * submitter's email, this site's sign-in provider) and the label the
+ * `contact.trackInAccount` message. Anything else — no `next`, a site with no
+ * sign-in, an email the hint schema refuses, a locale or message that cannot
+ * be read — answers exactly `{ kind: "success" }`: a written lead is never
+ * reported as a failure.
+ *
+ * Continue to checkout (#8757 D11): `{ completion: "checkout",
+ * checkoutOffering }` — the magnet sends the submitter on to the offering's
+ * standard checkout — calls `redirect("/api/checkout/<checkoutOffering>")`
+ * (a Server Action redirect, a 303). It runs only after the write resolved
+ * `ok`, and outside any `try`, since `redirect()` throws NEXT_REDIRECT by
+ * design (`checkout.actions.ts`'s rule). The key is re-checked with
+ * `flowCheckoutOfferingSchema` first; one that fails answers `{ kind:
+ * "success" }`, as `lead` does. The standard checkout is served on a spoke
+ * only (`TOPOLOGY`), so any other build answers `{ kind: "success" }` too,
+ * never a redirect to a 404. A failed write never redirects.
  */
 
-import { leads, visitorForwardHeaders } from "@working-theory/api-client";
+import { visitorForwardHeaders } from "@working-theory/api-client";
 import { LEAD_CAPTURE_HONEYPOT, type LeadCaptureFormState } from "@working-theory/ui";
 import {
-  CONTACT_FORM_FLOW_SLUG,
-  flowLeadSource,
+  CONTACT_LEAD_SOURCES,
+  flowCheckoutOfferingSchema,
+  leadSubmitNextSchema,
   submitLeadInputSchema,
 } from "@working-theory/validation";
 import { cookies, headers } from "next/headers";
+import { redirect } from "next/navigation";
+import { getLocale, getTranslations } from "next-intl/server";
 
+import { accountInviteHref } from "../../../lib/account-invite";
 import { consentVisitorHeader, readConsentVisitor } from "../../../lib/consent-visitor";
+import { TOPOLOGY } from "../../../lib/topology.generated";
+import { writeLead } from "../../../src/lib/lead-write";
+import { checkRateLimit, clientIpFromHeaders } from "../../../src/lib/rate-limit";
 
 const GENERIC_ERROR = "Something went wrong, please try again.";
+const RATE_LIMITED = "Too many messages from here. Please try again in a few minutes.";
+
+/** The per-visitor budget (#8747): the consumer sites' own values. */
+const RATE_LIMIT_MAX_CALLS = 30;
+const RATE_LIMIT_WINDOW_MS = 10 * 60 * 1000;
 
 /** Field names the action reads itself — never copied into `payload`. */
 const RESERVED_FIELDS = new Set([
@@ -79,13 +133,8 @@ const RESERVED_FIELDS = new Set([
 ]);
 const MAX_EXTRA_FIELDS = 20;
 
-/** The only sources a form post may stamp (#8661 D8); anything else is `"web"`. */
-const ALLOWED_SOURCES = new Set([
-  "web",
-  "conversational-intake",
-  flowLeadSource(CONTACT_FORM_FLOW_SLUG),
-]);
-const INTAKE_SOURCE = "conversational-intake";
+/** The built-in form's source (#8747), and the one an unlisted value becomes. */
+const DEFAULT_SOURCE = "contact-form";
 /** The server's terms-error text. The form block shows its own copy for this key. */
 const CONSENT_REQUIRED = "Please accept the terms to send your message.";
 const MAX_EXTRA_FIELD_LENGTH = 2000;
@@ -108,6 +157,16 @@ function extraFields(formData: FormData): Record<string, string> | null {
   return extra;
 }
 
+/** A 400 whose body names `consent_required` (#8730). */
+function isConsentRequired(res: { status: number; body: unknown }): boolean {
+  return (
+    res.status === 400 &&
+    typeof res.body === "object" &&
+    res.body !== null &&
+    (res.body as { error?: unknown }).error === "consent_required"
+  );
+}
+
 /** A 503 whose body names `lead_capture_not_configured`. */
 function isNotConfigured(res: { status: number; body: unknown }): boolean {
   return (
@@ -118,6 +177,54 @@ function isNotConfigured(res: { status: number; body: unknown }): boolean {
   );
 }
 
+/**
+ * The API could not be reached (#8747): `writeLead`'s `status: 0` (a thrown
+ * submit) or a gateway failure. A 503 that is not `lead_capture_not_configured`
+ * stays the generic error — the API answered.
+ */
+function isApiUnreachable(res: { status: number }): boolean {
+  return res.status === 0 || res.status === 502 || res.status === 504;
+}
+
+/**
+ * #8757 D11 — the offering a `checkout` answer names, when its key passes the
+ * schema and this build serves the standard checkout (a spoke); else `null`.
+ */
+function checkoutOfferingOf(next: unknown): string | null {
+  if (TOPOLOGY !== "spoke") return null;
+  const parsed = leadSubmitNextSchema.safeParse(next);
+  if (!parsed.success || parsed.data.completion !== "checkout") return null;
+  const key = flowCheckoutOfferingSchema.safeParse(parsed.data.checkoutOffering);
+  return key.success ? key.data : null;
+}
+
+/**
+ * #8757 D8 — the success state for a written lead: with the account link when
+ * the API answered `next: { completion: "invite" }` and this site can build
+ * one, else exactly `{ kind: "success" }`. Never throws.
+ */
+async function successState(
+  next: unknown,
+  email: string,
+): Promise<Extract<LeadCaptureFormState, { kind: "success" }>> {
+  const parsed = leadSubmitNextSchema.safeParse(next);
+  if (!parsed.success || parsed.data.completion !== "invite") return { kind: "success" };
+  let locale = "en";
+  try {
+    locale = await getLocale();
+  } catch {
+    // No request-scoped locale — the default locale's link.
+  }
+  const href = accountInviteHref(locale, email);
+  if (href === null) return { kind: "success" };
+  try {
+    const t = await getTranslations("contact");
+    return { kind: "success", next: { href, label: t("trackInAccount") } };
+  } catch {
+    return { kind: "success" };
+  }
+}
+
 export async function captureLeadAction(
   _prevState: LeadCaptureFormState,
   formData: FormData,
@@ -137,10 +244,12 @@ export async function captureLeadAction(
 
   const posted = formData.get("source");
   const source =
-    typeof posted === "string" && ALLOWED_SOURCES.has(posted) ? posted : "web";
+    typeof posted === "string" && CONTACT_LEAD_SOURCES.has(posted) ? posted : DEFAULT_SOURCE;
 
+  // #8730 D2 — every source, the intake's included: it asks for the terms
+  // itself and posts consent=true like the form does.
   const fieldErrors: Record<string, string> = {};
-  if (source !== INTAKE_SOURCE && formData.get("consent") !== "true") {
+  if (formData.get("consent") !== "true") {
     fieldErrors.consent = CONSENT_REQUIRED;
   }
 
@@ -161,28 +270,35 @@ export async function captureLeadAction(
   if (extra === null) return { kind: "error", message: GENERIC_ERROR };
 
   const { name, email, message, phone } = parsed.data;
-  const siteId = process.env.AILK_SITE_ID ?? "default";
-  const body = {
-    siteId,
-    source,
-    email,
-    payload: {
-      ...extra,
-      name,
-      ...(message !== undefined && { message }),
-      ...(phone !== undefined && { phone }),
-    },
+  const payload = {
+    ...extra,
+    name,
+    ...(message !== undefined && { message }),
+    ...(phone !== undefined && { phone }),
   };
 
-  let init: { headers: Record<string, string> } | undefined;
+  let requestHeaders: Awaited<ReturnType<typeof headers>> | undefined;
   try {
-    const forwarded = visitorForwardHeaders(
-      await headers(),
-      process.env.AILK_VISITOR_FORWARD_KEY,
-    );
-    if (forwarded) init = { headers: forwarded };
+    requestHeaders = await headers();
   } catch {
-    // No request scope to read — submit without forwarding.
+    // No request scope to read — no forwarding, and the visitor is "unknown".
+  }
+
+  // No readable address: skip the per-visitor limit rather than put every
+  // visitor in one shared bucket a single caller could fill. The hub's own
+  // per-IP limit still applies.
+  const visitor = requestHeaders ? clientIpFromHeaders(requestHeaders) : "unknown";
+  if (
+    visitor !== "unknown" &&
+    !checkRateLimit(`contact:${visitor}`, RATE_LIMIT_MAX_CALLS, RATE_LIMIT_WINDOW_MS)
+  ) {
+    return { kind: "error", message: RATE_LIMITED };
+  }
+
+  let init: { headers: Record<string, string> } | undefined;
+  if (requestHeaders) {
+    const forwarded = visitorForwardHeaders(requestHeaders, process.env.AILK_VISITOR_FORWARD_KEY);
+    if (forwarded) init = { headers: forwarded };
   }
 
   // #8438 D12 — the banner's visitor id, so a later form submit links its
@@ -195,20 +311,19 @@ export async function captureLeadAction(
     // No request scope to read — submit with no visitor-link header.
   }
 
-  try {
-    const res = init ? await leads.submit(body, init) : await leads.submit(body);
-    if (!res.ok) {
-      if (isNotConfigured(res)) return { kind: "unavailable" };
-      return { kind: "error", message: GENERIC_ERROR };
+  // writeLead never throws: a thrown submit is logged there by error name
+  // only, with no field values (#4042), and resolves as `status: 0`.
+  const res = await writeLead({ source, email, page: "contact", consent: true, payload }, init);
+  if (!res.ok) {
+    if (isConsentRequired(res)) {
+      return { kind: "error", fieldErrors: { consent: CONSENT_REQUIRED } };
     }
-    return { kind: "success" };
-  } catch (err) {
-    // Log server-side for observability (#4042, sibling of flow.actions.ts's
-    // #3989 fix). The api-client's post() never attaches the request payload
-    // to a thrown error (packages/api-client/src/http.ts), so logging `err`
-    // itself is safe — no submitted form fields (name/email/message/phone)
-    // are included.
-    console.error("[captureLeadAction]", err);
+    if (isNotConfigured(res) || isApiUnreachable(res)) return { kind: "unavailable" };
     return { kind: "error", message: GENERIC_ERROR };
   }
+  // #8757 D11 — after the write, outside any try: redirect() throws by design.
+  const checkoutOffering = checkoutOfferingOf(res.body.next);
+  if (checkoutOffering !== null) redirect(`/api/checkout/${checkoutOffering}`);
+  // #8847 D7 — the parsed name, which the magnet's ending fills `{name}` with.
+  return { ...(await successState(res.body.next, email)), name };
 }

package/templates/apps/web/app/[locale]/contact/intake-script.ts

@@ -11,6 +11,12 @@
  * ids ARE the submission adapter's field-mapping contract; renaming a
  * question id here requires updating that mapping too.
  *
+ * A fourth, closed question (`consent`, #8730 D2) asks for the terms before
+ * anything is sent. The engine records a tapped pill as its LABEL, so the
+ * wrapper treats the answer as acceptance only when it equals
+ * `copy.consentAccept` exactly; any other answer — the decline pill or typed
+ * text — sends nothing and shows the form, whose own terms box decides.
+ *
  * Copy is translated (next-intl "contact" namespace, "intake.*" keys —
  * see apps/web/messages/en.json) rather than hardcoded, consistent with
  * ContactForm's own `useTranslations("contact")` usage. The wrapper resolves
@@ -31,10 +37,18 @@ export interface ContactIntakeCopy {
   messagePrompt: string;
   emailAck: string;
   emailPrompt: string;
+  consentAck: string;
+  consentPrompt: string;
+  /** The accept pill's label — the one answer that is terms acceptance. */
+  consentAccept: string;
+  consentDecline: string;
   skipMessage: string;
   completionMessage: string;
 }
 
+/** The accept option's value — its pill's test id is `…-pill-accept`. */
+const INTAKE_CONSENT_ACCEPT = "accept";
+
 export function buildContactIntakeScript(
   copy: ContactIntakeCopy,
 ): IntakeScript {
@@ -59,6 +73,18 @@ export function buildContactIntakeScript(
         acknowledgement: copy.emailAck,
         prompt: copy.emailPrompt,
       },
+      // #8730 D2 — the intake asks for the terms itself. Only the accept
+      // pill's label is acceptance; the wrapper reads `consent` by that id.
+      {
+        id: "consent",
+        kind: "closed",
+        acknowledgement: copy.consentAck,
+        prompt: copy.consentPrompt,
+        options: [
+          { value: INTAKE_CONSENT_ACCEPT, label: copy.consentAccept },
+          { value: "decline", label: copy.consentDecline },
+        ],
+      },
     ],
     skip: { message: copy.skipMessage },
     completion: { message: copy.completionMessage },

package/templates/apps/web/app/[locale]/contact/page.tsx

@@ -11,18 +11,25 @@
 // API, an older API without the status route, or any other failed read is
 // treated as accepting: the form renders, and its submit reports honestly.
 //
-// The form's fields (#8661 D6), first usable wins: the workspace's Contact
-// form magnet (`flows.get("contact")`, the public flow read — the API resolves
-// the workspace, the site alias keyless and a spoke by its key); else the
-// page's `contact-form` section fields when it declares any; else the
-// built-in form: the seeded magnet's own config, its name, email and message
-// labels from the `contact` catalog. The submit label is the magnet's, else
-// the section's; the success message is the section's. A magnet-driven
-// post is stamped `source: "flow:contact"`, so it is an Inbox submission of
-// the Contact form; the other two post as `web`. The page is rendered on
-// every request, so an Admin edit shows on the next one. The terms statement
-// links Terms, Privacy Policy and Working Agreement from a page-built map —
-// a magnet label can name a link key, never an href.
+// The form (#8661 D6, #8847 D7), first usable wins: the workspace's Contact
+// form magnet (`flows.get("contact")`, the public flow read — the API
+// resolves the workspace, the site alias keyless and a spoke by its key);
+// else the page's `contact-form` section fields when it declares any; else
+// the built-in form: the seeded magnet's own config, its name, email and
+// message labels from the `contact` catalog. Every visible fact on the page
+// comes from the magnet (#8847): its field step's title is the page's H1 and
+// `<title>`, its body the line under it (`framedSources`), and its ending
+// the success message. The built-in config stands in when the hub cannot be
+// read, so a fresh deploy looks the same either way. The section's own
+// `successMessage` and `submitLabel` apply only when its own fields are
+// used. A magnet-driven post is stamped `source: "flow:contact"`, so it is
+// an Inbox submission of the Contact form; the other two post as
+// `contact-form` (#8747). The page is rendered on every request, but its two
+// hub reads (the magnet and the capture status) are shared across requests
+// for HUB_READ_TTL_MS (`lib/in-page-magnet.ts`, #8731). The terms statement
+// links Terms and Privacy Policy from a page-built map — a magnet label can
+// name a link key, never an href. Under the form, "Prefer email?" and the
+// `_site.mdx` contact email, when the site has one.
 //
 // A `contact-form` section in the `column` variant (the minimalism Contact
 // page, #8661 D12) gets the stacked form look and a Send that stays enabled,
@@ -31,7 +38,6 @@
 // The chat-style intake (ConversationalIntakeWrapper, #4534) remains
 // available to a site that prefers it. JSON-LD and translations handled by
 // renderPage.
-import { flows, leads } from "@working-theory/api-client";
 import type {
   getMdxSource as defaultGetMdxSource,
   getPageSections as defaultGetPageSections,
@@ -49,22 +55,30 @@ import {
   type LeadCaptureFormText,
   localeHref,
 } from "@working-theory/ui";
+import { Link, Text } from "@working-theory/ui/primitives";
 import {
   CONTACT_FORM_FLOW_SLUG,
   contactFormFlowConfig,
   flowLeadSource,
-  type FlowConfig,
 } from "@working-theory/validation";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
-import { contactFormFromConfig } from "./contact-form-magnet";
+import {
+  framedSources,
+  inPageView,
+  readCaptureStatus,
+  readServedMagnet,
+  type InPageView,
+} from "../../../lib/in-page-magnet";
+
+import { contactFormFromConfig, type ContactFormView } from "./contact-form-magnet";
 import { contactFormText } from "./contact-form-text";
 import { captureLeadAction } from "./contact.actions";
 import { readSiteContactEmail } from "./site-contact-email";
 
-// #8661 D6 — the Contact form magnet is read on every request.
+// #8661 D6 — rendered on every request; the magnet read behind it is shared for HUB_READ_TTL_MS (#8731, lib/in-page-magnet.ts).
 export const dynamic = "force-dynamic";
 
 interface Props {
@@ -73,11 +87,6 @@ interface Props {
   getPageSections?: typeof defaultGetPageSections;
 }
 
-type CaptureStatus = Extract<
-  Awaited<ReturnType<typeof leads.captureStatus>>,
-  { ok: true }
->["body"]["data"];
-
 type Section = Awaited<ReturnType<typeof defaultGetPageSections>>[number];
 type ContactFormSection = Extract<Section, { type: "contact-form" }>;
 
@@ -113,36 +122,44 @@ function builtInFields(text: LeadCaptureFormText, locale: string): ContactFormFi
   });
 }
 
-/** The API's capture status, or `null` for any failed read (see header). */
-async function readCaptureStatus(): Promise<CaptureStatus | null> {
-  try {
-    const res = await leads.captureStatus();
-    return res.ok && res.body.ok === true ? res.body.data : null;
-  } catch {
-    return null;
-  }
-}
-
 /**
- * The served Contact form magnet's config, or `null` for any failed read: a
- * non-2xx (absent, draft, a build with no flow route) or a throw. The
- * property access sits inside the `try`, so a client with no `flows` is a
- * failed read too.
+ * The page's view of the Contact form (#8847 D7): the served magnet's when it
+ * maps, else the built-in config's. `served` says which.
  */
-async function readContactMagnet(): Promise<FlowConfig | null> {
-  try {
-    const res = await flows.get(CONTACT_FORM_FLOW_SLUG);
-    return res.ok ? res.body : null;
-  } catch {
-    return null;
-  }
+async function contactView(
+  locale: string,
+  fallbackHeadline: string,
+): Promise<{ view: InPageView; served: boolean }> {
+  const magnet = await readServedMagnet(CONTACT_FORM_FLOW_SLUG);
+  const served = magnet ? inPageView(magnet, locale, "contact", fallbackHeadline) : null;
+  if (served) return { view: served, served: true };
+  // The built-in config always maps: its first step has name and email.
+  return {
+    view: inPageView(contactFormFlowConfig, locale, "contact", fallbackHeadline)!,
+    served: false,
+  };
 }
 
 export async function generateMetadata({
   params,
-}: Pick<Props, "params">): Promise<Metadata> {
+  getMdxSource,
+  getPageSections,
+}: Props): Promise<Metadata> {
   const { locale } = await params;
-  return renderPageMetadata({ type: "ContactPage", slug: "contact", locale });
+  const t = await getTranslations({ locale, namespace: "contact" });
+  const { view } = await contactView(locale, t("successMessage"));
+  // #8847 D7 — the `<title>` is the magnet's step title, like the H1.
+  const framed = framedSources({
+    getMdxSource: getMdxSource ?? loadMdxSource,
+    getPageSections: getPageSections ?? loadPageSections,
+    view,
+  });
+  return renderPageMetadata({
+    type: "ContactPage",
+    slug: "contact",
+    locale,
+    getMdxSource: framed.getMdxSource,
+  });
 }
 
 export default async function Page({
@@ -151,17 +168,22 @@ export default async function Page({
   getPageSections,
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
-  const [status, t, magnet] = await Promise.all([
+  const [status, t] = await Promise.all([
     readCaptureStatus(),
     getTranslations({ locale, namespace: "contact" }),
-    readContactMagnet(),
   ]);
   const accepting = status?.contact ?? true;
   const contactEmail = readSiteContactEmail();
   const text = contactFormText(t);
+  const { view, served } = await contactView(locale, text.success);
+  const framed = framedSources({
+    getMdxSource: getMdxSource ?? loadMdxSource,
+    getPageSections: getPageSections ?? loadPageSections,
+    view,
+  });
 
-  const source = await (getMdxSource ?? loadMdxSource)("ContactPage", "contact", locale);
-  const sections = source ? await (getPageSections ?? loadPageSections)(source.frontmatter) : [];
+  const source = await framed.getMdxSource("ContactPage", "contact", locale);
+  const sections = source ? await framed.getPageSections(source.frontmatter) : [];
   const formSection = sections.find(
     (s): s is ContactFormSection => s.type === "contact-form",
   );
@@ -173,19 +195,23 @@ export default async function Page({
     (lead?.type === "hero" && lead.data.variant === "split" ? lead.id : undefined);
 
   // #8661 D6 — the magnet's fields, else the section's, else the built-in form.
-  const served = magnet ? contactFormFromConfig(magnet, locale) : null;
-  const declared = formSection && formSection.data.fields.length > 0 ? formSection : undefined;
-  const fields: ContactFormField[] =
-    served?.fields ?? (declared ? sectionFields(declared) : builtInFields(text, locale));
-  // A magnet's own submit label wins; the section's copy fills what it leaves.
-  const submitLabel = served?.submitLabel ?? formSection?.data.submitLabel;
-  const successMessage = formSection?.data.successMessage;
+  const form = view.form as ContactFormView;
+  const declared =
+    !served && formSection && formSection.data.fields.length > 0 ? formSection : undefined;
+  const fields: ContactFormField[] = served
+    ? form.fields
+    : declared
+      ? sectionFields(declared)
+      : builtInFields(text, locale);
+  // #8847 D7 — the section's submit label and success message apply only to
+  // its own fields; otherwise the magnet's (or the built-in config's) ending.
+  const submitLabel = served ? form.submitLabel : declared?.data.submitLabel;
   const column = formSection?.data.variant === "column";
 
-  const surface = accepting ? (
+  const leadForm = accepting ? (
     <LeadCaptureForm
       action={captureLeadAction}
-      text={served?.consentStatement ? { ...text, consentStatement: served.consentStatement } : text}
+      text={served && form.consentStatement ? { ...text, consentStatement: form.consentStatement } : text}
       termsHref={localeHref(locale, "/terms")}
       policies={{
         terms: localeHref(locale, "/terms"),
@@ -195,7 +221,7 @@ export default async function Page({
       fallbackEmail={fallbackEmail}
       fields={fields}
       submitLabel={submitLabel}
-      successMessage={successMessage}
+      {...(declared ? { successMessage: declared.data.successMessage } : { ending: view.ending })}
       {...(served && { source: flowLeadSource(CONTACT_FORM_FLOW_SLUG) })}
       {...(column && { look: "column" as const, consentGate: "on-submit" as const })}
     />
@@ -209,14 +235,27 @@ export default async function Page({
       }}
     />
   );
+  // #8847 D7 — one muted line under the form; absent with no address.
+  const surface = (
+    <>
+      {leadForm}
+      {contactEmail !== undefined && (
+        <div className="mt-block-tight text-center" data-testid="contact-prefer-email">
+          <Text tone="muted" variant="body-sm">
+            {t("preferEmail")} <Link href={`mailto:${contactEmail}`}>{contactEmail}</Link>
+          </Text>
+        </div>
+      )}
+    </>
+  );
 
   const rendered = await renderPage({
     type: "ContactPage",
     slug: "contact",
     locale,
     translationsNamespace: "contact",
-    ...(getMdxSource !== undefined && { getMdxSource }),
-    ...(getPageSections !== undefined && { getPageSections }),
+    getMdxSource: framed.getMdxSource,
+    getPageSections: framed.getPageSections,
     ...(slotted !== undefined && { sectionSlots: { [slotted]: surface } }),
   });
   return (