create-ailk 0.1.1 → 0.2.0

package/templates/apps/api/src/services/project-listings.ts

@@ -42,10 +42,14 @@ import {
   clampWindowDays,
   buildProjectListingDraftPatchSchema,
   buildProjectListingSubmitSchema,
+  composeAddressLine,
+  flowAddressValueSchema,
+  publicSiteAnswers,
   PROJECT_LISTING_CONCURRENT_LIMIT,
   PROJECT_LISTING_NON_TERMINAL_STATUSES,
 } from "@working-theory/validation";
 import type {
+  FlowAddressValue,
   ProjectListing,
   ProjectListingDraftPatchInput,
   ProjectListingFaqs,
@@ -56,6 +60,13 @@ import type {
 
 import { prisma } from "../lib/prisma.js";
 
+import {
+  consentConfigForSite,
+  MAX_CONSENT_KEYS,
+  recordConsent,
+  recordLegacyConsent,
+  requiredConsentUnmet,
+} from "./consent.js";
 import { routeLead, type SourceMeta } from "./lead-routing.js";
 import { listingConfigFor } from "./listing-config.js";
 
@@ -205,7 +216,19 @@ const PROJECT_LISTING_SELECT = {
   faqs: true,
   anythingElse: true,
   address: true,
+  // #5279 — the structured parts beside the display string.
+  addressLine1: true,
+  addressLine2: true,
+  addressCity: true,
+  addressRegion: true,
+  addressPostalCode: true,
+  addressCountry: true,
   questions: true,
+  // #5285 — the site's own answers, and the window the applicant asked for.
+  // `windowDays` rides the select because `submit` re-validates the assembled
+  // application, and `requestedWindowDays` is one of its fields now.
+  siteAnswers: true,
+  windowDays: true,
   founderName: true,
   founderEmail: true,
   founderCompany: true,
@@ -228,6 +251,81 @@ type ProjectListingRow = Prisma.ProjectListingGetPayload<{
   select: typeof PROJECT_LISTING_SELECT;
 }>;
 
+/**
+ * The structured address parts of a row, or null (#5279).
+ *
+ * Exported because `project-listing-decision.ts` renders the same row shape
+ * and must answer the same way — two readers guessing separately at what
+ * "has parts" means is exactly how one of them starts emitting a half-filled
+ * object.
+ *
+ * The rule is the composite's REQUIRED set: the five non-optional parts are
+ * all present, or there are no parts. `addressLine2` is optional in the
+ * fieldset, so it rides along when present and is simply absent when not. A
+ * row written before #5279 has all six columns null and answers null here —
+ * never a partial object reconstructed from `address`, which nothing in this
+ * repo parses.
+ *
+ * `.safeParse` rather than a cast: these are six nullable TEXT columns, and
+ * the emitted object must satisfy `flowAddressValueSchema` or the row fails
+ * its own response schema downstream. A shape that somehow does not (a
+ * `country` that is not an alpha-2 code, say) answers null rather than
+ * putting an invalid address on the PUBLIC read.
+ */
+export function addressPartsFromRow(row: {
+  addressLine1: string | null;
+  addressLine2: string | null;
+  addressCity: string | null;
+  addressRegion: string | null;
+  addressPostalCode: string | null;
+  addressCountry: string | null;
+}): FlowAddressValue | null {
+  if (
+    row.addressLine1 === null ||
+    row.addressCity === null ||
+    row.addressRegion === null ||
+    row.addressPostalCode === null ||
+    row.addressCountry === null
+  ) {
+    return null;
+  }
+  const parsed = flowAddressValueSchema.safeParse({
+    addressLine1: row.addressLine1,
+    ...(row.addressLine2 !== null && { addressLine2: row.addressLine2 }),
+    city: row.addressCity,
+    region: row.addressRegion,
+    postalCode: row.addressPostalCode,
+    country: row.addressCountry,
+  });
+  return parsed.success ? parsed.data : null;
+}
+
+/**
+ * The site-answers object of a row, or null (#5285).
+ *
+ * Exported for the same reason `addressPartsFromRow` is: the operator's
+ * decision payload renders the same row shape and must answer the same way.
+ *
+ * The column is `Json?`, so Prisma types it as `JsonValue` — an array, a
+ * number and a string all satisfy it. Only ever written by
+ * `draftUpdateData` from a body the site's own declarations validated, so a
+ * row holding anything else is a row somebody wrote around this service.
+ * A non-object answers null rather than being cast: a value of the wrong
+ * SHAPE reaching the response schema would fail the whole read, and one
+ * malformed row must not take a listing page down.
+ *
+ * Non-string members are dropped for the same reason — the store is
+ * `Record<string, string>`, and what is handed back has to actually be one.
+ */
+export function siteAnswersFromRow(value: Prisma.JsonValue | null): Record<string, string> | null {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+  return Object.fromEntries(
+    Object.entries(value).filter(
+      (entry): entry is [string, string] => typeof entry[1] === "string",
+    ),
+  );
+}
+
 /**
  * `now` is passed rather than read inside so one read renders every row of a
  * list against a single instant. `featuredEnabled` is the site's config
@@ -257,12 +355,19 @@ function toResponseRow(
     faqs: row.faqs as unknown as ProjectListingFaqs | null,
     anythingElse: row.anythingElse,
     address: row.address,
+    addressParts: addressPartsFromRow(row),
     founderName: row.founderName,
     founderEmail: row.founderEmail,
     founderCompany: row.founderCompany,
     questions: row.questions as unknown as ProjectListingQuestions | null,
     logoMarkUrl: row.logoMarkUrl,
     logoWordmarkUrl: row.logoWordmarkUrl,
+    // #5285 — UNFILTERED here, deliberately. This row shape serves the tenant
+    // dashboard and the founder's own draft read, both of which are entitled
+    // to every answer. The PUBLIC read is the one that must not carry an
+    // `operator-only` answer, and it narrows this through `publicSiteAnswers`
+    // in `publicProjectListings` — one filter, on the one read that publishes.
+    siteAnswers: siteAnswersFromRow(row.siteAnswers),
     featured: featuredEnabled && row.featured,
     // The row's OWN flag decides the closed exemption (#5036 D6b), not the
     // site's `featuredEnabled` switch: that switch governs whether the flag
@@ -410,17 +515,25 @@ async function findDraftByToken(
 // ─── start (POST, anonymous) ────────────────────────────────────────────────
 
 /**
- * `start` has no failure mode of its own to report. It reads the site's config
- * (which falls back to the platform defaults rather than erroring) and writes
- * one row; a Prisma failure is a 500 through the framework, as everywhere else.
- * The Lead write — the one step that used to give this operation a
- * `persist_failed`/`config_missing` surface — moved to `submit`.
+ * `start` has one failure mode of its own to report (#5275): a `consents`
+ * map that does not GRANT every purpose the site's registry marks required —
+ * declined, or simply absent. The legacy literal says the founder consented;
+ * a `false` (or nothing) beside it for the required purpose says they did
+ * not — the body contradicts itself, and the row must not be created on it
+ * (it would go on to publish the founder's address against a recorded
+ * decline, or with no evidence row at all). An oversized map is the same
+ * 400. Everything else is as before: the site's config falls back to the
+ * platform defaults rather than erroring, and a Prisma failure is a 500
+ * through the framework. The Lead write — the step that used to give this
+ * operation a `persist_failed`/`config_missing` surface — moved to `submit`.
  */
-export type StartProjectListingDraftResult = {
-  ok: true;
-  id: string;
-  resumeToken: string;
-};
+export type StartProjectListingDraftResult =
+  | {
+      ok: true;
+      id: string;
+      resumeToken: string;
+    }
+  | { ok: false; error: { kind: "invalid_input"; message: string } };
 
 /**
  * Create a `draft` from step one — the founder's name, email and consent.
@@ -450,18 +563,64 @@ export async function startProjectListingDraft(
   const listingConfig = await listingConfigFor(siteId);
   const windowDays = clampWindowDays(requestedWindowDays, listingConfig);
 
+  // #5275 — refuse BEFORE the row exists: a required purpose not granted
+  // (declined or absent) is a body that contradicts its own `consent: true`,
+  // and an oversized map is not a form's answer.
+  const consentConfig = await consentConfigForSite(siteId);
+  if (input.consents) {
+    if (Object.keys(input.consents).length > MAX_CONSENT_KEYS) {
+      return {
+        ok: false,
+        error: {
+          kind: "invalid_input",
+          message: `consents carries more than ${MAX_CONSENT_KEYS} purposes`,
+        },
+      };
+    }
+    const unmet = requiredConsentUnmet(consentConfig, input.consents);
+    if (unmet !== undefined) {
+      return {
+        ok: false,
+        error: {
+          kind: "invalid_input",
+          message: `required consent purpose "${unmet}" was not granted`,
+        },
+      };
+    }
+  }
+
   const resumeToken = mintResumeToken();
-  const row = await prisma.projectListing.create({
-    data: {
-      siteId,
-      founderName,
-      founderEmail,
-      status: "draft",
-      consentAt: new Date(),
-      resumeTokenHash: hashResumeToken(resumeToken),
-      windowDays,
-    },
-    select: { id: true },
+  // #5275 — the row and its grant record land in ONE transaction: from here
+  // on `consentAt` and the ConsentGrant row are stamped by the SAME
+  // affirmative act, and a grant write that fails takes the row with it
+  // rather than stranding a "consented" listing with no evidence (security
+  // review, Medium 2). A body carrying `consents` records the wording the
+  // founder read (resolved server-side from the same registry the renderer
+  // used, D7); a body carrying only the legacy `consent: true` literal
+  // records one grant marked unrecoverable (D11) rather than today's
+  // wording, which nobody was shown.
+  const consents = input.consents;
+  const locale = input.locale ?? "en";
+  const row = await prisma.$transaction(async (tx) => {
+    const created = await tx.projectListing.create({
+      data: {
+        siteId,
+        founderName,
+        founderEmail,
+        status: "draft",
+        consentAt: new Date(),
+        resumeTokenHash: hashResumeToken(resumeToken),
+        windowDays,
+      },
+      select: { id: true },
+    });
+    const subject = { siteId, subjectType: "project_listing", subjectId: created.id };
+    if (consents) {
+      await recordConsent({ ...subject, locale, config: consentConfig, consents }, tx);
+    } else {
+      await recordLegacyConsent({ ...subject, config: consentConfig }, tx);
+    }
+    return created;
   });
 
   return { ok: true, id: row.id, resumeToken };
@@ -478,15 +637,47 @@ export type PatchProjectListingDraftResult =
         | { kind: "invalid_input"; message: string };
     };
 
+/**
+ * What `draftUpdateData` cannot read off the patch body (#5285).
+ *
+ * Both members are the SERVER's, and that is why they are a second argument
+ * rather than two more payload fields: `windowDays` is the applicant's
+ * request already clamped against the site's own maximum, and
+ * `storedSiteAnswers` is what is on the row, which the merge needs and a
+ * request body must never be able to supply.
+ */
+interface DraftUpdateContext {
+  /** The clamped window, when the patch asked for one. */
+  windowDays?: number;
+  /** The answers already stored, for the merge. */
+  storedSiteAnswers?: Record<string, string>;
+}
+
 /**
  * Translate a validated partial application into a Prisma update.
  *
  * Only the keys the caller actually sent are written: an absent key is
  * `undefined`, which Prisma omits from the UPDATE, so patching one field
  * cannot blank the nine the founder filled in on earlier steps.
+ *
+ * #5279 — THIS IS WHERE THE DISPLAY ADDRESS IS COMPOSED, and the only place.
+ * `address` is a union of the legacy display STRING and the structured PARTS
+ * (`flowAddressValueSchema`), and the two branches write different columns:
+ *
+ *   string → `address` verbatim, no part column touched. A founder who typed
+ *            a line gets that line stored exactly as typed, and a draft
+ *            written before #5279 keeps patching as it always did.
+ *   parts  → the six part columns, PLUS `address` composed from them by
+ *            `composeAddressLine`.
+ *
+ * The derivation runs ONE WAY ONLY. Nothing anywhere derives parts from a
+ * line: address parsing guesses, and a wrong guess silently corrupts the
+ * party identification a listing's privacy notice points at (#5036 D6), with
+ * nothing on the row to mark it as invented.
  */
 function draftUpdateData(
   patch: ProjectListingDraftPatchInput,
+  context: DraftUpdateContext,
 ): Prisma.ProjectListingUpdateInput {
   return {
     ...(patch.name !== undefined && { name: patch.name }),
@@ -499,11 +690,45 @@ function draftUpdateData(
     ...(patch.teamComposition !== undefined && { teamComposition: patch.teamComposition }),
     ...(patch.faqs !== undefined && { faqs: patch.faqs as unknown as Prisma.InputJsonValue }),
     ...(patch.anythingElse !== undefined && { anythingElse: patch.anythingElse }),
-    ...(patch.address !== undefined && { address: patch.address }),
+    ...(patch.address !== undefined &&
+      (typeof patch.address === "string"
+        ? { address: patch.address }
+        : {
+            address: composeAddressLine(patch.address),
+            addressLine1: patch.address.addressLine1,
+            addressLine2: patch.address.addressLine2 ?? null,
+            addressCity: patch.address.city,
+            addressRegion: patch.address.region,
+            addressPostalCode: patch.address.postalCode,
+            addressCountry: patch.address.country,
+          })),
     ...(patch.founderCompany !== undefined && { founderCompany: patch.founderCompany }),
     ...(patch.questions !== undefined && {
       questions: patch.questions as unknown as Prisma.InputJsonValue,
     }),
+    ...(patch.logoMarkUrl !== undefined && { logoMarkUrl: patch.logoMarkUrl }),
+    ...(patch.logoWordmarkUrl !== undefined && {
+      logoWordmarkUrl: patch.logoWordmarkUrl,
+    }),
+    // #5285 — the applicant's REQUEST, already clamped by the caller against
+    // the site's own `maxWindowDays`. It is written to `windowDays`, the same
+    // column `start` writes, because there is one window per listing and the
+    // screen that asks for it is the site's choice of screen, not a second
+    // field. Clamped and not refused, for the reason `startProjectListingDraft`
+    // gives: a founder who could post their own bound could post an unbounded
+    // one.
+    ...(context.windowDays !== undefined && { windowDays: context.windowDays }),
+    // #5285 — MERGED, never replaced. A founder patches one screen at a time,
+    // so a body carrying screen four's two answers must not blank screen
+    // two's. The incoming keys win; everything already stored is carried.
+    // Every incoming id was checked against the site's declarations by the
+    // compiled patch schema, so nothing undeclared can enter here.
+    ...(patch.siteAnswers !== undefined && {
+      siteAnswers: {
+        ...context.storedSiteAnswers,
+        ...patch.siteAnswers,
+      } as Prisma.InputJsonValue,
+    }),
   };
 }
 
@@ -526,7 +751,13 @@ export async function patchProjectListingDraft(
   // still answers `not_found` before any body is inspected.
   const owner = await prisma.projectListing.findFirst({
     where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
-    select: { siteId: true },
+    // #5285 — `siteAnswers` rides this read because the write MERGES into it
+    // (a founder patches one screen at a time). It is still not the write's
+    // guard: the compare-and-swap below is, and a concurrent patch of a
+    // DIFFERENT screen can still lose its answers to this one, exactly as it
+    // can already lose a column. The store is one row's worth of one
+    // founder's own form, not a shared document.
+    select: { siteId: true, siteAnswers: true },
   });
   if (!owner) {
     return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
@@ -536,6 +767,7 @@ export async function patchProjectListingDraft(
   const parsed = buildProjectListingDraftPatchSchema(
     listingConfig.wordCaps,
     listingConfig.collectedFields,
+    listingConfig.siteAnswers,
   ).safeParse(body);
   if (!parsed.success) {
     return {
@@ -548,6 +780,21 @@ export async function patchProjectListingDraft(
   }
   const patch: ProjectListingDraftPatchInput = parsed.data;
 
+  const stored = siteAnswersFromRow(owner.siteAnswers);
+  const context: DraftUpdateContext = {
+    // THE CLAMP, and the reason `requestedWindowDays` is safe to accept from
+    // an anonymous body at all (#5285). The site's `maxWindowDays` is read
+    // server-side and caps everything; the payload carries a REQUEST. A
+    // founder who could post their own bound could post an unbounded one, and
+    // this is the only place a patched window reaches a column.
+    ...(patch.requestedWindowDays !== undefined && {
+      windowDays: clampWindowDays(patch.requestedWindowDays, listingConfig),
+    }),
+    // What is on the row already, so the merge below adds to it rather than
+    // replacing it. It comes from the ROW and never from the body.
+    ...(stored !== null && { storedSiteAnswers: stored }),
+  };
+
   // A GUARDED `updateMany`, not a read-then-write: the token check and the
   // write are one statement, so a concurrent `submit` cannot flip the row to
   // `requested` in between and let this patch land on an application the
@@ -555,7 +802,7 @@ export async function patchProjectListingDraft(
   // same compare-and-swap shape `submit` and `decideListing` already use.
   const updated = await prisma.projectListing.updateMany({
     where: { id, status: "draft", resumeTokenHash: hashResumeToken(resumeToken) },
-    data: draftUpdateData(patch),
+    data: draftUpdateData(patch, context),
   });
   if (updated.count === 0) {
     return { ok: false, error: { kind: "not_found", message: "Draft not found" } };
@@ -613,6 +860,15 @@ function applicationFromRow(
     address: row.address,
     ...(row.founderCompany !== null && { founderCompany: row.founderCompany }),
     questions: row.questions,
+    // #5285 — the three fields that became writable. Each is optional in the
+    // application schema, so a row that never carried one simply omits it and
+    // `submit` is unaffected. `requestedWindowDays` reads back the CLAMPED
+    // `windowDays` the row actually holds, not what was asked for: the
+    // request is not stored anywhere, and re-asserting it would be asserting
+    // a number nothing ever agreed to.
+    ...(row.logoMarkUrl !== null && { logoMarkUrl: row.logoMarkUrl }),
+    ...(row.logoWordmarkUrl !== null && { logoWordmarkUrl: row.logoWordmarkUrl }),
+    ...(row.windowDays !== null && { requestedWindowDays: row.windowDays }),
   };
   return Object.fromEntries(
     Object.entries(all).filter(([key]) => collected.has(key)),
@@ -879,6 +1135,88 @@ export async function getProjectListing(siteId: string, id: string): Promise<Get
   return { ok: true, value: toResponseRow(row, waitlistCountFor(row, counts), new Date(), true) };
 }
 
+// ─── The founder's own listings (auth scope; #5295) ─────────────────────────
+
+/**
+ * The listings the CALLING USER owns, newest first.
+ *
+ * The join is the owner link and ONLY the owner link:
+ * `ownerUserId === userId`, the scalar `listing-promotion.ts` stamps once that
+ * user's own email is verified, matches the row's `founderEmail`, and the row's
+ * site resolves to one of the user's own workspaces. `founderEmail` is NEVER
+ * compared here, at any stage — an un-linked listing that happens to carry the
+ * caller's address is not theirs until a promotion said so, and a read-time
+ * email match would reintroduce exactly the cross-founder capture the link
+ * exists to remove. (`flow-checkouts.ts` draws the same line for `Lead`.)
+ *
+ * No `siteId` parameter and no `currentSiteId()` scope, deliberately — and the
+ * reason is NOT that the two can never coincide. `siteIdForPublicKey`
+ * (`listing-config.ts`) does fall back to `currentSiteId()`, so a listing's
+ * `siteId` CAN be `AILK_SITE_ID` or the literal `"default"` on a single-tenant
+ * deployment. The reason is that the owner link is already the narrower scope:
+ * it is only ever stamped for a site inside the user's own tenancy
+ * (`listing-promotion.ts`, condition 3), so adding a site term could only
+ * remove rows the caller owns — and on the multi-tenant shape, where a
+ * listing's `siteId` is a WORKSPACE id rather than `AILK_SITE_ID`, it would
+ * remove all of them. The response omits `siteId` regardless, so no workspace
+ * id leaves the read.
+ *
+ * The one thing this gives up against the sibling `/me` routes: on a database
+ * shared by more than one site, a caller's rows from every such site come back
+ * together. They are all the caller's own rows, which is why that is acceptable
+ * here and not a disclosure.
+ *
+ * No verified-email re-check either. `flow-checkouts.ts` performs one as
+ * defence in depth beside its email-matching sibling
+ * (`waitlist-signups.ts`, where the gate is load-bearing because the match IS
+ * an email). Here the link is the proof, and it was only issuable under
+ * verification — so a re-check adds no safety, while failing a caller whose
+ * address later changed to an unverified one would wrongly hide the rows they
+ * already proved they own.
+ *
+ * `waitlistCount` is resolved PER SITE: the count is keyed by
+ * `(siteId, experimentKey)`, and a founder may own listings in more than one of
+ * their own workspaces, so counting them all under one site id would report
+ * another site's number.
+ *
+ * An empty array for a caller who owns nothing is the normal answer, not an
+ * error.
+ */
+export async function listMyProjectListings(userId: string): Promise<ProjectListing[]> {
+  const rows = await prisma.projectListing.findMany({
+    where: { ownerUserId: userId },
+    orderBy: { createdAt: "desc" },
+    select: PROJECT_LISTING_SELECT,
+  });
+  if (rows.length === 0) return [];
+
+  const rowsBySite = new Map<string, ProjectListingRow[]>();
+  for (const row of rows) {
+    const forSite = rowsBySite.get(row.siteId);
+    if (forSite) forSite.push(row);
+    else rowsBySite.set(row.siteId, [row]);
+  }
+  const countsBySite = new Map<string, Map<string, number>>();
+  await Promise.all(
+    [...rowsBySite].map(async ([siteId, siteRows]) => {
+      countsBySite.set(siteId, await attachWaitlistCounts(siteId, siteRows));
+    }),
+  );
+
+  const now = new Date();
+  // `featuredEnabled: true` — the founder's own row, like the operator's
+  // dashboard row, reports the flag as stored. It is the PUBLIC shelf the
+  // site's config switch governs, not what the row's owner may see.
+  return rows.map((row) =>
+    toResponseRow(
+      row,
+      waitlistCountFor(row, countsBySite.get(row.siteId) ?? new Map()),
+      now,
+      true,
+    ),
+  );
+}
+
 // ─── Patch (tenant scope; the featured flag) ───────────────────────────────
 
 export type SetListingFeaturedResult =
@@ -1119,6 +1457,16 @@ export async function publicProjectListings(siteId: string): Promise<ProjectList
       now,
       listingConfig.featuredEnabled,
     );
-    return publicRow;
+    // #5285 — the `public`-visibility answers ONLY. An `operator-only` answer
+    // is something a site asked for its own triage, and a founder who was
+    // told it would not be published has to be right about that; an answer
+    // whose id the site no longer declares is dropped for the same reason,
+    // because "no declaration" cannot be read as "public" on the read that
+    // publishes. The tenant dashboard and the review payload are the audience
+    // that sees the rest, and they do not come through here.
+    return {
+      ...publicRow,
+      siteAnswers: publicSiteAnswers(publicRow.siteAnswers, listingConfig.siteAnswers),
+    };
   });
 }

package/templates/apps/web/app/[locale]/layout.tsx

@@ -4,6 +4,7 @@
 // Chrome extract — Nav + Footer from @working-theory/ui (#1451)
 // Shell/Chrome composition — Nav + Footer wrap via @working-theory/templates MarketingShell (#2820)
 // Session-aware Nav actions — Sign in / Account + Sign out from the server-read session (#4984)
+// Site-declared theme — `_site.mdx` `theme:` block → token overlay → CSS vars
 //
 // Sits under app/[locale]/ and sets the <html lang> attribute to the
 // active locale. next-intl's NextIntlClientProvider is wired here so
@@ -48,6 +49,7 @@ import { SignOutTrigger } from "../../components/sign-out-trigger";
 import { navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { SITE_NAME, siteLogo } from "../../lib/site-brand";
+import { loadSiteBrandTokens } from "../../lib/site-theme";
 import { resolveBaseUrl } from "../../src/lib/routes";
 
 // ── Constants ────────────────────────────────────────────────────────────────
@@ -238,11 +240,21 @@ export default async function LocaleLayout({
   // Shared brand mark injected into both Nav and Footer chrome slots.
   const brandLogo = siteLogo();
 
+  // The site's own declared colours, read from `content/_site.mdx`'s `theme:`
+  // block and translated from that customer-facing vocabulary onto a token
+  // overlay (`siteThemeToBrandTokens`). `undefined` when the site declares no
+  // theme — which is the regression floor: no `brand` key is passed, the
+  // resolver takes its untouched fast path, and the emitted CSS is
+  // byte-for-byte what it was before this wiring existed.
+  const siteBrandTokens = loadSiteBrandTokens();
+
   // Both theme modes, gated by [data-theme="dark"] (#1532 — sibling fix; the
   // single-mode call inlined an unconditional :root block that never
   // responded to a client-side data-theme toggle). themeMode still drives
   // the initial data-theme attribute below for a no-flash first paint.
-  const inlineThemeStyle = themeToCssVarsBothModes();
+  const inlineThemeStyle = themeToCssVarsBothModes(
+    siteBrandTokens ? { brand: siteBrandTokens } : {},
+  );
 
   return (
     <html lang={locale} dir={isRtl(locale) ? "rtl" : "ltr"} data-theme={themeMode}>

package/templates/apps/web/jest.config.cjs

@@ -83,6 +83,12 @@ module.exports = {
     "^@working-theory/ui/slices/scheduling$":
       "<rootDir>/node_modules/@working-theory/ui/dist/sections/slices/scheduling.js",
     "^@working-theory/theme$": "<rootDir>/node_modules/@working-theory/theme/dist/index.js",
+    // site-config publishes ESM in dist/; map to source so ts-jest compiles it
+    // through the same transformer as every sibling above. Only the
+    // client-safe /schema entry is mapped — architecture.yaml forbids apps/web
+    // from importing /server at all (#1567).
+    "^@working-theory/site-config/schema$":
+      "<rootDir>/node_modules/@working-theory/site-config/dist/schema/index.js",
     "^@working-theory/validation$": "<rootDir>/node_modules/@working-theory/validation/dist/index.js",
     "^@working-theory/web-i18n$": "<rootDir>/node_modules/@working-theory/web-i18n/dist/index.js",
     // #5025: pnpm keys next-intl's virtual-store path on its resolved peers,