create-ailk 0.14.0 → 0.16.0

package/templates/apps/web/lib/__tests__/listings-config.test.ts

@@ -0,0 +1,83 @@
+/**
+ * The one reader of the listing site key (#7872 D8, AC-6).
+ *
+ * `NEXT_PUBLIC_AILK_LISTING_SITE_KEY` wins; `AILK_LISTING_PUBLIC_KEY` is the
+ * fallback every site configured since create-ailk 0.12.0 already sets; an
+ * empty or whitespace value counts as unset, so the listicle directory stays
+ * off rather than reading the hub with a blank key.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { listingSiteKey, listingsEnabled } from "../listings-config";
+
+const PUBLIC_NAME = "NEXT_PUBLIC_AILK_LISTING_SITE_KEY";
+const FALLBACK_NAME = "AILK_LISTING_PUBLIC_KEY";
+
+const original = {
+  public: process.env[PUBLIC_NAME],
+  fallback: process.env[FALLBACK_NAME],
+};
+
+function setEnv(name: string, value: string | undefined): void {
+  if (value === undefined) delete process.env[name];
+  else process.env[name] = value;
+}
+
+afterEach(() => {
+  setEnv(PUBLIC_NAME, original.public);
+  setEnv(FALLBACK_NAME, original.fallback);
+});
+
+describe("listingSiteKey / listingsEnabled", () => {
+  it("answers the trimmed public name when both are set", () => {
+    setEnv(PUBLIC_NAME, "  site-public  ");
+    setEnv(FALLBACK_NAME, "site-fallback");
+
+    expect(listingSiteKey()).toBe("site-public");
+    expect(listingsEnabled()).toBe(true);
+  });
+
+  it("answers the trimmed fallback when only it is set", () => {
+    setEnv(PUBLIC_NAME, undefined);
+    setEnv(FALLBACK_NAME, " site-fallback\n");
+
+    expect(listingSiteKey()).toBe("site-fallback");
+    expect(listingsEnabled()).toBe(true);
+  });
+
+  it("falls back when the public name is whitespace only", () => {
+    setEnv(PUBLIC_NAME, "   ");
+    setEnv(FALLBACK_NAME, "site-fallback");
+
+    expect(listingSiteKey()).toBe("site-fallback");
+    expect(listingsEnabled()).toBe(true);
+  });
+
+  it("answers undefined when neither is set", () => {
+    setEnv(PUBLIC_NAME, undefined);
+    setEnv(FALLBACK_NAME, undefined);
+
+    expect(listingSiteKey()).toBeUndefined();
+    expect(listingsEnabled()).toBe(false);
+  });
+
+  it("answers undefined when both are empty or whitespace", () => {
+    setEnv(PUBLIC_NAME, "");
+    setEnv(FALLBACK_NAME, "  \t");
+
+    expect(listingSiteKey()).toBeUndefined();
+    expect(listingsEnabled()).toBe(false);
+  });
+});
+
+describe("apps/web/.env.example", () => {
+  it("documents both names", () => {
+    const example = readFileSync(
+      join(__dirname, "..", "..", ".env.example"),
+      "utf8",
+    );
+    expect(example).toMatch(new RegExp(`^# ${PUBLIC_NAME}=`, "m"));
+    expect(example).toMatch(new RegExp(`^# ${FALLBACK_NAME}=`, "m"));
+  });
+});

package/templates/apps/web/lib/__tests__/listings.test.tsx

@@ -294,6 +294,55 @@ describe("no read without a key or the paid package", () => {
   });
 });
 
+describe("the default key reader is listings-config's (#7872 D8)", () => {
+  const PUBLIC_NAME = "NEXT_PUBLIC_AILK_LISTING_SITE_KEY";
+  const FALLBACK_NAME = "AILK_LISTING_PUBLIC_KEY";
+  const original = { public: process.env[PUBLIC_NAME], fallback: process.env[FALLBACK_NAME] };
+
+  function setEnv(name: string, value: string | undefined): void {
+    if (value === undefined) delete process.env[name];
+    else process.env[name] = value;
+  }
+
+  /** Every dependency but the key: the extension falls back to its own reader. */
+  function keylessDepsExtension() {
+    return createListingExtension({
+      pathname: async () => path,
+      locales: () => ["en", "fr"],
+      fetchDirectory,
+      loadUi: async () => STUB_UI,
+      translate: async () => (key: string) => `listings.${key}`,
+      baseUrl: () => "https://site.test",
+    });
+  }
+
+  afterEach(() => {
+    setEnv(PUBLIC_NAME, original.public);
+    setEnv(FALLBACK_NAME, original.fallback);
+  });
+
+  it("reads the directory with NEXT_PUBLIC_AILK_LISTING_SITE_KEY", async () => {
+    setEnv(PUBLIC_NAME, "k");
+    setEnv(FALLBACK_NAME, undefined);
+    path = "/en/partners";
+
+    await keylessDepsExtension().appendix!({ type: "AboutPage", slug: "partners", locale: "en" });
+
+    expect(fetchDirectory).toHaveBeenCalledWith("k", "/partners", "en");
+  });
+
+  it("makes no read with neither variable set", async () => {
+    setEnv(PUBLIC_NAME, undefined);
+    setEnv(FALLBACK_NAME, undefined);
+    path = "/en/partners";
+
+    expect(
+      await keylessDepsExtension().appendix!({ type: "AboutPage", slug: "partners", locale: "en" }),
+    ).toBeNull();
+    expect(fetchDirectory).toHaveBeenCalledTimes(0);
+  });
+});
+
 describe("a failed read renders the page as today", () => {
   let warn: jest.SpyInstance;
   beforeEach(() => {

package/templates/apps/web/lib/__tests__/meeting-slugs.test.ts

@@ -1,7 +1,11 @@
 // oss: false
 /**
  * Tests for enabledMeetingSlugs (#6183 S9b D5) — the D4-resolving read both
- * /meet pages share.
+ * /meet pages share — and its spoke branch (#7872 D4).
+ *
+ * The topology seam is mocked: its hub render imports `../auth`, which this
+ * suite has no reason to load (`app/openapi.json/__tests__/route.test.ts`'s
+ * pattern).
  */
 const mockMeetingTypes = jest.fn();
 jest.mock("@working-theory/api-client", () => ({
@@ -9,6 +13,14 @@ jest.mock("@working-theory/api-client", () => ({
   schedule: { meetingTypes: (...args: unknown[]) => mockMeetingTypes(...args) },
 }));
 
+const mockTopology: { value: "hub" | "spoke" } = { value: "hub" };
+// eslint-disable-next-line no-restricted-syntax -- #507: the topology is a generated constant (#7426 D5), not a runtime input; the seam IS the boundary between a hub and a spoke build, and there is no env or HTTP surface that selects it.
+jest.mock("../topology.generated", () => ({
+  get TOPOLOGY() {
+    return mockTopology.value;
+  },
+}));
+
 import { enabledMeetingSlugs } from "../meeting-slugs";
 
 describe("enabledMeetingSlugs", () => {
@@ -16,6 +28,7 @@ describe("enabledMeetingSlugs", () => {
 
   beforeEach(() => {
     mockMeetingTypes.mockReset();
+    mockTopology.value = "hub";
   });
 
   afterEach(() => {
@@ -70,3 +83,38 @@ describe("enabledMeetingSlugs", () => {
     await expect(enabledMeetingSlugs()).resolves.toEqual([]);
   });
 });
+
+describe("enabledMeetingSlugs on a spoke (#7872 D4)", () => {
+  const originalEnv = process.env["SCHEDULING_CAL_LINK"];
+
+  beforeEach(() => {
+    mockMeetingTypes.mockReset();
+    mockTopology.value = "spoke";
+  });
+
+  afterEach(() => {
+    mockTopology.value = "hub";
+    if (originalEnv === undefined) delete process.env["SCHEDULING_CAL_LINK"];
+    else process.env["SCHEDULING_CAL_LINK"] = originalEnv;
+  });
+
+  it("null + SCHEDULING_CAL_LINK set → [], never the fallback: the hub books only a stored slug", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: null } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+
+  it("passes the workspace's stored list through unchanged", async () => {
+    mockMeetingTypes.mockResolvedValue({ ok: true, body: { slugs: ["intro"] } });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual(["intro"]);
+  });
+
+  it("a non-ok API result → [], fail closed", async () => {
+    process.env["SCHEDULING_CAL_LINK"] = "acme/intro-call";
+    mockMeetingTypes.mockResolvedValue({ ok: false, status: 401, body: null });
+
+    await expect(enabledMeetingSlugs()).resolves.toEqual([]);
+  });
+});

package/templates/apps/web/lib/__tests__/relay.test.ts

@@ -11,6 +11,7 @@
 // Spec: docs/specs/7644-the-browser-talks-only-to-spec.md §5.1 AC-1 to AC-4.
 
 import { handleRelay, RELAY_ROUTES } from "../relay";
+import { __resetRelayRateLimit, __relayRateLimitBucketCount } from "../relay";
 
 const HUB = "https://hub.example";
 const SITE = "https://spoke.example";
@@ -124,6 +125,7 @@ function entryRequest(
 let errorSpy: jest.SpyInstance;
 
 beforeEach(() => {
+  __resetRelayRateLimit();
   fetchMock.mockClear();
   fetchMock.mockImplementation(async () => hubAnswer());
   global.fetch = fetchMock as jest.Mock;
@@ -511,5 +513,320 @@ describe("hardening — what the site serves, and a missing hub address", () =>
       expect(res.status).toBe(201);
       expect(fetchMock).toHaveBeenCalledTimes(1);
     });
+
+    // #7874 D12 — the fallback reads the browser API origin seam. The
+    // committed seam is the hub render, so this case runs it unmocked.
+    it("on a hub, NEXT_PUBLIC_AILK_API_URL alone still counts as a hub address", async () => {
+      delete process.env.AILK_API_URL;
+      process.env.NEXT_PUBLIC_AILK_API_URL = HUB;
+      const res = await handleRelay(relayRequest("/v1/leads/submit"));
+      expect(res.status).toBe(201);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+
+    it("on a spoke (the seam's spoke render), that fallback is skipped", async () => {
+      delete process.env.AILK_API_URL;
+      process.env.NEXT_PUBLIC_AILK_API_URL = HUB;
+      let res: Response | undefined;
+      await jest.isolateModulesAsync(async () => {
+        jest.doMock("../api-origin.generated", () => ({
+          browserApiOrigin: (): string | undefined => undefined,
+        }));
+        const spoke = await import("../relay");
+        res = await spoke.handleRelay(relayRequest("/v1/leads/submit"));
+      });
+      if (res === undefined) throw new Error("the spoke relay did not answer");
+      expect(res.status).toBe(502);
+      expect(await errorCode(res)).toBe("relay_unreachable");
+      expect(fetchMock).not.toHaveBeenCalled();
+    });
+  });
+});
+
+// The relay's own per-visitor rate limit (#7707, spec
+// docs/specs/7707-relay-rate-limit-spec.md §5.1 AC-1 to AC-9).
+describe("the per-visitor rate limit (#7707)", () => {
+  const VISITOR = { "x-forwarded-for": "203.0.113.7" };
+
+  /** Spends the first visitor's 8-call visitor budget, then clears fetchMock. */
+  async function spendVisitorBudget(
+    headers: Record<string, string | null> = VISITOR,
+  ): Promise<void> {
+    for (let i = 0; i < 8; i++) {
+      await handleRelay(relayRequest("/v1/leads/submit", { headers }));
+    }
+    fetchMock.mockClear();
+  }
+
+  describe("AC-1 — 8 forwarded, the 9th refused, on each visitor route", () => {
+    it.each(VISITOR_ENTRIES)(
+      "$method $path: first 8 calls forwarded, the 9th refused",
+      async (entry) => {
+        for (let i = 0; i < 8; i++) {
+          const res = await handleRelay(entryRequest(entry, VISITOR));
+          expect(res.status).not.toBe(429);
+        }
+        fetchMock.mockClear();
+
+        const res = await handleRelay(entryRequest(entry, VISITOR));
+        expect(res.status).toBe(429);
+        expect(await errorCode(res)).toBe("rate_limited");
+        expect(res.headers.get("retry-after")).toBe("600");
+        expect(res.headers.get("cache-control")).toBe("no-store");
+        expect(res.headers.get("x-content-type-options")).toBe("nosniff");
+        expect(fetchMock).not.toHaveBeenCalled();
+      },
+    );
+  });
+
+  describe("AC-2 — the budget is shared across the five visitor routes", () => {
+    it("2 calls each to submit/subscribe/callback/availability, then book is refused", async () => {
+      const shared = VISITOR_ENTRIES.slice(0, 4);
+      for (const entry of shared) {
+        for (let i = 0; i < 2; i++) {
+          const res = await handleRelay(entryRequest(entry, VISITOR));
+          expect(res.status).not.toBe(429);
+        }
+      }
+      const book = VISITOR_ENTRIES[4];
+      if (!book) throw new Error("expected a fifth visitor entry");
+      const res = await handleRelay(entryRequest(book, VISITOR));
+      expect(res.status).toBe(429);
+    });
+  });
+
+  describe("AC-3 — the budget applies with and without AILK_VISITOR_FORWARD_KEY", () => {
+    const FORWARD_KEY_32 = "f".repeat(32);
+
+    it.each([
+      ["unset", undefined],
+      ["set", FORWARD_KEY_32],
+    ])("forward key %s: still 8 forwarded then refused", async (_label, key) => {
+      if (key) process.env.AILK_VISITOR_FORWARD_KEY = key;
+      else delete process.env.AILK_VISITOR_FORWARD_KEY;
+
+      await spendVisitorBudget();
+      const res = await handleRelay(relayRequest("/v1/leads/submit", { headers: VISITOR }));
+      expect(res.status).toBe(429);
+      expect(fetchMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("AC-4 — identity", () => {
+    it("a different visitor IP is forwarded", async () => {
+      await spendVisitorBudget();
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": "198.51.100.9" },
+        }),
+      );
+      expect(res.status).not.toBe(429);
+    });
+
+    it("the first value of a multi-hop x-forwarded-for is the identity", async () => {
+      await spendVisitorBudget();
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": "203.0.113.7, 10.0.0.1" },
+        }),
+      );
+      expect(res.status).toBe(429);
+    });
+
+    it("an IPv4-mapped IPv6 address maps to its IPv4 identity", async () => {
+      await spendVisitorBudget();
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": "::ffff:203.0.113.7" },
+        }),
+      );
+      expect(res.status).toBe(429);
+    });
+
+    it("x-real-ip alone resolves to the same identity as x-forwarded-for", async () => {
+      await spendVisitorBudget();
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": null, "x-real-ip": "203.0.113.7" },
+        }),
+      );
+      expect(res.status).toBe(429);
+    });
+
+    it("an IPv6 /64 prefix is one identity", async () => {
+      await spendVisitorBudget({ "x-forwarded-for": "2001:db8:0:0::1" });
+
+      const blocked = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": "2001:db8::2" },
+        }),
+      );
+      expect(blocked.status).toBe(429);
+
+      const forwarded = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": "2001:db8:0:1::1" },
+        }),
+      );
+      expect(forwarded.status).not.toBe(429);
+    });
+
+    it("an unparseable address shares the unknown identity with no address at all", async () => {
+      await spendVisitorBudget({ "x-forwarded-for": null, "x-real-ip": null });
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { "x-forwarded-for": "not-an-ip" },
+        }),
+      );
+      expect(res.status).toBe(429);
+    });
+  });
+
+  describe("AC-5 — the window resets after windowMs", () => {
+    it("refused just before the window ends, forwarded once it does", async () => {
+      const T0 = Date.now();
+      const nowSpy = jest.spyOn(Date, "now").mockReturnValue(T0);
+
+      await spendVisitorBudget();
+      const stillBlocked = await handleRelay(
+        relayRequest("/v1/leads/submit", { headers: VISITOR }),
+      );
+      expect(stillBlocked.status).toBe(429);
+
+      nowSpy.mockReturnValue(T0 + 599_000);
+      const almostThere = await handleRelay(
+        relayRequest("/v1/leads/submit", { headers: VISITOR }),
+      );
+      expect(almostThere.status).toBe(429);
+      expect(almostThere.headers.get("retry-after")).toBe("1");
+
+      nowSpy.mockReturnValue(T0 + 600_000);
+      const freshWindow = await handleRelay(
+        relayRequest("/v1/leads/submit", { headers: VISITOR }),
+      );
+      expect(freshWindow.status).not.toBe(429);
+
+      nowSpy.mockRestore();
+    });
+  });
+
+  describe("AC-6 — refusals before the budget check spend nothing", () => {
+    it("403s, 404s and 508s before the budget check don't consume it", async () => {
+      for (let i = 0; i < 12; i++) {
+        const res = await handleRelay(
+          relayRequest("/v1/leads/submit", {
+            headers: { ...VISITOR, "sec-fetch-site": "cross-site" },
+          }),
+        );
+        expect(res.status).toBe(403);
+      }
+      for (let i = 0; i < 12; i++) {
+        const res = await handleRelay(
+          relayRequest("/v1/workspaces", { method: "POST", headers: VISITOR }),
+        );
+        expect(res.status).toBe(404);
+      }
+      for (let i = 0; i < 12; i++) {
+        const res = await handleRelay(
+          relayRequest("/v1/leads/submit", {
+            headers: { ...VISITOR, "x-ailk-relayed": "1" },
+          }),
+        );
+        expect(res.status).toBe(508);
+      }
+
+      fetchMock.mockClear();
+      for (let i = 0; i < 8; i++) {
+        const res = await handleRelay(
+          relayRequest("/v1/leads/submit", { headers: VISITOR }),
+        );
+        expect(res.status).not.toBe(429);
+      }
+      expect(fetchMock).toHaveBeenCalledTimes(8);
+    });
+  });
+
+  describe("AC-7 — the budget check precedes content-type and body-size checks", () => {
+    it("a 9th call with a bad content-type gets 429, not 415", async () => {
+      await spendVisitorBudget();
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: { ...VISITOR, "content-type": "text/plain" },
+        }),
+      );
+      expect(res.status).toBe(429);
+    });
+
+    it("a 9th call with an oversized body gets 429, not 413", async () => {
+      await spendVisitorBudget();
+      const res = await handleRelay(
+        relayRequest("/v1/leads/submit", {
+          headers: VISITOR,
+          body: "x".repeat(1_048_577),
+        }),
+      );
+      expect(res.status).toBe(429);
+    });
+  });
+
+  describe("AC-8 — the session route has its own, wider, independent budget", () => {
+    it("30 forwarded, the 31st refused; the visitor budget is untouched", async () => {
+      for (let i = 0; i < 30; i++) {
+        const res = await handleRelay(
+          relayRequest("/v1/commerce/invoices", { headers: VISITOR }),
+        );
+        expect(res.status).not.toBe(429);
+      }
+      fetchMock.mockClear();
+
+      const refused = await handleRelay(
+        relayRequest("/v1/commerce/invoices", { headers: VISITOR }),
+      );
+      expect(refused.status).toBe(429);
+      expect(refused.headers.get("retry-after")).toBe("600");
+      expect(fetchMock).not.toHaveBeenCalled();
+
+      const stillVisitor = await handleRelay(
+        relayRequest("/v1/leads/submit", { headers: VISITOR }),
+      );
+      expect(stillVisitor.status).not.toBe(429);
+    });
+
+    it("a fresh visitor's visitor budget doesn't touch the session budget", async () => {
+      const OTHER = { "x-forwarded-for": "198.51.100.42" };
+      for (let i = 0; i < 8; i++) {
+        await handleRelay(relayRequest("/v1/leads/submit", { headers: OTHER }));
+      }
+      const res = await handleRelay(
+        relayRequest("/v1/commerce/invoices", { headers: OTHER }),
+      );
+      expect(res.status).not.toBe(429);
+    });
+  });
+
+  describe("AC-9 — the store is capped and evicts the oldest entry first", () => {
+    it(
+      "the first visitor's bucket is evicted at capacity, so its next call opens a fresh window",
+      async () => {
+        await spendVisitorBudget();
+        for (let i = 0; i < 10_000; i++) {
+          const ip = `10.${(i >> 16) & 0xff}.${(i >> 8) & 0xff}.${i & 0xff}`;
+          await handleRelay(
+            relayRequest("/v1/leads/submit", {
+              headers: { "x-forwarded-for": ip },
+            }),
+          );
+        }
+        expect(__relayRateLimitBucketCount()).toBe(10_000);
+
+        fetchMock.mockClear();
+        const res = await handleRelay(
+          relayRequest("/v1/leads/submit", { headers: VISITOR }),
+        );
+        expect(res.status).not.toBe(429);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+      },
+      30_000,
+    );
   });
 });

package/templates/apps/web/lib/__tests__/site-brand.test.ts

@@ -118,6 +118,58 @@ describe("SITE_NAME / SITE_BASE_URL (#4157)", () => {
   });
 });
 
+/**
+ * `COPYRIGHT_HOLDER` — the footer's holder (#7796): `siteIdentity.legalName`
+ * when declared, else the site name, exactly as before.
+ */
+describe("COPYRIGHT_HOLDER (#7796)", () => {
+  function writeIdentity(identityLines: string): void {
+    writeFileSync(
+      join(tmpRoot, "_site.mdx"),
+      `---\nsiteName: Wendi Henry\nsiteIdentity:\n  kind: Person\n  name: Wendi Henry\n${identityLines}---\n`,
+    );
+    process.env["AILK_CONTENT_ROOT"] = tmpRoot;
+    delete process.env["NEXT_PUBLIC_SITE_NAME"];
+  }
+
+  it("is siteIdentity.legalName when the site declares one", async () => {
+    writeIdentity("  legalName: SalesSmyth LLC\n");
+    const { COPYRIGHT_HOLDER, SITE_NAME } = await loadSiteBrand();
+
+    expect(COPYRIGHT_HOLDER).toBe("SalesSmyth LLC");
+    expect(SITE_NAME).toBe("Wendi Henry");
+  });
+
+  it("falls back to SITE_NAME when no legalName is declared", async () => {
+    writeIdentity("");
+    const { COPYRIGHT_HOLDER, SITE_NAME } = await loadSiteBrand();
+
+    expect(COPYRIGHT_HOLDER).toBe(SITE_NAME);
+  });
+
+  it("falls back to SITE_NAME when legalName is blank or not a string", async () => {
+    writeIdentity('  legalName: "  "\n');
+    expect((await loadSiteBrand()).COPYRIGHT_HOLDER).toBe("Wendi Henry");
+
+    writeIdentity("  legalName: 42\n");
+    expect((await loadSiteBrand()).COPYRIGHT_HOLDER).toBe("Wendi Henry");
+  });
+
+  it("follows the NEXT_PUBLIC_SITE_NAME override when no legalName is declared", async () => {
+    writeIdentity("");
+    process.env["NEXT_PUBLIC_SITE_NAME"] = "Env Override Co";
+    expect((await loadSiteBrand()).COPYRIGHT_HOLDER).toBe("Env Override Co");
+  });
+
+  it("falls back to the neutral default when _site.mdx is absent", async () => {
+    process.env["AILK_CONTENT_ROOT"] = tmpRoot;
+    delete process.env["NEXT_PUBLIC_SITE_NAME"];
+    const { COPYRIGHT_HOLDER, FALLBACK_SITE_NAME } = await loadSiteBrand();
+
+    expect(COPYRIGHT_HOLDER).toBe(FALLBACK_SITE_NAME);
+  });
+});
+
 /**
  * `siteLogo()` — the brand triad's logomark (#6820 D5). No `brand:` renders
  * exactly today's element; a declared mark is the one rendered, with its dark