create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/middleware.ts

@@ -19,6 +19,29 @@
 // here rather than in the matcher, because this middleware is the only place
 // the security headers are stamped.
 //
+// The spoke file routes (#9162) — `/reports/<slug>/file`,
+// `/account/inbox/message/<id>/file` and
+// `/account/artifacts/<pieceId>/versions/<version>/file` — get every baseline
+// header but the CSP. Their handlers set the hub's sandbox policy, and this
+// middleware runs before them: Next puts its headers on the response first and
+// adds a handler header only where none is set yet, so a site CSP stamped here
+// would replace the sandbox one on the wire.
+//
+// Docs path (#10041 D3). A site that sets `docsPath` in `_site.mdx` serves
+// its docs there: a request at or under the public path (bare or after an
+// enabled-locale prefix) is handed to next-intl as the internal `/docs` route,
+// so its rewrite lands on `app/[locale]/docs/` while the browser keeps the
+// public URL; a redirect's `Location` and every `Link` hreflang entry are
+// mapped back onto the public path. The internal `/docs` itself answers with
+// the site's 404, before next-intl, so no locale redirect intervenes. A site
+// with no `docsPath` takes none of these branches.
+//
+// Services path (#10043 D5). The same mapping for a site that sets
+// `services.path` in `_site.mdx`, except that the internal `/services` (and
+// everything under it) answers a 308 onto the same rest under the public
+// base, so old links keep working. A site with no `services.path` takes none
+// of these branches.
+//
 // S16 spec: docs/internal/specs/ailk-pre-oss-security-phase-3-s16-security-headers-spec.md
 // S2 spec:  docs/internal/specs/i18n-phase1-s2-next-intl-foundation-spec.md
 // P2 S1 spec: docs/internal/specs/i18n-phase2-s1-hreflang-metadata-spec.md §3
@@ -27,7 +50,19 @@ import { NextRequest, NextResponse } from "next/server";
 import createMiddleware from "next-intl/middleware";
 
 import { isBookingPath } from "./lib/auth-routes";
-import { SCHEDULING_PAGES } from "./lib/modules.generated";
+import {
+  DOCS_PATH,
+  DOCS_ROUTE,
+  toInternalDocsPath,
+  toPublicDocsHref,
+} from "./lib/docs-path";
+import { PUBLIC_PAGES, SCHEDULING_PAGES } from "./lib/modules.generated";
+import {
+  SERVICES_PATH,
+  SERVICES_ROUTE,
+  toInternalServicesPath,
+  toPublicServicesHref,
+} from "./lib/services-path";
 import {
   DEFAULT_SECURITY_HEADERS,
   SCHEDULING_SECURITY_HEADERS,
@@ -70,6 +105,76 @@ export function isNonLocaleRoute(pathname: string): boolean {
   );
 }
 
+// The file routes' paths after an enabled-locale prefix; a route group adds no
+// segment, so `(authed)` is not in them. Kept in step with every route handler
+// that sets its own CSP by the drift test in
+// __tests__/middleware-file-routes.test.ts.
+const FILE_ROUTE_PATHS = [
+  /^\/reports\/[^/]+\/file$/,
+  /^\/account\/inbox\/message\/[^/]+\/file$/,
+  /^\/account\/artifacts\/[^/]+\/versions\/[^/]+\/file$/,
+];
+
+const LOCALE_PREFIX = new RegExp(`^/(${enabledLocales.join("|")})(?=/)`);
+
+export function isFileRoutePath(pathname: string): boolean {
+  const bare = pathname.replace(LOCALE_PREFIX, "");
+  return FILE_ROUTE_PATHS.some((path) => path.test(bare));
+}
+
+// The path the hidden docs route is rewritten to. Its first segment is no
+// enabled locale, so the locale layout's `assertEnabledLocale` answers it with
+// the site's not-found page (#10041 D3).
+const DOCS_UNMOUNTED_PATH = "/_ailk-docs-unmounted";
+
+function splitLocalePrefix(pathname: string): { prefix: string; bare: string } {
+  const prefix = LOCALE_PREFIX.exec(pathname)?.[0] ?? "";
+  return { prefix, bare: pathname.slice(prefix.length) };
+}
+
+/**
+ * `url` (absolute) with its locale-less pathname mapped back onto a public
+ * path by `toPublicHref` — `toPublicDocsHref` or `toPublicServicesHref`.
+ */
+function toPublicUrl(url: string, toPublicHref: (bare: string) => string): string {
+  const parsed = new URL(url);
+  const { prefix, bare } = splitLocalePrefix(parsed.pathname);
+  parsed.pathname = prefix + toPublicHref(bare);
+  return parsed.toString();
+}
+
+/**
+ * next-intl's response for a mapped docs or services request, with the
+ * internal path it was handed mapped back onto the public one: a redirect's
+ * `Location` and each `<url>` of the hreflang `Link` header. A rewrite is
+ * left as is.
+ */
+function withPublicUrls(
+  response: NextResponse,
+  toPublicHref: (bare: string) => string,
+): NextResponse {
+  const location = response.headers.get("location");
+  if (location) response.headers.set("location", toPublicUrl(location, toPublicHref));
+  const link = response.headers.get("Link");
+  if (link) {
+    response.headers.set(
+      "Link",
+      link.replace(/<([^>]+)>/g, (_entry, url: string) => `<${toPublicUrl(url, toPublicHref)}>`),
+    );
+  }
+  return response;
+}
+
+/** The baseline map without its CSP, for the file routes. */
+const FILE_ROUTE_SECURITY_HEADERS: Readonly<Record<string, string>> =
+  Object.freeze(
+    Object.fromEntries(
+      Object.entries(DEFAULT_SECURITY_HEADERS).filter(
+        ([name]) => name !== "Content-Security-Policy",
+      ),
+    ),
+  );
+
 export function middleware(request: NextRequest): NextResponse {
   // Step 1: Forward x-pathname to server components so generateMetadata can
   // build path-aware hreflang alternates (P2 S1). Clone the request headers
@@ -82,27 +187,82 @@ export function middleware(request: NextRequest): NextResponse {
   if (isNonLocaleRoute(request.nextUrl.pathname)) {
     const res = NextResponse.next({ request: { headers: requestHeaders } });
     applyHeaders(res.headers, DEFAULT_SECURITY_HEADERS);
+    if (!PUBLIC_PAGES) res.headers.set("X-Robots-Tag", "noindex");
     return res;
   }
 
-  const requestWithPathname = new NextRequest(request.url, {
-    headers: requestHeaders,
-    method: request.method,
-    body: request.body,
-  });
+  // #10041 D3 — on a site that moved its docs, map the public docs path onto
+  // the internal route, and answer the internal route itself with the 404.
+  let docsInternalUrl: URL | null = null;
+  if (DOCS_PATH !== DOCS_ROUTE) {
+    const { prefix, bare } = splitLocalePrefix(request.nextUrl.pathname);
+    const internal = toInternalDocsPath(bare);
+    if (internal !== null) {
+      docsInternalUrl = request.nextUrl.clone();
+      docsInternalUrl.pathname = prefix + internal;
+    } else if (bare === DOCS_ROUTE || bare.startsWith(`${DOCS_ROUTE}/`)) {
+      const res = NextResponse.rewrite(new URL(DOCS_UNMOUNTED_PATH, request.url), {
+        request: { headers: requestHeaders },
+      });
+      applyHeaders(res.headers, DEFAULT_SECURITY_HEADERS);
+      if (!PUBLIC_PAGES) res.headers.set("X-Robots-Tag", "noindex");
+      return res;
+    }
+  }
+
+  // #10043 D5 — on a site that moved its services, map the public base onto
+  // the internal route, and answer the internal route itself with a 308 onto
+  // the base (same origin, same locale prefix and query, so it cannot leave
+  // the site).
+  let servicesInternalUrl: URL | null = null;
+  if (docsInternalUrl === null && SERVICES_PATH !== SERVICES_ROUTE) {
+    const { prefix, bare } = splitLocalePrefix(request.nextUrl.pathname);
+    const internal = toInternalServicesPath(bare);
+    if (internal !== null) {
+      servicesInternalUrl = request.nextUrl.clone();
+      servicesInternalUrl.pathname = prefix + internal;
+    } else if (bare === SERVICES_ROUTE || bare.startsWith(`${SERVICES_ROUTE}/`)) {
+      const target = request.nextUrl.clone();
+      target.pathname = prefix + toPublicServicesHref(bare);
+      const res = NextResponse.redirect(target, 308);
+      applyHeaders(res.headers, DEFAULT_SECURITY_HEADERS);
+      if (!PUBLIC_PAGES) res.headers.set("X-Robots-Tag", "noindex");
+      return res;
+    }
+  }
+
+  const requestWithPathname = new NextRequest(
+    docsInternalUrl ?? servicesInternalUrl ?? request.url,
+    {
+      headers: requestHeaders,
+      method: request.method,
+      body: request.body,
+    },
+  );
 
   // Step 2: run next-intl middleware (locale detection + rewrite/redirect)
-  const intlResponse = intlMiddleware(requestWithPathname) as NextResponse;
+  let intlResponse = intlMiddleware(requestWithPathname) as NextResponse;
+  if (docsInternalUrl) intlResponse = withPublicUrls(intlResponse, toPublicDocsHref);
+  if (servicesInternalUrl) {
+    intlResponse = withPublicUrls(intlResponse, toPublicServicesHref);
+  }
 
   // Step 3: apply the 7 baseline security headers to the response. The booking
   // pages of a site that carries the scheduling module get the same map with
-  // Cal.com's origin added to the CSP (#8843 D12); no other page does.
+  // Cal.com's origin added to the CSP (#8843 D12); no other page does. The
+  // file routes get the six others and keep their own sandbox CSP (#9162).
   applyHeaders(
     intlResponse.headers,
-    SCHEDULING_PAGES && isBookingPath(request.nextUrl.pathname, enabledLocales)
-      ? SCHEDULING_SECURITY_HEADERS
-      : DEFAULT_SECURITY_HEADERS,
+    isFileRoutePath(request.nextUrl.pathname)
+      ? FILE_ROUTE_SECURITY_HEADERS
+      : SCHEDULING_PAGES &&
+          isBookingPath(request.nextUrl.pathname, enabledLocales)
+        ? SCHEDULING_SECURITY_HEADERS
+        : DEFAULT_SECURITY_HEADERS,
   );
+  // #10040 decision 7 — a site with neither marketing nor docs-blog (a hub)
+  // asks every crawler to keep out of every page, read from the module list.
+  if (!PUBLIC_PAGES) intlResponse.headers.set("X-Robots-Tag", "noindex");
 
   return intlResponse;
 }
@@ -118,6 +278,13 @@ export function middleware(request: NextRequest): NextResponse {
 // og-default.png — and each 404'd (#4090 item 4). robots.txt and sitemap.xml are
 // route handlers rather than public/ files, but they carry extensions too and
 // are equally not locale-scoped, so the same rule covers them.
+//
+// BotID's proxy prefix (`withBotId`, `botid/next/config`, #9889 D7) is
+// excluded too, exactly that two-segment prefix and nothing wider, so
+// next-intl never rewrites it and the security headers never stamp
+// `frame-ancestors 'none'` on it; `withBotId` sets that prefix's own
+// `X-Frame-Options: SAMEORIGIN` and `frame-ancestors 'self'`.
 export const config = {
-  matcher: "/((?!_next/static|_next/image|_next/server|.*\\..*).*)",
+  matcher:
+    "/((?!_next/static|_next/image|_next/server|149e9513-01fa-4fb0-aad4-566afd725d1b/2d206a39-8ed7-437e-a3be-862e0f06eea3/|.*\\..*).*)",
 };

package/templates/apps/web/next.config.mjs

@@ -1,11 +1,13 @@
-import { readFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
-import { legacyRedirects } from "@working-theory/templates/routes";
+import { DocsPathSchema, ServicesPathSchema } from "@working-theory/site-config/schema";
+import { legacyRedirects, ROUTES, SERVICES_ROUTE } from "@working-theory/templates/routes";
 import { parseStealth } from "@working-theory/web-i18n/stealth";
+import { withBotId } from "botid/next/config";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
 // analyzerMode 'json' writes .next/analyze/client.json (and nodejs.json,
@@ -80,6 +82,203 @@ function readDefaultLocaleFromProjectYaml() {
 const enabledLocalesAtBuild = readLocalesFromProjectYaml();
 const defaultLocaleAtBuild = readDefaultLocaleFromProjectYaml();
 
+// #10041 D4 — where the docs live. A site sets `docsPath` in
+// content/_site.mdx (its own file, which `create-ailk update` never rewrites);
+// it is read here, refused by name when it cannot be served, and baked into
+// NEXT_PUBLIC_AILK_DOCS_PATH for the middleware and every docs-URL reader
+// (lib/docs-path.ts). Absent — the file, its frontmatter or the key — is
+// `/docs`, today's path. A refusal throws, so `next build` fails before a page
+// renders (the parseStealth posture).
+const DOCS_ROUTE = "/docs";
+
+function refuseDocsPath(value, reason) {
+  throw new Error(`content/_site.mdx docsPath ${value}: ${reason}`);
+}
+
+/**
+ * The mount checks a public path takes before it is served (#10041 D4, shared
+ * with `services.path` by #10043 D4), each refused through `refuse`:
+ *
+ * 1. A locale code as the first segment would be read as the locale.
+ * 2. A path that shadows another page, or sits under a catch-all. A route is
+ *    shadowed when the path matches its leading segments, a `:param` segment
+ *    matching any one segment (`/products/docs` hides the `/products/:slug`
+ *    page whose slug is `docs`). `ownRoutes` are the setting's own rows.
+ */
+function refuseUnmountablePath(value, ownRoutes, refuse) {
+  const firstSegment = value.split("/")[1];
+  const locales = enabledLocalesAtBuild.split(",").map((l) => l.toLowerCase());
+  if (locales.includes(firstSegment)) {
+    refuse(value, `its first segment is the enabled locale ${firstSegment}`);
+  }
+
+  const valueSegments = value.split("/").slice(1);
+  for (const { route } of ROUTES) {
+    if (ownRoutes.includes(route)) continue;
+    const catchAll = /^(.*)\/:\.\.\.[^/]+$/.exec(route);
+    if (catchAll) {
+      if (value.startsWith(`${catchAll[1]}/`)) {
+        refuse(value, `it is under the ${catchAll[1]} catch-all route`);
+      }
+      continue;
+    }
+    const routeSegments = route.split("/").slice(1);
+    const shadows =
+      valueSegments.length <= routeSegments.length &&
+      valueSegments.every(
+        (segment, i) =>
+          routeSegments[i].startsWith(":") || routeSegments[i] === segment,
+      );
+    if (shadows) refuse(value, `it shadows the ${route} route`);
+  }
+}
+
+const contentRootAtBuild =
+  process.env.AILK_CONTENT_ROOT || join(process.cwd(), "../../content");
+
+/** A file's YAML frontmatter, parsed; `undefined` when absent or unreadable. */
+function readFrontmatter(path) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return undefined;
+  }
+  // The frontmatter is the text between the first two `---` lines.
+  const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(raw);
+  return match ? parseYaml(match[1]) : undefined;
+}
+
+const siteFrontmatterAtBuild = readFrontmatter(join(contentRootAtBuild, "_site.mdx"));
+
+function readDocsPathFromSiteMdx() {
+  const value = siteFrontmatterAtBuild?.docsPath;
+  if (value === undefined || value === null) return DOCS_ROUTE;
+
+  const parsed = DocsPathSchema.safeParse(value);
+  if (!parsed.success) {
+    refuseDocsPath(
+      value,
+      "must be one to four lowercase kebab segments with a leading slash and no trailing slash, not starting with api, og or v1, and not under /docs",
+    );
+  }
+  const docsPath = parsed.data;
+  refuseUnmountablePath(
+    docsPath,
+    [DOCS_ROUTE, `${DOCS_ROUTE}/:...slug`],
+    refuseDocsPath,
+  );
+
+  // 3. The site's docs-blog files must follow the setting: its docs source
+  //    must take `DOCS_PATH` as its base.
+  if (docsPath !== DOCS_ROUTE) {
+    const sourcePath = join(process.cwd(), "lib/source.ts");
+    if (!existsSync(sourcePath)) {
+      refuseDocsPath(docsPath, "the site carries no docs-blog module");
+    }
+    if (!/\bbaseUrl:\s*DOCS_PATH\b/.test(readFileSync(sourcePath, "utf8"))) {
+      refuseDocsPath(
+        docsPath,
+        "this site's docs-blog files predate docsPath; re-install the docs-blog module's files",
+      );
+    }
+  }
+  return docsPath;
+}
+
+const docsPathAtBuild = readDocsPathFromSiteMdx();
+
+// #10043 D4 — where the services live, and their categories. A site sets
+// `services: { path: /capabilities }` in content/_site.mdx; it is read here,
+// refused by name when it cannot be served, and baked into
+// NEXT_PUBLIC_AILK_SERVICES_PATH for the middleware, the page renderer and
+// every services-URL reader (lib/services-path.ts). Absent is `/services`.
+// A Service's `parent` (its category) is checked here too, for the default
+// locale's MDX files: it must name a Service with no parent of its own, and
+// the site must carry the nested route.
+
+function refuseServicesPath(value, reason) {
+  throw new Error(`content/_site.mdx services.path ${value}: ${reason}`);
+}
+
+function readServicesPathFromSiteMdx() {
+  const value = siteFrontmatterAtBuild?.services?.path;
+  if (value === undefined || value === null) return SERVICES_ROUTE;
+
+  const parsed = ServicesPathSchema.safeParse(value);
+  if (!parsed.success) {
+    refuseServicesPath(
+      value,
+      "must be one to four lowercase kebab segments with a leading slash and no trailing slash, not starting with api, og or v1, and not under /services",
+    );
+  }
+  const servicesPath = parsed.data;
+  refuseUnmountablePath(
+    servicesPath,
+    [SERVICES_ROUTE, `${SERVICES_ROUTE}/:slug`, `${SERVICES_ROUTE}/:slug/:child`],
+    refuseServicesPath,
+  );
+  // Two moved mounts must not overlap, in either direction.
+  const overlaps = (a, b) => a === b || a.startsWith(`${b}/`);
+  if (overlaps(servicesPath, docsPathAtBuild) || overlaps(docsPathAtBuild, servicesPath)) {
+    refuseServicesPath(servicesPath, `it overlaps docsPath ${docsPathAtBuild}`);
+  }
+  return servicesPath;
+}
+
+function refuseServiceParent(file, value, reason) {
+  throw new Error(`${file} parent ${value}: ${reason}`);
+}
+
+function readServiceParents() {
+  // Under the database adapter the pages are not on disk; the nested route
+  // answers 404 for a bad parent at request time instead.
+  if (process.env.CONTENT_ADAPTER === "database") return;
+  const dirs = [`${defaultLocaleAtBuild}/Service`, "Service"];
+  const nestedRoute = join(process.cwd(), "app/[locale]/services/[slug]/[child]/page.tsx");
+  for (const dir of dirs) {
+    let files;
+    try {
+      files = readdirSync(join(contentRootAtBuild, dir)).filter((f) => f.endsWith(".mdx"));
+    } catch {
+      continue;
+    }
+    const pages = files.map((file) => {
+      const frontmatter = readFrontmatter(join(contentRootAtBuild, dir, file)) ?? {};
+      return {
+        file: `content/${dir}/${file}`,
+        slug: frontmatter.slug ?? file.replace(/\.mdx$/, ""),
+        parent: frontmatter.parent,
+      };
+    });
+    const bySlug = new Map(pages.map((page) => [page.slug, page]));
+    for (const page of pages) {
+      if (page.parent === undefined || page.parent === null) continue;
+      const category = bySlug.get(page.parent);
+      if (category === undefined) {
+        refuseServiceParent(page.file, page.parent, `it names no Service in content/${dir}`);
+      }
+      if (category.parent !== undefined && category.parent !== null) {
+        refuseServiceParent(
+          page.file,
+          page.parent,
+          "that Service has its own parent; services take one category level",
+        );
+      }
+      if (!existsSync(nestedRoute)) {
+        refuseServiceParent(
+          page.file,
+          page.parent,
+          "this site's services routes predate service categories; run create-ailk sync-routes",
+        );
+      }
+    }
+  }
+}
+
+const servicesPathAtBuild = readServicesPathFromSiteMdx();
+readServiceParents();
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   reactStrictMode: true,
@@ -104,6 +303,10 @@ const nextConfig = {
   // output shipped without them and postbuild's assert-content-bundled failed.
   outputFileTracingIncludes: {
     "/**": ["../../content/**/*.mdx"],
+    // #10041 D8 — /sitemap.xml and /llms.txt list the docs by reading this
+    // app's own content/<locale>/docs/ at request time.
+    "/sitemap.xml": ["./content/**/*.mdx"],
+    "/llms.txt": ["./content/**/*.mdx"],
   },
   // Workspace packages live outside this app's directory. Next.js must
   // transpile them from source so that "use client" / "use server" directives
@@ -160,6 +363,13 @@ const nextConfig = {
     // onto the hub's. Part of the source, not an operator setting: a build
     // that carries the relay always carries the flag, and no other build does.
     NEXT_PUBLIC_AILK_SAME_ORIGIN_RELAY: "1",
+    // The docs' public path (#10041), from content/_site.mdx's docsPath, or
+    // `/docs`. Read by middleware.ts and lib/docs-path.ts.
+    NEXT_PUBLIC_AILK_DOCS_PATH: docsPathAtBuild,
+    // The services' public base (#10043), from content/_site.mdx's
+    // services.path, or `/services`. Read by middleware.ts,
+    // lib/services-path.ts and @working-theory/page-renderer.
+    NEXT_PUBLIC_AILK_SERVICES_PATH: servicesPathAtBuild,
   },
   async headers() {
     if (!STEALTH) return [];
@@ -197,7 +407,14 @@ const sentryBuildOptions = {
     : {}),
 };
 
+// #9889 D6 — `withBotId` adds BotID's two rewrites (the challenge script and
+// its proxy) and one header rule on its own proxy prefix, which middleware.ts
+// keeps out of its matcher. It is not gated on `AILK_BOOKING_BOT_CHECK`: this
+// config is read at build time, the switch at run time, and an unused rewrite
+// answers nothing. It sits directly inside Sentry so the substrings
+// (the MDX wrap and the next-intl wrap, quoted nowhere else) that create-ailk
+// edits stay intact.
 export default withSentryConfig(
-  withBundleAnalyzer(withNextIntl(nextConfig)),
+  withBotId(withBundleAnalyzer(withNextIntl(nextConfig))),
   sentryBuildOptions,
 );

package/templates/apps/web/package.json

@@ -6,7 +6,7 @@
   "license": "Apache-2.0",
   "scripts": {
     "dev": "next dev --webpack",
-    "build": "next build --webpack",
+    "build": "tsx scripts/check-nav-labels.ts && next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
     "type-check": "tsc --noEmit",
@@ -37,8 +37,9 @@
     "@working-theory/validation": "workspace:*",
     "@working-theory/web-i18n": "workspace:*",
     "better-auth": "1.6.22",
+    "botid": "1.5.11",
     "lucide-react": "^0.577.0",
-    "next": "^16.3.8",
+    "next": "^16.4.3",
     "next-intl": "^3.26.3",
     "next-mdx-remote": "^6.0.0",
     "pg": "^8.22.0",

package/templates/apps/web/scripts/assert-content-bundled.ts

@@ -8,8 +8,8 @@
  * See: docs/runbooks/page-renderer-deploy-verification.md §1 Cause 2
  */
 
-import { existsSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readdirSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // apps/web/ is one level up from scripts/
@@ -18,10 +18,32 @@ const scriptDir = resolve(fileURLToPath(import.meta.url), "..");
 const appWebDir = resolve(scriptDir, "..");
 const standaloneDir = join(appWebDir, ".next", "standalone");
 
-// Sentinel file: content/en/HomePage/home.mdx
-// Traced from ../../content/en/HomePage/home.mdx (relative to apps/web),
-// placed at standaloneDir/content/en/HomePage/home.mdx by Next.js file tracing.
-const sentinelRelative = join("content", "en", "HomePage", "home.mdx");
+// Sentinel: the first MDX file under <repo-root>/content on disk — one traced
+// file proves the tracing; it does not count the others. A site that
+// dropped the marketing module (#10040) has no HomePage — only its legal
+// pages — so the sentinel is whichever page this site carries, traced from
+// ../../content/<locale>/<Type>/<page>.mdx (relative to apps/web) and placed
+// at standaloneDir/content/... by Next.js file tracing.
+const contentDir = resolve(appWebDir, "..", "..", "content");
+function firstMdx(dir: string): string | undefined {
+  if (!existsSync(dir)) return undefined;
+  for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const abs = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      const found = firstMdx(abs);
+      if (found !== undefined) return found;
+    } else if (entry.name.endsWith(".mdx")) {
+      return abs;
+    }
+  }
+  return undefined;
+}
+const sentinelAbs = firstMdx(contentDir);
+if (sentinelAbs === undefined) {
+  console.error("[assert-content-bundled] ERROR: no .mdx file under content/ to trace.");
+  process.exit(1);
+}
+const sentinelRelative = join("content", relative(contentDir, sentinelAbs));
 const sentinelPath = join(standaloneDir, sentinelRelative);
 
 if (!existsSync(standaloneDir)) {

package/templates/apps/web/scripts/check-nav-labels.ts

@@ -0,0 +1,39 @@
+/**
+ * Fail the build when a nav key has no text (#10045 D2).
+ *
+ * Every `labelKey` / `headingKey` / `descKey` in `lib/nav-config.ts`, and the
+ * keys the layout resolves by name, must exist in the `nav` namespace of every
+ * `messages/<locale>.json` (or its site overlay). A missing key would render
+ * as raw text in the header or footer; this check names the key and the file
+ * instead. Runs as the first step of `pnpm build`.
+ */
+
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  findMissingNavLabels,
+  formatMissingNavLabels,
+} from "../lib/nav-label-check";
+import { usedNavLabelKeys } from "../lib/nav-label-keys";
+
+const appWebDir = resolve(fileURLToPath(import.meta.url), "..", "..");
+const messagesDir = resolve(appWebDir, "messages");
+
+const keys = usedNavLabelKeys();
+const missing = findMissingNavLabels(messagesDir, keys);
+
+if (missing.length > 0) {
+  console.error(
+    `[check-nav-labels] ERROR:\n${formatMissingNavLabels(missing)}`,
+  );
+  console.error(
+    "[check-nav-labels] Add each key's text to the `nav` namespace of that file " +
+      "(or messages/site/<locale>.json).",
+  );
+  process.exit(1);
+}
+
+console.log(
+  `[check-nav-labels] ✓ ${keys.size} nav keys resolve in every locale`,
+);

package/templates/apps/web/sentry.server.config.ts

@@ -12,7 +12,11 @@
 
 import * as Sentry from "@sentry/nextjs";
 
-import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+import {
+  scrubSpanDescription,
+  scrubTelemetryQuery,
+  scrubTelemetryUrl,
+} from "./lib/telemetry-scrub";
 
 // #5613 / security review PR #5639: the report-grant token (?g=<id> on
 // /reports/<slug>, #5562) is a bearer credential for a private customer
@@ -21,13 +25,29 @@ import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
 // header, the transaction name, navigation breadcrumbs, and any URL
 // captured as span/trace data (e.g. `url.full`,
 // `http.request.header.referer`) here too.
+//
+// #9969 D9 (#8329): the Stripe SDK's outgoing requests carry a customer id in
+// their URL and query, so a span's `description` (`<METHOD> <url>`), its raw
+// `url`/`url.path`/`http.target`, and the separate query keys (`http.query`,
+// `url.query`) on spans, the trace and breadcrumbs are scrubbed as well.
+const QUERY_KEYS = ["http.query", "url.query"];
+
+function scrubQueryData(data: Record<string, unknown>): void {
+  for (const key of QUERY_KEYS) {
+    const value = data[key];
+    if (typeof value === "string") {
+      data[key] = scrubTelemetryQuery(value);
+    }
+  }
+}
+
 function scrubSentryEvent<
   T extends {
     request?: { url?: string; headers?: Record<string, string> };
     transaction?: string;
     breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
     contexts?: { trace?: { data?: Record<string, unknown> } };
-    spans?: { data?: Record<string, unknown> }[];
+    spans?: { description?: string; data?: Record<string, unknown> }[];
   },
 >(event: T): T {
   if (event.request?.url) {
@@ -60,6 +80,7 @@ function scrubSentryEvent<
     if (typeof url === "string") {
       crumb.data["url"] = scrubTelemetryUrl(url);
     }
+    scrubQueryData(crumb.data);
   }
   const scrubSpanData = (data?: Record<string, unknown>): void => {
     if (!data) return;
@@ -67,15 +88,22 @@ function scrubSentryEvent<
       "url.full",
       "http.url",
       "http.request.header.referer",
+      "url",
+      "url.path",
+      "http.target",
     ]) {
       const value = data[key];
       if (typeof value === "string") {
         data[key] = scrubTelemetryUrl(value);
       }
     }
+    scrubQueryData(data);
   };
   scrubSpanData(event.contexts?.trace?.data);
   for (const span of event.spans ?? []) {
+    if (span.description) {
+      span.description = scrubSpanDescription(span.description);
+    }
     scrubSpanData(span.data);
   }
   return event;