create-ailk 0.3.0 → 0.5.0

package/templates/apps/web/lib/__tests__/server-api.test.ts

@@ -0,0 +1,61 @@
+/**
+ * Tests for `forwardedCookieInit` — the RSC cookie/origin-forwarding helper
+ * (#5371 shepherd fix-up).
+ *
+ * Contract: the returned `init.headers` always carries the forwarded
+ * `cookie`, and carries `origin` ONLY when the incoming request's `Origin`
+ * header is present — never a fabricated value. This is what lets a Server
+ * Action `PUT`/`PATCH` through `@working-theory/api-client`'s `workspace.*`
+ * namespace pass `apps/api`'s same-origin CSRF check (`isOriginAllowed`),
+ * which Node's server-side `fetch` cannot satisfy on its own since it never
+ * sets `Origin`.
+ */
+import { forwardedCookieInit } from "../server-api";
+
+const mockCookies = jest.fn();
+const mockHeaders = jest.fn();
+
+jest.mock("next/headers", () => ({
+  __esModule: true,
+  cookies: (...args: unknown[]) => mockCookies(...args),
+  headers: (...args: unknown[]) => mockHeaders(...args),
+}));
+
+describe("forwardedCookieInit", () => {
+  beforeEach(() => {
+    mockCookies.mockReset();
+    mockHeaders.mockReset();
+  });
+
+  it("forwards cookie + origin when the incoming request carries an Origin header", async () => {
+    mockCookies.mockResolvedValue({
+      toString: () => "better-auth.session_token=abc",
+    });
+    mockHeaders.mockResolvedValue(
+      new Headers({ origin: "https://app.example.com" }),
+    );
+
+    const init = await forwardedCookieInit();
+
+    expect(init).toEqual({
+      headers: {
+        cookie: "better-auth.session_token=abc",
+        origin: "https://app.example.com",
+      },
+    });
+  });
+
+  it("forwards cookie alone — no origin key at all — when Origin is absent", async () => {
+    mockCookies.mockResolvedValue({
+      toString: () => "better-auth.session_token=abc",
+    });
+    mockHeaders.mockResolvedValue(new Headers());
+
+    const init = await forwardedCookieInit();
+
+    expect(init).toEqual({
+      headers: { cookie: "better-auth.session_token=abc" },
+    });
+    expect(init.headers).not.toHaveProperty("origin");
+  });
+});

package/templates/apps/web/lib/__tests__/structured-data.test.tsx

@@ -310,7 +310,7 @@ const NO_STRUCTURED_DATA_ROUTES: ReadonlyArray<{
     reason: "interactive flow engine, API-backed",
     subtree: true,
   },
-  { route: "schedule", reason: "booking surface, API-backed", subtree: true },
+  { route: "meet", reason: "booking surface, API-backed", subtree: true },
   { route: "sign-in", reason: "auth surface, not a content page" },
 ];
 
@@ -345,14 +345,36 @@ function exemption(route: string): string | undefined {
   )?.reason;
 }
 
-// The page identity a route renders — the two `renderPage({ type, slug })`
-// shapes tools/lint-check-content-renders.ts recognises (a literal slug, or a
-// slug taken from params). A route that reads its identity another way
-// (e.g. a page-type manifest) is not recognised and must be declared.
+// The page identity a route renders — the three shapes
+// tools/lint-check-content-renders.ts recognises: `renderPage({ type, slug })`
+// with a literal slug, the same with a slug taken from params, and a direct
+// `getMdxSource("<Type>", slug, …)` for a route that composes its own body.
+// This file previously mirrored only the first two and so drifted from the
+// tool its comment names (whose own `GET_MDX_SOURCE_RE` has carried the third
+// arm all along); #5562 restored the parity. A route that reads its identity
+// some other way (e.g. a page-type manifest) is still unrecognised and must
+// be declared.
 const RENDER_PAGE_EXACT_RE =
   /renderPage\s*\(\s*\{[^}]*type\s*:\s*["']([A-Za-z]+)["'][^}]*slug\s*:\s*["']([^"']+)["']/s;
 const RENDER_PAGE_DYNAMIC_RE =
   /renderPage\s*\(\s*\{[^}]*type\s*:\s*["']([A-Za-z]+)["'][^}]*\bslug\s*(?!:\s*["'])/s;
+// A route that composes its own body instead of calling `renderPage` — it
+// resolves content with `getMdxSource(<Type>, slug, locale)` and emits the
+// graph itself via `pageToJsonLd` + `<JsonLdScript>`. That is not a route
+// hiding from this check; it is the SAME declaration one level down, since
+// `renderPage` resolves its own content with exactly this call. `/reports/
+// [slug]` (#5562) is the first: it owns a full-bleed `<main>` and a header
+// section that already renders the title, so `renderPage`'s own `<h1>`/`<p>`
+// would duplicate it.
+//
+// Recognising the shape is deliberately better than exempting the route:
+// an exemption declares "nothing is known to emit JSON-LD here" — false for
+// these routes — and would silence the check for a page that DOES emit a
+// graph. Recognised, the route is rendered and validated like any other.
+// Matched only after both `renderPage` shapes above, so a route that uses
+// `renderPage` is still read through that (richer, slug-bearing) form.
+// Mirrors `GET_MDX_SOURCE_RE` in tools/lint-check-content-renders.ts.
+const GET_MDX_SOURCE_RE = /getMdxSource\s*\(\s*["']([A-Za-z]+)["']/s;
 
 function routeIdentity(
   file: string,
@@ -362,6 +384,11 @@ function routeIdentity(
   if (exact) return { type: exact[1] as string, slug: exact[2] as string };
   const dynamic = RENDER_PAGE_DYNAMIC_RE.exec(src);
   if (dynamic) return { type: dynamic[1] as string, slug: null };
+  // Self-composing route (see GET_MDX_SOURCE_RE). Its slug always comes from
+  // the route params — a self-composing FIXED route would name its slug as a
+  // literal to `getMdxSource`, and none exists — so the dynamic path applies.
+  const ownBody = GET_MDX_SOURCE_RE.exec(src);
+  if (ownBody) return { type: ownBody[1] as string, slug: null };
   return null;
 }
 

package/templates/apps/web/lib/nav-config.ts

@@ -1,13 +1,33 @@
-// nav-config.ts — Nav item registry for apps/web OSS template (#1451)
+// nav-config.ts — Nav item registry for apps/web (#1451, re-shaped by #5469).
 //
-// The OSS template ships a focused navigation inventory — home, docs, and blog.
-// Marketing-site items (pricing, services, about) belong in the per-site fork.
-// Paths are locale-agnostic; Nav prefixes them with the active locale at render.
+// The Free marketing-site template's nav (the approved chrome, #5469 D5):
+// a Product flyout (How it works · Features · FAQ), then How it works,
+// Pricing and About as top-level items. Paths are locale-agnostic; Nav
+// prefixes them with the active locale at render.
+//
+// In a SCAFFOLD this file is regenerated by create-ailk from the declared
+// route surfaces (`renderNavConfig` in packages/create-ailk/src/surfaces.ts)
+// so the nav never links a page the scaffold does not carry — keep the two in
+// step when the base item set changes.
 
 import type { NavItem } from "@working-theory/ui";
+import { BookOpen, HelpCircle, Layers, Sparkles } from "lucide-react";
 
 export const navItems: NavItem[] = [
-  { labelKey: "home", path: "/" },
-  { labelKey: "docs", path: "/docs" },
-  { labelKey: "blog", path: "/blog" },
+  {
+    labelKey: "product",
+    flyout: {
+      presentation: "list",
+      width: "trigger",
+      features: [
+        { labelKey: "howItWorks", descKey: "howItWorksDesc", icon: Layers, path: "/how-it-works" },
+        { labelKey: "features", descKey: "featuresDesc", icon: Sparkles, path: "/features" },
+        { labelKey: "faq", descKey: "faqDesc", icon: HelpCircle, path: "/faq" },
+      ],
+      actions: [{ labelKey: "docs", icon: BookOpen, path: "/how-it-works" }],
+    },
+  },
+  { labelKey: "howItWorks", path: "/how-it-works" },
+  { labelKey: "pricing", path: "/pricing" },
+  { labelKey: "about", path: "/about" },
 ];

package/templates/apps/web/lib/server-api.ts

@@ -3,22 +3,26 @@
  * (#4665 D9).
  *
  * Forwards the incoming request's cookies to `@working-theory/api-client`'s
- * `waitlistExperiments` namespace (B0, #4671) so `apps/api`'s cookie-session
- * auth preHandler resolves the SAME Better Auth session the browser holds —
- * both apps share the session store. GETs only, every page is an RSC; there
- * is no client fetch and no `NEXT_PUBLIC_` credential (D9).
+ * `waitlistExperiments` / `workspace` namespaces (B0, #4671; #5371) so
+ * `apps/api`'s cookie-session auth preHandler resolves the SAME Better Auth
+ * session the browser holds — both apps share the session store. Every page
+ * is an RSC and every write is a Server Action; there is no client fetch and
+ * no `NEXT_PUBLIC_` credential (D9). For a Server Action `PUT`/`PATCH`, the
+ * incoming request's `Origin` is forwarded alongside the cookie so
+ * `apps/api`'s same-origin CSRF check (`isOriginAllowed`) passes — Node's
+ * server-side `fetch` never sets `Origin` on its own.
  *
  * `apps/web` may not import `apps/api` directly (architecture.yaml) — every
- * read goes through `@working-theory/api-client`'s typed namespace, never a
+ * call goes through `@working-theory/api-client`'s typed namespace, never a
  * hand-rolled `fetch`. This module supplies exactly the two things that
- * namespace doesn't own: the cookie-forwarding `init` (B0's additive
+ * namespace doesn't own: the cookie/origin-forwarding `init` (B0's additive
  * `init?: { headers }` on `http.get`) and the envelope→`ApiError` unwrap
- * (mirrors `apps-paid/workspace/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
+ * (mirrors `apps-paid/admin/lib/api-error.ts`'s `unwrapEnvelope`, adapted to
  * the `@working-theory/api-client` `ApiResult<T>` shape B0 already returns
  * rather than re-parsing the wire envelope by hand).
  */
 
-import { cookies } from "next/headers";
+import { cookies, headers } from "next/headers";
 
 /**
  * Structural mirror of `@working-theory/api-client`'s `ApiResult<T>`
@@ -57,15 +61,27 @@ interface ErrorBody {
 }
 
 /**
- * Forward the incoming request's cookies as the `init` every
- * `waitlistExperiments.*` call accepts. Call once per request — `cookies()`
- * reads the current RSC request context.
+ * Forward the incoming request's cookies — and, when present, its `Origin` —
+ * as the `init` every `waitlistExperiments.*` / `workspace.*` call accepts.
+ * Call once per request — `cookies()` / `headers()` read the current RSC
+ * request context.
+ *
+ * The `Origin` forward matters for every non-GET call: `apps/api`'s
+ * `authPreHandler` (`isOriginAllowed`) requires a matching `Origin` header on
+ * a cookie-authenticated mutating request, and Node's server-side `fetch`
+ * (unlike a browser XHR/fetch) never sets one on its own. A Server Action's
+ * incoming request DOES carry the browser's real `Origin`, so re-forwarding
+ * it here — rather than fabricating one — lets a genuine same-origin write
+ * pass the check exactly as a browser-originated one would. RSC `GET`s are
+ * unaffected: `isOriginAllowed` short-circuits `true` for safe methods before
+ * it ever inspects the header.
  */
 export async function forwardedCookieInit(): Promise<{
-  headers: { cookie: string };
+  headers: { cookie: string; origin?: string };
 }> {
   const cookieHeader = (await cookies()).toString();
-  return { headers: { cookie: cookieHeader } };
+  const origin = (await headers()).get("origin");
+  return { headers: { cookie: cookieHeader, ...(origin ? { origin } : {}) } };
 }
 
 /**

package/templates/apps/web/lib/site-chrome.ts

@@ -0,0 +1,29 @@
+// site-chrome.ts — resolved template layout knobs.
+//
+// GENERATED by create-ailk from the declared template's `layout` block
+// (#5612). A scaffold with no template, or a template with no `layout`
+// block, gets these defaults — byte-identical to every scaffold before this
+// file existed. `apps/web/app/[locale]/layout.tsx` reads this to decide:
+//   - nav: "mark-only" → Nav renders the brand mark + right-hand controls
+//     only (no nav links).
+//   - footer: "centered" → Footer renders its existing centered variant.
+//   - announcementBanner: false → the home-only announcement Banner is not
+//     mounted (the cookie-consent Banner is unaffected — it is not an
+//     announcement).
+//   - home: "deck" → the locale-root route mounts MarketingShell with
+//     snap="mandatory" + deckHero (spec 5426 D7); every other route is
+//     unaffected.
+
+export interface SiteChrome {
+  nav: "full" | "mark-only";
+  footer: "columns" | "centered";
+  announcementBanner: boolean;
+  home: "default" | "deck";
+}
+
+export const siteChrome: SiteChrome = {
+  nav: "full",
+  footer: "columns",
+  announcementBanner: true,
+  home: "default",
+};

package/templates/apps/web/lib/telemetry-scrub.ts

@@ -0,0 +1,46 @@
+// Strips token-bearing query params from a URL before it's reported to
+// third-party telemetry (Google Analytics, Sentry). #5562 found the report
+// grant token (`/reports/<slug>?g=<grantId>`) — the bearer credential for a
+// private customer deliverable — riding `document.location.href` into GA's
+// `page_location` default and into Sentry events, transactions, and session
+// replays. This is the single source of the stripped-parameter list.
+//
+// Mirrored (duplicated, not shared) in packages/analytics/src/scrub.ts,
+// since apps/* must not import @working-theory/* packages — keep both lists
+// in sync (#5613).
+export const TOKEN_QUERY_PARAMS = ["g"];
+
+// Sentry navigation breadcrumbs (`data.to`/`data.from`) are relative
+// (`path?search`, no origin) rather than the absolute URLs GA and
+// `request.url` deal in — resolve against a throwaway base so relative
+// values get scrubbed too, then strip the base back off (security review,
+// PR #5639).
+const RELATIVE_URL_BASE = "https://scrub.invalid";
+
+function hasScheme(url: string): boolean {
+  return /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(url) || url.startsWith("//");
+}
+
+export function scrubTelemetryUrl(url: string): string {
+  const relative = !hasScheme(url);
+  let parsed: URL;
+  try {
+    parsed = relative ? new URL(url, RELATIVE_URL_BASE) : new URL(url);
+  } catch {
+    return url;
+  }
+
+  let changed = false;
+  for (const param of TOKEN_QUERY_PARAMS) {
+    if (parsed.searchParams.has(param)) {
+      parsed.searchParams.delete(param);
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return url;
+  }
+  const result = parsed.toString();
+  return relative ? result.slice(RELATIVE_URL_BASE.length) : result;
+}

package/templates/apps/web/messages/en.json

@@ -9,7 +9,17 @@
     "schedule": "Book a call",
     "signIn": "Sign in",
     "signOut": "Sign out",
-    "account": "Account"
+    "account": "Account",
+    "product": "Product",
+    "howItWorks": "How it works",
+    "howItWorksDesc": "What happens from install to launch",
+    "features": "Features",
+    "featuresDesc": "Everything the kit ships with",
+    "faq": "FAQ",
+    "faqDesc": "Answers to the questions we get most",
+    "pricing": "Pricing",
+    "about": "About",
+    "getStarted": "Get started"
   },
   "consent": {
     "title": "Cookie Preferences",
@@ -167,10 +177,35 @@
     "heading": "Launch Service",
     "emptyState": "Launch Service page content coming soon."
   },
+  "leadsInbox": {
+    "title": "Leads",
+    "description": "Every lead your site has captured, newest first.",
+    "forbiddenHeadline": "You don't have access",
+    "forbiddenDescription": "Sign in with the account that owns this site to see the leads it captured.",
+    "table": {
+      "caption": "Leads captured by your site",
+      "columnName": "Name",
+      "columnEmail": "Email",
+      "columnSource": "Source",
+      "columnCreated": "Captured",
+      "unavailable": "—",
+      "next": "Next page",
+      "emptyHeadline": "No leads yet",
+      "emptyDescription": "Leads captured by your site's forms will appear here."
+    }
+  },
   "partners": {
     "heading": "Partners",
     "emptyState": "Partners listing coming soon."
   },
+  "pricing": {
+    "heading": "Pricing",
+    "emptyState": "Pricing page content coming soon."
+  },
+  "privacy": {
+    "heading": "Privacy Policy",
+    "emptyState": "Privacy policy content coming soon."
+  },
   "products": {
     "heading": "Products",
     "emptyState": "Products listing coming soon."
@@ -215,6 +250,10 @@
     "description": "Deep dives into the architecture and internals of this site.",
     "emptyState": "Technical articles coming soon."
   },
+  "terms": {
+    "heading": "Terms of Service",
+    "emptyState": "Terms of service content coming soon."
+  },
   "testimonials": {
     "heading": "Testimonials",
     "emptyState": "Testimonials coming soon."
@@ -395,5 +434,51 @@
       "emptyHeadline": "No purchases yet",
       "emptyDescription": "Purchases you complete will appear here."
     }
+  },
+  "admin": {
+    "title": "Workspace settings",
+    "description": "Your workspace name, site settings, and team.",
+    "nav": {
+      "account": "Account",
+      "general": "General",
+      "site": "Site",
+      "team": "Team"
+    },
+    "general": {
+      "heading": "General",
+      "nameLabel": "Workspace name",
+      "saveButton": "Save",
+      "saving": "Saving\u2026",
+      "saved": "Saved",
+      "saveError": "Could not save. Try again."
+    },
+    "site": {
+      "heading": "Site",
+      "identityHeading": "Identity",
+      "identityName": "Site name",
+      "identityUrl": "Site URL",
+      "identityDescription": "Description",
+      "seoHeading": "SEO",
+      "seoDescription": "Meta description",
+      "seoOgImage": "Social share image URL",
+      "themeHeading": "Theme",
+      "themeLightPrimary": "Primary colour (light)",
+      "themeLightAccent": "Accent colour (light)",
+      "themeDarkPrimary": "Primary colour (dark)",
+      "themeDarkAccent": "Accent colour (dark)",
+      "themeUnconfigured": "This site uses the default theme. Colours become editable once a theme is configured for the workspace.",
+      "saveButton": "Save",
+      "saving": "Saving\u2026",
+      "saved": "Saved",
+      "saveError": "Could not save. Try again."
+    },
+    "team": {
+      "heading": "Team",
+      "name": "Name",
+      "email": "Email",
+      "role": "Role",
+      "emptyHeadline": "No members yet",
+      "emptyDescription": "People with access to this workspace will appear here."
+    }
   }
 }

package/templates/apps/web/next.config.mjs

@@ -4,6 +4,7 @@ import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
+import { legacyRedirects } from "@working-theory/templates/routes";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
 // analyzerMode 'json' writes .next/analyze/client.json (and nodejs.json,
@@ -118,6 +119,10 @@ const nextConfig = {
     "@working-theory/site-config",
     "@working-theory/theme",
     "@working-theory/ui",
+    "@working-theory/ui-commerce",
+    "@working-theory/ui-docs-blog",
+    "@working-theory/ui-scheduling",
+    "@working-theory/ui-signal-collectors",
     "@working-theory/validation",
     "@working-theory/web-i18n",
   ],
@@ -127,6 +132,14 @@ const nextConfig = {
   // Marking better-auth as a server external prevents webpack from statically
   // bundling it (and the unused kysely adapter) into the server chunk.
   serverExternalPackages: ["better-auth"],
+  // Disable Next 16's auto-generated AGENTS.md / CLAUDE.md agent-rules
+  // block. Default true: `next dev`, on detecting an AI coding agent in
+  // the environment, upserts a managed `<!-- BEGIN:nextjs-agent-rules -->`
+  // block into apps/web/CLAUDE.md on every dev-server start (verified at
+  // node_modules/next/dist/server/lib/generate-agent-files.js). That
+  // mutates a tracked file as a side effect of running the dev server,
+  // which this scaffold does not want.
+  agentRules: false,
   env: {
     // Comma-separated locale list baked at build time — consumed by middleware
     // and the sitemap route. NEXT_PUBLIC_ prefix makes it available in Edge
@@ -147,6 +160,13 @@ const nextConfig = {
       },
     ];
   },
+  // #5572 U2 (spec § D4 row 3) — a rename appends the old path to a row's
+  // `legacyRoutes` and this ships the 301 with no other edit here. Empty at
+  // HEAD: no row has moved yet. Proven against a FIXTURE, never the live map
+  // (apps/web/__tests__/routes/next-config-redirects.test.ts).
+  async redirects() {
+    return legacyRedirects();
+  },
 };
 
 // Sentry build-time plugin wrap (#894). When SENTRY_AUTH_TOKEN / SENTRY_ORG /

package/templates/apps/web/package.json

@@ -5,12 +5,12 @@
   "description": "AI Launch Kit web — Next.js App Router UX surface (placeholder; MDX content adapter wires in B1).",
   "license": "Apache-2.0",
   "scripts": {
-    "dev": "next dev",
+    "dev": "next dev --webpack",
     "build": "next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
     "type-check": "tsc --noEmit",
-    "lint": "next lint",
+    "lint": "eslint .",
     "test": "jest",
     "test:watch": "jest --watch"
   },
@@ -60,6 +60,10 @@
     "tailwindcss": "^4.3.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3",
+    "eslint": "^10.6.0",
+    "@eslint/js": "^10.0.1",
+    "globals": "^17.7.0",
+    "typescript-eslint": "^8.62.1",
     "@working-theory/license": "workspace:*",
     "@working-theory/sections-registry": "workspace:*"
   }

package/templates/apps/web/sentry.client.config.ts

@@ -13,6 +13,80 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. Scrub it from every
+// error event and transaction before it reaches Sentry — the request URL,
+// its Referer header, the transaction name, navigation breadcrumbs, and any
+// URL captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`).
+function scrubRequestUrlAndHeaders(request?: {
+  url?: string;
+  headers?: Record<string, string>;
+}): void {
+  if (!request) return;
+  if (request.url) {
+    request.url = scrubTelemetryUrl(request.url);
+  }
+  if (request.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = request.headers[key];
+      if (typeof value === "string") {
+        request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+}
+
+function scrubSpanData(data?: Record<string, unknown>): void {
+  if (!data) return;
+  for (const key of ["url.full", "http.url", "http.request.header.referer"]) {
+    const value = data[key];
+    if (typeof value === "string") {
+      data[key] = scrubTelemetryUrl(value);
+    }
+  }
+}
+
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  scrubRequestUrlAndHeaders(event.request);
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
   enabled: !!process.env.NEXT_PUBLIC_SENTRY_DSN,
@@ -24,4 +98,61 @@ Sentry.init({
   // Session replays: 10% of all sessions, 100% of sessions that hit an error.
   replaysSessionSampleRate: 0.1,
   replaysOnErrorSampleRate: 1.0,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
+
+  integrations: [
+    Sentry.replayIntegration({
+      // Custom recording events (navigation/history frames) can be scrubbed
+      // here. Events added by the underlying DOM recording library (rrweb) —
+      // notably the initial page-load snapshot's href — can NOT be modified
+      // via this or any other documented option in @sentry/replay 10.58.0:
+      // checked ReplayPluginOptions, BeforeAddRecordingEvent, and the core
+      // Options' beforeSend/beforeSendTransaction. That snapshot href is a
+      // residual, called out in the PR body.
+      beforeAddRecordingEvent(event) {
+        const { payload } = event.data;
+        if (
+          "description" in payload &&
+          typeof payload.description === "string"
+        ) {
+          payload.description = scrubTelemetryUrl(payload.description);
+        }
+        const data = "data" in payload ? payload.data : undefined;
+        if (data && typeof data === "object") {
+          const record = data as Record<string, unknown>;
+          // "url" covers click/slowClick/multiClick frames' `data.url`
+          // (security review, PR #5639), alongside history/navigation
+          // frames' `previous`/`to`/`from`.
+          for (const key of ["previous", "to", "from", "url"] as const) {
+            const value = record[key];
+            if (typeof value === "string") {
+              record[key] = scrubTelemetryUrl(value);
+            }
+          }
+        }
+        return event;
+      },
+    }),
+  ],
+});
+
+// beforeSend/beforeSendTransaction never see the replay envelope — @sentry/
+// replay builds and transports it directly. It still passes through
+// `client.getEventProcessors()` (verified in @sentry/core's prepareEvent),
+// so this is the one hook that reaches it: the session's visited-URLs list
+// and the request Referer it carries (security review, PR #5639).
+Sentry.addEventProcessor((event) => {
+  const replayEvent = event as typeof event & { urls?: unknown };
+  if (replayEvent.type !== "replay_event") {
+    return event;
+  }
+  if (Array.isArray(replayEvent.urls)) {
+    replayEvent.urls = replayEvent.urls.map((url) =>
+      typeof url === "string" ? scrubTelemetryUrl(url) : url,
+    );
+  }
+  scrubRequestUrlAndHeaders(event.request);
+  return event;
 });