create-ailk 0.4.0 → 0.5.0

package/templates/apps/web/lib/telemetry-scrub.ts

@@ -0,0 +1,46 @@
+// Strips token-bearing query params from a URL before it's reported to
+// third-party telemetry (Google Analytics, Sentry). #5562 found the report
+// grant token (`/reports/<slug>?g=<grantId>`) — the bearer credential for a
+// private customer deliverable — riding `document.location.href` into GA's
+// `page_location` default and into Sentry events, transactions, and session
+// replays. This is the single source of the stripped-parameter list.
+//
+// Mirrored (duplicated, not shared) in packages/analytics/src/scrub.ts,
+// since apps/* must not import @working-theory/* packages — keep both lists
+// in sync (#5613).
+export const TOKEN_QUERY_PARAMS = ["g"];
+
+// Sentry navigation breadcrumbs (`data.to`/`data.from`) are relative
+// (`path?search`, no origin) rather than the absolute URLs GA and
+// `request.url` deal in — resolve against a throwaway base so relative
+// values get scrubbed too, then strip the base back off (security review,
+// PR #5639).
+const RELATIVE_URL_BASE = "https://scrub.invalid";
+
+function hasScheme(url: string): boolean {
+  return /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(url) || url.startsWith("//");
+}
+
+export function scrubTelemetryUrl(url: string): string {
+  const relative = !hasScheme(url);
+  let parsed: URL;
+  try {
+    parsed = relative ? new URL(url, RELATIVE_URL_BASE) : new URL(url);
+  } catch {
+    return url;
+  }
+
+  let changed = false;
+  for (const param of TOKEN_QUERY_PARAMS) {
+    if (parsed.searchParams.has(param)) {
+      parsed.searchParams.delete(param);
+      changed = true;
+    }
+  }
+
+  if (!changed) {
+    return url;
+  }
+  const result = parsed.toString();
+  return relative ? result.slice(RELATIVE_URL_BASE.length) : result;
+}

package/templates/apps/web/messages/en.json

@@ -9,7 +9,17 @@
     "schedule": "Book a call",
     "signIn": "Sign in",
     "signOut": "Sign out",
-    "account": "Account"
+    "account": "Account",
+    "product": "Product",
+    "howItWorks": "How it works",
+    "howItWorksDesc": "What happens from install to launch",
+    "features": "Features",
+    "featuresDesc": "Everything the kit ships with",
+    "faq": "FAQ",
+    "faqDesc": "Answers to the questions we get most",
+    "pricing": "Pricing",
+    "about": "About",
+    "getStarted": "Get started"
   },
   "consent": {
     "title": "Cookie Preferences",
@@ -167,6 +177,23 @@
     "heading": "Launch Service",
     "emptyState": "Launch Service page content coming soon."
   },
+  "leadsInbox": {
+    "title": "Leads",
+    "description": "Every lead your site has captured, newest first.",
+    "forbiddenHeadline": "You don't have access",
+    "forbiddenDescription": "Sign in with the account that owns this site to see the leads it captured.",
+    "table": {
+      "caption": "Leads captured by your site",
+      "columnName": "Name",
+      "columnEmail": "Email",
+      "columnSource": "Source",
+      "columnCreated": "Captured",
+      "unavailable": "—",
+      "next": "Next page",
+      "emptyHeadline": "No leads yet",
+      "emptyDescription": "Leads captured by your site's forms will appear here."
+    }
+  },
   "partners": {
     "heading": "Partners",
     "emptyState": "Partners listing coming soon."
@@ -408,7 +435,7 @@
       "emptyDescription": "Purchases you complete will appear here."
     }
   },
-  "workspace": {
+  "admin": {
     "title": "Workspace settings",
     "description": "Your workspace name, site settings, and team.",
     "nav": {

package/templates/apps/web/next.config.mjs

@@ -4,6 +4,7 @@ import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
+import { legacyRedirects } from "@working-theory/templates/routes";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
 // analyzerMode 'json' writes .next/analyze/client.json (and nodejs.json,
@@ -118,6 +119,10 @@ const nextConfig = {
     "@working-theory/site-config",
     "@working-theory/theme",
     "@working-theory/ui",
+    "@working-theory/ui-commerce",
+    "@working-theory/ui-docs-blog",
+    "@working-theory/ui-scheduling",
+    "@working-theory/ui-signal-collectors",
     "@working-theory/validation",
     "@working-theory/web-i18n",
   ],
@@ -127,6 +132,14 @@ const nextConfig = {
   // Marking better-auth as a server external prevents webpack from statically
   // bundling it (and the unused kysely adapter) into the server chunk.
   serverExternalPackages: ["better-auth"],
+  // Disable Next 16's auto-generated AGENTS.md / CLAUDE.md agent-rules
+  // block. Default true: `next dev`, on detecting an AI coding agent in
+  // the environment, upserts a managed `<!-- BEGIN:nextjs-agent-rules -->`
+  // block into apps/web/CLAUDE.md on every dev-server start (verified at
+  // node_modules/next/dist/server/lib/generate-agent-files.js). That
+  // mutates a tracked file as a side effect of running the dev server,
+  // which this scaffold does not want.
+  agentRules: false,
   env: {
     // Comma-separated locale list baked at build time — consumed by middleware
     // and the sitemap route. NEXT_PUBLIC_ prefix makes it available in Edge
@@ -147,6 +160,13 @@ const nextConfig = {
       },
     ];
   },
+  // #5572 U2 (spec § D4 row 3) — a rename appends the old path to a row's
+  // `legacyRoutes` and this ships the 301 with no other edit here. Empty at
+  // HEAD: no row has moved yet. Proven against a FIXTURE, never the live map
+  // (apps/web/__tests__/routes/next-config-redirects.test.ts).
+  async redirects() {
+    return legacyRedirects();
+  },
 };
 
 // Sentry build-time plugin wrap (#894). When SENTRY_AUTH_TOKEN / SENTRY_ORG /

package/templates/apps/web/package.json

@@ -5,12 +5,12 @@
   "description": "AI Launch Kit web — Next.js App Router UX surface (placeholder; MDX content adapter wires in B1).",
   "license": "Apache-2.0",
   "scripts": {
-    "dev": "next dev",
+    "dev": "next dev --webpack",
     "build": "next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
     "type-check": "tsc --noEmit",
-    "lint": "next lint",
+    "lint": "eslint .",
     "test": "jest",
     "test:watch": "jest --watch"
   },
@@ -60,6 +60,10 @@
     "tailwindcss": "^4.3.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3",
+    "eslint": "^10.6.0",
+    "@eslint/js": "^10.0.1",
+    "globals": "^17.7.0",
+    "typescript-eslint": "^8.62.1",
     "@working-theory/license": "workspace:*",
     "@working-theory/sections-registry": "workspace:*"
   }

package/templates/apps/web/sentry.client.config.ts

@@ -13,6 +13,80 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. Scrub it from every
+// error event and transaction before it reaches Sentry — the request URL,
+// its Referer header, the transaction name, navigation breadcrumbs, and any
+// URL captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`).
+function scrubRequestUrlAndHeaders(request?: {
+  url?: string;
+  headers?: Record<string, string>;
+}): void {
+  if (!request) return;
+  if (request.url) {
+    request.url = scrubTelemetryUrl(request.url);
+  }
+  if (request.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = request.headers[key];
+      if (typeof value === "string") {
+        request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+}
+
+function scrubSpanData(data?: Record<string, unknown>): void {
+  if (!data) return;
+  for (const key of ["url.full", "http.url", "http.request.header.referer"]) {
+    const value = data[key];
+    if (typeof value === "string") {
+      data[key] = scrubTelemetryUrl(value);
+    }
+  }
+}
+
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  scrubRequestUrlAndHeaders(event.request);
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
   enabled: !!process.env.NEXT_PUBLIC_SENTRY_DSN,
@@ -24,4 +98,61 @@ Sentry.init({
   // Session replays: 10% of all sessions, 100% of sessions that hit an error.
   replaysSessionSampleRate: 0.1,
   replaysOnErrorSampleRate: 1.0,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
+
+  integrations: [
+    Sentry.replayIntegration({
+      // Custom recording events (navigation/history frames) can be scrubbed
+      // here. Events added by the underlying DOM recording library (rrweb) —
+      // notably the initial page-load snapshot's href — can NOT be modified
+      // via this or any other documented option in @sentry/replay 10.58.0:
+      // checked ReplayPluginOptions, BeforeAddRecordingEvent, and the core
+      // Options' beforeSend/beforeSendTransaction. That snapshot href is a
+      // residual, called out in the PR body.
+      beforeAddRecordingEvent(event) {
+        const { payload } = event.data;
+        if (
+          "description" in payload &&
+          typeof payload.description === "string"
+        ) {
+          payload.description = scrubTelemetryUrl(payload.description);
+        }
+        const data = "data" in payload ? payload.data : undefined;
+        if (data && typeof data === "object") {
+          const record = data as Record<string, unknown>;
+          // "url" covers click/slowClick/multiClick frames' `data.url`
+          // (security review, PR #5639), alongside history/navigation
+          // frames' `previous`/`to`/`from`.
+          for (const key of ["previous", "to", "from", "url"] as const) {
+            const value = record[key];
+            if (typeof value === "string") {
+              record[key] = scrubTelemetryUrl(value);
+            }
+          }
+        }
+        return event;
+      },
+    }),
+  ],
+});
+
+// beforeSend/beforeSendTransaction never see the replay envelope — @sentry/
+// replay builds and transports it directly. It still passes through
+// `client.getEventProcessors()` (verified in @sentry/core's prepareEvent),
+// so this is the one hook that reaches it: the session's visited-URLs list
+// and the request Referer it carries (security review, PR #5639).
+Sentry.addEventProcessor((event) => {
+  const replayEvent = event as typeof event & { urls?: unknown };
+  if (replayEvent.type !== "replay_event") {
+    return event;
+  }
+  if (Array.isArray(replayEvent.urls)) {
+    replayEvent.urls = replayEvent.urls.map((url) =>
+      typeof url === "string" ? scrubTelemetryUrl(url) : url,
+    );
+  }
+  scrubRequestUrlAndHeaders(event.request);
+  return event;
 });

package/templates/apps/web/sentry.edge.config.ts

@@ -7,9 +7,81 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. The RSC render of the
+// grant page can run in this runtime too, so scrub the request URL, its
+// Referer header, the transaction name, navigation breadcrumbs, and any URL
+// captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`) here as well.
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  if (event.request?.url) {
+    event.request.url = scrubTelemetryUrl(event.request.url);
+  }
+  if (event.request?.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = event.request.headers[key];
+      if (typeof value === "string") {
+        event.request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  const scrubSpanData = (data?: Record<string, unknown>): void => {
+    if (!data) return;
+    for (const key of [
+      "url.full",
+      "http.url",
+      "http.request.header.referer",
+    ]) {
+      const value = data[key];
+      if (typeof value === "string") {
+        data[key] = scrubTelemetryUrl(value);
+      }
+    }
+  };
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.SENTRY_DSN,
   enabled: !!process.env.SENTRY_DSN,
 
   tracesSampleRate: process.env.NODE_ENV === "development" ? 1.0 : 0.1,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
 });

package/templates/apps/web/sentry.server.config.ts

@@ -12,9 +12,81 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. The RSC render of the
+// grant page runs in this runtime, so scrub the request URL, its Referer
+// header, the transaction name, navigation breadcrumbs, and any URL
+// captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`) here too.
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  if (event.request?.url) {
+    event.request.url = scrubTelemetryUrl(event.request.url);
+  }
+  if (event.request?.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = event.request.headers[key];
+      if (typeof value === "string") {
+        event.request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  const scrubSpanData = (data?: Record<string, unknown>): void => {
+    if (!data) return;
+    for (const key of [
+      "url.full",
+      "http.url",
+      "http.request.header.referer",
+    ]) {
+      const value = data[key];
+      if (typeof value === "string") {
+        data[key] = scrubTelemetryUrl(value);
+      }
+    }
+  };
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.SENTRY_DSN,
   enabled: !!process.env.SENTRY_DSN,
 
   tracesSampleRate: process.env.NODE_ENV === "development" ? 1.0 : 0.1,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
 });

package/templates/apps/web/src/lib/routes.ts

@@ -5,6 +5,8 @@
  * handlers to avoid copy-paste duplication.
  */
 
+import { routeFor } from "@working-theory/templates/routes";
+
 import { SITE_BASE_URL } from "../../lib/site-brand";
 
 /**
@@ -29,22 +31,15 @@ export function resolveBaseUrl(): string {
 /**
  * Maps a content-adapter page type + slug to a site-relative path.
  * Drives both /llms.txt and /sitemap.xml URL generation.
+ *
+ * A lookup over the routes map (#5572 U2, spec § D4 row 1) — `routeFor` is
+ * byte-identical to the switch this replaced for its six `case` literals and
+ * the `` `/${slug}` `` default (proven by
+ * `packages/templates/src/__tests__/routes-map.test.ts`'s table test and
+ * `apps/web/__tests__/routes/routes-map-identity.test.ts`'s differential
+ * test over the live content tree). The signature is annotated explicitly so
+ * this stays the exact `(type: string, slug: string) => string` contract the
+ * three call sites (`sitemap.xml`, `llms.txt`, `docs-blog/llms-route.ts`)
+ * depend on, even though `routeFor`'s own `slug` parameter is optional.
  */
-export function slugToPath(type: string, slug: string): string {
-  switch (type) {
-    case "HomePage":
-      return "/";
-    case "BlogPosting":
-      return `/blog/${slug}`;
-    case "Product":
-      return `/products/${slug}`;
-    case "Service":
-      return `/services/${slug}`;
-    case "AboutPage":
-      return "/about";
-    case "ContactPage":
-      return "/contact";
-    default:
-      return `/${slug}`;
-  }
-}
+export const slugToPath: (type: string, slug: string) => string = routeFor;

package/templates/brand_assets/README.md

@@ -0,0 +1,24 @@
+# brand_assets/
+
+This folder is where you put your project's real brand material. It ships
+empty — nothing here is required to run `pnpm dev` — but populating it is
+what lets Claude Code (and anyone else building this site) use your actual
+brand instead of inventing placeholder colors and copy.
+
+`apps/web/CLAUDE.md` reads from this folder before designing a page. If a
+file below is present, it's used; if it's absent, generic defaults are used
+instead.
+
+## What goes here
+
+| File / folder                   | Contents                                                                                                                               |
+| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `logo.svg` (or `.png`)          | Your logo, ideally an SVG. Add light/dark variants if your mark needs them (e.g. `logo-dark.svg`).                                     |
+| `brand-guide.md`                | The global theme — brand colors, type direction, tone of voice, do's and don'ts — used when choosing layout and components for a page. |
+| `brand-brief.md`                | Positioning, messaging, and the target citation phrases a page's content should work toward.                                           |
+| `favicon.ico` / `favicon-*.png` | Favicon assets for `apps/web/app/favicon.ico` and any additional sizes your deploy target wants.                                       |
+| `photos/`                       | Real photography — team, product, office — to use instead of stock or placeholder images.                                              |
+| `reference/`                    | Mockups, screenshots, or other visual references to match when building or reviewing a page's design.                                  |
+
+None of these are mandatory. Add what you have; the rest can stay
+placeholder until you're ready.