create-ailk 0.4.0 → 0.6.0

package/templates/apps/web/messages/en.json

@@ -9,7 +9,17 @@
     "schedule": "Book a call",
     "signIn": "Sign in",
     "signOut": "Sign out",
-    "account": "Account"
+    "account": "Account",
+    "product": "Product",
+    "howItWorks": "How it works",
+    "howItWorksDesc": "What happens from install to launch",
+    "features": "Features",
+    "featuresDesc": "Everything the kit ships with",
+    "faq": "FAQ",
+    "faqDesc": "Answers to the questions we get most",
+    "pricing": "Pricing",
+    "about": "About",
+    "getStarted": "Get started"
   },
   "consent": {
     "title": "Cookie Preferences",
@@ -39,6 +49,10 @@
     "emptyState": "No documentation yet. Add MDX files to",
     "emptyStateTrailing": "to populate this list."
   },
+  "cancellation": {
+    "heading": "Cancellation Policy",
+    "emptyState": "Cancellation policy content coming soon."
+  },
   "careers": {
     "heading": "Careers",
     "emptyState": "Career listings coming soon."
@@ -167,6 +181,23 @@
     "heading": "Launch Service",
     "emptyState": "Launch Service page content coming soon."
   },
+  "leadsInbox": {
+    "title": "Leads",
+    "description": "Every lead your site has captured, newest first.",
+    "forbiddenHeadline": "You don't have access",
+    "forbiddenDescription": "Sign in with the account that owns this site to see the leads it captured.",
+    "table": {
+      "caption": "Leads captured by your site",
+      "columnName": "Name",
+      "columnEmail": "Email",
+      "columnSource": "Source",
+      "columnCreated": "Captured",
+      "unavailable": "—",
+      "next": "Next page",
+      "emptyHeadline": "No leads yet",
+      "emptyDescription": "Leads captured by your site's forms will appear here."
+    }
+  },
   "partners": {
     "heading": "Partners",
     "emptyState": "Partners listing coming soon."
@@ -187,10 +218,39 @@
     "heading": "Projects",
     "emptyState": "Projects listing coming soon."
   },
+  "purchase": {
+    "success": {
+      "title": "Payment successful",
+      "message": "Thanks for your order — here's what you bought.",
+      "statusLabel": "Paid",
+      "sessionIdLabel": "Order",
+      "lineItem": "Qty {quantity} · {amount}",
+      "continueLabel": "Back to services",
+      "pendingHeadline": "We have your order",
+      "pendingBody": "Payment is still settling. This page will not update on its own — check your email for the receipt, or come back in a few minutes.",
+      "unknownHeadline": "We can't look up this order from here",
+      "unknownBody": "Check your email for the receipt from checkout — it has everything about your order.",
+      "ctaHeadline": "Keep going",
+      "ctaDescription": "Have a look at what else we offer.",
+      "ctaLabel": "Browse services"
+    },
+    "cancel": {
+      "title": "Checkout canceled",
+      "message": "Nothing was charged. Your card was not billed.",
+      "statusLabel": "Canceled",
+      "ctaHeadline": "Still interested?",
+      "ctaDescription": "Head back to the service menu whenever you're ready.",
+      "ctaLabel": "Back to services"
+    }
+  },
   "resources": {
     "heading": "Resources",
     "emptyState": "Resources listing coming soon."
   },
+  "returns": {
+    "heading": "Returns & Refunds",
+    "emptyState": "Returns and refunds content coming soon."
+  },
   "schedule": {
     "title": "Book a call",
     "description": "Pick a time that works for you.",
@@ -213,6 +273,10 @@
     "heading": "Services",
     "emptyState": "Services listing coming soon."
   },
+  "shipping": {
+    "heading": "Shipping Policy",
+    "emptyState": "Shipping policy content coming soon."
+  },
   "software": {
     "heading": "Software",
     "description": "The @working-theory/* packages \u2014 typed tools for building AX-first products.",
@@ -369,6 +433,64 @@
     "signInFailed": "We couldn't sign you in. Check your details and try again.",
     "providerFailed": "We couldn't start sign-in with that provider. Try again."
   },
+  "auth": {
+    "signUpTitle": "Create an account",
+    "signUpDescription": "Create an account on this site.",
+    "forgotTitle": "Reset your password",
+    "forgotDescription": "Request a password reset link.",
+    "resetTitle": "Choose a new password",
+    "resetDescription": "Set a new password for your account.",
+    "verifyEmailTitle": "Check your email",
+    "verifyEmailDescription": "Follow the link we sent to continue.",
+    "email": "Email address",
+    "password": "Password",
+    "confirmPassword": "Confirm password",
+    "newPassword": "New password",
+    "orContinue": "Or continue with",
+    "ssoPrefix": "Continue with",
+    "google": "Google",
+    "github": "GitHub",
+    "backToSignIn": "Back to sign in",
+    "signUpHeading": "Create your account",
+    "signUpSubhead": "Enter your details to get started.",
+    "signUpSubmit": "Create account",
+    "signUpFooterPrompt": "Already have an account?",
+    "signUpFooterLink": "Sign in",
+    "signUpNotConfiguredSubhead": "Sign-up is not configured for this site yet. Set a provider's environment variables to enable it.",
+    "signUpFailed": "We couldn't create your account. Check your details and try again.",
+    "providerFailed": "We couldn't start sign-up with that provider. Try again.",
+    "invitationHeading": "Accounts are by invitation",
+    "invitationSubhead": "This site does not offer public sign-up.",
+    "invitationBody": "If you were invited, open the link in your invitation email to create your account.",
+    "forgotHeading": "Reset your password",
+    "forgotSubhead": "Enter your email and we will send a reset link.",
+    "forgotSubmit": "Send reset link",
+    "resetHeading": "Choose a new password",
+    "resetSubhead": "Choose a new password for your account.",
+    "resetSubmit": "Set new password",
+    "forgotUnavailableHeading": "Password reset isn't available",
+    "forgotUnavailableSubhead": "This site does not offer password reset.",
+    "forgotUnavailableBody": "Sign in with one of the providers on the sign-in page, or ask the site owner for help getting back in.",
+    "resetUnavailableHeading": "Password reset isn't available",
+    "resetUnavailableSubhead": "This reset link cannot be used on this site.",
+    "resetUnavailableBody": "Password reset is not enabled here. Sign in with one of the providers on the sign-in page instead.",
+    "sentToPrefix": "We sent it to",
+    "resetRequestFailed": "We couldn't send a reset link just now. Try again in a few minutes.",
+    "resetFailed": "We couldn't set that password. The link may have expired \u2014 request a new one.",
+    "passwordMismatch": "Both passwords must match.",
+    "resetExpiredHeading": "This reset link has expired",
+    "resetExpiredSubhead": "Reset links are single-use and last one hour.",
+    "resetExpiredBody": "Request a new link from the sign-in page and follow the most recent email.",
+    "verifyExpiredHeading": "This confirmation link has expired",
+    "verifyExpiredSubhead": "Confirmation links last 24 hours.",
+    "verifyExpiredBody": "Sign in again and we'll send you a fresh confirmation email.",
+    "sentHeading": "Check your email",
+    "sentSubhead": "Follow the link we just sent to continue.",
+    "sentBody": "Check your inbox and follow the link to continue. You can close this tab once you're done.",
+    "footerPrivacy": "Privacy",
+    "footerTerms": "Terms",
+    "footerHelp": "Help"
+  },
   "account": {
     "title": "Your account",
     "description": "Your profile, results, and purchases.",
@@ -406,9 +528,15 @@
       "date": "Date",
       "emptyHeadline": "No purchases yet",
       "emptyDescription": "Purchases you complete will appear here."
+    },
+    "subscription": {
+      "headline": "Your payment didn't go through",
+      "descriptionPastDue": "Update your card to keep your subscription active.",
+      "descriptionCanceled": "Your subscription was canceled. Update your card by {date} to keep your access.",
+      "action": "Update payment method"
     }
   },
-  "workspace": {
+  "admin": {
     "title": "Workspace settings",
     "description": "Your workspace name, site settings, and team.",
     "nav": {
@@ -453,5 +581,91 @@
       "emptyHeadline": "No members yet",
       "emptyDescription": "People with access to this workspace will appear here."
     }
+  },
+  "edit": {
+    "title": "Pages",
+    "description": "Edit your site's pages and publish changes without a deploy.",
+    "listHeading": "Pages",
+    "listDescription": "Every page on this site. Choose one to edit its content and publish your changes.",
+    "listEmptyHeadline": "No pages yet",
+    "listEmptyDescription": "Pages you create appear here, ready to edit and publish.",
+    "statusDraft": "Draft",
+    "statusPublished": "Published",
+    "statusPublishedWithDraft": "Published, with unpublished changes",
+    "licenceRequiredHeadline": "Content editing is a Pro feature",
+    "licenceRequiredDescription": "Editing pages without a deploy is part of Pro. Add a Pro licence to this site to turn it on.",
+    "notFoundHeadline": "Page not found",
+    "notFoundDescription": "There is no page at this address. It may have been renamed or removed.",
+    "editor": {
+      "tabForm": "Details",
+      "tabBody": "Body",
+      "tabPreview": "Preview",
+      "tabCode": "Code",
+      "statusDraft": "Draft",
+      "statusNotYetLive": "Not yet live",
+      "statusPublished": "Published",
+      "frontmatterHeading": "Page details",
+      "frontmatterTitle": "Title",
+      "frontmatterSlug": "Slug",
+      "frontmatterDescription": "Description",
+      "issuesHeading": "Fix these before publishing",
+      "saveButton": "Save draft",
+      "saving": "Saving\u2026",
+      "saved": "Saved",
+      "saveError": "Could not save. Try again.",
+      "publishButton": "Publish",
+      "publishing": "Publishing\u2026",
+      "published": "Published",
+      "publishError": "Could not publish. Try again.",
+      "unpublishButton": "Unpublish",
+      "unpublishing": "Unpublishing\u2026",
+      "unpublished": "Unpublished",
+      "unpublishError": "Could not unpublish. Try again.",
+      "conflictHeading": "Someone else saved this page",
+      "conflictMessage": "This page changed since you opened it. Reload to take their version, or overwrite it with yours.",
+      "conflictReload": "Reload their version",
+      "conflictOverwrite": "Overwrite with mine",
+      "imageInsertLabel": "Insert an image",
+      "imageInsertHint": "The image is uploaded and its markdown inserted at the cursor.",
+      "imageAlt": "Image",
+      "imageInsertError": "Could not upload that image. Try again.",
+      "codeHeading": "Composed MDX",
+      "diffLegendAdded": "Added",
+      "diffLegendRemoved": "Removed",
+      "diffLegendUnchanged": "Unchanged"
+    },
+    "sections": {
+      "heading": "Sections",
+      "arrayAdd": "Add",
+      "arrayRemove": "Remove",
+      "unsupportedField": "This field is edited as raw JSON",
+      "sectionLevelErrors": "Other problems with this section"
+    },
+    "body": {
+      "label": "Body",
+      "hint": "Markdown. Headings, links, lists and images all work.",
+      "machinePreambleNotice": "This page starts with imports or components. They are preserved and are not editable here."
+    }
+  },
+  "appointments": {
+    "title": "Appointments",
+    "description": "Your site's upcoming bookings, soonest first.",
+    "forbiddenHeadline": "You don't have access",
+    "forbiddenDescription": "Sign in with the account that owns this site to see its bookings.",
+    "table": {
+      "caption": "Upcoming bookings for your site",
+      "columnWhen": "When",
+      "columnWho": "Who",
+      "columnStatus": "Status",
+      "columnPaid": "Paid",
+      "statusPending": "Pending",
+      "statusConfirmed": "Confirmed",
+      "statusCancelled": "Cancelled",
+      "paidYes": "Paid",
+      "paidNo": "Unpaid",
+      "next": "Next page",
+      "emptyHeadline": "No upcoming bookings",
+      "emptyDescription": "When someone books a time with you, the appointment appears here automatically."
+    }
   }
 }

package/templates/apps/web/next.config.mjs

@@ -4,6 +4,7 @@ import { parse as parseYaml } from "yaml";
 import bundleAnalyzer from "@next/bundle-analyzer";
 import { withSentryConfig } from "@sentry/nextjs";
 import createNextIntlPlugin from "next-intl/plugin";
+import { legacyRedirects } from "@working-theory/templates/routes";
 
 // @next/bundle-analyzer — enabled when ANALYZE=true (set by ci-bundle.yml).
 // analyzerMode 'json' writes .next/analyze/client.json (and nodejs.json,
@@ -118,6 +119,10 @@ const nextConfig = {
     "@working-theory/site-config",
     "@working-theory/theme",
     "@working-theory/ui",
+    "@working-theory/ui-commerce",
+    "@working-theory/ui-docs-blog",
+    "@working-theory/ui-scheduling",
+    "@working-theory/ui-signal-collectors",
     "@working-theory/validation",
     "@working-theory/web-i18n",
   ],
@@ -127,6 +132,14 @@ const nextConfig = {
   // Marking better-auth as a server external prevents webpack from statically
   // bundling it (and the unused kysely adapter) into the server chunk.
   serverExternalPackages: ["better-auth"],
+  // Disable Next 16's auto-generated AGENTS.md / CLAUDE.md agent-rules
+  // block. Default true: `next dev`, on detecting an AI coding agent in
+  // the environment, upserts a managed `<!-- BEGIN:nextjs-agent-rules -->`
+  // block into apps/web/CLAUDE.md on every dev-server start (verified at
+  // node_modules/next/dist/server/lib/generate-agent-files.js). That
+  // mutates a tracked file as a side effect of running the dev server,
+  // which this scaffold does not want.
+  agentRules: false,
   env: {
     // Comma-separated locale list baked at build time — consumed by middleware
     // and the sitemap route. NEXT_PUBLIC_ prefix makes it available in Edge
@@ -147,6 +160,13 @@ const nextConfig = {
       },
     ];
   },
+  // #5572 U2 (spec § D4 row 3) — a rename appends the old path to a row's
+  // `legacyRoutes` and this ships the 301 with no other edit here. Empty at
+  // HEAD: no row has moved yet. Proven against a FIXTURE, never the live map
+  // (apps/web/__tests__/routes/next-config-redirects.test.ts).
+  async redirects() {
+    return legacyRedirects();
+  },
 };
 
 // Sentry build-time plugin wrap (#894). When SENTRY_AUTH_TOKEN / SENTRY_ORG /

package/templates/apps/web/package.json

@@ -5,12 +5,12 @@
   "description": "AI Launch Kit web — Next.js App Router UX surface (placeholder; MDX content adapter wires in B1).",
   "license": "Apache-2.0",
   "scripts": {
-    "dev": "next dev",
+    "dev": "next dev --webpack",
     "build": "next build --webpack",
     "postbuild": "tsx scripts/assert-content-bundled.ts",
     "start": "next start",
     "type-check": "tsc --noEmit",
-    "lint": "next lint",
+    "lint": "eslint .",
     "test": "jest",
     "test:watch": "jest --watch"
   },
@@ -21,7 +21,9 @@
     "@working-theory/api-client": "workspace:*",
     "@working-theory/content-adapters": "workspace:*",
     "@working-theory/database": "workspace:*",
+    "@working-theory/ids": "workspace:*",
     "@working-theory/jsonld": "workspace:*",
+    "@working-theory/license": "workspace:*",
     "@working-theory/metadata": "workspace:*",
     "@working-theory/page-renderer": "workspace:*",
     "@working-theory/schema": "workspace:*",
@@ -60,7 +62,10 @@
     "tailwindcss": "^4.3.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3",
-    "@working-theory/license": "workspace:*",
+    "eslint": "^10.6.0",
+    "@eslint/js": "^10.0.1",
+    "globals": "^17.7.0",
+    "typescript-eslint": "^8.62.1",
     "@working-theory/sections-registry": "workspace:*"
   }
 }

package/templates/apps/web/sentry.client.config.ts

@@ -13,6 +13,80 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. Scrub it from every
+// error event and transaction before it reaches Sentry — the request URL,
+// its Referer header, the transaction name, navigation breadcrumbs, and any
+// URL captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`).
+function scrubRequestUrlAndHeaders(request?: {
+  url?: string;
+  headers?: Record<string, string>;
+}): void {
+  if (!request) return;
+  if (request.url) {
+    request.url = scrubTelemetryUrl(request.url);
+  }
+  if (request.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = request.headers[key];
+      if (typeof value === "string") {
+        request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+}
+
+function scrubSpanData(data?: Record<string, unknown>): void {
+  if (!data) return;
+  for (const key of ["url.full", "http.url", "http.request.header.referer"]) {
+    const value = data[key];
+    if (typeof value === "string") {
+      data[key] = scrubTelemetryUrl(value);
+    }
+  }
+}
+
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  scrubRequestUrlAndHeaders(event.request);
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.NEXT_PUBLIC_SENTRY_DSN,
   enabled: !!process.env.NEXT_PUBLIC_SENTRY_DSN,
@@ -24,4 +98,61 @@ Sentry.init({
   // Session replays: 10% of all sessions, 100% of sessions that hit an error.
   replaysSessionSampleRate: 0.1,
   replaysOnErrorSampleRate: 1.0,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
+
+  integrations: [
+    Sentry.replayIntegration({
+      // Custom recording events (navigation/history frames) can be scrubbed
+      // here. Events added by the underlying DOM recording library (rrweb) —
+      // notably the initial page-load snapshot's href — can NOT be modified
+      // via this or any other documented option in @sentry/replay 10.58.0:
+      // checked ReplayPluginOptions, BeforeAddRecordingEvent, and the core
+      // Options' beforeSend/beforeSendTransaction. That snapshot href is a
+      // residual, called out in the PR body.
+      beforeAddRecordingEvent(event) {
+        const { payload } = event.data;
+        if (
+          "description" in payload &&
+          typeof payload.description === "string"
+        ) {
+          payload.description = scrubTelemetryUrl(payload.description);
+        }
+        const data = "data" in payload ? payload.data : undefined;
+        if (data && typeof data === "object") {
+          const record = data as Record<string, unknown>;
+          // "url" covers click/slowClick/multiClick frames' `data.url`
+          // (security review, PR #5639), alongside history/navigation
+          // frames' `previous`/`to`/`from`.
+          for (const key of ["previous", "to", "from", "url"] as const) {
+            const value = record[key];
+            if (typeof value === "string") {
+              record[key] = scrubTelemetryUrl(value);
+            }
+          }
+        }
+        return event;
+      },
+    }),
+  ],
+});
+
+// beforeSend/beforeSendTransaction never see the replay envelope — @sentry/
+// replay builds and transports it directly. It still passes through
+// `client.getEventProcessors()` (verified in @sentry/core's prepareEvent),
+// so this is the one hook that reaches it: the session's visited-URLs list
+// and the request Referer it carries (security review, PR #5639).
+Sentry.addEventProcessor((event) => {
+  const replayEvent = event as typeof event & { urls?: unknown };
+  if (replayEvent.type !== "replay_event") {
+    return event;
+  }
+  if (Array.isArray(replayEvent.urls)) {
+    replayEvent.urls = replayEvent.urls.map((url) =>
+      typeof url === "string" ? scrubTelemetryUrl(url) : url,
+    );
+  }
+  scrubRequestUrlAndHeaders(event.request);
+  return event;
 });

package/templates/apps/web/sentry.edge.config.ts

@@ -7,9 +7,81 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. The RSC render of the
+// grant page can run in this runtime too, so scrub the request URL, its
+// Referer header, the transaction name, navigation breadcrumbs, and any URL
+// captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`) here as well.
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  if (event.request?.url) {
+    event.request.url = scrubTelemetryUrl(event.request.url);
+  }
+  if (event.request?.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = event.request.headers[key];
+      if (typeof value === "string") {
+        event.request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  const scrubSpanData = (data?: Record<string, unknown>): void => {
+    if (!data) return;
+    for (const key of [
+      "url.full",
+      "http.url",
+      "http.request.header.referer",
+    ]) {
+      const value = data[key];
+      if (typeof value === "string") {
+        data[key] = scrubTelemetryUrl(value);
+      }
+    }
+  };
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.SENTRY_DSN,
   enabled: !!process.env.SENTRY_DSN,
 
   tracesSampleRate: process.env.NODE_ENV === "development" ? 1.0 : 0.1,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
 });

package/templates/apps/web/sentry.server.config.ts

@@ -12,9 +12,81 @@
 
 import * as Sentry from "@sentry/nextjs";
 
+import { scrubTelemetryUrl } from "./lib/telemetry-scrub";
+
+// #5613 / security review PR #5639: the report-grant token (?g=<id> on
+// /reports/<slug>, #5562) is a bearer credential for a private customer
+// deliverable and must never leave this app in a URL. The RSC render of the
+// grant page runs in this runtime, so scrub the request URL, its Referer
+// header, the transaction name, navigation breadcrumbs, and any URL
+// captured as span/trace data (e.g. `url.full`,
+// `http.request.header.referer`) here too.
+function scrubSentryEvent<
+  T extends {
+    request?: { url?: string; headers?: Record<string, string> };
+    transaction?: string;
+    breadcrumbs?: { category?: string; data?: Record<string, unknown> }[];
+    contexts?: { trace?: { data?: Record<string, unknown> } };
+    spans?: { data?: Record<string, unknown> }[];
+  },
+>(event: T): T {
+  if (event.request?.url) {
+    event.request.url = scrubTelemetryUrl(event.request.url);
+  }
+  if (event.request?.headers) {
+    for (const key of ["Referer", "referer"]) {
+      const value = event.request.headers[key];
+      if (typeof value === "string") {
+        event.request.headers[key] = scrubTelemetryUrl(value);
+      }
+    }
+  }
+  if (event.transaction) {
+    event.transaction = scrubTelemetryUrl(event.transaction);
+  }
+  for (const crumb of event.breadcrumbs ?? []) {
+    if (!crumb.data) continue;
+    if (crumb.category === "navigation") {
+      for (const key of ["to", "from"]) {
+        const value = crumb.data[key];
+        if (typeof value === "string") {
+          crumb.data[key] = scrubTelemetryUrl(value);
+        }
+      }
+    }
+    // fetch/xhr breadcrumbs (and others) can carry `data.url` independent
+    // of category — scrub it regardless (security review, PR #5639).
+    const url = crumb.data["url"];
+    if (typeof url === "string") {
+      crumb.data["url"] = scrubTelemetryUrl(url);
+    }
+  }
+  const scrubSpanData = (data?: Record<string, unknown>): void => {
+    if (!data) return;
+    for (const key of [
+      "url.full",
+      "http.url",
+      "http.request.header.referer",
+    ]) {
+      const value = data[key];
+      if (typeof value === "string") {
+        data[key] = scrubTelemetryUrl(value);
+      }
+    }
+  };
+  scrubSpanData(event.contexts?.trace?.data);
+  for (const span of event.spans ?? []) {
+    scrubSpanData(span.data);
+  }
+  return event;
+}
+
 Sentry.init({
   dsn: process.env.SENTRY_DSN,
   enabled: !!process.env.SENTRY_DSN,
 
   tracesSampleRate: process.env.NODE_ENV === "development" ? 1.0 : 0.1,
+
+  beforeSend: scrubSentryEvent,
+  beforeSendTransaction: scrubSentryEvent,
 });