create-ailk 0.25.1 → 0.27.0

package/templates/apps/web/app/[locale]/(authed)/sign-in-gate.tsx

@@ -20,18 +20,23 @@
  * current pathname (via `usePathname()`) so a successful social sign-in
  * lands back on the exact dashboard page the visitor requested.
  *
- * Email sign-in link (#7435 § D9): when the layout passes `emailLink`, the
- * gate renders `/sign-in`'s own `SignInCard` — the same providers plus "Email
- * me a sign-in link" — in place of `AuthPanel`, whose email + password form
- * has no submit wiring and would otherwise sit inert beside the new field.
- * Without the prop every render is what it was before.
+ * Email sign-in link (#7435 § D9): when the layout passes `card` with
+ * `emailLink`, the gate renders `/sign-in`'s own `SignInCard` — the same
+ * providers plus "Send me a magic link" — in place of `AuthPanel`, whose
+ * email + password form has no submit wiring and would otherwise sit inert
+ * beside the new field. Without the prop every render is what it was before.
+ *
+ * The one card (#9662): on the member `/account` gate the layout passes
+ * `card` whenever a method is on, with the site's mark, the "Don't have an
+ * account? Sign up" line and the Terms + Privacy acknowledgement, so the gate
+ * renders the same card `/sign-in` does.
  */
 
 import { EmptyState, Link } from "@working-theory/ui/primitives";
 import { AuthPanel, type AuthPanelProvider } from "@working-theory/ui/sections";
 import { createAuthClient } from "better-auth/react";
 import { usePathname } from "next/navigation";
-import type { ReactElement } from "react";
+import type { ReactElement, ReactNode } from "react";
 
 import { SignInCard } from "../(auth)/sign-in/sign-in-card";
 import type { SignInCardText } from "../(auth)/sign-in/sign-in-text";
@@ -52,17 +57,25 @@ export interface SignInGateProps {
   /** The active social providers, resolved server-side by the layout (#7419). */
   providers: AuthPanelProvider[];
   /**
-   * Present iff the email sign-in link is on (#7435) — the sign-in card's
-   * copy, resolved server-side by the layout.
+   * Renders `SignInCard` in place of `AuthPanel` — present when the email
+   * sign-in link is on (#7435) or on the member gate (#9662). The card's copy,
+   * mark, prospect line and footnote are resolved server-side by the layout.
    */
-  emailLink?: { text: SignInCardText };
+  card?: {
+    text: SignInCardText;
+    /** Offer "Send me a magic link" — the email sign-in link is on. */
+    emailLink: boolean;
+    logo?: ReactNode;
+    prospect?: { prompt: string; linkLabel: string; href: string };
+    footnote?: ReactNode;
+  };
 }
 
 export function SignInGate({
   labels,
   signInPath,
   providers,
-  emailLink,
+  card,
 }: SignInGateProps): ReactElement {
   const pathname = usePathname();
   const signInHref = `${signInPath}?next=${encodeURIComponent(pathname)}`;
@@ -79,25 +92,35 @@ export function SignInGate({
     </Link>
   );
 
-  if (emailLink) {
-    const { text } = emailLink;
+  if (card) {
+    const { text } = card;
     return (
       <div
         className="flex min-h-screen flex-col items-center justify-center gap-4 py-section"
         data-testid="sign-in-gate"
       >
-        <SignInCard
-          providers={providers}
-          method="sso"
-          next={pathname}
-          labels={text.labels}
-          notConfiguredSubhead={text.notConfiguredSubhead}
-          errorLabels={text.errorLabels}
-          emailLink
-          errorCallbackURL={signInHref}
-          signInHref={signInHref}
-          emailLinkLabels={text.emailLinkLabels}
-        />
+        {/* AuthShell's 400px column: the cap sits on the wrapper, never on the card (AuthShell.tsx). */}
+        <div className="w-full max-w-100">
+          <SignInCard
+            providers={providers}
+            method="sso"
+            next={pathname}
+            labels={text.labels}
+            notConfiguredSubhead={text.notConfiguredSubhead}
+            errorLabels={text.errorLabels}
+            emailLink={card.emailLink}
+            errorCallbackURL={signInHref}
+            signInHref={signInHref}
+            emailLinkLabels={text.emailLinkLabels}
+            {...(card.logo !== undefined ? { logo: card.logo } : {})}
+            {...(card.prospect !== undefined
+              ? { prospect: card.prospect }
+              : {})}
+            {...(card.footnote !== undefined
+              ? { footnote: card.footnote }
+              : {})}
+          />
+        </div>
         {signInLink}
       </div>
     );

package/templates/apps/web/app/[locale]/(authed)/signed-out-gate.generated.tsx

@@ -11,9 +11,11 @@ import { readLocales } from "@working-theory/web-i18n";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
 
+import { legalFootnote } from "../(auth)/legal-footnote";
 import { resolveSignInCardText } from "../(auth)/sign-in/sign-in-text";
 import { getActiveProviderIds } from "../../../lib/auth-env";
 import { isAccountPath } from "../../../lib/auth-routes";
+import { siteLogo } from "../../../lib/site-logo";
 
 import { SignInGate } from "./sign-in-gate";
 
@@ -39,9 +41,7 @@ export async function SignedOutGate({
     namespace: isAccount ? "account.gate" : "waitlistDashboard.gate",
   });
   const active = getActiveProviderIds();
-  const emailLink = active.includes("magic-link")
-    ? { text: await resolveSignInCardText(locale) }
-    : undefined;
+  const emailLink = active.includes("magic-link");
   const providers = active.filter((id): id is AuthPanelProvider =>
     (SUPPORTED_PROVIDERS as readonly string[]).includes(id),
   );
@@ -75,6 +75,25 @@ export async function SignedOutGate({
     );
   }
 
+  // The sign-in card: with the email link on, and on the member gate, which
+  // also wears the one card's frame — the mark, the toggle line to /sign-up
+  // and the Terms + Privacy acknowledgement (#9662).
+  const text =
+    emailLink || isAccount ? await resolveSignInCardText(locale) : undefined;
+  const card = text
+    ? {
+        text,
+        emailLink,
+        ...(isAccount
+          ? {
+              logo: siteLogo(),
+              prospect: { ...text.prospect, href: localeHref(locale, "/sign-up") },
+              footnote: legalFootnote(locale, text.acknowledgement),
+            }
+          : {}),
+      }
+    : undefined;
+
   return (
     <SignInGate
       labels={{
@@ -84,7 +103,7 @@ export async function SignedOutGate({
       }}
       signInPath={signInPath}
       providers={providers}
-      {...(emailLink ? { emailLink } : {})}
+      {...(card ? { card } : {})}
     />
   );
 }

package/templates/apps/web/app/[locale]/layout.tsx

@@ -48,6 +48,7 @@ import {
   getStealthRobots,
   readLocales,
 } from "@working-theory/web-i18n";
+import { BotIdClient } from "botid/client";
 import type { Metadata, Viewport } from "next";
 import { cookies, headers } from "next/headers";
 import { NextIntlClientProvider } from "next-intl";
@@ -77,6 +78,7 @@ import { SCHEDULING_PAGES } from "../../lib/modules.generated";
 import { footerColumns, navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { backLinkHref } from "../../lib/profile-back-link";
+import { BOT_CHECKED_ROUTES, bookingBotCheckOn } from "../../lib/relay";
 import {
   COPYRIGHT_HOLDER,
   SITE_DESCRIPTION,
@@ -704,6 +706,19 @@ export default async function LocaleLayout({
             dangerouslySetInnerHTML={{ __html: FLASH_PREVENTION_SCRIPT }}
           />
         )}
+        {/* #9889 D5 — BotID's browser half: one inline script, nothing
+            visible, protecting exactly the pairs the relay checks. Mounted
+            only where the server check runs, so a site with it off is
+            byte-identical and one off Vercel never loads a challenge it
+            cannot complete. */}
+        {bookingBotCheckOn() ? (
+          <BotIdClient
+            protect={BOT_CHECKED_ROUTES.map((r) => ({
+              path: r.path,
+              method: r.method,
+            }))}
+          />
+        ) : null}
         {/* Inline CSS-variable declarations for the active theme mode */}
         <style
           data-ailk="theme-vars"
@@ -952,7 +967,9 @@ export default async function LocaleLayout({
            * cookie read — same #5557 hydration-safety property, no gate
            * needed. This also means the banner never blocks the page: it
            * reserves its own space (D1) and carries a close-without-choosing
-           * control (D2) instead of a hard server-side hide.
+           * control (D2) instead of a hard server-side hide. The standard
+           * chrome's compact card has no close control (#9656 D5): it is a
+           * non-modal corner card and Decline All is one tap.
            */}
           {isAccountRoute ? null : (
             <ConsentBanner
@@ -961,18 +978,36 @@ export default async function LocaleLayout({
               consentCookieName={CONSENT_COOKIE_NAME}
               consentDecided={consentDecided}
               title={tConsent("title")}
-              message={
-                <>
-                  {consentBannerStatement}{" "}
-                  <Link
-                    href={localeHref(locale, "/privacy")}
-                    variant="unstyled"
-                    className="font-semibold text-current underline underline-offset-4"
-                  >
-                    {tConsent("policyLinkLabel")}
-                  </Link>
-                </>
-              }
+              // #9656 D7 — the standard chrome mounts the compact floating
+              // card on every width, its Privacy Policy link on the button
+              // row; the minimal chrome keeps its hairline band (#7742 D5),
+              // the statement with the link inline.
+              {...(isMinimalChrome
+                ? {
+                    message: (
+                      <>
+                        {consentBannerStatement}{" "}
+                        <Link
+                          href={localeHref(locale, "/privacy")}
+                          variant="unstyled"
+                          className="font-semibold text-current underline underline-offset-4"
+                        >
+                          {tConsent("policyLinkLabel")}
+                        </Link>
+                      </>
+                    ),
+                  }
+                : {
+                    message: consentBannerStatement,
+                    presentation: "floating" as const,
+                    corner: "bottom-left" as const,
+                    consentAppearance: "compact" as const,
+                    mobileConsent: "inherit" as const,
+                    consentPolicyLink: {
+                      label: tConsent("policyLinkLabel"),
+                      href: "/privacy",
+                    },
+                  })}
               dismissible={false}
               dismissLabel={tConsent("dismissLabel")}
               acceptLabel={tConsent("acceptLabel")}

package/templates/apps/web/app/[locale]/meet/confirmed/BookingHandOff.tsx

@@ -0,0 +1,128 @@
+// oss: false
+"use client"; // Reads sessionStorage (a browser API) once on mount — a server page cannot.
+
+/**
+ * BookingHandOff — `/meet/confirmed`'s booked time and Slack next step
+ * (#9853 D10). The booker writes one `sessionStorage` item before it
+ * navigates here (`BOOKING_CONFIRMATION_STORAGE_KEY`); this reads it once and
+ * removes it, the `/thanks` page's `AccountInviteLink` pattern, so the page's
+ * address carries nothing about the booking and a later visit shows nothing.
+ *
+ * It renders only an item written for this page (`to`'s path, without its
+ * query or hash, is `/meet/confirmed` or `/<locale>/meet/confirmed`) in the last ten
+ * minutes. The time is formatted in the zone Cal.com recorded, with the zone
+ * named, so the page and the Slack welcome name the same one; a zone `Intl`
+ * does not know renders nothing. Every string is a prop the server page read
+ * from the `schedule` namespace.
+ */
+import { Container, Heading, Text } from "@working-theory/ui";
+import {
+  BOOKING_CONFIRMATION_STORAGE_KEY,
+  BookingConfirmationHandOffSchema,
+} from "@working-theory/validation";
+import type { ReactElement } from "react";
+import { useEffect, useState } from "react";
+
+/** A reserved name that never resolves: only used to read the path of `to`. */
+const PLACEHOLDER_ORIGIN = "https://placeholder.invalid";
+const CONFIRMED_PATH = "/meet/confirmed";
+const MAX_AGE_MS = 10 * 60_000;
+
+interface Props {
+  locale: string;
+  /** `schedule.confirmed.bookedTimeHeading`. */
+  bookedTimeHeading: string;
+  /** `schedule.confirmed.slackHeadline`. */
+  slackHeadline: string;
+  /** `schedule.confirmed.slackBody`. */
+  slackBody: string;
+}
+
+interface Shown {
+  time: string;
+  slackOptIn: boolean;
+}
+
+/** Whether `to` names this page, with or without this page's `/<locale>`. */
+function namesThisPage(to: string, locale: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(to, PLACEHOLDER_ORIGIN);
+  } catch {
+    return false;
+  }
+  if (url.origin !== PLACEHOLDER_ORIGIN) return false;
+  return (
+    url.pathname === CONFIRMED_PATH ||
+    url.pathname === `/${locale}${CONFIRMED_PATH}`
+  );
+}
+
+/** Read the hand-off once, remove it, and answer what to show (or `null`). */
+function takeHandOff(locale: string): Shown | null {
+  try {
+    const stored = window.sessionStorage.getItem(
+      BOOKING_CONFIRMATION_STORAGE_KEY,
+    );
+    if (stored === null) return null;
+    window.sessionStorage.removeItem(BOOKING_CONFIRMATION_STORAGE_KEY);
+    const parsed = BookingConfirmationHandOffSchema.safeParse(
+      JSON.parse(stored),
+    );
+    if (!parsed.success) return null;
+    const { to, savedAt, start, timeZone, slackOptIn } = parsed.data;
+    const age = Date.now() - savedAt;
+    if (!namesThisPage(to, locale) || age < 0 || age >= MAX_AGE_MS) return null;
+    const time = new Intl.DateTimeFormat(locale, {
+      weekday: "long",
+      month: "long",
+      day: "numeric",
+      hour: "numeric",
+      minute: "2-digit",
+      timeZone,
+      timeZoneName: "longGeneric",
+    }).format(new Date(start));
+    return { time, slackOptIn };
+  } catch {
+    // Unparseable JSON, refused storage, or a zone `Intl` does not know.
+    return null;
+  }
+}
+
+export function BookingHandOff({
+  locale,
+  bookedTimeHeading,
+  slackHeadline,
+  slackBody,
+}: Props): ReactElement | null {
+  const [shown, setShown] = useState<Shown | null>(null);
+
+  useEffect(() => {
+    // Only ever sets: React's development double-mount runs this twice, and
+    // the second run finds the item already removed.
+    const found = takeHandOff(locale);
+    if (found !== null) setShown(found);
+  }, [locale]);
+
+  if (shown === null) return null;
+  return (
+    <Container className="pt-block-loose">
+      <div role="status" data-testid="booking-hand-off">
+        <Heading level={2} visual={4}>
+          {bookedTimeHeading}
+        </Heading>
+        <Text className="mt-2">{shown.time}</Text>
+        {shown.slackOptIn && (
+          <>
+            <Heading level={2} visual={4} className="mt-block-tight">
+              {slackHeadline}
+            </Heading>
+            <Text tone="muted" className="mt-2">
+              {slackBody}
+            </Text>
+          </>
+        )}
+      </div>
+    </Container>
+  );
+}

package/templates/apps/web/app/[locale]/meet/confirmed/__tests__/BookingHandOff.test.tsx

@@ -0,0 +1,126 @@
+// oss: false
+/**
+ * Tests for `/meet/confirmed`'s booking hand-off (#9853 D9, D10; AC-7).
+ *
+ * The booker hands this page the booked time, its zone and the Slack opt-in
+ * through one `sessionStorage` item, never the address. The component reads
+ * it once and removes it, and shows it only when it was written for this page
+ * in the last ten minutes, formatted in the zone Cal.com recorded — the
+ * prospect's, not the viewer's. Anything else renders nothing.
+ */
+import React from "react";
+import { act, render, screen } from "@testing-library/react";
+
+import { BookingHandOff } from "../BookingHandOff";
+
+const STORAGE_KEY = "ailk:booking-confirmation";
+const PROPS = {
+  locale: "en",
+  bookedTimeHeading: "copy:confirmed.bookedTimeHeading",
+  slackHeadline: "copy:confirmed.slackHeadline",
+  slackBody: "copy:confirmed.slackBody",
+};
+
+function handOff(overrides: Record<string, unknown> = {}) {
+  return {
+    to: "/meet/confirmed",
+    savedAt: Date.now(),
+    start: "2026-10-30T20:00:00.000Z",
+    timeZone: "America/Denver",
+    slackOptIn: true,
+    ...overrides,
+  };
+}
+
+function store(value: unknown): void {
+  window.sessionStorage.setItem(
+    STORAGE_KEY,
+    typeof value === "string" ? value : JSON.stringify(value),
+  );
+}
+
+async function renderHandOff() {
+  let utils!: ReturnType<typeof render>;
+  await act(async () => {
+    utils = render(<BookingHandOff {...PROPS} />);
+  });
+  return utils;
+}
+
+beforeEach(() => {
+  window.sessionStorage.clear();
+  window.history.replaceState(null, "", "/en/meet/confirmed");
+});
+
+describe("<BookingHandOff/> (#9853 AC-7)", () => {
+  it("shows the booked time in the prospect's zone, named, and the Slack step; then forgets it", async () => {
+    store(handOff());
+    const { container } = await renderHandOff();
+
+    expect(screen.getByText(PROPS.bookedTimeHeading)).toBeInTheDocument();
+    expect(container.textContent).toContain("2:00");
+    expect(container.textContent).toContain("Mountain Time");
+    expect(screen.getByText(PROPS.slackHeadline)).toBeInTheDocument();
+    expect(screen.getByText(PROPS.slackBody)).toBeInTheDocument();
+    expect(screen.getByRole("status")).toBeInTheDocument();
+    expect(window.sessionStorage.getItem(STORAGE_KEY)).toBeNull();
+  });
+
+  it("accepts a destination written with a locale prefix, a query or a hash", async () => {
+    store(handOff({ to: "/en/meet/confirmed?x=1#top" }));
+    const { container } = await renderHandOff();
+    expect(container.textContent).toContain("Mountain Time");
+  });
+
+  it("shows no Slack text when the box was not ticked", async () => {
+    store(handOff({ slackOptIn: false }));
+    const { container } = await renderHandOff();
+    expect(container.textContent).toContain("Mountain Time");
+    expect(screen.queryByText(PROPS.slackHeadline)).toBeNull();
+    expect(screen.queryByText(PROPS.slackBody)).toBeNull();
+  });
+
+  it.each<[string, () => void]>([
+    ["no item", () => undefined],
+    ["an unparseable item", () => store("{not json")],
+    [
+      "an item with an extra email key",
+      () => store(handOff({ email: "ada@example.com" })),
+    ],
+    [
+      "an item for another page",
+      () => store(handOff({ to: "/before-your-call" })),
+    ],
+    [
+      "an item eleven minutes old",
+      () => store(handOff({ savedAt: Date.now() - 11 * 60_000 })),
+    ],
+    [
+      "a zone Intl does not know",
+      () => store(handOff({ timeZone: "Mars/Olympus" })),
+    ],
+  ])("renders nothing, and removes the item, for %s", async (_label, seed) => {
+    seed();
+    const { container } = await renderHandOff();
+    expect(container).toBeEmptyDOMElement();
+    expect(window.sessionStorage.getItem(STORAGE_KEY)).toBeNull();
+  });
+
+  it("shows nothing on a later visit", async () => {
+    store(handOff());
+    const first = await renderHandOff();
+    first.unmount();
+    const { container } = await renderHandOff();
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it.each([
+    "/fr/meet/confirmed",
+    "/anything/meet/confirmed",
+    "//evil.example/meet/confirmed",
+  ])("renders nothing for a destination of %s", async (to) => {
+    store(handOff({ to }));
+    const { container } = await renderHandOff();
+    expect(container).toBeEmptyDOMElement();
+  });
+});

package/templates/apps/web/app/api/auth/hub/authorize/__tests__/route.test.ts

@@ -14,6 +14,10 @@
  * #8757 D9 (AC-6): an optional `login_hint` reaches the sign-in page as
  * `email` on the no-session branch only; it never enters the continuation ref
  * or the code redirect, and a repeated one is a 400 like any repeated key.
+ *
+ * #9912 D3 (AC-1): a single `prompt=create` sends a visitor with no session to
+ * `/sign-up` with the same continuation; any other value gives `/sign-in`, a
+ * session ignores it, and it never enters the ref or the code request.
  */
 
 // --- Mocks set up BEFORE imports ---
@@ -459,3 +463,117 @@ describe("the login_hint (#8757 D9)", () => {
     );
   });
 });
+
+describe("the sign-up hint, prompt=create (#9912 D3)", () => {
+  /** The `next` value of the 303, and the ref inside it. */
+  function continuationOf(res: Response): { next: string; ref: string } {
+    const location = res.headers.get("location") ?? "";
+    const next = new URL(location, HUB).searchParams.get("next") ?? "";
+    return { next, ref: next.slice(`${CONTINUE}/`.length) };
+  }
+
+  it("no session + prompt=create: 303 to /sign-up?next=<continue path>; the ref opens to the same six-key query as without the prompt", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const canonical = query();
+
+    const res = await GET(request(`${canonical}&prompt=create`));
+    const plain = await GET(request(canonical));
+
+    expect(res.status).toBe(303);
+    const location = new URL(res.headers.get("location") ?? "", HUB);
+    expect(location.pathname).toBe("/sign-up");
+    expect([...location.searchParams.keys()]).toEqual(["next"]);
+    const { next, ref } = continuationOf(res);
+    expect(res.headers.get("location")).toBe(
+      `/sign-up?next=${encodeURIComponent(`${CONTINUE}/${ref}`)}`,
+    );
+    // The sign-up page keeps it, as the sign-in page does.
+    expect(resolveNextPath(next, "/account")).toBe(next);
+    const opened = openContinuation(ref, mockSecret);
+    expect(opened).toBe(canonical);
+    expect(opened).toBe(
+      openContinuation(continuationOf(plain).ref, mockSecret),
+    );
+    expect(opened).not.toContain("prompt");
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+    expect(mockCreateCode).not.toHaveBeenCalled();
+  });
+
+  it("no session + prompt=create + a valid login_hint: /sign-up carries no email", async () => {
+    mockGetSession.mockResolvedValue(null);
+
+    const res = await GET(
+      request(`${query()}&prompt=create&login_hint=a%40b.example`),
+    );
+
+    expect(res.status).toBe(303);
+    const location = new URL(res.headers.get("location") ?? "", HUB);
+    expect(location.pathname).toBe("/sign-up");
+    expect(location.searchParams.has("email")).toBe(false);
+    expect(res.headers.get("location")).not.toContain("b.example");
+  });
+
+  it.each([
+    ["prompt=login", "login"],
+    ["prompt=none", "none"],
+    ["an empty prompt", ""],
+    ["a cased prompt", "Create"],
+  ])("no session + %s: today's /sign-in", async (_name, prompt) => {
+    mockGetSession.mockResolvedValue(null);
+    const canonical = query();
+
+    const res = await GET(
+      request(`${canonical}&prompt=${encodeURIComponent(prompt)}`),
+    );
+
+    expect(res.status).toBe(303);
+    const { ref } = continuationOf(res);
+    expect(res.headers.get("location")).toBe(
+      `/sign-in?next=${encodeURIComponent(`${CONTINUE}/${ref}`)}`,
+    );
+    expect(openContinuation(ref, mockSecret)).toBe(canonical);
+  });
+
+  it.each([
+    ["no session", null],
+    ["a session", { user: { id: "u1" } }],
+  ])(
+    "a repeated prompt is a 400 invalid_request (%s)",
+    async (_name, session) => {
+      mockGetSession.mockResolvedValue(session);
+
+      const res = await GET(request(`${query()}&prompt=create&prompt=create`));
+
+      expect(res.status).toBe(400);
+      expect(res.headers.get("location")).toBeNull();
+      expect(await res.json()).toEqual({ error: "invalid_request" });
+      expect(mockCreateCode).not.toHaveBeenCalled();
+      expect(mockGetSession).not.toHaveBeenCalled();
+    },
+  );
+
+  it("with a session: prompt=create is ignored — the same code redirect and the same API call", async () => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    const withPrompt = await GET(
+      request(`${query()}&prompt=create`, {
+        cookie: "better-auth.session_token=tok",
+      }),
+    );
+    const without = await GET(
+      request(query(), { cookie: "better-auth.session_token=tok" }),
+    );
+
+    expect(withPrompt.status).toBe(303);
+    const location = withPrompt.headers.get("location") ?? "";
+    expect(location).toBe(without.headers.get("location"));
+    expect(location).toBe(`${SPOKE_CALLBACK}?code=${CODE}&state=${STATE}`);
+    expect(mockCreateCode).toHaveBeenCalledTimes(2);
+    expect(mockCreateCode.mock.calls[0]).toEqual(mockCreateCode.mock.calls[1]);
+  });
+});