create-ailk 0.26.0 → 0.27.0

package/templates/apps/web/app/[locale]/(auth)/sign-up/__tests__/page.test.tsx

@@ -6,27 +6,41 @@
  * provider body. A failed link lands back here with `?error=<code>`, mapped
  * to fixed copy and never echoed.
  *
+ * #9912 D4, D5: the page reads `?next=` through `resolveNextPath`, as
+ * `/sign-in` does. The "Sign in" toggle (open and closed card) carries it, and
+ * the password, Google and magic-link paths each hand it to Better Auth as
+ * `callbackURL`, the magic link's failed-link return keeping it too. A `next`
+ * resolveNextPath refuses, or none, gives `/account` and the bare links.
+ *
  * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
  * the real en.json.
  */
 import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 
 const mockGetActiveProviderIds = jest.fn();
+const mockIsSignUpOpen = jest.fn();
 // eslint-disable-next-line no-restricted-syntax -- #507: auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
 jest.mock("../../../../../lib/auth-env", () => ({
   __esModule: true,
   getActiveProviderIds: () => mockGetActiveProviderIds(),
-  isSignUpOpen: () => true,
+  isSignUpOpen: () => mockIsSignUpOpen(),
   isResetAvailable: () => false,
   resetSendConfigured: () => false,
 }));
 
+const mockSocial = jest.fn();
+const mockSignUpEmail = jest.fn();
+const mockFetch = jest.fn();
 jest.mock("better-auth/react", () => ({
   __esModule: true,
   createAuthClient: () => ({
-    signIn: { social: jest.fn(), email: jest.fn() },
-    signUp: { email: jest.fn() },
-    $fetch: jest.fn(),
+    signIn: {
+      social: (...args: unknown[]) => mockSocial(...args),
+      email: jest.fn(),
+    },
+    signUp: { email: (...args: unknown[]) => mockSignUpEmail(...args) },
+    $fetch: (...args: unknown[]) => mockFetch(...args),
   }),
 }));
 
@@ -46,6 +60,10 @@ async function renderSignUp(
 
 beforeEach(() => {
   mockGetActiveProviderIds.mockReset();
+  mockIsSignUpOpen.mockReset().mockReturnValue(true);
+  mockSocial.mockReset().mockResolvedValue({ data: {}, error: null });
+  mockSignUpEmail.mockReset().mockResolvedValue({ data: {}, error: null });
+  mockFetch.mockReset().mockResolvedValue({ data: {}, error: null });
 });
 
 describe("the method (D6)", () => {
@@ -106,3 +124,178 @@ describe("the failed-link notice (D6)", () => {
     expect(screen.queryByTestId("sign-up-link-notice")).toBeNull();
   });
 });
+
+/** A continue path as the hub's authorize step hands it (#8146). */
+const CONTINUATION = "/api/auth/hub/continue/AbC-123_xyz";
+
+/** The three values `resolveNextPath` refuses that a toggle must never echo. */
+const REFUSED: ReadonlyArray<[string, string]> = [
+  ["a protocol-relative next", "//evil.example"],
+  ["an absolute next", "https://evil.example/x"],
+  ["a backslash next", "/\\evil.example"],
+];
+
+/** Each query that carries no `next` a toggle may echo: the refused three, and none. */
+const UNCARRIED: Array<[string, Record<string, string>]> = [
+  ...REFUSED.map(([label, next]): [string, Record<string, string>] => [
+    label,
+    { next },
+  ]),
+  ["no next", {}],
+];
+
+/** The completion cases with no `next` to honour: one refused, and none. */
+const TO_ACCOUNT: Array<[string, Record<string, string>]> = [
+  ["a refused next", { next: "//evil.example" }],
+  ["no next", {}],
+];
+
+describe("the Sign in toggle keeps the next (#9912 D4)", () => {
+  beforeEach(() => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+  });
+
+  it("carries a validated next on the open card", async () => {
+    await renderSignUp({ next: "/account/billing" });
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-in?next=%2Faccount%2Fbilling",
+    );
+  });
+
+  it("carries a validated next on the closed (invitation) card", async () => {
+    mockIsSignUpOpen.mockReturnValue(false);
+    await renderSignUp({ next: "/account/billing" });
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-in?next=%2Faccount%2Fbilling",
+    );
+  });
+
+  it.each(UNCARRIED)(
+    "%s gives the bare /sign-in on the open card",
+    async (_label, query) => {
+      await renderSignUp(query);
+      expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+        "href",
+        "/sign-in",
+      );
+    },
+  );
+
+  it.each(UNCARRIED)(
+    "%s gives the bare /sign-in on the closed card",
+    async (_label, query) => {
+      mockIsSignUpOpen.mockReturnValue(false);
+      await renderSignUp(query);
+      expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+        "href",
+        "/sign-in",
+      );
+    },
+  );
+});
+
+describe("sign-up completion follows the validated next (#9912 D5)", () => {
+  async function tickTerms(): Promise<void> {
+    await userEvent.setup().click(screen.getByTestId("consent-account_terms"));
+  }
+
+  async function submitPassword(): Promise<void> {
+    const user = userEvent.setup();
+    await tickTerms();
+    await user.type(screen.getByTestId("auth-email"), "ada@example.com");
+    await user.type(
+      screen.getByTestId("auth-password"),
+      "correct horse battery staple",
+    );
+    await user.click(screen.getByTestId("auth-submit"));
+  }
+
+  async function clickGoogle(): Promise<void> {
+    await tickTerms();
+    await userEvent.setup().click(screen.getByTestId("auth-social-google"));
+  }
+
+  async function submitLink(): Promise<void> {
+    const user = userEvent.setup();
+    await tickTerms();
+    await user.type(screen.getByTestId("auth-email"), "ada@example.com");
+    await user.click(screen.getByTestId("auth-submit"));
+  }
+
+  describe("with a continuation next", () => {
+    it("password: signUp.email's callbackURL is the next", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp({ next: CONTINUATION });
+      await submitPassword();
+      expect(mockSignUpEmail).toHaveBeenCalledTimes(1);
+      expect(mockSignUpEmail.mock.calls[0][0]).toMatchObject({
+        callbackURL: CONTINUATION,
+      });
+    });
+
+    it("Google: signIn.social's callbackURL is the next", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp({ next: CONTINUATION });
+      await clickGoogle();
+      expect(mockSocial).toHaveBeenCalledTimes(1);
+      expect(mockSocial.mock.calls[0][0]).toMatchObject({
+        provider: "google",
+        callbackURL: CONTINUATION,
+      });
+    });
+
+    it("magic link: the request's callbackURL is the next and its failed-link return keeps it", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "magic-link"]);
+      await renderSignUp({ next: CONTINUATION });
+      await submitLink();
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const [path, init] = mockFetch.mock.calls[0] as [
+        string,
+        { body: Record<string, unknown> },
+      ];
+      expect(path).toBe("/sign-in/magic-link");
+      expect(init.body.callbackURL).toBe(CONTINUATION);
+      expect(init.body.errorCallbackURL).toBe(
+        `/sign-up?next=${encodeURIComponent(CONTINUATION)}`,
+      );
+    });
+  });
+
+  describe.each(TO_ACCOUNT)("with %s", (_label, query) => {
+    it("password: callbackURL /account", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp(query);
+      await submitPassword();
+      expect(mockSignUpEmail).toHaveBeenCalledTimes(1);
+      expect(mockSignUpEmail.mock.calls[0][0]).toMatchObject({
+        callbackURL: "/account",
+      });
+    });
+
+    it("Google: callbackURL /account", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+      await renderSignUp(query);
+      await clickGoogle();
+      expect(mockSocial).toHaveBeenCalledTimes(1);
+      expect(mockSocial.mock.calls[0][0]).toMatchObject({
+        provider: "google",
+        callbackURL: "/account",
+      });
+    });
+
+    it("magic link: callbackURL /account and the bare /sign-up return", async () => {
+      mockGetActiveProviderIds.mockReturnValue(["google", "magic-link"]);
+      await renderSignUp(query);
+      await submitLink();
+      expect(mockFetch).toHaveBeenCalledTimes(1);
+      const [, init] = mockFetch.mock.calls[0] as [
+        string,
+        { body: Record<string, unknown> },
+      ];
+      expect(init.body.callbackURL).toBe("/account");
+      expect(init.body.errorCallbackURL).toBe("/sign-up");
+    });
+  });
+});

package/templates/apps/web/app/[locale]/(auth)/sign-up/page.tsx

@@ -19,6 +19,13 @@
  * keeps its invitation copy inside that frame — never a form the server
  * would refuse (operator, 2026-10-24).
  *
+ * `?next=` (#9912 D4, D5) is read through `resolveNextPath`, the call
+ * `/sign-in` makes. The validated `next` is where every method completes —
+ * the password verification link, the magic link and Google — and both the
+ * "Sign in" toggle and the failed-link return carry it, so a buyer sent here
+ * by a spoke's round trip ends back on the spoke. A refused or absent `next`
+ * gives `/account` and the bare links, as before.
+ *
  * `AuthShell` (the (auth) group's layout) owns the 400px column; the card
  * carries the site's mark (#8790 D3).
  */
@@ -38,13 +45,17 @@ import { getActiveProviderIds, isSignUpOpen } from "../../../../lib/auth-env";
 import { consentPoliciesFor } from "../../../../lib/consent-policies";
 import { siteLogo } from "../../../../lib/site-logo";
 import { legalFootnote } from "../legal-footnote";
+import { hrefWithNext, resolveNextPath } from "../sign-in/next-path";
 import { resolveSignInCardText } from "../sign-in/sign-in-text";
 
 import { SignUpCard, type SignUpProvider } from "./sign-up-card";
 
 interface Props {
   params: Promise<{ locale: string }>;
-  searchParams?: Promise<{ error?: string | string[] }>;
+  searchParams?: Promise<{
+    next?: string | string[];
+    error?: string | string[];
+  }>;
 }
 
 /**
@@ -79,13 +90,15 @@ export default async function SignUpPage({
   searchParams,
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
+  const { next: rawNext, error } = (await searchParams) ?? {};
   const t = await getTranslations({ locale, namespace: "auth" });
-  const signInHref = localeHref(locale, "/sign-in");
+  const fallback = localeHref(locale, "/account");
+  const next = resolveNextPath(rawNext, fallback);
   // The toggle line to /sign-in, and the acknowledgement /sign-in shares.
   const prospect = {
     prompt: t("signUpFooterPrompt"),
     linkLabel: t("signUpFooterLink"),
-    href: signInHref,
+    href: hrefWithNext(localeHref(locale, "/sign-in"), next, fallback),
   };
   const footnote = legalFootnote(
     locale,
@@ -122,8 +135,7 @@ export default async function SignUpPage({
     : active.includes("email")
       ? "password"
       : "sso";
-  const noticeKey =
-    method === "magic-link" ? linkNoticeKey((await searchParams)?.error) : null;
+  const noticeKey = method === "magic-link" ? linkNoticeKey(error) : null;
 
   const labels: AuthCardLabels = {
     signUpHeading: t("signUpHeading"),
@@ -156,7 +168,7 @@ export default async function SignUpPage({
       logo={siteLogo()}
       providers={providers}
       method={method}
-      next={localeHref(locale, "/account")}
+      next={next}
       prospect={prospect}
       footnote={footnote}
       labels={labels}
@@ -170,7 +182,11 @@ export default async function SignUpPage({
       agreementPolicies={consentPoliciesFor(locale)}
       agreementsLegend={t("signUpAgreementsLegend")}
       locale={locale}
-      errorCallbackURL={localeHref(locale, "/sign-up")}
+      errorCallbackURL={hrefWithNext(
+        localeHref(locale, "/sign-up"),
+        next,
+        fallback,
+      )}
       {...(noticeKey ? { linkNotice: t(noticeKey) } : {})}
       linkLabels={{
         sentHeading: t("sentHeading"),

package/templates/apps/web/app/[locale]/layout.tsx

@@ -48,6 +48,7 @@ import {
   getStealthRobots,
   readLocales,
 } from "@working-theory/web-i18n";
+import { BotIdClient } from "botid/client";
 import type { Metadata, Viewport } from "next";
 import { cookies, headers } from "next/headers";
 import { NextIntlClientProvider } from "next-intl";
@@ -77,6 +78,7 @@ import { SCHEDULING_PAGES } from "../../lib/modules.generated";
 import { footerColumns, navItems } from "../../lib/nav-config";
 import { getOgImageUrl } from "../../lib/og";
 import { backLinkHref } from "../../lib/profile-back-link";
+import { BOT_CHECKED_ROUTES, bookingBotCheckOn } from "../../lib/relay";
 import {
   COPYRIGHT_HOLDER,
   SITE_DESCRIPTION,
@@ -704,6 +706,19 @@ export default async function LocaleLayout({
             dangerouslySetInnerHTML={{ __html: FLASH_PREVENTION_SCRIPT }}
           />
         )}
+        {/* #9889 D5 — BotID's browser half: one inline script, nothing
+            visible, protecting exactly the pairs the relay checks. Mounted
+            only where the server check runs, so a site with it off is
+            byte-identical and one off Vercel never loads a challenge it
+            cannot complete. */}
+        {bookingBotCheckOn() ? (
+          <BotIdClient
+            protect={BOT_CHECKED_ROUTES.map((r) => ({
+              path: r.path,
+              method: r.method,
+            }))}
+          />
+        ) : null}
         {/* Inline CSS-variable declarations for the active theme mode */}
         <style
           data-ailk="theme-vars"

package/templates/apps/web/app/api/auth/hub/authorize/__tests__/route.test.ts

@@ -14,6 +14,10 @@
  * #8757 D9 (AC-6): an optional `login_hint` reaches the sign-in page as
  * `email` on the no-session branch only; it never enters the continuation ref
  * or the code redirect, and a repeated one is a 400 like any repeated key.
+ *
+ * #9912 D3 (AC-1): a single `prompt=create` sends a visitor with no session to
+ * `/sign-up` with the same continuation; any other value gives `/sign-in`, a
+ * session ignores it, and it never enters the ref or the code request.
  */
 
 // --- Mocks set up BEFORE imports ---
@@ -459,3 +463,117 @@ describe("the login_hint (#8757 D9)", () => {
     );
   });
 });
+
+describe("the sign-up hint, prompt=create (#9912 D3)", () => {
+  /** The `next` value of the 303, and the ref inside it. */
+  function continuationOf(res: Response): { next: string; ref: string } {
+    const location = res.headers.get("location") ?? "";
+    const next = new URL(location, HUB).searchParams.get("next") ?? "";
+    return { next, ref: next.slice(`${CONTINUE}/`.length) };
+  }
+
+  it("no session + prompt=create: 303 to /sign-up?next=<continue path>; the ref opens to the same six-key query as without the prompt", async () => {
+    mockGetSession.mockResolvedValue(null);
+    const canonical = query();
+
+    const res = await GET(request(`${canonical}&prompt=create`));
+    const plain = await GET(request(canonical));
+
+    expect(res.status).toBe(303);
+    const location = new URL(res.headers.get("location") ?? "", HUB);
+    expect(location.pathname).toBe("/sign-up");
+    expect([...location.searchParams.keys()]).toEqual(["next"]);
+    const { next, ref } = continuationOf(res);
+    expect(res.headers.get("location")).toBe(
+      `/sign-up?next=${encodeURIComponent(`${CONTINUE}/${ref}`)}`,
+    );
+    // The sign-up page keeps it, as the sign-in page does.
+    expect(resolveNextPath(next, "/account")).toBe(next);
+    const opened = openContinuation(ref, mockSecret);
+    expect(opened).toBe(canonical);
+    expect(opened).toBe(
+      openContinuation(continuationOf(plain).ref, mockSecret),
+    );
+    expect(opened).not.toContain("prompt");
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    expect(res.headers.get("referrer-policy")).toBe("no-referrer");
+    expect(mockCreateCode).not.toHaveBeenCalled();
+  });
+
+  it("no session + prompt=create + a valid login_hint: /sign-up carries no email", async () => {
+    mockGetSession.mockResolvedValue(null);
+
+    const res = await GET(
+      request(`${query()}&prompt=create&login_hint=a%40b.example`),
+    );
+
+    expect(res.status).toBe(303);
+    const location = new URL(res.headers.get("location") ?? "", HUB);
+    expect(location.pathname).toBe("/sign-up");
+    expect(location.searchParams.has("email")).toBe(false);
+    expect(res.headers.get("location")).not.toContain("b.example");
+  });
+
+  it.each([
+    ["prompt=login", "login"],
+    ["prompt=none", "none"],
+    ["an empty prompt", ""],
+    ["a cased prompt", "Create"],
+  ])("no session + %s: today's /sign-in", async (_name, prompt) => {
+    mockGetSession.mockResolvedValue(null);
+    const canonical = query();
+
+    const res = await GET(
+      request(`${canonical}&prompt=${encodeURIComponent(prompt)}`),
+    );
+
+    expect(res.status).toBe(303);
+    const { ref } = continuationOf(res);
+    expect(res.headers.get("location")).toBe(
+      `/sign-in?next=${encodeURIComponent(`${CONTINUE}/${ref}`)}`,
+    );
+    expect(openContinuation(ref, mockSecret)).toBe(canonical);
+  });
+
+  it.each([
+    ["no session", null],
+    ["a session", { user: { id: "u1" } }],
+  ])(
+    "a repeated prompt is a 400 invalid_request (%s)",
+    async (_name, session) => {
+      mockGetSession.mockResolvedValue(session);
+
+      const res = await GET(request(`${query()}&prompt=create&prompt=create`));
+
+      expect(res.status).toBe(400);
+      expect(res.headers.get("location")).toBeNull();
+      expect(await res.json()).toEqual({ error: "invalid_request" });
+      expect(mockCreateCode).not.toHaveBeenCalled();
+      expect(mockGetSession).not.toHaveBeenCalled();
+    },
+  );
+
+  it("with a session: prompt=create is ignored — the same code redirect and the same API call", async () => {
+    mockGetSession.mockResolvedValue({ user: { id: "u1" } });
+    mockCreateCode.mockResolvedValue({
+      ok: true,
+      body: { code: CODE, redirectUri: SPOKE_CALLBACK },
+    });
+
+    const withPrompt = await GET(
+      request(`${query()}&prompt=create`, {
+        cookie: "better-auth.session_token=tok",
+      }),
+    );
+    const without = await GET(
+      request(query(), { cookie: "better-auth.session_token=tok" }),
+    );
+
+    expect(withPrompt.status).toBe(303);
+    const location = withPrompt.headers.get("location") ?? "";
+    expect(location).toBe(without.headers.get("location"));
+    expect(location).toBe(`${SPOKE_CALLBACK}?code=${CODE}&state=${STATE}`);
+    expect(mockCreateCode).toHaveBeenCalledTimes(2);
+    expect(mockCreateCode.mock.calls[0]).toEqual(mockCreateCode.mock.calls[1]);
+  });
+});

package/templates/apps/web/app/api/auth/hub/authorize/route.ts

@@ -12,6 +12,7 @@
  *       ?response_type=code&client_id=…&redirect_uri=…&state=…
  *       &code_challenge=…&code_challenge_method=S256
  *       [&login_hint=<email>]   (optional, #8757 D9 — see below)
+ *       [&prompt=create]        (optional, #9912 D3 — see below)
  *
  *   - a malformed query is a 400 and NEVER a redirect;
  *   - no Better Auth session: the six validated keys are sealed into a short
@@ -41,6 +42,15 @@
  * route rebuilds the query from the ref, so the hint is gone after sign-in —
  * and with a session it is ignored.
  *
+ * `prompt=create` (#9912 D3) is the spoke's "Sign up": read beside
+ * `login_hint` by the same once-only rule (repeated → 400, before the session
+ * read). On the no-session branch exactly `create` sends the visitor to
+ * `/sign-up?next=<the same continue path>` instead of `/sign-in`, with no
+ * `email`; any other value does nothing. It never enters the ref — so a
+ * password sign-up, which ends with no session, comes back through the
+ * continuation to `/sign-in` — nor a code or a cookie, and with a session it
+ * is ignored: the person has an account, and the spoke signs them in.
+ *
  * `BETTER_AUTH_URL` pins the `Origin` sent with the cookie-authenticated write
  * (Node's `fetch` sets none). Unset, the step answers 503: it needs a pinned
  * origin, exactly as the emailed link does.
@@ -124,6 +134,9 @@ export async function GET(request: Request): Promise<Response> {
   // #8757 D9 — the optional hint: the same once-only rule; refused → dropped.
   const hints = url.searchParams.getAll("login_hint");
   if (hints.length > 1) return json(400, "invalid_request");
+  // #9912 D3 — the sign-up hint, by the same rule; only `create` acts.
+  const prompts = url.searchParams.getAll("prompt");
+  if (prompts.length > 1) return json(400, "invalid_request");
   const parsed = hubAuthorizeQuerySchema.safeParse(raw);
   if (!parsed.success) return json(400, "invalid_request");
   const query = parsed.data;
@@ -138,6 +151,7 @@ export async function GET(request: Request): Promise<Response> {
     const ref = mintContinuation(canonical.toString(), resolveSecret());
     if (ref.length > CONTINUATION_REF_MAX) return json(400, "invalid_request");
     const signIn = new URLSearchParams({ next: `${CONTINUE_PATH}/${ref}` });
+    if (prompts[0] === "create") return see(`/sign-up?${signIn.toString()}`);
     if (hint.success) signIn.set("email", hint.data);
     return see(`/sign-in?${signIn.toString()}`);
   }

package/templates/apps/web/app/api/hub-session/__tests__/routes.test.ts

@@ -16,6 +16,10 @@
  *
  * #8757 D9 (AC-6): a valid single `?email=` on the sign-in route becomes the
  * authorize URL's `login_hint`; the sealed flow cookie never carries it.
+ *
+ * #9912 D2 (AC-1): exactly one `?prompt=create` rides to the hub as
+ * `prompt=create`, so the hub sends a visitor with no session to /sign-up;
+ * any other value adds nothing, and the flow cookie's keys are unchanged.
  */
 
 import { createHash } from "node:crypto";
@@ -204,6 +208,53 @@ describe("GET /api/hub-session/sign-in — the hinted email (#8757 D9)", () => {
   });
 });
 
+describe("GET /api/hub-session/sign-in — the sign-up hint (#9912 D2)", () => {
+  function startWith(query: string): { authorize: URL; payload: Record<string, unknown> } {
+    const res = signIn(new Request(`${SITE}/api/hub-session/sign-in?${query}`));
+    expect(res.status).toBe(303);
+    const flow = cookieValue(res, "ailk-hub-flow");
+    if (flow === undefined) throw new Error("no flow cookie");
+    const payload = unseal(flow, SESSION_SECRET, "flow", "ailk-hub-flow");
+    if (payload === null || typeof payload !== "object") throw new Error("flow did not open");
+    return {
+      authorize: new URL(res.headers.get("location") ?? ""),
+      payload: payload as Record<string, unknown>,
+    };
+  }
+
+  it("?next=/account&prompt=create → the authorize URL carries prompt=create; the flow cookie keeps exactly its five keys", () => {
+    const { authorize, payload } = startWith("next=/account&prompt=create");
+    expect(authorize.pathname).toBe("/api/auth/hub/authorize");
+    expect(authorize.searchParams.getAll("prompt")).toEqual(["create"]);
+    // The six keys are untouched beside it.
+    expect(authorize.searchParams.get("response_type")).toBe("code");
+    expect(authorize.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(Object.keys(payload).sort()).toEqual(
+      ["expiresAt", "next", "state", "v", "verifier"],
+    );
+    expect(payload.next).toBe("/account");
+    expect(JSON.stringify(payload)).not.toContain("create");
+  });
+
+  it("forwards the hint beside a valid login_hint", () => {
+    const { authorize } = startWith("next=/account&prompt=create&email=a%40b.example");
+    expect(authorize.searchParams.get("prompt")).toBe("create");
+    expect(authorize.searchParams.get("login_hint")).toBe("a@b.example");
+  });
+
+  it.each([
+    ["another OIDC value", "next=/account&prompt=login"],
+    ["an empty value", "next=/account&prompt="],
+    ["a repeated value", "next=/account&prompt=create&prompt=create"],
+    ["a cased value", "next=/account&prompt=Create"],
+    ["no value", "next=/account"],
+  ])("%s → no prompt", (_label, query) => {
+    const { authorize, payload } = startWith(query);
+    expect(authorize.searchParams.has("prompt")).toBe(false);
+    expect(payload).not.toHaveProperty("prompt");
+  });
+});
+
 describe("GET /api/hub-session/callback", () => {
   function exchangeOk(): void {
     mockExchange.mockResolvedValue({

package/templates/apps/web/app/api/hub-session/sign-in/route.ts

@@ -15,6 +15,12 @@
  * the address typed. A refused or repeated value is dropped. The hint goes on
  * the authorize URL only — never into the sealed flow cookie.
  *
+ * Sign-up hint (#9912 D2): exactly one `?prompt=create` (the gate's "Sign up")
+ * rides to the hub as `prompt=create`, so a visitor with no hub session lands
+ * on its sign-up screen instead of sign-in; the round trip is otherwise the
+ * same. Any other value, an empty or a repeated one adds nothing, and the hint
+ * never enters the flow cookie.
+ *
  * Nothing here logs the state, the verifier or the challenge.
  */
 import { createHash, randomBytes } from "node:crypto";
@@ -55,6 +61,12 @@ function emailHint(params: URLSearchParams): string | undefined {
   return parsed.success ? parsed.data : undefined;
 }
 
+/** #9912 D2 — `"create"` when the one `prompt` is exactly that, else none. */
+function signUpHint(params: URLSearchParams): "create" | undefined {
+  const values = params.getAll("prompt");
+  return values.length === 1 && values[0] === "create" ? "create" : undefined;
+}
+
 // platform-decisions-waiver: api-versioning — sign-in redirect endpoint, not a versioned API contract (spec 7894 §7)
 export function GET(request: Request): Response {
   if (SIGN_IN_PROVIDER !== "hub") return new Response(null, { status: 404 });
@@ -84,6 +96,7 @@ export function GET(request: Request): Response {
     code_challenge: challenge,
     code_challenge_method: "S256",
   });
+  if (signUpHint(params) !== undefined) query.set("prompt", "create");
   const loginHint = emailHint(params);
   if (loginHint !== undefined) query.set("login_hint", loginHint);
   authorize.search = query.toString();