create-ailk 0.31.0 → 0.33.0

package/templates/apps/web/app/[locale]/(auth)/verify-email/page.tsx

@@ -1,31 +1,41 @@
 /**
- * `/[locale]/verify-email` — the check-your-email terminus (#5963, wired by #5962).
+ * `/[locale]/verify-email` — the check-your-email terminus (#5963, wired by
+ * #5962) and the sign-up confirm page (#10820 D7).
  *
- * Two states, both copy-only:
- *   - no `?error`  → the `sent` intent. What #5963 shipped: this page states
- *                    what just happened.
- *   - `?error=…`   → the same expired/invalid-token state `/reset-password`
- *                    renders. Better Auth's `/verify-email` redirects to its
- *                    callback with `?error=<code>` when the JWT is expired,
- *                    malformed or signed with a rotated secret.
+ * Four states, in this precedence:
+ *   - `?verify=<nonce>` → a confirm card holding ONE button. The GET writes
+ *                    nothing: the button posts to `confirmEmailAction`, bound
+ *                    to the nonce (no hidden input carries it), so a mail
+ *                    scanner or a link preview that fetches the link verifies
+ *                    nothing — only a person's click does.
+ *   - `?confirmed=1` → the verified card, with the Sign in link.
+ *   - `?error=…`   → the same expired/invalid-link state `/reset-password`
+ *                    renders: the action's answer for an expired, unknown or
+ *                    refused confirm.
+ *   - no query     → the `sent` intent: this page states what just happened.
  *
- * The verification token's properties are NOT the reset token's, and the copy
- * is written accordingly: it is a signed JWT rather than a row, so it is
- * neither single-use nor revocable — the same link keeps working until it
- * expires. That asymmetry is acceptable precisely because its blast radius is
- * `emailVerified: true` on one row rather than a credential.
+ * The link is the API's single-use nonce (`services/email-verification.ts`):
+ * one confirm spends it, and it expires after 24 hours.
  */
 
 import { localeHref } from "@working-theory/ui";
 import { AuthCard, type AuthCardLabels } from "@working-theory/ui/blocks";
+import { Button, Text } from "@working-theory/ui/primitives";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
+
 import { siteLogo } from "../../../../lib/site-logo";
 
+import { confirmEmailAction } from "./actions";
+
 interface Props {
   params: Promise<{ locale: string }>;
-  searchParams?: Promise<{ error?: string | string[] }>;
+  searchParams?: Promise<{
+    error?: string | string[];
+    verify?: string | string[];
+    confirmed?: string | string[];
+  }>;
 }
 
 function firstValue(raw: string | string[] | undefined): string {
@@ -52,6 +62,61 @@ export default async function VerifyEmailPage({
 
   const query = searchParams ? await searchParams : {};
   const error = firstValue(query.error);
+  const nonce = firstValue(query.verify);
+
+  if (nonce.length >= 1 && nonce.length <= 256) {
+    const labels: AuthCardLabels = {
+      sentHeading: t("confirmHeading"),
+      sentSubhead: t("confirmSubhead"),
+      backToSignIn: t("backToSignIn"),
+    };
+    return (
+      <div className="flex flex-col gap-4" data-testid="verify-email-page">
+        <div data-testid="verify-email-confirm">
+          <AuthCard
+            logo={siteLogo()}
+            intent="sent"
+            signInHref={signInHref}
+            labels={labels}
+            body={
+              <form
+                action={confirmEmailAction.bind(null, nonce, locale)}
+                className="flex flex-col gap-5 text-center"
+              >
+                <Text variant="body-sm" tone="muted">
+                  {t("confirmBody")}
+                </Text>
+                <Button
+                  type="submit"
+                  size="big"
+                  className="w-full"
+                  data-testid="verify-email-confirm-button"
+                >
+                  {t("confirmButton")}
+                </Button>
+              </form>
+            }
+          />
+        </div>
+      </div>
+    );
+  }
+
+  if (firstValue(query.confirmed) === "1") {
+    const labels: AuthCardLabels = {
+      sentHeading: t("verifiedHeading"),
+      sentSubhead: t("verifiedSubhead"),
+      sentBody: t("verifiedBody"),
+      backToSignIn: t("backToSignIn"),
+    };
+    return (
+      <div className="flex flex-col gap-4" data-testid="verify-email-page">
+        <div data-testid="verify-email-confirmed">
+          <AuthCard logo={siteLogo()} intent="sent" signInHref={signInHref} labels={labels} />
+        </div>
+      </div>
+    );
+  }
 
   if (error) {
     const labels: AuthCardLabels = {

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/hub-mode.test.tsx

@@ -124,6 +124,13 @@ jest.mock("@working-theory/api-client", () => ({
     messages: (...args: unknown[]) => mockMemberRead(...args),
     purchases: (...args: unknown[]) => mockMemberPurchases(...args),
     appointments: (...args: unknown[]) => mockMemberAppointments(...args),
+    // #10826 D7 — the user-magnet results read; 404 here (no workspace module).
+    results: () =>
+      Promise.resolve({
+        ok: false,
+        status: 404,
+        body: { ok: false, error: { code: "not_found", message: "Not found" } },
+      }),
     updateProfile: (...args: unknown[]) => mockUpdateProfile(...args),
     requestDeletion: (...args: unknown[]) => mockRequestDeletion(...args),
     // #8217 — only the rendered billing action reads it; billing-source.ts never does.

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/new-menu.test.tsx

@@ -72,6 +72,13 @@ jest.mock("@working-theory/api-client", () => ({
     messages: (...args: unknown[]) => mockMemberMessages(...args),
     purchases: (...args: unknown[]) => mockMemberPurchases(...args),
     appointments: (...args: unknown[]) => mockMemberAppointments(...args),
+    // #10826 D7 — the user-magnet results read; 404 here (no workspace module).
+    results: () =>
+      Promise.resolve({
+        ok: false,
+        status: 404,
+        body: { ok: false, error: { code: "not_found", message: "Not found" } },
+      }),
     meetingTypes: (...args: unknown[]) => mockMemberMeetingTypes(...args),
     requestForm: (...args: unknown[]) => mockMemberRequestForm(...args),
   },

package/templates/apps/web/app/[locale]/(authed)/account/__tests__/page.test.tsx

@@ -100,6 +100,13 @@ jest.mock("@working-theory/api-client", () => ({
     messages: (...args: unknown[]) => mockMemberMessages(...args),
     purchases: (...args: unknown[]) => mockMemberPurchases(...args),
     appointments: (...args: unknown[]) => mockMemberAppointments(...args),
+    // #10826 D7 — the user-magnet results read; 404 here (no workspace module).
+    results: () =>
+      Promise.resolve({
+        ok: false,
+        status: 404,
+        body: { ok: false, error: { code: "not_found", message: "Not found" } },
+      }),
     // #8765 D8 — the retired card's read; the page must not depend on it.
     consents: (...args: unknown[]) => mockMemberConsents(...args),
     // #8233 C4 — the New menu's availability reads; 404 here, so the Inbox

package/templates/apps/web/app/[locale]/[slug]/[detail]/__tests__/page.test.tsx

@@ -105,6 +105,9 @@ import { notFound } from "next/navigation";
 import { listingExtension } from "../../../../../lib/listings";
 import DetailPage, { generateMetadata } from "../page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
 
 function makeSource(slug: string) {

package/templates/apps/web/app/[locale]/[slug]/__tests__/page.test.tsx

@@ -45,6 +45,9 @@ jest.mock("@working-theory/ui", () => ({
 import { notFound } from "next/navigation";
 import SlugPage from "../page";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 const mockNotFound = notFound as jest.MockedFunction<typeof notFound>;
 
 function makeSource(slug: string, schema?: Record<string, unknown>) {

package/templates/apps/web/app/[locale]/about/__tests__/about-routes.test.tsx

@@ -45,6 +45,9 @@ import { createSitemapHandler } from "../../../sitemap.xml/route";
 import { createLlmsHandler } from "../../../llms.txt/route";
 import type { ContentAdapter } from "@working-theory/content-adapters";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 type JsonLd = Record<string, unknown>;
 
 function jsonLdScripts(container: HTMLElement): JsonLd[] {

package/templates/apps/web/app/[locale]/careers/__tests__/page-renderer-migration.test.tsx

@@ -58,6 +58,9 @@ import CareersPage from "../page";
 import CareersSlugPage from "../[slug]/page";
 import * as pageRenderer from "@working-theory/page-renderer";
 
+// #10704 — a fixture suite: its content is shaped for the mdx source, whatever the site serves from.
+process.env.CONTENT_ADAPTER = "mdx";
+
 // ── Shared stubs ───────────────────────────────────────────────────────────────
 const getMdxSourceEmpty = jest.fn().mockResolvedValue(null);
 

package/templates/apps/web/app/[locale]/contact/__tests__/contact.actions.test.ts

@@ -935,6 +935,27 @@ describe("captureLeadAction — a checkout magnet answers the Offerings buy rout
     },
   );
 
+  it("a stored lookup key is the key itself, never `<key>_monthly` (#10823)", async () => {
+    answers({ completion: "checkout", checkoutOffering: "growth-ops-growth_yearly" });
+    shows({ status: "shown", shownSet: shownSet(["monthly", "yearly"], "growth-ops-growth") });
+
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
+      kind: "success",
+      name: "Jane Smith",
+      redirect: "/api/offerings/checkout/growth-ops-growth_yearly",
+    });
+  });
+
+  it("a stored lookup key the shown set does not show → exactly { kind: success } (#10823)", async () => {
+    answers({ completion: "checkout", checkoutOffering: "growth-ops-growth_once" });
+    shows({ status: "shown", shownSet: shownSet(["monthly", "yearly"], "growth-ops-growth") });
+
+    expect(await captureLeadAction(INITIAL_STATE, makeFormData(VALID_FIELDS))).toStrictEqual({
+      kind: "success",
+      name: expect.any(String),
+    });
+  });
+
   it.each([
     ["a plan the shown set does not show", () => shows({ status: "shown", shownSet: shownSet(["monthly"], "growth") })],
     ["an unconnected site", () => shows({ status: "unconnected" })],

package/templates/apps/web/app/[locale]/contact/contact.actions.ts

@@ -100,13 +100,15 @@
  * (#9142). The form hard-navigates there (`LeadCaptureForm`'s `redirect`),
  * because the route starts a session only for a top-level navigation and a
  * Server Action `redirect()` is fetched as RSC, which it sends to `/pricing`.
- * The stored value is a `{plan}`, so the key is the one that plan's
- * `/pricing` card links first: the first of `<plan>_monthly`,
- * `<plan>_yearly` and `<plan>_once` the shown set shows, read through
+ * A stored value `parseLookupKey` accepts (`growth-ops-growth_monthly`,
+ * #10823) is the key itself. Otherwise it is a `{plan}`, and the key is the
+ * one that plan's `/pricing` card links first: the first of `<plan>_monthly`,
+ * `<plan>_yearly` and `<plan>_once` the shown set shows. Either way the key
+ * must be in the shown set, read through
  * `offerings.shown()` within 5 seconds and shared per instance for 15, as
  * the buy route reads it. It runs only after the write resolved `ok`. The
  * value is re-checked with `flowCheckoutOfferingSchema` first; one that
- * fails, a plan the shown set does not show, or a read that fails or times
+ * fails, a key or plan the shown set does not show, or a read that fails or times
  * out answers `{ kind: "success" }`, as `lead` does.
  * A failed write never answers the buy route.
  */
@@ -118,6 +120,7 @@ import {
   flowCheckoutOfferingSchema,
   leadSubmitNextSchema,
   LOOKUP_KEY_PERIODS,
+  parseLookupKey,
 } from "@working-theory/validation";
 import { cookies, headers } from "next/headers";
 import { getLocale, getTranslations } from "next-intl/server";
@@ -247,8 +250,9 @@ function sharedShownSet(): Promise<unknown> {
 }
 
 /**
- * #8757 D11, #9171 — the Offerings buy route for the plan a `checkout` answer
- * names: its first shown key in `/pricing`'s card order; else `null`.
+ * #8757 D11, #9171 — the Offerings buy route for the offering a `checkout`
+ * answer names: the stored lookup key when it is one and shown (#10823), else
+ * the plan's first shown key in `/pricing`'s card order; else `null`.
  */
 async function checkoutHrefOf(next: unknown): Promise<string | null> {
   const parsed = leadSubmitNextSchema.safeParse(next);
@@ -256,9 +260,11 @@ async function checkoutHrefOf(next: unknown): Promise<string | null> {
   const plan = flowCheckoutOfferingSchema.safeParse(parsed.data.checkoutOffering);
   if (!plan.success) return null;
   const shownSet = await sharedShownSet();
-  const key = LOOKUP_KEY_PERIODS.map((period) => `${plan.data}_${period}`).find((k) =>
-    isShownLookupKey(shownSet, k),
-  );
+  const candidates =
+    parseLookupKey(plan.data) === null
+      ? LOOKUP_KEY_PERIODS.map((period) => `${plan.data}_${period}`)
+      : [plan.data];
+  const key = candidates.find((k) => isShownLookupKey(shownSet, k));
   return key === undefined ? null : offeringsCheckoutHref(key);
 }
 

package/templates/apps/web/app/[locale]/flows/[slug]/FlowStepperClient.tsx

@@ -42,14 +42,16 @@
  * a tier with no slug, or a flow with none, continues exactly as before. The
  * answers are read to score, never written into the href.
  *
- * Account link (#8771 D5): when the walk completes on an `invite` magnet (the
- * step response's `next`), the client asks `accountInviteLinkAction` for the
- * sign-in link with the email the visitor gave already filled in, then shows
- * "Track this in your account" on `FlowStepper`'s own finished panel — or,
- * for a flow with a `thankYou` block, hands the link to `/thanks/<slug>`
- * through `sessionStorage` (`ailk:account-invite`). The email never enters a
- * URL the walk navigates to (NFR1), and each link sits in a Session-Replay
- * `data-sentry-block` element, since the scrub cannot reach a DOM `href`.
+ * Sign-up landing (#10826 D6, after #8771 D5): when the walk completes on a
+ * `user` magnet (the step response's `next` is `{ completion: "invite" }`),
+ * the client asks `accountInviteLinkAction` for the sign-in link with the
+ * email the visitor gave already filled in, and navigates there at once —
+ * a full navigation (`window.location.assign`), because a hub sign-in path is
+ * not a Next route. A `null` link (no sign-in on this site) ends the walk as
+ * before. A response carrying a `deliverable` never navigates (#8848 D8): the
+ * sign-up landing then reaches the respondent through the verification
+ * email's confirm (D5). The email never enters a URL the walk navigates to
+ * other than that sign-in link itself.
  *
  * The standard magnet's parts (#8840 D9): the consent registry is the
  * platform default with the locale's `/terms` and `/privacy` links
@@ -116,6 +118,7 @@ import {
   resolveLocalizedString,
   resolveThankYouSlug,
   resolveTierThankYouSlug,
+  resultsPermalinkAnswers,
   selectFlowEndingOutcome,
   SITE_CONSENT_CONFIG_DEFAULTS,
   visitorNameOf,
@@ -150,9 +153,6 @@ function resolveSafeLocale(candidate: string): string {
   return ENABLED_LOCALES.includes(candidate) ? candidate : DEFAULT_LOCALE;
 }
 
-/** The `/thanks` hand-off key (#8771 D5) — read once by `AccountInviteLink`. */
-const ACCOUNT_INVITE_STORAGE_KEY = "ailk:account-invite";
-
 /**
  * #8771 D5 — the email the engine will land as the lead's: the first
  * `mapsTo: "email"` field of the submitted `field` step that holds a
@@ -190,24 +190,6 @@ function safeDeliverable(raw: unknown): FlowStepDeliverable | undefined {
   return parsed.success ? parsed.data : undefined;
 }
 
-/**
- * D7 (#4770) — every question `name` contributed by a `segmentation`-typed
- * step. This is the allowlist the encoded permalink is filtered to: a
- * `field`-typed step's values — mapped or unmapped, including the invisible
- * `aeo_score` step's own submission (D1) — never reach it.
- */
-function segmentationQuestionNames(config: FlowConfig): Set<string> {
-  const names = new Set<string>();
-  for (const step of config.steps) {
-    if (step.type === "segmentation") {
-      for (const question of step.questions) {
-        names.add(question.name);
-      }
-    }
-  }
-  return names;
-}
-
 /**
  * #8840 D9 — the answers the ending is chosen from, assembled as the
  * permalink path assembles them: the visible steps' answers flattened, then
@@ -258,13 +240,10 @@ export function FlowStepperClient({
   // recommending completion can hand the walk's session to the results page
   // via `sessionStorage` (never the URL — the permalink stays answers-only).
   const lastSessionIdRef = useRef<string | undefined>(undefined);
-  // #8771 D5 — the email the walk has landed, and the account link built from
-  // it at completion on an `invite` magnet. The ref carries the link to
-  // `handleCompleted`; the state draws it on the finished panel.
+  // #8771 D5 — the email the walk has landed. #10826 D6 — set once the walk
+  // has left for the sign-up landing, so no other ending races it.
   const emailRef = useRef<string | undefined>(undefined);
-  const inviteHrefRef = useRef<string | null>(null);
-  const [inviteHref, setInviteHref] = useState<string | null>(null);
-  const tContact = useTranslations("contact");
+  const signingUpRef = useRef(false);
   // #8840 D9 — a config with an `ending` ends on it, never on `thankYou` or
   // the permalink; the chosen screen is drawn in the finished card.
   const endingWins = config.ending !== undefined;
@@ -285,8 +264,12 @@ export function FlowStepperClient({
       lastSessionIdRef.current = result.response.sessionId;
       emailRef.current = mappedEmailOf(config, payload) ?? emailRef.current;
       if (result.response.completed) {
-        await resolveInviteLink(result.response);
-        const delivered = showDeliverable((result.response as { deliverable?: unknown }).deliverable);
+        const raw = (result.response as { deliverable?: unknown }).deliverable;
+        // #8848 D8 — a deliverable (or a gated file's by-email line) is never
+        // lost to a navigation.
+        const hasDeliverable = raw !== undefined || config.deliverable !== undefined;
+        if (!hasDeliverable && (await goToSignUp(result.response))) return result;
+        const delivered = showDeliverable(raw);
         if (endingWins) showEnding(delivered);
       }
     } else if (result.kind === "step_conflict") {
@@ -296,23 +279,25 @@ export function FlowStepperClient({
     return result;
   }
 
-  // #8771 D5 — on an `invite` completion with a landed email, ask the server
-  // for the prefilled sign-in link. A rejected or null answer gives no link.
-  async function resolveInviteLink(response: unknown): Promise<void> {
-    inviteHrefRef.current = null;
-    setInviteHref(null);
+  // #10826 D6 — on an `invite` completion (a `user` magnet) with a landed
+  // email, ask the server for the prefilled sign-in link and go there. True
+  // when the walk navigated; a rejected or null answer ends the walk as before.
+  async function goToSignUp(response: unknown): Promise<boolean> {
     const next = flowStepNextSchema.safeParse(
       (response as { next?: unknown }).next,
     );
     const email = emailRef.current;
-    if (!next.success || email === undefined || isRecommending) return;
+    if (!next.success || email === undefined || isRecommending) return false;
+    let href: string | null;
     try {
-      const href = await accountInviteLinkAction(email);
-      inviteHrefRef.current = href;
-      setInviteHref(href);
+      href = await accountInviteLinkAction(email);
     } catch {
-      // No link — the walk still completes.
+      return false;
     }
+    if (href === null) return false;
+    signingUpRef.current = true;
+    window.location.assign(href);
+    return true;
   }
 
   // #8848 D8 — draw the response's deliverable (true when there is one), or,
@@ -385,14 +370,7 @@ export function FlowStepperClient({
   // redirect never runs, so the deliverable is never lost to a navigation.
   function showEnding(delivered = false): void {
     const answers = walkAnswers(config, answersRef.current);
-    const segmentationNames = segmentationQuestionNames(config);
-    const choices: Record<string, string | string[]> = {};
-    for (const [name, value] of Object.entries(answers)) {
-      if (segmentationNames.has(name) && (typeof value === "string" || Array.isArray(value))) {
-        choices[name] = value as string | string[];
-      }
-    }
-    const outcome = selectFlowEndingOutcome(config, choices);
+    const outcome = selectFlowEndingOutcome(config, resultsPermalinkAnswers(config, answers));
     if (outcome === undefined) return;
     if (outcome.kind === "redirect") {
       if (!delivered && flowSitePathSchema.safeParse(outcome.href).success) {
@@ -449,6 +427,7 @@ export function FlowStepperClient({
     segment?: string;
     aeoScore?: AeoScoreResult;
   }): void {
+    if (signingUpRef.current) return;
     // #10616 D4 — a scored tier's thank-you page wins over the permalink and
     // the `thankYou` block. Scored from the walk's answers as the server's
     // completion payload assembles them; no flags are passed (the server
@@ -481,15 +460,9 @@ export function FlowStepperClient({
       // below.
       Object.assign(flat, hiddenAnswers(config, answersRef.current, flags));
 
-      // D7 — segmentation-only filter.
-      const segmentationNames = segmentationQuestionNames(config);
-      const answers: Record<string, string | string[]> = {};
-      for (const [name, value] of Object.entries(flat)) {
-        if (!segmentationNames.has(name)) continue;
-        if (typeof value === "string" || Array.isArray(value)) {
-          answers[name] = value as string | string[];
-        }
-      }
+      // D7 — segmentation-only filter (`resultsPermalinkAnswers`, the
+      // allowlist the Lead confirm's results landing shares, #10826 D5).
+      const answers = resultsPermalinkAnswers(config, flat);
 
       const payload = encodePermalink({
         version: PERMALINK_VERSION,
@@ -519,28 +492,8 @@ export function FlowStepperClient({
   }
 
   // The thank-you redirect's tail, shared by the `thankYou` block and a
-  // scored tier's slug (#10616 D4): the invite hand-off, then the push.
+  // scored tier's slug (#10616 D4).
   function goToThanks(thankYouSlug: string): void {
-    // #8771 D5 — hand the link to /thanks through the per-tab sessionStorage,
-    // never the URL; with no link, clear an earlier walk's so it never shows
-    // on this page. A storage that throws gives no link.
-    if (typeof window !== "undefined") {
-      try {
-        if (inviteHrefRef.current !== null) {
-          window.sessionStorage.setItem(
-            ACCOUNT_INVITE_STORAGE_KEY,
-            JSON.stringify({
-              thanks: thankYouSlug,
-              href: inviteHrefRef.current,
-            }),
-          );
-        } else {
-          window.sessionStorage.removeItem(ACCOUNT_INVITE_STORAGE_KEY);
-        }
-      } catch {
-        // No hand-off.
-      }
-    }
     router.push(`/${resolveSafeLocale(locale)}/thanks/${thankYouSlug}`);
   }
 
@@ -584,25 +537,6 @@ export function FlowStepperClient({
     selectAllThatApply: t("selectAllThatApply"),
   };
 
-  // #8771 D5 — the link goes INSIDE FlowStepper's own finished card (a flow
-  // with a `thankYou` block navigates away instead, so it never shows there).
-  // Session Replay records the DOM, so the link (it carries the email) is
-  // blocked from it; `Link` does not forward an undeclared data-* attribute.
-  const completedAction =
-    inviteHref !== null && (endingWins || thankYou === undefined) && !isRecommending ? (
-      <div data-sentry-block>
-        <Button asChild variant="outline" className="mt-4 min-h-11">
-          <Link
-            href={inviteHref}
-            variant="bare"
-            data-testid="flow-account-invite"
-          >
-            {tContact("trackInAccount")}
-          </Link>
-        </Button>
-      </div>
-    ) : undefined;
-
   // #8848 D8 — the ending screen, then the deliverable; with no ending the
   // stepper's own finished copy heads the action.
   const completedContent =
@@ -629,7 +563,6 @@ export function FlowStepperClient({
       {...(!endingWins && (thankYou !== undefined || isRecommending || hasTierThankYou)
         ? { onCompleted: handleCompleted }
         : {})}
-      {...(completedAction !== undefined ? { completedAction } : {})}
       // #8840 D9 — the locale's policy links, the input-step count, and the
       // page's hidden values, header and ending.
       consentConfig={{ ...SITE_CONSENT_CONFIG_DEFAULTS, policies: consentPoliciesFor(locale) }}