Let guests keep a published rule via Save & Exit and a post-finalize sign-in prompt.

Email is optional so they can continue without saving; skip from Save & Exit leaves the flow instead of returning to completed.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/unit/hooks/useCreateFlowFinalize.test.tsx

@@ -4,6 +4,7 @@ import type { CreateFlowState } from "../../../app/(app)/create/types";
 import { useCreateFlowFinalize } from "../../../app/(app)/create/hooks/useCreateFlowFinalize";
 import { publishRule, updatePublishedRule } from "../../../lib/create/api";
 import { writeLastPublishedRule } from "../../../lib/create/lastPublishedRule";
+import { CREATE_FLOW_PENDING_KEEP_RULE_LOGIN_KEY } from "../../../lib/create/pendingKeepRuleLogin";
 import {
   CREATE_FLOW_COMPLETED_CELEBRATE_QUERY,
   CREATE_FLOW_COMPLETED_CELEBRATE_VALUE,
@@ -44,6 +45,7 @@ describe("useCreateFlowFinalize", () => {
     updateState.mockReset();
     openLogin.mockReset();
     onGuestPublished.mockReset();
+    sessionStorage.clear();
   });
 
   afterEach(() => {
@@ -82,6 +84,9 @@ describe("useCreateFlowFinalize", () => {
       summary: "Published summary",
       document: {},
     });
+    expect(
+      sessionStorage.getItem(CREATE_FLOW_PENDING_KEEP_RULE_LOGIN_KEY),
+    ).toBeNull();
   });
 
   it("does not publish while the session is unresolved", async () => {
@@ -137,6 +142,7 @@ describe("useCreateFlowFinalize", () => {
     });
     expect(onGuestPublished).toHaveBeenCalledWith({ skippedInvites: true });
     expect(openLogin).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem(CREATE_FLOW_PENDING_KEEP_RULE_LOGIN_KEY)).toBe("1");
     expect(router.push).toHaveBeenCalledWith(
       `/create/completed?${CREATE_FLOW_COMPLETED_CELEBRATE_QUERY}=${CREATE_FLOW_COMPLETED_CELEBRATE_VALUE}`,
     );
@@ -172,6 +178,7 @@ describe("useCreateFlowFinalize", () => {
     });
     expect(onGuestPublished).toHaveBeenCalledWith({ skippedInvites: false });
     expect(openLogin).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem(CREATE_FLOW_PENDING_KEEP_RULE_LOGIN_KEY)).toBe("1");
     expect(router.push).toHaveBeenCalledWith(
       `/create/completed?${CREATE_FLOW_COMPLETED_CELEBRATE_QUERY}=${CREATE_FLOW_COMPLETED_CELEBRATE_VALUE}`,
     );
@@ -250,4 +257,69 @@ describe("useCreateFlowFinalize", () => {
       editingPublishedRuleId: undefined,
     });
   });
+
+  it("does not PATCH when a guest finalizes an already-published rule", async () => {
+    const { result } = renderHook(() =>
+      useCreateFlowFinalize({
+        state: {
+          ...emptyState,
+          editingPublishedRuleId: "guest-rule-1",
+        },
+        router,
+        openLogin,
+        updateState,
+        loginReturnPath: "/create/final-review?syncDraft=1",
+        sessionUser: null,
+        onGuestPublished,
+      }),
+    );
+
+    await act(async () => {
+      await result.current.finalize();
+    });
+
+    expect(updatePublishedRule).not.toHaveBeenCalled();
+    expect(publishRule).not.toHaveBeenCalled();
+    expect(openLogin).not.toHaveBeenCalled();
+    expect(onGuestPublished).toHaveBeenCalledWith({ skippedInvites: false });
+    expect(writeLastPublishedRule).toHaveBeenCalledWith({
+      id: "guest-rule-1",
+      title: "Published title",
+      summary: "Published summary",
+      document: {},
+    });
+    expect(sessionStorage.getItem(CREATE_FLOW_PENDING_KEEP_RULE_LOGIN_KEY)).toBe("1");
+    expect(router.push).toHaveBeenCalledWith("/create/completed");
+  });
+
+  it("opens keepRule login when a guest publish is unauthorized", async () => {
+    vi.mocked(publishRule).mockResolvedValue({
+      ok: false,
+      error: "Unauthorized",
+      status: 401,
+    });
+
+    const { result } = renderHook(() =>
+      useCreateFlowFinalize({
+        state: emptyState,
+        router,
+        openLogin,
+        updateState,
+        loginReturnPath: "/create/final-review?syncDraft=1",
+        sessionUser: null,
+        onGuestPublished,
+      }),
+    );
+
+    await act(async () => {
+      await result.current.finalize();
+    });
+
+    expect(openLogin).toHaveBeenCalledWith({
+      variant: "keepRule",
+      nextPath: "/create/completed",
+      backdropVariant: "blurredYellow",
+    });
+    expect(router.push).not.toHaveBeenCalled();
+  });
 });