Authentication
The way in: sign in, sign up, reset, verify. Real validation, real states, and no server call of their own.
Asks for the email and answers the same way whether or not the account exists; the confirmation names the address, the link's lifetime and the way back.
Sign in with email and password plus brand-neutral other ways in. Field errors after the first attempt, a revealable password, a pending button and the server's answer as an alert; hands the values to onSubmit and never calls a server itself.
The sign-in form beside a brand panel painted with the primary pair. Container-query layout: the panel stands down when narrow.
Create an account: name, work email, a password with a strength meter that names the unmet rules, and explicit consent. Errors appear after the first attempt.
Choose a new password: whose account, strength explained, the two entries compared, and an end state that says other sessions were signed out.
Six digits in one InputOTP that submits itself when full, a resend that counts down, and a recovery-code way out.
The waiting room after sign-up: which address, what to do, a counting-down resend and the way back for a mistyped address.