create-ailk 0.20.0 → 0.22.0

package/templates/apps/web/app/[locale]/(auth)/layout.tsx

@@ -24,7 +24,6 @@ import { headers } from "next/headers";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement, ReactNode } from "react";
 
-import { siteLogo } from "../../../lib/site-logo";
 
 interface Props {
   children: ReactNode;
@@ -51,19 +50,9 @@ export default async function AuthLayout({
 
   return (
     <AuthShell
-      brand={
-        /*
-         * The mark is clamped to 28px the way `BrandLogo` clamps it inside
-         * Nav: `siteLogo()` emits an <img> with a height ATTRIBUTE and no
-         * width, and an SVG with no intrinsic size then stretches to the
-         * container — it rendered 48 x 350 here before the clamp. The shell
-         * owns the row's geometry; the site owns its mark's size.
-         */
-        <div className="inline-flex h-7 items-center [&>img]:h-full [&>img]:w-auto [&>img]:object-contain">
-          {siteLogo()}
-        </div>
-      }
-      brandHref={localeHref(locale, "/")}
+      // No brand row (#8790 D3): every auth card now carries the site's mark
+      // centred at 48px (`AuthCard`'s `logo` slot), so the shell's top-start
+      // corner is free for a page's own affordance (the sign-in's back link).
       footerLinks={footerLinks}
       languageSwitcher={
         <LocaleSwitcherNav

package/templates/apps/web/app/[locale]/(auth)/reset-password/page.tsx

@@ -39,6 +39,7 @@ import type { ReactElement } from "react";
 import { resetSendConfigured } from "../../../../lib/auth-env";
 
 import { ResetPasswordCard } from "./reset-password-card";
+import { siteLogo } from "../../../../lib/site-logo";
 
 interface Props {
   params: Promise<{ locale: string }>;
@@ -122,6 +123,7 @@ export default async function ResetPasswordPage({
 
   return (
     <ResetPasswordCard
+      logo={siteLogo()}
       token={token}
       signInHref={signInHref}
       labels={labels}

package/templates/apps/web/app/[locale]/(auth)/reset-password/reset-password-card.tsx

@@ -23,12 +23,14 @@ import {
   type AuthSubmitData,
 } from "@working-theory/ui/blocks";
 import { createAuthClient } from "better-auth/react";
-import type { ReactElement } from "react";
+import type { ReactElement, ReactNode } from "react";
 import { useState } from "react";
 
 const authClient = createAuthClient();
 
 export interface ResetPasswordCardProps {
+  /** The site's mark, centred in the card at 48px (#8790 D3). */
+  logo?: ReactNode;
   /** The `?token=` Better Auth redirected back with. May be empty. */
   token: string;
   /** Where a completed reset lands. */
@@ -60,6 +62,7 @@ export function ResetPasswordCard({
   labels,
   errorLabels,
   navigate = defaultNavigate,
+  logo,
 }: ResetPasswordCardProps): ReactElement {
   const [errors, setErrors] = useState<{
     password?: string;
@@ -104,6 +107,7 @@ export function ResetPasswordCard({
   return (
     <div className="flex flex-col gap-4" data-testid="reset-password-page">
       <AuthCard
+        {...(logo !== undefined ? { logo } : {})}
         intent="reset"
         signInHref={signInHref}
         labels={labels}

package/templates/apps/web/app/[locale]/(auth)/sign-in/__tests__/page.test.tsx

@@ -21,6 +21,9 @@
  *   (h) the email sign-in link (#7435): with "magic-link" active the form
  *       renders beside the providers (or alone); a `?error=` from a failed
  *       link maps to fixed copy and is never echoed.
+ *   (i) the hinted email (#8757 D9): a valid single `?email=` is the starting
+ *       value of every email input of the card; an invalid or repeated value,
+ *       or none, leaves them empty as before. It signs no one in.
  *
  * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
  * the real en.json, so `signIn` copy is asserted by its real strings.
@@ -58,6 +61,21 @@ jest.mock("better-auth/react", () => ({
   }),
 }));
 
+// #8790 D2 — the spoke back link. The hub's secret and the registry read are
+// the two boundaries the page crosses; the continuation itself is REAL
+// (minted below with the same test secret), so the sealed-ref path is covered.
+const TEST_SECRET = "test-secret-for-the-sign-in-page-suite";
+// eslint-disable-next-line no-restricted-syntax -- #507: mock-internal rewrite pending; auth.ts is Better Auth's server singleton (a DB/HTTP boundary)
+jest.mock("../../../../../auth", () => ({
+  __esModule: true,
+  resolveSecret: () => TEST_SECRET,
+}));
+const mockClientInfo = jest.fn();
+jest.mock("@working-theory/api-client", () => ({
+  __esModule: true,
+  hubSignIn: { clientInfo: (...args: unknown[]) => mockClientInfo(...args) },
+}));
+import { mintContinuation } from "../../../../api/auth/hub/continuation";
 import en from "../../../../../messages/en.json";
 import Page, { generateMetadata } from "../page";
 
@@ -124,7 +142,9 @@ describe("/sign-in page", () => {
     expect(screen.queryByTestId("auth-sso-github")).toBeNull();
     expect(screen.queryByTestId("auth-submit")).toBeNull();
     expect(screen.queryByTestId("auth-email")).toBeNull();
-    expect(screen.getByText(en.signIn.notConfiguredSubhead)).toBeInTheDocument();
+    expect(
+      screen.getByText(en.signIn.notConfiguredSubhead),
+    ).toBeInTheDocument();
     expect(mockSocial).not.toHaveBeenCalled();
   });
 
@@ -144,7 +164,9 @@ describe("/sign-in page", () => {
     mockSocial.mockResolvedValue({ data: null, error: { message: "nope" } });
     await renderPage("/account");
     await user.click(screen.getByTestId("auth-sso-google"));
-    expect(await screen.findByText(en.signIn.providerFailed)).toBeInTheDocument();
+    expect(
+      await screen.findByText(en.signIn.providerFailed),
+    ).toBeInTheDocument();
   });
 
   it("(e) a protocol-relative ?next= falls back to /account", async () => {
@@ -213,27 +235,49 @@ describe("/sign-in page — the email sign-in link (#7435)", () => {
   it("(h) with google + magic-link: the Google button and 'Email me a sign-in link'", async () => {
     mockGetActiveProviderIds.mockReturnValue(["google", "magic-link"]);
     await renderPage("/account");
-    expect(screen.getByTestId("auth-sso-google")).toBeInTheDocument();
-    expect(screen.getByTestId("auth-email-link-submit")).toHaveTextContent(
+    // Google sits under the "or" as a social button, no longer an SSO stack.
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+    expect(screen.queryByTestId("auth-sso-google")).toBeNull();
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
       en.signIn.emailLinkSubmit,
     );
     expect(en.signIn.emailLinkSubmit).toBe("Email me a sign-in link");
-    expect(screen.getByTestId("auth-email-link-divider")).toBeInTheDocument();
+    // One "or" divider between the primary and Google (#8790 D5).
+    expect(screen.getAllByTestId("auth-divider")).toHaveLength(1);
+    expect(screen.queryByTestId("auth-email-link-divider")).toBeNull();
   });
 
   it("(h) with magic-link only: the form renders and the not-configured subhead does not", async () => {
     mockGetActiveProviderIds.mockReturnValue(["magic-link"]);
     await renderPage();
-    expect(screen.getByTestId("auth-email-link-form")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-email")).toBeInTheDocument();
     expect(screen.queryByText(en.signIn.notConfiguredSubhead)).toBeNull();
-    expect(screen.getByText(en.signIn.subhead)).toBeInTheDocument();
+    // "Welcome back" stands alone — no subhead (#8790 D3).
+    expect(screen.getByText(en.signIn.heading)).toBeInTheDocument();
+    expect(en.signIn.heading).toBe("Welcome back");
+    expect(screen.queryByTestId("auth-method-switch")).toBeNull();
   });
 
   it("(h) beside the password form when the password method is active too", async () => {
     mockGetActiveProviderIds.mockReturnValue(["google", "email", "magic-link"]);
     await renderPage("/account");
+    // The sign-in link leads; the password is one quiet switch away, in place
+    // (#8790 D4), and the typed email survives the switch.
+    expect(screen.queryByTestId("auth-password")).toBeNull();
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
+      en.signIn.emailLinkSubmit,
+    );
+    const user = userEvent.setup();
+    await user.type(screen.getByTestId("auth-email"), "member@example.com");
+    await user.click(screen.getByTestId("auth-method-switch"));
     expect(screen.getByTestId("auth-password")).toBeInTheDocument();
-    expect(screen.getByTestId("auth-email-link-form")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-email")).toHaveValue("member@example.com");
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
+      en.signIn.submit,
+    );
+    expect(screen.getByTestId("auth-method-switch")).toHaveTextContent(
+      en.signIn.useEmailLink,
+    );
   });
 
   it.each(["INVALID_TOKEN", "new_user_signup_disabled"])(
@@ -263,3 +307,111 @@ describe("/sign-in page — the email sign-in link (#7435)", () => {
     expect(screen.queryByTestId("sign-in-link-notice")).toBeNull();
   });
 });
+
+describe("/sign-in page — the spoke back link (#8790 D2)", () => {
+  beforeEach(() => {
+    mockClientInfo.mockReset();
+  });
+
+  it("names the spoke from the registry when the continuation opens", async () => {
+    mockClientInfo.mockResolvedValue({
+      ok: true,
+      body: {
+        clientId: "spoke_1",
+        name: "Wendi Henry",
+        origin: "https://wendihenry.com",
+      },
+    });
+    const ref = mintContinuation(
+      "client_id=spoke_1&response_type=code",
+      TEST_SECRET,
+    );
+    await renderPage(`/api/auth/hub/continue/${ref}`);
+    expect(mockClientInfo).toHaveBeenCalledWith("spoke_1");
+    const back = screen.getByTestId("auth-back-link");
+    expect(back).toHaveAttribute("href", "https://wendihenry.com/account");
+    // This suite's next-intl shim returns messages uninterpolated, so the
+    // label's shape is what is asserted here; the ICU fill is next-intl's.
+    expect(back).toHaveTextContent(/^Back to/);
+  });
+
+  it("renders no back link when the registry does not know the client", async () => {
+    mockClientInfo.mockResolvedValue({ ok: false, status: 404 });
+    const ref = mintContinuation("client_id=spoke_gone", TEST_SECRET);
+    await renderPage(`/api/auth/hub/continue/${ref}`);
+    expect(screen.queryByTestId("auth-back-link")).toBeNull();
+  });
+
+  it("renders no back link on a direct visit", async () => {
+    await renderPage("/account");
+    expect(screen.queryByTestId("auth-back-link")).toBeNull();
+  });
+
+  it("renders no back link, and no error, when the continuation cannot be opened", async () => {
+    // A continuation-shaped `next` whose ref is garbage: the secret load or
+    // the open throws, and the page degrades to the direct-visit render.
+    mockGetActiveProviderIds.mockReturnValue(["google", "magic-link"]);
+    await renderPage("/api/auth/hub/continue/not-a-real-continuation");
+    expect(screen.queryByTestId("auth-back-link")).toBeNull();
+    expect(screen.getByTestId("auth-email")).toBeInTheDocument();
+  });
+});
+
+describe("/sign-in page — the hinted email (#8757 D9)", () => {
+  async function renderWithEmail(email?: string | string[]): Promise<void> {
+    const el = await Page({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({
+        next: "/account",
+        ...(email === undefined ? {} : { email }),
+      }),
+    });
+    render(el);
+  }
+
+  function emailInputs(): HTMLInputElement[] {
+    return Array.from(
+      document.querySelectorAll<HTMLInputElement>('input[type="email"]'),
+    );
+  }
+
+  beforeEach(() => {
+    // One email input on the card (#8790 D4): the sign-in link and the password share it.
+    mockGetActiveProviderIds.mockReturnValue(["google", "email", "magic-link"]);
+  });
+
+  it("(i) ?email=a%40b.example → the card's email input has that value", async () => {
+    // Next hands the page the decoded value.
+    await renderWithEmail("a@b.example");
+    const inputs = emailInputs();
+    expect(inputs).toHaveLength(1);
+    expect(screen.getByTestId("auth-email")).toHaveValue("a@b.example");
+    for (const input of inputs) expect(input).toHaveValue("a@b.example");
+    // A starting value only — nothing was sent.
+    expect(mockEmail).not.toHaveBeenCalled();
+    expect(mockSocial).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ["an invalid value (?email=nope)", "nope"],
+    [
+      "a repeated value (?email=a%40b.example&email=c%40d.example)",
+      ["a@b.example", "c@d.example"],
+    ],
+    ["a value carrying a query separator", "a@b.example&next=/x"],
+    ["no parameter", undefined],
+  ] as const)(
+    "(i) %s → empty email inputs, as today",
+    async (_label, email) => {
+      await renderWithEmail(
+        email === undefined || typeof email === "string" ? email : [...email],
+      );
+      const inputs = emailInputs();
+      expect(inputs).toHaveLength(1);
+      for (const input of inputs) {
+        expect(input).toHaveValue("");
+        expect(input).not.toHaveAttribute("value");
+      }
+    },
+  );
+});

package/templates/apps/web/app/[locale]/(auth)/sign-in/__tests__/sign-in-card.test.tsx

@@ -53,8 +53,10 @@ function props(overrides: Partial<SignInCardProps> = {}): SignInCardProps {
 
 async function requestLink(email = "member@example.com"): Promise<void> {
   const user = userEvent.setup();
-  await user.type(screen.getByTestId("auth-email-link-input"), email);
-  await user.click(screen.getByTestId("auth-email-link-submit"));
+  // #8790 D4 — one field, one action: the sign-in link is the card's own
+  // email field and primary, not a second form.
+  await user.type(screen.getByTestId("auth-email"), email);
+  await user.click(screen.getByTestId("auth-submit"));
 }
 
 beforeEach(() => {
@@ -89,7 +91,7 @@ describe("SignInCard — email sign-in link (#7435)", () => {
     expect(back).toHaveAttribute("href", "/sign-in?next=%2Faccount");
     expect(document.body.textContent).not.toContain("member@example.com");
     expect(document.body.textContent).not.toContain("Follow the link we just sent");
-    expect(screen.queryByTestId("auth-email-link-form")).toBeNull();
+    expect(screen.queryByTestId("auth-submit")).toBeNull();
   });
 
   it("lands rateLimited on the field for a 429", async () => {
@@ -102,7 +104,7 @@ describe("SignInCard — email sign-in link (#7435)", () => {
     expect(
       await screen.findByText(EMAIL_LINK_LABELS.rateLimited),
     ).toBeInTheDocument();
-    expect(screen.getByTestId("auth-email-link-form")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-submit")).toBeInTheDocument();
   });
 
   it("lands failed on the field for any other error", async () => {
@@ -127,9 +129,9 @@ describe("SignInCard — email sign-in link (#7435)", () => {
     mockFetch.mockReturnValue(new Promise((r) => (resolve = r)));
     const user = userEvent.setup();
     render(<SignInCard {...props()} />);
-    await user.type(screen.getByTestId("auth-email-link-input"), "member@example.com");
-    await user.click(screen.getByTestId("auth-email-link-submit"));
-    await user.click(screen.getByTestId("auth-email-link-submit"));
+    await user.type(screen.getByTestId("auth-email"), "member@example.com");
+    await user.click(screen.getByTestId("auth-submit"));
+    await user.click(screen.getByTestId("auth-submit"));
     expect(mockFetch).toHaveBeenCalledTimes(1);
     resolve({ data: { status: true }, error: null });
     expect(await screen.findByText(EMAIL_LINK_LABELS.sentHeading)).toBeInTheDocument();
@@ -144,13 +146,14 @@ describe("SignInCard — email sign-in link (#7435)", () => {
 
   it("renders the form alone, without the not-configured subhead, when it is the only method", () => {
     render(<SignInCard {...props({ providers: [] })} />);
-    expect(screen.getByTestId("auth-email-link-form")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-email")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent("Email me a sign-in link");
     expect(screen.queryByText("Sign-in is not configured.")).toBeNull();
   });
 
   it("renders no email-link form when emailLink is false", () => {
     render(<SignInCard {...props({ emailLink: false, providers: [] })} />);
-    expect(screen.queryByTestId("auth-email-link-form")).toBeNull();
+    expect(screen.queryByTestId("auth-submit")).toBeNull();
     expect(screen.getByText("Sign-in is not configured.")).toBeInTheDocument();
   });
 });

package/templates/apps/web/app/[locale]/(auth)/sign-in/page.tsx

@@ -11,6 +11,11 @@
  * fails verification lands back here with Better Auth's `?error=`, which maps
  * to FIXED copy; the raw value is never rendered.
  *
+ * Hinted email (#8757 D9): a single `?email=` that `accountEmailHintSchema`
+ * accepts is the starting value of every email input of the card (an account
+ * link from a lead's thank-you or invite email). A refused or repeated value
+ * is dropped. Only a field's starting value — it signs no one in.
+ *
  * Since #5963 the page lives in the `(auth)` route group — the URL is
  * unchanged (a group contributes no path segment) but the frame is
  * `AuthShell`, not the marketing Nav + Footer. The shell owns the brand mark
@@ -22,6 +27,7 @@
  */
 
 import { localeHref } from "@working-theory/ui";
+import { accountEmailHintSchema } from "@working-theory/validation";
 import type { Metadata } from "next";
 import { getTranslations } from "next-intl/server";
 import type { ReactElement } from "react";
@@ -31,13 +37,34 @@ import {
   resetSendConfigured,
 } from "../../../../lib/auth-env";
 
+import { hubSignIn } from "@working-theory/api-client";
+import { Link, Text } from "@working-theory/ui/primitives";
+import { siteLogo } from "../../../../lib/site-logo";
+import {
+  CONTINUE_PATH,
+  openContinuation,
+} from "../../../api/auth/hub/continuation";
 import { resolveNextPath } from "./next-path";
 import { SignInCard, type SignInProvider } from "./sign-in-card";
 import { resolveSignInCardText, type SignInCardText } from "./sign-in-text";
 
 interface Props {
   params: Promise<{ locale: string }>;
-  searchParams: Promise<{ next?: string | string[]; error?: string | string[] }>;
+  searchParams: Promise<{
+    next?: string | string[];
+    error?: string | string[];
+    email?: string | string[];
+  }>;
+}
+
+/**
+ * #8757 D9 — the hinted email, read once: a repeated `?email=` (an array) or a
+ * value the hint schema refuses is dropped, never echoed.
+ */
+function hintedEmail(raw: string | string[] | undefined): string | undefined {
+  if (typeof raw !== "string") return undefined;
+  const parsed = accountEmailHintSchema.safeParse(raw);
+  return parsed.success ? parsed.data : undefined;
 }
 
 /**
@@ -67,12 +94,46 @@ export async function generateMetadata({ params }: Props): Promise<Metadata> {
   return { title: t("title"), description: t("description") };
 }
 
+/**
+ * The spoke a hub sign-in continuation came from (#8790 D2), or `null`: not
+ * a continuation, a continuation that does not open (expired, forged), a
+ * client id the registry does not know, or no API. The spoke's identity is
+ * read from the registry by `client_id` — never from a query parameter.
+ */
+async function spokeFromNext(
+  next: string,
+): Promise<{ name: string; origin: string } | null> {
+  const prefix = `${CONTINUE_PATH}/`;
+  if (!next.startsWith(prefix)) return null;
+  let query: string | null;
+  try {
+    // Lazy: `auth.ts` is Better Auth's server module. Only a continuation
+    // needs its secret, so a direct visit — and every test of one — never
+    // loads it (the `(authed)` gate takes the same care).
+    const { resolveSecret } = await import("../../../../auth");
+    query = openContinuation(next.slice(prefix.length), resolveSecret());
+  } catch {
+    return null;
+  }
+  if (query === null) return null;
+  const clientId = new URLSearchParams(query).get("client_id");
+  if (!clientId) return null;
+  try {
+    const result = await hubSignIn.clientInfo(clientId);
+    return result.ok
+      ? { name: result.body.name, origin: result.body.origin }
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 export default async function SignInPage({
   params,
   searchParams,
 }: Props): Promise<ReactElement> {
   const { locale } = await params;
-  const { next: rawNext, error } = await searchParams;
+  const { next: rawNext, error, email: rawEmail } = await searchParams;
   const text = await resolveSignInCardText(locale);
 
   const active = getActiveProviderIds();
@@ -87,9 +148,50 @@ export default async function SignInPage({
   const signInHref = `${localeHref(locale, "/sign-in")}?next=${encodeURIComponent(next)}`;
   // Only the email link produces `?error=` here; with it off, today's render.
   const linkNotice = emailLink ? linkNoticeFor(error, text) : undefined;
+  const defaultEmail = hintedEmail(rawEmail);
 
+  const spoke = await spokeFromNext(next);
+  // The acknowledgement (#8790 D6) — the hub's own policy pages, through the
+  // inline link variant; the card never hardcodes a path.
+  // `caption` is the muted footnote role; a default `Text` would re-impose
+  // body size and the foreground colour over the card's footnote wrapper.
+  const footnote = (
+    <Text as="p" variant="caption">
+      {text.acknowledgement.lead}{" "}
+      <Link variant="inline" href={localeHref(locale, "/terms")}>
+        {text.acknowledgement.terms}
+      </Link>
+      ,{" "}
+      <Link variant="inline" href={localeHref(locale, "/privacy")}>
+        {text.acknowledgement.privacy}
+      </Link>
+      , and{" "}
+      <Link variant="inline" href={localeHref(locale, "/working-agreement")}>
+        {text.acknowledgement.workingAgreement}
+      </Link>
+      .
+    </Text>
+  );
   return (
     <SignInCard
+      logo={siteLogo()}
+      {...(spoke
+        ? {
+            backLink: {
+              href: `${spoke.origin}/account`,
+              label: text.backTo(spoke.name),
+            },
+          }
+        : {})}
+      {...(text.prospect
+        ? {
+            prospect: {
+              ...text.prospect,
+              href: localeHref(locale, "/sign-up"),
+            },
+          }
+        : {})}
+      footnote={footnote}
       providers={providers}
       method={method}
       next={next}
@@ -109,6 +211,7 @@ export default async function SignInPage({
       errorCallbackURL={signInHref}
       signInHref={signInHref}
       {...(linkNotice !== undefined ? { linkNotice } : {})}
+      {...(defaultEmail !== undefined ? { defaultEmail } : {})}
       emailLinkLabels={text.emailLinkLabels}
     />
   );

package/templates/apps/web/app/[locale]/(auth)/sign-in/sign-in-card.tsx

@@ -45,15 +45,20 @@
  * the same for an address with and without an account, so a success swaps to
  * a sent state that never names the address. The gate composes this card too
  * (`(authed)/sign-in-gate.tsx`).
+ *
+ * Hinted email (#8757 D9): the page hands in `defaultEmail` (already checked
+ * by `accountEmailHintSchema`); it reaches AuthCard as the starting value of
+ * every email input. Absent → AuthCard's render is unchanged.
  */
 
 import {
+  AuthBackLink,
   AuthCard,
   type AuthCardLabels,
   type AuthSubmitData,
 } from "@working-theory/ui/blocks";
 import { Alert, AlertDescription } from "@working-theory/ui/primitives";
-import { useRef, useState, type ReactElement } from "react";
+import { useRef, useState, type ReactElement, type ReactNode } from "react";
 
 import { authClient, useAuthCardFlow } from "../use-auth-card-flow";
 
@@ -98,6 +103,16 @@ export interface SignInCardProps {
   /** Fixed copy for a failed link (`?error=` mapped by the page), shown above the card. */
   linkNotice?: string;
   emailLinkLabels: SignInEmailLinkLabels;
+  /** #8757 D9 — the validated `?email=` hint, the email inputs' starting value. */
+  defaultEmail?: string;
+  /** The site's mark, centred in the card at 48px (#8790 D3). */
+  logo?: ReactNode;
+  /** "← Back to <spoke>" when the visitor came from a registered spoke (#8790 D2). */
+  backLink?: { href: string; label: string };
+  /** The prospect line a site turns on (#8790 D3). */
+  prospect?: { prompt: string; linkLabel: string; href: string };
+  /** The acknowledgement sentence(s) at the card's foot (#8790 D6). */
+  footnote?: ReactNode;
 }
 
 export function SignInCard({
@@ -114,6 +129,11 @@ export function SignInCard({
   signInHref,
   linkNotice,
   emailLinkLabels,
+  defaultEmail,
+  logo,
+  backLink,
+  prospect,
+  footnote,
 }: SignInCardProps): ReactElement {
   const { errors, providerError, launchProvider, submitPassword } =
     useAuthCardFlow(next, {
@@ -128,6 +148,12 @@ export function SignInCard({
 
   const notConfigured =
     method === "sso" && providers.length === 0 && !emailLink;
+  // One field, one action (#8790 D4): the sign-in link first when it is on,
+  // the password as the in-place alternative when the email provider is on.
+  const methods: ("magic-link" | "password")[] = [
+    ...(emailLink ? (["magic-link"] as const) : []),
+    ...(method === "password" ? (["password"] as const) : []),
+  ];
 
   const providerButtons = providers.map((provider) => ({
     provider,
@@ -198,6 +224,7 @@ export function SignInCard({
      * in empty space, first input at 470px" defect the auth route group fixes.
      */
     <div className="flex flex-col gap-4" data-testid="sign-in-page">
+      {backLink ? <AuthBackLink href={backLink.href} label={backLink.label} /> : null}
       {method === "sso" && providerError ? (
         <Alert variant="error" data-testid="sign-in-provider-error">
           <AlertDescription>{providerError}</AlertDescription>
@@ -212,18 +239,24 @@ export function SignInCard({
         intent="sign-in"
         method={method}
         footer="none"
+        {...(logo !== undefined ? { logo } : {})}
         {...(forgotHref !== undefined ? { forgotHref } : {})}
         {...(forgot !== undefined ? { forgot } : {})}
-        {...(notConfigured ? { subhead: notConfiguredSubhead } : {})}
+        // "Welcome back" stands alone (#8790 D3): no subhead unless the card
+        // is inert and must say why.
+        subhead={notConfigured ? notConfiguredSubhead : ""}
+        {...(prospect !== undefined ? { prospect } : {})}
+        {...(footnote !== undefined ? { footnote } : {})}
         providers={providerButtons}
         onSubmit={handleSubmit}
         errors={
           emailLinkError ? { ...errors, emailLink: emailLinkError } : errors
         }
         labels={labels}
+        {...(defaultEmail !== undefined ? { defaultEmail } : {})}
+        {...(methods.length > 0 ? { methodSwitch: { methods } } : {})}
         {...(emailLink
           ? {
-              emailLink: "form" as const,
               onEmailLink: (email: string) => void requestEmailLink(email),
             }
           : {})}