create-ailk 0.25.1 → 0.26.0

package/templates/apps/web/app/[locale]/(auth)/__tests__/auth-pages.test.tsx

@@ -17,7 +17,7 @@
  * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
  * the real en.json, so the `auth` copy is asserted by its real strings.
  */
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 
 const mockGetActiveProviderIds = jest.fn();
 const mockIsSignUpOpen = jest.fn();
@@ -217,12 +217,51 @@ describe("/sign-up follows isSignUpOpen()", () => {
   it("renders the invitation intent when sign-up is closed", async () => {
     mockIsSignUpOpen.mockReturnValue(false);
     await renderPage(SignUpPage);
-    expect(screen.getByTestId("auth-invitation-body")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-invitation-body")).toHaveTextContent(
+      en.auth.invitationBody,
+    );
     expect(
-      screen.getByRole("heading", { name: en.auth.invitationHeading }),
+      screen.getByRole("heading", { name: en.auth.signUpHeading }),
     ).toBeInTheDocument();
     expect(screen.queryByTestId("auth-submit")).not.toBeInTheDocument();
   });
+
+  // The one card (#9662) frames both branches: the mark, "Sign up", the toggle
+  // line to /sign-in (no footer cross-link) and the acknowledgement.
+  it.each([
+    ["closed", false],
+    ["open", true],
+  ] as const)("frames the %s card: mark, 'Sign up', toggle line, footnote (#9662)", async (_name, open) => {
+    mockIsSignUpOpen.mockReturnValue(open);
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+    await renderPage(SignUpPage);
+    expect(screen.getByTestId("auth-card-logo")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { name: "Sign up" })).toBeInTheDocument();
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^Already have an account\? Sign in$/,
+    );
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-in",
+    );
+    expect(screen.queryByTestId("auth-footer-link")).not.toBeInTheDocument();
+    expect(screen.getByTestId("auth-card-footnote")).toHaveTextContent(
+      /^You acknowledge that you read, and agree to our Terms of Service and our Privacy Policy\.$/,
+    );
+    const footnote = within(screen.getByTestId("auth-card-footnote"));
+    expect(footnote.getByRole("link", { name: "Terms of Service" })).toHaveAttribute("href", "/terms");
+    expect(footnote.getByRole("link", { name: "Privacy Policy" })).toHaveAttribute("href", "/privacy");
+  });
+
+  it("offers 'or' + Google under the open card's form, with the consent checkboxes kept (#9662; #8438 D13)", async () => {
+    mockIsSignUpOpen.mockReturnValue(true);
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+    await renderPage(SignUpPage);
+    expect(screen.getByLabelText("Email")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-divider")).toHaveTextContent(/^or$/);
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+    expect(screen.getByTestId("sign-up-agreements")).toBeInTheDocument();
+  });
 });
 
 describe("/forgot-password and /reset-password follow the reset predicate", () => {
@@ -266,9 +305,9 @@ describe("/forgot-password and /reset-password follow the reset predicate", () =
 
 // ── Every non-form page routes back to sign-in ───────────────────────────────
 
+// A closed /sign-up routes back through its toggle line instead (#9662, above).
 describe("the copy-only intents route back to sign-in", () => {
   it.each([
-    ["sign-up (closed)", SignUpPage],
     ["forgot-password (unavailable)", ForgotPasswordPage],
     ["reset-password (unavailable)", ResetPasswordPage],
     ["verify-email", VerifyEmailPage],

package/templates/apps/web/app/[locale]/(auth)/legal-footnote.tsx

@@ -0,0 +1,35 @@
+/**
+ * The acknowledgement at the foot of every auth card (#8790 D6) — "You
+ * acknowledge that you read, and agree to our Terms of Service and our Privacy
+ * Policy." (#9662) — linking the site's own policy routes through the inline
+ * link variant, so the card never hardcodes a path.
+ *
+ * One builder for `/sign-in`, `/sign-up` and the `(authed)` gate.
+ * `caption` is the muted footnote role; a default `Text` would re-impose body
+ * size and the foreground colour over the card's footnote wrapper.
+ */
+
+import { localeHref } from "@working-theory/ui";
+import { Link, Text } from "@working-theory/ui/primitives";
+import type { ReactElement } from "react";
+
+import type { SignInCardText } from "./sign-in/sign-in-text";
+
+export function legalFootnote(
+  locale: string,
+  text: SignInCardText["acknowledgement"],
+): ReactElement {
+  return (
+    <Text as="p" variant="caption">
+      {text.lead}{" "}
+      <Link variant="inline" href={localeHref(locale, "/terms")}>
+        {text.terms}
+      </Link>{" "}
+      {text.and}{" "}
+      <Link variant="inline" href={localeHref(locale, "/privacy")}>
+        {text.privacy}
+      </Link>
+      {text.end}
+    </Text>
+  );
+}

package/templates/apps/web/app/[locale]/(auth)/sign-in/__tests__/page.test.tsx

@@ -24,11 +24,16 @@
  *   (i) the hinted email (#8757 D9): a valid single `?email=` is the starting
  *       value of every email input of the card; an invalid or repeated value,
  *       or none, leaves them empty as before. It signs no one in.
+ *   (j) the one card (#9662): the site's logo and "Sign in to <site>" from
+ *       the deployment's own data — a crafted query parameter cannot change
+ *       the name — the "Don't have an account? Sign up" line linking
+ *       /sign-up, and the Terms + Privacy acknowledgement.
  *
- * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
- * the real en.json, so `signIn` copy is asserted by its real strings.
+ * `next-intl/server` is mocked here against the real en.json, with `{name}`
+ * placeholders filled from the values passed, so `signIn` copy is asserted
+ * by its real strings and the heading by the name actually interpolated.
  */
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 
 const mockGetActiveProviderIds = jest.fn();
@@ -75,7 +80,31 @@ jest.mock("@working-theory/api-client", () => ({
   __esModule: true,
   hubSignIn: { clientInfo: (...args: unknown[]) => mockClientInfo(...args) },
 }));
+// The global shim (__tests__/__mocks__/next-intl-server.ts) returns messages
+// uninterpolated; this suite fills `{name}` placeholders so the heading's
+// organization name is the one the page actually passed (#9662).
+jest.mock("next-intl/server", () => {
+  const messages = jest.requireActual("../../../../../messages/en.json") as Record<
+    string,
+    Record<string, string>
+  >;
+  return {
+    __esModule: true,
+    getTranslations: async ({ namespace }: { namespace: string }) => {
+      const catalog = messages[namespace];
+      const t = (key: string, values?: Record<string, string>): string =>
+        (catalog?.[key] ?? `${namespace}.${key}`).replace(
+          /\{(\w+)\}/g,
+          (match, name: string) => values?.[name] ?? match,
+        );
+      t.has = (key: string): boolean => catalog?.[key] !== undefined;
+      return t;
+    },
+  };
+});
+
 import { mintContinuation } from "../../../../api/auth/hub/continuation";
+import { SITE_NAME } from "../../../../../lib/site-brand";
 import en from "../../../../../messages/en.json";
 import Page, { generateMetadata } from "../page";
 
@@ -119,7 +148,9 @@ describe("/sign-in page", () => {
     expect(screen.queryByTestId("auth-submit")).toBeNull();
     expect(screen.queryByTestId("auth-footer-link")).toBeNull();
     expect(screen.queryByText(/create an account/i)).toBeNull();
-    expect(screen.getByText(en.signIn.heading)).toBeInTheDocument();
+    expect(
+      screen.getByRole("heading", { name: `Sign in to ${SITE_NAME}` }),
+    ).toBeInTheDocument();
   });
 
   it("(b) email + OAuth: password body with both social buttons, no sign-up footer", async () => {
@@ -241,7 +272,7 @@ describe("/sign-in page — the email sign-in link (#7435)", () => {
     expect(screen.getByTestId("auth-submit")).toHaveTextContent(
       en.signIn.emailLinkSubmit,
     );
-    expect(en.signIn.emailLinkSubmit).toBe("Email me a sign-in link");
+    expect(en.signIn.emailLinkSubmit).toBe("Send me a magic link");
     // One "or" divider between the primary and Google (#8790 D5).
     expect(screen.getAllByTestId("auth-divider")).toHaveLength(1);
     expect(screen.queryByTestId("auth-email-link-divider")).toBeNull();
@@ -252,9 +283,11 @@ describe("/sign-in page — the email sign-in link (#7435)", () => {
     await renderPage();
     expect(screen.getByTestId("auth-email")).toBeInTheDocument();
     expect(screen.queryByText(en.signIn.notConfiguredSubhead)).toBeNull();
-    // "Welcome back" stands alone — no subhead (#8790 D3).
-    expect(screen.getByText(en.signIn.heading)).toBeInTheDocument();
-    expect(en.signIn.heading).toBe("Welcome back");
+    // The heading stands alone — no subhead (#8790 D3); #9662 names the site.
+    expect(
+      screen.getByRole("heading", { name: `Sign in to ${SITE_NAME}` }),
+    ).toBeInTheDocument();
+    expect(en.signIn.heading).toBe("Sign in to {site}");
     expect(screen.queryByTestId("auth-method-switch")).toBeNull();
   });
 
@@ -415,3 +448,79 @@ describe("/sign-in page — the hinted email (#8757 D9)", () => {
     },
   );
 });
+
+describe("/sign-in page — the one card (#9662)", () => {
+  beforeEach(() => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "email", "magic-link"]);
+  });
+
+  it("(j) renders the site's logo and 'Sign in to <site>' from the deployment's data", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-card-logo")).toBeInTheDocument();
+    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent(
+      `Sign in to ${SITE_NAME}`,
+    );
+    expect(screen.getByLabelText(en.signIn.email)).toBe(
+      screen.getByTestId("auth-email"),
+    );
+    expect(en.signIn.email).toBe("Email");
+  });
+
+  it("(j) a crafted query parameter cannot change the organization name", async () => {
+    const crafted = "Evil Corp";
+    expect(SITE_NAME).not.toBe(crafted);
+    const el = await Page({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve({
+        next: `/account?site=${encodeURIComponent(crafted)}`,
+        site: crafted,
+        organization: crafted,
+        name: crafted,
+        siteName: crafted,
+      }),
+    });
+    render(el);
+    expect(screen.getByRole("heading", { level: 2 })).toHaveTextContent(
+      `Sign in to ${SITE_NAME}`,
+    );
+    expect(document.body.textContent).not.toContain(crafted);
+  });
+
+  it("(j) the prospect line toggles to /sign-up, with no trailing period", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-card-prospect")).toHaveTextContent(
+      /^Don't have an account\? Sign up$/,
+    );
+    expect(screen.getByTestId("auth-card-prospect-link")).toHaveAttribute(
+      "href",
+      "/sign-up",
+    );
+  });
+
+  it("(j) 'Send me a magic link' first, the in-place password switch, then 'or' and Google", async () => {
+    await renderPage("/account");
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
+      "Send me a magic link",
+    );
+    expect(screen.getByTestId("auth-method-switch")).toHaveTextContent(
+      "Sign in using password",
+    );
+    expect(screen.getByTestId("auth-divider")).toHaveTextContent(/^or$/);
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+  });
+
+  it("(j) ends on the Terms of Service + Privacy Policy acknowledgement, linking the site's own routes", async () => {
+    await renderPage("/account");
+    const footnote = screen.getByTestId("auth-card-footnote");
+    expect(footnote).toHaveTextContent(
+      /^You acknowledge that you read, and agree to our Terms of Service and our Privacy Policy\.$/,
+    );
+    expect(
+      within(footnote).getByRole("link", { name: "Terms of Service" }),
+    ).toHaveAttribute("href", "/terms");
+    expect(
+      within(footnote).getByRole("link", { name: "Privacy Policy" }),
+    ).toHaveAttribute("href", "/privacy");
+    expect(within(footnote).getAllByRole("link")).toHaveLength(2);
+  });
+});

package/templates/apps/web/app/[locale]/(auth)/sign-in/page.tsx

@@ -18,14 +18,19 @@
  *
  * Since #5963 the page lives in the `(auth)` route group — the URL is
  * unchanged (a group contributes no path segment) but the frame is
- * `AuthShell`, not the marketing Nav + Footer. The shell owns the brand mark
- * and the 400px column, so this page passes NO `logo` (it would render twice)
- * and no framing of its own.
+ * `AuthShell`, not the marketing Nav + Footer. The shell owns the 400px
+ * column; the card carries the site's mark (#8790 D3).
+ *
+ * The one card (#9662): "Sign in to <site>" (the name is the deployment's,
+ * read in `resolveSignInCardText`, never the request's), the "Don't have an
+ * account? Sign up" line to `/sign-up`, and the Terms + Privacy
+ * acknowledgement.
  *
  * Signed-in visitors are not redirected here — the Nav's session-aware action
  * cluster (Account / Sign out) is the affordance for them.
  */
 
+import { hubSignIn } from "@working-theory/api-client";
 import { localeHref } from "@working-theory/ui";
 import { accountEmailHintSchema } from "@working-theory/validation";
 import type { Metadata } from "next";
@@ -36,14 +41,13 @@ import {
   getActiveProviderIds,
   resetSendConfigured,
 } from "../../../../lib/auth-env";
-
-import { hubSignIn } from "@working-theory/api-client";
-import { Link, Text } from "@working-theory/ui/primitives";
 import { siteLogo } from "../../../../lib/site-logo";
 import {
   CONTINUE_PATH,
   openContinuation,
 } from "../../../api/auth/hub/continuation";
+import { legalFootnote } from "../legal-footnote";
+
 import { resolveNextPath } from "./next-path";
 import { SignInCard, type SignInProvider } from "./sign-in-card";
 import { resolveSignInCardText, type SignInCardText } from "./sign-in-text";
@@ -151,27 +155,7 @@ export default async function SignInPage({
   const defaultEmail = hintedEmail(rawEmail);
 
   const spoke = await spokeFromNext(next);
-  // The acknowledgement (#8790 D6) — the hub's own policy pages, through the
-  // inline link variant; the card never hardcodes a path.
-  // `caption` is the muted footnote role; a default `Text` would re-impose
-  // body size and the foreground colour over the card's footnote wrapper.
-  const footnote = (
-    <Text as="p" variant="caption">
-      {text.acknowledgement.lead}{" "}
-      <Link variant="inline" href={localeHref(locale, "/terms")}>
-        {text.acknowledgement.terms}
-      </Link>
-      ,{" "}
-      <Link variant="inline" href={localeHref(locale, "/privacy")}>
-        {text.acknowledgement.privacy}
-      </Link>
-      , and{" "}
-      <Link variant="inline" href={localeHref(locale, "/working-agreement")}>
-        {text.acknowledgement.workingAgreement}
-      </Link>
-      .
-    </Text>
-  );
+  const t = await getTranslations({ locale, namespace: "signIn" });
   return (
     <SignInCard
       logo={siteLogo()}
@@ -179,19 +163,12 @@ export default async function SignInPage({
         ? {
             backLink: {
               href: `${spoke.origin}/account`,
-              label: text.backTo(spoke.name),
-            },
-          }
-        : {})}
-      {...(text.prospect
-        ? {
-            prospect: {
-              ...text.prospect,
-              href: localeHref(locale, "/sign-up"),
+              label: t("backTo", { site: spoke.name }),
             },
           }
         : {})}
-      footnote={footnote}
+      prospect={{ ...text.prospect, href: localeHref(locale, "/sign-up") }}
+      footnote={legalFootnote(locale, text.acknowledgement)}
       providers={providers}
       method={method}
       next={next}

package/templates/apps/web/app/[locale]/(auth)/sign-in/sign-in-card.tsx

@@ -11,12 +11,12 @@
  * method from auth-env and hands them in; this component never reads env
  * itself.
  *
- * The brand mark is the SHELL's since #5963 — this island renders no `logo`,
- * or it would appear twice on the page.
+ * The site's mark arrives as `logo` (#8790 D3) and renders centred in the
+ * card; the shell draws no brand row.
  *
- * No sign-up affordance anywhere: `footer="none"` drops the "Not a member?
- * Create an account" cross-link (Better Auth `emailAndPassword.disableSignUp`
- * posture).
+ * `footer="none"` drops AuthCard's "Not a member? Create an account"
+ * cross-link; the page's `prospect` line ("Don't have an account? Sign up",
+ * #9662) is the one route to `/sign-up`.
  *
  * Password path: `apps/web/auth.ts` does not enable `emailAndPassword` today,
  * so `signIn.email` is wired but inert (Better Auth answers with an error)
@@ -242,7 +242,7 @@ export function SignInCard({
         {...(logo !== undefined ? { logo } : {})}
         {...(forgotHref !== undefined ? { forgotHref } : {})}
         {...(forgot !== undefined ? { forgot } : {})}
-        // "Welcome back" stands alone (#8790 D3): no subhead unless the card
+        // The heading stands alone (#8790 D3): no subhead unless the card
         // is inert and must say why.
         subhead={notConfigured ? notConfiguredSubhead : ""}
         {...(prospect !== undefined ? { prospect } : {})}

package/templates/apps/web/app/[locale]/(auth)/sign-in/sign-in-text.ts

@@ -4,26 +4,36 @@
  * One helper so `/sign-in` and the `(authed)` gate render the SAME labels from
  * the same `signIn` keys — the gate composes `SignInCard` when the email
  * sign-in link is on, and a second copy of this object would drift.
+ *
+ * The heading names the site — "Sign in to <site>" (#9662) — from
+ * `SITE_NAME`, the deployment's own display name (env, else `_site.mdx`),
+ * never from the request.
+ *
+ * Plain data only: the gate hands this object to a client component, and a
+ * function cannot cross that boundary (`/sign-in` resolves its "Back to
+ * <spoke>" line itself).
  */
 
 import type { AuthCardLabels } from "@working-theory/ui/blocks";
 import { getTranslations } from "next-intl/server";
 
+import { SITE_NAME } from "../../../../lib/site-brand";
+
 import type { SignInEmailLinkLabels } from "./sign-in-card";
 
 export interface SignInCardText {
   labels: AuthCardLabels;
-  /** "Back to {site}" — the spoke's name goes in (#8790 D2). */
-  backTo: (site: string) => string;
-  /** The acknowledgement sentence's parts (#8790 D6). */
+  /** The acknowledgement sentence's parts (#8790 D6; Terms + Privacy, #9662). */
   acknowledgement: {
     lead: string;
     terms: string;
+    and: string;
     privacy: string;
-    workingAgreement: string;
+    /** The sentence's closing mark — a message, so a locale can use its own. */
+    end: string;
   };
-  /** The prospect line, when the site's messages carry it (#8790 D3). */
-  prospect?: { prompt: string; linkLabel: string };
+  /** The prospect line toggling to /sign-up (#8790 D3; on by default, #9662). */
+  prospect: { prompt: string; linkLabel: string };
   notConfiguredSubhead: string;
   errorLabels: { signInFailed: string; providerFailed: string };
   emailLinkLabels: SignInEmailLinkLabels;
@@ -31,32 +41,13 @@ export interface SignInCardText {
   emailLinkExpired: string;
 }
 
-type HasKey = Parameters<Awaited<ReturnType<typeof getTranslations>>["has"]>[0];
-function optional(
-  t: Awaited<ReturnType<typeof getTranslations>>,
-  key: string,
-): boolean {
-  // A partial `getTranslations` mock (the (authed) gate suite's) carries no
-  // `has`; an absent `has` reads as an absent key, never a throw.
-  return typeof t.has === "function" && t.has(key as HasKey);
-}
-
-function prospect(
-  prompt: string,
-  linkLabel: string,
-): { prospect: { prompt: string; linkLabel: string } } | null {
-  return prompt.trim() && linkLabel.trim()
-    ? { prospect: { prompt, linkLabel } }
-    : null;
-}
-
 export async function resolveSignInCardText(
   locale: string,
 ): Promise<SignInCardText> {
   const t = await getTranslations({ locale, namespace: "signIn" });
   return {
     labels: {
-      signInHeading: t("heading"),
+      signInHeading: t("heading", { site: SITE_NAME }),
       ssoPrefix: t("ssoPrefix"),
       google: t("google"),
       github: t("github"),
@@ -70,20 +61,14 @@ export async function resolveSignInCardText(
       useEmailLink: t("useEmailLink"),
       emailPlaceholder: t("emailPlaceholder"),
     },
-    backTo: (site) => t("backTo", { site }),
     acknowledgement: {
       lead: t("acknowledgement"),
       terms: t("termsLink"),
+      and: t("acknowledgementAnd"),
       privacy: t("privacyLink"),
-      workingAgreement: t("workingAgreementLink"),
+      end: t("acknowledgementEnd"),
     },
-    // The prospect line (#8790 D3) is OFF until a site ADDS both keys to its
-    // messages — the shipped catalog carries neither (every leaf must be a
-    // non-empty string), so presence is the switch. The keys are optional
-    // extensions of the typed catalog, hence the cast on `has`.
-    ...(optional(t, "prospectPrompt") && optional(t, "prospectLink")
-      ? prospect(t("prospectPrompt" as never), t("prospectLink" as never))
-      : {}),
+    prospect: { prompt: t("prospectPrompt"), linkLabel: t("prospectLink") },
 
     notConfiguredSubhead: t("notConfiguredSubhead"),
     errorLabels: {

package/templates/apps/web/app/[locale]/(auth)/sign-up/__tests__/page.test.tsx

@@ -0,0 +1,108 @@
+/**
+ * `/sign-up`'s method and its failed-link notice (#9667 D6, AC-3).
+ *
+ * With the email sign-in link active, an open `/sign-up` renders AuthCard's
+ * one-field "Send me a magic link" body; without it, #9662's password or
+ * provider body. A failed link lands back here with `?error=<code>`, mapped
+ * to fixed copy and never echoed.
+ *
+ * `next-intl/server` is mocked globally (apps/web/__tests__/setup.ts) against
+ * the real en.json.
+ */
+import { render, screen } from "@testing-library/react";
+
+const mockGetActiveProviderIds = jest.fn();
+// eslint-disable-next-line no-restricted-syntax -- #507: auth-env.ts is a pure env-introspection module with no external boundary to mock instead.
+jest.mock("../../../../../lib/auth-env", () => ({
+  __esModule: true,
+  getActiveProviderIds: () => mockGetActiveProviderIds(),
+  isSignUpOpen: () => true,
+  isResetAvailable: () => false,
+  resetSendConfigured: () => false,
+}));
+
+jest.mock("better-auth/react", () => ({
+  __esModule: true,
+  createAuthClient: () => ({
+    signIn: { social: jest.fn(), email: jest.fn() },
+    signUp: { email: jest.fn() },
+    $fetch: jest.fn(),
+  }),
+}));
+
+import en from "../../../../../messages/en.json";
+import SignUpPage from "../page";
+
+async function renderSignUp(
+  searchParams: Record<string, string | string[]> = {},
+): Promise<void> {
+  render(
+    await SignUpPage({
+      params: Promise.resolve({ locale: "en" }),
+      searchParams: Promise.resolve(searchParams),
+    }),
+  );
+}
+
+beforeEach(() => {
+  mockGetActiveProviderIds.mockReset();
+});
+
+describe("the method (D6)", () => {
+  it('with "magic-link" active: one Email field, Send me a magic link, no password, the agreements, "or" + Google', async () => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "email", "magic-link"]);
+    await renderSignUp();
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
+      en.auth.magicLinkSubmit,
+    );
+    expect(screen.queryByTestId("auth-password")).toBeNull();
+    expect(screen.getByTestId("sign-up-agreements")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-divider")).toHaveTextContent(
+      en.auth.orContinue,
+    );
+    expect(screen.getByTestId("auth-social-google")).toBeInTheDocument();
+  });
+
+  it('with only ["google", "email"]: the password body', async () => {
+    mockGetActiveProviderIds.mockReturnValue(["google", "email"]);
+    await renderSignUp();
+    expect(screen.getByTestId("auth-password")).toBeInTheDocument();
+    expect(screen.getByTestId("auth-submit")).toHaveTextContent(
+      en.auth.signUpSubmit,
+    );
+  });
+});
+
+describe("the failed-link notice (D6)", () => {
+  beforeEach(() => {
+    mockGetActiveProviderIds.mockReturnValue(["magic-link"]);
+  });
+
+  it.each([
+    ["INVALID_TOKEN", en.auth.signUpLinkExpired],
+    ["new_user_signup_disabled", en.auth.signUpLinkExpired],
+    ["AGREEMENTS_REQUIRED", en.auth.signUpAgreementsRequired],
+    ["AGREEMENTS_UNAVAILABLE", en.auth.signUpFailed],
+  ])("?error=%s renders its copy", async (error, copy) => {
+    await renderSignUp({ error });
+    expect(screen.getByTestId("sign-up-link-notice")).toHaveTextContent(copy);
+  });
+
+  it("a repeated error reads its first value, and the raw value is never echoed", async () => {
+    await renderSignUp({ error: ["INVALID_TOKEN", "<b>x</b>"] });
+    const notice = screen.getByTestId("sign-up-link-notice");
+    expect(notice).toHaveTextContent(en.auth.signUpLinkExpired);
+    expect(notice).not.toHaveTextContent("INVALID_TOKEN");
+  });
+
+  it("no error, no notice", async () => {
+    await renderSignUp();
+    expect(screen.queryByTestId("sign-up-link-notice")).toBeNull();
+  });
+
+  it("the password method shows no link notice", async () => {
+    mockGetActiveProviderIds.mockReturnValue(["email"]);
+    await renderSignUp({ error: "INVALID_TOKEN" });
+    expect(screen.queryByTestId("sign-up-link-notice")).toBeNull();
+  });
+});