create-nevela 0.3.0 → 0.4.1

package/template/web/components/auth/otp-input.tsx

@@ -0,0 +1,95 @@
+"use client";
+
+import { useId, useRef, useState } from "react";
+import { cn } from "@/lib/utils";
+
+interface Props {
+  value: string;
+  onChange: (value: string) => void;
+  /** Called once the last character is typed or pasted, so nobody taps "Continue". */
+  onComplete?: (value: string) => void;
+  length?: number;
+  label?: string;
+  autoFocus?: boolean;
+  disabled?: boolean;
+  /** Backup codes are letters and digits; emailed codes are digits. */
+  mode?: "numeric" | "alphanumeric";
+  id?: string;
+}
+
+/**
+ * A code box that is really one input with the cells drawn behind it.
+ *
+ * The obvious build — one input per digit — breaks paste, iOS and Android code
+ * autofill, backspace across cells and screen readers, all of which a single input
+ * gets for free from `autocomplete="one-time-code"`.
+ */
+export function OtpInput({ value, onChange, onComplete, length = 6, label = "Verification code", autoFocus, disabled, mode = "numeric", id }: Props) {
+  const generatedId = useId();
+  const fieldId = id ?? generatedId;
+  const input = useRef<HTMLInputElement>(null);
+  const [focused, setFocused] = useState(false);
+
+  const clean = (raw: string) => (mode === "numeric" ? raw.replace(/\D/g, "") : raw.replace(/[^a-zA-Z0-9]/g, "").toUpperCase()).slice(0, length);
+
+  const handle = (raw: string) => {
+    const next = clean(raw);
+    onChange(next);
+    if (next.length === length) onComplete?.(next);
+  };
+
+  const characters = [...value];
+  // The cursor sits on the first empty cell, or the last one when it's full.
+  const cursor = Math.min(value.length, length - 1);
+
+  return (
+    <div className="flex flex-col gap-2">
+      <label htmlFor={fieldId} className="sr-only">
+        {label}
+      </label>
+      <div className="relative" onClick={() => input.current?.focus()}>
+        <input
+          ref={input}
+          id={fieldId}
+          value={value}
+          onChange={(event) => handle(event.target.value)}
+          onFocus={() => setFocused(true)}
+          onBlur={() => setFocused(false)}
+          onPaste={(event) => {
+            event.preventDefault();
+            handle(event.clipboardData.getData("text"));
+          }}
+          inputMode={mode === "numeric" ? "numeric" : "text"}
+          autoComplete="one-time-code"
+          autoCorrect="off"
+          spellCheck={false}
+          maxLength={length}
+          disabled={disabled}
+          autoFocus={autoFocus}
+          aria-label={label}
+          // Invisible but really there, so autofill, paste and the caret all work.
+          // The right padding keeps a password manager's icon off the last cell.
+          className="absolute inset-0 h-full w-full cursor-text pr-10 text-transparent caret-transparent opacity-0 outline-none"
+        />
+        <div className="flex gap-2" aria-hidden="true">
+          {Array.from({ length }, (_, index) => {
+            const active = focused && index === cursor;
+            return (
+              <div
+                key={index}
+                className={cn(
+                  "relative grid h-13 flex-1 place-items-center rounded-[calc(var(--radius)-2px)] border border-border bg-surface text-lg font-medium tabular-nums transition-[border-color,box-shadow]",
+                  active && "border-brand ring-[3px] ring-brand/20",
+                  disabled && "opacity-60",
+                )}
+              >
+                {characters[index] ?? ""}
+                {active && !characters[index] && <span className="absolute h-5 w-px animate-pulse bg-foreground" />}
+              </div>
+            );
+          })}
+        </div>
+      </div>
+    </div>
+  );
+}

package/template/web/components/auth/password-field.tsx

@@ -0,0 +1,116 @@
+"use client";
+
+import { useId, useMemo, useState } from "react";
+import { CheckIcon, EyeIcon, EyeOffIcon } from "lucide-react";
+import { checkPassword, PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH } from "@/lib/password-rules";
+import { cn } from "@/lib/utils";
+import { AuthInput, AuthLabel } from "./ui";
+
+interface Props {
+  value: string;
+  onChange: (value: string) => void;
+  label?: string;
+  id?: string;
+  name?: string;
+  autoComplete?: "new-password" | "current-password";
+  autoFocus?: boolean;
+  required?: boolean;
+  placeholder?: string;
+  /** Show the rules and strength as they type. Off for "your current password". */
+  showRules?: boolean;
+  /** Their name and email: a password shouldn't contain either. */
+  avoid?: (string | null | undefined)[];
+}
+
+const BAR_COLOURS = ["bg-danger", "bg-danger", "bg-warning", "bg-success/70", "bg-success"];
+
+/**
+ * A password input that says what it wants before you get it wrong: the rules and a
+ * strength reading update as you type, and the eye shows what you've typed.
+ *
+ * Only the length is enforced; everything else reads as advice (see lib/password-rules.ts).
+ */
+export function PasswordField({
+  value,
+  onChange,
+  label = "Password",
+  id,
+  name = "password",
+  autoComplete = "new-password",
+  autoFocus,
+  required = true,
+  placeholder,
+  showRules = autoComplete === "new-password",
+  avoid = [],
+}: Props) {
+  const generatedId = useId();
+  const fieldId = id ?? generatedId;
+  const hintId = `${fieldId}-hint`;
+  const [visible, setVisible] = useState(false);
+  const check = useMemo(() => checkPassword(value, avoid), [value, avoid.join("\u0000")]);
+  const started = value.length > 0;
+
+  return (
+    <div className="flex flex-col gap-2">
+      <AuthLabel htmlFor={fieldId}>{label}</AuthLabel>
+      <div className="relative">
+        <AuthInput
+          id={fieldId}
+          name={name}
+          type={visible ? "text" : "password"}
+          autoComplete={autoComplete}
+          autoFocus={autoFocus}
+          required={required}
+          placeholder={placeholder}
+          value={value}
+          onChange={(event) => onChange(event.target.value)}
+          minLength={autoComplete === "new-password" ? PASSWORD_MIN_LENGTH : undefined}
+          maxLength={PASSWORD_MAX_LENGTH}
+          aria-describedby={showRules ? hintId : undefined}
+          // A styling hook, so the field can go green without any state plumbing.
+          data-has-passed-validation={showRules && check.valid ? "" : undefined}
+          className={cn("pr-11", showRules && check.valid && "border-success/60")}
+        />
+        <button
+          type="button"
+          onClick={() => setVisible(!visible)}
+          aria-pressed={visible}
+          aria-controls={fieldId}
+          aria-label={visible ? "Hide password" : "Show password"}
+          title={visible ? "Hide password" : "Show password"}
+          className="absolute inset-y-0 right-0 grid w-11 place-items-center text-foreground-muted hover:text-foreground focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-brand"
+        >
+          {visible ? <EyeOffIcon className="size-4.5" /> : <EyeIcon className="size-4.5" />}
+        </button>
+      </div>
+
+      {showRules && (
+        <div id={hintId} className="flex flex-col gap-2">
+          <div className="flex items-center gap-2">
+            <div className="flex h-1 flex-1 gap-1" aria-hidden="true">
+              {[0, 1, 2, 3].map((step) => (
+                <span key={step} className={cn("h-full flex-1 rounded-full transition-colors", started && check.score > step ? BAR_COLOURS[check.score] : "bg-border")} />
+              ))}
+            </div>
+            <span className={cn("text-xs tabular-nums", started ? "text-foreground-muted" : "text-transparent")}>{check.label}</span>
+          </div>
+
+          {/* Announced politely: it changes on every keystroke, so it mustn't interrupt. */}
+          <ul className="flex flex-col gap-1" aria-live="polite">
+            {check.rules.map((rule) => (
+              <li key={rule.id} className={cn("flex items-center gap-2 text-xs", rule.met ? "text-success" : "text-foreground-muted")}>
+                <span className={cn("grid size-3.5 shrink-0 place-items-center rounded-full border", rule.met ? "border-success bg-success/15" : "border-border")}>
+                  {rule.met && <CheckIcon className="size-2.5" />}
+                </span>
+                {rule.label}
+                {rule.required && !rule.met && <span className="text-foreground-muted">(required)</span>}
+              </li>
+            ))}
+          </ul>
+
+          {started && check.advice && <p className="text-xs text-foreground-muted">{check.advice}</p>}
+        </div>
+      )}
+    </div>
+  );
+}

package/template/web/components/auth/password-forms.tsx

@@ -0,0 +1,76 @@
+"use client";
+
+import { useState } from "react";
+import { authClient } from "@/lib/auth-client";
+import { checkPassword } from "@/lib/password-rules";
+import { PasswordField } from "./password-field";
+import { authErrorMessage } from "./sign-in-flow";
+import { AuthInput, AuthLabel, FormMessage, PrimaryButton } from "./ui";
+
+/** Asks for a reset link. Says the same thing whether or not the address has an account. */
+export function ForgotPasswordForm({ initialEmail }: { initialEmail: string }) {
+  const [email, setEmail] = useState(initialEmail);
+  const [pending, setPending] = useState(false);
+  const [sent, setSent] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const submit = async (event: React.FormEvent) => {
+    event.preventDefault();
+    setPending(true);
+    setError(null);
+    const { error } = await authClient.requestPasswordReset({ email, redirectTo: "/reset-password" });
+    setPending(false);
+    if (error) return setError(authErrorMessage(error));
+    setSent(true);
+  };
+
+  if (sent) {
+    return <FormMessage tone="success">If {email} has an account, a reset link is on its way. It expires in 1 hour.</FormMessage>;
+  }
+  return (
+    <form className="flex flex-col gap-4" onSubmit={submit}>
+      <div className="flex flex-col gap-2">
+        <AuthLabel htmlFor="email">Email</AuthLabel>
+        <AuthInput id="email" type="email" autoComplete="email" value={email} onChange={(event) => setEmail(event.target.value)} required autoFocus />
+      </div>
+      <FormMessage>{error}</FormMessage>
+      <PrimaryButton type="submit" pending={pending}>
+        Send reset link
+      </PrimaryButton>
+    </form>
+  );
+}
+
+/** Sets the new password from the emailed link's token. */
+export function ResetPasswordForm({ token }: { token: string }) {
+  const [password, setPassword] = useState("");
+  const [confirm, setConfirm] = useState("");
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const submit = async (event: React.FormEvent) => {
+    event.preventDefault();
+    const check = checkPassword(password);
+    if (!check.valid) return setError(check.advice ?? "That password is too short.");
+    if (password !== confirm) return setError("The two passwords don't match.");
+    setPending(true);
+    setError(null);
+    const { error } = await authClient.resetPassword({ newPassword: password, token });
+    setPending(false);
+    if (error) {
+      return setError(error.code === "INVALID_TOKEN" ? "This link has expired or was already used. Ask for a new one." : authErrorMessage(error));
+    }
+    window.location.href = "/sign-in?reset=1";
+  };
+
+  return (
+    <form className="flex flex-col gap-4" onSubmit={submit}>
+      <PasswordField id="password" label="New password" value={password} onChange={setPassword} autoFocus />
+      <PasswordField id="confirm" label="Confirm it" name="confirm" value={confirm} onChange={setConfirm} showRules={false} />
+      <FormMessage>{error}</FormMessage>
+      <PrimaryButton type="submit" pending={pending}>
+        Set new password
+      </PrimaryButton>
+    </form>
+  );
+}

package/template/web/components/auth/provider-icons.tsx

@@ -0,0 +1,39 @@
+import type { SocialProvider } from "@/lib/auth-config";
+
+/** Provider marks for the social sign-in buttons (brand colours, as each provider's guidelines ask). */
+export function ProviderIcon({ provider, className = "size-5" }: { provider: SocialProvider; className?: string }) {
+  switch (provider) {
+    case "google":
+      return (
+        <svg viewBox="0 0 24 24" className={className} aria-hidden="true">
+          <path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.27-4.74 3.27-8.1Z" />
+          <path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84A11 11 0 0 0 12 23Z" />
+          <path fill="#FBBC05" d="M5.84 14.1A6.6 6.6 0 0 1 5.5 12c0-.73.13-1.44.34-2.1V7.06H2.18A11 11 0 0 0 1 12c0 1.78.43 3.45 1.18 4.94l3.66-2.84Z" />
+          <path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15A10.97 10.97 0 0 0 12 1 11 11 0 0 0 2.18 7.06l3.66 2.84C6.71 7.3 9.14 5.38 12 5.38Z" />
+        </svg>
+      );
+    case "github":
+      return (
+        <svg viewBox="0 0 24 24" className={className} aria-hidden="true">
+          <path fill="currentColor" d="M12 .5a11.5 11.5 0 0 0-3.64 22.41c.58.1.79-.25.79-.56v-2.17c-3.2.7-3.88-1.36-3.88-1.36-.52-1.33-1.28-1.69-1.28-1.69-1.05-.72.08-.7.08-.7 1.16.08 1.77 1.19 1.77 1.19 1.03 1.77 2.7 1.26 3.36.96.1-.75.4-1.26.73-1.55-2.55-.29-5.24-1.28-5.24-5.69 0-1.26.45-2.29 1.19-3.09-.12-.29-.52-1.46.11-3.05 0 0 .97-.31 3.17 1.18a11 11 0 0 1 5.77 0c2.2-1.49 3.17-1.18 3.17-1.18.63 1.59.23 2.76.11 3.05.74.8 1.19 1.83 1.19 3.09 0 4.42-2.7 5.39-5.26 5.68.41.36.78 1.06.78 2.14v3.17c0 .31.21.67.8.56A11.5 11.5 0 0 0 12 .5Z" />
+        </svg>
+      );
+    case "apple":
+      return (
+        <svg viewBox="0 0 24 24" className={className} aria-hidden="true">
+          <path fill="currentColor" d="M16.37 12.64c-.03-2.6 2.13-3.86 2.23-3.92-1.22-1.78-3.11-2.02-3.78-2.05-1.6-.17-3.13.95-3.95.95-.82 0-2.07-.93-3.4-.9a5.03 5.03 0 0 0-4.25 2.58c-1.83 3.17-.47 7.84 1.3 10.4.87 1.25 1.9 2.66 3.25 2.61 1.3-.05 1.8-.84 3.38-.84 1.57 0 2.02.84 3.4.81 1.4-.02 2.29-1.27 3.15-2.53a11 11 0 0 0 1.42-2.93 4.55 4.55 0 0 1-2.75-4.18ZM13.8 5.02c.72-.88 1.2-2.09 1.07-3.3-1.04.04-2.3.69-3.04 1.56-.66.77-1.25 2.01-1.09 3.19 1.15.09 2.33-.59 3.06-1.45Z" />
+        </svg>
+      );
+    case "microsoft":
+      return (
+        <svg viewBox="0 0 24 24" className={className} aria-hidden="true">
+          <path fill="#F25022" d="M2 2h9.5v9.5H2z" />
+          <path fill="#7FBA00" d="M12.5 2H22v9.5h-9.5z" />
+          <path fill="#00A4EF" d="M2 12.5h9.5V22H2z" />
+          <path fill="#FFB900" d="M12.5 12.5H22V22h-9.5z" />
+        </svg>
+      );
+  }
+}
+
+export const PROVIDER_LABELS: Record<SocialProvider, string> = { google: "Google", github: "GitHub", apple: "Apple", microsoft: "Microsoft" };

package/template/web/components/auth/sign-in-flow.tsx

@@ -0,0 +1,307 @@
+"use client";
+
+import { useEffect, useRef, useState } from "react";
+import Link from "next/link";
+import { FingerprintIcon, MailIcon, KeyRoundIcon } from "lucide-react";
+import { authClient } from "@/lib/auth-client";
+import type { SocialProvider } from "@/lib/auth-config";
+import { AuthInput, AuthLabel, Divider, FormMessage, PrimaryButton, SecondaryButton, TextButton } from "./ui";
+import { OtpInput } from "./otp-input";
+import { SocialButtons } from "./social-buttons";
+import { useResend } from "./use-resend";
+
+export interface SignInMethods {
+  magicLink: boolean;
+  emailOtp: boolean;
+  passkeys: boolean;
+}
+
+interface Props {
+  providers: SocialProvider[];
+  socialPlacement: "before" | "after";
+  socialStyle: "full" | "icon";
+  methods: SignInMethods;
+  next: string;
+  initialError?: string | null;
+  initialNotice?: string | null;
+}
+
+type Step = "email" | "password" | "link-sent" | "code";
+
+/** Messages for Better Auth's error codes, written for the person signing in. */
+export function authErrorMessage(error: { code?: string; message?: string } | null | undefined, fallback = "Something went wrong. Try again."): string {
+  switch (error?.code) {
+    case "INVALID_EMAIL_OR_PASSWORD":
+      return "That email and password don't match.";
+    case "EMAIL_NOT_VERIFIED":
+      return "Verify your email first: we've sent you a new link.";
+    case "INVALID_OTP":
+    case "INVALID_CODE":
+    case "INVALID_TWO_FACTOR_CODE":
+      return "That code isn't right. Check it and try again.";
+    case "OTP_EXPIRED":
+      return "That code has expired. Ask for a new one.";
+    case "TOO_MANY_ATTEMPTS":
+      return "Too many attempts. Ask for a new code.";
+    case "USER_ALREADY_EXISTS":
+    case "USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL":
+      return "An account with this email already exists. Sign in instead.";
+    case "PASSWORD_TOO_SHORT":
+      return "Use at least 8 characters.";
+    default:
+      return error?.message || fallback;
+  }
+}
+
+const go = (next: string) => {
+  window.location.href = next;
+};
+
+/**
+ * Sign-in in two steps: the email first (with social and passkey sign-in beside it),
+ * then the password or an emailed link or code. A password sign-in that needs a
+ * second factor continues on /two-factor (see lib/auth-client.ts).
+ */
+export function SignInFlow({ providers, socialPlacement, socialStyle, methods, next, initialError, initialNotice }: Props) {
+  const [step, setStep] = useState<Step>("email");
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [code, setCode] = useState("");
+  const [pending, setPending] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(initialError ?? null);
+  const [notice, setNotice] = useState<string | null>(initialNotice ?? null);
+  const passwordRef = useRef<HTMLInputElement>(null);
+
+  // Offer saved passkeys in the email field's autofill (conditional UI), where supported.
+  useEffect(() => {
+    if (!methods.passkeys || typeof PublicKeyCredential === "undefined") return;
+    let cancelled = false;
+    PublicKeyCredential.isConditionalMediationAvailable?.().then((available) => {
+      if (!available || cancelled) return;
+      void authClient.signIn.passkey({ autoFill: true }).then(({ error }) => {
+        if (!error) go(next);
+      });
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [methods.passkeys, next]);
+
+  useEffect(() => {
+    if (step === "password") passwordRef.current?.focus();
+  }, [step]);
+
+  const run = async (label: string, work: () => Promise<void>) => {
+    setPending(label);
+    setError(null);
+    setNotice(null);
+    try {
+      await work();
+    } finally {
+      setPending(null);
+    }
+  };
+
+  const signInWithPassword = () =>
+    run("password", async () => {
+      const { data, error } = await authClient.signIn.email({ email, password });
+      if (error) return setError(authErrorMessage(error));
+      // With two-factor on, the client plugin has already sent us to /two-factor.
+      if (data && "twoFactorRedirect" in data && data.twoFactorRedirect) return;
+      go(next);
+    });
+
+  const sendLink = () =>
+    run("link", async () => {
+      const { error } = await authClient.signIn.magicLink({ email, callbackURL: next, errorCallbackURL: "/sign-in?error=link" });
+      if (error) return setError(authErrorMessage(error));
+      setStep("link-sent");
+    });
+
+  const sendCode = () =>
+    run("code", async () => {
+      const { error } = await authClient.emailOtp.sendVerificationOtp({ email, type: "sign-in" });
+      if (error) return setError(authErrorMessage(error));
+      setCode("");
+      setStep("code");
+    });
+
+  // Resending leaves the code already in their inbox working; it just sends another.
+  const codeResend = useResend(sendCode);
+
+  // `value` is the code as just completed: the field reports it before `code` has caught up.
+  const signInWithCode = (value: string = code) =>
+    run("verify", async () => {
+      const { error } = await authClient.signIn.emailOtp({ email, otp: value.trim() });
+      if (error) return setError(authErrorMessage(error));
+      go(next);
+    });
+
+  const signInWithPasskey = () =>
+    run("passkey", async () => {
+      const { error } = await authClient.signIn.passkey();
+      if (error) return setError(authErrorMessage(error, "That passkey didn't work. Try again or use your email."));
+      go(next);
+    });
+
+  const social = (
+    <SocialButtons providers={providers} variant={socialStyle} next={next} onError={setError} />
+  );
+  const hasSocial = providers.length > 0;
+  const changeEmail = (
+    <div className="flex items-center justify-between rounded-[calc(var(--radius)-2px)] bg-surface-muted px-3.5 py-2.5 text-sm">
+      <span className="truncate text-foreground">{email}</span>
+      <TextButton onClick={() => setStep("email")}>Change</TextButton>
+    </div>
+  );
+
+  if (step === "link-sent") {
+    return (
+      <div className="flex flex-col gap-5 text-center">
+        <span className="mx-auto grid size-12 place-items-center rounded-full bg-brand/15 text-link">
+          <MailIcon className="size-6" />
+        </span>
+        <div className="flex flex-col gap-1.5">
+          <p className="text-base font-medium text-foreground">Check your email</p>
+          <p className="text-sm text-foreground-muted">
+            We sent a sign-in link to <span className="font-medium text-foreground">{email}</span>. It works once and expires in 5 minutes.
+          </p>
+        </div>
+        <FormMessage>{error}</FormMessage>
+        <div className="flex justify-center gap-4">
+          <TextButton onClick={sendLink} disabled={pending !== null}>Send it again</TextButton>
+          <TextButton onClick={() => setStep("email")}>Use another email</TextButton>
+        </div>
+      </div>
+    );
+  }
+
+  if (step === "code") {
+    return (
+      <form
+        className="flex flex-col gap-4"
+        onSubmit={(event) => {
+          event.preventDefault();
+          void signInWithCode();
+        }}
+      >
+        <p className="text-sm text-foreground-muted">
+          Enter the 6-digit code we sent to <span className="font-medium text-foreground">{email}</span>.
+        </p>
+        <OtpInput value={code} onChange={setCode} onComplete={(value) => void signInWithCode(value)} label="Sign-in code" autoFocus disabled={pending === "verify"} />
+        <FormMessage>{error}</FormMessage>
+        <PrimaryButton type="submit" pending={pending === "verify"} disabled={code.length !== 6}>
+          Sign in
+        </PrimaryButton>
+        <div className="flex justify-center gap-4">
+          <TextButton onClick={() => void codeResend.resend()} disabled={codeResend.disabled || pending !== null}>
+            {codeResend.label}
+          </TextButton>
+          <TextButton onClick={() => setStep("email")}>Use another email</TextButton>
+        </div>
+      </form>
+    );
+  }
+
+  if (step === "password") {
+    return (
+      <form
+        className="flex flex-col gap-4"
+        onSubmit={(event) => {
+          event.preventDefault();
+          void signInWithPassword();
+        }}
+      >
+        {changeEmail}
+        {/* Keeps the email with the password for password managers. */}
+        <input type="email" name="email" value={email} autoComplete="username" readOnly hidden />
+        <div className="flex flex-col gap-2">
+          <div className="flex items-baseline justify-between">
+            <AuthLabel htmlFor="password">Password</AuthLabel>
+            <Link href={`/forgot-password?email=${encodeURIComponent(email)}`} className="text-sm text-link hover:underline">
+              Forgot password?
+            </Link>
+          </div>
+          <AuthInput
+            ref={passwordRef}
+            id="password"
+            name="password"
+            type="password"
+            autoComplete="current-password"
+            value={password}
+            onChange={(event) => setPassword(event.target.value)}
+            required
+            aria-invalid={Boolean(error) || undefined}
+          />
+        </div>
+        <FormMessage>{error}</FormMessage>
+        <PrimaryButton type="submit" pending={pending === "password"}>
+          Sign in
+        </PrimaryButton>
+        {(methods.magicLink || methods.emailOtp) && (
+          <>
+            <Divider />
+            {methods.magicLink && (
+              <SecondaryButton onClick={sendLink} disabled={pending !== null}>
+                <MailIcon className="size-4" /> Email me a sign-in link
+              </SecondaryButton>
+            )}
+            {methods.emailOtp && (
+              <SecondaryButton onClick={sendCode} disabled={pending !== null}>
+                <KeyRoundIcon className="size-4" /> Email me a code
+              </SecondaryButton>
+            )}
+          </>
+        )}
+      </form>
+    );
+  }
+
+  return (
+    <div className="flex flex-col gap-4">
+      {hasSocial && socialPlacement === "before" && (
+        <>
+          {social}
+          <Divider />
+        </>
+      )}
+      <form
+        className="flex flex-col gap-4"
+        onSubmit={(event) => {
+          event.preventDefault();
+          setError(null);
+          setStep("password");
+        }}
+      >
+        <div className="flex flex-col gap-2">
+          <AuthLabel htmlFor="email">Email</AuthLabel>
+          <AuthInput
+            id="email"
+            name="email"
+            type="email"
+            autoComplete="username webauthn"
+            placeholder="you@example.com"
+            value={email}
+            onChange={(event) => setEmail(event.target.value)}
+            required
+            autoFocus
+          />
+        </div>
+        <FormMessage tone="success">{notice}</FormMessage>
+        <FormMessage>{error}</FormMessage>
+        <PrimaryButton type="submit">Continue</PrimaryButton>
+      </form>
+      {methods.passkeys && (
+        <SecondaryButton onClick={signInWithPasskey} disabled={pending !== null}>
+          <FingerprintIcon className="size-4" /> Sign in with a passkey
+        </SecondaryButton>
+      )}
+      {hasSocial && socialPlacement === "after" && (
+        <>
+          <Divider />
+          {social}
+        </>
+      )}
+    </div>
+  );
+}