Every state a consumer must render — these are contract, not decoration

Auth states

Email-availability, password-strength, Turnstile, submit-in-flight, and the field/form errors. If it isn't a frame here, the implementation isn't required to handle it.

Email availability · idle

Work email

We'll check availability as you type.

Email availability · checking (debounced)

Work email Checking…

Email availability · available

Work email Available

Email availability · already registered

Work email Already registered

That email has an account. Sign in instead?

Email availability · check unavailable

Work email Couldn't check right now

We'll confirm when you submit — this never blocks you from trying.

Password strength · weak

Password strengthWeak

12+ characters
Lowercase
Uppercase
Number
Symbol

Password strength · strong

Password strengthStrong

Confirm password · mismatch

Confirm password

Passwords don't match yet.

Turnstile · loading

Loading challenge… Cloudflare Turnstile

Turnstile · verified

Verified — you're human Cloudflare Turnstile

Turnstile · failed / please retry

Verification failed Cloudflare Turnstile

Please complete the challenge to continue.

Submit · in flight

Button is disabled and shows a spinner until the request resolves.

Form error · invalid credentials

We couldn't sign you in. Check your email and password and try again.

Signup · 409 already exists

That account already exists. Sign in or reset your password.

Service · provider unavailable

Sign-in is temporarily unavailable. Please try again in a moment.

One more step. This account uses two-factor authentication — continues into the MFA challenge flow (separate feature).

Gate · verify to continue