Sign in

ada@example.com / lovelace — a demo with a secret password is a demo nobody can try.

That doesn't look like an email address.
Please check this value.

The button is disabled until both fields are valid and while the request is in flight. That is three states off one value and two .valid reads — no listeners, and nothing keeping them in step.

Where the line is

Markout
In-flight state, field validity, the submit button's three states, the server's error message, and which of the two branches is in the page.
api.ts
The credential check, the session and its lifetime, the httpOnly cookie, the rate limit, and the decision that a wrong password and an unknown address get the same answer.
Neither
Password hashing, a user store, a second factor, a CSRF token. Real answers to questions this demo does not have — value-to-markup.md says what markout does and does not guarantee, and this is the part it says is not its.

View source signed in and ${'$'}{me.email}'s result is already in the HTML. Sign out and view it again: the dashboard's markup is gone rather than hidden, because :server-if decided it on the server.