<div class="auth-card">
    <div class="brand-kicker">Password Recovery</div>
    <h1>Create New Password</h1>
    <?php if (!$valid): ?>
        <div class="alert error">This reset link is invalid or expired.</div>
        <p><a href="index.php?route=auth/forgotPassword">Request a new reset link</a></p>
    <?php else: ?>
        <form method="post" action="index.php?route=auth/updatePassword">
            <?= csrf_input() ?>
            <input type="hidden" name="token" value="<?= e($token) ?>">
            <label>New Password</label>
            <input type="password" name="password" required>
            <label>Confirm Password</label>
            <input type="password" name="password_confirm" required>
            <button class="btn primary">Update Password</button>
        </form>
    <?php endif; ?>
</div>
