/* CGN-1587 (epic CGN-1584) — one auth-screen design standard.
 *
 * SINGLE SOURCE OF TRUTH for the two standalone auth screens, /login and
 * /re-auth: page backdrop and centring, panel shell, brand row, title /
 * instruction type scale, fields, primary button, inline error and progress.
 * Both documents link this file first, so a change here changes both screens
 * together. Page-specific rules stay in login.css / re-auth.css and may only
 * add content (divider, success banner, logout, maintenance banner) on top.
 *
 * The screens differ in content and in background mode only:
 *   body.auth-surface             — normal page, light backdrop (/login)
 *   body.auth-surface.is-iframe   — transparent inside the idle-lock overlay
 *                                   iframe (/re-auth?iframe=true)
 *
 * See docs/10_ui_standards.md §9 and docs/25_card_authentication.md §15.1 / §16.1.
 */

:root {
    /* Surfaces and text */
    --auth-bg: #eef1f4;
    --auth-panel-bg: #ffffff;
    --auth-panel-border: #dee2e6;
    --auth-text: #212529;
    --auth-text-strong: #343a40;
    --auth-muted: #6c757d;
    --auth-subtle: #adb5bd;

    /* Fields */
    --auth-field-border: #ced4da;
    --auth-field-disabled-bg: #e9ecef;

    /* Primary (green — CLAUDE.md: primary actions are never blue) */
    --auth-accent: #28a745;
    --auth-accent-hover: #218838;
    --auth-accent-border: #1e7e34;
    --auth-accent-soft: rgba(40, 167, 69, 0.12);

    /* Inline feedback */
    --auth-danger-bg: #f8d7da;
    --auth-danger-border: #f1aeb5;
    --auth-danger-text: #842029;
    --auth-success-bg: #d1e7dd;
    --auth-success-border: #a3cfbb;
    --auth-success-text: #0f5132;

    /* Geometry */
    --auth-radius-panel: 14px;
    --auth-radius-control: 8px;
    --auth-radius-section: 10px;
    --auth-font: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
}

*,
*::before,
*::after {
    box-sizing: border-box;
}

[hidden] {
    display: none !important;
}

html,
body {
    min-height: 100%;
}

/* ─── Page surface and centring ─────────────────────────────────────────── */

.auth-surface {
    margin: 0;
    font-family: var(--auth-font);
    color: var(--auth-text);
    background: var(--auth-bg);
}

/* Inside the idle-lock overlay the shell's scrim provides the backdrop. */
.auth-surface.is-iframe {
    background: transparent;
}

.auth-shell {
    display: flex;
    align-items: center;
    justify-content: center;
    min-height: 100vh;
    padding: 16px;
}

/* ─── Panel shell ───────────────────────────────────────────────────────── */

.auth-panel {
    width: 100%;
    max-width: 420px;
    padding: 28px 26px 24px;
    background: var(--auth-panel-bg);
    border: 1px solid var(--auth-panel-border);
    border-radius: var(--auth-radius-panel);
    box-shadow: 0 18px 48px rgba(20, 24, 28, 0.18);
}

/* ─── Brand ─────────────────────────────────────────────────────────────── */

.auth-brand {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    margin: 0 0 18px;
}

.auth-brand-mark {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 32px;
    height: 32px;
    border-radius: 9px;
    background: var(--auth-accent-soft);
    color: var(--auth-accent);
}

.auth-brand-name {
    font-size: 0.82rem;
    font-weight: 700;
    letter-spacing: 0.08em;
    text-transform: uppercase;
    color: var(--auth-muted);
}

/* ─── Type scale ────────────────────────────────────────────────────────── */

.auth-title {
    margin: 0 0 8px;
    font-size: 1.2rem;
    line-height: 1.35;
    font-weight: 600;
    text-align: center;
    text-wrap: balance;
    color: var(--auth-text);
}

.auth-user {
    margin: 0 0 18px;
    text-align: center;
    color: #495057;
    font-size: 0.95rem;
}

.auth-user strong {
    color: var(--auth-text);
}

.auth-hint {
    margin: 0 0 18px;
    text-align: center;
    color: var(--auth-muted);
    font-size: 0.82rem;
    line-height: 1.45;
}

.auth-footer {
    margin: 18px 0 0;
    text-align: center;
    font-size: 0.75rem;
    color: var(--auth-subtle);
}

/* A boxed block inside the panel — the card form on both screens. */
.auth-card-panel {
    padding: 14px 14px 16px;
    margin: 0;
    background: #f8f9fa;
    border: 1px solid var(--auth-panel-border);
    border-radius: var(--auth-radius-section);
    cursor: text; /* the whole block is a way back to the scan field */
}

/* ─── Fields ────────────────────────────────────────────────────────────── */

.auth-label {
    display: block;
    margin: 0 0 6px;
    font-size: 0.85rem;
    font-weight: 600;
    color: var(--auth-text-strong);
}

.auth-input {
    display: block;
    width: 100%;
    margin: 0 0 12px;
    padding: 12px 14px;
    border: 1px solid var(--auth-field-border);
    border-radius: var(--auth-radius-control);
    background: #ffffff;
    color: var(--auth-text);
    font-family: inherit;
    font-size: 1rem;
    line-height: 1.4;
    outline: none;
    transition: border-color 0.15s ease, box-shadow 0.15s ease;
}

.auth-input:focus {
    border-color: var(--auth-accent);
    box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.2);
}

.auth-input:disabled,
.auth-input[readonly] {
    background: var(--auth-field-disabled-bg);
    color: var(--auth-muted);
    cursor: wait;
}

/* Scanned card code: longer and numeric, so it gets tracking and breathing room. */
.auth-input--code {
    font-size: 1.35rem;
    letter-spacing: 0.18em;
    text-align: center;
    font-variant-numeric: tabular-nums;
}

/* The wide tracking would stretch the hint text — keep placeholders readable. */
.auth-input--code::placeholder {
    font-size: 0.95rem;
    letter-spacing: normal;
    color: var(--auth-subtle);
}

/* ─── Primary button ────────────────────────────────────────────────────── */

.auth-btn {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 100%;
    padding: 10px 16px;
    border: 1px solid transparent;
    border-radius: var(--auth-radius-control);
    font-family: inherit;
    font-size: 0.95rem;
    font-weight: 600;
    line-height: 1.4;
    cursor: pointer;
    transition: background-color 0.15s ease, border-color 0.15s ease;
}

.auth-btn--primary {
    background: var(--auth-accent);
    border-color: var(--auth-accent);
    color: #ffffff;
}

.auth-btn--primary:hover:not(:disabled),
.auth-btn--primary:focus-visible {
    background: var(--auth-accent-hover);
    border-color: var(--auth-accent-border);
}

.auth-btn:disabled {
    opacity: 0.65;
    cursor: wait;
}

/* ─── Inline feedback ───────────────────────────────────────────────────── */

.auth-error {
    margin: 0 0 14px;
    padding: 10px 12px;
    border: 1px solid var(--auth-danger-border);
    border-radius: var(--auth-radius-control);
    background: var(--auth-danger-bg);
    color: var(--auth-danger-text);
    font-size: 0.85rem;
    line-height: 1.4;
}

.auth-progress {
    margin: 8px 0 0;
    text-align: center;
    font-size: 0.82rem;
    color: var(--auth-muted);
}

/* ─── Secondary link (password fallback, back to card) ──────────────────── */

.auth-link {
    display: block;
    width: 100%;
    margin: 14px 0 0;
    padding: 4px;
    border: 0;
    background: transparent;
    color: #0d6efd;
    font-family: inherit;
    font-size: 0.85rem;
    text-align: center;
    cursor: pointer;
}

.auth-link:hover,
.auth-link:focus-visible {
    text-decoration: underline;
}

/* ─── Divider between the two sign-in methods (/login) ──────────────────── */

.auth-divider {
    display: flex;
    align-items: center;
    gap: 8px;
    margin: 18px 0;
    color: var(--auth-subtle);
    font-size: 0.75rem;
}

.auth-divider::before,
.auth-divider::after {
    content: "";
    flex: 1;
    height: 1px;
    background: var(--auth-panel-border);
}

/* ─── Narrow screens (360 px upward) ────────────────────────────────────── */

@media (max-width: 420px) {
    .auth-panel {
        padding: 22px 18px 20px;
        border-radius: 12px;
    }

    .auth-input--code {
        font-size: 1.15rem;
        letter-spacing: 0.12em;
    }
}