/*
 * Auth layout — Phase 30.5-01 (Plan A) migration off legacy dark-navy palette.
 *
 * Replaces the ~30-line inline <style> block that shipped in auth.html since
 * Phase 18. That legacy block used a hand-picked navy palette + system-ui
 * font (see Phase 30.5-01 SUMMARY.md for the exact hex values removed) that
 * predates the CONTEXT-locked Ubiquiti gray/black baseline. This file uses
 * ONLY tokens from app.css DESIGN SYSTEM (loaded first via base link tag),
 * so the auth family (login, 2fa-*, reset-*, claim.html, etc.) now matches
 * shell chrome.
 *
 * SEC-02 partner fix: auth.html also swaps the third-party htmx CDN for the
 * self-hosted /static/js/htmx.min.js in the same commit.
 *
 * Plan B (30.5-02) will polish the individual auth-family PAGES on top of
 * this locked palette base — this file only touches the shared layout.
 */

html, body {
  margin: 0;
  padding: 0;
  background: var(--bg);
  color: var(--fg);
  font-family: var(--font-body);
}

body {
  min-height: 100vh;
  display: grid;
  place-items: center;
}

.auth-card {
  background: var(--bg-panel);
  border: 1px solid var(--border);
  padding: var(--pad-4);
  border-radius: var(--radius);
  width: 22rem;
  box-shadow: 0 4px 24px rgba(0, 0, 0, 0.4);
}

.auth-card h1 {
  font-size: 1.2rem;
  margin: 0 0 var(--pad-3) 0;
  color: var(--accent);
  letter-spacing: 0.04em;
  text-transform: uppercase;
}

.auth-card label {
  display: block;
  margin: var(--pad-2) 0;
  font-size: 0.9rem;
  color: var(--fg);
}

.auth-card input[type=email],
.auth-card input[type=password],
.auth-card input[type=text],
.auth-card input[type=tel] {
  display: block;
  width: 100%;
  box-sizing: border-box;
  padding: var(--pad-2);
  margin-top: var(--pad-1);
  background: var(--bg-hover);
  border: 1px solid var(--border-strong);
  border-radius: var(--radius);
  color: var(--fg);
  font-family: var(--font-body);
  font-size: 1rem;
}

.auth-card input:focus {
  outline: none;
  border-color: var(--accent);
  box-shadow: 0 0 0 2px rgba(0, 162, 255, 0.25);
}

.auth-card button,
.auth-card button[type=submit] {
  display: block;
  width: 100%;
  padding: 0.6rem;
  margin-top: var(--pad-3);
  background: var(--accent);
  border: 0;
  border-radius: var(--radius);
  color: #fff;
  font-family: var(--font-body);
  font-size: 1rem;
  font-weight: 500;
  cursor: pointer;
  transition: background 100ms;
}

.auth-card button:hover,
.auth-card button[type=submit]:hover {
  background: var(--accent-hover);
}

.auth-card a {
  color: var(--accent);
  text-decoration: none;
}

.auth-card a:hover {
  color: var(--accent-hover);
  text-decoration: underline;
}

/* Error message pill — Ubiquiti alarm red with subtle background. */
.auth-card .error,
.auth-card .form-error {
  background: rgba(239, 68, 68, 0.12);
  color: var(--alarm);
  border: 1px solid rgba(239, 68, 68, 0.35);
  padding: var(--pad-2) var(--pad-3);
  border-radius: var(--radius);
  font-size: 0.9rem;
  margin-bottom: var(--pad-2);
}

/* Success message pill — Ubiquiti ok green. */
.auth-card .success,
.auth-card .form-success {
  background: rgba(34, 197, 94, 0.12);
  color: var(--ok);
  border: 1px solid rgba(34, 197, 94, 0.35);
  padding: var(--pad-2) var(--pad-3);
  border-radius: var(--radius);
  font-size: 0.9rem;
  margin-bottom: var(--pad-2);
}

/* Auth footer (legal links) — matches shell-footer palette. */
.auth-footer {
  position: fixed;
  bottom: 0;
  left: 0;
  right: 0;
  text-align: center;
  padding: var(--pad-2) var(--pad-3);
  color: var(--fg-muted);
  font-size: 0.82em;
}

.auth-footer a {
  color: var(--fg-muted);
  margin: 0 var(--pad-2);
  text-decoration: none;
}

.auth-footer a:hover {
  color: var(--fg);
  text-decoration: underline;
}

/* ============================================================
 * Phase 30.5-02 (Plan B) — Auth family per-page selectors.
 * Every colour references a Plan A token (--bg / --bg-panel /
 * --accent / --fg / --fg-muted / --ok / --warn / --alarm) — no
 * legacy dark-navy hex anywhere.
 * ============================================================ */

/* body.auth-page — used by ownership-accept + must-set-pin
 * which link app.css and don't wrap in {{template "auth" .}}. */
body.auth-page {
  min-height: 100vh;
  display: grid;
  place-items: center;
  background: var(--bg);
  color: var(--fg);
  font-family: var(--font-body);
  margin: 0;
  padding: 0;
}
body.auth-page .auth-card,
body.auth-page main.auth-card {
  background: var(--bg-panel);
  border: 1px solid var(--border);
  padding: var(--pad-4);
  border-radius: var(--radius);
  width: 22rem;
  box-shadow: 0 4px 24px rgba(0, 0, 0, 0.4);
}
body.auth-page h1 {
  font-size: 1.2rem;
  margin: 0 0 var(--pad-3) 0;
  color: var(--accent);
  letter-spacing: 0.04em;
  text-transform: uppercase;
  font-weight: 600;
}
body.auth-page p {
  color: var(--fg);
  line-height: 1.55;
  margin: 0 0 var(--pad-2);
}
body.auth-page p.hint,
body.auth-page .hint {
  color: var(--fg-muted);
  font-size: 0.85em;
  line-height: 1.5;
}
body.auth-page .form-row {
  margin: var(--pad-2) 0;
}
body.auth-page .form-row label {
  display: block;
  margin-bottom: var(--pad-1);
  font-size: 0.9rem;
  color: var(--fg);
}
body.auth-page .form-row input {
  display: block;
  width: 100%;
  box-sizing: border-box;
  padding: var(--pad-2);
  background: var(--bg-hover);
  border: 1px solid var(--border-strong);
  border-radius: var(--radius);
  color: var(--fg);
  font-family: var(--font-body);
  font-size: 1rem;
}
body.auth-page .form-row input:focus {
  outline: none;
  border-color: var(--accent);
  box-shadow: 0 0 0 2px rgba(0, 162, 255, 0.25);
}
body.auth-page .form-actions {
  margin-top: var(--pad-3);
}
body.auth-page .form-actions .btn,
body.auth-page .btn-primary,
body.auth-page .btn-secondary {
  display: block;
  width: 100%;
  padding: 0.6rem;
  border-radius: var(--radius);
  font-family: var(--font-body);
  font-size: 1rem;
  font-weight: 500;
  cursor: pointer;
  text-align: center;
  text-decoration: none;
}
body.auth-page .btn-primary {
  background: var(--accent);
  color: #fff;
  border: 0;
  margin-top: var(--pad-2);
}
body.auth-page .btn-primary:hover { background: var(--accent-hover); }
body.auth-page .btn-secondary {
  background: transparent;
  color: var(--fg);
  border: 1px solid var(--border-strong);
  margin-top: var(--pad-2);
}
body.auth-page .btn-secondary:hover { background: var(--bg-hover); }
body.auth-page .error {
  background: rgba(239, 68, 68, 0.12);
  color: var(--alarm);
  border: 1px solid rgba(239, 68, 68, 0.35);
  padding: var(--pad-2) var(--pad-3);
  border-radius: var(--radius);
  font-size: 0.9rem;
  margin-bottom: var(--pad-2);
}

/* Subtitle / help copy inside auth cards. */
.auth-card p.subtitle,
.auth-card p.help-text {
  color: var(--fg-muted);
  font-size: 0.9rem;
  margin-bottom: var(--pad-3);
  margin-top: 0;
}
.auth-card p {
  color: var(--fg);
  line-height: 1.55;
}
.auth-card p + p { margin-top: var(--pad-2); }

.auth-card label small {
  display: block;
  color: var(--fg-muted);
  font-size: 0.78rem;
  margin-top: 2px;
  font-weight: 400;
}

/* Wide auth-card variant — legal doc long-form + claim (extra fields). */
.auth-card--wide {
  width: 26rem;
  max-width: 100%;
}

/* Legal doc long-form typography — .auth-card--wide up to 720px. */
.auth-card--legal {
  width: 100%;
  max-width: 720px;
}
.legal-doc { line-height: 1.65; }
.legal-doc h1 {
  font-size: 22px;
  font-weight: 600;
  color: var(--fg);
  padding-bottom: var(--pad-2);
  margin: 0 0 var(--pad-1);
  border-bottom: 2px solid var(--accent);
  text-transform: none;
  letter-spacing: 0;
}
.legal-doc-lastupdated {
  color: var(--fg-muted);
  font-size: 13px;
  margin: 0 0 var(--pad-3);
}
.legal-doc h2 {
  font-size: 17px;
  font-weight: 600;
  color: var(--fg);
  margin: var(--pad-4) 0 var(--pad-2);
}
.legal-doc h3 {
  font-size: 15px;
  font-weight: 500;
  color: var(--fg);
  margin: var(--pad-3) 0 var(--pad-1);
}
.legal-doc p {
  margin: 0 0 var(--pad-2);
  color: var(--fg);
  line-height: 1.65;
  font-size: 0.95em;
}
.legal-doc ul {
  padding-left: var(--pad-4);
  color: var(--fg);
  margin: 0 0 var(--pad-2);
}
.legal-doc li {
  margin-bottom: var(--pad-1);
  line-height: 1.6;
}
.legal-doc a {
  color: var(--accent);
  text-decoration: none;
}
.legal-doc a:hover { color: var(--accent-hover); text-decoration: underline; }
.legal-doc code {
  font-family: var(--font-mono, Consolas, "Courier New", ui-monospace, monospace);
  background: var(--bg-hover);
  color: var(--accent);
  padding: 1px 5px;
  border-radius: var(--radius-sm);
  font-size: 0.9em;
}
.legal-doc strong { color: var(--fg); }

.legal-doc-footer {
  margin-top: var(--pad-4);
  padding-top: var(--pad-3);
  border-top: 1px solid var(--border);
  color: var(--fg-muted);
  font-size: 0.8em;
}
.legal-doc-footer a { color: var(--fg-muted); }
.legal-doc-footer a:hover { color: var(--fg); }

.legal-back-to-top {
  position: sticky;
  top: var(--pad-3);
  float: right;
  background: var(--bg-hover);
  border: 1px solid var(--border-strong);
  color: var(--fg-muted);
  padding: var(--pad-1) var(--pad-2);
  border-radius: var(--radius-sm);
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  text-decoration: none;
}
.legal-back-to-top:hover { color: var(--fg); }

/* Auth-card content utilities used by 2fa / claim / verify / must-set-pin. */
.auth-card .form-help,
.auth-card .backup-hint {
  text-align: center;
  margin-top: var(--pad-3);
  font-size: 0.85rem;
  color: var(--fg-muted);
}
.auth-card .form-help a,
.auth-card .backup-hint a { color: var(--accent); }

/* Monospace / OTP / PIN / claim-code input variants. */
.auth-card input.otp,
.auth-card input.pin {
  font-family: Consolas, "Courier New", ui-monospace, monospace;
  font-size: 1.4rem;
  letter-spacing: 0.4em;
  text-align: center;
  padding: 0.7rem;
}
.auth-card input.claim-code {
  font-family: Consolas, "Courier New", ui-monospace, monospace;
  font-size: 1.2rem;
  letter-spacing: 0.3em;
  text-align: center;
  text-transform: uppercase;
}

/* Remember-device row (2fa-challenge). */
.auth-card .checkbox-row {
  display: flex;
  align-items: center;
  gap: var(--pad-2);
  margin-top: var(--pad-3);
  font-size: 0.85rem;
  color: var(--fg);
}
.auth-card .checkbox-row input[type=checkbox] {
  appearance: none;
  width: 16px;
  height: 16px;
  background: var(--bg-hover);
  border: 1px solid var(--border-strong);
  border-radius: var(--radius-sm);
  cursor: pointer;
  position: relative;
  margin: 0;
}
.auth-card .checkbox-row input[type=checkbox]:checked {
  background: var(--accent);
  border-color: var(--accent);
}
.auth-card .checkbox-row input[type=checkbox]:checked::after {
  content: "";
  position: absolute;
  left: 4px;
  top: 0;
  width: 5px;
  height: 10px;
  border: solid #fff;
  border-width: 0 2px 2px 0;
  transform: rotate(45deg);
}

/* QR display (2fa-enroll) — white plate for camera contrast. */
.auth-card .qr-box {
  background: #fff;
  padding: 0.75rem;
  border-radius: var(--radius);
  display: flex;
  justify-content: center;
  margin: var(--pad-3) auto var(--pad-2);
  width: fit-content;
}
.auth-card .secret-manual {
  text-align: center;
  font-size: 0.75rem;
  color: var(--fg-muted);
  margin: var(--pad-2) 0 var(--pad-3);
}
.auth-card .secret-manual code {
  display: inline-block;
  font-family: Consolas, "Courier New", ui-monospace, monospace;
  color: var(--accent);
  background: var(--bg-hover);
  padding: var(--pad-1) var(--pad-2);
  border-radius: var(--radius-sm);
  margin-top: var(--pad-1);
  letter-spacing: 0.1em;
  font-size: 0.85rem;
  word-break: break-all;
}

/* Recovery-codes grid (2fa-recovery-codes). */
.auth-card .warning-heading {
  color: var(--warn);
  text-transform: uppercase;
  letter-spacing: 0.04em;
  font-weight: 600;
}
.auth-card .warning-hint {
  font-size: 0.85rem;
  color: var(--fg-muted);
  margin-bottom: var(--pad-3);
}
.auth-card .warning-hint strong { color: var(--warn); }
.auth-card .codes-grid {
  background: var(--bg);
  border: 1px solid var(--border);
  padding: var(--pad-3);
  border-radius: var(--radius);
  font-family: Consolas, "Courier New", ui-monospace, monospace;
  font-size: 1rem;
  letter-spacing: 0.2em;
  text-align: center;
  line-height: 1.8;
  margin-bottom: var(--pad-3);
  color: var(--fg);
}
.auth-card .btn-copy {
  display: block;
  width: 100%;
  padding: 0.6rem;
  margin-top: var(--pad-2);
  background: transparent;
  color: var(--fg);
  border: 1px solid var(--border-strong);
  border-radius: var(--radius);
  font-family: var(--font-body);
  font-size: 0.9rem;
  cursor: pointer;
}
.auth-card .btn-copy:hover { background: var(--bg-hover); }

/* Suggestions block (claim tenant-name-taken). */
.auth-card .suggestions {
  background: var(--bg);
  border: 1px solid var(--warn);
  border-left-width: 3px;
  padding: var(--pad-2) var(--pad-3);
  border-radius: var(--radius);
  font-size: 0.85rem;
  margin: var(--pad-2) 0;
  color: var(--fg);
}
.auth-card .suggestions p { margin: 0 0 var(--pad-1); }
.auth-card .suggestions ul {
  margin: var(--pad-1) 0 0 0;
  padding-left: var(--pad-3);
}
.auth-card .suggestions li { margin-bottom: 2px; }
.auth-card .suggestions code {
  font-family: Consolas, "Courier New", ui-monospace, monospace;
  background: var(--bg-hover);
  color: var(--accent);
  padding: 1px 6px;
  border-radius: var(--radius-sm);
  font-size: 0.85rem;
}

/* Legal agreement copy at the bottom of claim / invite forms. */
.auth-card .legal-agree {
  font-size: 0.8em;
  color: var(--fg-muted);
  margin: var(--pad-3) 0 0 0;
  line-height: 1.5;
}
.auth-card .legal-agree a { color: var(--accent); }

/* Token-context header (invite-accept + ownership-accept). */
.auth-card .token-context {
  background: var(--bg);
  border-left: 3px solid var(--accent);
  padding: var(--pad-2) var(--pad-3);
  margin-bottom: var(--pad-3);
  font-size: 0.85rem;
  color: var(--fg);
  border-radius: 0 var(--radius) var(--radius) 0;
}
.auth-card .token-context strong { color: var(--fg); }
.auth-card .token-context .expires {
  display: block;
  color: var(--fg-muted);
  font-size: 0.8rem;
  margin-top: 4px;
}

/* Info icon (claim-check-email + verify-email success/envelope). */
.auth-card .info-icon {
  width: 56px;
  height: 56px;
  display: flex;
  align-items: center;
  justify-content: center;
  background: var(--bg-hover);
  color: var(--accent);
  border-radius: 50%;
  margin: 0 auto var(--pad-3);
  font-size: 26px;
}
.auth-card .info-icon.success { color: var(--ok); }
.auth-card--center { text-align: center; }

/* PIN mismatch warning (invite-accept inline JS). */
.auth-card .pin-warn {
  color: var(--alarm);
  font-size: 0.85rem;
  margin-top: var(--pad-1);
}

/* ============================================================
 * First-run empty-state partial — companion to pages/first-run-empty.html.
 * Standalone (not inside auth-card); own selector namespace to avoid
 * clobbering .auth-card centering / width.
 * ============================================================ */
.first-run-empty {
  max-width: 32rem;
  margin: 4rem auto;
  padding: var(--pad-4);
  background: var(--bg-panel);
  color: var(--fg);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  text-align: center;
  box-shadow: 0 4px 24px rgba(0, 0, 0, 0.4);
}
.first-run-empty__icon {
  font-size: 3rem;
  margin-bottom: var(--pad-2);
  color: var(--fg-muted);
}
.first-run-empty__title {
  margin: 0 0 var(--pad-2) 0;
  color: var(--accent);
  font-size: 1.25rem;
}
.first-run-empty__body {
  color: var(--fg-muted);
  margin: var(--pad-2) 0 var(--pad-3) 0;
  font-size: 0.95rem;
  line-height: 1.5;
}
.first-run-empty__cta {
  margin: var(--pad-3) 0 0 0;
  font-size: 0.9rem;
}
.first-run-empty__cta a {
  color: var(--accent);
  text-decoration: underline;
}
.first-run-empty__cta a:hover { color: var(--accent-hover); }

/* First-run topbar (companion to first-run-empty.html shell). */
.first-run-topbar {
  background: var(--bg-panel);
  border-bottom: 1px solid var(--border);
  padding: var(--pad-2) var(--pad-3);
  color: var(--accent);
  letter-spacing: 0.04em;
  text-transform: uppercase;
  font-size: 0.9rem;
  font-weight: 600;
}

/* ============================================================
 * Sessions page (settings-sessions.html + session-row.html partial).
 * Standalone shell (auth-family-adjacent — will migrate to shell partial
 * in a future pass; this pass polishes the palette).
 * ============================================================ */
.sessions-page {
  background: var(--bg);
  color: var(--fg);
  font-family: var(--font-body);
  min-height: 100vh;
  padding: var(--pad-4);
  margin: 0;
}
.sessions-card {
  background: var(--bg-panel);
  border: 1px solid var(--border);
  padding: var(--pad-4);
  border-radius: var(--radius);
  max-width: 46rem;
  margin: 0 auto;
  box-shadow: 0 4px 24px rgba(0, 0, 0, 0.4);
}
.sessions-card h1 {
  font-size: 1.2rem;
  margin: 0 0 var(--pad-3) 0;
  color: var(--accent);
  letter-spacing: 0.04em;
  text-transform: uppercase;
  font-weight: 600;
}
.sessions-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 0.9rem;
}
.sessions-table th,
.sessions-table td {
  text-align: left;
  padding: var(--pad-2) var(--pad-3);
  border-bottom: 1px solid var(--border);
}
.sessions-table th {
  color: var(--fg-muted);
  font-weight: 600;
  font-size: 0.8rem;
  letter-spacing: 0.04em;
  text-transform: uppercase;
}
.sessions-table code {
  font-family: Consolas, "Courier New", ui-monospace, monospace;
  color: var(--fg);
  font-size: 0.85rem;
}
.sessions-table .session-fingerprint {
  color: var(--fg-muted);
  font-size: 0.75rem;
}
.sessions-table .session-none {
  color: var(--fg-muted);
  font-style: italic;
}
.sessions-table .is-current {
  color: var(--ok);
  font-weight: 600;
}
.sessions-table .session-current-note {
  color: var(--fg-muted);
  font-style: italic;
}
.sessions-table .session-empty {
  color: var(--fg-muted);
}
.sessions-table .btn-revoke {
  background: var(--alarm);
  color: #fff;
  border: 0;
  padding: var(--pad-1) var(--pad-2);
  border-radius: var(--radius-sm);
  cursor: pointer;
  font-size: 0.8rem;
}
.sessions-table .btn-revoke:hover { filter: brightness(0.9); }
.sessions-card .btn-revoke-all {
  background: transparent;
  color: var(--alarm);
  border: 1px solid var(--alarm);
  padding: var(--pad-2) var(--pad-3);
  border-radius: var(--radius);
  cursor: pointer;
  font-size: 0.9rem;
  margin-top: var(--pad-3);
  font-family: var(--font-body);
}
.sessions-card .btn-revoke-all:hover { background: rgba(239, 68, 68, 0.12); }