/* ===========================================================================
 * Identity credential surface — composition only.
 *
 * These pages are server-rendered HTML with no client framework, deliberately:
 * a credential form must work before, and without, JavaScript. @fiveforge/ui is
 * React, so it cannot run here — this sheet is the sanctioned exception noted
 * in ADR-004. It composes; it does not invent.
 *
 * The rule that keeps that honest: EVERY value here is either a token from
 * @fiveforge/tokens or a recipe copied from the shipped component it stands in
 * for (Label, Input, Button in @fiveforge/ui). No value originates in this
 * file. If a number below stops matching its component, the component moved
 * and this file is stale — fix it here, never re-tune the component to match.
 * ======================================================================== */

/* The brand typeface, self-hosted. A credential page must not depend on — or
   disclose its visitors to — a third-party font host, so no Google Fonts.
   One variable file covers the whole weight range this surface uses. */
@font-face {
  font-family: 'Geist';
  src: url('/assets/geist-sans-variable.woff2') format('woff2-variations');
  font-weight: 100 900;
  font-style: normal;
  font-display: swap;
}

* { box-sizing: border-box; }

html {
  color-scheme: light dark;
  /* Feeds the same hook next/font sets in the React apps, so the token sheet's
     --font-sans-stack resolves to Geist here exactly as it does there. */
  --font-geist-sans: 'Geist';
  font-family: var(--font-sans-stack);
}

body {
  margin: 0;
  min-height: 100vh;
  display: grid;
  place-items: center;
  padding: 1.5rem;
  color: var(--foreground);
  background: color-mix(in oklch, var(--muted) 40%, var(--background));
}

/* narrow-form: the PageShell variant for a single-column form. */
.shell { width: min(100%, 42rem); }

.brand { display: flex; justify-content: center; margin: 0 0 1.5rem; }
.brand img { display: block; width: 180px; height: 32px; }

/* Surface radius is rounded-xl; small controls take the component radius. */
.card {
  padding: 1.5rem;
  border: 1px solid var(--border);
  border-radius: var(--radius-scale-xl);
  color: var(--card-foreground);
  background: var(--card);
  box-shadow: 0 1px 2px color-mix(in oklch, var(--foreground) 7%, transparent);
}

/* The ONE page-title recipe: text-2xl font-semibold tracking-tight. */
h1 {
  margin: 0;
  font-size: 1.5rem;
  font-weight: 600;
  line-height: 1.25;
  letter-spacing: -0.025em;
}

/* Field label recipe: text-xs font-medium uppercase tracking-wide muted. */
.eyebrow {
  margin: 0 0 0.5rem;
  color: var(--muted-foreground);
  font-size: 0.75rem;
  font-weight: 500;
  letter-spacing: 0.025em;
  text-transform: uppercase;
}

/* Muted / meta: text-sm text-muted-foreground. */
.lede {
  margin: 0.5rem 0 1.5rem;
  color: var(--muted-foreground);
  font-size: 0.875rem;
  line-height: 1.5;
}

/* Label: text-sm font-medium. */
label {
  display: grid;
  gap: 0.45rem;
  margin-top: 1rem;
  font-size: 0.875rem;
  font-weight: 500;
}

/* Author-level display rules override the browser's built-in [hidden] rule. */
[data-password-field][hidden] { display: none; }

/* Input: rounded-lg, border-input, bg-transparent, px-2.5, text-base/md:text-sm.
   Held at the touch-target floor — this is the surface most likely to be used
   one-handed in the field. */
input {
  min-height: var(--touch-target);
  width: 100%;
  padding: 0.5rem 0.625rem;
  border: 1px solid var(--input);
  border-radius: var(--radius-scale-lg);
  color: var(--foreground);
  background: var(--background);
  font: inherit;
  font-size: 1rem;
  transition: border-color 0.15s, box-shadow 0.15s;
}

@media (min-width: 768px) {
  input { font-size: 0.875rem; }
}

input:focus-visible {
  border-color: var(--ring);
  outline: none;
  box-shadow: 0 0 0 3px color-mix(in oklch, var(--ring) 50%, transparent);
}

/* Button, default variant: rounded-lg, text-sm, font-medium, bg-primary. */
button {
  min-height: var(--touch-target);
  width: 100%;
  margin-top: 1.25rem;
  border: 1px solid transparent;
  border-radius: var(--radius-scale-lg);
  color: var(--primary-foreground);
  background: var(--primary);
  font: inherit;
  font-size: 0.875rem;
  font-weight: 500;
  cursor: pointer;
  transition: background-color 0.15s, box-shadow 0.15s;
}

button:hover { background: color-mix(in oklch, var(--primary) 80%, transparent); }
button:active { transform: translateY(1px); }

button:focus-visible {
  border-color: var(--ring);
  outline: none;
  box-shadow: 0 0 0 3px color-mix(in oklch, var(--ring) 50%, transparent);
}

/* Button, secondary variant. */
button.secondary { color: var(--secondary-foreground); background: var(--secondary); }
button.secondary:hover { background: color-mix(in oklch, var(--secondary) 80%, transparent); }

/* Status messages.
 *
 * These carry the status token as a TINT and a RULE, not as the text color.
 * The Badge pattern — status-colored text on a /10 tint of the same token —
 * measures 4.0:1 for destructive and 3.9:1 for info at 14px, under the 4.5:1
 * WCAG AA needs for body text. On a sign-in page the failing string is "That
 * username or password is incorrect", which is the one message a user in
 * trouble must be able to read. Foreground text over the same tint measures
 * ~19:1 and keeps the status color doing the signalling.
 *
 * This is composition, not a new token: the values are still --destructive and
 * --info. The Badge variants in @fiveforge/ui have the same contrast shortfall
 * and need fixing at the token source; that is tracked separately. */
.error,
.notice {
  margin: 0 0 1rem;
  padding: 0.75rem;
  border-radius: var(--radius-scale-lg);
  border-inline-start: 3px solid;
  color: var(--foreground);
  font-size: 0.875rem;
}

.error {
  border-inline-start-color: var(--destructive);
  background: color-mix(in oklch, var(--destructive) 10%, transparent);
}

.notice {
  border-inline-start-color: var(--info);
  background: color-mix(in oklch, var(--info) 10%, transparent);
}

.help { margin: 0.75rem 0 0; color: var(--muted-foreground); font-size: 0.75rem; }
/* Link: copied from the @fiveforge/ui `link` button variant — text-primary,
   underline on hover, offset 4. No value originates here (ADR-013). */
a {
  color: var(--primary);
  text-decoration: none;
  text-underline-offset: 4px;
}

.help a { text-decoration: underline; }
a:hover { text-decoration: underline; }

a:focus-visible {
  outline: 2px solid var(--ring);
  outline-offset: 2px;
  border-radius: var(--radius-scale-sm);
}


.footer {
  margin-top: 1rem;
  color: var(--muted-foreground);
  font-size: 0.75rem;
  text-align: center;
}

@media (prefers-reduced-motion: reduce) {
  * { transition: none !important; }
  button:active { transform: none; }
}

/* Account pages compose the same Card, Button, and muted text recipes. */
h2 { margin: 0; font-size: 1rem; font-weight: 600; line-height: 1.5; }
.section-heading { display: flex; align-items: center; justify-content: space-between; gap: 1rem; flex-wrap: wrap; }
.section-heading > a { font-size: 0.875rem; }
.account-profile { padding: 1rem; background: var(--muted); border-radius: var(--radius-scale-lg); overflow-wrap: anywhere; }
.connection-details { overflow-wrap: anywhere; }
.account-profile p { margin: 0.25rem 0 0; font-size: 0.875rem; color: var(--muted-foreground); }
.account-section { margin-top: 1.5rem; padding-top: 1.5rem; border-top: 1px solid var(--border); }
.account-section .lede { margin-bottom: 0.75rem; }
.account-actions { display: flex; flex-direction: column; gap: 0.75rem; margin-top: 1rem; font-size: 0.875rem; }
.status { font-size: 0.75rem; font-weight: 500; padding: 0.25rem 0.5rem; background: var(--secondary); color: var(--secondary-foreground); border-radius: var(--radius-scale-sm); }
.button-link { display: flex; align-items: center; justify-content: center; min-height: var(--touch-target); margin-top: 1rem; padding: 0.5rem 1rem; border-radius: var(--radius-scale-lg); background: var(--primary); color: var(--primary-foreground); font-size: 0.875rem; font-weight: 500; text-align: center; }
.button-link.secondary { background: var(--secondary); color: var(--secondary-foreground); }
.button-link:hover { text-decoration: none; filter: brightness(0.95); }
.password-toggle { display: block; width: auto; min-height: var(--touch-target); margin: 0; padding: 0 0.25rem; color: var(--foreground); background: transparent; font-size: 0.75rem; text-decoration: underline; text-underline-offset: 4px; }
.password-toggle:hover { background: var(--muted); }
[hidden] { display: none !important; }
.enrollment-qr { width: min(100%, 16rem); margin: 1rem auto; }
.enrollment-qr svg { display: block; width: 100%; height: auto; }
summary { cursor: pointer; font-size: 0.875rem; min-height: var(--touch-target); padding-block: 0.75rem; }
summary:focus-visible { outline: 2px solid var(--ring); outline-offset: 2px; }
.secret-key { font-family: var(--font-mono-stack); font-size: 0.875rem; }
.step-heading { margin-top: 1.5rem; }
.recovery-codes { display: grid; grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr)); gap: 0.75rem; padding: 1rem; list-style: none; background: var(--muted); border-radius: var(--radius-scale-lg); }
.recovery-codes code { font-size: 0.875rem; overflow-wrap: anywhere; }
@media print {
  .brand, .footer, .button-link, button { display: none; }
  body, .card, .recovery-codes { background: white; color: black; }
  .card { box-shadow: none; }
}