/* =====================================================================
 * Sign-in pages — login.php, logout.php, accept_invite.php and its
 * invalid-link page. Loaded with $pageCss = 'auth'. Tokens only, so the
 * dark theme is the same token flip as everywhere else.
 *
 *   .auth-shell(.auth-shell--wide | .auth-shell--in-app)
 *     .auth-brand > .brand-mark + .auth-brand-text(.auth-brand-name + .auth-brand-sub)
 *     .auth-card
 *       .auth-head > .auth-ico? + h1.auth-title + p.auth-sub?
 *       .alert                         (form-level error, role="alert")
 *       form.auth-form > (label | .auth-field) … + button.btn-block
 *       .auth-step > h2.auth-step-title(.auth-step-num) + …   (invite set-up)
 *     p.auth-foot
 *
 * Self-contained: nothing here leans on the older .auth-card / .totp-secret-*
 * block in style.css, so that block can go once these pages load this file.
 * =================================================================== */

/* Rail-less pages: one column in the middle of the viewport, on the same
   gutter as the rest of the portal (32px, 16px on phones). With no JS the
   flash banner is a second grid row; both rows pack at the centre. */
body.no-nav .main {
  display: grid;
  place-items: center;
  align-content: center;
  gap: 16px;
  width: 100%;
  max-width: none;
  min-height: 100vh;
  min-height: 100dvh;
  padding: 40px var(--gutter);
}
body.no-nav .main > .js-hide { width: 100%; max-width: 400px; }
body.no-nav .main > .js-hide .alert { margin: 0; }

.auth-shell {
  display: flex;
  flex-direction: column;
  gap: 20px;
  width: 100%;
  max-width: 400px;
}
.auth-shell--wide { max-width: 580px; }
/* Signed-in pages (logout.php) keep the rail and the timer bar: centre the
   column inside .main instead of the viewport. */
.auth-shell--in-app { margin: 32px auto 0; }

/* Brand above the card — the rail's mark, a size up. */
.auth-brand {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: 10px;
}
.auth-brand .brand-mark { width: 36px; height: 36px; border-radius: 10px; font-size: 13px; }
.auth-brand-text { display: flex; flex-direction: column; min-width: 0; line-height: 1.2; }
.auth-brand-name { color: var(--ink); font-size: 15px; font-weight: 650; letter-spacing: -.01em; }
.auth-brand-sub { margin-top: 2px; color: var(--ink-muted); font-size: var(--fs-xs); font-weight: 500; }

.auth-card {
  width: 100%;
  max-width: none;
  padding: 28px;
  background: var(--panel);
  border: 1px solid var(--line);
  border-radius: var(--radius-xl);
  box-shadow: var(--shadow-pop);
}
.auth-head {
  display: flex;
  flex-direction: column;
  align-items: center;
  gap: 6px;
  margin: 0 0 22px;
  text-align: center;
}
/* Two classes deep: style.css's older `.auth-card h1` (24px, 24px margin)
   would otherwise win. */
.auth-card .auth-title {
  margin: 0;
  font-size: 22px;
  line-height: 1.2;
  font-weight: 600;
  letter-spacing: -.02em;
  text-align: inherit;
}
.auth-sub { margin: 0; max-width: 44ch; color: var(--ink-muted); font-size: var(--fs-sm); line-height: 1.5; }
.auth-sub strong { color: var(--ink-2); font-weight: 600; }
.auth-ico {
  display: grid;
  place-items: center;
  width: 40px;
  height: 40px;
  margin: 0 0 6px;
  border-radius: 10px;
  background: var(--panel-inset);
  color: var(--ink-muted);
}
.auth-ico svg { width: 20px; height: 20px; }
.auth-ico--warn { background: var(--warn-bg); color: var(--warn); }

.auth-card > .alert { margin: 0 0 18px; }
.auth-form { gap: 16px; }
/* A field whose hint sits outside its <label> (label[for] + control + hint):
   inside the label the hint would be read twice, as part of the field's name
   and again as its description. Same look as a wrapping label. */
.auth-field { display: flex; flex-direction: column; gap: 6px; min-width: 0; }
.auth-field > label { display: block; }
.auth-field > .field-help { margin-top: -2px; }
.auth-form > .btn-block { margin-top: 4px; }
/* Stacked full-width actions (sign out / stay signed in, invalid invite). */
.auth-actions { display: flex; flex-direction: column; gap: 10px; }
.auth-actions .btn-block { width: 100%; }

.auth-foot {
  margin: 0;
  color: var(--ink-muted);
  font-size: var(--fs-xs);
  line-height: 1.5;
  text-align: center;
}
.auth-foot a { color: var(--ink-2); text-decoration: underline; text-underline-offset: 2px; }
.auth-foot a:hover { color: var(--ink); }

/* ── Invite set-up: left-aligned head, two numbered steps ────────────── */
.auth-shell--wide .auth-head { align-items: flex-start; text-align: left; }
.auth-step {
  display: flex;
  flex-direction: column;
  gap: 14px;
  margin: 0;
  padding: 20px 0 4px;
  border-top: 1px solid var(--line-soft);
}
.auth-step-title {
  display: flex;
  align-items: center;
  gap: 10px;
  margin: 0;
  font-size: var(--fs-h3);
  font-weight: 600;
  line-height: 1.35;
}
.auth-step-num {
  display: inline-grid;
  place-items: center;
  flex: 0 0 auto;
  width: 24px;
  height: 24px;
  border-radius: 50%;
  background: var(--accent-soft);
  color: var(--accent-ink);
  font-size: var(--fs-xs);
  font-weight: 650;
}
.auth-step-text { margin: 0; color: var(--ink-2); font-size: 13.5px; line-height: 1.55; }
.auth-step-link { display: flex; flex-wrap: wrap; align-items: center; gap: 6px 10px; margin: 0; }
.auth-step-link .field-help { margin: 0; }

.auth-shell--wide .auth-sub { max-width: none; }
.auth-step > p { margin: 0; }

/* The setup key: what to type into the authenticator, set apart. Labels sit
   above their values, so the 32-character key gets the card's full width and
   keeps one line on a tablet or desktop. A phone is narrower: there it breaks
   only between its 4-character groups, balanced into two even lines of four. */
.totp-secret {
  display: grid;
  grid-template-columns: minmax(0, 1fr);
  gap: 2px;
  margin: 0;
  padding: 12px 14px;
  background: var(--panel-inset);
  border: 1px solid var(--line);
  border-radius: var(--radius);
}
.totp-secret dt {
  color: var(--ink-muted);
  font-size: var(--fs-2xs);
  font-weight: 600;
  letter-spacing: .06em;
  text-transform: uppercase;
}
.totp-secret dd + dt { margin-top: 10px; }
.totp-secret dd { margin: 0; min-width: 0; color: var(--ink); font-size: 13.5px; overflow-wrap: anywhere; }
.totp-secret dd:has(> .totp-key) { text-wrap: balance; }
.totp-secret .totp-key {
  padding: 0;
  background: none;
  color: var(--ink);
  font-family: var(--font-mono);
  font-size: 15px;
  letter-spacing: .02em;
  overflow-wrap: anywhere;
}
/* The hint belongs to the key block above it. */
.totp-secret + .field-help { margin-top: -6px; }

.auth-form .form-actions { margin-top: 8px; padding-bottom: 0; }

@media (max-width: 720px) {
  body.no-nav .main { padding-top: 28px; padding-bottom: 28px; }
}
/* Touch: the whole "Remember this device" row is the 36px target. */
@media (pointer: coarse), (max-width: 720px) {
  .auth-form .checkbox-inline { min-height: 36px; }
}
@media (max-width: 480px) {
  .auth-card { padding: 22px 18px; border-radius: var(--radius-lg); }
  .auth-shell--in-app { margin-top: 16px; }
  .auth-form .form-actions > .btn { flex: 1 1 auto; }
}