/* auth.css — the sign-in pages (auth/, name/), the cookie banner, the account icon and menu (js/account_menu.js). Load after style.css. */

/* The sign-in page (auth/): its status line is plain text, so the dot is the same colour as
   the card it sits on — invisible — for a routine message ("Continuing…", "Checking…",
   "Verified — redirecting…"), and shows only as the red of an error. The stronger selectors
   beat the colours the form's own states use above. */
.page-auth .status-dot,
.page-auth .form-status[data-state="saving"] .status-dot,
.page-auth .form-status[data-state="saved"] .status-dot {
  background: var(--surface);
}

.page-auth .form-status[data-state="error"] .status-dot { background: var(--danger); }

/* ---------------------------------------------------------------------
   Cookie consent banner
--------------------------------------------------------------------- */
.consent-banner {
  position: fixed;
  left: 0;
  right: 0;
  bottom: 0;
  z-index: 20;
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: var(--space-4);
  justify-content: space-between;
  background: var(--surface);
  border-top: 1px solid var(--line);
  padding: var(--space-4) var(--space-6);
  padding-bottom: calc(var(--space-4) + env(safe-area-inset-bottom, 0px));
  box-shadow: 0 -8px 24px rgba(0, 0, 0, 0.08);
}

/* `display: flex` above beats the browser's own `[hidden] { display: none }`
   rule (author styles always win over user-agent styles at equal
   specificity), so setting the `hidden` attribute alone never actually
   hid this element. This rule is more specific than `.consent-banner`
   alone and restores the expected behavior. */
.consent-banner[hidden] {
  display: none;
}

.consent-copy { max-width: 60ch; }

.consent-copy p { margin: 0 0 0.35rem; color: var(--ink-soft); }

.consent-copy p:first-child { color: var(--ink); }

.consent-copy p:last-child { margin-bottom: 0; }

.consent-actions {
  display: flex;
  gap: var(--space-2);
  flex: none;
}

/* The cookie categories in the banner: Necessary (locked on), Analytics, Third-party. */
.consent-categories { border: 0; margin: var(--space-2) 0 0; padding: 0; display: grid; gap: 0.3rem; }
.consent-categories label { display: flex; gap: 0.5rem; align-items: baseline; color: var(--ink); font-size: 0.95rem; }
.consent-categories input { flex: none; }
.consent-version { font-size: 0.8rem; color: var(--ink-soft); }
.visually-hidden { position: absolute; width: 1px; height: 1px; margin: -1px; padding: 0; overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap; border: 0; }
.link-button { appearance: none; background: none; border: 0; padding: 0; font: inherit; color: var(--accent); text-decoration: underline; cursor: pointer; }

/* ---------------------------------------------------------------------
   Terms of Service consent checkbox on /auth/ — deliberately named
   .tos-pp-consent-* rather than reusing .consent-*, which already means
   something different and unrelated here (the cookie/storage consent
   banner on /form/).
--------------------------------------------------------------------- */
.tos-pp-notice {
  margin: 0 0 var(--space-4);
  font-size: 0.95rem;
}

.tos-pp-notice a {
  color: var(--accent);
}

.tos-pp-consent-field {
  margin-bottom: var(--space-4);
}

.tos-pp-consent-label {
  display: flex;
  align-items: flex-start;
  gap: 0.5rem;
  cursor: pointer;
  font-size: 0.95rem;
}

.tos-pp-consent-label input[type="checkbox"] {
  margin-top: 0.2rem;
  flex: none;
}

.tos-pp-consent-label a {
  color: var(--accent);
}

/* ---------------------------------------------------------------------
   "or login with" — SSO buttons on /auth/
--------------------------------------------------------------------- */
.sso-divider {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  margin: var(--space-3) 0;
  color: var(--ink-soft);
  font-size: 0.85rem;
}

.sso-divider::before,
.sso-divider::after {
  content: '';
  flex: 1 1 auto;
  height: 1px;
  background: var(--line);
}

.sso-buttons {
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
}

.sso-btn {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: var(--space-2);
  width: 100%;
  padding: 0.65rem 1rem;
  border: 1px solid var(--line);
  border-radius: var(--radius);
  background: var(--surface);
  color: var(--ink);
  font: inherit;
  font-weight: 600;
  text-decoration: none;
  cursor: pointer;
  transition: border-color 0.15s ease, background-color 0.15s ease;
}

.sso-btn:hover:not(:disabled) {
  border-color: var(--accent);
}

.sso-btn:focus-visible {
  outline: 2px solid var(--focus);
  outline-offset: 2px;
}

.sso-btn:disabled {
  opacity: 0.55;
  cursor: not-allowed;
}

.sso-btn svg {
  flex: none;
}

@media (max-width: 480px) {
  .consent-banner { flex-direction: column; align-items: stretch; }
  .consent-actions { justify-content: flex-end; }
}

/* ---------------------------------------------------------------------
   Account icon + popup (js/account_menu.js) — top-right corner of every
   page a signed-in person sees.
--------------------------------------------------------------------- */
.account-avatar {
  display: inline-grid;
  place-items: center;
  width: 40px;
  height: 40px;
  padding: 0;
  border: 0;
  border-radius: 50%;
  background: #e3e5e8;          /* light gray, in light and dark mode alike */
  color: #3c4043;
  font: 600 0.9rem/1 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  letter-spacing: 0.02em;
  user-select: none;
}

button.account-avatar {
  position: fixed;
  top: 12px;
  right: 12px;
  z-index: 50;
  cursor: pointer;
  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.25);
}

button.account-avatar:hover { background: #d7dade; }

.account-avatar--large {
  width: 56px;
  height: 56px;
  font-size: 1.2rem;
  flex: none;
}

.account-popup {
  position: fixed;
  top: 60px;
  right: 12px;
  z-index: 60;
  width: min(400px, calc(100vw - 24px));
  max-height: calc(100vh - 84px); /* the session list can grow: the popup scrolls rather than leaving the screen */
  overflow-y: auto;
  box-sizing: border-box;
  padding: var(--space-4);
  background: var(--surface);
  color: var(--ink);
  border: 1px solid var(--line);
  border-radius: var(--radius);
  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.28);
}

.account-popup[hidden] { display: none; }

.account-popup:focus { outline: none; }

.account-popup-close {
  position: absolute;
  top: 6px;
  right: 8px;
  width: 32px;
  height: 32px;
  border: 0;
  border-radius: 50%;
  background: transparent;
  color: var(--ink-soft, var(--ink));
  font-size: 1.5rem;
  line-height: 1;
  cursor: pointer;
}

.account-popup-close:hover { background: var(--line); }

.account-who {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  padding-right: 2rem;          /* keeps the text clear of the × */
  margin-bottom: var(--space-4);
}

.account-lines {
  display: flex;
  flex-direction: column;
  min-width: 0;
}

.account-name { overflow-wrap: anywhere; }

.account-name-row {
  display: flex;
  align-items: center;
  flex-wrap: wrap;
  gap: var(--space-2, 0.5rem);
  min-width: 0;
}

.account-name-edit,
.account-name-save,
.account-name-cancel {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  min-width: 1.75rem;
  height: 1.75rem;
  padding: 0;
  border: 0;
  border-radius: 6px;
  background: transparent;
  color: var(--ink-soft, var(--ink));
  font: inherit;
  cursor: pointer;
}

.account-name-edit:hover,
.account-name-save:hover,
.account-name-cancel:hover { background: var(--line); }

.account-name-input {
  flex: 1 1 8rem;
  min-width: 0;
  padding: 0.25rem 0.5rem;
  border: 1px solid var(--line);
  border-radius: 6px;
  background: transparent;
  color: var(--ink);
  font: inherit;
}

.account-name-error {
  flex-basis: 100%;
  font-size: 0.8125rem;
  color: var(--danger, #b00020);
}

.account-name-error:empty { display: none; }

.account-email {
  font-size: 0.875rem;
  color: var(--ink-soft, var(--ink));
  overflow-wrap: anywhere;
}

.account-actions {
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
}

.account-actions .btn { width: 100%; }

.account-status {
  min-height: 1.25rem;
  margin: var(--space-3) 0 0;
  font-size: 0.875rem;
  color: var(--ink-soft, var(--ink));
}

.account-status[data-state="error"] { color: var(--danger); font-weight: 600; }

/* On narrow screens a long heading must not run underneath the icon. */
@media (max-width: 640px) {
  .has-account-menu .page-header { padding-right: calc(var(--space-4) + 3rem); }
}

@media print {
  .account-avatar, .account-popup { display: none !important; }
}

/* Role badge under the email (editor, admin, system admin — never shown for a plain user). */
.account-role {
  align-self: flex-start;
  margin-top: 0.15rem;
  padding: 0.05rem 0.5rem;
  font-size: 0.75rem;
  font-weight: 600;
  color: var(--accent);
  border: 1px solid var(--accent);
  border-radius: 999px;
}

/* "Where you're signed in": one row per browser session or MCP connection. */
.account-sessions {
  margin-top: var(--space-3);
  padding-top: var(--space-3);
  border-top: 1px solid var(--line);
}

.account-sessions-title {
  margin: 0 0 var(--space-2);
  font-size: 0.9rem;
}

.account-session-list {
  margin: 0;
  padding: 0;
  list-style: none;
}

.account-session {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: var(--space-3);
  padding: var(--space-2) 0;
  border-bottom: 1px solid var(--line);
}

.account-session:last-child { border-bottom: 0; }

.account-session-main {
  display: flex;
  flex-wrap: wrap;
  align-items: baseline;
  gap: 0.15rem 0.5rem;
  min-width: 0;
}

.account-session-label {
  font-size: 0.9rem;
  overflow-wrap: anywhere;
}

.account-session-tag {
  padding: 0 0.4rem;
  font-size: 0.7rem;
  color: var(--ink-soft);
  border: 1px solid var(--line);
  border-radius: 999px;
}

.account-session-meta {
  flex-basis: 100%;
  font-size: 0.78rem;
  line-height: 1.35;
  color: var(--ink-soft);
}

.account-session-end {
  flex: none;
  padding: 0.25rem 0.6rem;
  font-size: 0.8rem;
}

.account-session-note {
  margin: var(--space-2) 0;
  font-size: 0.8rem;
  color: var(--ink-soft);
}

.account-session-note:empty { display: none; }

.account-signout-all {
  margin-top: var(--space-2);
  width: 100%;
}

@media print {
  .account-role, .account-sessions { display: none !important; }
}

/* nothing to report: no bar, and no stray dot */
/* The kit's landing page (home/): who the server says you are. */
.home-facts {
  display: grid;
  grid-template-columns: minmax(6rem, max-content) 1fr;
  gap: 0.35rem var(--space-3);
  margin: 0 0 var(--space-3);
}

.home-facts dt { color: var(--ink-soft); }

.home-facts dd { margin: 0; overflow-wrap: anywhere; }

/* Space between the label and the input on the name and code steps. */
#name,
#code { margin-top: 12px; }

/* ---------------------------------------------------------------------
   Terms of Service + Privacy Policy modal (js/account_menu.js, buildTermsDialog)
   A native <dialog>. The site's global reset removes the margin the browser centres it with, so it is restored here.
--------------------------------------------------------------------- */
.terms-dialog {
  margin: auto;
  width: min(440px, calc(100vw - 24px));
  padding: var(--space-6, 1.5rem);
  border: 1px solid var(--line);
  border-radius: var(--radius);
  background: var(--surface);
  color: var(--ink);
  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.28);
  font-family: var(--font-sans, system-ui, sans-serif);
  font-size: 16px;
  line-height: 1.5;
}

.terms-dialog::backdrop { background: rgba(0, 0, 0, 0.45); }

.terms-dialog-title { margin: 0 0 var(--space-3, 0.75rem); font-size: 1.15rem; }

.terms-dialog-text { margin: 0 0 var(--space-4, 1rem); color: var(--ink-soft, var(--ink)); }

.terms-dialog-check {
  display: flex;
  align-items: flex-start;
  gap: var(--space-2, 0.5rem);
  margin: 0 0 var(--space-3, 0.75rem);
  font-size: 0.95rem;
  font-weight: 500;
  color: var(--ink);
}

.terms-dialog-check input { margin-top: 0.2rem; flex: none; }

.terms-dialog-check a { color: var(--accent); }

.terms-dialog-status { min-height: 1.25rem; margin: 0 0 var(--space-3, 0.75rem); font-size: 0.9rem; color: var(--ink-soft, var(--ink)); }

/* Decline / forget me on the left (two rows of small text), Accept on the right. */
.terms-dialog-actions { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: var(--space-3, 0.75rem); }
.terms-dialog-leave { display: flex; flex-direction: column; align-items: flex-start; gap: 0.2rem; font-size: 0.85rem; color: var(--ink-soft, var(--ink)); }
.terms-dialog-link {
  appearance: none; background: none; border: 0; padding: 0; margin: 0;
  font: inherit; color: var(--accent); text-decoration: underline; cursor: pointer;
}
.terms-dialog-link:hover { text-decoration-thickness: 2px; }
.terms-dialog-link:disabled { opacity: 0.5; cursor: default; }


/* auth/ asks the server whether this browser is already signed in (and, if so, moves on to home/ or company/).
   Until the answer comes, the page is invisible, so a signed-in person never sees the form flash by. It appears by
   itself after 0.3 s (also when scripts are off or the server is slow), and at once when the script adds
   `auth-ready` because nobody is signed in. */
@keyframes auth-reveal { from { opacity: 0; } to { opacity: 1; } }
body.page-auth:not(.auth-ready) > .page-header,
body.page-auth:not(.auth-ready) > .page-main {
  animation: auth-reveal 0s linear 0.3s backwards;
}