/* =============================================================
   Autopilot — sign-in screen
   Requires tokens.css + ui.css.
   ============================================================= */

.auth-page {
  display: grid;
  grid-template-rows: 1fr auto;
  justify-items: center;
  min-height: 100vh;
  min-height: 100dvh;
  padding: var(--space-6) var(--space-4);
}

.auth-main {
  display: flex;
  flex-direction: column;
  justify-content: center;
  width: 100%;
  /* 400px keeps the measure short enough that the eye does not have to
     travel. The old page stretched three fields across 1240px. */
  max-width: 400px;
  padding: var(--space-8) 0;
}

/* ---------- Session check ---------- */

/* The old page rendered the full form, then redirected once /api/session
   answered — so an authenticated user always saw a flash of sign-in.
   The shell stays hidden until we know which of the two states applies. */
.auth-shell[hidden] {
  display: none;
}

.auth-checking {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: var(--space-2);
  min-height: 120px;
  color: var(--text-tertiary);
  font-size: var(--text-sm);
}

.auth-checking::before {
  content: "";
  width: 14px;
  height: 14px;
  border-radius: 50%;
  border: 2px solid currentColor;
  border-top-color: transparent;
  animation: ui-spin 600ms linear infinite;
}

.auth-checking[hidden] {
  display: none;
}

/* ---------- Brand ---------- */

.auth-brand {
  display: flex;
  align-items: center;
  gap: var(--space-2);
  margin-bottom: var(--space-6);
}

.auth-brand-mark {
  flex: 0 0 auto;
  /* Sized against the two-line text block beside it, not against the name
     alone, so the lockup reads as one object. */
  width: 36px;
  height: 36px;
  border-radius: var(--radius-lg);
  /* Fixed light tile in both themes. The logo is DiFFreight's asset and its
     two brand colours are designed against a light ground, so the tile
     travels with it instead of the colours being altered per theme. */
  background: #ffffff;
  /* Hairline only in light mode, where a white tile on a near-white page
     would otherwise have no edge at all. */
  box-shadow: inset 0 0 0 1px var(--border-default);
}

@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) .auth-brand-mark {
    box-shadow: none;
  }
}

:root[data-theme="dark"] .auth-brand-mark {
  box-shadow: none;
}

.auth-brand-text {
  display: flex;
  flex-direction: column;
  gap: 1px;
  min-width: 0;
}

.auth-brand-name {
  color: var(--text-primary);
  font-size: var(--text-base);
  font-weight: var(--weight-semibold);
  line-height: var(--leading-tight);
  letter-spacing: var(--tracking-tight);
}

/* The descriptor carries the vendor binding so the name does not have to.
   It can change as scope grows without touching the name. */
.auth-brand-descriptor {
  color: var(--text-tertiary);
  font-size: var(--text-xs);
  line-height: var(--leading-tight);
}

/* ---------- Card ---------- */

.auth-card {
  padding: var(--space-8);
  border: 1px solid var(--border-default);
  border-radius: var(--radius-xl);
  background: var(--bg-surface);
  box-shadow: var(--shadow-sm);
}

.auth-heading {
  margin: 0;
  color: var(--text-primary);
  font-size: var(--text-xl);
  font-weight: var(--weight-semibold);
  line-height: var(--leading-tight);
  letter-spacing: var(--tracking-tight);
}

.auth-subheading {
  margin: var(--space-2) 0 0;
  color: var(--text-secondary);
  font-size: var(--text-sm);
  line-height: var(--leading-normal);
  /* Without this the last word drops alone onto line two. Short display
     copy is the one place balancing is worth the layout cost — it runs on
     a handful of words, not on body text. */
  text-wrap: balance;
}

.auth-form {
  display: flex;
  flex-direction: column;
  gap: var(--space-5);
  margin-top: var(--space-6);
}

.auth-actions {
  display: flex;
  flex-direction: column;
  gap: var(--space-3);
}

.auth-label-row {
  display: flex;
  align-items: baseline;
  justify-content: space-between;
  gap: var(--space-2);
}

/* ---------- SSO providers ---------- */

/* Reserved slot for "Continue with Atlassian" / "Continue with Google".
   Styled and laid out now so that enabling SSO is a markup change, not a
   re-layout: providers sit above the divider, the API-token form below.
   See index.html for the exact block to unhide. */
.auth-providers {
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
  margin-top: var(--space-6);
}

.auth-providers[hidden] {
  display: none;
}

.auth-provider {
  justify-content: center;
  min-height: 40px;
}

.auth-divider {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  margin-top: var(--space-5);
  color: var(--text-tertiary);
  font-size: var(--text-xs);
}

.auth-divider[hidden] {
  display: none;
}

.auth-divider::before,
.auth-divider::after {
  content: "";
  flex: 1 1 auto;
  height: 1px;
  background: var(--border-subtle);
}

/* When SSO is live the token form becomes the secondary path; this class
   is applied to .auth-form to reduce its prominence without hiding it. */
.auth-form-secondary {
  margin-top: var(--space-5);
}

/* ---------- Footer ---------- */

.auth-footer {
  display: flex;
  align-items: center;
  flex-wrap: wrap;
  gap: var(--space-2) var(--space-3);
  width: 100%;
  max-width: 400px;
  padding-top: var(--space-4);
  color: var(--text-tertiary);
  font-size: var(--text-xs);
}

/* Credit and recovery cluster left; the theme control is a different kind of
   thing, so it sits apart rather than joining the text run. */
.auth-theme {
  margin-left: auto;
}

@media (max-width: 480px) {
  .auth-footer {
    justify-content: center;
  }

  .auth-theme {
    margin-left: 0;
    flex-basis: 100%;
    display: flex;
    justify-content: center;
  }
}

/* A `display` declaration beats the `hidden` attribute, so every component
   here that sets one must opt back out explicitly. */
.auth-footer[hidden] {
  display: none;
}

.auth-footer-sep {
  color: var(--border-strong);
}

.auth-credit-link {
  color: inherit;
  text-decoration: none;
  border-radius: var(--radius-sm);
  /* Underline only on hover/focus so the credit stays quiet at rest but is
     unmistakably clickable the moment someone goes looking for it. */
  transition: color var(--duration-fast) var(--ease-out);
}

.auth-credit-link:hover,
.auth-credit-link:focus-visible {
  color: var(--text-secondary);
  text-decoration: underline;
  text-underline-offset: 2px;
}

/* A recovery affordance, not a primary action: reads as a quiet link but
   stays a real <button> because it performs a state change, not navigation. */
.auth-footer-action {
  padding: 0;
  border: 0;
  border-radius: var(--radius-sm);
  background: none;
  color: var(--text-tertiary);
  font-family: inherit;
  font-size: inherit;
  line-height: inherit;
  cursor: pointer;
}

.auth-footer-action:hover {
  color: var(--text-secondary);
  text-decoration: underline;
  text-underline-offset: 2px;
}

/* ---------- Small screens ---------- */

/* index.html previously had no viewport meta at all, so this screen was
   unusable on a phone regardless of CSS. */
@media (max-width: 480px) {
  .auth-page {
    padding: var(--space-4) var(--space-3);
  }

  .auth-main {
    padding: var(--space-4) 0;
  }

  .auth-card {
    padding: var(--space-5);
    /* Edge-to-edge on a narrow screen reads as native; a floating rounded
       card with side gutters wastes horizontal space that the fields need. */
    border-left: 0;
    border-right: 0;
    border-radius: 0;
    margin: 0 calc(var(--space-3) * -1);
    padding-left: var(--space-4);
    padding-right: var(--space-4);
  }
}