/* ZDS — Zinn Design System · Keycloak login theme stylesheet.
 *
 * The design tokens below are transcribed VERBATIM from the ZDS source of truth
 * (ui/src/tokens/tokens.css — itself transcribed from the owner-approved
 * "Zinn Digital — Control Panel Concept", docs/07 §1). Keycloak themes cannot
 * import the @zinn/ui package, so the token values are inlined here; keep them in
 * sync with tokens.css. Light is the default, dark follows the OS, and every rule
 * uses LOGICAL properties only (margin-inline, padding-block, inset-*) so the
 * Arabic/Urdu/Farsi/Hebrew/Pashto RTL screens mirror correctly (CLAUDE.md §2.7).
 */

:root {
  --font-ui: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
  --font-mono: ui-monospace, "SF Mono", "Cascadia Code", "Roboto Mono", Menlo, monospace;

  --bg: #eef2f9;
  --surface: #ffffff;
  --surface-2: #f4f7fc;
  --border: #dce4f0;
  --border-strong: #c6d2e6;
  --text: #0f1b2e;
  --text-muted: #5c6b85;
  --text-faint: #8a98b2;

  --brand: #2557d6;
  --brand-strong: #1b44b0;
  --brand-ink: #ffffff;
  --brand-soft: #e7eefc;
  --brand-line: #bfd1f6;

  --ok: #16915b;
  --ok-soft: #e0f3ea;
  --warn: #b77400;
  --warn-soft: #fbefd8;
  --crit: #ce3e45;
  --crit-soft: #fbe5e6;
  --info: #2557d6;
  --info-soft: #e7eefc;

  --radius: 12px;
  --radius-sm: 9px;
  --radius-lg: 16px;
  --shadow: 0 1px 2px rgba(16, 27, 46, 0.05), 0 8px 24px -14px rgba(16, 27, 46, 0.18);
  --shadow-lg: 0 1px 2px rgba(16, 27, 46, 0.06), 0 24px 60px -28px rgba(16, 27, 46, 0.35);

  --space-1: 4px;
  --space-2: 8px;
  --space-3: 12px;
  --space-4: 16px;
  --space-5: 20px;
  --space-6: 24px;
  --space-8: 32px;
  --space-10: 40px;

  --text-xs: 12px;
  --text-sm: 13px;
  --text-md: 14px;
  --text-lg: 16px;
  --text-xl: 18px;
  --text-2xl: 22px;
  --text-3xl: 28px;

  --duration-base: 200ms;
  --ease-standard: cubic-bezier(0.2, 0, 0, 1);

  color-scheme: light;
}

@media (prefers-color-scheme: dark) {
  :root {
    --bg: #0a1120;
    --surface: #111b2e;
    --surface-2: #16223a;
    --border: #243349;
    --border-strong: #31435f;
    --text: #e9eff9;
    --text-muted: #97a6c2;
    --text-faint: #6c7c99;
    --brand: #5a8bf7;
    --brand-strong: #7aa2fa;
    --brand-ink: #0a1120;
    --brand-soft: #16233f;
    --brand-line: #2b4573;
    --ok: #3bc488;
    --ok-soft: #12332a;
    --warn: #e0a33a;
    --warn-soft: #33280f;
    --crit: #f0666c;
    --crit-soft: #361b21;
    --info: #5a8bf7;
    --info-soft: #16233f;
    --shadow: 0 1px 2px rgba(0, 0, 0, 0.4), 0 12px 30px -16px rgba(0, 0, 0, 0.7);
    --shadow-lg: 0 1px 2px rgba(0, 0, 0, 0.4), 0 30px 70px -30px rgba(0, 0, 0, 0.8);
    color-scheme: dark;
  }
}

*,
*::before,
*::after {
  box-sizing: border-box;
}

html,
body.auth-body {
  margin: 0;
  padding: 0;
  min-block-size: 100%;
}

body.auth-body {
  font-family: var(--font-ui);
  font-size: var(--text-md);
  line-height: 1.5;
  color: var(--text);
  /* A calm cobalt wash on the ZDS canvas — not a loud gradient hero. */
  background-color: var(--bg);
  background-image:
    radial-gradient(60rem 60rem at 100% -10%, var(--brand-soft) 0%, transparent 55%),
    radial-gradient(50rem 50rem at -10% 110%, var(--brand-soft) 0%, transparent 50%);
  background-attachment: fixed;
  -webkit-font-smoothing: antialiased;
  text-rendering: optimizeLegibility;
}

.auth-shell {
  min-block-size: 100vh;
  display: flex;
  flex-direction: column;
  align-items: center;
  justify-content: center;
  padding: var(--space-6);
  gap: var(--space-5);
}

/* ── Brand lockup (inline SVG mark + wordmark), mirrors ui/src/brand/logo.tsx ── */
.auth-logo {
  display: inline-flex;
  align-items: center;
  gap: var(--space-2);
  font-weight: 690;
  letter-spacing: -0.035em;
  font-size: var(--text-2xl);
  color: var(--text);
  text-decoration: none;
  white-space: nowrap;
}
.auth-logo__mark {
  flex: none;
  color: var(--brand);
}
.auth-logo__z {
  color: var(--brand);
}
.auth-logo__r {
  font-size: 0.46em;
  vertical-align: super;
  font-weight: 600;
  color: var(--text-muted);
  margin-inline-start: 0.05em;
}

/* ── Card ─────────────────────────────────────────────────────────────────── */
.auth-card {
  inline-size: 100%;
  max-inline-size: 27rem;
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius-lg);
  box-shadow: var(--shadow-lg);
  overflow: hidden;
}
.auth-card__header {
  padding: var(--space-8) var(--space-8) var(--space-4);
  text-align: center;
}
.auth-card__header .auth-logo {
  margin-block-end: var(--space-5);
}
.auth-card__title {
  margin: 0;
  font-size: var(--text-2xl);
  font-weight: 650;
  letter-spacing: -0.02em;
  color: var(--text);
}
.auth-card__subtitle {
  margin-block-start: var(--space-2);
  margin-block-end: 0;
  color: var(--text-muted);
  font-size: var(--text-md);
}
.auth-card__body {
  padding: var(--space-4) var(--space-8) var(--space-8);
}
.auth-card__footer {
  padding: var(--space-5) var(--space-8);
  border-block-start: 1px solid var(--border);
  background: var(--surface-2);
  text-align: center;
  font-size: var(--text-sm);
  color: var(--text-muted);
}
.auth-card__footer a {
  color: var(--brand);
  font-weight: 500;
  text-decoration: none;
}
.auth-card__footer a:hover {
  text-decoration: underline;
}

/* ── Alerts (Keycloak message.type → ZDS semantic colours) ─────────────────── */
.auth-alert {
  display: flex;
  align-items: flex-start;
  gap: var(--space-2);
  padding: var(--space-3) var(--space-4);
  border-radius: var(--radius-sm);
  border: 1px solid transparent;
  font-size: var(--text-sm);
  margin-block-end: var(--space-5);
}
.auth-alert__icon {
  flex: none;
  inline-size: 1rem;
  block-size: 1rem;
  margin-block-start: 1px;
}
.auth-alert--success {
  background: var(--ok-soft);
  border-color: var(--ok);
  color: var(--ok);
}
.auth-alert--warning {
  background: var(--warn-soft);
  border-color: var(--warn);
  color: var(--warn);
}
.auth-alert--error {
  background: var(--crit-soft);
  border-color: var(--crit);
  color: var(--crit);
}
.auth-alert--info {
  background: var(--info-soft);
  border-color: var(--info);
  color: var(--info);
}
.auth-alert a {
  color: inherit;
  font-weight: 600;
}

/* ── Forms ────────────────────────────────────────────────────────────────── */
.auth-form {
  display: flex;
  flex-direction: column;
  gap: var(--space-4);
}
.auth-field {
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
}
.auth-label {
  font-size: var(--text-sm);
  font-weight: 550;
  color: var(--text);
  /* inline-flex so a required marker that Keycloak's userProfileFormFields
     renders as a SIBLING after the <label> sits on the same line, not below it. */
  display: inline-flex;
  align-items: baseline;
  gap: var(--space-1);
}
/* The required marker — whether inside our own labels (login/register) or rendered
   right after the label by the inherited user-profile field template. */
.auth-label__required,
.auth-field .auth-label + *:where(.required, [aria-hidden="true"]) {
  color: var(--crit);
  margin-inline-start: 2px;
}
.auth-input,
.auth-select {
  inline-size: 100%;
  font: inherit;
  color: var(--text);
  background: var(--surface);
  border: 1px solid var(--border-strong);
  border-radius: var(--radius-sm);
  padding: var(--space-3) var(--space-4);
  transition: border-color var(--duration-base) var(--ease-standard),
    box-shadow var(--duration-base) var(--ease-standard);
}
.auth-input::placeholder {
  color: var(--text-faint);
}
.auth-input:focus,
.auth-select:focus,
.auth-input:focus-visible {
  outline: none;
  border-color: var(--brand);
  box-shadow: 0 0 0 3px var(--brand-soft);
}
.auth-input[aria-invalid="true"] {
  border-color: var(--crit);
}
.auth-input[aria-invalid="true"]:focus {
  box-shadow: 0 0 0 3px var(--crit-soft);
}

/* Password field with a reveal toggle. */
.auth-input-group {
  position: relative;
  display: flex;
}
.auth-input-group .auth-input {
  padding-inline-end: 2.75rem;
}
.auth-reveal {
  position: absolute;
  inset-inline-end: var(--space-2);
  inset-block-start: 50%;
  transform: translateY(-50%);
  display: inline-flex;
  align-items: center;
  justify-content: center;
  inline-size: 2rem;
  block-size: 2rem;
  border: none;
  background: transparent;
  color: var(--text-muted);
  border-radius: var(--radius-sm);
  cursor: pointer;
}
.auth-reveal:hover {
  color: var(--text);
  background: var(--surface-2);
}
.auth-reveal:focus-visible {
  outline: 2px solid var(--brand);
  outline-offset: 1px;
}

.auth-field__error {
  color: var(--crit);
  font-size: var(--text-xs);
}
.auth-field__hint {
  color: var(--text-muted);
  font-size: var(--text-xs);
}

/* Checkbox + inline row (remember-me / forgot-password). */
.auth-form__row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: var(--space-3);
  flex-wrap: wrap;
}
.auth-checkbox {
  display: inline-flex;
  align-items: center;
  gap: var(--space-2);
  font-size: var(--text-sm);
  color: var(--text-muted);
  cursor: pointer;
}
.auth-checkbox input {
  inline-size: 1rem;
  block-size: 1rem;
  accent-color: var(--brand);
}
.auth-link {
  color: var(--brand);
  font-size: var(--text-sm);
  font-weight: 500;
  text-decoration: none;
}
.auth-link:hover {
  text-decoration: underline;
}

/* ── Buttons ──────────────────────────────────────────────────────────────── */
.auth-btn {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  gap: var(--space-2);
  inline-size: 100%;
  font: inherit;
  font-weight: 600;
  padding: var(--space-3) var(--space-5);
  border-radius: var(--radius-sm);
  border: 1px solid transparent;
  cursor: pointer;
  transition: background-color var(--duration-base) var(--ease-standard),
    border-color var(--duration-base) var(--ease-standard);
}
.auth-btn--primary {
  background: var(--brand);
  color: var(--brand-ink);
}
.auth-btn--primary:hover {
  background: var(--brand-strong);
}
.auth-btn--secondary {
  background: var(--surface);
  color: var(--text);
  border-color: var(--border-strong);
}
.auth-btn--secondary:hover {
  background: var(--surface-2);
}
.auth-btn:focus-visible {
  outline: 2px solid var(--brand);
  outline-offset: 2px;
}
.auth-actions {
  display: flex;
  flex-direction: column;
  gap: var(--space-3);
  margin-block-start: var(--space-2);
}

/* ── Social / identity providers ──────────────────────────────────────────── */
.auth-divider {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  margin-block: var(--space-6) var(--space-5);
  color: var(--text-faint);
  font-size: var(--text-xs);
  text-transform: uppercase;
  letter-spacing: 0.06em;
}
.auth-divider::before,
.auth-divider::after {
  content: "";
  flex: 1;
  block-size: 1px;
  background: var(--border);
}
.auth-social {
  display: grid;
  gap: var(--space-2);
}
.auth-social__btn {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  gap: var(--space-2);
  padding: var(--space-3) var(--space-4);
  border: 1px solid var(--border-strong);
  border-radius: var(--radius-sm);
  background: var(--surface);
  color: var(--text);
  font-weight: 550;
  text-decoration: none;
  transition: background-color var(--duration-base) var(--ease-standard);
}
.auth-social__btn:hover {
  background: var(--surface-2);
}
.auth-social__btn i {
  font-style: normal;
}

/* ── Info block (registration link etc.) ──────────────────────────────────── */
.auth-info {
  margin-block-start: var(--space-5);
  text-align: center;
  color: var(--text-muted);
  font-size: var(--text-sm);
}
.auth-info a {
  color: var(--brand);
  font-weight: 500;
  text-decoration: none;
}
.auth-info a:hover {
  text-decoration: underline;
}

/* ── Attempted-username banner (identity-first second step) ───────────────── */
.auth-attempted-username {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: var(--space-3);
  flex-wrap: wrap;
  padding: var(--space-3) var(--space-4);
  margin-block-end: var(--space-4);
  background: var(--surface-2);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  font-size: var(--text-sm);
  color: var(--text-muted);
}
.auth-attempted-username span {
  font-weight: 550;
  color: var(--text);
  word-break: break-all;
}

/* ── Locale switcher ──────────────────────────────────────────────────────── */
.auth-locale {
  display: flex;
  margin-block-end: var(--space-4);
}
.auth-locale__select {
  /* Full-width to line up with the form inputs — consistent with the centered
     card, not tucked into a right-hand corner. */
  inline-size: 100%;
  font: inherit;
  font-size: var(--text-sm);
  color: var(--text-muted);
  background: var(--surface-2);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding-block: var(--space-2);
  padding-inline: var(--space-3) var(--space-6);
  cursor: pointer;
}

/* ── Try-another-way (WebAuthn/OTP alternatives) ──────────────────────────── */
.auth-try-another {
  margin-block-start: var(--space-4);
  text-align: center;
}

/* ── Instruction / helper copy blocks ─────────────────────────────────────── */
.auth-instruction {
  color: var(--text-muted);
  font-size: var(--text-md);
  margin-block: 0 var(--space-5);
}

/* ── OTP / TOTP setup (QR + manual key) ───────────────────────────────────── */
.auth-totp {
  display: flex;
  flex-direction: column;
  gap: var(--space-4);
  margin-block-end: var(--space-5);
}
.auth-totp__step {
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: var(--space-4);
  background: var(--surface-2);
}
.auth-totp__step-title {
  font-weight: 600;
  margin-block-end: var(--space-2);
}
.auth-totp__qr img {
  display: block;
  margin: var(--space-3) auto 0;
  background: #fff;
  padding: var(--space-2);
  border-radius: var(--radius-sm);
}
.auth-totp__key {
  font-family: var(--font-mono);
  font-size: var(--text-sm);
  word-break: break-all;
  color: var(--text);
  background: var(--surface);
  border: 1px dashed var(--border-strong);
  border-radius: var(--radius-sm);
  padding: var(--space-2) var(--space-3);
  margin-block-start: var(--space-2);
}

.auth-list {
  margin: 0;
  padding-inline-start: var(--space-5);
  color: var(--text-muted);
  font-size: var(--text-sm);
}

@media (max-width: 480px) {
  .auth-shell {
    padding: var(--space-3);
  }
  .auth-card__header,
  .auth-card__body {
    padding-inline: var(--space-5);
  }
}

@media (prefers-reduced-motion: reduce) {
  * {
    transition: none !important;
    animation: none !important;
  }
}