/* bran.css — BRAN Gateway design system (docs/DESIGN.md v2.0, B-46 / ticket #11)
 *
 * One hand-written stylesheet, no framework, no build step, no CDN.
 * Tokens and components only — page-specific layout stays in templates.
 * 503.html intentionally stays inline/self-contained (Caddy must be able to
 * serve it with bran-core itself down) and is not wired to this file.
 * authz/denied.html is rendered by bran-core and uses this stylesheet like
 * every other client-facing screen (ticket #13).
 */

@font-face {
    font-family: "PT Serif";
    src: url("/static/fonts/pt-serif-regular.woff2") format("woff2");
    font-weight: 400;
    font-display: swap;
}
@font-face {
    font-family: "Source Sans Pro";
    src: url("/static/fonts/source-sans-pro-regular.woff2") format("woff2");
    font-weight: 400;
    font-display: swap;
}
@font-face {
    font-family: "Source Sans Pro";
    src: url("/static/fonts/source-sans-pro-semibold.woff2") format("woff2");
    font-weight: 600;
    font-display: swap;
}

:root {
    /* Color */
    --c-bg: #f9fafb;
    --c-surface: #ffffff;
    --c-border: #e5e7eb;
    --c-text: #111827;
    --c-text-muted: #374151;
    --c-text-subtle: #6b7280;
    --c-brand: #1f3a3a;
    --c-brand-dark: #16292a;
    --c-accent: #f26522;
    --c-danger: #b91c1c;
    --c-success: #15803d;

    /* Typography */
    --font-serif: "PT Serif", Georgia, "Times New Roman", serif;
    --font-sans: "Source Sans Pro", -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
    --text-xs: 0.8125rem;
    --text-sm: 0.9375rem;
    --text-base: 1rem;
    --text-lg: 1.125rem;
    --text-xl: 1.5rem;

    /* Shape */
    --radius: 0.75rem;
    --radius-sm: 0.375rem;
}

*, *::before, *::after {
    box-sizing: border-box;
    margin: 0;
    padding: 0;
}

body {
    font-family: var(--font-sans);
    background: var(--c-bg);
    color: var(--c-text);
}

/* --font-serif is reserved for h1 and .wordmark only (DESIGN.md v2.0 Typography);
 * everything else — body, labels, buttons, table text, inputs — stays --font-sans. */
h1 {
    font-family: var(--font-serif);
}

/* ---------- Components ---------- */

.card {
    background: var(--c-surface);
    border: 1px solid var(--c-border);
    border-radius: var(--radius);
    max-width: 480px;
    width: 100%;
    padding: 2.5rem 2rem;
    text-align: center;
}

.wordmark {
    font-family: var(--font-serif);
    font-size: var(--text-lg);
    font-weight: 600;
    letter-spacing: 0.05em;
    color: var(--c-brand);
    margin-bottom: 2rem;
    text-transform: uppercase;
}

.btn {
    display: inline-block;
    font-family: var(--font-sans);
    font-size: var(--text-base);
    font-weight: 600;
    border-radius: var(--radius-sm);
    border: 1px solid transparent;
    padding: 0.75rem 2rem;
    cursor: pointer;
}

.btn:disabled {
    opacity: .5;
    cursor: not-allowed;
}

.btn-primary {
    background: var(--c-brand);
    color: var(--c-surface);
}

.btn-primary:hover:not(:disabled) {
    background: var(--c-brand-dark);
}

.btn-secondary {
    background: var(--c-surface);
    color: var(--c-accent);
    border-color: var(--c-accent);
}

.btn-secondary:hover:not(:disabled) {
    background: var(--c-bg);
}

.form-actions {
    display: flex;
    gap: 1rem;
}

.field {
    display: flex;
    flex-direction: column;
    gap: 0.5rem;
    text-align: left;
    margin-bottom: 1.5rem;
}

.field label {
    font-size: var(--text-sm);
    color: var(--c-text-muted);
    font-weight: 600;
}

.field input {
    font-family: var(--font-sans);
    font-size: var(--text-base);
    color: var(--c-text);
    border: 1px solid var(--c-border);
    border-radius: var(--radius-sm);
    padding: 0.75rem 1rem;
}

.field input:focus {
    outline: 2px solid var(--c-accent);
    outline-offset: 1px;
}

.otp-input {
    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
    letter-spacing: 0.3em;
    text-align: center;
    font-size: var(--text-xl);
    padding: 1rem;
}

.badge {
    display: inline-block;
    font-size: var(--text-xs);
    font-weight: 600;
    border-radius: var(--radius-sm);
    padding: 0.125rem 0.625rem;
    border: 1px solid var(--c-border);
    color: var(--c-text-subtle);
}

.badge-success {
    color: var(--c-success);
    border-color: var(--c-success);
}

.badge-danger {
    color: var(--c-danger);
    border-color: var(--c-danger);
}

.nav-admin {
    background: var(--c-brand);
    color: #fff;
    padding: 0.75rem 2rem;
    display: flex;
    gap: 2rem;
    align-items: center;
}

.nav-admin strong {
    color: #fff;
}

.nav-admin a {
    color: #ccc;
    text-decoration: none;
    font-size: var(--text-sm);
}

.nav-admin a:hover {
    color: #fff;
}

.nav-admin .nav-admin-user {
    margin-left: auto;
    font-size: var(--text-xs);
}

table {
    width: 100%;
    border-collapse: collapse;
    font-size: var(--text-sm);
}

table th,
table td {
    border: 1px solid var(--c-border);
    padding: 0.75rem 1rem;
    text-align: left;
}

table th {
    color: var(--c-text-muted);
    font-weight: 600;
}

/* Small muted helper text (e.g. the "sign in with a different account" link
 * on authz/denied.html) — same subtle-gray treatment used elsewhere. */
.hint {
    font-size: var(--text-xs);
    color: var(--c-text-subtle);
}

.hint a {
    color: var(--c-text-subtle);
}

.alert-error {
    border: 1px solid var(--c-danger);
    background: #fef2f2;
    color: var(--c-danger);
    border-radius: var(--radius-sm);
    padding: 0.75rem 1rem;
    font-size: var(--text-sm);
    margin-bottom: 1.5rem;
}

/* ---------- Layout patterns ---------- */

/* Auth flow (login, verify): centered card, vertically centered on --c-bg.
 * Matches authz/denied.html and caddy/error_pages/503.html exactly. */
.auth-shell {
    display: flex;
    align-items: center;
    justify-content: center;
    min-height: 100vh;
    padding: 2rem;
}

/* Disclosure screen: same card pattern, wider (640px per screen.html). */
.disclosure-shell {
    display: flex;
    align-items: center;
    justify-content: center;
    min-height: 100vh;
    padding: 2rem;
}

.disclosure-shell .card {
    max-width: 640px;
    text-align: left;
}

/* Admin panel: .nav-admin top bar + main content area on --c-bg. */
.admin-main {
    padding: 2rem;
}

.admin-main .card {
    max-width: none;
    text-align: left;
    margin-bottom: 2rem;
}

/* ---------- New components (DESIGN.md v2.0) ----------
 * Added by ticket #11, unstyled elsewhere yet — no template wires these up
 * in this ticket. Shapes follow DESIGN.md v2.0 "Components" verbatim.
 */

/* .split-shell — two-pane client-facing layout (login, verify, disclosure,
 * authz/denied). Left: .split-shell-brand (teal), .wordmark + accent rule +
 * tagline. Right: .split-shell-content (white), the page's own content.
 * Below 640px the panes stack, brand pane becomes a short centered band. */
.split-shell {
    display: flex;
    min-height: 100vh;
}

.split-shell-brand {
    background: var(--c-brand);
    color: rgba(255, 255, 255, 0.7);
    flex: 0 0 38%;
    display: flex;
    flex-direction: column;
    justify-content: center;
    align-items: flex-start;
    padding: 2.5rem;
}

.split-shell-brand .wordmark {
    color: #fff;
    margin-bottom: 0.75rem;
}

.split-shell-rule {
    width: 3rem;
    height: 3px;
    background: var(--c-accent);
    border: none;
    margin-bottom: 1rem;
}

.split-shell-tagline {
    font-size: var(--text-sm);
}

.split-shell-content {
    background: var(--c-surface);
    flex: 1;
    display: flex;
    flex-direction: column;
    justify-content: center;
    padding: 2.5rem;
}

@media (max-width: 640px) {
    .split-shell {
        flex-direction: column;
        min-height: 0;
    }

    .split-shell-brand {
        flex: none;
        align-items: center;
        text-align: center;
        padding: 1.5rem;
    }

    .split-shell-content {
        flex: none;
    }
}

/* .wizard-steps / .wizard-pane — self-serve app registration (4-step
 * wizard). .wizard-steps is the numbered progress strip; each .wizard-pane
 * is one step's content, only one shown at a time (toggled via [hidden]). */
.wizard-steps {
    display: flex;
    gap: 0.75rem;
    margin-bottom: 2rem;
    list-style: none;
}

.wizard-steps li {
    display: flex;
    align-items: center;
    gap: 0.5rem;
    font-size: var(--text-sm);
    color: var(--c-text-subtle);
}

.wizard-steps li::before {
    content: counter(wizard-step);
    counter-increment: wizard-step;
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 1.5rem;
    height: 1.5rem;
    border-radius: 50%;
    border: 1px solid var(--c-border);
    font-size: var(--text-xs);
    font-weight: 600;
}

.wizard-steps {
    counter-reset: wizard-step;
}

.wizard-steps li.is-current {
    color: var(--c-text);
    font-weight: 600;
}

.wizard-steps li.is-current::before {
    border-color: var(--c-brand);
    color: var(--c-brand);
}

.wizard-steps li.is-done::before {
    content: "\2713";
    background: var(--c-success);
    border-color: var(--c-success);
    color: #fff;
}

.wizard-pane[hidden] {
    display: none;
}

.wizard-pane-controls {
    display: flex;
    justify-content: space-between;
    margin-top: 2rem;
}

/* .probe-list / .probe-pass / .probe-fail — the two automatic registration
 * probes (public-door-bricked, gateway-guards) shown live on the wizard's
 * final pane. */
.probe-list {
    list-style: none;
    border: 1px solid var(--c-border);
    border-radius: var(--radius-sm);
    margin-bottom: 1.5rem;
}

.probe-list li {
    display: flex;
    align-items: center;
    gap: 0.75rem;
    padding: 0.75rem 1rem;
    font-size: var(--text-sm);
    border-bottom: 1px solid var(--c-border);
}

.probe-list li:last-child {
    border-bottom: none;
}

.probe-pass {
    color: var(--c-success);
    font-weight: 600;
}

.probe-fail {
    color: var(--c-danger);
    font-weight: 600;
}

/* .block-explain — explains why a blocked registration failed and what to
 * do about it; never a bare error code. */
.block-explain {
    border: 1px solid var(--c-danger);
    background: #fef2f2;
    color: var(--c-text);
    border-radius: var(--radius-sm);
    padding: 1rem 1.25rem;
    font-size: var(--text-sm);
    margin-bottom: 1.5rem;
}

.block-explain strong {
    color: var(--c-danger);
}

/* .page-guidance — plain-English "what this page is for" block at the top
 * of every admin page (DESIGN.md v2.0 principle 7). */
.page-guidance {
    background: var(--c-surface);
    border: 1px solid var(--c-border);
    border-left: 3px solid var(--c-accent);
    border-radius: var(--radius-sm);
    padding: 1rem 1.25rem;
    font-size: var(--text-sm);
    color: var(--c-text-muted);
    margin-bottom: 2rem;
}

/* .grant-picker — reciprocal add/remove-by-email control, shared between
 * the Apps page (add users to an app) and the per-user detail page (add
 * apps to a user); same underlying `grants` mechanism, same component. */
.grant-picker {
    border: 1px solid var(--c-border);
    border-radius: var(--radius-sm);
    padding: 1rem;
}

.grant-picker-add {
    display: flex;
    gap: 0.75rem;
    margin-bottom: 1rem;
}

.grant-picker-add input {
    flex: 1;
}

.grant-picker-list {
    list-style: none;
}

.grant-picker-list li {
    display: flex;
    align-items: center;
    justify-content: space-between;
    padding: 0.5rem 0;
    border-bottom: 1px solid var(--c-border);
    font-size: var(--text-sm);
}

.grant-picker-list li:last-child {
    border-bottom: none;
}