/*
 * The server-rendered auth surface: /auth/register, /auth/login, /cli-success.
 *
 * A separate sheet from design-system-public.css on purpose — that one dresses documents
 * (the error page, the old crawler twins) and this one dresses the two screens the whole
 * funnel narrows through. Tokens come from there; everything here is layout and the three
 * controls these pages actually use.
 *
 * Register is two columns: the act on the left, what you are agreeing to on the right.
 * Login is one, because there is nothing to reassure anyone about signing back in.
 */

.auth-page {
  min-height: 100vh;
  /* Recessed ground, so the form reads as the lit object on the page. */
  background: var(--ui-bg);
}

.auth {
  max-width: 1040px;
  margin: 0 auto;
  padding: 64px 24px 80px;
  display: grid;
  grid-template-columns: minmax(0, 1fr) minmax(0, 0.85fr);
  gap: 64px;
  align-items: start;
}

.auth.is-single {
  max-width: 460px;
  grid-template-columns: minmax(0, 1fr);
}

.auth-col {
  min-width: 0;
}

/* The one way back to marketing. Deliberately the only outbound link above the legal line. */
.auth-mark {
  display: inline-flex;
  align-items: center;
  gap: 9px;
  text-decoration: none;
  color: var(--ui-text);
  font-weight: 600;
  font-size: 15px;
  margin-bottom: 36px;
}

.auth h1 {
  font-size: 30px;
  line-height: 1.15;
  margin: 0 0 8px;
  letter-spacing: -0.02em;
}

.auth-sub {
  margin: 0 0 28px;
  color: var(--ui-text-2);
  font-size: 15px;
}

/* Deep Blue is the authority colour; the email route is the same geometry, quieter fill. */
.auth-btn-wide {
  width: 100%;
  gap: 10px;
  padding: 11px 18px;
}

.auth-google {
  margin: 0 0 4px;
}

.auth-divider {
  display: flex;
  align-items: center;
  gap: 12px;
  margin: 20px 0;
  color: var(--ui-text-3);
  font-size: 13px;
}

.auth-divider::before,
.auth-divider::after {
  content: '';
  flex: 1;
  height: 1px;
  background: var(--ui-line);
}

.auth-email {
  margin: 0;
}

.auth-label {
  display: block;
  font-size: 14px;
  font-weight: 500;
  margin-bottom: 6px;
  color: var(--ui-text);
}

.auth-input {
  width: 100%;
  box-sizing: border-box;
  padding: 10px 12px;
  font: inherit;
  font-size: 15px;
  color: var(--ui-text);
  background: var(--ui-surface);
  border: 1px solid var(--ui-line-strong);
  border-radius: 9px;
}

.auth-input:focus {
  outline: 2px solid var(--ui-brand);
  outline-offset: 1px;
  border-color: var(--ui-brand);
}

.auth-input[aria-invalid='true'] {
  border-color: var(--ui-fail-ink);
}

.auth-note {
  margin: 6px 0 14px;
  font-size: 13px;
  color: var(--ui-text-3);
  min-height: 1em;
}

.auth-legal {
  margin: 26px 0 0;
  font-size: 13px;
  color: var(--ui-text-3);
}

.auth-swap {
  margin: 14px 0 0;
  font-size: 14px;
  color: var(--ui-text-2);
}

/*
 * The shared message strip. Same three tones as the app's `.app-alert`, with the per-hue
 * rest inks tuned rather than thinned by opacity — a supporting line at 3.8:1 over a tint
 * is the bug every hand-rolled version of this strip has shipped.
 */
.app-alert {
  display: block;
  padding: 12px 14px;
  border-radius: 10px;
  border: 1px solid transparent;
  margin: 0 0 22px;
  font-size: 14px;
}

.app-alert .app-alert-title {
  display: block;
  font-weight: 600;
  margin-bottom: 2px;
}

.app-alert.is-fail {
  background: rgba(192, 41, 54, 0.08);
  border-color: rgba(192, 41, 54, 0.3);
}

.app-alert.is-fail .app-alert-title {
  color: #a3222d;
}

.app-alert.is-fail .app-alert-rest {
  color: #7d2129;
}

.app-alert.is-warn {
  background: rgba(176, 106, 0, 0.09);
  border-color: rgba(176, 106, 0, 0.32);
}

.app-alert.is-warn .app-alert-title {
  color: #8a5200;
}

.app-alert.is-warn .app-alert-rest {
  color: #6b4300;
}

.app-alert.is-pass {
  background: rgba(10, 125, 79, 0.08);
  border-color: rgba(10, 125, 79, 0.3);
}

.app-alert.is-pass .app-alert-title {
  color: var(--ui-pass-ink);
}

/* The refusal that has a remedy puts it in the strip, not three paragraphs away. */
.auth-alert-action {
  font-weight: 600;
  white-space: nowrap;
}

/* Right column: type and one hairline. No panel, no boxes — a readout, not a dashboard. */
.auth-aside {
  border-left: 1px solid var(--ui-line);
  padding-left: 40px;
  padding-top: 56px;
}

.auth-aside h2 {
  margin: 0 0 18px;
  font-size: 17px;
  font-weight: 600;
}

.auth-gets {
  list-style: none;
  margin: 0;
  padding: 0;
}

.auth-gets li {
  display: flex;
  gap: 10px;
  margin-bottom: 16px;
  font-size: 14px;
  line-height: 1.55;
  color: var(--ui-text-2);
}

.auth-gets strong {
  color: var(--ui-text);
  font-weight: 600;
}

.auth-tick {
  color: var(--ui-pass-ink);
  font-weight: 700;
  flex: none;
}

.auth-closer {
  margin: 22px 0 0;
  font-size: 13px;
  color: var(--ui-text-3);
}

.auth-card {
  border: 1px solid var(--ui-line);
  background: var(--ui-surface);
  border-radius: 10px;
  padding: 16px 18px;
  font-size: 14px;
  color: var(--ui-text-2);
}

.auth-card p {
  margin: 0;
}

@media (max-width: 860px) {
  .auth {
    grid-template-columns: minmax(0, 1fr);
    gap: 40px;
    padding: 40px 20px 64px;
  }

  /* Stacked, the hairline becomes a rule above rather than a gutter beside. */
  .auth-aside {
    border-left: 0;
    border-top: 1px solid var(--ui-line);
    padding-left: 0;
    padding-top: 28px;
  }
}