/* Standalone auth pages for the password provider — the sign-in form
 * and the first-run init form.
 *
 * These render before any session exists, so they load no app bundle
 * and inherit nothing from the admin shell: this file is the whole
 * stylesheet. Tokens are declared locally for the same reason.
 *
 * The teal is Darwin's sidebar tone from admin.css, repeated here
 * rather than imported so an unauthenticated page never depends on
 * the shell's cascade.
 *
 * ref: darwin/journal/072/2026-09-19_01_password_auth_provider.md §UX.
 */

:root {
  --auth-bg: #f4f6f6;
  --auth-surface: #ffffff;
  --auth-border: #d7dedc;
  --auth-text: #14201d;
  --auth-muted: #5f716c;
  --auth-accent: #0d3a33;
  --auth-accent-hover: #12554a;
  --auth-error: #a62f2f;
  --auth-radius: 8px;
}

html.dark {
  --auth-bg: #0b1512;
  --auth-surface: #12211d;
  --auth-border: #26403a;
  --auth-text: #e6efec;
  --auth-muted: #93a8a2;
  --auth-accent: #2f8073;
  --auth-accent-hover: #3c9a8b;
  --auth-error: #e08585;
}

.auth-page {
  margin: 0;
  min-height: 100vh;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 24px;
  background: var(--auth-bg);
  color: var(--auth-text);
  font-family: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  font-size: 15px;
  line-height: 1.5;
}

.auth-card {
  width: 100%;
  max-width: 380px;
  padding: 32px;
  background: var(--auth-surface);
  border: 1px solid var(--auth-border);
  border-radius: var(--auth-radius);
}

.auth-card__title {
  margin: 0 0 4px;
  font-size: 22px;
  font-weight: 600;
  text-align: center;
}

.auth-card__subtitle {
  margin: 0 0 24px;
  color: var(--auth-muted);
  text-align: center;
}

/* The sign-in page has no subtitle, so its title carries the gap to
 * the form itself. Keyed off the adjacent form rather than
 * :last-of-type, which always matched (each page has exactly one h1)
 * and so also pushed the init page's title away from its subtitle. */
.auth-card__title + .auth-form {
  margin-top: 24px;
}

.auth-form {
  display: flex;
  flex-direction: column;
  gap: 16px;
}

.auth-field {
  display: flex;
  flex-direction: column;
  gap: 6px;
}

.auth-field__label {
  font-size: 13px;
  font-weight: 500;
  color: var(--auth-muted);
}

.auth-field__input {
  padding: 9px 11px;
  font: inherit;
  color: inherit;
  background: var(--auth-surface);
  border: 1px solid var(--auth-border);
  border-radius: 6px;
}

.auth-field__input:focus {
  outline: 2px solid var(--auth-accent);
  outline-offset: -1px;
  border-color: var(--auth-accent);
}

.auth-button {
  padding: 10px 14px;
  font: inherit;
  font-weight: 500;
  color: #ffffff;
  background: var(--auth-accent);
  border: 1px solid transparent;
  border-radius: 6px;
  cursor: pointer;
}

.auth-button:hover {
  background: var(--auth-accent-hover);
}

.auth-button:focus-visible {
  outline: 2px solid var(--auth-accent);
  outline-offset: 2px;
}

.auth-hint {
  margin: 0;
  font-size: 13px;
  color: var(--auth-muted);
}

.auth-message {
  margin: 0;
  font-size: 14px;
}

.auth-message--error {
  color: var(--auth-error);
}

/* Arrival notice — the gate turning a disabled user out
 * (`?reason=disabled`). Informational rather than a rejection, so it
 * is toned apart from `.auth-message--error`.
 * ref: darwin/journal/072/2026-09-19_01_password_auth_provider.md. */

.auth-message--notice {
  color: var(--auth-muted);
}