/* go-auth shared UI — "Ledger" design system: ink + ember. Self-contained
   (no CDN, no build step; served by the auth service itself at
   /assets/auth.css and embedded in the binary, like qrcode.min.js). Light and
   dark palettes switch automatically through prefers-color-scheme — there is
   no manual toggle: the browser's own scheme preference drives every page.
   Shares its token values with web/admin/src/styles.css so the console and
   the sign-in surface read as one product. */

:root {
  color-scheme: light dark;

  /* Rebrand surface: change these four values to configure the auth UI. */
  --brand-primary: #15130f;
  --brand-accent: #d1440c;
  --brand-accent-hover: #ab370a;
  --brand-highlight: #cdeee9;

  /* ── Ledger tokens (light) ─────────────────────────────────────────────── */
  --surface: #faf9f6;
  --surface-lowest: #ffffff;
  --surface-container-low: #f4f2ed;
  --surface-container: #ece8e0;
  --surface-container-high: #e0dbd0;
  --surface-container-highest: #d3ccbd;
  --on-surface: #1a1712;
  --on-surface-variant: #57534a;
  --primary: var(--brand-primary);
  --on-primary: #fdfcf9;
  --primary-container: #241f16;
  --on-primary-container: #a49c86;
  --secondary: var(--brand-accent);
  --on-secondary: #fff9f5;
  --secondary-fixed: #ffe2ce;
  --on-secondary-fixed: #7a2607;
  --tertiary-fixed: var(--brand-highlight);
  --on-tertiary-fixed: #0b4a44;
  --inverse-surface: #2a251c;
  --inverse-on-surface: #f6f2ea;
  --outline: #948e7c;
  --outline-variant: #ddd7c8;
  --error-container: #fbdde1;
  --on-error-container: #7c0d24;
  --success-container: #d9f2e3;
  --on-success-container: #0d5233;
  --warn-container: #fbe8c8;
  --on-warn-container: #6b4108;

  --radius-sm: 8px;
  --radius-md: 12px;
  --radius-lg: 16px;

  --shadow-sm: 0 1px 2px rgba(26, 20, 10, .07);
  --shadow-card: 0 24px 56px rgba(20, 15, 8, .16);
}

@media (prefers-color-scheme: dark) {
  :root {
    --surface: #0c0b09;
    --surface-lowest: #131210;
    --surface-container-low: #17150f;
    --surface-container: #1e1a14;
    --surface-container-high: #28221a;
    --surface-container-highest: #332c22;
    --on-surface: #f4f0e7;
    --on-surface-variant: #b9b2a1;
    --primary: #f7f3ea;            /* inverted: light button, dark text */
    --on-primary: #14120c;
    --primary-container: #211d15;
    --on-primary-container: #9a927e;
    --secondary: #f0703a;
    --on-secondary: #200900;
    --secondary-fixed: #3c1d0d;
    --on-secondary-fixed: #ffd3b4;
    --tertiary-fixed: #113a35;
    --on-tertiary-fixed: #a6ece4;
    --inverse-surface: #f6f2ea;
    --inverse-on-surface: #2a251c;
    --outline: #7a725f;
    --outline-variant: #2c2820;
    --error-container: #3a0e14;
    --on-error-container: #ffd3d9;
    --success-container: #0e3524;
    --on-success-container: #adf2cf;
    --warn-container: #33230a;
    --on-warn-container: #ffdfa3;

    --shadow-sm: 0 1px 2px rgba(0, 0, 0, .5);
    --shadow-card: 0 24px 56px rgba(0, 0, 0, .55);
  }
}

/* ── Base ──────────────────────────────────────────────────────────────── */
* { box-sizing: border-box; }
html { height: 100%; }
body {
  margin: 0; min-height: 100%;
  font-family: "Inter", system-ui, -apple-system, sans-serif;
  background: var(--surface); color: var(--on-surface);
  -webkit-font-smoothing: antialiased;
}
h1, h2, h3 { margin: 0; }
p { margin: 0; }
a { color: var(--secondary); text-decoration: none; }
a:hover { text-decoration: underline; }
button:focus-visible, input:focus-visible, textarea:focus-visible, summary:focus-visible, a:focus-visible { outline: 3px solid color-mix(in srgb, var(--secondary) 32%, transparent); outline-offset: 2px; }
::selection { background: var(--secondary); color: var(--on-secondary); }
[hidden] { display: none !important; }
code { font-family: "JetBrains Mono", ui-monospace, "SF Mono", Menlo, Consolas, monospace; }
.auth-shader-background { position: fixed; inset: 0; z-index: 0; width: 100%; height: 100%; display: block; pointer-events: none; background: radial-gradient(circle at 72% 22%, rgba(167,52,14,.11), transparent 28%), #0c0b09; }
.auth-shell { position: relative; z-index: 1; }

/* ── Page shells ──────────────────────────────────────────────────────── */
.auth-shell {
  min-height: 100vh; display: flex; align-items: center; justify-content: center;
  padding: 24px;
}

/* Two-panel split card (login): form on the left, identity panel on the right */
.auth-card {
  width: 100%; max-width: 1100px; margin: auto;
  display: flex; flex-direction: column;
  background: color-mix(in srgb, var(--surface-lowest) 80%, transparent); color: var(--on-surface);
  border-radius: var(--radius-lg); overflow: hidden;
  box-shadow: var(--shadow-card);
  border: 1px solid var(--outline-variant);
  -webkit-backdrop-filter: blur(18px);
  backdrop-filter: blur(18px);
}
@media (min-width: 1024px) {
  .auth-card { flex-direction: row; }
}
.auth-left {
  width: 100%; flex-shrink: 0; padding: 40px 32px;
  display: flex; flex-direction: column; justify-content: center;
}
@media (min-width: 1024px) {
  .auth-left { width: 460px; padding: 60px; }
}
.auth-right {
  display: none; position: relative; flex: 1; overflow: hidden;
  background: color-mix(in srgb, var(--primary) 78%, transparent);
}
/* Faint blueprint dot-grid — an engineering-drawing texture rather than a
   glassy gradient blob, in keeping with the flat, hairline-first system. */
.auth-right::before {
  content: ""; position: absolute; inset: 0;
  background-image: radial-gradient(color-mix(in srgb, var(--on-primary) 14%, transparent) 1.4px, transparent 1.4px);
  background-size: 26px 26px;
  -webkit-mask-image: radial-gradient(circle at 78% 22%, black, transparent 72%);
  mask-image: radial-gradient(circle at 78% 22%, black, transparent 72%);
}
.auth-right::after {
  content: ""; position: absolute; inset: 0;
  background: linear-gradient(to top, color-mix(in srgb, var(--primary) 92%, black) 0%, transparent 55%);
  pointer-events: none;
}
@media (min-width: 1024px) {
  .auth-right { display: block; }
}

/* Brand header */
.brand-icon {
  width: 46px; height: 46px; border-radius: var(--radius-md);
  background: var(--secondary); color: var(--on-secondary);
  display: flex; align-items: center; justify-content: center;
  margin-bottom: 24px;
}
.brand-icon svg { width: 25px; height: 25px; }
.headline { font-size: 25px; line-height: 31px; font-weight: 800; letter-spacing: -0.025em; }
.sub { margin-top: 8px; font-size: 14px; line-height: 20px; color: var(--on-surface-variant); }

/* ── Typography helpers ───────────────────────────────────────────────── */
.mono-label {
  font-family: "JetBrains Mono", ui-monospace, monospace;
  font-size: 11px; line-height: 14px; letter-spacing: .08em; font-weight: 600;
  text-transform: uppercase;
}
.muted { color: var(--on-surface-variant); font-size: 13px; }
.hint { color: var(--on-surface-variant); font-size: 12px; margin-top: 14px; text-align: center; line-height: 1.5; }
.auth-links { display: flex; justify-content: center; align-items: center; flex-wrap: wrap; gap: 8px; margin-top: 18px; font-size: 13px; font-weight: 500; }
.auth-links-separator { color: var(--outline); }

/* ── Buttons ──────────────────────────────────────────────────────────── */
.btn {
  display: inline-flex; align-items: center; justify-content: center; gap: 10px;
  width: 100%; padding: 15px 18px;
  border: 0; border-radius: var(--radius-md);
  font: 700 14px/16px "Inter", system-ui, sans-serif; letter-spacing: 0.01em;
  cursor: pointer; transition: background-color .15s ease, filter .15s ease, opacity .15s ease;
  text-decoration: none;
}
.btn:hover { text-decoration: none; filter: brightness(1.05); }
.btn:active { filter: brightness(0.96); }
.btn:disabled { opacity: .55; cursor: default; filter: none; }
.btn svg { width: 18px; height: 18px; flex-shrink: 0; }
.btn .spin { display: none; }
.btn.loading .spin { display: inline-block; animation: spin 1s linear infinite; }
@keyframes spin { to { transform: rotate(360deg); } }

.btn-primary { background: var(--primary); color: var(--on-primary); }
.auth-left form > .btn-primary { margin-top: 8px; }
.btn-accent { background: var(--secondary); color: var(--on-secondary); }
.btn-quiet { background: var(--surface-container); color: var(--on-surface); }
.btn-quiet:hover { background: var(--surface-container-high); }

/* sheen sweep — the passkey CTA's decorative shine */
.btn-shine { position: relative; overflow: hidden; }
.btn-shine::after {
  content: ""; position: absolute; top: 0; left: -100%; width: 60%; height: 100%;
  background: linear-gradient(90deg, transparent, rgba(255, 255, 255, .22), transparent);
  transform: skewX(-18deg); transition: left .6s ease;
}
.btn-shine:hover::after { left: 130%; }

/* pill-size variant for dense surfaces (admin) */
.btn-sm { width: auto; padding: 8px 14px; font-size: 13px; border-radius: var(--radius-sm); font-weight: 600; }
.btn-sm svg { width: 15px; height: 15px; }
.btn-ghost { background: transparent; color: var(--secondary); }
.btn-ghost:hover { background: var(--surface-container); filter: none; }
.btn-danger { background: transparent; color: var(--error-container); }
.btn-danger:hover { background: var(--error-container); color: var(--on-error-container); filter: none; }

/* ── Forms ────────────────────────────────────────────────────────────── */
.field { display: flex; flex-direction: column; gap: 6px; }
.field + .field { margin-top: 18px; }
.field.remember { margin-top: 14px; }
.field .check {
  display: inline-flex; align-items: center; gap: 9px; cursor: pointer;
  font-size: 13px; font-weight: 400; color: var(--on-surface-variant); user-select: none;
}
.field .check input {
  width: 16px; height: 16px; margin: 0; accent-color: var(--secondary); cursor: pointer;
  border-radius: 4px;
}
.field .check:hover { color: var(--on-surface); }
.field label {
  font-size: 12px; line-height: 14px; letter-spacing: .02em; font-weight: 600;
  color: var(--on-surface-variant);
}
.field .row { display: flex; align-items: center; justify-content: space-between; }
.field .row a { font-size: 12px; font-weight: 600; }
input[type="email"], input[type="text"], input[type="password"], textarea {
  width: 100%; padding: 14px 16px;
  background: var(--surface-container); color: var(--on-surface);
  border: 1px solid transparent; border-radius: var(--radius-md);
  font: 400 16px/20px "Inter", system-ui, sans-serif;
  outline: none; transition: background-color .2s ease, box-shadow .2s ease, border-color .2s ease;
}
textarea {
  min-height: 108px;
  resize: vertical;
  font-family: "Inter", system-ui, sans-serif;
}
input::placeholder, textarea::placeholder { color: var(--outline); }
input:focus, textarea:focus {
  background: var(--surface-lowest);
  border-color: var(--secondary);
  box-shadow: 0 0 0 3px color-mix(in srgb, var(--secondary) 22%, transparent);
}
.is-invalid { border-color: var(--error-container) !important; }

/* TOTP / recovery code entry */
.code-input { text-align: center; letter-spacing: .28em; font-variant-numeric: tabular-nums; font-size: 22px; font-family: "JetBrains Mono", ui-monospace, monospace; }

/* ── Alerts ───────────────────────────────────────────────────────────── */
.err, .ok, .warn {
  border-radius: var(--radius-md); padding: 10px 14px;
  font-size: 13px; line-height: 1.45; margin: 14px 0 0;
  border: 1px solid transparent;
}
.auth-left form > .err {
  margin-top: 18px;
  margin-bottom: 8px;
  padding-top: 14px;
  padding-bottom: 14px;
}
.err:empty, .ok:empty, .warn:empty { display: none; }
.err { background: var(--error-container); color: var(--on-error-container); border-color: color-mix(in srgb, var(--error-container) 40%, var(--on-error-container)); }
.ok { background: var(--success-container); color: var(--on-success-container); }
.warn { background: var(--warn-container); color: var(--on-warn-container); }

/* Give the fallback form a calm, brief nudge when passkeys are unavailable. */
.focus-attention {
  animation: focus-attention 650ms ease-out;
}
@keyframes focus-attention {
  0%, 100% { transform: translateX(0); }
  35% { transform: translateX(5px); }
  70% { transform: translateX(-3px); }
}
@media (prefers-reduced-motion: reduce) {
  .focus-attention { animation: none; }
}

/* ── Divider ──────────────────────────────────────────────────────────── */
.divider {
  display: flex; align-items: center; gap: 12px; margin: 22px 0;
  color: var(--on-surface-variant);
  font-family: "JetBrains Mono", ui-monospace, monospace;
  font-size: 10.5px; line-height: 13px; letter-spacing: .1em; font-weight: 600; text-transform: uppercase;
}
.divider::before, .divider::after { content: ""; flex: 1 1 auto; height: 1px; background: var(--outline-variant); }

/* ── Right identity panel: a ledger card, not a glass blob ─────────────── */
.glass-wrap { position: absolute; inset: 0; display: flex; align-items: flex-end; padding: 48px; }
.glass {
  position: relative; width: 100%; max-width: 420px; margin-left: auto;
  padding: 30px; border-radius: var(--radius-lg);
  background: color-mix(in srgb, var(--inverse-on-surface) 6%, transparent);
  border: 1px solid color-mix(in srgb, var(--inverse-on-surface) 16%, transparent);
  color: var(--inverse-on-surface);
}
.glass-head { display: flex; align-items: center; gap: 16px; margin-bottom: 18px; }
.glass-icon {
  width: 46px; height: 46px; border-radius: var(--radius-sm); flex-shrink: 0;
  background: var(--secondary); color: var(--on-secondary);
  display: flex; align-items: center; justify-content: center;
}
.glass-icon svg { width: 23px; height: 23px; }
.glass h3 { font-size: 17px; line-height: 23px; font-weight: 700; color: var(--inverse-on-surface); letter-spacing: -0.01em; }
.glass .mono-label { color: color-mix(in srgb, var(--secondary) 55%, var(--inverse-on-surface) 45%); margin-top: 4px; }
.glass-body { font-size: 14.5px; line-height: 23px; color: color-mix(in srgb, var(--inverse-on-surface) 78%, transparent); margin-bottom: 22px; }
.status-chips { display: flex; flex-wrap: wrap; gap: 8px; }
.chip {
  display: inline-flex; align-items: center; gap: 7px;
  padding: 6px 12px; border-radius: var(--radius-sm);
  background: color-mix(in srgb, var(--inverse-on-surface) 10%, transparent);
  border: 1px solid color-mix(in srgb, var(--inverse-on-surface) 14%, transparent);
  color: var(--inverse-on-surface);
  font-family: "JetBrains Mono", ui-monospace, monospace;
  font-size: 10.5px; line-height: 13px; letter-spacing: .05em; font-weight: 600; text-transform: uppercase;
}
.chip .dot { width: 6px; height: 6px; border-radius: 50%; background: var(--secondary); animation: pulse 2s ease-in-out infinite; }
@keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: .35; } }
.chip svg { width: 13px; height: 13px; color: var(--secondary); }

/* ── Single-column card (TOTP pages, recovery) ───────────────────────── */
.panel {
  width: 100%; max-width: 440px; margin: auto;
  background: color-mix(in srgb, var(--surface-lowest) 80%, transparent); color: var(--on-surface);
  border: 1px solid var(--outline-variant); border-radius: var(--radius-lg);
  padding: 36px; box-shadow: var(--shadow-card); position: relative;
  -webkit-backdrop-filter: blur(18px);
  backdrop-filter: blur(18px);
}
.panel::before {
  content: ""; display: block; width: 30px; height: 5px; margin-bottom: 26px;
  border-radius: 999px; background: var(--secondary);
}
@media (max-width: 520px) {
  .auth-shell { padding: 14px; align-items: flex-start; padding-top: 28px; }
  .auth-left, .panel { padding: 28px 22px; }
  .panel::before { margin-bottom: 22px; }
}
.panel form { margin-top: 20px; }
.panel form button { margin-top: 8px; }
.panel details { margin-top: 20px; }
.panel details summary {
  cursor: pointer; color: var(--secondary); font-size: 13px; font-weight: 700;
}
.panel details .sub { margin-top: 10px; }
.qr {
  display: flex; justify-content: center; align-items: center;
  background: #fff; border: 1px solid var(--outline-variant);
  border-radius: var(--radius-md); padding: 16px; margin-bottom: 16px;
}
.qr svg { display: block; width: 200px; height: 200px; }
.uri {
  background: var(--surface-container); border: 1px dashed var(--outline-variant);
  border-radius: var(--radius-sm); padding: 10px 12px;
  font-family: "JetBrains Mono", ui-monospace, "SF Mono", Menlo, Consolas, monospace; font-size: 11px;
  word-break: break-all; margin-bottom: 16px; user-select: all;
}
.uri-tools, .uri-actions { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
.uri-tools .caption { margin-bottom: 6px; }
.uri-actions { justify-content: flex-start; margin: -8px 0 16px; }
.text-link { color: var(--secondary); font-size: 12px; font-weight: 700; }
.copy-status { color: var(--on-surface-variant); font-size: 12px; }
.caption {
  display: block; font-size: 11px; line-height: 14px; letter-spacing: .04em;
  text-transform: uppercase; font-weight: 700; color: var(--on-surface-variant); margin: 0 0 6px;
}
.codes {
  background: var(--surface-container); border: 1px dashed var(--outline-variant);
  border-radius: var(--radius-md); padding: 14px 16px; margin: 16px 0;
  font-family: "JetBrains Mono", ui-monospace, "SF Mono", Menlo, Consolas, monospace; font-size: 14px;
  line-height: 1.9; user-select: all;
}

/* ── Admin (UsersManager) ─────────────────────────────────────────────── */
.admin-page { min-height: 100vh; }
@media (min-width: 1024px) {
  .admin-page .shell { padding-left: 272px; }
}

/* left rail: brand + nav + profile */
.rail {
  position: fixed; top: 0; bottom: 0; left: 0; width: 272px; z-index: 50;
  background: var(--primary); color: var(--on-primary-container);
  border-right: 1px solid color-mix(in srgb, var(--on-primary) 12%, transparent);
  display: flex; flex-direction: column; padding: 24px 16px;
}
@media (max-width: 1023.98px) { .rail { display: none; } }
.rail .brand { display: flex; align-items: center; gap: 12px; padding: 0 12px 32px; }
.rail .brand .logo {
  width: 36px; height: 36px; border-radius: var(--radius-sm); flex-shrink: 0;
  background: var(--secondary); color: var(--on-secondary);
  display: flex; align-items: center; justify-content: center;
}
.rail .brand .logo svg { width: 20px; height: 20px; }
.rail .brand b { font-size: 17px; font-weight: 700; color: var(--on-primary); }
.rail nav { flex: 1; display: flex; flex-direction: column; gap: 2px; }
.nav-item {
  display: flex; align-items: center; gap: 12px; padding: 11px 14px;
  border-radius: var(--radius-md); text-decoration: none;
  color: color-mix(in srgb, var(--on-primary) 62%, transparent); font-size: 14px; font-weight: 500;
  transition: background-color .15s ease, color .15s ease;
}
.nav-item svg { width: 19px; height: 19px; flex-shrink: 0; }
.nav-item:hover { background: color-mix(in srgb, var(--on-primary) 8%, transparent); color: var(--on-primary); text-decoration: none; }
.nav-item.active { background: var(--secondary); color: var(--on-secondary); }
.nav-item.muted { opacity: .55; cursor: default; pointer-events: none; }
.nav-item .soon {
  margin-left: auto; font-size: 10px; font-weight: 700; letter-spacing: .06em; text-transform: uppercase;
  color: color-mix(in srgb, var(--on-primary) 60%, transparent); border: 1px solid color-mix(in srgb, var(--on-primary) 20%, transparent);
  border-radius: 999px; padding: 2px 8px;
}
.rail .profile {
  margin-top: 16px; padding: 16px 12px 0; border-top: 1px solid color-mix(in srgb, var(--on-primary) 12%, transparent);
  display: flex; align-items: center; gap: 12px;
}
.avatar {
  width: 40px; height: 40px; border-radius: 50%; flex-shrink: 0;
  background: var(--secondary-fixed); color: var(--secondary);
  display: flex; align-items: center; justify-content: center;
  font-size: 13px; font-weight: 700; letter-spacing: .02em;
}
.rail .profile .who { min-width: 0; }
.rail .profile .who b { display: block; font-size: 14px; font-weight: 600; color: var(--on-primary); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.rail .profile .who span { display: block; font-size: 12px; color: color-mix(in srgb, var(--on-primary) 55%, transparent); }

/* page frame under the rail — near full width so the user table (and audit
   table) get the space they need; the side column is a fixed 340px rail. */
.page-frame { padding: 32px 40px 56px; max-width: 1680px; margin: 0 auto; }
@media (max-width: 1023.98px) { .page-frame { padding: 24px 16px 48px; } }
.page-head { display: flex; align-items: flex-end; justify-content: space-between; gap: 16px; flex-wrap: wrap; margin-bottom: 24px; }
.page-head h1 { font-size: 29px; line-height: 37px; font-weight: 800; letter-spacing: -0.03em; }
.page-head .sub { font-size: 15px; line-height: 22px; color: var(--on-surface-variant); margin-top: 6px; }

/* toolbar: search + filters */
.toolbar {
  display: flex; align-items: center; justify-content: space-between; gap: 14px; flex-wrap: wrap;
  padding: 16px; margin-bottom: 16px;
  background: var(--surface-container-low); border: 1px solid var(--outline-variant);
  border-radius: var(--radius-md);
}
.search { position: relative; flex: 1 1 240px; max-width: 420px; }
.search svg {
  position: absolute; left: 12px; top: 50%; transform: translateY(-50%);
  width: 17px; height: 17px; color: var(--on-surface-variant); pointer-events: none;
}
.search input { padding-left: 38px; }
.filters { display: flex; gap: 10px; flex-wrap: wrap; }
select.filter {
  appearance: none; -webkit-appearance: none;
  padding: 11px 34px 11px 14px; border: 1px solid var(--outline-variant);
  border-radius: var(--radius-md); background: var(--surface-lowest); color: var(--on-surface);
  font: 500 13px/16px "Inter", system-ui, sans-serif; cursor: pointer;
  background-image: url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' width='14' height='14' viewBox='0 0 24 24' fill='none' stroke='%23948e7c' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M6 9l6 6 6-6'/%3E%3C/svg%3E");
  background-repeat: no-repeat; background-position: right 12px center;
}
select.filter:focus { outline: 2px solid color-mix(in srgb, var(--secondary) 30%, transparent); outline-offset: 1px; }

/* data card: table + pager */
.data-card {
  background: var(--surface-lowest); border: 1px solid var(--outline-variant);
  border-radius: var(--radius-lg); overflow: hidden; box-shadow: var(--shadow-sm);
}
.ta { width: 100%; border-collapse: collapse; font-size: 14px; }
.ta thead th {
  text-align: left; padding: 14px 20px; font-size: 10.5px; text-transform: uppercase; letter-spacing: .08em;
  color: var(--on-surface-variant); font-weight: 700;
  background: var(--surface-container-low); border-bottom: 1px solid var(--outline-variant);
}
.ta th.num, .ta td.num { text-align: right; }
.ta tbody td { padding: 16px 20px; border-bottom: 1px solid var(--outline-variant); vertical-align: middle; }
.ta tbody tr:last-child td { border-bottom: 0; }
.ta tbody tr { transition: background-color .15s ease; }
.ta tbody tr:hover { background: var(--surface-container-low); }
.user-cell { display: flex; align-items: center; gap: 14px; min-width: 0; }
.user-cell .who { min-width: 0; }
.user-cell .who b { display: block; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.user-cell .who span { font-size: 13px; color: var(--on-surface-variant); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.badge {
  display: inline-flex; align-items: center; gap: 7px; padding: 4px 11px;
  border-radius: var(--radius-sm); font-size: 12px; font-weight: 600;
}
.badge .dot { width: 7px; height: 7px; border-radius: 50%; }
.badge.ok { background: var(--success-container); color: var(--on-success-container); }
.badge.ok .dot { background: var(--on-success-container); }
.badge.warn { background: var(--warn-container); color: var(--on-warn-container); }
.badge.warn .dot { background: var(--on-warn-container); }
.badge.off { background: var(--error-container); color: var(--on-error-container); }
.badge.off .dot { background: var(--on-error-container); }
.badge.neutral { background: var(--surface-container); color: var(--on-surface-variant); }
.ta .actions { white-space: nowrap; text-align: right; }
.ta .actions .btn-sm { margin-left: 4px; }
.pager {
  display: flex; align-items: center; justify-content: space-between; gap: 12px;
  padding: 14px 20px; border-top: 1px solid var(--outline-variant);
  font-size: 13px; color: var(--on-surface-variant);
}
.pager .pgs { display: flex; gap: 4px; align-items: center; }
.pager .pgs button {
  min-width: 32px; height: 32px; padding: 0 8px; border: 0; border-radius: var(--radius-sm);
  background: transparent; color: var(--on-surface); font: 600 13px/1 "Inter", system-ui;
  cursor: pointer; transition: background-color .15s ease;
}
.pager .pgs button:hover { background: var(--surface-container); }
.pager .pgs button.cur { background: var(--primary); color: var(--on-primary); }
.pager .pgs button:disabled { opacity: .4; cursor: default; }

/* right column: security health + activity */
.dash-grid { display: grid; grid-template-columns: 1fr; gap: 20px; margin-top: 16px; }
@media (min-width: 1024px) { .dash-grid { grid-template-columns: minmax(0, 1fr) minmax(0, 340px); } }
.health-card {
  background: var(--primary-container); color: var(--on-primary-container);
  border-radius: var(--radius-lg); padding: 24px; position: relative; overflow: hidden;
}
.health-card h3 { position: relative; font-size: 17px; font-weight: 700; color: var(--inverse-on-surface); }
.health-card .sub { position: relative; font-size: 13px; margin-top: 4px; opacity: .85; }
.ring { position: relative; width: 120px; height: 120px; margin: 20px auto 8px; }
.ring svg { transform: rotate(-90deg); }
.ring .track { stroke: color-mix(in srgb, var(--inverse-on-surface) 16%, transparent); }
.ring .fill {
  stroke: var(--secondary);
  transition: stroke-dashoffset 1.2s ease-out;
}
.ring .center {
  position: absolute; inset: 0; display: flex; flex-direction: column; align-items: center; justify-content: center;
}
.ring .center b { font-size: 28px; font-weight: 800; color: var(--inverse-on-surface); line-height: 1; }
.ring .center span { font-size: 11px; color: var(--on-primary-container); margin-top: 3px; }
.legend { margin-top: 16px; display: flex; flex-direction: column; gap: 10px; }
.legend .row { display: flex; align-items: center; justify-content: space-between; gap: 10px; font-size: 13px; }
.legend .k { display: flex; align-items: center; gap: 8px; }
.legend .dot { width: 9px; height: 9px; border-radius: 50%; }
.legend .v { font-weight: 600; font-variant-numeric: tabular-nums; }
.legend .dot.mint { background: var(--secondary); }
.legend .dot.indigo { background: var(--tertiary-fixed); }
.legend .dot.red { background: #ff5c72; }
.side-card { background: var(--surface-lowest); border: 1px solid var(--outline-variant); border-radius: var(--radius-lg); padding: 20px; box-shadow: var(--shadow-sm); }
.side-card h3 { font-size: 12px; font-weight: 700; text-transform: uppercase; letter-spacing: .08em; color: var(--on-surface-variant); margin-bottom: 4px; }
.empty-state { text-align: center; color: var(--on-surface-variant); padding: 40px 16px; font-size: 14px; }
.empty-state .big { font-size: 30px; margin-bottom: 8px; opacity: .5; }

/* modal (one-time secret / recovery reveal / invite) */
.modal-bg {
  display: none; position: fixed; inset: 0; background: rgba(15, 12, 7, .6); z-index: 100;
  place-items: center; padding: 16px;
}
.modal {
  background: var(--surface-lowest); color: var(--on-surface);
  border-radius: var(--radius-lg); max-width: 560px; width: 100%;
  max-height: 85vh; overflow: auto; padding: 28px;
  box-shadow: var(--shadow-card); border: 1px solid var(--outline-variant);
}
.modal h2 { font-size: 18px; line-height: 24px; font-weight: 700; margin-bottom: 6px; }
.modal .sub { margin-bottom: 16px; }
.modal .field + .field, .modal form .field { margin-top: 14px; }
.modal form { display: flex; flex-direction: column; }
.modal pre {
  font-family: "JetBrains Mono", ui-monospace, "SF Mono", Menlo, Consolas, monospace; font-size: 12px;
  background: var(--surface-container); border: 1px dashed var(--outline-variant);
  border-radius: var(--radius-sm); padding: 12px; margin: 12px 0;
  white-space: pre-wrap; word-break: break-all; user-select: all;
}
.modal .btn { width: auto; margin-top: 16px; }
.modal .btn + .btn { margin-left: 8px; }
.modal label.inline { display: flex; align-items: center; gap: 8px; font-size: 14px; color: var(--on-surface); }
.modal label.inline input { width: auto; }
/* ── Device sign-in (RFC 8628 approval + completed pages) ─────────────── */
/* The verify page's meta box: what the device asks for, and who is asking. */
.device-meta {
  background: var(--surface-container-low); border: 1px solid var(--outline-variant);
  border-radius: var(--radius-md); padding: 14px 16px; margin-top: 18px;
}
.device-meta .caption { margin-bottom: 8px; }
.device-who {
  font: 600 14px/20px "Inter", system-ui, sans-serif; color: var(--on-surface);
  word-break: break-all;
}
.device-meta .warn { margin-top: 12px; }
.scope-badges { display: flex; flex-wrap: wrap; gap: 8px; }
.scope-badge {
  display: inline-flex; align-items: center; padding: 5px 12px; border-radius: var(--radius-sm);
  background: var(--surface-container); border: 1px solid var(--outline-variant);
  color: var(--on-surface); font: 600 12px/14px "JetBrains Mono", ui-monospace, monospace;
}
/* Approve / deny sit side by side; deny is the quiet secondary action. */
.device-actions { display: flex; gap: 10px; margin-top: 20px; }
.device-actions .btn { margin-top: 0; }
/* Live status line under the code field (overrides .hint's centering). */
.status { text-align: left; font-size: 13px; line-height: 18px; margin-top: 10px; color: var(--on-surface-variant); }
.status.good { color: var(--on-success-container); }
.status.bad { color: var(--on-error-container); }
/* Completed page: a big result glyph over the headline. */
.device-done { text-align: center; }
.device-done .sub b { font-weight: 700; }
.result-icon {
  width: 64px; height: 64px; border-radius: 50%; margin: 0 auto 22px;
  display: flex; align-items: center; justify-content: center;
  background: var(--surface-container); color: var(--on-surface-variant);
}
.result-icon svg { width: 30px; height: 30px; }
.result-icon.ok { background: var(--success-container); color: var(--on-success-container); }
.result-icon.off { background: var(--error-container); color: var(--on-error-container); }
.device-done .hint b { font-variant-numeric: tabular-nums; }
.device-done .device-meta { text-align: left; }

/* Account-specific sign-in choices: one column, large touch targets. */
.method-panel { max-width: 480px; }
.method-panel .headline { text-wrap: balance; }
.method-options { display: grid; gap: 12px; margin: 24px 0; }
.method-option { display: flex; align-items: center; gap: 16px; width: 100%; padding: 22px 18px; border: 1px solid var(--outline, #9b9389); border-radius: 14px; background: transparent; color: inherit; text-align: left; text-decoration: none; cursor: pointer; font: inherit; transition: background 160ms, border-color 160ms; }
.method-option > svg { width: 30px; height: 30px; flex-shrink: 0; }
.method-option > span:nth-child(2) { flex: 1; }
.method-option strong { display: block; font-size: 17px; line-height: 1.4; }
.method-option small { display: block; margin-top: 5px; font-size: 13px; line-height: 1.6; opacity: .8; }
.method-preferred { border-color: #b57838; background: #b578380d; }
.method-option:hover { background: #b5783818; }
.method-option:focus-visible, .browser-help summary:focus-visible { outline: 3px solid #b57838; outline-offset: 4px; }
.method-option:disabled { opacity: .6; cursor: default; }
.method-tag { display: inline-block; margin-top: 12px; font-size: 11px; letter-spacing: .025em; opacity: .75; }
.browser-help { margin: 20px 0; font-size: 13px; line-height: 1.7; }
.browser-help summary { cursor: pointer; font-weight: 600; }
.browser-help p { margin-top: 10px; }
[hidden] { display: none !important; }
.mobile-setup { margin: 20px 0; }
@media (max-width: 600px) { .totp-enrollment .mobile-setup { display: block; } .totp-enrollment .qr-details { margin-top: 20px; } .method-option { padding: 20px 14px; gap: 12px; } }