/* ============================================================
   TrapIt · auth pages (_AuthLayout)

   One card, five states: log in, sign up, a provider that came back without a grant,
   a returnUrl being resumed, and signed out. They share every measurement — only the
   copy and which blocks are present change — so this file styles the card once and
   the states are additive slots rather than variants.

   Dark-only, like the rest of the public surface. No .ds-app: that pins itself to the
   viewport and hides overflow, and this page has to scroll when the error banner and
   the resume panel both land on a short window.
   ============================================================ */

/* Flex rather than grid: an auto-sized grid column takes its width from the card, so the card's
   max-width:100% would resolve against its own 380px and never clamp — a phone got a 380px card
   in a 343px column and the page scrolled sideways. A flex item resolves it against the
   container. min-height (not height) so a tall card grows the page instead of being clipped by
   the centring. */
.auth {
  min-height: 100vh;
  background: var(--ds-bg-sunken);
  display: flex;
  align-items: center;
  justify-content: center;
  padding: var(--ds-space-6) var(--ds-space-4);
}

.auth__card {
  width: 380px;
  max-width: 100%;
  background: var(--ds-surface);
  border: 1px solid var(--ds-border);
  border-radius: var(--ds-radius-xl);
  box-shadow: var(--ds-shadow-lg);
  padding: 32px 30px 26px;
  display: flex;
  flex-direction: column;
}

/* Links in the card are links — .ds-btn opts out of underline, these want it on hover.
   Scoped to .auth so it cannot leak into the shells that set their own. */
.auth a { color: var(--ds-link); text-decoration: none; }
.auth a:hover { color: var(--ds-text); text-decoration: underline; }

/* ---------- head ---------- */
.auth__head {
  display: flex;
  flex-direction: column;
  align-items: center;
  text-align: center;
}

/* The lockup's wordmark is fill="currentColor" — this is what makes it the theme's text
   colour. app.css does the same for the shells under .app-logo; auth.css does not load it. */
.auth__logo { display: inline-flex; color: var(--ds-text); }
.auth__logo .app-logo__lockup { display: block; }

.auth__title {
  font-family: var(--ds-font-display);
  font-weight: var(--ds-weight-display);
  font-size: 24px;
  letter-spacing: -0.02em;
  margin: 22px 0 0;
}

/* The signed-out state is the only one with a subtitle: it is the only one that has
   something to report rather than something to ask. */
.auth__sub {
  color: var(--ds-text-muted);
  font-size: 14.5px;
  line-height: 1.5;
  margin: 8px 0 0;
}

.auth__pill { margin-top: 20px; }
.auth__pill + .auth__title { margin-top: 14px; }

/* ---------- provider buttons ---------- */
.auth__options {
  display: flex;
  flex-direction: column;
  gap: 11px;
  margin-top: 26px;
}

/* Anything between the head and the buttons — banner, resume panel — already carries
   its own breathing room, so the stack tightens up behind it. */
.auth__banner + .auth__options,
.auth__resume + .auth__options { margin-top: 18px; }

.auth__banner { margin-top: 20px; }

/* The code and request id under the banner copy: quotable in a bug report, and quiet
   enough that it is not competing with the sentence above it. */
.auth__banner-meta {
  display: flex;
  flex-direction: column;
  gap: 2px;
  font-family: var(--ds-font-mono);
  font-size: 11.5px;
  color: var(--ds-text-faint);
  margin-top: var(--ds-space-2);
  letter-spacing: 0.01em;
}
/* The id is the part someone copies into a bug report, so it gets a line it cannot be
   broken across, and one wide enough to hold all 32 characters of it. */
.auth__banner-meta span { white-space: nowrap; }
.auth__banner-id { color: var(--ds-text-muted); user-select: all; }

/* The dev bypass never ships to a user — warn-coloured and mono so it can never be
   mistaken for one of the real providers in a screenshot. */
.auth__dev {
  color: var(--ds-warn);
  border-color: color-mix(in srgb, var(--ds-warn) 45%, transparent);
  font-family: var(--ds-font-mono);
  font-size: 13px;
}

/* Provider marks keep their own brand colours (Google's is multicolour), so unlike
   .ds-btn svg they must not inherit currentColor. Sized to match. */
.auth__mark { width: 18px; height: 18px; flex: 0 0 auto; }

/* ---------- resume panel ---------- */
/* Naming the destination is the whole point: "grant this to the wrong workspace" is the
   mistake this panel exists to prevent, so the URL is shown verbatim and truncated
   rather than summarised. */
.auth__resume {
  margin-top: 18px;
  display: flex;
  flex-direction: column;
  gap: var(--ds-space-2);
  background: var(--ds-surface-2);
  border: 1px solid var(--ds-border);
  border-radius: var(--ds-radius-md);
  padding: 12px 13px;
}

.auth__resume-label {
  font-family: var(--ds-font-mono);
  font-size: 10.5px;
  font-weight: var(--ds-weight-bold);
  letter-spacing: var(--ds-tracking-label);
  text-transform: uppercase;
  color: var(--ds-text-faint);
}

.auth__resume-url {
  font-family: var(--ds-font-mono);
  font-size: 12.5px;
  color: var(--ds-text);
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}

.auth__resume-who {
  display: inline-flex;
  align-items: center;
  gap: 7px;
  font-size: 12.5px;
  color: var(--ds-text-muted);
  min-width: 0;
}

.auth__resume-host {
  font-family: var(--ds-font-mono);
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}

/* ---------- foot ---------- */
.auth__foot {
  border-top: 1px solid var(--ds-border);
  margin-top: 22px;
  padding-top: 16px;
  display: flex;
  flex-direction: column;
  align-items: center;
  gap: 10px;
}

.auth__cross { font-size: 13.5px; color: var(--ds-text-muted); margin: 0; }
.auth__cross a { font-weight: var(--ds-weight-semibold); }

.auth__home {
  font-family: var(--ds-font-mono);
  font-size: 12px;
}
.auth .auth__home { color: var(--ds-text-faint); }
.auth .auth__home:hover { color: var(--ds-text); }

/* ---------- no providers configured ---------- */
/* A local checkout with no OAuth secrets and the dev bypass off. Says what to set
   rather than showing an empty card. */
.auth__none {
  color: var(--ds-text-muted);
  font-size: 13px;
  line-height: 1.55;
  margin: 26px 0 0;
  text-align: center;
}
.auth__none code { font-family: var(--ds-font-mono); font-size: 12.5px; color: var(--ds-text); }

@media (max-width: 480px) {
  .auth { padding: var(--ds-space-4); align-items: start; }
  .auth__card { padding: 26px 20px 22px; }
}