/* The sign-in page. Deliberately the only screen with no navigation: there is
 * nothing to navigate to until the browser has an account.
 *
 * The page background and the field background named `--bg-app` and
 * `--bg-inset` until AIP-11, and tokens.css defines neither. An undefined
 * custom property is not an error the browser reports: the declaration is
 * dropped, so the page fell through to `html` and the field fell through to
 * the card, and the contrast the tests assert was not the contrast being
 * painted. Both now name the token that reproduces exactly what shipped —
 * giving the field a genuinely sunken tone is a design change, not this one. */

body {
  min-height: 100vh;
  display: grid;
  place-items: center;
  background: var(--bg-canvas);
  color: var(--text-primary);
  padding: var(--step-4);
}

.signin { width: min(380px, 100%); }

.card {
  display: flex;
  flex-direction: column;
  gap: var(--step-3);
  padding: var(--step-6);
  border: 1px solid var(--border-subtle);
  border-radius: var(--radius-lg);
  background: var(--bg-surface);
}

/* `display: flex` above outranks the browser's own `[hidden] { display: none }`,
   so the second-factor card would otherwise sit on screen from the first paint,
   asking for a code before anyone has typed a password. */
.card[hidden] { display: none; }

/* The operator's password form and the customer's Clerk widget share this
 * card, so a descendant selector written for one lands on the other: Clerk's
 * own heading, labels and email field were being painted by the rules below,
 * which is how a dark field ended up inside Clerk's white card and unreadable
 * (AIP-103). These four are the ones with a Clerk counterpart, so they name
 * the form's own children; the widget is dressed through Clerk's appearance
 * API in portal-sign-in.js instead. */
.card > h1 { font-size: 20px; }
.card .sub { color: var(--text-muted); font-size: 13px; margin-top: -6px; }

.card > label {
  font-size: 12px;
  color: var(--text-secondary);
  margin-bottom: -6px;
}

.card > input {
  background: var(--bg-surface);
  color: var(--text-primary);
  border: 1px solid var(--border-subtle);
  border-radius: var(--radius-md);
  padding: 10px var(--step-3);
  font: inherit;
  font-size: 14px;
}
.card > input:focus-visible { border-color: var(--accent-blue); }

/* Where Clerk's component lands. It arrives sized by Clerk — the card box
 * computes to a fixed 350px against the 316px of content box this card gives
 * it — so it hung 34px past both edges and scrolled the page sideways at
 * 390px. A flex item will not shrink below its own content either, so the
 * floor has to be released here before the width handed to Clerk in
 * portal-sign-in.js can take. Nothing is positioned: the overhang was width
 * overflow, and floating the widget would hide it rather than fix it. */
#sign-in { width: 100%; min-width: 0; }

/* Two data attributes naming the Clerk instance, not something to look at.
 * Left displayed it is an empty flex item that still takes a row and a gap —
 * part of the dead band between the intro copy and the widget. */
#clerk-config { display: none; }

.card button.primary {
  margin-top: var(--step-2);
  padding: 10px var(--step-3);
  border: 0;
  border-radius: var(--radius-md);
  background: var(--accent-blue);
  /* White on the dark theme's blue is 2.78:1, so the ink comes from the
     palette (--on-accent: dark ink there, white on the light theme's deep
     blue) and matches the signed-in shell's primary button. */
  color: var(--on-accent);
  font: inherit;
  font-size: 14px;
  font-weight: 600;
  cursor: pointer;
}
.card button.primary:disabled { opacity: 0.6; cursor: default; }
/* The customer page's way out when Clerk does not come up, pressed with a
   finger on a phone: the padding above makes it 40px, under the 44 a
   fingertip needs. */
#retry { min-height: 44px; }

.card button.secondary {
  padding: 10px var(--step-3);
  border: 1px solid var(--border-subtle);
  border-radius: var(--radius-md);
  background: transparent;
  color: var(--text-secondary);
  font: inherit;
  font-size: 13px;
  cursor: pointer;
}
.card button.secondary:disabled { opacity: 0.6; cursor: default; }

.message { min-height: 18px; font-size: 13px; color: var(--accent-red); }
.message.ok { color: var(--accent-green); }
/* Progress, not a verdict. In the line's own red, the customer page's
   "Loading the sign-in form…" read as a failure before anything had failed
   (FE-013). */
.message.info { color: var(--text-secondary); }

/* The recovery codes. Someone is copying these into a password manager by
   hand, so they get the monospaced face the rest of the platform uses for
   anything transcribed, and select whole rather than by word. */
#codes-list {
  list-style: none;
  display: grid;
  gap: var(--step-1);
  margin: 0;
  padding: var(--step-3);
  border: 1px solid var(--border-subtle);
  border-radius: var(--radius-md);
  font-family: var(--font-mono);
  font-size: 14px;
  user-select: all;
}