/* breakglass web UI. One flow, no framework. The 2am rules: big targets, big password,
   high contrast, nothing decorative past the sign-in screen. */

@font-face {
  font-family: "IBM Plex Mono";
  src: url("/static/fonts/IBMPlexMono-Regular.woff2") format("woff2");
  font-weight: 400; font-display: swap;
}
@font-face {
  font-family: "IBM Plex Mono";
  src: url("/static/fonts/IBMPlexMono-SemiBold.woff2") format("woff2");
  font-weight: 600; font-display: swap;
}

:root {
  --bg: #101216; --fg: #e8eaed; --muted: #9aa0a6;
  --accent: #d33; --box: #1a1d23; --ok: #7bd88f;
  --hint: #ef6a6a; /* accent is ~4.1:1 on the dark bg; hints are small text and need AA (4.5:1) */
  --mono: "IBM Plex Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
}
@media (prefers-color-scheme: light) {
  :root { --bg: #f6f7f8; --fg: #17181a; --muted: #5f6368; --box: #ffffff; --hint: #b02525; }
}

* { box-sizing: border-box; }
body {
  margin: 0; background: var(--bg); color: var(--fg);
  font: 16px/1.5 system-ui, sans-serif;
  min-height: 100dvh; display: grid; place-items: center;
}
main { width: min(40rem, 100vw - 2rem); padding: 1rem; }

/* exactly one state visible, driven by data-state on <main> */
.state { display: none; }
main[data-state="loading"] .state-loading,
main[data-state="signin"]  .state-signin,
main[data-state="form"]    .state-form,
main[data-state="result"]  .state-result,
main[data-state="error"]   .state-error { display: block; }

.logo {
  max-width: min(16rem, 60vw); display: block; margin: 0 auto 1rem;
  /* Edges fade to transparent (not to a color), so the photo melts into the page background
     in both themes without baking a vignette into the JPEG. */
  /* Rectangular fade: two intersected linear gradients keep the full center visible (the
     subject fills the frame edge to edge) and melt only a thin border into the page bg. */
  -webkit-mask-image: linear-gradient(to right, transparent, black 12%, black 88%, transparent),
    linear-gradient(to bottom, transparent, black 12%, black 88%, transparent);
  -webkit-mask-composite: source-in;
  mask-image: linear-gradient(to right, transparent, black 12%, black 88%, transparent),
    linear-gradient(to bottom, transparent, black 12%, black 88%, transparent);
  mask-composite: intersect;
}
.state-signin { text-align: center; }
.muted { color: var(--muted); font-size: .85rem; }
h1 { font-size: 1.3rem; }
.note { font-size: .78rem; margin: -.4rem 0 .8rem; text-align: center; }

/* Service identity, every state. The wordmark inherits our red in both themes. */
.brand { display: flex; align-items: center; justify-content: center; gap: .6rem; margin-bottom: 1.4rem; }
.brand svg { height: 1.3rem; width: auto; fill: var(--accent); }
.brand span { font-family: var(--mono); font-weight: 600; letter-spacing: .05em; font-size: 1.4rem; }

input, button {
  font: inherit; padding: .8rem 1rem; border-radius: 8px;
  border: 1px solid var(--muted); min-height: 3rem; /* touch target */
}
input { width: 100%; background: var(--box); color: var(--fg); font-family: var(--mono); }
form label { display: block; margin-bottom: .3rem; }
button { background: var(--accent); color: #fff; border: none; cursor: pointer; }
button.linklike { background: none; color: var(--muted); text-decoration: underline; min-height: 3rem; }
form button { margin-top: .8rem; width: 100%; }
.hint { min-height: 1.2rem; color: var(--hint); font-size: .85rem; }

.recent { list-style: none; padding: 0; }
.recent li { display: flex; gap: .4rem; margin-top: .4rem; }
.recent li button {
  background: var(--box); color: var(--fg); flex: 1;
  font-family: var(--mono); text-align: left;
}
.recent li button.forget { flex: 0 0 auto; min-width: 3rem; text-align: center; color: var(--muted); }

/* The password: read off a phone while typing on a console. Chunked by JS with spaces;
   letter-spacing keeps 0/O l/1 apart, SemiBold + size does the rest. */
.password-box { position: relative; background: var(--box); border-radius: 8px; padding: 1.2rem; margin: 1rem 0; }
.password {
  font-family: var(--mono); font-weight: 600;
  font-size: clamp(1.3rem, 4.5vw, 2rem);
  letter-spacing: .06em; line-height: 1.7;
}
/* Group gaps are margin, not characters, so selection stays pure. On narrow screens the quad
   wrapper vanishes (display: contents) and groups wrap freely; where a quad is sure to fit it
   becomes atomic, so the only break opportunity is the 4/4 seam. */
.password .quad { display: contents; }
.password .quad span { display: inline-block; margin-right: .5ch; }
@media (min-width: 30rem) {
  .password .quad { display: inline-block; white-space: nowrap; }
}
.cover { width: 100%; min-height: 4rem; background: var(--box); color: var(--muted); border: 1px dashed var(--muted); }
#copy-btn { width: 100%; }
#copy-btn.copied { background: var(--ok); color: #000; }

.versions { list-style: none; padding: 0; font-family: var(--mono); color: var(--muted); }
.versions .testcred { color: var(--hint); font-weight: 600; }
.error { font-family: var(--mono); background: var(--box); padding: 1rem; border-radius: 8px; overflow-wrap: anywhere; }

/* Context footer: which breakglass, which authentik — the TUI shows the same header.
   Parts are unbreakable spans; separators live in ::after so a wrapped line ends on the dot. */
.meta { margin-top: 1.5rem; text-align: center; color: var(--muted); font-family: var(--mono); font-size: .75rem; }
/* inline-block, like the password groups: browsers may break BETWEEN these boxes even with no
   whitespace in the DOM, but never inside one. */
.meta span { display: inline-block; }
.meta span:not(:last-child)::after { content: " ·"; }
.meta span:not(:last-child) { margin-right: .5ch; }