/* auth.css — the authority's entire stylesheet, served same-origin so
 * the strict CSP (style-src 'self') passes. One file, every page.
 *
 * APPEAR-4 (NOTE-FRUIN-AUTH-MASTHEAD 0.1, ruled 2026-10-16): the look of the Fruin consoles, as net.fruininc.com —
 * the same palette, type, masthead, menu and column. (APPEAR-1 brought the schemes, the faces and the tab icon;
 * APPEAR-2 the jellyfish beside the name.)
 *   light   Net's light palette: grey-blue paper, white surfaces, ink text, orange-red links and buttons
 *   dark    the dark palette of Fruin AI-Coms and Net, with the same orange-red
 *   type    Archivo for headings, IBM Plex Sans for text, IBM Plex Mono for code and "Signed in as"; self-hosted
 * Every colour is a token on :root, in three states:
 *   no attribute, a light device          the :root block below
 *   "Match my device" on a dark device    the prefers-color-scheme block (only when the person did not choose light)
 *   the person chose dark                 the data-fruin-theme="dark" block (the same values as the block above)
 * The layout writes the attribute from the cookie fruin_theme (libTheme), so the person's choice wins over the device.
 * Each text token meets 4.5:1 on its background and each edge 3:1 (WCAG AA) in both schemes; the ship's contrast
 * check reads these blocks. A rule never names a colour: it names a token.
 * The text of a notice is always the ink colour: the kind is told by the box's colour, its edge and its lead words. */
@font-face { font-family: "Archivo"; src: url(/assets/font-archivo.woff2) format("woff2"); font-weight: 100 900; font-stretch: 62% 125%; font-style: normal; font-display: swap; }
@font-face { font-family: "IBM Plex Sans"; src: url(/assets/font-plex-sans.woff2) format("woff2"); font-weight: 100 700; font-style: normal; font-display: swap; }
@font-face { font-family: "IBM Plex Mono"; src: url(/assets/font-plex-mono.woff2) format("woff2"); font-weight: 400; font-style: normal; font-display: swap; }

:root {
  color-scheme: light dark;
  --f-display: "Archivo", "Arial Narrow", system-ui, sans-serif;
  --f-body: "IBM Plex Sans", system-ui, -apple-system, "Segoe UI", sans-serif;
  --f-mono: "IBM Plex Mono", ui-monospace, "SFMono-Regular", Menlo, Consolas, monospace;
  --gutter: max(16px, 2.5vw); --column: min(100% - 2 * var(--gutter), 76rem);   /* masthead, page and foot share one column */
  --bg: #edf0f3;           --surface: #ffffff;     --sunken: #e3e8ed;       --fg: #18212c;        --muted: #5a6777;
  --link: #b8391f;         --rule: #d3dae2;        --rule-strong: #b3bdc8;
  --field-bg: #ffffff;     --field-line: #77828f;  --code-bg: #e3e8ed;
  --btn-bg: #f4694d;       --btn-fg: #1f0b05;      --btn2-bg: #ffffff;      --btn2-fg: #18212c;   --btn2-line: #77828f;
  --danger-bg: #a3123a;    --danger-fg: #ffffff;   --danger-mark: #a3123a;
  --focus: #b8391f;
  --notice-bg: #e6f0e9;    --notice-line: #8fb89b;
  --ok-bg: #e2efe6;        --ok-line: #2f7d4f;
  --warn-bg: #f8ecd6;      --warn-line: #a86400;
  --error-bg: #f6e1e6;     --error-line: #a3123a;
  --choice-on-bg: #f4694d; --choice-on-fg: #1f0b05;
  --shadow: #18212c1f;     --backdrop: #00000073;
}
@media (prefers-color-scheme: dark) {
  :root:not([data-fruin-theme="light"]) {
    --bg: #11161c;           --surface: #19202a;     --sunken: #0d1116;       --fg: #e4e9ef;        --muted: #93a0af;
    --link: #f78a72;         --rule: #2a333f;        --rule-strong: #3a4554;
    --field-bg: #19202a;     --field-line: #66727f;  --code-bg: #0d1116;
    --btn-bg: #f4694d;       --btn-fg: #1f0b05;      --btn2-bg: #19202a;      --btn2-fg: #e4e9ef;   --btn2-line: #66727f;
    --danger-bg: #ff6b9a;    --danger-fg: #1f0b05;   --danger-mark: #ff6b9a;
    --focus: #f78a72;
    --notice-bg: #172a20;    --notice-line: #3f7d58;
    --ok-bg: #15281c;        --ok-line: #63bf89;
    --warn-bg: #2e2410;      --warn-line: #e3a843;
    --error-bg: #2f1520;     --error-line: #ff6b9a;
    --choice-on-bg: #f4694d; --choice-on-fg: #1f0b05;
    --shadow: #00000099;     --backdrop: #000000a6;
  }
}
:root[data-fruin-theme="dark"] {
  color-scheme: dark;
  --bg: #11161c;           --surface: #19202a;     --sunken: #0d1116;       --fg: #e4e9ef;        --muted: #93a0af;
  --link: #f78a72;         --rule: #2a333f;        --rule-strong: #3a4554;
  --field-bg: #19202a;     --field-line: #66727f;  --code-bg: #0d1116;
  --btn-bg: #f4694d;       --btn-fg: #1f0b05;      --btn2-bg: #19202a;      --btn2-fg: #e4e9ef;   --btn2-line: #66727f;
  --danger-bg: #ff6b9a;    --danger-fg: #1f0b05;   --danger-mark: #ff6b9a;
  --focus: #f78a72;
  --notice-bg: #172a20;    --notice-line: #3f7d58;
  --ok-bg: #15281c;        --ok-line: #63bf89;
  --warn-bg: #2e2410;      --warn-line: #e3a843;
  --error-bg: #2f1520;     --error-line: #ff6b9a;
  --choice-on-bg: #f4694d; --choice-on-fg: #1f0b05;
  --shadow: #00000099;     --backdrop: #000000a6;
}
:root[data-fruin-theme="light"] { color-scheme: light; }

/* ---- base */
*,*::before,*::after{box-sizing:border-box}
html,body{margin:0}
html{background:var(--bg)}
body{font:400 15px/1.55 var(--f-body);color:var(--fg);background:var(--bg);-webkit-font-smoothing:antialiased}
a{color:var(--link)}
h1,h2,h3{font-family:var(--f-display);font-stretch:112%;line-height:1.15;text-wrap:balance}
h1{font-size:clamp(1.6rem,1.2rem + 1.6vw,2.2rem);font-weight:700;letter-spacing:-.01em;margin:0 0 1.25rem}
h2{font-size:1.2rem;font-weight:700;margin:2rem 0 .5rem}
h3{font-size:1rem;font-weight:600}
p{margin:0 0 .75rem}
:focus-visible{outline:2px solid var(--focus);outline-offset:2px;border-radius:3px}

/* ---- the masthead (APPEAR-4): mark + name, the menu, who is signed in, Sign out — as net.fruininc.com */
.top{width:var(--column);margin:0 auto;display:flex;flex-wrap:wrap;align-items:center;gap:.75rem 1.5rem;
  padding:1.5rem 0 1rem;border-bottom:2px solid var(--fg)}
.brand{display:inline-flex;align-items:center;gap:.5rem;text-decoration:none;color:var(--fg);
  font:700 1.35rem/1 var(--f-display);font-stretch:112%;letter-spacing:-.01em}
.brand-mark{display:block;width:28px;height:28px;flex:none}
.nav{display:inline-flex;flex-wrap:wrap;gap:2px;padding:3px;background:var(--sunken);border-radius:9px}
.nav a{font:500 .86rem/1 var(--f-body);padding:.5rem .8rem;border-radius:6px;text-decoration:none;color:var(--muted)}
.nav a:hover{color:var(--fg)}
.nav a[aria-current="page"]{background:var(--surface);color:var(--fg);box-shadow:0 1px 2px var(--shadow)}
.who{margin:0 0 0 auto;font-family:var(--f-mono);font-size:.82rem;color:var(--muted)}
.who strong{color:var(--fg);font-weight:500}
.signout{margin:0}
.signout button{margin:0;padding:.45rem .8rem;font-size:.86rem}

/* ---- the page: the console's column, as net.fruininc.com (Drew, 2026-10-16). A text field keeps a readable
 * width inside it (a login name does not need 76 rem); the column itself is the page's width. */
.main{width:var(--column);margin:0 auto;padding:1.5rem 0 3rem}
/* APPEAR-4 1.1.0: the pages of signing in and out — one narrow column (the 26 rem of the sign-in page before
 * APPEAR-4), centered in the page's column (Drew, 2026-10-16). Its fields and buttons take its whole width. */
.center{max-width:26rem;margin:0 auto}
.center input,.center select,.center button{width:100%;max-width:none}
.foot{width:var(--column);margin:0 auto;padding:1rem 0 2rem;border-top:1px solid var(--rule);
  font-family:var(--f-mono);font-size:.76rem;color:var(--muted)}

/* ---- controls */
label{display:block;margin:.75rem 0 .25rem;font-weight:600}
input{width:100%;max-width:32rem;padding:.6rem;border:1px solid var(--field-line);border-radius:6px;font:inherit;color:var(--fg);background:var(--field-bg)}
button{margin-top:1rem;padding:.6rem 1.2rem;border:1px solid var(--btn-bg);border-radius:6px;background:var(--btn-bg);color:var(--btn-fg);font:700 .95rem/1.2 var(--f-body);cursor:pointer}   /* APPEAR-5: the orange button at 700 (Drew, 2026-10-16) */
button.secondary{background:var(--btn2-bg);color:var(--btn2-fg);border-color:var(--btn2-line);font-weight:600}
.muted{color:var(--muted);font-size:.9rem}
.err{background:var(--error-bg);border:1px solid var(--error-line);border-left-width:.4rem;padding:.6rem .8rem;border-radius:6px;color:var(--fg)}
code{font-family:var(--f-mono);font-size:.9em;background:var(--code-bg);padding:.15rem .35rem;border-radius:4px}
select{display:block;width:100%;max-width:32rem;padding:.45rem;margin:.15rem 0 .6rem;border:1px solid var(--field-line);border-radius:6px;font:inherit;color:var(--fg);background:var(--field-bg)}

/* ---- account surface (Phase 3) */
.notice{background:var(--notice-bg);border:1px solid var(--notice-line);border-radius:6px;padding:.5rem .75rem;color:var(--fg)}
/* notice kinds (NOTICE-1): the box's colour, its edge AND its lead words carry the kind; the text stays ink */
.notice-ok,.notice-warn,.notice-error{border-left-width:.4rem;margin:1rem 0;padding:.6rem .8rem;font-weight:500}
.notice-ok{background:var(--ok-bg);border-color:var(--ok-line)}
.notice-warn{background:var(--warn-bg);border-color:var(--warn-line)}
.notice-error{background:var(--error-bg);border-color:var(--error-line)}
.notice strong{font-weight:700}
.rows{list-style:none;margin:0 0 .75rem;padding:0}
.rows li{display:flex;justify-content:space-between;align-items:center;gap:1rem;
  padding:.45rem 0;border-bottom:1px solid var(--rule)}
.rows form{margin:0}
/* a link-like action that removes something: ink text (readable), a red underline tells it removes */
button.linkish{background:none;border:none;color:var(--fg);cursor:pointer;margin:0;
  padding:0;font:inherit;text-decoration:underline;text-decoration-color:var(--danger-mark);text-decoration-thickness:2px;text-underline-offset:3px}
/* the Appearance choice (APPEAR-1): the button in force is filled and says so to a screen reader (aria-pressed);
 * the two others are outlined. The shape, not only the colour, tells which one is chosen. */
.theme-choice{display:flex;flex-wrap:wrap;gap:.5rem;margin:.5rem 0 0}
.theme-choice button{margin-top:0;background:var(--btn2-bg);color:var(--btn2-fg);border:2px solid var(--btn2-line);font-weight:500}
.theme-choice button[aria-pressed="true"]{border-color:var(--choice-on-bg);background:var(--choice-on-bg);color:var(--choice-on-fg);font-weight:700}

/* ---- admin surface (Phase 4): the table on a surface, as Net's tables */
table.admin{width:100%;border-collapse:collapse;margin:0 0 1rem;background:var(--surface);border:1px solid var(--rule);border-radius:6px}
table.admin th{text-align:left;border-bottom:2px solid var(--rule-strong);padding:.55rem .65rem;font:600 .72rem/1.2 var(--f-body);
  letter-spacing:.09em;text-transform:uppercase;color:var(--muted)}
table.admin td{border-bottom:1px solid var(--rule);padding:.55rem .65rem;vertical-align:top}
table.admin form{margin:0}

/* Native confirm dialogs (invoker-driven, zero-JS) */
dialog.admin-confirm {
  border: 1px solid var(--rule); border-radius: .4em; padding: 1em 1.25em;
  max-width: 26em; box-shadow: 0 12px 40px -12px var(--shadow);
  color: var(--fg); background: var(--surface);
}
dialog.admin-confirm::backdrop { background: var(--backdrop); }
dialog.admin-confirm h3 { margin: 0 0 .5em; }
dialog.admin-confirm form {
  display: flex; gap: .75em; justify-content: flex-end; margin-top: 1em;
}
.danger {
  background: var(--danger-bg); color: var(--danger-fg); border: 0;
  border-radius: .3em; padding: .4em .9em; cursor: pointer;
}

@media (max-width: 600px) {
  .who{margin:0;flex:1 1 auto}   /* who and Sign out share one row under the menu */
  .brand{font-size:1.2rem}
}
@media (prefers-reduced-motion: reduce) { * { transition: none !important; } }

/* ---- ACCOUNTS-1 (2026-10-16): the Accounts pages. Tokens only, so both schemes follow. -------------------------- */
.search{margin:0 0 .75rem}
.search-row{display:flex;flex-wrap:wrap;gap:.5rem;align-items:center}
.search-row input{flex:1 1 22rem;max-width:none;font-family:var(--f-mono)}
.search-row select{flex:0 0 auto;width:auto;margin:0}
.search-row button{margin-top:0}
form.inline{display:inline;margin:0}
.quick{display:flex;flex-wrap:wrap;gap:.4rem;margin:0 0 .75rem}
button.chip{margin:0;padding:.3rem .75rem;border-radius:999px;font-size:.85rem;font-weight:500;
  background:var(--btn2-bg);color:var(--btn2-fg);border:1px solid var(--btn2-line)}
button.chip:hover{background:var(--sunken)}
details.help{margin:0 0 1rem}
details.help summary{cursor:pointer;color:var(--link)}
.count{margin:.5rem 0}
.table-wrap{overflow-x:auto;margin:0 0 1rem}
.table-wrap table.admin{margin:0}
table.accounts td{white-space:nowrap}
tr.off td{color:var(--muted)}
.badge{display:inline-block;padding:.05rem .45rem;border:1px solid var(--ok-line);border-radius:999px;
  font-size:.75rem;line-height:1.4;color:var(--fg);background:var(--ok-bg)}
.badge.off{border-color:var(--rule-strong);background:var(--sunken);color:var(--muted)}
.pager{display:flex;align-items:center;gap:1rem;margin:1rem 0}
.pager button{margin:0}
.crumb{margin:0 0 .5rem;font-size:.9rem}
dl.facts{display:grid;grid-template-columns:max-content 1fr;gap:.35rem 1.25rem;margin:0 0 1.5rem}
dl.facts dt{color:var(--muted)}
dl.facts dd{margin:0}
input.copy{width:12rem;font-family:var(--f-mono);padding:.25rem .5rem}
@media (max-width:40rem){dl.facts{grid-template-columns:1fr}dl.facts dd{margin:0 0 .5rem}}

/* ---- HELP-1 (2026-10-16): the Help page. Tokens only, so both schemes follow. ------------------------------------- */
nav.toc ul{margin:0 0 1.5rem;padding-left:1.2rem}
nav.toc li{margin:.2rem 0}
.help-topic{max-width:52rem;margin:0 0 2rem;padding:1rem 1.25rem;background:var(--surface);border:1px solid var(--rule);border-radius:6px}
.help-topic h2{margin-top:0}
.help-topic h3{font-size:1.05rem;margin:1.25rem 0 .4rem}
pre.cmd{margin:.4rem 0 .8rem;padding:.6rem .8rem;background:var(--code-bg);border-radius:6px;overflow-x:auto}
pre.cmd code{padding:0;background:none;font-size:.9rem;white-space:pre}
/* ---- ACCOUNT-TABS (2026-10-16): the account's tiles — the blocks of the Fruin consoles (net.fruininc.com,
 * terminal.fruininc.com): a grid of boxes, a 4px bar on the left, a large figure and a small upper-case label. Each
 * tile is a link to one account page. The page in view: the bar in the link colour (3:1 or more on the surface in both
 * schemes), a stronger edge and aria-current="page" — the colour is never the only signal. Tokens only. */
.tiles{display:grid;grid-template-columns:repeat(auto-fit,minmax(9rem,1fr));gap:.75rem;margin:0 0 1.5rem}
.tile{position:relative;display:flex;flex-direction:column;justify-content:space-between;gap:.5rem;min-height:5.5rem;
  padding:.85rem .9rem .8rem 1.1rem;background:var(--surface);border:1px solid var(--rule);border-radius:6px;
  color:var(--fg);text-decoration:none;overflow:hidden}
.tile::before{content:"";position:absolute;left:0;top:0;bottom:0;width:4px;background:var(--rule-strong)}
.tile:hover{border-color:var(--rule-strong)}
.tile-current{border-color:var(--fg)}
.tile-current::before{background:var(--link)}
.tile-n{font:700 2rem/1 var(--f-display);font-stretch:112%;letter-spacing:-.01em;overflow-wrap:anywhere}
.tile-n.tile-word{font-size:1.25rem;line-height:1.15}
.tile-l{font:600 .72rem/1.2 var(--f-body);letter-spacing:.09em;text-transform:uppercase;color:var(--muted)}
.tile-current .tile-l{color:var(--fg)}
.account-page h2{margin-top:0}
.account-page h3{margin:1.5rem 0 .5rem}
.account-foot{margin-top:2.5rem;padding-top:1rem;border-top:1px solid var(--rule)}
.account-foot h2{margin-top:0}
.sessions{margin-top:2rem}
form.stack button{display:block}   /* a form of fields: its button starts its own line, under the last field */