/* =====================================================================
   Walkable — auth surface
   Token-driven, white-label-aware. Every brand-touching value reads from
   --brand-* (overridable per-tenant). Structural tokens (asphalt/slate/
   paper/shadows/radii/type scale) come from tokens.css and stay constant.
   Mobile-first; the layout is a single centered card across breakpoints.
   ===================================================================== */

.auth-body {
  margin: 0;
  min-height: 100vh;
  background: var(--brand-bg);
  color: var(--fg-1);
  font-family: var(--brand-font-body);
  font-size: var(--fs-body);
  line-height: var(--lh-normal);
  -webkit-font-smoothing: antialiased;
  text-rendering: optimizeLegibility;
}

.auth-shell {
  min-height: 100vh;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: var(--space-6) var(--space-4);
  box-sizing: border-box;
}

.auth-card {
  width: 100%;
  max-width: 440px;
  background: var(--brand-surface);
  border: 1px solid var(--border-subtle);
  border-radius: var(--radius-lg);
  padding: var(--space-8);
  box-shadow: var(--shadow-md);
  box-sizing: border-box;
}

@media (min-width: 480px) {
  .auth-card { padding: var(--space-10) var(--space-8); }
}

/* ─── Header ──────────────────────────────────────────────────────── */
.auth-brand {
  display: flex;
  justify-content: center;
  align-items: center;
  margin-bottom: var(--space-8);
  min-height: 32px;
}

.auth-brand img {
  max-height: 36px;
  max-width: 180px;
  width: auto;
  height: auto;
  object-fit: contain;
}

/* Walkable fallback wordmark.
   IMPORTANT — overrides above .auth-brand img rule:
   The general `.auth-brand img` rule clamps logos to max-width:180px /
   max-height:36px. With the wordmark SVG's 220×56 aspect ratio, the
   max-width was the binding constraint and the rendered height
   collapsed to ~46px regardless of any max-height bump. Using an
   explicit `height` + nulling both max-* constraints gives us
   pixel-accurate control: height 72 ≈ 27px rendered "walkable" glyphs,
   ~3.4× the 8px caption. */
.auth-brand .auth-brand__walkable {
  /* 45px container → "walkable" glyphs ~16px, ~2× the 8px caption. */
  height: 45px;
  width: auto;
  max-height: none;
  max-width: none;
}

.auth-brand__fallback {
  display: inline-flex;
  flex-direction: column;
  align-items: center;
  gap: 4px;
}

/* Subtle "Powered by" label that sits just above the Walkable mark when a
   tenant hasn't uploaded a logo yet. Deliberately tiny — must read as a
   caption, not a header. The wordmark below is the visual anchor. */
.auth-brand__poweredby {
  font-family: var(--brand-font-body);
  font-size: 8px;
  font-weight: 500;
  letter-spacing: 0.1em;
  text-transform: uppercase;
  color: var(--fg-3);
  opacity: 0.6;
  line-height: 1;
}

.auth-secure-badge {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: 6px;
  width: fit-content;
  margin: 0 auto var(--space-6);
  background: #E6F1FB;
  color: #185FA5;
  font-family: var(--brand-font-body);
  font-size: 12px;
  font-weight: 500;
  border-radius: 999px;
  padding: 6px 14px;
  line-height: 1;
}

.auth-eyebrow {
  display: block;
  font-family: var(--brand-font-body);
  font-size: var(--fs-micro);
  font-weight: 600;
  letter-spacing: var(--tracking-cap);
  text-transform: uppercase;
  color: var(--fg-3);
  margin-bottom: var(--space-2);
}

.auth-title {
  font-family: var(--brand-font-display);
  font-weight: 700;
  font-size: 32px; /* between h2 (28) and h1 (40) — auth title is hero, not page hero */
  line-height: var(--lh-tight);
  letter-spacing: var(--tracking-tight);
  color: var(--fg-1);
  margin: 0 0 var(--space-3) 0;
}

@media (min-width: 480px) {
  .auth-title { font-size: var(--fs-h1); }
}

.auth-subtitle {
  font-family: var(--brand-font-body);
  font-size: var(--fs-body);
  color: var(--fg-2);
  margin: 0 0 var(--space-8) 0;
  line-height: var(--lh-normal);
}

/* ─── Alerts (inline, above form) ─────────────────────────────────── */
.auth-alert {
  border-radius: var(--radius-sm);
  padding: var(--space-3) var(--space-4);
  font-size: var(--fs-small);
  border: 1px solid transparent;
  margin-bottom: var(--space-5);
  font-family: var(--brand-font-body);
}

.auth-alert--error {
  background: var(--status-danger-bg);
  border-color: rgba(156, 43, 34, 0.25);
  color: var(--status-danger-fg);
}

.auth-alert--success {
  background: var(--status-success-bg);
  border-color: rgba(42, 106, 61, 0.25);
  color: var(--status-success-fg);
}

/* ─── Form ────────────────────────────────────────────────────────── */
.auth-form {
  display: flex;
  flex-direction: column;
  gap: var(--space-5);
}

.auth-field {
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
}

.auth-label {
  font-family: var(--brand-font-body);
  font-size: var(--fs-small);
  font-weight: 600;
  color: var(--fg-1);
}

.auth-input {
  font-family: var(--brand-font-body);
  font-size: var(--fs-body);
  color: var(--fg-1);
  background: var(--brand-surface);
  border: 1px solid var(--border-subtle);
  border-radius: var(--radius-sm);
  padding: 0 var(--space-4);
  height: 44px;
  width: 100%;
  box-sizing: border-box;
  transition:
    border-color var(--dur-fast) var(--ease-out),
    box-shadow   var(--dur-fast) var(--ease-out);
  -webkit-appearance: none;
  appearance: none;
}

.auth-input::placeholder { color: var(--slate-400); }

.auth-input:hover {
  border-color: var(--slate-300);
}

.auth-input:focus,
.auth-input:focus-visible {
  outline: none;
  border-color: var(--border-strong);
  box-shadow: 0 0 0 3px var(--brand-primary-soft);
}

.auth-input:disabled {
  background: var(--bg-sunken);
  color: var(--fg-3);
  cursor: not-allowed;
}

.auth-input.is-valid {
  border-color: rgba(42, 106, 61, 0.55);
  box-shadow: 0 0 0 3px rgba(42, 106, 61, 0.10);
}

.auth-input.is-invalid {
  border-color: rgba(156, 43, 34, 0.55);
  box-shadow: 0 0 0 3px rgba(156, 43, 34, 0.10);
}

.auth-field-hint {
  font-family: var(--brand-font-body);
  font-size: var(--fs-small);
  color: var(--fg-3);
  line-height: var(--lh-normal);
  margin-top: var(--space-1);
}

.auth-field-feedback {
  min-height: 18px;
  font-family: var(--brand-font-body);
  font-size: var(--fs-small);
  line-height: var(--lh-normal);
  color: var(--fg-3);
}

.auth-field-feedback[data-state="error"] {
  color: var(--status-danger-fg);
}

.auth-field-feedback[data-state="success"] {
  color: var(--status-success-fg);
}

.auth-password-meter {
  height: 6px;
  overflow: hidden;
  background: var(--bg-sunken);
  border: 1px solid var(--border-subtle);
  border-radius: 999px;
}

.auth-password-meter__bar {
  display: block;
  width: 100%;
  height: 100%;
  background: linear-gradient(90deg, var(--status-danger-fg), var(--brand-primary));
  border-radius: inherit;
  transform: scaleX(0);
  transform-origin: left center;
  transition: transform var(--dur-base) var(--ease-out);
}

.auth-password-checklist {
  display: flex;
  flex-direction: column;
  gap: 6px;
  list-style: none;
  padding: 0;
  margin: 0;
}

.auth-password-check {
  display: flex;
  align-items: center;
  gap: 8px;
  font-family: var(--brand-font-body);
  font-size: var(--fs-small);
  line-height: var(--lh-normal);
  color: var(--fg-3);
  transition: color var(--dur-fast) var(--ease-out);
}

.auth-password-check__icon {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  flex: 0 0 18px;
  width: 18px;
  height: 18px;
  border-radius: 999px;
  background: var(--bg-sunken);
  border: 1px solid var(--border-subtle);
  color: var(--fg-3);
  transition:
    background-color var(--dur-fast) var(--ease-out),
    border-color var(--dur-fast) var(--ease-out),
    color var(--dur-fast) var(--ease-out);
}

.auth-password-check__icon::before {
  content: '';
  width: 6px;
  height: 6px;
  border-radius: 50%;
  background: currentColor;
}

.auth-password-check[data-valid="true"] {
  color: var(--status-success-fg);
}

.auth-password-check[data-valid="true"] .auth-password-check__icon {
  background: var(--status-success-bg);
  border-color: rgba(42, 106, 61, 0.35);
  color: var(--status-success-fg);
}

.auth-password-check[data-valid="true"] .auth-password-check__icon::before {
  width: 9px;
  height: 5px;
  border-radius: 0;
  background: transparent;
  border-left: 2px solid currentColor;
  border-bottom: 2px solid currentColor;
  transform: rotate(-45deg) translateY(-1px);
}

/* ─── Inline link shown above an input (e.g. "Forgot?") ──────────── */
.auth-label-row {
  display: flex;
  align-items: baseline;
  justify-content: space-between;
  gap: var(--space-2);
}

.auth-label-row .auth-label-link {
  font-size: var(--fs-small);
  color: var(--fg-link);
  font-weight: 500;
}

/* ─── Primary CTA ─────────────────────────────────────────────────── */
.auth-btn {
  position: relative;             /* anchor for the loading spinner */
  font-family: var(--brand-font-body);
  font-size: var(--fs-body);
  font-weight: 600;
  background: var(--brand-primary);
  color: var(--brand-primary-on);
  border: none;
  border-radius: var(--radius-md);
  height: 44px;
  cursor: pointer;
  width: 100%;
  margin-top: var(--space-2);
  transition:
    background-color var(--dur-fast) var(--ease-out),
    transform        var(--dur-fast) var(--ease-out),
    box-shadow       var(--dur-fast) var(--ease-out);
  box-shadow: var(--shadow-xs);
}

.auth-btn:hover {
  background: var(--brand-primary-hover);
  box-shadow: var(--shadow-sm);
}

.auth-btn:active {
  background: var(--brand-primary-active);
  transform: translateY(1px);
  box-shadow: none;
}

.auth-btn:focus-visible {
  outline: none;
  box-shadow: 0 0 0 3px var(--brand-primary-soft);
}

.auth-btn:disabled {
  background: var(--slate-300);
  color: rgba(255, 255, 255, 0.9);
  cursor: not-allowed;
  transform: none;
  box-shadow: none;
}

/* Loading state.
   - Driven by aria-busy="true" so the same attribute serves a11y AND CSS.
   - .auth-btn__label fades out via opacity (NOT display:none) so the
     button keeps its width and there's no layout reflow.
   - ::after pseudo-element is the spinner — fades in over the same beat.
   - pointer-events:none blocks double-submits without the gray :disabled
     styling (we want the button to read "busy", not "unavailable"). */
.auth-btn__label {
  display: inline-block;
  transition: opacity var(--dur-fast) var(--ease-out);
}

.auth-btn[aria-busy="true"] {
  pointer-events: none;
  cursor: wait;
}

.auth-btn[aria-busy="true"] .auth-btn__label {
  opacity: 0;
}

.auth-btn::after {
  content: '';
  position: absolute;
  top: 50%;
  left: 50%;
  width: 14px;
  height: 14px;
  margin: -7px 0 0 -7px;
  border: 1.75px solid currentColor;
  border-right-color: transparent;
  border-radius: 50%;
  opacity: 0;
  pointer-events: none;
  transition: opacity var(--dur-base) var(--ease-out);
}

.auth-btn[aria-busy="true"]::after {
  opacity: 1;
  animation: auth-btn-spin 0.7s linear infinite;
}

@keyframes auth-btn-spin {
  to { transform: rotate(360deg); }
}

/* Reduced motion: keep the rotation (so the user can still tell the
   button is busy) but slow it down dramatically. */
@media (prefers-reduced-motion: reduce) {
  .auth-btn[aria-busy="true"]::after { animation-duration: 2.4s; }
  .auth-btn__label { transition: none; }
}

/* ─── Below-form meta + footer ────────────────────────────────────── */
.auth-meta {
  font-family: var(--brand-font-body);
  font-size: var(--fs-small);
  color: var(--fg-2);
  text-align: center;
  margin-top: var(--space-6);
  margin-bottom: 0;
}

.auth-meta + .auth-meta { margin-top: var(--space-2); }

.auth-meta a {
  color: var(--brand-primary);
  font-weight: 600;
  text-decoration: none;
}

.auth-meta a:hover { text-decoration: underline; }

.auth-divider {
  border: 0;
  border-top: 1px solid var(--border-subtle);
  margin: var(--space-6) 0;
}

.auth-footer {
  margin-top: var(--space-6);
  text-align: center;
  font-size: var(--fs-micro);
  letter-spacing: var(--tracking-cap);
  text-transform: uppercase;
  color: var(--fg-3);
}

.auth-footer a {
  color: inherit;
  text-decoration: none;
}

.auth-footer a:hover { color: var(--fg-2); }

/* Reduced motion: disable button transforms. */
@media (prefers-reduced-motion: reduce) {
  .auth-btn,
  .auth-input { transition: none; }
  .auth-btn:active { transform: none; }
}