/* PennyScan web UI.
   One stylesheet, no framework, no build step. */

:root {
  color-scheme: light dark;

  --bg: #f5f6f8;
  --panel: #ffffff;
  --ink: #14171c;
  --ink-soft: #5b6472;
  --line: #dde1e7;
  --accent: #1f6feb;
  --accent-ink: #ffffff;
  --danger: #b42318;
  --danger-soft: #fdecea;
  --warn: #8a5a00;
  --warn-soft: #fff6e0;
  --ok: #17603a;
  --ok-soft: #e6f4ec;
  --err-soft: #fdecea;
}

@media (prefers-color-scheme: dark) {
  :root {
    --bg: #0e1116;
    --panel: #161b22;
    --ink: #e6edf3;
    --ink-soft: #9aa4b2;
    --line: #2b323c;
    --accent: #4c8dff;
    --accent-ink: #0b1220;
    --danger: #ff8a80;
    --danger-soft: #2a1614;
    --warn: #ffcf70;
    --warn-soft: #2a2314;
    --ok: #7ee2b8;
    --ok-soft: #10241c;
    --err-soft: #2a1614;
  }
}

* { box-sizing: border-box; }

body {
  margin: 0;
  padding: 2rem 1rem;
  min-height: 100vh;
  display: flex;
  justify-content: center;
  align-items: flex-start;
  background: var(--bg);
  color: var(--ink);
  font: 15px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
        "Helvetica Neue", Arial, sans-serif;
}

.card {
  width: 100%;
  max-width: 30rem;
  padding: 1.75rem;
  background: var(--panel);
  border: 1px solid var(--line);
  border-radius: 12px;
}

.card-wide { max-width: 52rem; }

.card-head { margin-bottom: 1.25rem; }

h1 {
  margin: 0;
  font-size: 1.4rem;
  letter-spacing: -0.01em;
}

h2 {
  margin: 0 0 0.5rem;
  font-size: 1.05rem;
}

.sub,
.muted,
.hint {
  color: var(--ink-soft);
}

.sub { margin: 0.25rem 0 0; }

.hint {
  margin: 0.35rem 0 1rem;
  font-size: 0.85rem;
}

p { margin: 0 0 1rem; }

code {
  padding: 0.1em 0.35em;
  border-radius: 4px;
  background: var(--bg);
  border: 1px solid var(--line);
  font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
  font-size: 0.85em;
}

/* --- forms --- */

label {
  display: block;
  margin-bottom: 0.3rem;
  font-weight: 600;
  font-size: 0.88rem;
}

input[type="text"],
input[type="password"] {
  width: 100%;
  padding: 0.55rem 0.7rem;
  color: var(--ink);
  background: var(--bg);
  border: 1px solid var(--line);
  border-radius: 7px;
  font: inherit;
}

input:focus-visible,
.btn:focus-visible,
summary:focus-visible {
  outline: 2px solid var(--accent);
  outline-offset: 2px;
}

/* --- buttons --- */

.actions {
  display: flex;
  flex-wrap: wrap;
  gap: 0.5rem;
  align-items: center;
  margin-top: 0.5rem;
}

.btn {
  display: inline-block;
  padding: 0.55rem 0.95rem;
  color: var(--ink);
  background: var(--panel);
  border: 1px solid var(--line);
  border-radius: 7px;
  font: inherit;
  font-weight: 600;
  text-decoration: none;
  cursor: pointer;
}

.btn:hover:not(:disabled) { border-color: var(--accent); }

.btn:disabled {
  opacity: 0.55;
  cursor: progress;
}

.btn-primary {
  color: var(--accent-ink);
  background: var(--accent);
  border-color: var(--accent);
}

.btn-quiet {
  color: var(--ink-soft);
  background: transparent;
  border-color: transparent;
}

.btn-danger {
  color: var(--danger);
  background: var(--danger-soft);
  border-color: var(--danger-soft);
}

.btn-small {
  padding: 0.3rem 0.6rem;
  font-size: 0.85rem;
}

/* --- alerts ---
   One box, four tones. Technical detail is always shown in the <pre> rather
   than hidden in the console, because an opaque WebAuthn failure with no
   visible cause is exactly what this UI exists to avoid. */

.alert {
  margin: 0 0 1.25rem;
  padding: 0.8rem 0.9rem;
  border: 1px solid var(--line);
  border-left-width: 4px;
  border-radius: 8px;
  background: var(--bg);
}

.alert strong { display: block; }

.alert p {
  margin: 0.35rem 0 0;
  font-size: 0.9rem;
}

.alert pre {
  margin: 0.6rem 0 0;
  padding: 0.45rem 0.55rem;
  overflow-x: auto;
  white-space: pre-wrap;
  word-break: break-word;
  background: var(--panel);
  border: 1px solid var(--line);
  border-radius: 6px;
  color: var(--ink-soft);
  font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
  font-size: 0.78rem;
}

.alert--error { border-left-color: var(--danger); background: var(--err-soft); }
.alert--warn  { border-left-color: var(--warn);   background: var(--warn-soft); }
.alert--ok    { border-left-color: var(--ok);     background: var(--ok-soft); }

.warn-note {
  margin: 1.25rem 0 0;
  padding: 0.65rem 0.75rem;
  border: 1px solid var(--line);
  border-left: 4px solid var(--warn);
  border-radius: 8px;
  background: var(--warn-soft);
  font-size: 0.85rem;
}

/* --- add-device disclosure --- */

.add-device {
  margin-top: 1.5rem;
  padding-top: 1.25rem;
  border-top: 1px solid var(--line);
}

.add-device summary {
  cursor: pointer;
  font-weight: 600;
}

/* --- credential table --- */

.table-wrap {
  overflow-x: auto;
  border: 1px solid var(--line);
  border-radius: 8px;
}

table {
  width: 100%;
  border-collapse: collapse;
  font-size: 0.9rem;
}

th, td {
  padding: 0.6rem 0.75rem;
  text-align: left;
  border-bottom: 1px solid var(--line);
  white-space: nowrap;
}

th {
  color: var(--ink-soft);
  font-size: 0.78rem;
  text-transform: uppercase;
  letter-spacing: 0.04em;
}

tbody tr:last-child td { border-bottom: none; }

.card-foot {
  margin-top: 1.5rem;
  padding-top: 1.25rem;
  border-top: 1px solid var(--line);
}

.sr-only {
  position: absolute;
  width: 1px;
  height: 1px;
  overflow: hidden;
  clip: rect(0 0 0 0);
  white-space: nowrap;
}

/* --- auth hardening additions ------------------------------------------- */

.steps {
  margin: 0;
  padding: 0;
  list-style: none;
}

.step {
  padding: 1rem 0;
  border-top: 1px solid var(--line);
  opacity: 0.55;
}

.step:first-child { border-top: none; }
.step--active { opacity: 1; }
.step--done { opacity: 0.7; }

.step h2 {
  margin: 0 0 0.35rem;
  font-size: 0.95rem;
  letter-spacing: 0.02em;
}

.qr {
  display: flex;
  justify-content: center;
  margin: 0.75rem 0;
  padding: 0.75rem;
  background: #fff;          /* QR contrast must not depend on the theme */
  border: 1px solid var(--line);
  border-radius: 8px;
}

.qr svg { display: block; max-width: 100%; height: auto; }

.secret,
.approval-code {
  margin: 0.35rem 0 1rem;
  padding: 0.6rem 0.7rem;
  overflow-x: auto;
  background: var(--bg);
  border: 1px solid var(--line);
  border-radius: 7px;
  font-family: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
  font-size: 0.9rem;
  word-break: break-all;
  user-select: all;
}

.approval-code {
  font-size: 1.5rem;
  font-weight: 700;
  letter-spacing: 0.12em;
  text-align: center;
  word-break: normal;
}

.checkbox {
  display: flex;
  gap: 0.45rem;
  align-items: center;
  margin: 0.6rem 0;
  font-weight: 400;
}

.checkbox input { width: auto; }

.warn-text { color: var(--warn); font-weight: 600; }

.danger-zone {
  margin-top: 1.5rem;
  padding: 1rem;
  border: 1px solid var(--danger);
  border-radius: 8px;
  background: var(--danger-soft);
}

.danger-zone h2 { margin-top: 0; }

#audit-box { margin-top: 1.5rem; }

#audit-box td { white-space: normal; }
#audit-box td:last-child { min-width: 18rem; }

/* `hidden` must beat the component rules below it. .btn sets
   display:inline-block, which has the same specificity as the UA sheet's
   [hidden] rule and wins on order — so without this, hiding a button does
   nothing and the enrolment flow shows its "Create passkey" control early. */
[hidden] { display: none !important; }