:root {
  color-scheme: light dark;
  --bg: #f6f7f9;
  --surface: #ffffff;
  --text: #1a1d23;
  --muted: #6b7280;
  --border: #e2e5ea;
  --accent: #2f6fed;
  --accent-hover: #2558c4;
  --danger: #d1453b;
  --success: #1a7f4e;
  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
}

@media (prefers-color-scheme: dark) {
  :root {
    --bg: #14161a;
    --surface: #1c1f26;
    --text: #e8eaed;
    --muted: #9aa1ac;
    --border: #2b2f38;
  }
}

* { box-sizing: border-box; }

body {
  margin: 0;
  background: var(--bg);
  color: var(--text);
  min-height: 100vh;
  display: flex;
  flex-direction: column;
  align-items: center;
  padding: 2.5rem 1rem;
}

.card {
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: 10px;
  padding: 2rem;
  width: 100%;
  max-width: 420px;
}

.card.wide {
  max-width: 720px;
}

/* Scoped to the admin dashboard specifically (body.dashboard-page) rather
   than widening .wide/.topbar everywhere — that page is a full-bleed
   operational console (6 KPI columns, a trend chart, a paginated event
   table beside an attention panel) and uses the whole viewport, while the
   account/OAuth-client/email-template pages stay in the shared centered
   column that suits their single-column forms. */
body.dashboard-page .topbar,
body.dashboard-page .card.wide {
  max-width: none;
}

h1 {
  font-size: 1.4rem;
  margin: 0 0 1.25rem;
}

h2 {
  font-size: 1.05rem;
  margin: 1.75rem 0 0.75rem;
}

label {
  display: block;
  font-size: 0.85rem;
  color: var(--muted);
  margin: 0.9rem 0 0.3rem;
}

input {
  width: 100%;
  padding: 0.55rem 0.65rem;
  border: 1px solid var(--border);
  border-radius: 6px;
  background: transparent;
  color: var(--text);
  font-size: 0.95rem;
}

input:focus {
  outline: 2px solid var(--accent);
  outline-offset: -1px;
}

textarea {
  width: 100%;
  padding: 0.55rem 0.65rem;
  border: 1px solid var(--border);
  border-radius: 6px;
  background: transparent;
  color: var(--text);
  font-size: 0.95rem;
  font-family: inherit;
}

textarea:focus {
  outline: 2px solid var(--accent);
  outline-offset: -1px;
}

/* Card heading style shared by pages that use plain .card/.card.wide
   wrappers (OAuth clients, email templates) rather than the dashboard's
   own scoped theme — a smaller, tighter title than the page-level h1, so
   a card's own <h2> reads as "this card's title" and not a second page
   heading. */
.card h2.card-title {
  font-size: 1.05rem;
  margin: 0 0 1rem;
}

/* Vertical gap between stacked, non-grid cards (OAuth clients, email
   templates) — scoped to an explicit wrapper rather than a bare
   `.card + .card`, since several pages (e.g. account.html) place adjacent
   `.card`s inside a CSS grid with its own `gap`, where an extra margin
   would misalign the grid row. */
.card-stack > .card + .card {
  margin-top: 1.25rem;
}

button {
  cursor: pointer;
  border: none;
  border-radius: 6px;
  padding: 0.6rem 1rem;
  font-size: 0.9rem;
  font-weight: 600;
  background: var(--accent);
  color: #fff;
}

button:hover { background: var(--accent-hover); }
button.secondary { background: transparent; color: var(--text); border: 1px solid var(--border); }
button.danger { background: transparent; color: var(--danger); border: 1px solid var(--border); }

.actions { margin-top: 1.25rem; display: flex; gap: 0.6rem; }

.error {
  color: var(--danger);
  font-size: 0.85rem;
  margin-top: 0.75rem;
  min-height: 1.1em;
}

.muted { color: var(--muted); font-size: 0.85rem; }

a { color: var(--accent); }

table {
  width: 100%;
  border-collapse: collapse;
  font-size: 0.85rem;
  margin-top: 0.5rem;
}

th, td {
  text-align: left;
  padding: 0.5rem 0.4rem;
  border-bottom: 1px solid var(--border);
}

th { color: var(--muted); font-weight: 600; }

.stats {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
  gap: 0.75rem;
  margin: 1rem 0;
}

.stat {
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 0.75rem;
}

.stat .value { font-size: 1.4rem; font-weight: 700; }
.stat .label { color: var(--muted); font-size: 0.8rem; }

.session-row { display: flex; justify-content: space-between; align-items: center; padding: 0.6rem 0; border-bottom: 1px solid var(--border); }
.badge { font-size: 0.7rem; background: var(--accent); color: #fff; border-radius: 4px; padding: 0.1rem 0.4rem; margin-left: 0.4rem; }
.badge.event-login_failed { background: var(--danger); }
.badge.event-logout { background: var(--muted); }

.topbar { width: 100%; max-width: 720px; display: flex; justify-content: space-between; align-items: center; margin-bottom: 1rem; }
.topbar a { text-decoration: none; font-size: 0.85rem; }

/* Auth pages (login/register/forgot-password/reset-password): a two-panel
   layout with a quiet tenant-branding side and the form itself, matching
   docs/ui/wireframes.html's "01 Sign-in" screen pixel-for-pixel (its own
   tokens, not the app-wide --accent/--border/--muted, are reproduced here
   under a local scope) per UI.md's "Sign-in experience" section. Scoped to
   body.auth-page rather than widening body/.card generally — the rest of
   the app keeps its existing palette, matching the existing
   body.dashboard-page scoping precedent above. */
body.auth-page {
  --auth-text: #192338;
  --auth-muted: #58647a;
  --auth-accent: #4248ce;
  --auth-border: #dce2ee;
  padding: 0;
  display: block;
  min-height: 100vh;
  background: #f3f5fa;
  color: var(--auth-text);
}

@media (prefers-color-scheme: dark) {
  body.auth-page {
    --auth-text: #e8eaed;
    --auth-muted: #9aa1ac;
    --auth-accent: #7b80f0;
    --auth-border: #2b2f38;
    background: #14161a;
  }
}

.auth-shell {
  display: grid;
  grid-template-columns: 1fr 1fr;
  min-height: 100vh;
}

.auth-story {
  background: #e8ebfa;
  color: var(--auth-text);
  /* padding-top clears the absolutely positioned .auth-brand mark (32px
     top offset + its own 32px height) with room to spare, then starts
     content — matching the account page's fixed, non-centered top
     alignment (.acct-shell main's 32px) instead of vertically centering,
     so switching between login/register/forgot-password never shifts the
     form's vertical position based on how much text a given screen has. */
  padding: 80px 65px 65px;
  display: flex;
  flex-direction: column;
  justify-content: flex-start;
  position: relative;
}

@media (prefers-color-scheme: dark) {
  .auth-story { background: #1b1f2c; }
}

.auth-story .tenant-eyebrow {
  color: var(--auth-muted);
  font-size: 12px;
  font-weight: 650;
  letter-spacing: 1.4px;
  text-transform: uppercase;
}

.auth-brand,
.acct-brand {
  display: flex;
  align-items: center;
  gap: 8px;
}

.auth-brand {
  position: absolute;
  top: 32px;
  left: 40px;
  font-size: 20px;
  font-weight: 750;
  letter-spacing: -0.7px;
}

.auth-logo,
.acct-logo {
  display: inline-grid;
  place-items: center;
  width: 32px;
  height: 32px;
  border-radius: 9px;
  background: var(--auth-accent, var(--accent));
  color: #fff;
  font-size: 17px;
  font-weight: 750;
  letter-spacing: 0;
}

.auth-story h1 {
  font-size: 48px;
  line-height: 1.15;
  letter-spacing: -2px;
  max-width: 480px;
  margin: 42px 0 20px;
  color: var(--auth-text);
}

.auth-story p {
  max-width: 370px;
  color: var(--auth-muted);
  font-size: 16px;
}

.auth-story-footer {
  position: absolute;
  bottom: 32px;
  color: var(--auth-muted);
}

.auth-form {
  display: flex;
  flex-direction: column;
  align-items: center;
  /* Fixed top offset, same reasoning as .auth-story above: starts every
     auth page's form at the same height regardless of its content length,
     rather than vertically centering (which made login/register/forgot
     jump to different heights). */
  padding: 80px 24px 40px;
  background: var(--surface);
}

.auth-login {
  max-width: 390px;
  width: 100%;
}

.auth-login h1 {
  font-size: 30px;
  letter-spacing: -1px;
  margin: 6px 0;
  color: var(--auth-text);
}

.auth-context { margin: 0 0 22px; }

.auth-login .pill {
  display: inline-block;
  border-radius: 20px;
  background: #e8f5ed;
  color: #176139;
  padding: 4px 10px;
  font-size: 12px;
  font-weight: 650;
}

@media (prefers-color-scheme: dark) {
  .auth-login .pill { background: #163827; color: #6fd39a; }
}

.auth-login label {
  display: block;
  margin: 18px 0 6px;
  font-size: 14px;
  font-weight: 600;
  color: var(--auth-text);
}

.auth-login input {
  width: 100%;
  border: 1px solid #aeb9cd;
  border-radius: 8px;
  padding: 12px;
  background: var(--surface);
  color: var(--auth-text);
  font-size: 0.95rem;
}

.password-field { position: relative; }

.password-field input { padding-right: 62px; }

.auth-login .password-toggle {
  position: absolute;
  right: 5px;
  top: 50%;
  width: auto;
  margin: 0;
  padding: 6px 8px;
  transform: translateY(-50%);
  border: 0;
  background: transparent;
  color: var(--auth-accent);
  font-size: 12px;
}

.auth-login .password-toggle:hover { background: transparent; color: var(--auth-accent); text-decoration: underline; }

@media (prefers-color-scheme: dark) {
  .auth-login input { border-color: var(--auth-border); }
}

.auth-login button {
  width: 100%;
  margin: 7px 0;
  border-radius: 8px;
  padding: 12px 15px;
}

.auth-login button.primary,
.auth-login button[type="submit"] {
  background: var(--auth-accent);
  color: white;
  border-color: var(--auth-accent);
}

.auth-login button.secondary {
  background: var(--surface);
  color: var(--auth-text);
  border: 1px solid var(--auth-border);
}

.auth-login a { color: var(--auth-accent); }

.auth-login .muted { color: var(--auth-muted); font-size: 0.85rem; }

.auth-links { margin: 16px 0 0; font-size: 0.85rem; }

.auth-login .error { color: var(--danger); font-size: 0.85rem; margin-top: 0.75rem; }

.auth-divider {
  text-align: center;
  color: var(--auth-muted);
  font-size: 12px;
  margin: 18px 0;
}

.auth-footer {
  margin-top: 28px;
  font-size: 12px;
  color: var(--auth-muted);
}

@media (max-width: 860px) {
  .auth-shell { grid-template-columns: 1fr; }
  .auth-story { display: none; }
  .auth-form { padding: 28px 20px; }
  .auth-brand, .auth-story-footer { display: none; }
}

/* My-account pages (account.html + account-*.html siblings): a sidebar
   shell shared across the split-out sub-pages, per UI.md's "My account"
   section and docs/ui/wireframes.html's "02 My account" screen. Scoped to
   body.account-page, same precedent as body.auth-page/dashboard-page
   above — the rest of the app (plain forms on register/forgot-password
   etc.) keeps using bare .card centered on the page. */
body.account-page {
  padding: 0;
  display: block;
  min-height: 100vh;
}

.acct-shell {
  display: grid;
  grid-template-columns: 230px 1fr;
  min-height: 100vh;
}

.acct-shell aside {
  background: var(--surface);
  border-right: 1px solid var(--border);
  /* Top padding matches .acct-shell main's 32px (not the wireframe's
     unreconciled 28px) so the brand mark and the page heading start at
     the exact same height on every account page. */
  padding: 32px 20px 28px;
  display: flex;
  flex-direction: column;
}

.acct-logout {
  margin-top: auto;
  padding-top: 16px;
}

.acct-logout button {
  width: 100%;
}

/* Desktop navigation stays viewport-sized even when the main content is long. */
@media (min-width: 861px) {
  .acct-shell > aside {
    position: sticky;
    top: 0;
    align-self: start;
    height: 100vh;
    height: 100dvh;
    overflow-y: auto;
  }
  .acct-shell > aside > * { flex-shrink: 0; }
}

.acct-brand {
  font-size: 20px;
  font-weight: 750;
  letter-spacing: -0.7px;
}

.acct-context {
  padding: 14px 12px;
  background: #f1f3fa;
  border-radius: 9px;
  margin: 28px 0;
}

@media (prefers-color-scheme: dark) {
  .acct-context { background: var(--bg); }
}

.acct-context small { font-size: 12px; }

.acct-nav {
  list-style: none;
  padding: 0;
  margin: 0;
}

.acct-nav li {
  margin: 4px 0;
  border-radius: 7px;
}

.acct-nav li a {
  display: block;
  padding: 9px 12px;
  border-radius: 7px;
  color: var(--muted);
  text-decoration: none;
}

.acct-nav li.active a {
  background: #ededff;
  color: #353bb5;
  font-weight: 650;
}

@media (prefers-color-scheme: dark) {
  .acct-nav li.active a { background: #262a4a; color: #a6acf5; }
}

.acct-shell main {
  padding: 32px;
  min-width: 0;
  max-width: 1550px;
  width: 100%;
  /* Horizontal centering only. A bare `margin: auto` (the wireframe's own
     value) auto-centers a grid item on BOTH axes when it's shorter than
     its row — .acct-shell's row stretches to min-height:100vh, so a
     short page (e.g. Security) got vertically centered and started much
     lower than a taller one (e.g. Overview) that nearly filled the row.
     Pinning the top margin to 0 keeps every page's content flush to the
     same top offset regardless of how much content follows. */
  margin: 0 auto;
}

body.account-page .card {
  max-width: none;
  min-width: 0;
  padding: 22px;
}

.acct-shell p { margin: 8px 0; }

.acct-top {
  display: flex;
  justify-content: space-between;
  align-items: center;
  gap: 16px;
  margin-bottom: 28px;
  flex-wrap: wrap;
}

.acct-top .eyebrow {
  color: var(--muted);
  font-size: 12px;
  font-weight: 650;
  letter-spacing: 1.4px;
  text-transform: uppercase;
}

.acct-top h1 { margin: 6px 0; font-size: 30px; letter-spacing: -1px; }

.acct-shell h2 { font-size: 17px; margin: 0 0 8px; }

.pill {
  display: inline-block;
  border-radius: 20px;
  background: #e8f5ed;
  color: #176139;
  padding: 4px 10px;
  font-size: 12px;
  font-weight: 650;
}

.pill.warn { background: #fff1d7; color: #805300; }

@media (prefers-color-scheme: dark) {
  .pill { background: #163827; color: #6fd39a; }
  .pill.warn { background: #3a2c0d; color: #e0ac4a; }
}

.acct-notice {
  background: #edf0ff;
  border: 1px solid #d9dfff;
  padding: 14px 18px;
  border-radius: 9px;
  color: #333d79;
  margin: 18px 0;
}

@media (prefers-color-scheme: dark) {
  .acct-notice { background: #232849; border-color: #333d79; color: #c7cdf7; }
}

.acct-columns {
  display: grid;
  grid-template-columns: 1.7fr 1fr;
  gap: 20px;
  margin: 20px 0;
  align-items: start;
}

.acct-row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 14px;
  padding: 16px 0;
  border-bottom: 1px solid var(--border);
}

.acct-row:last-child { border-bottom: none; }

.acct-wide-card { margin-top: 20px; }

.app-icon {
  display: grid;
  place-items: center;
  width: 40px;
  height: 40px;
  border-radius: 10px;
  background: #eef0fc;
  color: #4548a5;
  font-weight: 700;
  flex-shrink: 0;
}

@media (prefers-color-scheme: dark) {
  .app-icon { background: #262a4a; color: #a6acf5; }
}

.app-name {
  display: flex;
  align-items: center;
  gap: 12px;
}

.acct-shell footer {
  color: var(--muted);
  font-size: 12px;
  margin-top: 24px;
}

@media (max-width: 860px) {
  .acct-shell { grid-template-columns: 1fr; }
  .acct-shell aside { border-right: none; border-bottom: 1px solid var(--border); }
  .acct-nav { display: flex; flex-wrap: wrap; gap: 4px; }
  .acct-columns { grid-template-columns: 1fr; }
  .acct-shell main { padding: 20px 14px; }
}