/* Security review 31 Oct 2026: the GUI side of the fixes. Built from the design system's roles only (no new colour
   token): the sign-in screen without an email code, the temporary password, the step-up prompt, the host's own words,
   external links, the shell banner, passkeys and the full approval diff. */

/* ---------------------------------------------------------------- sign-in (H1) */
.auth-links-stack { flex-direction: column; align-items: center; gap: 0; }
.auth-links-stack .link-btn { text-align: center; }
.auth-hint { color: var(--ink-2); font: var(--text-body-sm); text-align: center; margin: 0; }
.auth-origin { display: flex; align-items: center; justify-content: center; flex-wrap: wrap; gap: var(--sp-1) var(--sp-2); max-width: 420px;
  color: var(--ink-3); font: var(--text-caption); font-weight: 400; text-align: center; }
.auth-origin b { color: var(--ink-2); font-weight: 500; }
.auth-origin .icon { flex: none; }
.auth-form .btn-block[hidden] { display: none; }

/* ---------------------------------------------------------------- the host's own words (M2, M25) */
.host-text { display: block; margin-top: 2px; color: var(--ink-3); overflow-wrap: anywhere; font-weight: 400; }
.host-text.is-inline { display: inline; }
.host-text q { font-style: italic; }
.host-text .host-more { font: inherit; font-weight: 500; min-height: 24px; }
@media (pointer: coarse) { .host-text .host-more { min-height: var(--target); padding: 0 var(--sp-1); } }
.upkeep-err .host-text, .fail-count + .host-text { margin-top: 0; }

/* ---------------------------------------------------------------- links that leave Olympus (M17) */
.md-render a.ext::after, .prose a.ext::after {
  content: ""; display: inline-block; width: 0.72em; height: 0.72em; margin-left: 0.2em; vertical-align: baseline;
  background-color: currentColor; -webkit-mask: url("ext-link.svg") center / contain no-repeat; mask: url("ext-link.svg") center / contain no-repeat; }
/* The destination: inside the link (it never wraps away from it), one line, an arrow first, the accent wash and an accent
   outline: inline code (surface-3, ink, no arrow) cannot look like it, and code inside link text is rendered as plain text. */
.md-render a.ext:has(.ext-host)::after { content: none; }
.ext-host { display: inline; margin-left: 0.4em; padding: 0 var(--sp-1) 0 3px; border: 1px solid var(--accent); border-radius: var(--r-pill);
  background: var(--accent-wash); color: var(--accent); font: var(--text-caption); font-weight: 600; white-space: nowrap;
  box-decoration-break: clone; -webkit-box-decoration-break: clone; }
.ext-host::before { content: "↗ "; content: "↗ " / ""; }
@media (forced-colors: active) { .md-render a.ext::after, .prose a.ext::after { background-color: LinkText; forced-color-adjust: none; } .ext-host { border: 1px solid CanvasText; } }

/* ---------------------------------------------------------------- the shell banner (L2): cannot be dismissed */
.shell-banner { position: sticky; top: 0; z-index: 90; display: flex; align-items: center; flex-wrap: wrap; gap: var(--sp-2) var(--sp-3);
  margin: 0; border-radius: 0; padding: var(--sp-3) var(--sp-4); padding-top: calc(var(--sp-3) + env(safe-area-inset-top)); }
.shell-banner > span { flex: 1 1 260px; }
.shell-banner .btn { flex: none; }

/* ---------------------------------------------------------------- users, settings (H1, M18) */
.user-tools { white-space: normal; }
.user-tools .btn { margin: 2px 0 2px var(--sp-1); }
@media (max-width: 719px) { .user-tools { display: flex; flex-direction: column; align-items: flex-end; gap: var(--sp-1); } .user-tools .btn { margin: 0; } }
.set-actions { display: flex; flex-wrap: wrap; gap: var(--sp-2); padding-top: var(--sp-3); }

/* ---------------------------------------------------------------- the approval's full diff (M11) */
.approve-diff { margin-top: var(--sp-2); }
.diff-full { display: grid; gap: var(--sp-2); font: var(--text-body-sm); }
.diff-full dt { color: var(--ink-2); padding-top: var(--sp-2); border-top: 1px solid var(--line); }
.diff-full dt:first-child { border-top: 0; padding-top: 0; }
.diff-full dd { min-width: 0; overflow-wrap: anywhere; }
.diff-full .diff-row { display: flex; flex-wrap: wrap; align-items: baseline; gap: 2px var(--sp-2); }
.diff-full .linediff { max-height: none; border: 1px solid var(--line); border-radius: var(--r-md); }
.hermes-yardstick { margin: calc(-1 * var(--sp-2)) 0 var(--sp-2); }
.hermes-use { min-height: 32px; }
@media (pointer: coarse) { .hermes-use { min-height: var(--target); } }

/* ---------------------------------------------------------------- the watchdog's last run (Fleet, admins) */
.watchdog-line { display: flex; align-items: flex-start; gap: var(--sp-2); margin: 0 0 var(--sp-3); color: var(--ink-3); font: var(--text-body-sm); }
.watchdog-line .glyph, .watchdog-line svg { flex: none; margin-top: 2px; }
.watchdog-line.is-late { padding: var(--sp-3) var(--sp-4); border-radius: var(--r-md); background: var(--crit-wash); color: var(--crit-ink); }
.watchdog-line.is-late b { font-weight: 600; }

/* The host's words in the Actions table: a readable column; on phones a full-width row under the action instead. */
.actions-table .action-result { min-width: 280px; max-width: 520px; }
.actions-table .action-result-row { display: none; }
@media (max-width: 719px) {
  /* Phones: Action and State on the row; when, who and the result (the host's words) full width under it. */
  .actions-table thead th:nth-child(n+3), .actions-table .action-row > :nth-child(n+3) { display: none; }
  .actions-table .action-meta { margin: 0 0 var(--sp-1); font: var(--text-caption); font-weight: 400; }
  .actions-table { table-layout: fixed; width: 100%; min-width: 0; }
  .actions-table .action-result-row > td, .actions-table .action-result-row .work-note { overflow-wrap: anywhere; white-space: normal; }
  .actions-table .action-row > * { border-bottom: 0; }
  .actions-table .action-result-row { display: table-row; }
  .actions-table .action-result-row > td { padding-top: 0; white-space: normal; }
}
@media (max-width: 559px) {
  .passkey-list .device-row { display: grid; grid-template-columns: 32px minmax(0, 1fr); align-items: start; column-gap: var(--sp-3); row-gap: var(--sp-2); }
  .passkey-list .device-row > .chip, .passkey-list .device-row > .btn { grid-column: 2; justify-self: start; margin-left: 0; }
  .set-row-stack { flex-direction: column; align-items: stretch; }
  .set-row-stack > .btn { align-self: flex-start; }
}

/* ---------------------------------------------------------------- the one-time temporary password (Users) */
.temp-slot:empty { display: none; }
.temp-card { display: grid; gap: var(--sp-3); margin-bottom: var(--sp-4); border-color: var(--crit); }
.temp-card .secret-box code { font-size: 16px; letter-spacing: 0.04em; user-select: all; overflow-wrap: anywhere; }