/* Sign-in, identity chip, role locks and the Access page (tokens, audit log). */
.id-slot { margin-left: auto; display: flex; align-items: center; gap: 6px; min-width: 0; }
.id-slot:empty { display: none; }
.id-slot:not(:empty) + .theme-btn { margin-left: 0; }
.id-chip { flex: none; display: inline-flex; align-items: center; gap: 8px; min-width: 0; padding: 3px 4px 3px 10px; border: 1px solid var(--border); border-radius: 999px; background: var(--panel); font-size: 13px; }
.id-name { font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 18ch; }
.id-role { display: inline-block; padding: 1px 8px; border-radius: 999px; font-size: 12px; font-weight: 600; background: var(--panel-2); color: var(--text-dim); text-transform: lowercase; }
.id-admin .id-role, .role-admin { background: var(--warn-soft); color: var(--warn); }
.id-runner .id-role, .role-runner { background: var(--accent-soft); color: var(--accent); }
.id-viewer .id-role, .role-viewer { background: var(--panel-2); color: var(--text-dim); }
.id-off { gap: 6px; padding: 3px 10px; background: var(--bad-soft); border-color: var(--bad); color: var(--text); font-weight: 600; }
.id-off .icon { color: var(--bad); }
.id-out { min-height: 30px; padding: 4px 10px; }

.role-locked { cursor: not-allowed !important; opacity: 1 !important; color: var(--text-faint) !important; background: var(--inset) !important; border-color: var(--border-soft) !important; box-shadow: none !important; }
.role-locked .icon:not(.role-tag .icon) { opacity: 0.5; }
.role-tag { display: inline-flex; align-items: center; gap: 3px; margin-left: 4px; padding: 0 6px; border-radius: 999px; font-size: 11.5px; font-weight: 600; color: var(--text-dim); background: var(--panel-2); }
.role-tag .icon { width: 12px; height: 12px; }

.signin-wrap { max-width: 480px; text-align: left; margin-top: 8vh; padding: 28px 28px 22px; box-shadow: var(--shadow); }
.signin { display: grid; gap: 10px; }
.signin .state-icon { margin-bottom: 2px; }
.signin .state-title { margin: 4px 0 0; }
.signin .state-body { margin: 0 0 6px; }
.signin-label { font-weight: 600; font-size: 13px; }
.signin-row { display: flex; gap: 6px; }
.token-input { flex: 1; min-width: 0; min-height: 38px; font-size: 13px; }
.signin-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; }
.signin-go { min-height: 38px; padding-inline: 20px; }
.signin-msg { margin: 0; padding: 8px 12px; border-radius: var(--radius-sm); background: var(--bad-soft); color: var(--text); border: 1px solid var(--bad); }
/* SSO first when the server has it; the token form stays below as the second way in. */
.signin-sso { display: grid; gap: 10px; }
.signin-sso-host { color: var(--text-dim); font-size: 13px; overflow-wrap: anywhere; }
.signin-or { display: flex; align-items: center; gap: 10px; margin: 6px 0 0; color: var(--text-dim); font-size: 12.5px; }
.signin-or::before, .signin-or::after { content: ""; flex: 1; height: 1px; background: var(--border-soft); }
.sso-done .state-title { margin-top: 0; }
.sso-done .signin-msg { margin: 0 0 12px; }
.signin-help { margin-top: 8px; padding-top: 12px; border-top: 1px solid var(--border-soft); color: var(--text-dim); font-size: 13px; }
.signin-help summary { cursor: pointer; color: var(--text); font-weight: 600; }
.signin-help p { margin: 8px 0 4px; }
.signin-help pre, .token-secret { margin: 0; padding: 8px 10px; border-radius: var(--radius-sm); background: var(--inset); border: 1px solid var(--border-soft); color: var(--text); overflow-x: auto; }

/* SaaS account pages: sign-in, invite, reset, 2FA challenge. Same panel and tokens as the token sign-in above. */
.account-wrap { max-width: 440px; }
.account-form { gap: 14px; }
.account-field { display: grid; gap: 6px; min-width: 0; }
.account-input { width: 100%; min-height: 38px; }
.account-field .signin-row .account-input { flex: 1; }
.account-field .field-hint { margin: 0; }
.field-error { display: grid; gap: 2px; margin: 0; font-size: 13px; font-weight: 600; color: var(--bad); }
.account-google { display: flex; justify-content: center; width: 100%; background: var(--panel-2); }
.account-invited { display: grid; gap: 4px; padding: 10px 12px; border-radius: var(--radius-sm); background: var(--inset); border: 1px solid var(--border-soft); }
.account-invited p { margin: 0; }
.account-invited-email { font-weight: 600; overflow-wrap: anywhere; }
.g-mark { flex: none; width: 18px; height: 18px; }
.account-google-group { display: grid; gap: 6px; }
.account-google-group .field-hint { margin: 0; }
.account-msg { display: grid; gap: 4px; }
.msg-en, .msg-th { display: block; }
.account-note { display: grid; gap: 4px; margin: 0 0 14px; padding: 8px 12px; border-radius: var(--radius-sm); background: var(--good-soft); border: 1px solid var(--good); color: var(--text); }
.account-sent:empty { display: none; }
.account-foot { margin: 4px 0 0; }
.account-wrap > .account-msg { margin: 0 0 14px; }
.account-end-go { margin-top: 2px; }
.account-wrap .state-body { margin: 0 0 6px; }
.account-wrap.state-bad, .account-wrap.state-neutral { text-align: left; }
@media (prefers-reduced-motion: reduce) { .account-wrap * { transition: none !important; } }

.access-section { margin-top: 28px; }
.section-title { margin: 0; font-size: 17px; letter-spacing: -0.01em; }
.access-section > .page-sub { margin-bottom: 14px; }
.token-form, .audit-filters { display: flex; flex-wrap: wrap; align-items: flex-end; gap: 12px 16px; margin-bottom: 14px; padding: 14px 16px; border: 1px solid var(--border); border-radius: var(--radius); background: var(--panel); }
.field { display: grid; gap: 4px; min-width: 0; flex: 1 1 170px; }
.field label { font-size: 12.5px; font-weight: 600; color: var(--text-dim); }
.field .input { width: 100%; }
.field-hint { font-size: 12px; color: var(--text-faint); }
.token-form-go { display: flex; align-items: center; gap: 10px; flex: 1 1 100%; }
.token-reveal { margin-bottom: 14px; padding: 16px; border: 1px solid var(--good); border-radius: var(--radius); background: var(--good-soft); }
.token-reveal h3 { margin: 0 0 4px; font-size: 15px; outline: none; }
.token-reveal p { margin: 0 0 10px; color: var(--text); max-width: 70ch; }
.token-secret-row { display: flex; gap: 8px; align-items: stretch; }
.token-secret { flex: 1; min-width: 0; white-space: nowrap; font-size: 13px; user-select: all; }
.token-reveal-go { display: flex; align-items: center; gap: 10px; margin-top: 10px; }
.tokens-table td, .audit-table td { font-size: 13.5px; }
.tokens-table .run-name, .audit-table .run-name { display: block; }
.tokens-table .run-id, .audit-table .run-id { display: block; white-space: nowrap; }
.row-dim td { color: var(--text-dim); }
.confirm { display: inline-flex; flex-wrap: wrap; align-items: center; justify-content: flex-end; gap: 6px; }
.audit-export { display: flex; align-items: center; gap: 8px; margin-left: auto; }
.nowrap { white-space: nowrap; }

@media (max-width: 640px) {
  .id-name { display: none; }
  .shell-top:has(.id-chip) { gap: 4px 6px; }
  .id-slot { gap: 2px; }
  .id-chip { padding-left: 4px; }
  .id-out-word { display: none; }
  .signin-wrap { margin-top: 16px; padding: 20px 16px; }
  .audit-export { margin-left: 0; flex-wrap: wrap; }
  .token-secret-row { flex-direction: column; }
  .shell-nav a { padding: 6px 8px; }
}