body {
  font-family: sans-serif;
  margin: 20px;
  background-color: #f4f4f4;
  color: #333;
}

.container {
  background-color: #fff;
  padding: 20px;
  border-radius: 8px;
  box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
}

h1,
h2 {
  color: #333;
}

nav {
  margin-bottom: 20px;
  padding-bottom: 10px;
  border-bottom: 1px solid #eee;
}

nav a,
.link-button {
  margin-right: 15px;
  text-decoration: none;
  color: #007bff;
}

/* Highlights the nav link for the page currently being viewed (and any of
   its subpages, e.g. editing/adding under OIDC Providers) - see
   handlers.renderTemplate's ActiveNav injection. */
nav a.active {
  font-weight: bold;
  color: #333;
  text-decoration: underline;
}

.link-button {
  background: none;
  border: none;
  padding: 0;
  font: inherit;
  cursor: pointer;
}

/* Consistent destructive-action styling - Delete/Revoke/Destroy controls
   across the whole admin GUI and wizard, so they're visually distinct from
   non-destructive actions (Rediscover, Enable, ...) everywhere, not just
   on some pages. */
.link-button.danger {
  background: none;
  color: #c0392b;
}

.link-button.danger:hover {
  background: none;
  color: #992d22;
  text-decoration: underline;
}

button.danger {
  background-color: #c0392b;
}

button.danger:hover {
  background-color: #992d22;
}

/* Policy builder buttons (setup_policies.html / encryption_policies.html) -
   spacing above the row and below it, so it doesn't crowd the heading above
   or the manual pattern field below. */
.policy-builders {
  margin: 16px 0 32px;
}

.policy-builders button {
  margin-right: 10px;
  margin-bottom: 8px;
}

/* "Fake disabled" look for .button-link and real <button> elements - used
   for "Continue" (blocked until a recovery bundle has been generated and
   verified) and "Generate recovery bundle" (blocked from being clicked
   again once one exists, which would mint a different passphrase for the
   same key) in the master key pages. Deliberately still clickable (no
   pointer-events:none, no disabled attribute) - a click must reach JS so
   it can explain why nothing happened, rather than silently doing nothing. */
.button-link.disabled,
button.disabled {
  background-color: #ccc;
  color: #666;
  cursor: not-allowed;
}

/* Camera-scan preview ("From a paper backup" restore flow) - shared by the
   setup wizard's Master Key step and the admin Master Key page. The QR
   codes generated for recovery are never rendered on-screen (only into the
   print sheet below, static/js/wizard-bundle.js's renderPrintSheet) since
   they're only meant to be scanned off paper. */
#qr-video {
  width: 100%;
  max-width: 480px;
  background: #000;
}

/* #print-sheet is built by static/js/wizard-bundle.js's renderPassphraseSheet/
   renderQRSheet just before printing, and is invisible on screen - @media
   print below hides everything else so ONLY it ends up on paper. Shared by
   the wizard and admin Master Key pages so a printed sheet looks identical
   regardless of which one made it. */
#print-sheet {
  display: none;
}

.sheet-passphrase {
  font-size: 1.4em;
  letter-spacing: 0.05em;
}

.sheet-qr-grid {
  display: flex;
  flex-wrap: wrap;
  gap: 8mm;
}

.sheet-qr-grid figure {
  margin: 0;
  text-align: center;
  page-break-inside: avoid;
}

.sheet-qr-grid svg {
  width: 70mm;
  height: 70mm;
}

@media print {
  /* visibility:hidden alone leaves the rest of the page's layout (nav,
     tables, forms) in place - just invisible - so the browser paginated
     based on that full (invisible) height and printed a second, blank
     page beyond #print-sheet's own single page. display:none actually
     removes it from layout, so the page count matches #print-sheet alone. */
  body > *:not(#print-sheet) {
    display: none !important;
  }

  #print-sheet {
    display: block !important;
  }

  @page {
    size: A4;
    margin: 15mm;
  }
}

/* OIDC provider cards (oidc_providers.html) - each provider plus its
   allowed clients inline, replacing the old "Manage Clients" click-through. */
.provider-card {
  border: 1px solid #eee;
  border-radius: 6px;
  padding: 14px;
  margin-bottom: 16px;
}

.inline-add-client input {
  width: auto;
  display: inline-block;
  margin-right: 8px;
}

/* Master key recovery data buttons (setup_master_key.html / master_key.html) -
   digital file and QR codes are two equal-weight options, shown side by
   side rather than stacked to make that visually obvious. */
.backup-buttons {
  display: flex;
  gap: 12px;
  flex-wrap: wrap;
  margin: 10px 0;
}

/* Generic modal, shared by every popup (static/js/ui-modal.js). */
.modal-backdrop {
  position: fixed;
  inset: 0;
  background: rgba(0, 0, 0, 0.5);
  display: flex;
  align-items: center;
  justify-content: center;
  z-index: 1000;
}

.modal-backdrop[hidden] {
  display: none;
}

.modal {
  background: #fff;
  border-radius: 8px;
  padding: 20px;
  max-width: 480px;
  width: 90%;
  max-height: 90vh;
  overflow-y: auto;
}

nav a:hover,
.link-button:hover {
  background: none;
  text-decoration: underline;
}

form div {
  margin-bottom: 10px;
}

label {
  display: block;
  margin-bottom: 5px;
}

input[type="text"],
input[type="password"],
input[type="url"],
input[type="email"],
textarea {
  width: calc(100% - 22px);
  padding: 10px;
  margin-bottom: 10px;
  border: 1px solid #ddd;
  border-radius: 4px;
  box-sizing: border-box;
}

/* Wraps every password input with a "Show"/"Hide" toggle button -
   static/js/password-toggle.js builds this markup at runtime. */
.password-field {
  display: flex;
  align-items: center;
  gap: 6px;
}

.password-field input {
  flex: 1;
  width: auto;
}

.password-toggle {
  flex-shrink: 0;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 38px;
  height: 38px;
  background: #eee;
  color: #555;
  border: 1px solid #ddd;
  border-radius: 4px;
  margin-bottom: 10px;
  padding: 0;
  cursor: pointer;
}

.password-toggle:hover {
  background: #e0e0e0;
  color: #333;
}

button,
.button-link {
  background-color: #007bff;
  color: white;
  padding: 10px 15px;
  border: none;
  border-radius: 4px;
  cursor: pointer;
  display: inline-block;
  text-decoration: none;
}

button:hover,
.button-link:hover {
  background-color: #0056b3;
}

/* A small spinner for async buttons (fetch-driven actions) - toggled via
   the .loading class, see static/js/wizard-bundle.js's setLoading helper. */
button.loading {
  position: relative;
  color: transparent;
  pointer-events: none;
}

button.loading::after {
  content: "";
  position: absolute;
  top: 50%;
  left: 50%;
  width: 14px;
  height: 14px;
  margin: -7px 0 0 -7px;
  border: 2px solid rgba(255, 255, 255, 0.5);
  border-top-color: #fff;
  border-radius: 50%;
  animation: keyring-spin 0.6s linear infinite;
}

@keyframes keyring-spin {
  to {
    transform: rotate(360deg);
  }
}

.error {
  color: red;
  background-color: #ffebeb;
  border: 1px solid red;
  padding: 10px;
  margin-bottom: 15px;
  border-radius: 4px;
}

.success {
  color: green;
  background-color: #e6ffe6;
  border: 1px solid green;
  padding: 10px;
  margin-bottom: 15px;
  border-radius: 4px;
}

.hint {
  color: #555;
  font-size: 0.9em;
  margin: 4px 0 0;
}

/* Setup wizard step 1's Quick-setup/Custom-setup choice (setup_env_check.html) -
   two full-width option buttons, each with its own explanatory line. */
.setup-mode-choice {
  display: flex;
  flex-direction: column;
  gap: 10px;
  margin: 15px 0;
}

.setup-mode-choice button {
  display: block;
  width: 100%;
  text-align: left;
  padding: 12px 15px;
}

.setup-mode-choice button .hint {
  display: block;
  color: inherit;
  opacity: 0.85;
  font-weight: normal;
  margin-top: 4px;
}

.warning {
  color: #7a5b00;
  background-color: #fff8e1;
  border: 1px solid #e0b400;
  padding: 8px 10px;
  margin: 6px 0;
  border-radius: 4px;
  font-size: 0.9em;
}

table {
  width: 100%;
  border-collapse: collapse;
  margin-top: 20px;
}

th,
td {
  text-align: left;
  padding: 8px;
  border-bottom: 1px solid #ddd;
}

th {
  background-color: #f0f0f0;
}

.actions a,
.actions button {
  margin-right: 5px;
}