/* Microsoft 365 connection settings — the connection-specific chrome:
   the setup-step section cards, the credential probe
   panel, and the EXO setup-script block. GLOBAL (not component-scoped)
   on purpose: the connections page splits across sibling components —
   the Graph body in Microsoft365.razor and the Exchange Online wizard
   in ExchangeOnlinePanel.razor (a child component) — and both render
   the same `connections-config__*` vocabulary. Scoped CSS would only
   reach one component, leaving the other tab unstyled, so these rules
   live here where every tab picks them up. The cross-feature bits
   (step badge, section legend, danger zone, forbidden notice) live in
   settings-chrome.css; the card surface comes from `.surface-card`;
   inputs / labels / buttons inherit from app.css. */

/* Setup stepper — the page's single navigation surface: each node is a
   tab link with a state marker, joined by a continuous connector line,
   so the tab strip and setup progress are ONE timeline. The stepper is
   VERTICAL at every width — markers stacked with the line running
   through them, the same shape on a phone as in the macOS-installer
   sidebar. The wide-viewport media block further down only adds the
   two-column grid that floats this same list as a sticky rail beside
   the active panel; it does not change the timeline's shape. (An earlier
   horizontal wrapping row read as broken on mobile — connector dashes
   stranded at the start of each wrapped line.) Markers are decorative
   (aria-hidden); each node carries hidden status text for AT users. */
.connections-stepper {
    margin-block: var(--space-5) var(--space-4);
    border-bottom: 1px solid var(--color-border-subtle);
    padding-bottom: var(--space-3);
}

.connections-layout__content {
    /* Grid/flow blowout guard: wide children (tables, chip rows) must
       scroll inside their own containers, not stretch the column. */
    min-width: 0;
}

.connections-stepper__list {
    list-style: none;
    margin: 0;
    padding: 0;
    display: flex;
    flex-direction: column;
    align-items: stretch;
}

.connections-stepper__node {
    position: relative;
    display: flex;
    align-items: center;
    gap: var(--space-2);
    padding-block: var(--space-2);
}

    /* Vertical connector: an upper segment from the row top to the marker
       and a lower segment from the marker to the row bottom; adjacent
       rows join into one continuous line broken only by the markers. Both
       sit at the marker's horizontal center (marker is 1.125rem wide). */
    .connections-stepper__node::before,
    .connections-stepper__node::after {
        content: "";
        position: absolute;
        left: calc(0.5625rem - 1px);
        width: 2px;
        height: calc(50% - 0.5625rem);
        background: var(--color-border-subtle);
    }

    .connections-stepper__node::before {
        top: 0;
    }

    .connections-stepper__node::after {
        bottom: 0;
    }

    .connections-stepper__node:first-child::before,
    .connections-stepper__node:last-child::after {
        content: none;
    }

/* Marker: a circle whose fill/glyph encodes the node state. */
.connections-stepper__marker {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    flex: 0 0 auto;
    width: 1.125rem;
    height: 1.125rem;
    border-radius: 50%;
    border: 2px solid var(--color-border);
    font-size: 0.6875rem;
    font-weight: var(--font-weight-bold);
    line-height: 1;
    color: transparent;
}

.connections-stepper__node--done > .connections-stepper__marker {
    border-color: var(--color-success);
    background: var(--color-success);
    color: var(--color-text-on-brand, #fff);
}

    .connections-stepper__node--done > .connections-stepper__marker::before {
        content: "\2713"; /* check mark */
    }

/* "Current" is the next step to take, and "none" is the always-available
   Prerequisites node — both carry a FILLED marker (never the hollow ring
   Pending nodes use). The fill is a neutral grey dot by default so it
   never reads as "you are here"; only when you are actually viewing that
   tab (--active) does it take the brand fill. This keeps the brand-blue
   marker unique to the open tab — being on Prerequisites must not paint
   the Graph API dot blue. */
.connections-stepper__node--current > .connections-stepper__marker,
.connections-stepper__node--none > .connections-stepper__marker {
    border-color: var(--color-border);
    background: color-mix(in srgb, var(--color-text-muted) 18%, transparent);
}

    .connections-stepper__node--current > .connections-stepper__marker::before,
    .connections-stepper__node--none > .connections-stepper__marker::before {
        content: "";
        width: 0.375rem;
        height: 0.375rem;
        border-radius: 50%;
        background: var(--color-text-muted);
    }

.connections-stepper__node--current.connections-stepper__node--active > .connections-stepper__marker,
.connections-stepper__node--none.connections-stepper__node--active > .connections-stepper__marker {
    border-color: var(--color-brand);
    background: color-mix(in srgb, var(--color-brand) 18%, transparent);
}

    .connections-stepper__node--current.connections-stepper__node--active > .connections-stepper__marker::before,
    .connections-stepper__node--none.connections-stepper__node--active > .connections-stepper__marker::before {
        background: var(--color-brand);
    }

.connections-stepper__node--attention > .connections-stepper__marker {
    border-color: var(--color-warning);
    background: var(--color-warning);
    color: var(--color-text-on-brand, #fff);
}

    .connections-stepper__node--attention > .connections-stepper__marker::before {
        content: "!";
    }

@media (forced-colors: active) {
    .connections-stepper__marker {
        border-color: CanvasText;
        color: CanvasText;
        background: Canvas;
    }
}

.connections-stepper__label {
    color: var(--color-text);
    text-decoration: none;
    font-weight: var(--font-weight-medium);
    padding-block: var(--space-1);
}

    .connections-stepper__label:hover {
        text-decoration: underline;
    }

    /* The open tab — the strongest cue in the strip. */
    .connections-stepper__label[aria-current="page"] {
        color: var(--color-brand);
        font-weight: var(--font-weight-semibold);
        text-decoration: underline;
        text-underline-offset: 0.5em;
        text-decoration-thickness: 2px;
    }

/* Locked node — the surface's Graph prerequisite is unmet: inert text. */
span.connections-stepper__label--locked {
    color: var(--color-text-muted);
    opacity: 0.7;
    cursor: not-allowed;
    font-weight: var(--font-weight-regular);
}

.connections-stepper__optional {
    flex: 0 0 auto;
    /* Trailing edge, not label-adjacent: label widths differ per row
       ("Microsoft Fabric" vs "Power Platform"), so an inline badge lands
       a few pixels differently on every node. Pushing it to the rail's
       end gives all Optional pills one shared alignment edge. */
    margin-inline-start: auto;
    padding: 0 var(--space-2);
    border: 1px solid var(--color-border-subtle);
    border-radius: var(--radius-full, 999px);
    font-size: var(--font-size-xs);
    color: var(--color-text-muted);
}

/* The continue-setup card below the stepper. */
.connections-continue {
    margin-block-end: var(--space-6);
}

/* Wide viewports: float the (already vertical) stepper into a sticky
   left rail beside the active panel — a two-column grid, macOS-installer
   style. Only the layout changes here; the timeline's shape is the base
   vertical list. */
@media (min-width: 56rem) {
    .connections-layout {
        display: grid;
        grid-template-columns: 15rem minmax(0, 1fr);
        column-gap: var(--space-7, var(--space-6));
        align-items: start;
    }

    .connections-layout > .connections-stepper {
        position: sticky;
        top: var(--space-5);
        margin-block: var(--space-5) 0;
        border-bottom: none;
        padding-bottom: 0;
    }

    .connections-layout .connections-continue {
        margin-block-start: var(--space-5);
    }
}

/* Step summary title inside the collapsible step cards (StepSection):
   the settings-accordion title alone is a plain inline span, so this
   lays the numbered badge and heading text out on one flex line. */
.connections-step__title {
    display: inline-flex;
    align-items: center;
    gap: var(--space-2);
}

.connections-config__form {
    /* Plain block flow (not flex): the section cards already space
       themselves via the `.connections-config__section + …` margin
       rule, so a flex `gap` here would STACK on top of that margin and
       double the space between cards. */
    margin-top: var(--space-4);
    /* Never let the form (or a wide descendant) force the main column
       wider than its track — keeps the page free of a horizontal
       scrollbar when the secondary rail narrows the content area. */
    min-width: 0;
    max-width: 100%;
}

/* Section card. The surface recipe (border/radius/shadow/background)
   comes from the shared `.surface-card` utility applied alongside this
   class in the markup; this rule only carries the form-specific deltas:
   the denser space-6 padding, a zeroed fieldset margin, and a fieldset
   min-width guard (a <fieldset> defaults to min-inline-size: min-content
   and would otherwise refuse to shrink, pushing wide content — e.g. the
   long redirect URI — past the viewport and the action buttons
   off-screen). Same approach the SSO settings page uses. */
.connections-config__section {
    padding: var(--space-6);
    margin: 0;
    min-width: 0;
    min-inline-size: 0;
}

/* Space between setup-step cards. Set directly on the section elements
   (not relied on via the form-level flex `gap`) because the
   `.connections-config__form` class sits on <EditForm>, a child
   component whose rendered <form> is a layout boundary; spacing the
   real <fieldset>/<section> markup is robust regardless. */
.connections-config__section + .connections-config__section {
    margin-block-start: var(--space-6);
}

/* A section that is a sibling of <EditForm> rather than of the step
   cards inside it (e.g. the Graph remediation opt-in) can't be reached
   by the adjacent-sibling rule above — give it the same inter-card
   spacing explicitly. */
.connections-config__section--standalone {
    margin-block-start: var(--space-6);
}

/* The numbered step badge (`.step-badge`), the section legend
   (`.section-legend` + title/hint), the danger zone, and the forbidden
   notice are shared utilities in settings-chrome.css — the markup uses
   those class names directly. */

/* Locked step — shown for a step that is gated until a prerequisite
   (e.g. Graph: credentials saved before consent) is met. */
.connections-config__step-locked {
    margin: 0;
    color: var(--color-text-muted);
    font-size: var(--font-size-sm);
}

/* Graph credential note (Graph tab Step 1): a short muted line above the
   certificate pane. Microsoft Graph is certificate-only, so there is no
   auth-method chooser. */
.connections-config__auth-note {
    margin: 0 0 var(--space-4);
    color: var(--color-text-muted);
}

/* Toolbar row above the generated RBAC script (copy affordance). */
.connections-config__script-toolbar {
    margin: 0 0 var(--space-2);
}

/* Numbered sub-steps inside the Graph "Set up the Entra ID app" step —
   a heading + short body per portal task, spaced so each reads as its
   own small section. */
.connections-substep {
    margin-block-start: var(--space-5);
}

    .connections-substep:first-child {
        margin-block-start: 0;
    }

.connections-substep__heading {
    margin: 0 0 var(--space-1);
    /* Body/UI font (Inter), not the brand display face — a functional setup
       sub-step label, uniform with the surrounding form content (matches the
       .section-legend__title / .danger-zone__heading treatment). */
    font-family: var(--font-sans);
    font-size: var(--font-size-md);
    font-weight: var(--font-weight-semibold);
    color: var(--color-text);
}

.connections-substep__body {
    margin: 0 0 var(--space-3);
    color: var(--color-text-muted);
    line-height: var(--line-height-snug, 1.4);
    max-inline-size: 65ch;
}

/* Form field group inside a sub-step — the global `form > div` spacing
   rule can't reach these (they are nested under the accordion body),
   so the breathing room between the tenant-id and client-id fields is
   set explicitly here. The help <small> under each input becomes a
   capped block line for readability. */
.connections-config__field {
    margin-block-end: var(--space-5);
}

    .connections-config__field .form-help {
        display: block;
        margin-top: var(--space-1);
        max-inline-size: 42rem;
    }

/* Prerequisites tab — the "before you begin" list. */
.connections-prereq__intro {
    margin: 0 0 var(--space-3);
    color: var(--color-text-muted);
}

.connections-prereq__list {
    margin: 0;
    padding-inline-start: 1.25rem;
    display: flex;
    flex-direction: column;
    gap: var(--space-2);
    line-height: var(--line-height-snug, 1.4);
}

/* Propagation-lag callout under the prerequisites list — warning-toned
   so it registers before the operator's first "Test connection", icon +
   text laid out as one row. Token-driven so HC + dark themes track. */
.connections-prereq__patience {
    display: flex;
    align-items: flex-start;
    gap: var(--space-3);
    margin-top: var(--space-5);
    padding: var(--space-4) var(--space-5);
    border: 1px solid var(--color-warning);
    border-radius: var(--radius-lg);
    background: var(--color-warning-surface, var(--color-surface));
    color: var(--color-warning-on-surface, var(--color-text));
}

.connections-prereq__patience-icon {
    flex: 0 0 auto;
    margin-top: 2px;
    color: var(--color-warning);
}

.connections-prereq__patience-heading {
    margin: 0 0 var(--space-1);
    font-weight: var(--font-weight-semibold);
}

.connections-prereq__patience-body {
    margin: 0;
    font-size: var(--font-size-sm);
    line-height: var(--line-height-snug, 1.4);
}

@media (forced-colors: active) {
    .connections-prereq__patience {
        border: 1px solid CanvasText;
        background: Canvas;
        color: CanvasText;
    }
}

/* Required-permissions foldout (Graph Step 1) — collapsed by default to
   keep the step compact. */
.connections-config__permissions {
    margin-block: var(--space-3);
}

    .connections-config__permissions > summary {
        cursor: pointer;
        font-weight: var(--font-weight-medium);
    }

.connections-config__permissions-intro {
    margin-block: var(--space-2);
    color: var(--color-text-muted);
}

/* Permissions grouped by API (Microsoft Graph read / write, Office 365 Exchange Online). */
.connections-config__permissions-group {
    margin-block: var(--space-3);
}

/* Muted pointer under the read group: the write scopes are hidden while
   the tenant's write-operations toggle is off. */
.connections-config__permissions-write-hint {
    margin: var(--space-2) 0 0;
    font-size: var(--font-size-sm);
    color: var(--color-text-muted);
}

.connections-config__permissions-group-heading {
    margin: 0 0 var(--space-2);
    font-size: var(--font-size-xs, 0.75rem);
    font-weight: var(--font-weight-semibold, 600);
    text-transform: uppercase;
    letter-spacing: 0.04em;
    color: var(--color-text-muted);
}

/* Bare scope names as wrapping monospace chips: scans as a compact grid
   on desktop and wraps naturally on narrow screens — no horizontal
   scrolling, no 35-row column. Long names break inside the chip. */
.connections-config__permissions-list {
    margin: 0;
    padding-inline-start: 0;
    list-style: none;
    display: flex;
    flex-wrap: wrap;
    gap: var(--space-2);
    font-family: var(--font-family-mono, ui-monospace, SFMono-Regular, "Cascadia Mono", Menlo, Consolas, monospace);
    font-size: var(--font-size-xs, 0.75rem);
    color: var(--color-text);
}

    .connections-config__permissions-list > li {
        padding: var(--space-1) var(--space-2);
        border: 1px solid var(--color-border-subtle);
        border-radius: var(--radius-md);
        background: var(--color-surface-sunken);
        overflow-wrap: anywhere;
        max-width: 100%;
    }

/* Each setup step has a single action button (Save / Test connection).
   A flex container here pushed that button off-screen — the global
   `.app-shell__main button[type="submit"]` rule already makes the
   button an inline-flex box, so the row just needs normal block flow
   plus top spacing. (If a step ever grows a second button, wrap them
   in their own flex row rather than flexing this container.) */
.connections-config__actions {
    margin-top: var(--space-4);
}

/* Read-only identity summary (Exchange Online Step 1, where the app
   registration is inherited from the Graph connection). Overrides the
   shared .settings-summary-list grid (whose max-content first column
   let the short id/domain values collapse and float right) with a
   simple block stack: each label sits above its value, full width. */
.connections-config__summary {
    display: block;
    margin: 0 0 var(--space-4);
}

    .connections-config__summary dt {
        margin-top: var(--space-3);
    }

    .connections-config__summary dt:first-child {
        margin-top: 0;
    }

    .connections-config__summary dd {
        margin: var(--space-1) 0 0;
        word-break: break-all;
    }

/* Probe result panel — green for ok, red for any failure variant.
   Lays out the structured outcome plus the per-permission checklist. */
.connections-config__probe {
    margin-top: var(--space-5);
    padding: var(--space-5) var(--space-6);
    border-radius: var(--radius-lg);
    border: 1px solid var(--color-border-subtle);
    background: var(--color-surface);
    box-shadow: var(--shadow-sm);
}

.connections-config__probe--ok {
    border-color: var(--color-success);
    background: var(--color-success-subtle, var(--color-surface));
}

.connections-config__probe--err {
    border-color: var(--color-danger);
    background: var(--color-danger-subtle, var(--color-surface));
}

@media (forced-colors: active) {
    .connections-config__probe,
    .connections-config__probe--ok,
    .connections-config__probe--err {
        border: 1px solid CanvasText;
        background: Canvas;
        box-shadow: none;
    }
}

.connections-config__probe-heading {
    margin: 0 0 var(--space-2);
    /* Body/UI font (Inter) — see .connections-substep__heading. */
    font-family: var(--font-sans);
    font-size: var(--font-size-md);
    font-weight: var(--font-weight-semibold);
    color: var(--color-text);
}

.connections-config__probe-summary {
    margin: 0;
    color: var(--color-text);
    line-height: var(--line-height-snug, 1.4);
}

.connections-config__probe-expiry {
    margin: var(--space-3) 0 0;
    color: var(--color-text-muted);
    font-size: var(--font-size-sm);
}

    /* Within 30 days — amber warning so operators see the rotation
       cue without missing it among the muted body copy. */
    .connections-config__probe-expiry--soon {
        color: var(--color-warning);
        font-weight: var(--font-weight-semibold);
    }

    /* Past expiry — red. Token acquisition has likely already failed
       (Entra rejects expired secrets); the line documents the cause. */
    .connections-config__probe-expiry--expired {
        color: var(--color-danger);
        font-weight: var(--font-weight-semibold);
    }

.connections-config__probe-permissions {
    margin: var(--space-4) 0 0;
    padding: 0;
    list-style: none;
    display: flex;
    flex-direction: column;
    gap: var(--space-2);
}

.connections-config__probe-permission {
    display: flex;
    align-items: center;
    gap: var(--space-2);
    font-size: var(--font-size-sm);
    color: var(--color-text);
}

.connections-config__probe-permission-glyph {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 1.25rem;
    height: 1.25rem;
    border-radius: 50%;
    font-weight: var(--font-weight-bold);
}

.connections-config__probe-permission--ok .connections-config__probe-permission-glyph {
    color: var(--color-success);
    background: color-mix(in srgb, var(--color-success) 15%, transparent);
}

.connections-config__probe-permission--err .connections-config__probe-permission-glyph {
    color: var(--color-danger);
    background: color-mix(in srgb, var(--color-danger) 15%, transparent);
}

.connections-config__probe-permission-error {
    margin-left: auto;
    color: var(--color-text-muted);
    font-family: var(--font-family-mono, ui-monospace, SFMono-Regular, "Cascadia Mono", Menlo, Consolas, monospace);
    font-size: var(--font-size-xs);
}

/* Exchange Online RBAC setup script — monospace block in a sunken
   surface, horizontally scrollable so long cmdlet lines never widen
   the page. */
.connections-config__script {
    margin: var(--space-3) 0 0;
    padding: var(--space-4);
    border-radius: var(--radius-md);
    background: var(--color-surface-sunken);
    border: 1px solid var(--color-border-subtle);
    font-family: var(--font-family-mono, ui-monospace, SFMono-Regular, "Cascadia Mono", Menlo, Consolas, monospace);
    font-size: var(--font-size-sm);
    line-height: var(--line-height-snug, 1.4);
    overflow-x: auto;
    white-space: pre;
}

/* Read-only syntax colouring for the setup script (PowerShellScriptHighlighter tokens). Colours map to the
   adaptive semantic palette so they stay legible in both light and dark themes; plain tokens inherit the base
   text colour. */
.connections-config__script .ps-comment {
    color: var(--color-text-muted);
    font-style: italic;
}

.connections-config__script .ps-string {
    color: var(--color-success);
}

.connections-config__script .ps-cmdlet {
    color: var(--color-info);
    font-weight: var(--font-weight-medium, 500);
}

.connections-config__script .ps-param {
    color: var(--color-warning);
}

.connections-config__script .ps-var {
    color: var(--color-danger);
}

.connections-config__script .ps-keyword {
    font-weight: var(--font-weight-semibold, 600);
}