/* Security checkpoint — post-login MFA + auth-shell parity (preview v1) */

.rmc-security-checkpoint-page {
  display: flex;
  flex-direction: column;
  align-items: center;
  padding: clamp(1rem, 3vw, 1.5rem) clamp(0.75rem, 2vw, 1.25rem) clamp(1.5rem, 4vw, 2rem);
  width: 100%;
  min-width: 0;
}

.rmc-security-checkpoint-page--wide {
  --rmc-checkpoint-w: min(100%, 40rem);
}

.rmc-security-checkpoint {
  width: min(100%, var(--rmc-checkpoint-w, 26.25rem));
  flex-shrink: 0;
}

.rmc-security-checkpoint__trail {
  display: flex;
  align-items: center;
  flex-wrap: wrap;
  gap: 0.35rem 0.5rem;
  font-size: 0.6875rem;
  color: var(--text-secondary, var(--admin-content-text-muted));
  margin-bottom: 0.875rem;
  width: min(100%, var(--rmc-checkpoint-w, 26.25rem));
}

.rmc-security-checkpoint__trail-step.is-active {
  color: var(--school-primary, var(--brand-primary, #4f46e5));
  font-weight: 600;
}

.rmc-security-checkpoint__trail-sep {
  opacity: 0.35;
  font-style: normal;
}

.rmc-security-checkpoint__card,
.rmc-security-checkpoint-page .auth-card {
  background: var(--surface-elevated, var(--admin-content-bg, #fff));
  border: 1px solid var(--hairline, var(--admin-content-border));
  border-radius: var(--radius-lg, 16px);
  box-shadow: var(--elev-2, 0 4px 12px rgba(15, 23, 42, 0.08));
  overflow: visible;
  width: 100%;
}

.rmc-security-checkpoint-page .auth-shell {
  width: min(100%, var(--rmc-checkpoint-w, 26.25rem));
  margin: 0;
  padding: 0;
  max-width: none;
}

.rmc-security-checkpoint__head {
  padding: 1.125rem 1.25rem 0.875rem;
  border-bottom: 1px solid var(--hairline, var(--admin-content-border));
  display: flex;
  gap: 0.75rem;
  align-items: flex-start;
}

.rmc-security-checkpoint__icon {
  width: 2.5rem;
  height: 2.5rem;
  border-radius: 0.6875rem;
  flex-shrink: 0;
  background: color-mix(in oklab, var(--school-primary, #4f46e5) 12%, transparent);
  color: var(--school-primary, #4f46e5);
  display: grid;
  place-items: center;
  font-size: 1.125rem;
}

.rmc-security-checkpoint__icon .bi {
  font-size: 1.125rem;
}

.rmc-security-checkpoint__eyebrow {
  font-size: 0.625rem;
  font-weight: 800;
  letter-spacing: 0.08em;
  text-transform: uppercase;
  color: var(--text-tertiary, var(--admin-content-text-muted));
}

.rmc-security-checkpoint__head h1,
.rmc-security-checkpoint__head h2 {
  margin: 0.125rem 0 0;
  font-size: 1.25rem;
  font-weight: 700;
  letter-spacing: -0.02em;
  line-height: 1.2;
}

.rmc-security-checkpoint__body {
  padding: 1.125rem 1.25rem 1.25rem;
}

.rmc-security-checkpoint__sub {
  margin: 0 0 1rem;
  font-size: 0.8125rem;
  color: var(--text-secondary, var(--admin-content-text-muted));
  line-height: 1.5;
}

.rmc-security-checkpoint__foot {
  padding: 0.75rem 1.25rem;
  border-top: 1px solid var(--hairline, var(--admin-content-border));
  font-size: 0.6875rem;
  color: var(--text-tertiary, var(--admin-content-text-muted));
  display: flex;
  justify-content: space-between;
  align-items: center;
  gap: 0.75rem;
  flex-wrap: wrap;
}

.rmc-security-checkpoint__foot a {
  color: var(--school-primary, #4f46e5);
  text-decoration: none;
  font-weight: 600;
}

.rmc-security-checkpoint__foot a:hover {
  text-decoration: underline;
}

/* OTP */
.rmc-mfa-otp {
  display: flex;
  gap: 0.5rem;
  justify-content: center;
  margin: 0 0 1rem;
}

.rmc-mfa-otp__cell {
  width: 2.75rem;
  height: 3.25rem;
  border-radius: var(--radius-md, 12px);
  border: 1px solid var(--hairline-strong, var(--admin-content-border));
  background: var(--surface-canvas, var(--surface-bg-subtle, #fbfbfd));
  font-family: var(--font-mono, ui-monospace, monospace);
  font-size: 1.25rem;
  font-weight: 700;
  text-align: center;
  color: var(--text-primary, var(--admin-content-text));
  transition: border-color var(--motion-fast, 0.15s ease), box-shadow var(--motion-fast, 0.15s ease);
}

.rmc-mfa-otp__cell:focus {
  outline: none;
  border-color: var(--school-primary, #4f46e5);
  box-shadow: 0 0 0 3px color-mix(in oklab, var(--school-primary, #4f46e5) 18%, transparent);
}

.rmc-mfa-otp__sr {
  position: absolute;
  width: 1px;
  height: 1px;
  padding: 0;
  margin: -1px;
  overflow: hidden;
  clip: rect(0, 0, 0, 0);
  white-space: nowrap;
  border: 0;
}

.rmc-security-checkpoint__trust {
  display: flex;
  align-items: center;
  gap: 0.5rem;
  font-size: 0.75rem;
  color: var(--text-secondary, var(--admin-content-text-muted));
  margin-bottom: 1rem;
}

.rmc-security-checkpoint__trust input {
  accent-color: var(--school-primary, #4f46e5);
}

.rmc-security-checkpoint__trust label:not(.visually-hidden) {
  flex: 1 1 auto;
  min-width: 0;
}

.rmc-security-checkpoint__trust select {
  flex: 0 0 auto;
  width: auto;
  min-width: 6.5rem;
}

.rmc-security-checkpoint__actions {
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
}

.rmc-security-checkpoint__divider {
  display: flex;
  align-items: center;
  gap: 0.625rem;
  margin: 0.875rem 0;
  font-size: 0.625rem;
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  color: var(--text-tertiary, var(--admin-content-text-muted));
}

.rmc-security-checkpoint__divider::before,
.rmc-security-checkpoint__divider::after {
  content: "";
  flex: 1;
  height: 1px;
  background: var(--hairline, var(--admin-content-border));
}

.rmc-security-checkpoint__stepper {
  display: flex;
  margin-bottom: 1rem;
  border-radius: var(--radius-pill, 999px);
  border: 1px solid var(--hairline, var(--admin-content-border));
  overflow: hidden;
  background: var(--surface-canvas, var(--surface-bg-subtle));
}

.rmc-security-checkpoint__stepper span {
  flex: 1;
  font-size: 0.625rem;
  font-weight: 700;
  padding: 0.5rem 0.375rem;
  text-align: center;
  color: var(--text-tertiary, var(--admin-content-text-muted));
  border-right: 1px solid var(--hairline, var(--admin-content-border));
}

.rmc-security-checkpoint__stepper span:last-child {
  border-right: 0;
}

.rmc-security-checkpoint__stepper span.is-active {
  background: color-mix(in oklab, var(--school-primary, #4f46e5) 10%, transparent);
  color: var(--school-primary, #4f46e5);
}

.rmc-security-checkpoint__qr-grid {
  display: grid;
  grid-template-columns: 8.75rem 1fr;
  gap: 0.875rem;
  align-items: start;
  margin-bottom: 1rem;
}

.rmc-security-checkpoint__qr-wrap {
  padding: 0.5rem;
  border-radius: var(--radius-md, 12px);
  background: var(--surface-canvas, #fff);
  border: 1px solid var(--hairline, var(--admin-content-border));
}

.rmc-security-checkpoint__qr-wrap img {
  display: block;
  width: 100%;
  height: auto;
  border-radius: var(--radius-sm, 8px);
}

.rmc-security-checkpoint__secret {
  font-family: var(--font-mono, ui-monospace, monospace);
  font-size: 0.6875rem;
  padding: 0.5rem 0.625rem;
  border-radius: var(--radius-sm, 8px);
  background: var(--surface-canvas, var(--surface-bg-subtle));
  border: 1px solid var(--hairline, var(--admin-content-border));
  word-break: break-all;
  margin-top: 0.375rem;
}

.rmc-security-checkpoint__backup-codes {
  display: flex;
  flex-wrap: wrap;
  gap: 0.375rem;
  margin: 0.5rem 0 1rem;
}

/* Retire dual-rail on checkpoint surfaces */
.rmc-security-checkpoint .rmc-account-auth-shell__rail,
[data-rmc-security-checkpoint] .rmc-account-auth-shell__rail {
  display: none !important;
}

.rmc-security-checkpoint.rmc-account-auth-shell,
[data-rmc-security-checkpoint].rmc-account-auth-shell {
  display: block;
  width: min(100%, var(--rmc-checkpoint-w, 26.25rem));
  margin: 0 auto;
  grid-template-columns: minmax(0, 1fr);
}

.rmc-security-checkpoint .rmc-account-auth-shell__primary {
  min-width: 0;
}

.cp-layout[data-rmc-page-archetype="security-workbench"] .cp-page-body,
.rmc-security-checkpoint-page {
  min-height: 0;
}

@media (max-width: 575.98px) {
  .rmc-mfa-otp__cell {
    width: 2.5rem;
    height: 3rem;
    font-size: 1.125rem;
  }

  .rmc-security-checkpoint__qr-grid {
    grid-template-columns: 1fr;
    justify-items: center;
    text-align: center;
  }

  .rmc-security-checkpoint__trust {
    flex-wrap: wrap;
  }

  .rmc-security-checkpoint__trust select {
    margin-left: 1.5rem;
  }
}

/* ── Hub / secondary security menus — fill available width intelligently ── */
.rmc-security-checkpoint-page--wide {
  --rmc-checkpoint-w: min(100%, 52rem);
  width: 100%;
}

.rmc-security-hub-grid {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(min(100%, 15.5rem), 1fr));
  gap: 0.75rem;
  width: 100%;
}

.rmc-security-hub-grid .card,
.rmc-security-hub-grid .rmc-security-checkpoint__card {
  height: 100%;
  margin: 0;
}

.rmc-security-checkpoint-page--wide .auth-shell {
  width: 100%;
  max-width: var(--rmc-checkpoint-w);
}

.rmc-security-checkpoint-page--wide .auth-card {
  width: 100%;
}

.rmc-security-checkpoint-page[data-rmc-surface-density="hub"] .container,
.rmc-security-checkpoint-page[data-rmc-surface-density="hub"] .container-fluid,
.rmc-security-checkpoint-page[data-rmc-surface-density="hub"] .container-lg {
  width: 100%;
  max-width: var(--rmc-checkpoint-w);
  padding-inline: 0;
}

/* Task tables inside checkpoint shells — use full card width */
.rmc-security-checkpoint-page .rmc-data-table {
  width: 100%;
}

/* Signup / onboarding wide wizards */
.rmc-security-checkpoint-page--wide .auth-card--signup,
.rmc-security-checkpoint-page--wide .rmc-signup-done__card {
  width: 100%;
  max-width: var(--rmc-checkpoint-w);
}