{% extends "base_bare.html" %}
{% from "_components.html" import brand_mark %}
{% block content %}
<section class="auth-story" aria-labelledby="ragcore-heading">
  <div class="auth-story__brand">
    {{ brand_mark("lg") }}
    <div>
      <span class="eyebrow">Private knowledge. Verifiable answers.</span>
      <h1 id="ragcore-heading">RAGCore</h1>
    </div>
  </div>
  <p class="auth-story__lead">
    Turn governed source material into searchable evidence and grounded answers,
    without giving up provenance or local control.
  </p>

  <ol class="auth-flow" data-rag-flow="sources-retrieval-answers" aria-label="RAGCore knowledge flow">
    <li>
      <span class="auth-flow__index">01</span>
      <span class="auth-flow__icon material-symbols-outlined" aria-hidden="true">hub</span>
      <div><strong>Governed sources</strong><span>Versioned content with immutable provenance.</span></div>
    </li>
    <li>
      <span class="auth-flow__index">02</span>
      <span class="auth-flow__icon material-symbols-outlined" aria-hidden="true">manage_search</span>
      <div><strong>Dense + sparse retrieval</strong><span>Policy-filtered evidence fused deterministically.</span></div>
    </li>
    <li>
      <span class="auth-flow__index">03</span>
      <span class="auth-flow__icon material-symbols-outlined" aria-hidden="true">format_quote</span>
      <div><strong>Cited answers</strong><span>Grounded claims that point back to their source version.</span></div>
    </li>
  </ol>

  <p class="auth-story__architecture">
    <span>PostgreSQL authority</span><span aria-hidden="true">·</span>
    <span>Rebuildable vector index</span><span aria-hidden="true">·</span>
    <span>Local-first routing</span>
  </p>
</section>

<section class="sign-in-panel" aria-labelledby="sign-in-heading">
  <div class="sign-in-panel__topline">
    <span class="sign-in-panel__mark">{{ brand_mark("xs") }}</span>
    {% if oidc_configured %}
    <span class="security-chip"><span class="material-symbols-outlined" aria-hidden="true">shield_lock</span>OIDC secured</span>
    {% else %}
    <span class="security-chip security-chip--muted"><span class="material-symbols-outlined" aria-hidden="true">info</span>Setup required</span>
    {% endif %}
  </div>
  <div>
    <p class="eyebrow">Knowledge control plane</p>
    <h2 id="sign-in-heading">Continue to your workspace</h2>
    <p id="sign-in-description" class="sign-in-panel__description">
      Access sources, ingestion operations, retrieval diagnostics and policy configuration.
    </p>
  </div>

  {% if oidc_configured %}
  <a href="/auth/login" class="sign-in-action" aria-describedby="sign-in-description">
    <span class="material-symbols-outlined" aria-hidden="true">passkey</span>
    <span>Sign in with SSO</span>
    <span class="material-symbols-outlined sign-in-action__arrow" aria-hidden="true">arrow_forward</span>
  </a>
  <p class="sign-in-panel__note">
    Your identity provider handles credentials. RAGCore does not expose a local password form.
  </p>
  {% else %}
  <div class="sign-in-unavailable" role="status">
    <span class="material-symbols-outlined" aria-hidden="true">info</span>
    <p><strong>No identity provider is configured</strong><span>Contact your platform administrator to enable sign-in for this deployment.</span></p>
  </div>
  {% endif %}
</section>
{% endblock %}