/* Cadence authentication — the ONE login for every tenant.
   Contract: Codex login spec, 2026-08-22. This surface belongs to the platform: shell, skin, and
   tenant themes do not own it, and it loads AFTER them so nothing overrides it. Only the workspace
   name and the available auth methods may vary between tenants. */
/* showShell() hides the gateway with .hidden — the auth namespace owns that rule now
   (the legacy #login-screen.hidden lived in a sheet the login purge removed). */
.auth-gateway.hidden { display:none !important; }
.auth-gateway {
  --auth-ink:#17141D;
  --auth-muted:#6F6B70;
  --auth-faint:#9A969B;
  --auth-canvas:#F3F1ED;
  --auth-surface:#FFFFFF;
  --auth-rule:#DDD8D1;
  --auth-rule-strong:#C9C3BB;
  --auth-primary:#2B2134;
  --auth-primary-hover:#211927;
  --auth-error:#A7362D;
  min-height:100vh;
  min-height:100svh;
  display:grid;
  place-items:center;
  padding:clamp(24px,5vw,72px);
  color:var(--auth-ink);
  background:var(--auth-canvas);
  font-family:"Instrument Sans",Arial,sans-serif;
}
/* Compact authentication object, not a tall white slab: wider than it is problematic (560px)
   and short (~520px in the full password state) — squarish proportions, no fixed height. */
.auth-card {
  width:min(560px,100%);
  padding:28px 40px 24px;
  background:var(--auth-surface);
  border:1px solid var(--auth-rule);
  border-radius:18px;
  box-shadow:0 26px 72px rgba(35,27,39,.09);
}
.auth-brand { display:flex; align-items:center; gap:11px; }
.auth-brand-mark { width:30px; height:30px; display:block; object-fit:contain; }
.auth-wordmark {
  color:var(--auth-ink);
  font-family:"Newsreader",Georgia,serif;
  font-size:27px;
  font-weight:720;
  line-height:1;
  letter-spacing:-0.018em;   /* canonical wordmark tracking — matches the measured lockup */
}
/* One divider only — the rule above the workspace block. The rule below it was the second
   frame around a one-line fact and most of the perceived stretch. */
.auth-workspace {
  margin:18px 0 18px;
  padding:14px 0 0;
  border-top:1px solid var(--auth-rule);
}
.auth-workspace-label {
  display:block;
  margin-bottom:6px;
  color:var(--auth-faint);
  font-size:10px;
  font-weight:600;
  letter-spacing:.13em;
  text-transform:uppercase;
}
.auth-tenant { margin:0; }
.auth-tenant strong { color:var(--auth-ink); font-size:15px; font-weight:600; line-height:1.3; }
.auth-intro { margin-bottom:18px; }
.auth-intro h1 {
  margin:0;
  color:var(--auth-ink);
  font-family:"Newsreader",Georgia,serif;
  font-size:26px;
  font-weight:580;
  line-height:1.06;
  letter-spacing:-.035em;
}
.auth-intro p { margin:6px 0 0; color:var(--auth-muted); font-size:13.5px; line-height:1.5; }
.auth-form { margin:0; }
.auth-label { display:block; margin:0 0 7px; color:var(--auth-ink); font-size:11.5px; font-weight:600; }
.auth-input {
  width:100%;
  height:48px;
  margin:0 0 14px;
  padding:0 14px;
  color:var(--auth-ink);
  background:var(--auth-surface);
  border:1px solid var(--auth-rule-strong);
  border-radius:9px;
  outline:none;
  box-shadow:none;
  font:inherit;
  font-size:14px;
  transition:border-color .14s,box-shadow .14s;
}
.auth-input::placeholder { color:#9D999D; }
.auth-input:hover { border-color:#AAA39B; }
.auth-input:focus { border-color:var(--auth-primary); box-shadow:0 0 0 3px rgba(43,33,52,.12); }
.auth-primary,
.auth-secondary {
  width:100%;
  min-height:48px;
  display:flex;
  align-items:center;
  justify-content:center;
  gap:10px;
  padding:0 16px;
  border-radius:9px;
  font:inherit;
  font-size:13px;
  font-weight:600;
  cursor:pointer;
}
.auth-primary {
  justify-content:space-between;
  color:#fff;
  background:var(--auth-primary);
  border:1px solid var(--auth-primary);
  box-shadow:0 4px 11px rgba(43,33,52,.10);
}
.auth-primary:hover { background:var(--auth-primary-hover); border-color:var(--auth-primary-hover); }
.auth-primary:active { transform:translateY(1px); }
.auth-primary[disabled] { opacity:.55; cursor:default; transform:none; }
.auth-primary span { color:rgba(255,255,255,.78); font-size:18px; font-weight:400; }
.auth-secondary {
  margin-top:10px;
  color:var(--auth-ink);
  background:var(--auth-surface);
  border:1px solid var(--auth-rule-strong);
}
.auth-secondary:hover { border-color:#AAA39B; }
.auth-primary:focus-visible,
.auth-secondary:focus-visible,
.auth-alt:focus-visible { outline:2px solid var(--auth-primary); outline-offset:3px; }
/* Quiet mode switch (workspace password ↔ email account) — a text link, never competing with Sign in. */
.auth-alt {
  display:block;
  margin:14px auto 0;
  border:0;
  background:none;
  padding:0;
  font:inherit;
  font-size:12px;
  color:var(--auth-muted);
  text-decoration:underline;
  text-underline-offset:3px;
  cursor:pointer;
}
.auth-alt:hover { color:var(--auth-ink); }
/* States that haven't happened take no room: the error strip exists only once it has text. */
.auth-error { margin-top:11px; color:var(--auth-error); font-size:11.5px; line-height:1.4; }
.auth-error:empty { display:none; }
/* Footer follows the last action; it is not pinned to the card bottom. */
.auth-note { margin:18px 0 0; color:var(--auth-faint); font-size:10.5px; line-height:1.45; text-align:center; }
@media(max-width:560px) {
  .auth-gateway { place-items:center; padding:0; background:var(--auth-surface); }
  .auth-card { width:100%; padding:34px 24px 28px; border:0; border-radius:0; box-shadow:none; }
  .auth-workspace { margin:24px 0 24px; }
  .auth-intro h1 { font-size:24px; }
}
@media(prefers-reduced-motion:reduce) {
  .auth-input, .auth-primary { transition:none; }
}