/* Cadence authentication — the ONE login for every tenant.
   Contract: Codex login spec, 2026-08-22. This surface belongs to the platform: shell, skin, and
   tenant themes do not own it, and it loads AFTER them so nothing overrides it. Only the workspace
   name and the available auth methods may vary between tenants. */
/* showShell() hides the gateway with .hidden — the auth namespace owns that rule now
   (the legacy #login-screen.hidden lived in a sheet the login purge removed). */
.auth-gateway.hidden { display:none !important; }
.auth-gateway {
  --auth-ink:#17141D;
  --auth-muted:#6F6B70;
  --auth-faint:#9A969B;
  --auth-canvas:#F3F1ED;
  --auth-surface:#FFFFFF;
  --auth-rule:#DDD8D1;
  --auth-rule-strong:#C9C3BB;
  --auth-primary:#2B2134;
  --auth-primary-hover:#211927;
  --auth-error:#A7362D;
  min-height:100vh;
  min-height:100svh;
  display:grid;
  place-items:center;
  padding:clamp(24px,5vw,72px);
  color:var(--auth-ink);
  background:var(--auth-canvas);
  font-family:"Instrument Sans",Arial,sans-serif;
}
/* Compact authentication object, not a tall white slab: wider than it is problematic (560px)
   and short (~520px in the full password state) — squarish proportions, no fixed height. */
.auth-card {
  width:min(560px,100%);
  padding:28px 40px 24px;
  background:var(--auth-surface);
  border:1px solid var(--auth-rule);
  border-radius:18px;
  box-shadow:0 26px 72px rgba(35,27,39,.09);
}
.auth-brand { display:flex; align-items:center; gap:11px; }
.auth-brand-mark { width:30px; height:30px; display:block; object-fit:contain; }
.auth-wordmark {
  color:var(--auth-ink);
  font-family:"Newsreader",Georgia,serif;
  font-size:27px;
  font-weight:720;
  line-height:1;
  letter-spacing:-0.018em;   /* canonical wordmark tracking — matches the measured lockup */
}
/* One divider only — the rule above the workspace block. The rule below it was the second
   frame around a one-line fact and most of the perceived stretch. */
.auth-workspace {
  margin:18px 0 18px;
  padding:14px 0 0;
  border-top:1px solid var(--auth-rule);
}
.auth-workspace-label {
  display:block;
  margin-bottom:6px;
  color:var(--auth-faint);
  font-size:10px;
  font-weight:600;
  letter-spacing:.13em;
  text-transform:uppercase;
}
.auth-tenant { margin:0; }
.auth-tenant strong { color:var(--auth-ink); font-size:15px; font-weight:600; line-height:1.3; }
.auth-intro { margin-bottom:18px; }
.auth-intro h1 {
  margin:0;
  color:var(--auth-ink);
  font-family:"Newsreader",Georgia,serif;
  font-size:26px;
  font-weight:580;
  line-height:1.06;
  letter-spacing:-.035em;
}
.auth-intro p { margin:6px 0 0; color:var(--auth-muted); font-size:13.5px; line-height:1.5; }
.auth-form { margin:0; }
.auth-label { display:block; margin:0 0 7px; color:var(--auth-ink); font-size:11.5px; font-weight:600; }
.auth-input {
  width:100%;
  height:48px;
  margin:0 0 14px;
  padding:0 14px;
  color:var(--auth-ink);
  background:var(--auth-surface);
  border:1px solid var(--auth-rule-strong);
  border-radius:9px;
  outline:none;
  box-shadow:none;
  font:inherit;
  font-size:14px;
  transition:border-color .14s,box-shadow .14s;
}
.auth-input::placeholder { color:#9D999D; }
.auth-input:hover { border-color:#AAA39B; }
.auth-input:focus { border-color:var(--auth-primary); box-shadow:0 0 0 3px rgba(43,33,52,.12); }
.auth-primary,
.auth-secondary {
  width:100%;
  min-height:48px;
  display:flex;
  align-items:center;
  justify-content:center;
  gap:10px;
  padding:0 16px;
  border-radius:9px;
  font:inherit;
  font-size:13px;
  font-weight:600;
  cursor:pointer;
}
.auth-primary {
  justify-content:space-between;
  color:#fff;
  background:var(--auth-primary);
  border:1px solid var(--auth-primary);
  box-shadow:0 4px 11px rgba(43,33,52,.10);
}
.auth-primary:hover { background:var(--auth-primary-hover); border-color:var(--auth-primary-hover); }
.auth-primary:active { transform:translateY(1px); }
.auth-primary[disabled] { opacity:.55; cursor:default; transform:none; }
.auth-primary span { color:rgba(255,255,255,.78); font-size:18px; font-weight:400; }
.auth-secondary {
  margin-top:10px;
  color:var(--auth-ink);
  background:var(--auth-surface);
  border:1px solid var(--auth-rule-strong);
}
.auth-secondary:hover { border-color:#AAA39B; }
.auth-primary:focus-visible,
.auth-secondary:focus-visible,
.auth-alt:focus-visible { outline:2px solid var(--auth-primary); outline-offset:3px; }
/* Quiet mode switch (workspace password ↔ email account) — a text link, never competing with Sign in. */
.auth-alt {
  display:block;
  margin:14px auto 0;
  border:0;
  background:none;
  padding:0;
  font:inherit;
  font-size:12px;
  color:var(--auth-muted);
  text-decoration:underline;
  text-underline-offset:3px;
  cursor:pointer;
}
.auth-alt:hover { color:var(--auth-ink); }
/* States that haven't happened take no room: the error strip exists only once it has text. */
.auth-error { margin-top:11px; color:var(--auth-error); font-size:11.5px; line-height:1.4; }
.auth-error:empty { display:none; }
/* Footer follows the last action; it is not pinned to the card bottom. */
.auth-note { margin:18px 0 0; color:var(--auth-faint); font-size:10.5px; line-height:1.45; text-align:center; }
@media(max-width:560px) {
  .auth-gateway { place-items:center; padding:0; background:var(--auth-surface); }
  .auth-card { width:100%; padding:34px 24px 28px; border:0; border-radius:0; box-shadow:none; }
  .auth-workspace { margin:24px 0 24px; }
  .auth-intro h1 { font-size:24px; }
}
@media(prefers-reduced-motion:reduce) {
  .auth-input, .auth-primary { transition:none; }
}
/* SSO handoff splash — masks the redirect hops (app -> Oracle -> app) so SSO reads as one motion
   instead of three white flashes. Shown on the outbound click and again while the session boots on
   return. Uses the auth canvas so it blends with the gateway it replaces. */
.oidc-splash {
  position:fixed; inset:0; z-index:9999;
  display:none; place-items:center;
  padding:24px;
  background:var(--auth-canvas,#F3F1ED);
  font-family:"Instrument Sans",Arial,sans-serif;
}
.oidc-splash.show { display:grid; }
.oidc-splash-card { display:flex; flex-direction:column; align-items:center; gap:18px; }
.oidc-splash-spin {
  width:34px; height:34px; border-radius:50%;
  border:3px solid rgba(43,33,52,.18);
  border-top-color:var(--auth-primary,#2B2134);
  animation:oidc-spin .7s linear infinite;
}
.oidc-splash-msg {
  margin:0; color:var(--auth-muted,#6F6B70);
  font-size:14px; font-weight:600; letter-spacing:.01em;
}
@keyframes oidc-spin { to { transform:rotate(360deg); } }
@media(prefers-reduced-motion:reduce) { .oidc-splash-spin { animation:none; } }