/* ========== EP-400 design tokens — login-screen self-contained copy (T-EPF01) ==========
 *
 * QA defect D1 (docs/qa/ep400-live-smoke-2026-05-31.md, HIGH): the EP-400
 * token `:root` block AND the four Instrument `@font-face` rules live only in
 * the theme `style.css`, which `wp-login.php` never enqueues — only THIS file
 * (`auth.css`) reaches the login screen. So on the login surfaces every
 * `var(--cah-t2-*)` resolved to nothing (dark-pill CTA + floating-label
 * degraded) and Instrument Serif never loaded (H1 fell back to Times New Roman).
 *
 * Fix: copy the RESOLVED token values + `@font-face` rules verbatim from
 * `style.css` (source of truth: docs/spec/brand-tokens-ep400.md). NOT an
 * `@import` — the login screen must be self-contained without pulling the full
 * theme sheet. Keep these in sync with `style.css` until the design system
 * promotes them to a shared partial (tracked for T-EP22 / PRODUCTION-GAP).
 *
 * Font paths are relative to this file (assets/css/) → `../fonts/…`, equivalent
 * to `./assets/fonts/…` in style.css.
 */

@font-face {
    font-family: 'Instrument Sans';
    font-style: normal;
    font-weight: 400 700;
    font-display: swap;
    src: url('../fonts/InstrumentSans-Variable.woff2') format('woff2');
}
@font-face {
    font-family: 'Instrument Sans';
    font-style: italic;
    font-weight: 400 700;
    font-display: swap;
    src: url('../fonts/InstrumentSans-Italic-Variable.woff2') format('woff2');
}
@font-face {
    font-family: 'Instrument Serif';
    font-style: normal;
    font-weight: 400;
    font-display: swap;
    src: url('../fonts/InstrumentSerif-Regular.woff2') format('woff2');
}
@font-face {
    font-family: 'Instrument Serif';
    font-style: italic;
    font-weight: 400;
    font-display: swap;
    src: url('../fonts/InstrumentSerif-Italic.woff2') format('woff2');
}

:root {
    /* ---- Tier 1: brand-blue (charcoal grey-blue) ---- */
    --cah-t1-brand-blue-100: #8E98A8;
    --cah-t1-brand-blue-200: #BCBEC0;
    --cah-t1-brand-blue-300: #9C9EA1;
    --cah-t1-brand-blue-400: #6E7276;
    --cah-t1-brand-blue-500: #52575C;
    --cah-t1-brand-blue-600: #272D33;
    --cah-t1-brand-blue-700: #23292E;
    --cah-t1-brand-blue-800: #1C2024;
    --cah-t1-brand-blue-900: #15191C;

    /* ---- Tier 1: brand-teal (mint accent) ---- */
    --cah-t1-brand-teal-100: #E2F6EF;
    --cah-t1-brand-teal-200: #BEE8D9;
    --cah-t1-brand-teal-300: #9FDDC7;
    --cah-t1-brand-teal-400: #73CEAD;
    --cah-t1-brand-teal-500: #58C59D;
    --cah-t1-brand-teal-600: #2EB685;
    --cah-t1-brand-teal-700: #2AA679;
    --cah-t1-brand-teal-800: #21815E;
    --cah-t1-brand-teal-900: #196449;

    /* ---- Tier 1: neutral (APPROX — designer confirms) ---- */
    --cah-t1-neutral-white: #FFFFFF;
    --cah-t1-neutral-100: #F5F5F5;
    --cah-t1-neutral-200: #E5E5E5;
    --cah-t1-neutral-300: #D4D4D4;
    --cah-t1-neutral-400: #A0A0A0;
    --cah-t1-neutral-500: #737373;
    --cah-t1-neutral-600: #525252;
    --cah-t1-neutral-700: #404040;
    --cah-t1-neutral-800: #262626;
    --cah-t1-neutral-900: #171717;
    --cah-t1-neutral-black: #000000;

    /* ---- Tier 1: cream (APPROX) ---- */
    --cah-t1-brand-cream-100: #F8F4E8;

    /* ---- Tier 1: utility scales (APPROX) ---- */
    --cah-t1-utility-red-100: #FCE6E6;
    --cah-t1-utility-red-500: #C53030;
    --cah-t1-utility-red-600: #A02B2B;
    --cah-t1-utility-red-700: #8E2222;
    --cah-t1-utility-orange-100: #FAE9D5;
    --cah-t1-utility-orange-500: #E0993D;
    --cah-t1-utility-orange-600: #D38933;
    --cah-t1-utility-orange-700: #B97320;
    --cah-t1-utility-green-100: #DCEDD9;
    --cah-t1-utility-green-500: #4C8A4C;
    --cah-t1-utility-green-600: #3D7A4A;
    --cah-t1-utility-green-700: #2E5F2E;
    --cah-t1-utility-blue-100: #EEF1F4;
    --cah-t1-utility-blue-500: #52575C;
    --cah-t1-utility-blue-600: #23292E;
    --cah-t1-utility-blue-700: #1A1F23;

    /* ---- Tier 1: transparent ---- */
    --cah-t1-transparent-25: rgba(0, 0, 0, 0.25);
    --cah-t1-transparent-90: rgba(0, 0, 0, 0.90);

    /* ---- Tier 1: typography families ---- */
    --cah-t1-font-family-sans: 'Instrument Sans', -apple-system, BlinkMacSystemFont, 'Helvetica Neue', Arial, sans-serif;
    --cah-t1-font-family-serif: 'Instrument Serif', Georgia, 'Times New Roman', serif;

    /* ---- Tier 1: spacing scale (provisional defaults) ---- */
    --cah-t1-spacing-2: 2px;
    --cah-t1-spacing-4: 4px;
    --cah-t1-spacing-8: 8px;
    --cah-t1-spacing-12: 12px;
    --cah-t1-spacing-16: 16px;
    --cah-t1-spacing-20: 20px;
    --cah-t1-spacing-24: 24px;
    --cah-t1-spacing-32: 32px;
    --cah-t1-spacing-40: 40px;
    --cah-t1-spacing-48: 48px;
    --cah-t1-spacing-64: 64px;

    /* ---- Tier 1: border-radius scale (provisional) ---- */
    --cah-t1-radius-0: 0;
    --cah-t1-radius-2: 2px;
    --cah-t1-radius-4: 4px;
    --cah-t1-radius-8: 8px;
    --cah-t1-radius-12: 12px;
    --cah-t1-radius-pill: 999px;

    /* ---- Tier 2: background ---- */
    --cah-t2-bg-default: var(--cah-t1-neutral-white);
    --cah-t2-bg-default-hover: var(--cah-t1-neutral-100);
    --cah-t2-bg-subtle: var(--cah-t1-brand-blue-200);
    --cah-t2-bg-subtle-hover: var(--cah-t1-brand-blue-300);
    --cah-t2-bg-knockout: var(--cah-t1-brand-blue-600);
    --cah-t2-bg-disabled: var(--cah-t1-neutral-200);
    --cah-t2-bg-brand: var(--cah-t1-brand-teal-300);
    --cah-t2-bg-brand-hover: var(--cah-t1-brand-teal-400);
    --cah-t2-bg-brand-disabled: var(--cah-t1-neutral-200);
    --cah-t2-bg-brand-knockout: var(--cah-t1-brand-teal-500);
    --cah-t2-bg-brand-knockout-hover: var(--cah-t1-brand-teal-600);
    --cah-t2-bg-transparent-25: var(--cah-t1-transparent-25);
    --cah-t2-bg-transparent-90: var(--cah-t1-transparent-90);
    --cah-t2-bg-utility-error: var(--cah-t1-utility-red-100);
    --cah-t2-bg-utility-error-knockout: var(--cah-t1-utility-red-600);
    --cah-t2-bg-utility-warning: var(--cah-t1-utility-orange-100);
    --cah-t2-bg-utility-warning-knockout: var(--cah-t1-utility-orange-600);
    --cah-t2-bg-utility-success: var(--cah-t1-utility-green-100);
    --cah-t2-bg-utility-success-knockout: var(--cah-t1-utility-green-600);
    --cah-t2-bg-utility-info: var(--cah-t1-utility-blue-100);
    --cah-t2-bg-utility-info-knockout: var(--cah-t1-utility-blue-600);

    /* ---- Tier 2: content ---- */
    --cah-t2-content-default: var(--cah-t1-brand-blue-600);
    --cah-t2-content-default-hover: var(--cah-t1-brand-blue-700);
    --cah-t2-content-subtle: var(--cah-t1-neutral-700);
    --cah-t2-content-knockout: var(--cah-t1-brand-cream-100);
    --cah-t2-content-disabled: var(--cah-t1-neutral-700);
    --cah-t2-content-brand: var(--cah-t1-brand-teal-500);
    --cah-t2-content-brand-hover: var(--cah-t1-brand-teal-600);
    --cah-t2-content-brand-knockout: var(--cah-t1-brand-blue-100);
    --cah-t2-content-utility-error: var(--cah-t1-utility-red-700);
    --cah-t2-content-utility-warning: var(--cah-t1-utility-orange-700);
    --cah-t2-content-utility-success: var(--cah-t1-utility-green-700);
    --cah-t2-content-utility-info: var(--cah-t1-utility-blue-500);

    /* ---- Tier 2: border ---- */
    --cah-t2-border-default: var(--cah-t1-brand-blue-300);
    --cah-t2-border-default-hover: var(--cah-t1-brand-blue-400);
    --cah-t2-border-subtle: var(--cah-t1-neutral-300);
    --cah-t2-border-strong: var(--cah-t1-neutral-900);
    --cah-t2-border-knockout: var(--cah-t1-neutral-400);
    --cah-t2-border-disabled: var(--cah-t1-neutral-200);
    --cah-t2-border-brand: var(--cah-t1-brand-blue-700);
    --cah-t2-border-utility-error: var(--cah-t1-utility-red-700);
    --cah-t2-border-utility-warning: var(--cah-t1-utility-orange-700);
    --cah-t2-border-utility-success: var(--cah-t1-utility-green-700);
    --cah-t2-border-utility-info: var(--cah-t1-utility-blue-700);

    /* ---- Tier 2: button (outlined default) ---- */
    --cah-t2-btn-bg-default: var(--cah-t1-neutral-white);
    --cah-t2-btn-bg-hover: var(--cah-t1-neutral-white);
    --cah-t2-btn-bg-active: var(--cah-t1-neutral-white);
    --cah-t2-btn-bg-disabled: var(--cah-t1-neutral-white);
    --cah-t2-btn-content-default: var(--cah-t1-brand-blue-600);
    --cah-t2-btn-content-hover: var(--cah-t1-brand-blue-800);
    --cah-t2-btn-content-active: var(--cah-t1-brand-blue-800);
    --cah-t2-btn-content-disabled: var(--cah-t1-neutral-500);
    --cah-t2-btn-border-default: var(--cah-t1-brand-blue-600);
    --cah-t2-btn-border-hover: var(--cah-t1-brand-blue-700);
    --cah-t2-btn-border-active: var(--cah-t1-brand-blue-700);
    --cah-t2-btn-border-disabled: var(--cah-t1-neutral-400);

    /* ---- Tier 2: button (primary — solid dark pill) ---- */
    --cah-t2-btn-primary-bg-default: var(--cah-t1-brand-blue-600);
    --cah-t2-btn-primary-bg-hover: var(--cah-t1-brand-blue-700);
    --cah-t2-btn-primary-bg-active: var(--cah-t1-brand-blue-700);
    --cah-t2-btn-primary-bg-disabled: var(--cah-t1-neutral-500);
    --cah-t2-btn-primary-content-default: var(--cah-t1-neutral-white);
    --cah-t2-btn-primary-content-hover: var(--cah-t1-neutral-white);
    --cah-t2-btn-primary-content-active: var(--cah-t1-neutral-white);
    --cah-t2-btn-primary-content-disabled: var(--cah-t1-neutral-white);
    --cah-t2-btn-primary-border-default: var(--cah-t1-brand-blue-600);
    --cah-t2-btn-primary-border-hover: var(--cah-t1-brand-blue-700);
    --cah-t2-btn-primary-border-active: var(--cah-t1-brand-blue-700);
    --cah-t2-btn-primary-border-disabled: var(--cah-t1-neutral-400);

    /* ---- Tier 2: focus-ring ---- */
    --cah-t2-focus-ring-border-default: var(--cah-t1-brand-blue-500);
    --cah-t2-focus-ring-border-knockout: var(--cah-t1-neutral-white);

    /* ---- Tier 2: form ---- */
    --cah-t2-form-bg-default: var(--cah-t1-neutral-white);
    --cah-t2-form-bg-focus: var(--cah-t1-neutral-white);
    --cah-t2-form-bg-hover: var(--cah-t1-neutral-white);
    --cah-t2-form-bg-active: var(--cah-t1-neutral-white);
    --cah-t2-form-border-default: var(--cah-t1-neutral-500);
    --cah-t2-form-border-focus: var(--cah-t1-neutral-black);
    --cah-t2-form-border-hover: var(--cah-t1-neutral-black);
    --cah-t2-form-border-active: var(--cah-t1-neutral-black);

    /* ---- Tier 2: link (on light surface) ---- */
    --cah-t2-link-content-default: var(--cah-t1-brand-blue-600);
    --cah-t2-link-content-hover: var(--cah-t1-brand-blue-900);
    --cah-t2-link-content-active: var(--cah-t1-brand-blue-900);
    --cah-t2-link-content-visited: var(--cah-t1-brand-blue-600);

    /* ---- Tier 2: link (knockout — on dark surface) ---- */
    --cah-t2-link-knockout-content-default: var(--cah-t1-brand-blue-100);
    --cah-t2-link-knockout-content-hover: var(--cah-t1-brand-blue-200);
    --cah-t2-link-knockout-content-active: var(--cah-t1-brand-blue-200);
    --cah-t2-link-knockout-content-visited: var(--cah-t1-brand-blue-300);
}

/**
 * T-UX15 — beehive auth shell for /wp/wp-login.php?action=cah_otp.
 *
 * Loaded by Candide\CAH\Core\Auth\EmailOTP::enqueue_auth_styles() on
 * login_enqueue_scripts. The cah-theme is the canonical host; an estate
 * can override by overriding `cah_otp_template_path` and shipping its
 * own auth.css alongside.
 *
 * Strategy: keep WP's #login wrapper but neutralise its presentation
 * (no background, no border) so our nested .cah-auth-shell + .cah-auth-card
 * own the visual chrome. The T-G10/T-G12 inline styling at login_head:999
 * still loads but only matters for the password-admin escape hatch; our
 * .cah-auth-* selectors are higher-specificity for the cah_otp action.
 */

:root {
    --beehive-green-deep: #0F2A1F;
    --beehive-green-mid:  #1a3a2a;
    --beehive-honey:      #E8C547;
    --beehive-honey-soft: #F4D88A;
    --beehive-honey-pale: #FAEEDA;
    --beehive-honey-deep: #B8911E;
    --beehive-cream:      #F4F1E4;
    --beehive-cream-warm: #FAF7EE;
    --beehive-ink:        #0F2A1F;
    --beehive-text-primary:   #1a3a2a;
    --beehive-text-secondary: #5a6b4a;
    --beehive-text-tertiary:  #8a8475;
    --beehive-border:        rgba(26, 58, 42, 0.12);
    --beehive-border-strong: rgba(26, 58, 42, 0.25);
}

/* Override the T-G12 cream login background with the warmer beehive
   cream so the auth shell matches the rest of the redesigned surfaces. */
body.login {
    background: var(--beehive-cream-warm);
    color: var(--beehive-text-primary);
    font-family: 'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
}

/* T-UX37 — un-clip the auth card on short viewports.
   The T-G12 inline style at `login_head` priority 999 makes `body.login`
   a `display:flex; flex-direction:column; justify-content:center;
   min-height:100vh` container. That body stays pinned at exactly 100vh
   and hard-centres `#login`; when the verify form (six-cell code grid +
   an error notice) is taller than the viewport the card overflows BOTH
   edges and the top half becomes unscrollable — clipping the hex motif
   and, on very short screens, the "Send a new code" ghost button.
   `safe center` keeps the centring while the card fits and falls back
   to `flex-start` when it does not, so the document scrolls and nothing
   is clipped. The `:has(.cah-auth-shell)` raises specificity above the
   inline `body.login` rule (which loads after this sheet) and scopes the
   change to the OTP shell — the password escape hatch is left untouched. */
body.login:has(.cah-auth-shell) {
    justify-content: safe center;
}

/* #login holds the cah_otp form parts. Drop its inline card chrome so
   our nested .cah-auth-card owns the look. */
body.login #login {
    background: transparent !important;
    border: none !important;
    box-shadow: none !important;
    padding: 0 !important;
    max-width: 480px !important;
    width: 100% !important;
}

/* WP renders an h1 above the form with the brand link — keep it sized
   but allow our hex motif inside the card to be the primary visual. */
body.login #login h1 a {
    background-image: url('/app/themes/cah-theme/assets/img/hive-logo.svg');
    background-size: contain;
    background-repeat: no-repeat;
    background-position: center;
    width: 200px;
    height: 64px;
    margin: 0 auto 8px;
}

/* When our auth shell is rendered, the WP `<form>` wrapper that nests
   it is just a flow container — drop borders/padding so the card has
   sole visual weight. */
body.login .cah-auth-shell,
body.login form:has(> .cah-auth-shell) {
    background: transparent;
    border: none;
    box-shadow: none;
    padding: 0;
    margin: 0;
}

.cah-auth-shell {
    position: relative;
    display: flex;
    flex-direction: column;
    align-items: center;
    padding: 32px 16px;
}

/* Decorative honeycomb watermark — opacity 0.04 per design-extension brief. */
.cah-auth-shell::before {
    content: '';
    position: absolute;
    inset: 0;
    background-image:
        radial-gradient(circle at 18% 22%, var(--beehive-honey-pale) 0%, transparent 38%),
        radial-gradient(circle at 82% 78%, var(--beehive-honey-pale) 0%, transparent 38%);
    opacity: 0.5;
    pointer-events: none;
    z-index: 0;
}

.cah-auth-eyebrow {
    position: relative;
    z-index: 1;
    font-size: 11px;
    letter-spacing: 3px;
    text-transform: uppercase;
    color: var(--beehive-honey-deep);
    font-weight: 500;
    margin-bottom: 14px;
}

.cah-auth-card {
    position: relative;
    z-index: 1;
    width: 100%;
    max-width: 440px;
    background: var(--beehive-cream);
    border: 0.5px solid var(--beehive-border-strong);
    border-radius: 16px;
    padding: 40px 36px 32px;
    box-shadow: 0 4px 24px rgba(15, 42, 31, 0.06);
}

.cah-auth-hex {
    display: flex;
    justify-content: center;
    margin-bottom: 18px;
}
.cah-auth-hex svg { width: 44px; height: 50px; }

.cah-auth-heading {
    font-family: 'Lora', Georgia, serif;
    font-size: 28px;
    color: var(--beehive-text-primary);
    margin: 0 0 10px;
    font-weight: 400;
    text-align: center;
    letter-spacing: -0.4px;
    line-height: 1.2;
}
.cah-auth-strap {
    font-family: 'Lora', Georgia, serif;
    font-style: italic;
    font-size: 14px;
    color: var(--beehive-text-secondary);
    text-align: center;
    margin: 0 0 28px;
    line-height: 1.5;
}

.cah-auth-form { margin: 0; }

.cah-auth-field { display: block; margin: 0 0 18px; }
.cah-auth-field label {
    display: block;
    font-size: 12.5px;
    font-weight: 600;
    color: var(--beehive-text-primary);
    letter-spacing: 0.02em;
    margin-bottom: 8px;
}
.cah-auth-input {
    box-sizing: border-box;
    width: 100%;
    height: 46px;
    padding: 0 14px;
    background: #fff;
    border: 1px solid var(--beehive-border-strong);
    border-radius: 10px;
    font-family: inherit;
    font-size: 14px;
    color: var(--beehive-ink);
    outline: none;
    transition: border-color 0.15s, box-shadow 0.15s;
}
.cah-auth-input:focus,
.cah-auth-input:focus-visible {
    border-color: var(--beehive-honey-deep);
    box-shadow: 0 0 0 3px rgba(184, 145, 30, 0.18);
}

/* 6-digit code grid — six individual inputs so screen readers announce
   per-digit and auto-advance works without overriding `maxlength`. */
.cah-auth-codegrid {
    display: grid;
    grid-template-columns: repeat(6, 1fr);
    gap: 8px;
    margin: 0 0 22px;
    padding: 0;
    border: none;
}
.cah-auth-codecell {
    box-sizing: border-box;
    width: 100%;
    height: 56px;
    padding: 0;
    background: #fff;
    border: 1px solid var(--beehive-border-strong);
    border-radius: 10px;
    font-family: 'Menlo', Consolas, monospace;
    font-size: 24px;
    font-weight: 500;
    color: var(--beehive-ink);
    text-align: center;
    outline: none;
    transition: border-color 0.15s, box-shadow 0.15s;
}
.cah-auth-codecell:focus,
.cah-auth-codecell:focus-visible {
    border-color: var(--beehive-honey-deep);
    box-shadow: 0 0 0 3px rgba(184, 145, 30, 0.18);
}

.cah-auth-button {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 100%;
    min-height: 48px;
    padding: 12px 18px;
    border: 1px solid var(--beehive-green-deep);
    border-radius: 10px;
    background: var(--beehive-green-deep);
    color: var(--beehive-cream);
    font-family: inherit;
    font-size: 14px;
    font-weight: 600;
    letter-spacing: 0.02em;
    text-decoration: none;
    cursor: pointer;
    transition: background 0.15s, border-color 0.15s, transform 0.1s;
}
.cah-auth-button:hover,
.cah-auth-button:focus,
.cah-auth-button:focus-visible {
    background: var(--beehive-honey-deep);
    border-color: var(--beehive-honey-deep);
    color: var(--beehive-cream);
    outline: none;
}
.cah-auth-button--ghost {
    background: transparent;
    color: var(--beehive-green-deep);
    border-color: var(--beehive-border-strong);
    font-weight: 500;
    margin-top: 12px;
}
.cah-auth-button--ghost:hover,
.cah-auth-button--ghost:focus,
.cah-auth-button--ghost:focus-visible {
    background: var(--beehive-honey-pale);
    border-color: var(--beehive-honey-deep);
    color: var(--beehive-green-deep);
}

.cah-auth-notice {
    background: var(--beehive-honey-pale);
    border-left: 3px solid var(--beehive-honey-deep);
    padding: 12px 14px;
    border-radius: 6px;
    font-size: 13px;
    color: var(--beehive-text-primary);
    margin: 0 0 22px;
}
.cah-auth-error {
    background: #fdf4f3;
    border-left: 3px solid #b0392a;
    padding: 12px 14px;
    border-radius: 6px;
    font-size: 13px;
    color: #6b2118;
    margin: 0 0 18px;
}

.cah-auth-foot {
    margin-top: 22px;
    text-align: center;
    font-size: 12.5px;
    color: var(--beehive-text-tertiary);
}
.cah-auth-foot a {
    color: var(--beehive-green-deep);
    font-weight: 500;
    text-decoration: none;
    border-bottom: 1px solid currentColor;
}
.cah-auth-foot a:hover,
.cah-auth-foot a:focus { color: var(--beehive-honey-deep); }

.screen-reader-text {
    border: 0;
    clip-path: inset(50%);
    height: 1px;
    margin: -1px;
    overflow: hidden;
    padding: 0;
    position: absolute;
    width: 1px;
    word-wrap: normal !important;
}

@media (max-width: 480px) {
    .cah-auth-card { padding: 28px 22px 24px; }
    .cah-auth-heading { font-size: 24px; }
    .cah-auth-codecell { height: 50px; font-size: 20px; }
}

/* ------------------------------------------------------------------ *
 * T-UX20 — unified login shell.
 *
 * The OTP form (?action=cah_otp) renders our own `.cah-auth-card`
 * markup. The admin password escape hatch (?action=passwd_admin) renders
 * WordPress core's native `#loginform` — we cannot add card markup to it
 * without replacing wp-login.php (forbidden: a WP core upgrade must not
 * regress us). Instead we restyle the native `#loginform` into the SAME
 * beehive card so an admin and a general user see one coherent product.
 *
 * All selectors are scoped by the `#loginform` id, which exists ONLY on
 * the native password view — the OTP template's <form> carries the
 * `.cah-auth-form` class with no id, so these rules never touch it. The
 * id also out-specifies the T-G12 inline `login_head` styling, so this
 * block wins without `!important` despite loading earlier in <head>.
 * ------------------------------------------------------------------ */

/* T-SG01 — the native password form becomes the EP-400 white card: white
   fill, 16px radius, border + soft shadow. The Beehive logo above the card
   (`.login h1 a`, branded in functions.php) is the sole brand mark — the
   former in-card gold-hexagon motif (`::before`) is removed so passwd_admin
   and the 2FA TOTP page match the white-card cah_otp / cah_login surfaces.
   Was beehive-cream fill + hexagon before this ticket. */
body.login #loginform {
    position: relative;
    box-sizing: border-box;
    width: 100%;
    max-width: 440px;
    margin: 8px auto 0;
    background: var(--cah-t1-neutral-white);
    border: 0.5px solid var(--beehive-border-strong);
    border-radius: 16px;
    box-shadow: 0 4px 24px rgba(15, 42, 31, 0.06);
    padding: 36px 36px 28px;
}

/* Username + password inputs adopt the `.cah-auth-input` proportions. */
body.login #loginform input[type="text"],
body.login #loginform input[type="email"],
body.login #loginform input[type="password"] {
    box-sizing: border-box;
    width: 100%;
    height: 46px;
    padding: 0 14px;
    background: #fff;
    border: 1px solid var(--beehive-border-strong);
    border-radius: 10px;
    font-size: 14px;
    color: var(--beehive-ink);
    transition: border-color 0.15s, box-shadow 0.15s;
}
body.login #loginform input[type="text"]:focus,
body.login #loginform input[type="email"]:focus,
body.login #loginform input[type="password"]:focus {
    border-color: var(--beehive-honey-deep);
    box-shadow: 0 0 0 3px rgba(184, 145, 30, 0.18);
}

/* The "Log In" submit button becomes the full-width deep-green primary
   from `.cah-auth-button` — drop WP's right-float so it spans the card. */
body.login #loginform .submit { text-align: center; }
body.login #loginform #wp-submit {
    float: none;
    display: block;
    width: 100%;
    min-height: 48px;
    margin: 0;
    padding: 12px 18px;
    background: var(--beehive-green-deep);
    border: 1px solid var(--beehive-green-deep);
    border-radius: 10px;
    color: var(--beehive-cream);
    font-size: 14px;
    font-weight: 600;
    letter-spacing: 0.02em;
}
body.login #loginform #wp-submit:hover,
body.login #loginform #wp-submit:focus {
    background: var(--beehive-honey-deep);
    border-color: var(--beehive-honey-deep);
    color: var(--beehive-cream);
}

@media (max-width: 480px) {
    body.login #loginform { padding: 28px 22px 24px; }
}

/* ------------------------------------------------------------------ *
 * T-EP14 — EP-400 register form (additive on T-EP12 auth-shell).
 *
 * Scope: every rule lives under `body.cah-ep400` so the legacy beehive
 * shell (above) keeps owning the `cah_otp` surface on un-redesigned
 * routes. When T-EP19 wires `body.cah-ep400` site-wide, the EP-400
 * shell takes over the register surface.
 *
 * Surface contract — derived from plan §3.1 universal auth rules:
 *   - centred white card (max-width 520px) on `bg/subtle` page bg
 *   - BEEHIVE wordmark + bee glyph centred above the H1
 *   - H1 "Register" via `.cah-c-display-sm` composite typography class
 *   - 3 floating-label notched-outline inputs, 48px tall, stacked 16px apart
 *   - dark pill CTA "Continue →", 48px tall, full-width
 *   - footer link "Already have an account? Sign in" using
 *     `var(--cah-t2-link-content-default)` with underline
 *   - `.cah-ep400-auth__banner--error` variant carries the domain-reject
 *     copy on `bg/utility-error`
 *
 * The `.cah-field--floating` mixin is defined here so the register
 * surface is self-contained for the snap-diff gate. T-EP12 (same wave)
 * ships the same mixin against the same selector path for the login
 * surface — additive merge keeps the union (identical rules, no
 * conflict). If the design system later promotes the mixin to a global
 * place, this scoped block can be retired in T-EP22.
 * ------------------------------------------------------------------ */

body.cah-ep400 .cah-ep400-auth {
    box-sizing: border-box;
    width: 100%;
    min-height: 100vh;
    display: flex;
    flex-direction: column;
    align-items: center;
    justify-content: center;
    padding: 48px 16px;
    /* T-SG01 — page bg is white (the card is separated by its border +
       soft shadow), matching the native wp-login auth surfaces. Was
       bg/subtle (brand/blue/200) before this ticket. */
    background: var(--cah-t2-bg-default);
    color: var(--cah-t2-content-default);
    font-family: 'Instrument Sans', system-ui, -apple-system,
        BlinkMacSystemFont, 'Segoe UI', sans-serif;
}

body.cah-ep400 .cah-ep400-auth__card {
    box-sizing: border-box;
    width: 100%;
    max-width: 520px;
    margin: 0;
    padding: 48px 56px 40px;
    background: var(--cah-t2-bg-default);
    border: 1px solid var(--cah-t2-border-default);
    border-radius: 24px;
    box-shadow: 0 12px 32px rgba(0, 0, 0, 0.06);
}

body.cah-ep400 .cah-ep400-auth__brand {
    display: flex;
    align-items: center;
    justify-content: center;
    margin: 0 0 28px;
}
/* T-SG01 — single horizontal Beehive lockup image (replaces the former
   bee glyph + "BEEHIVE" wordmark text). Dark-filled variant on the white
   card; sized by height so width tracks the 133×30 aspect ratio. */
body.cah-ep400 .cah-ep400-auth__logo {
    display: block;
    width: auto;
    height: 30px;
    max-width: 100%;
}

body.cah-ep400 .cah-ep400-auth__heading {
    margin: 0 0 24px;
}

/* ------------------------------------------------------------------
 * T-EP12 — EP-400 login + auth-card shell.
 *
 * Activated by `body.cah-ep400` (set per-route by
 * Candide\CAH\Core\Auth\LoginPage on /wp-login.php?action=cah_login,
 * and site-wide once T-EP19 wires the body class). Until then the
 * legacy `.cah-auth-card` rules above own the OTP escape hatch
 * (?action=cah_otp), so both designs coexist without interference.
 *
 * Owns: the shared auth-card shell consumed by T-EP12 (login),
 * T-EP13 (OTP request/verify), T-EP14 (register), T-EP15 (account).
 * The shell tokens — page bg, card surface, floating-label input,
 * dark pill CTA, link rows — all derive from the EP-400 Tier 2
 * mappings declared in style.css `:root { --cah-t2-* }`.
 *
 * Mockup: site/tests/playwright/mockups/ep400/login-desktop.png.
 * Spec:   docs/superpowers/plans/2026-05-31-wave-ep400-redesign.md
 *         §3.1 universal rules + §7 T-EP12 acceptance criteria.
 *
 * Token consumption rules from docs/spec/brand-tokens-ep400.md:
 *   - Colours: var(--cah-t2-*) — never raw hex.
 *   - Type: composite `.cah-c-*` classes — no inline font props
 *     here; the typography classes ride on the PHP template and
 *     this block only sets layout / colour / shape.
 * ------------------------------------------------------------------ */

/* Page background switches to `bg/subtle` on the cah_login route so
   the centred white card reads against the brand/blue/200 fill. The
   `body.login.cah-ep400` qualifier overrides the legacy
   `body.login { background: var(--beehive-cream-warm); }` rule above
   without `!important` because the qualifier is more specific. */
body.login.cah-ep400 {
    /* White page fill — the centred card is separated by its border + soft
       shadow; no grey/subtle page wash behind it (operator review 2026-06-07). */
    background: var(--cah-t1-neutral-white);
    color: var(--cah-t2-content-default);
    font-family: var(--cah-t1-font-family-sans);
}

/* Drop WP's #login inline chrome on the EP-400 route. Higher
   specificity than the legacy `body.login #login` rule above. */
body.login.cah-ep400 #login {
    background: transparent !important;
    border: none !important;
    box-shadow: none !important;
    padding: 32px 16px !important;
    max-width: 600px !important;
    width: 100% !important;
}

/* Suppress WP's default #login h1 wordmark on the EP-400 route — we
   render our own brand block inside the card. */
body.login.cah-ep400 #login h1 a {
    display: none;
}

/* When our shell is rendered, the WP <form> wrapper that nests it is
   a flow container — drop borders/padding so the inner card has sole
   visual weight. */
body.cah-ep400 .cah-auth-shell--ep400,
body.cah-ep400 form:has(> .cah-auth-shell--ep400) {
    background: transparent;
    border: none;
    box-shadow: none;
    padding: 0;
    margin: 0;
}

.cah-auth-shell--ep400 {
    position: relative;
    display: flex;
    flex-direction: column;
    align-items: center;
    width: 100%;
}

/* The centred white card. 24px radius is one rung above the T-EP01
   ramp (radius/12 is the current top); we use a literal 24px value
   and call it out as a token gap in the PR — see Notes for the
   orchestrator. Soft shadow `0 12px 32px rgba(0,0,0,0.06)` per
   plan §7 T-EP12 acceptance criterion 1. */
.cah-auth-card--ep400 {
    position: relative;
    box-sizing: border-box;
    width: 100%;
    max-width: 440px;
    margin: 0 auto;
    background: var(--cah-t2-bg-default);
    border: 1px solid var(--cah-t2-border-default);
    border-radius: 24px;
    padding: 40px 40px 36px;
    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.04);
}

/* Centred bee + BEEHIVE wordmark at the top. The mockup shows the
   horizontal lockup (133 × 30); the SVG ships at that intrinsic
   size. */
.cah-auth-card--ep400__brand {
    display: flex;
    justify-content: center;
    margin: 0 0 24px;
}
.cah-auth-card--ep400__brand-link {
    display: inline-flex;
    text-decoration: none;
    border: none;
}
.cah-auth-card--ep400__logo {
    display: block;
    width: auto;
    height: 30px;
    max-width: 100%;
}

/* H1 "Log In". The composite `.cah-c-headline-lg` on the PHP element
   sets family / size / line-height / weight; we only set colour +
   alignment + margin here per the "do not redeclare font props"
   convention in docs/spec/brand-tokens-ep400.md. */
/* The composite `.cah-c-headline-lg` lives in style.css, which wp-login.php
   never loads — so the heading font must be declared here (self-contained).
   Mockup (mockups/ep400/login-desktop.png) shows a large, light-weight
   "Log In" (~52px / 400), not the WP-default bold ~26px fallback. */
.cah-auth-card--ep400__heading {
    margin: 0 0 8px;
    text-align: center;
    color: var(--cah-t2-content-default);
    font-family: var(--cah-t1-font-family-sans);
    font-size: 52px;
    font-weight: 400;
    line-height: 1.04;
    letter-spacing: -0.02em;
}

body.cah-ep400 .cah-ep400-auth__banner {
    box-sizing: border-box;
    width: 100%;
    margin: 0 0 16px;
    padding: 12px 16px;
    border-radius: 12px;
    font-size: 14px;
    line-height: 1.45;
}
body.cah-ep400 .cah-ep400-auth__banner--error {
    background: var(--cah-t2-bg-utility-error);
    border: 1px solid var(--cah-t2-border-utility-error);
    color: var(--cah-t2-content-utility-error);
}

body.cah-ep400 .cah-ep400-auth__form {
    margin: 0;
    display: flex;
    flex-direction: column;
    gap: 16px;
}

/* Floating-label notched-outline input (`.cah-field--floating` mixin).
   Implementation: position the <input> with a transparent top-border
   notch carved by the absolutely-positioned <label>. The label moves
   from the field centre (placeholder state) to the top edge (focused
   or filled state) via the `:focus` and `:not(:placeholder-shown)`
   sibling-state selectors. No JS required. */
body.cah-ep400 .cah-field--floating,
body.cah-ep400 .cah-ep400-auth__field {
    position: relative;
    box-sizing: border-box;
    display: block;
    width: 100%;
    margin: 0;
}

body.cah-ep400 .cah-field--floating .cah-ep400-auth__input,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__input {
    box-sizing: border-box;
    width: 100%;
    height: 48px;
    padding: 0 14px;
    background: var(--cah-t2-form-bg-default);
    border: 1px solid var(--cah-t2-form-border-default);
    border-radius: 4px;
    font-family: inherit;
    font-size: 16px;
    line-height: 1.4;
    color: var(--cah-t2-content-default);
    outline: none;
    transition: border-color 0.15s, box-shadow 0.15s;
}
body.cah-ep400 .cah-field--floating .cah-ep400-auth__input:hover,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__input:hover {
    border-color: var(--cah-t2-form-border-hover);
}
body.cah-ep400 .cah-field--floating .cah-ep400-auth__input:focus,
body.cah-ep400 .cah-field--floating .cah-ep400-auth__input:focus-visible,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__input:focus,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__input:focus-visible {
    border-color: var(--cah-t2-form-border-focus);
    box-shadow: 0 0 0 2px var(--cah-t2-focus-ring-border-default);
}

body.cah-ep400 .cah-field--floating .cah-ep400-auth__label,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__label {
    position: absolute;
    left: 10px;
    top: 50%;
    transform: translateY(-50%);
}
/* One-line muted subtitle. Composite `.cah-c-body-default` on the
   PHP element supplies the type ramp. */
.cah-auth-card--ep400__subtitle {
    margin: 0 0 32px;
    text-align: center;
    color: var(--cah-t2-content-subtle);
}

.cah-auth-card--ep400__form {
    margin: 0;
    padding: 0;
    border: none;
    background: transparent;
}

/* ----- Floating-label input (Material-style notched outline) -----
 *
 * Mixin owned by T-EP12; consumed by T-EP14 (register: 3 stacked
 * inputs) and T-EP15 (account: form rows). Wraps an <input> + <label>
 * pair; the label sits inside the input chrome by default and floats
 * up to the notched gap on focus + when the input has a value
 * (driven by :focus and :not(:placeholder-shown) — the PHP template
 * sets placeholder=" " so the pseudo-class only matches when the
 * user has typed). No JS required.
 */
.cah-field--floating {
    position: relative;
    margin: 0 0 24px;
    width: 100%;
}
.cah-field--floating__input {
    box-sizing: border-box;
    display: block;
    width: 100%;
    height: 56px;
    padding: 18px 16px 6px;
    background: var(--cah-t2-form-bg-default);
    border: 1px solid var(--cah-t2-form-border-default);
    border-radius: var(--cah-t1-radius-8);
    font-family: var(--cah-t1-font-family-sans);
    font-size: 16px;
    line-height: 24px;
    color: var(--cah-t2-content-default);
    outline: none;
    transition: border-color 150ms ease, box-shadow 150ms ease;
}
.cah-field--floating__input:focus,
.cah-field--floating__input:focus-visible {
    border-color: var(--cah-t2-form-border-focus);
    box-shadow: 0 0 0 2px var(--cah-t2-focus-ring-border-default);
}
.cah-field--floating__label {
    position: absolute;
    left: 14px;
    top: 50%;
    transform: translateY(-50%);
    padding: 0 4px;
    background: var(--cah-t2-form-bg-default);
    color: var(--cah-t2-content-subtle);
    font-size: 16px;
    line-height: 1;
    pointer-events: none;
    transition: top 0.15s ease, font-size 0.15s ease, color 0.15s ease;
}
body.cah-ep400 .cah-field--floating .cah-ep400-auth__input:focus + .cah-ep400-auth__label,
body.cah-ep400 .cah-field--floating .cah-ep400-auth__input:not(:placeholder-shown) + .cah-ep400-auth__label,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__input:focus + .cah-ep400-auth__label,
body.cah-ep400 .cah-ep400-auth__field .cah-ep400-auth__input:not(:placeholder-shown) + .cah-ep400-auth__label {
    top: 0;
    font-size: 12px;
    color: var(--cah-t2-content-default);
}

body.cah-ep400 .cah-ep400-auth__cta {
    font-family: var(--cah-t1-font-family-sans);
    font-size: 16px;
    line-height: 1;
    color: var(--cah-t2-content-subtle);
    pointer-events: none;
    transition:
        top 150ms ease,
        font-size 150ms ease,
        color 150ms ease,
        transform 150ms ease;
}
/* Floated state — when input has focus or contains a value. The
   `placeholder=" "` on the PHP <input> means :not(:placeholder-shown)
   only matches on user input, so the label sits centred at rest and
   notches the top border once the user starts typing or focuses. */
.cah-field--floating__input:focus + .cah-field--floating__label,
.cah-field--floating__input:not(:placeholder-shown) + .cah-field--floating__label {
    top: 0;
    transform: translateY(-50%) scale(1);
    font-size: 12px;
    color: var(--cah-t2-content-subtle);
}
.cah-field--floating__input:focus + .cah-field--floating__label {
    color: var(--cah-t2-form-border-focus);
}

/* ----- Dark pill primary CTA — full-width 48px tall ----- */
.cah-auth-btn--primary-ep400 {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    width: 100%;
    height: 48px;
    margin: 8px 0 0;
    padding: 0 18px;
    background: var(--cah-t2-btn-primary-bg-default);
    border: 1px solid var(--cah-t2-btn-primary-border-default);
    border-radius: 999px;
    color: var(--cah-t2-btn-primary-content-default, #fff);
    font-family: inherit;
    font-size: 14px;
    font-weight: 500;
    letter-spacing: 0.02em;
    text-decoration: none;
    cursor: pointer;
    transition: background 0.15s, border-color 0.15s;
}
body.cah-ep400 .cah-ep400-auth__cta:hover,
body.cah-ep400 .cah-ep400-auth__cta:focus,
body.cah-ep400 .cah-ep400-auth__cta:focus-visible {
    background: var(--cah-t2-btn-primary-bg-hover);
    border-color: var(--cah-t2-btn-primary-border-hover);
    outline: none;
}

body.cah-ep400 .cah-ep400-auth__foot {
    margin: 24px 0 0;
    text-align: center;
    font-size: 14px;
    color: var(--cah-t2-content-subtle);
}
body.cah-ep400 .cah-ep400-auth__foot-link {
    margin-left: 4px;
    color: var(--cah-t2-link-content-default);
    text-decoration: underline;
}
body.cah-ep400 .cah-ep400-auth__foot-link:hover,
body.cah-ep400 .cah-ep400-auth__foot-link:focus,
body.cah-ep400 .cah-ep400-auth__foot-link:focus-visible {
    color: var(--cah-t2-link-content-hover);
    outline: none;
}

@media (max-width: 480px) {
    body.cah-ep400 .cah-ep400-auth__card { padding: 32px 24px 28px; }
}

/* ------------------------------------------------------------------
 * T-EP13 — EP-400 OTP request + verify decorations.
 *
 * Scope: every rule below is body-class-gated on `body.cah-ep400`
 * (wired by T-EP19) so the pre-EP400 cream T-UX15 styling stays intact
 * until the new design system is enabled. The auth-card shell itself
 * (centred white card, max-width 520, dark pill CTA) is owned by T-EP12
 * — this block adds ONLY the OTP-specific 6-cell grid, the muted helper
 * row, the masked-email subtitle, and the submit-error border-flash.
 *
 * All colours go through Tier 2 tokens (`var(--cah-t2-*)`) and all
 * radii through Tier 1 tokens (`var(--cah-t1-radius-*)`) per the
 * brand-tokens-ep400.md convention. No raw hex below.
 * ------------------------------------------------------------------ */

/* The masked-email subtitle on OTP verify and the resend-cooldown
   helper below the CTA both render as muted body text on EP-400.
   We use composite typography classes on the markup; here we just
   override the colour so the muted token wins over the pre-EP400
   `.cah-auth-strap` rule. */
body.cah-ep400 .cah-auth-strap.cah-c-body-default {
    font-style: normal;
    color: var(--cah-t2-content-subtle);
}
body.cah-ep400 .cah-otp-strap--masked {
    text-align: center;
    margin: 0 0 24px;
}
body.cah-ep400 .cah-otp-helper {
    color: var(--cah-t2-content-subtle);
    text-align: center;
    margin: 12px 0 0;
}

/* 6-cell OTP grid. 56 × 64 squares, 8px radius (slightly softer than
   chip radius/4 so the eye reads "input" rather than "chip"), white
   bg, 1px neutral border. The centred 32px Instrument Sans weight 700
   text inside each cell uses an inline font-family + weight (because a
   single cell carries one digit — no composite class wraps a bare
   `<input>` cleanly without an extra span, which would break the
   auto-advance JS). */
body.cah-ep400 .cah-otp-grid--ep400 {
    display: grid;
    /* Fluid columns so the 6 cells always fit the card content width
       (T-DR03 narrowed the card to 440px → ~360px content). */
    grid-template-columns: repeat(6, 1fr);
    gap: 8px;
    width: 100%;
    justify-content: center;
    margin: 0 0 22px;
    padding: 0;
    border: none;
}
body.cah-ep400 .cah-otp-cell--ep400 {
    box-sizing: border-box;
    width: 100%;
    height: 56px;
    padding: 0;
    background: var(--cah-t2-form-bg-default);
    border: 1px solid var(--cah-t2-form-border-default);
    border-radius: var(--cah-t1-radius-8);
    font-family: var(--cah-t1-font-family-sans);
    font-size: 28px;
    font-weight: 700;
    line-height: 1;
    color: var(--cah-t2-content-default);
    text-align: center;
    outline: none;
    transition: border-color 0.15s, box-shadow 0.15s;
}
body.cah-ep400 .cah-otp-cell--ep400:focus,
body.cah-ep400 .cah-otp-cell--ep400:focus-visible {
    border-color: var(--cah-t2-form-border-focus);
    box-shadow: 0 0 0 3px var(--cah-t2-focus-ring-border-default);
}

/* Submit-error border-flash. The fieldset gains `.is-error` server-side
   when the verify handler rejects the code; the 2s flash animation runs
   once on render so the eye is drawn to the cells. The matching
   `<div role="alert">` below carries `.cah-otp-error--ep400` which
   takes its colour from `--cah-t2-content-utility-error`. */
body.cah-ep400 .cah-otp-grid--ep400.is-error .cah-otp-cell--ep400 {
    animation: cah-otp-cell-flash 2s ease-out 1;
    border-color: var(--cah-t2-border-utility-error);
}
body.cah-ep400 .cah-otp-error--ep400 {
    background: transparent;
    border-left: none;
    padding: 0;
    color: var(--cah-t2-content-utility-error);
    text-align: center;
    margin: -8px 0 18px;
}

/* Responsive: at very narrow widths the 6 × 56 grid (336px content) +
   gap-8 (5 × 8 = 40px) totals 376px which overflows the 320px iPhone-SE
   viewport. Shrink the cells to 44 × 56 to keep them on one row. */
@media (max-width: 420px) {
    body.cah-ep400 .cah-otp-grid--ep400 {
        grid-template-columns: repeat(6, 44px);
        gap: 6px;
    }
    body.cah-ep400 .cah-otp-cell--ep400 {
        width: 44px;
        height: 56px;
        font-size: 24px;
    }
}
.cah-auth-btn--primary-ep400 {
    padding: 0 24px;
    background: var(--cah-t2-btn-primary-bg-default);
    color: var(--cah-t2-btn-primary-content-default);
    border: 1px solid var(--cah-t2-btn-primary-border-default);
    border-radius: var(--cah-t1-radius-pill);
    font-family: var(--cah-t1-font-family-sans);
    font-size: 14px;
    line-height: 1;
    font-weight: 600;
    letter-spacing: 0.01em;
    cursor: pointer;
    text-decoration: none;
    transition: background-color 150ms ease, border-color 150ms ease, color 150ms ease;
}
.cah-auth-btn--primary-ep400:hover,
.cah-auth-btn--primary-ep400:focus,
.cah-auth-btn--primary-ep400:focus-visible {
    background: var(--cah-t2-btn-primary-bg-hover);
    border-color: var(--cah-t2-btn-primary-border-hover);
    color: var(--cah-t2-btn-primary-content-hover);
    outline: none;
}
.cah-auth-btn--primary-ep400:focus-visible {
    box-shadow: 0 0 0 2px var(--cah-t2-focus-ring-border-default);
}
.cah-auth-btn--primary-ep400__arrow {
    display: inline-block;
    font-size: 16px;
    line-height: 1;
}

/* ----- Footer link rows beneath the CTA, separated by 8px ----- */
.cah-auth-foot--ep400 {
    margin: 24px 0 0;
    text-align: center;
    font-family: var(--cah-t1-font-family-sans);
    font-size: 14px;
    line-height: 20px;
    color: var(--cah-t2-content-subtle);
}
.cah-auth-foot--ep400 + .cah-auth-foot--ep400 {
    margin-top: 8px; /* second link row sits 8px below the first */
}
/* Mockup (login-desktop.png) renders the footer links in brand teal,
   underlined — not the default dark link colour. */
.cah-auth-foot--ep400 a {
    color: var(--cah-t1-brand-teal-700);
    text-decoration: underline;
    text-underline-offset: 2px;
    font-weight: 500;
}
.cah-auth-foot--ep400 a:hover,
.cah-auth-foot--ep400 a:focus,
.cah-auth-foot--ep400 a:focus-visible {
    color: var(--cah-t1-brand-teal-900);
}

/* ----- Mobile breakpoint per universal rule §15 ----- */
@media (max-width: 640px) {
    .cah-auth-card--ep400 {
        max-width: 100%;
        padding: 32px 24px 28px;
        border-radius: 16px;
    }
    .cah-auth-card--ep400__brand { margin-bottom: 20px; }
    .cah-auth-card--ep400__subtitle { margin-bottom: 24px; }
    body.login.cah-ep400 #login {
        padding: 16px 12px !important;
    }
}

/* =====================================================================
 * Native wp-login.php forms — EP-400 card (T-DR03 / wave-design-recon)
 * ---------------------------------------------------------------------
 * The default WP login forms (#loginform = password escape hatch,
 * #registerform, #lostpasswordform, #resetpassform) don't use the
 * .cah-auth-card--ep400 markup. functions.php adds body.cah-ep400 on the
 * 'login'/'register'/'lostpassword'/'rp'/'resetpass' actions; these rules
 * then render those native forms as the same white EP-400 card. Scoped to
 * the native form IDs so the custom cah_login / cah_otp templates (which
 * have no native form id) are untouched.
 * ===================================================================== */
body.cah-ep400.login #login {
    width: 440px;
    max-width: calc(100% - 32px);
    margin: 0 auto;
}
body.cah-ep400 #loginform,
body.cah-ep400 #registerform,
body.cah-ep400 #lostpasswordform,
body.cah-ep400 #resetpassform {
    box-sizing: border-box;
    background: var(--cah-t2-bg-default);
    border: 1px solid var(--cah-t2-border-default);
    border-radius: 24px;
    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.04);
    padding: 36px 36px 32px;
    margin-top: 16px;
}
body.cah-ep400 #loginform label,
body.cah-ep400 #registerform label,
body.cah-ep400 #lostpasswordform label,
body.cah-ep400 #resetpassform label {
    font-family: var(--cah-t1-font-family-sans);
    font-size: 14px;
    line-height: 1.4;
    color: var(--cah-t2-content-subtle);
}
body.cah-ep400 #loginform input[type="text"],
body.cah-ep400 #loginform input[type="password"],
body.cah-ep400 #loginform input[type="email"],
body.cah-ep400 #registerform input[type="text"],
body.cah-ep400 #registerform input[type="email"],
body.cah-ep400 #lostpasswordform input[type="text"],
body.cah-ep400 #lostpasswordform input[type="email"],
body.cah-ep400 #resetpassform input[type="text"],
body.cah-ep400 #resetpassform input[type="password"] {
    box-sizing: border-box;
    width: 100%;
    height: 48px;
    margin: 6px 0 18px;
    padding: 0 14px;
    background: var(--cah-t2-form-bg-default);
    border: 1px solid var(--cah-t2-form-border-default);
    border-radius: var(--cah-t1-radius-8);
    font-family: var(--cah-t1-font-family-sans);
    font-size: 16px;
    line-height: 24px;
    color: var(--cah-t2-content-default);
    box-shadow: none;
}
body.cah-ep400 #loginform input:focus,
body.cah-ep400 #registerform input:focus,
body.cah-ep400 #lostpasswordform input:focus,
body.cah-ep400 #resetpassform input:focus {
    border-color: var(--cah-t2-form-border-focus);
    box-shadow: 0 0 0 2px var(--cah-t2-focus-ring-border-default);
    outline: none;
}
body.cah-ep400.login #login .button-primary,
body.cah-ep400.login #login #wp-submit {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    float: none;
    width: 100%;
    height: 48px;
    margin: 4px 0 0;
    padding: 0 18px;
    border-radius: 999px;
    background: var(--cah-t2-btn-primary-bg-default);
    border: 1px solid var(--cah-t2-btn-primary-border-default);
    color: var(--cah-t2-btn-primary-content-default);
    font-family: var(--cah-t1-font-family-sans);
    font-size: 14px;
    font-weight: 600;
    line-height: 1;
    text-transform: none;
    text-shadow: none;
    box-shadow: none;
}
body.cah-ep400.login #login .button-primary:hover,
body.cah-ep400.login #login #wp-submit:hover {
    background: var(--cah-t2-btn-primary-bg-hover);
}
/* Forgot-me / nav / back-to-blog links centred + teal */
body.cah-ep400.login #login #nav,
body.cah-ep400.login #login #backtoblog {
    text-align: center;
    padding-top: 16px;
}
body.cah-ep400.login #login #nav a,
body.cah-ep400.login #login #backtoblog a {
    color: var(--cah-t1-brand-teal-700);
    text-decoration: underline;
    text-underline-offset: 2px;
}
body.cah-ep400.login #login #nav a:hover,
body.cah-ep400.login #login #backtoblog a:hover {
    color: var(--cah-t1-brand-teal-900);
}
/* Error / message notices inside the card */
body.cah-ep400.login #login .message,
body.cah-ep400.login #login #login_error {
    box-sizing: border-box;
    width: 440px;
    max-width: calc(100% - 32px);
    margin: 0 auto 16px;
    border-radius: 12px;
    border-left-width: 4px;
    font-family: var(--cah-t1-font-family-sans);
}

 * T-EP15 — EP-400 Account / profile page
 *
 * The front-end `/account/` page is rendered by `[cah_account_profile]`
 * (Candide\CAH\Core\Account\AccountPage) into the standard cah-theme
 * page template — NOT inside body.login. The full EP-400 styling for
 * that surface lives at the bottom of `cah-theme/style.css` under the
 * `T-EP15 — EP-400 Account / profile page` block, scoped by
 * `body.cah-ep400 .cah-account-shell …`.
 *
 * This file (`auth.css`) stays focused on the `body.login` overlay used
 * by wp-login.php (OTP shell + native password form). Account-page CSS
 * lives in style.css so it loads with the rest of the EP-400 surfaces
 * via the theme's main stylesheet enqueue, not the login-screen
 * enqueue. No styles below this comment.
 * ------------------------------------------------------------------ */