/* ===================================================================
   manas · brand tokens  —  the BRAND SHEET
   Lifted from ux_prototypes/manas_app/parts/10_brand.css on 2026-08-19.

   ⚠ NAMED `brand.css`, NOT `tokens.css`, AND THAT IS DELIBERATE. The
   repository's .gitignore carries a secrets denylist — `*secret*`,
   `*credential*`, `*token*` — so a file called `tokens.css` is silently
   untracked. It cost a red build to find, and the prototype's own token
   sheet had been missing from git since the day it was written for the
   same reason. **Do not add an exception to the denylist to get the name
   back.** A secrets rule you have to read carefully is a secrets rule
   that will one day be read carelessly.
   Source of truth for the values: branding/logo/manas_concepts/brand_base.html
   §8 (Round 3.3, working-locked).

   🔴 THE ONE RULE THAT KEEPS THE BRAND REVERSIBLE:
   no screen, template or component may write a colour or a font family
   literally. Everything goes through a token. The day a screen hardcodes
   #0E3B30 it stops following the brand, and nobody finds out until the
   refresh — which is exactly when it is most expensive to discover.
   Guarded by test_brand_tokens.py.

   THE SEMANTIC SPLIT IS DELIBERATE AND MUST SURVIVE:
     BRAND tokens      may be restyled freely — that is the point
     FUNCTIONAL tokens may NOT. A brand refresh must never quietly change
                       what "blocked" or "red" looks like.

   This is the ONLY file allowed a colour or a font-family literal
   (tests/test_brand_tokens.py). The kit (kit.css), the shell (shell.css)
   and the ceremony (ceremony.css) read these tokens and nothing else.
   =================================================================== */

/* -- the four brand faces, SELF-HOSTED (U0). A booth with no internet must
      still render in the brand: no page asks Google's CDN for a font. The
      files are the OFL originals, unmodified, with their licences beside
      them in fonts/. Inter and Playfair are variable: one file, every weight.
      `swap` so a slow disk never hides text. -- */
@font-face{font-family:'Inter';src:url('fonts/Inter.ttf') format('truetype');
  font-weight:100 900;font-style:normal;font-display:swap}
@font-face{font-family:'Playfair Display';src:url('fonts/PlayfairDisplay.ttf') format('truetype');
  font-weight:400 900;font-style:normal;font-display:swap}
@font-face{font-family:'Marcellus';src:url('fonts/Marcellus-Regular.ttf') format('truetype');
  font-weight:400;font-style:normal;font-display:swap}
@font-face{font-family:'IBM Plex Mono';src:url('fonts/IBMPlexMono-Regular.ttf') format('truetype');
  font-weight:400;font-style:normal;font-display:swap}
@font-face{font-family:'IBM Plex Mono';src:url('fonts/IBMPlexMono-Medium.ttf') format('truetype');
  font-weight:500 600;font-style:normal;font-display:swap}

:root{
  /* -- theme: porcelain (day, default — every screen, every day) -- */
  --bg:            #F4EFE4;
  --surface:       #FCFAF4;
  --surface-well:  #EFE8D8;
  --ink:           #221F1A;
  --ink-muted:     #6B6760;
  --brand:         #0E3B30;
  --accent:        #B98A2F;
  --line:          #E2DCCB;
  --row-sum:       #E8EFEA;   /* a sum row on a grid — tinted, never an input */

  /* -- theme: emerald (night / ceremony: sign-in, covers, splash) -- */
  --night-bg:      #0E3B30;
  --night-ink:     #F4EFE4;
  --night-accent:  #D9BE7E;

  /* -- functional · theme-invariant · NEVER restyled by brand -- */
  --gate:          #143D33;
  --advisory-ink:  #8A6D2E;
  --advisory-bg:   #F7F1E2;
  --rag-red:       #A8352F;
  --rag-amber:     #C07A1E;
  --rag-green:     #2E6B4F;
  --red:           #A8352F;   /* the refusal colour — shell.css used it undefined until 15 Oct */
  --amber:         #C07A1E;
  --green:         #2E6B4F;
  /* ⚠ The QR ground is WHITE because a scanner needs dark modules on a light
     field — it is an optical requirement, not a brand choice, so a refresh
     must never re-map it. Tokenised only because colour literals live here. */
  --qr-ground:     #FFFFFF;

  /* The grounds and lines of the three functional states — what a gate, a tag
     or a pill sits on. Functional: they say met / waiting / refused. */
  --rag-green-bg:   #E4EFE8;  --rag-green-line: #BFD9CB;  --rag-green-ink: #1F4D38;
  --rag-amber-bg:   #F6ECD9;  --rag-amber-line: #E5D0AC;  --rag-amber-ink: #7A4E12;
  --rag-red-bg:     #F4E1DF;  --rag-red-line:   #E4C6C3;  --rag-red-ink:   #8A2B26;
  --on-rag:         #FFFFFF;  /* text on a solid red / amber / green ground      */
  --here:           #E8A400;  /* "act here" — where Understood takes the person */

  /* The CUSTODY colours of the tracking sheet (FRD §7.1 f.4) are functional
     too: pink = out at a vendor · yellow = back at the desk · green = done ·
     dispatched · grey = skipped. They say who holds the piece, and a brand
     refresh must never re-map them. */
  --cust-vendor:   #F2C4CF;
  --cust-tcu:      #F4E3A1;
  --cust-done:     #BFDDC9;
  --cust-disp:     #7FB79A;
  --cust-skip:     #E4E0D8;

  /* The duty badges (§0A) are functional too — they say which of the three
     razor duties a screen serves, and a brand refresh must not re-map them. */
  --duty-decide-ink:   #1D5C46;  --duty-decide-bg:   #E8F1EC;
  --duty-protect-ink:  #7A3E2E;  --duty-protect-bg:  #F6EAE5;
  --duty-preserve-ink: #4A4483;  --duty-preserve-bg: #ECEAF6;

  /* -- type: four families, four jobs (T1–T8) -- */
  --font-voice:    'Playfair Display', Georgia, serif;      /* wordmark, titles   */
  --font-engrave:  'Marcellus', Georgia, serif;             /* tracked small caps */
  --font-ui:       'Inter', system-ui, -apple-system, sans-serif;
  --font-code:     'IBM Plex Mono', ui-monospace, monospace;/* codes, S-codes     */
  /* aliases: shell.css and some screens asked for these names, which were
     never defined, so titles and figures fell back to the system face */
  --font-display:  var(--font-voice);
  --font-mono:     var(--font-code);

  /* -- surfaces of the action layer (BRAND: may be restyled) -- */
  --on-brand:      #F4EFE4;   /* text on an emerald button or bar          */
  --brand-hover:   #0A2E26;
  --brand-tint:    #EAF1EE;   /* a selected row, an "on" chip ground       */
  --focus:         var(--accent);
  --scrim:         rgba(24,20,14,.34);
  --shadow-pop:    0 12px 32px rgba(20,16,10,.18);
  --shadow-sheet:  -18px 0 44px rgba(20,16,10,.16);
  --shadow-banner: 0 8px 24px rgba(168,53,47,.30);

  /* -- the mark takes its colour from here, so artwork is never re-cut -- */
  --mk:  var(--brand);
  --dot: var(--accent);

  /* -- motion: the five-rung duration ladder, nothing between rungs
        (motion_and_dimension.html §7, adopted 2026-07-26). The keyframes
        that use these live in motion.css; only the behaviours a shipped
        surface actually fires are written there. -- */
  --t-refuse:  160ms;   /* rung 1 · a refused keystroke, M7            */
  --t-move:    420ms;   /* rung 2 · a context change, M8, the toast    */
  --t-done:    900ms;   /* rung 3 · a completed gesture, M5            */
  --t-rite:   2600ms;   /* rung 4 · ceremony, M3                       */
  --t-amb:    5200ms;   /* rung 5 · ambient breath, M1                 */
  --ease-breath: cubic-bezier(.42,0,.58,1);  /* symmetric · living     */
  --ease-still:  cubic-bezier(.2,.85,.25,1); /* resolves  · arrives    */
  --ease-draw:   cubic-bezier(.55,0,.2,1);   /* converges · pulled     */
  --ease-hard:   cubic-bezier(.9,0,1,1);     /* refuses   · no bounce  */
}

/* The night theme is for CEREMONY surfaces only — sign-in, covers, splash.
   It is not a dark mode: applying it to a working screen is a brand error. */
.night{
  --bg:var(--night-bg); --surface:#12463A; --surface-well:#0B3128;
  --ink:var(--night-ink); --ink-muted:#A9BDB4; --line:#1D5445; --row-sum:#0F3F33;
  --brand:var(--night-accent); --accent:var(--night-accent);
  --mk:var(--night-accent); --dot:var(--night-accent);
  --on-brand:var(--night-bg); --brand-hover:#E6CF95; --brand-tint:#16503F;
}