/*
 * Login card in the Dreamkit house style.
 *
 * Fork seam (server/utils/css-chain.js): loaded last, in the app shell too,
 * so it reaches the login page. Upstream's login card has no logo slot and no
 * configurable SSO button label; this file adds the Dreamkit lockup above the
 * title and paints the SSO button in the brand navy, so the card matches the
 * ZITADEL login at auth.dreamkit.eu. The button text stays upstream's i18n
 * string until upstream carries a white-label label (briefed 2026-09-23).
 *
 * Assets: custom/assets/images/dreamkit/ is served at /custom/assets/.
 */

.auth-card .auth-header::before {
  content: '';
  display: block;
  width: min(220px, 70%);
  height: 34px;
  margin: 0 auto var(--ps-space-5);
  background: url('/custom/assets/images/dreamkit/lockup.svg') center / contain
    no-repeat;
}

.auth-card .auth-title {
  font-weight: 800;
  letter-spacing: -0.01em;
}

.auth-sso-section .auth-btn {
  background: #1c2d6e;
  border-radius: var(--ps-radius-md);
}

.auth-sso-section .auth-btn:hover:not(:disabled) {
  background: #16245a;
  box-shadow: 0 4px 16px rgb(28 45 110 / 0.35);
}

.auth-sso-section .auth-btn:active:not(:disabled) {
  box-shadow: 0 2px 8px rgb(28 45 110 / 0.25);
}

.auth-sso-section .auth-btn:focus-visible {
  outline: 2px solid #ff7c1f;
  outline-offset: 2px;
}