/* ============================================================================ uptime-auth-supplement.css — the auth-surface rules that belong to Uptime, layered on top of the shared shell (_content/Vahary.Branding/vahary-auth-shell.css, from Vahary.Branding.Assets). THE ONE RULE FOR THIS FILE: it may only ADD elements the shared shell does not have. It must never restate, override, or "improve" a shell rule. That rule is the whole point. Uptime used to vendor its own copy of the shell, and the copy drifted a full generation behind the source — all 749 lines differed, because the custom properties had been renamed to a --vh- prefix and the class vocabulary with them. Nothing caught it: a stylesheet that no longer matches its own markup still compiles and still passes every test. It only looks wrong. Anything in here that duplicates the shell is the beginning of that same divergence, so if a rule below ever needs to change because the SHELL changed, it is in the wrong file — push it upstream instead. Everything here is expressed in the shell's own --vh-* tokens and hangs off .vh-shell, so it inherits the tenant accent and the Night ground rather than carrying a second opinion about either. Loaded from App.razor AFTER the package sheet, and — like it — unconditionally rather than route-gated: Uptime's whole app is one interactive circuit and RedirectToLogin reaches /login WITHOUT a page load, so a path-gated stylesheet would miss the most common way the login appears. NOT carried over from the vendored sheet, deliberately: * a host-element rule. Uptime's BlankLayout renders @Body with no wrapper, so the shell IS the body's child and owns the viewport on its own min-height. (The vendored sheet reached the same place differently — position:fixed; inset:0 — which is a shell-tier decision and now the package's to make.) * .open-console, the first-run "no operators configured" notice. It was styled but never rendered by any component; a dead rule does not get a second life in a new file. ============================================================================ */ /* ---- .vh-error: the collision, and why nothing is left here ------------------ Vahary.Branding.Assets used to ship BOTH sheets Uptime links with the same class name meaning two different things: vahary-branding.css .vh-error = the full-page error POSTER that VaharyError renders on /Error and /not-found (min-height:100vh, flex COLUMN, everything centred). vahary-auth-shell.css .vh-error = the auth-surface error BAND — a hairline strip above the form, ✕ beside the message. Uptime is the only product in the estate that loads both sheets app-wide: it consumes VaharyError on the anonymous error surfaces AND the auth shell on /login, and neither link can be route-gated (the circuit reaches /login without a page load). So the two rules cascaded together on every page, in both directions, and both directions were fatal: * the POSTER's min-height:100vh landed on the BAND — a refused sign-in drew a 900px-tall error box in a 900px viewport, ✕ stacked above the message in the middle of an empty field, and the sign-in form pushed entirely off screen; * the BAND's default `display:none` landed on the POSTER — /not-found and /Error rendered as a blank Night screen with the 404 copy present in the DOM and invisible. That is the anonymous surface whose entire job is to explain itself, so it is the worst possible page to lose. Neither could be caught from here: both sheets were correct on their own, the build was clean, and the markup matched the shell exactly. Only the computed box was wrong. This file used to carry two reset blocks that pulled each sheet's opinion back out of the other's context. They worked, and they were the wrong repair — a consumer arbitrating between two rules of a package it does not own is exactly the divergence the header above forbids. The note left with them said so: "the real repair belongs upstream: the two components should not share a class name. When Vahary.Branding renames one of them, delete this block." Branding 0.6.0 renamed it (PlatformAudit PR #22, e5e1975): the full-page surface is now .vh-errorpage / .vh-errorpage__*, and .vh-error belongs to the auth band alone. The two selectors no longer match the same element, so there is nothing left to arbitrate and the resets have been deleted rather than adjusted. Keeping them would now mean restating shell rules — they named `display`, `min-height`, `flex-direction`, `padding`, `gap`, `colour` and the borders, every one of which is the package's to decide — and the file would silently go stale the next time the shell moved. Both directions are re-proved against the running app on /login, /not-found and /Error; see the branch's verification notes. If a collision like this ever appears again, it goes upstream. Do not re-add a reset here. */ /* UW3 quiet status notice (session expired): the error treatment's hairline shape in the INFORMATIONAL register — steel rules, steel text, never fault-red. The shell has only .vh-error, which is the wrong voice for "your session expired"; if another product grows a neutral notice, this is the rule to move upstream. */ .vh-shell .uptime-notice { display: flex; gap: .55rem; margin: 0 0 1.4rem; padding: .7rem 0; border-top: 1px solid var(--vh-hairline); border-bottom: 1px solid var(--vh-hairline); color: var(--vh-steel); font-size: .86rem; line-height: 1.45; animation: vh-rise 200ms var(--vh-rise-ease) both; } /* UW5 recovery affordance: a static, honest line. Uptime accounts are NOC-managed and there is no self-service reset flow behind Backend.Api's auth surface (login + me), so there is nothing to link to — the shell's .vh-quiet "Forgot password?" anchor would be a lie here, which is why this is copy and not a link. */ .vh-shell .uptime-help { margin: 1.6rem 0 0; color: var(--vh-steel); font-size: .82rem; line-height: 1.6; } /* The SSO entry block. In Suite/BYO-SAML mode it stands in the FORM's slot — the password form is not rendered at all — so it inherits the form's rise timing to keep the page's entrance sequence identical in both auth modes. The shell has no opinion about it: it owns .vh-btn-sso as a button beside the primary, not as a whole block replacing the form. */ .vh-shell .uptime-ssoentry { margin-top: 2.2rem; animation: vh-rise var(--vh-rise-dur) var(--vh-rise-ease) 260ms both; } .vh-shell .uptime-ssoentry .uptime-ssonote { margin: 0 0 1.4rem; color: var(--vh-steel); font-size: .9rem; line-height: 1.6; } /* Blazor's EditForm validation output. These class names are emitted by the framework, not chosen by us, so the shared shell cannot reasonably own them — a static-HTML consumer would never produce them. Shaped to match .vh-error so a framework-rendered message and the component-rendered band read as one thing. The `invalid` / `valid modified` pair is the same story from the other side: InputText appends them to whatever class it is given, and app.css draws GLOBAL 1px outlines on them because Wave 0's console fields are boxed. The shell's fields are hairlines, so the state has to live on the underline instead — this is not overriding the shell (the shell says nothing about these classes), it is stopping the CONSOLE stylesheet from boxing a shell field. */ .vh-shell .validation-errors { list-style: none; margin: 0 0 1.4rem; padding: .7rem 0; border-top: 1px solid rgba(248, 113, 113, .4); border-bottom: 1px solid rgba(248, 113, 113, .4); display: flex; flex-direction: column; gap: .25rem; animation: vh-rise 200ms var(--vh-rise-ease) both; } /* An EditForm renders the