/* ═══════════════════════════════════════════════════════════════════════════
   rs-tokens.css — the brand, and the only file that owns it.
   ═══════════════════════════════════════════════════════════════════════════

   Loaded FIRST by both layouts:

     layout_main.php    rs-tokens → bootstrap → fontawesome → rsflow → rooka → custom
     layout_public.php  rs-tokens → bootstrap → fontawesome → public

   WHY THIS FILE EXISTS SEPARATELY
   ------------------------------
   Domaka keeps the palette at the top of rsflow.css. But rsflow.css is 17 KB of
   admin shell — a fixed 200px sidebar, a 44px topbar, html{font-size:87.5%} and
   .btn{font-size:.78rem !important}. A marketing hero cannot be built on a 14px
   base behind !important; loading it publicly would be a fight on every element.
   So the palette moved here, where the public stylesheet can have it without the
   shell that surrounds it.

   THE PALETTE IS THE LOGO
   -----------------------
   Sampled from the RS mark: the R glyph is #49535E, the S is #7090BE, the gear
   #606B79. The values below are those, deepened for contrast on white — which
   is why they were already right in RS Flow's own stylesheet.

   THREE PLACES HOLD THIS ONE TRUTH: here, BRAND_COLOR/BRAND_ACCENT in
   config/config.php, and RsDocPdf::C_BRAND/C_ACCENT for the invoices. Domaka
   keeps them in step with a comment saying "change both together". A comment is
   not an assertion — scripts/verify_theme.php compares all three and fails.
   ═══════════════════════════════════════════════════════════════════════════ */

/* ── Typeface ───────────────────────────────────────────────────────────────
   Open Sans, everywhere — the back office, the public site, the sign-in page.

   Self-hosted, because the CSP is font-src 'self' and Google Fonts is therefore
   impossible. That is the correct trade: nothing about this site's rendering
   depends on a third party being up, and no visitor's IP is handed to one.

   ── WHY IT IS DECLARED HERE ────────────────────────────────────────────────

   rs-tokens.css is the one stylesheet all four layouts load — layout_main,
   layout_public, l_auth and l_bare. Anything font-shaped therefore belongs
   here and nowhere else.

   It used to be declared in public.css, which only the public site loads, while
   custom.css asked the ADMIN for 'Open Sans' with no @font-face behind it. The
   browser fell back to whatever Open Sans was installed on the machine, and to
   Arial where none was. Declaring it once, in the file everything loads, is
   what makes that impossible rather than merely unlikely.

   ── WHAT REPLACED WHAT ─────────────────────────────────────────────────────

   Inter (body) and Outfit (display headings) were here, as variable fonts —
   one file per unicode subset, nine files in total. Open Sans is shipped as
   static weights instead: 400, 500, 600, 700, 800 plus one italic, ~120 KB,
   cached for a year by the rule in .htaccess. Only the weights a page actually
   uses are fetched.

   Both tokens point at it. Leaving --rs-font-display as Outfit would mix a
   geometric display face with a humanist body face — a deliberate pairing, and
   this is no longer that pairing. Open Sans at 700/800 carries headings alone.

   The Inter and Outfit files are still in fonts/, unreferenced. Reverting is
   restoring this block, not re-downloading anything.

   Ported from domaka/fonts/open-sans rather than fetched: same house, already
   woff2, already subset, no new third party in the supply chain. Licence in
   fonts/open-sans/LICENSE.txt, provenance in PROVENANCE.md.
   ────────────────────────────────────────────────────────────────────────── */

@font-face {
  font-family: 'Open Sans'; font-style: normal; font-weight: 400; font-display: swap;
  src: url('../fonts/open-sans/open-sans-400.woff2') format('woff2');
}
@font-face {
  font-family: 'Open Sans'; font-style: italic; font-weight: 400; font-display: swap;
  src: url('../fonts/open-sans/open-sans-400-italic.woff2') format('woff2');
}
@font-face {
  font-family: 'Open Sans'; font-style: normal; font-weight: 500; font-display: swap;
  src: url('../fonts/open-sans/open-sans-500.woff2') format('woff2');
}
@font-face {
  font-family: 'Open Sans'; font-style: normal; font-weight: 600; font-display: swap;
  src: url('../fonts/open-sans/open-sans-600.woff2') format('woff2');
}
@font-face {
  font-family: 'Open Sans'; font-style: normal; font-weight: 700; font-display: swap;
  src: url('../fonts/open-sans/open-sans-700.woff2') format('woff2');
}
@font-face {
  font-family: 'Open Sans'; font-style: normal; font-weight: 800; font-display: swap;
  src: url('../fonts/open-sans/open-sans-800.woff2') format('woff2');
}


:root {

    /* ── The brand. Everything else is derived from these eight. ─────────── */

    --rs-bg:           #f0f4f8;   /* ground */
    --rs-sidebar-bg:   #2c3a4a;   /* charcoal — the R */
    --rs-accent:       #6b8fbe;   /* steel blue — the S */
    --rs-accent-light: rgba(107,143,190,.14);
    --rs-accent-dark:  #4d6f99;
    --rs-text:         #1e2d3d;
    --rs-text-muted:   #6b7a8d;
    --rs-border:       #e2e8f0;

    /* ── Admin shell chrome ──────────────────────────────────────────────── */

    --rs-sidebar-w:    200px;
    --rs-topbar-h:     44px;
    --rs-sidebar-txt:  rgba(255,255,255,.68);
    --rs-sidebar-sec:  rgba(255,255,255,.28);
    --rs-card-bg:      #ffffff;
    --rs-topbar-bg:    #ffffff;

    /* ── Type ────────────────────────────────────────────────────────────── */

    /* Both tokens, one face — see the @font-face block above for why display
       is no longer a different family. */
    --rs-font:         'Open Sans', 'Segoe UI', system-ui, -apple-system, BlinkMacSystemFont, sans-serif;
    --rs-font-display: 'Open Sans', 'Segoe UI', system-ui, -apple-system, BlinkMacSystemFont, sans-serif;

    /* ── Public site ─────────────────────────────────────────────────────────
       DERIVED, never new hex. Every value below either points at a brand token
       above or is a neutral that carries no brand meaning. That is the rule
       that makes a rebrand an eight-line edit instead of a two-day search, and
       verify_theme.php greps public.css for raw #rrggbb to keep it honest.
       ──────────────────────────────────────────────────────────────────── */

    --pub-ink:        var(--rs-sidebar-bg);   /* headings, nav, footer */
    --pub-ink-2:      #22303e;                /* one step darker — footer base */
    --pub-accent:     var(--rs-accent);
    --pub-accent-dk:  var(--rs-accent-dark);
    --pub-wash:       var(--rs-accent-light); /* tinted section bands */
    --pub-bg:         #ffffff;
    --pub-bg-alt:     var(--rs-bg);           /* alternating sections */
    --pub-body:       var(--rs-text);
    --pub-muted:      var(--rs-text-muted);
    --pub-line:       var(--rs-border);

    /* Status only — the one place the site is allowed a colour that is not the
       brand, because "operational" must not be open to interpretation. */
    --pub-ok:         #2f9e68;
    --pub-warn:       #d99a2b;
    --pub-bad:        #c0473f;

    /* ── Shape and rhythm ────────────────────────────────────────────────── */

    --pub-radius:     10px;
    --pub-radius-lg:  16px;
    --pub-shadow:     0 1px 2px rgba(30,45,61,.05), 0 8px 24px rgba(30,45,61,.06);
    --pub-shadow-lg:  0 2px 4px rgba(30,45,61,.06), 0 24px 48px rgba(30,45,61,.10);
    --pub-maxw:       1180px;
    --pub-gutter:     clamp(1rem, 4vw, 3rem);
    --pub-section-y:  clamp(3.5rem, 8vw, 7rem);
}