/* Generic single-product shell (see public/js/product-mode-shell.js).
   Generalises the mechanism whistleblowing-workspace.css introduced: one body
   class plus a marker class on the allowed nav links and settings tiles, and
   CSS hides the rest. Kept as CSS rather than inline style toggling so
   navigation.js's own re-renders cannot fight it back — the marker classes are
   re-applied on every page-load, and these rules then hold regardless.

   These selectors HIDE UI. They do not secure anything: every page and
   callable behind them keeps its own server-side check. */

.product-mode-only nav [data-page]:not(.product-mode-nav),
.product-mode-only nav .nav-group-trigger:not(.product-mode-nav),
.product-mode-only nav .nav-submenu:not(.product-mode-nav),
.product-mode-only nav .nav-section-caption,
.product-mode-only #settings-tile-list [data-group]:not(.product-mode-nav),
.product-mode-only .settings-tile-divider,
/* The command palette lists every HR page by name, which would advertise the
   whole suite to a tenant that bought one product. */
.product-mode-only #topbar-search,
.product-mode-only #eq-palette-overlay { display: none !important; }

/* The shell must never hide the app itself — the employee mobile view can mount
   before the mode resolves, and the sidebar/tabbar stay the way out of a page. */
.product-mode-only #app-content { display: block !important; }
.product-mode-only #sidebar { display: flex !important; }
.product-mode-only #mobile-tabbar { display: flex !important; }
@media (min-width: 901px) {
  .product-mode-only #mobile-tabbar { display: none !important; }
}

/* Branded login: the generic proof/marketing strip belongs to the full suite. */
.product-mode-login .login-brand .proof { display: none; }