/*
 * Ultra Sentinel — dashboard styles.
 *
 * Palette derived from the Ultra Web Hosting brand:
 *   Primary blue:    #1b79cf / #3183d7 (lighter)
 *   Secondary gold:  #f7a300
 * Adapted for a dark operator dashboard — the core dark surfaces stay
 * cool/neutral, the accent strip + interactive elements carry brand blue,
 * the gold is used sparingly for highlight/info states.
 */

:root {
  /* Surfaces — dark, slightly blue-tinted to harmonize with accent */
  --bg:         #0d1117;
  --bg-elev:    #161b24;
  --bg-elev-2:  #1c2230;
  --bg-row:     #1d2432;

  --border:     #283044;
  --border-lt:  #323b52;

  --text:       #e8ecf3;
  --text-dim:   #8a94a5;
  --text-mute:  #5a6577;

  /* Brand colors */
  --brand:       #3183d7;              /* lighter Ultra Blue, good on dark */
  --brand-deep:  #1b79cf;              /* logo blue */
  --brand-soft:  rgba(49,131,215,0.15);
  --accent:      #3183d7;              /* alias — all interactive elements */
  --accent-hi:   #5aa5ea;              /* hover */
  --gold:        #f7a300;              /* secondary highlight */
  --gold-soft:   rgba(247,163,0,0.15);

  /* Semantic */
  --danger:      #ff5c7a;
  --danger-soft: rgba(255,92,122,0.15);
  --warn:        #f7a300;
  --warn-soft:   rgba(247,163,0,0.15);
  --ok:          #5fd068;
  --ok-soft:     rgba(95,208,104,0.15);

  --radius:      8px;
  --radius-sm:   5px;
  --shadow:      0 1px 2px rgba(0,0,0,0.25), 0 2px 8px rgba(0,0,0,0.25);
}

* { box-sizing: border-box; }

html, body {
  margin: 0;
  padding: 0;
  background: var(--bg);
  color: var(--text);
  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto,
               "Helvetica Neue", Arial, sans-serif;
  font-size: 14px;
  line-height: 1.5;
  -webkit-font-smoothing: antialiased;
  -moz-osx-font-smoothing: grayscale;
}

a { color: var(--accent); text-decoration: none; }
a:hover { color: var(--accent-hi); }

code, .mono {
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-size: 12.5px;
}
code {
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 3px;
  padding: 1px 5px;
}

.muted { color: var(--text-dim); }
.empty { color: var(--text-dim); padding: 20px 0; }

/* ---- Site header ---- */

.site-header {
  position: relative;
  display: flex;
  align-items: center;
  gap: 24px;
  padding: 12px 28px;
  background: linear-gradient(180deg, var(--bg-elev-2) 0%, var(--bg-elev) 100%);
  border-bottom: 1px solid var(--border);
}
/* Brand accent line at the very top of every page */
.site-header::before {
  content: "";
  position: absolute;
  top: 0;
  left: 0;
  right: 0;
  height: 2px;
  background: linear-gradient(90deg, var(--brand-deep) 0%, var(--brand) 50%, var(--gold) 100%);
}

.brand {
  display: flex;
  align-items: center;
  gap: 12px;
  color: var(--text);
  text-decoration: none;
}
.brand:hover { text-decoration: none; }
.brand-logo {
  height: 26px;
  width: auto;
  display: block;
}
.brand-sep {
  color: var(--text-mute);
  font-weight: 300;
  font-size: 14px;
}
.brand-product {
  font-weight: 600;
  letter-spacing: 0.08em;
  font-size: 13px;
  text-transform: uppercase;
  color: var(--text);
}
.brand-version {
  color: var(--text-mute);
  font-size: 11px;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  padding: 2px 8px;
  border: 1px solid var(--border);
  border-radius: 3px;
  margin-left: 4px;
}

/* Desktop: .nav-panel is a transparent wrapper that takes the slot the
   primary nav + user-info used to occupy directly. flex:1 lets the nav
   push user-info to the right edge. On mobile this wrapper flips to a
   stacked dropdown anchored under the header (see .nav-open below). */
.nav-panel {
  display: flex;
  flex: 1;
  align-items: center;
  gap: 24px;
}

.primary-nav {
  display: flex;
  gap: 2px;
  flex: 1;
}

/* Hamburger button — hidden on desktop, shown at narrow widths. Three
   horizontal bars stacked via flex-direction:column on the button. */
.nav-toggle {
  display: none;
  flex-direction: column;
  justify-content: center;
  gap: 4px;
  width: 38px;
  height: 38px;
  padding: 0;
  margin-left: auto;
  background: transparent;
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  cursor: pointer;
}
.nav-toggle:hover { background: var(--bg-row); }
.nav-toggle-bar {
  display: block;
  width: 18px;
  height: 2px;
  margin: 0 auto;
  background: var(--text-dim);
  border-radius: 1px;
}
.nav-toggle[aria-expanded="true"] .nav-toggle-bar { background: var(--text); }
.primary-nav a {
  color: var(--text-dim);
  padding: 6px 14px;
  border-radius: var(--radius-sm);
  font-size: 13px;
  transition: color 0.12s, background 0.12s;
}
.primary-nav a:hover {
  color: var(--text);
  background: var(--bg-row);
  text-decoration: none;
}
.primary-nav a.active {
  color: var(--text);
  background: var(--brand-soft);
  box-shadow: inset 0 -2px 0 var(--brand);
  border-radius: var(--radius-sm) var(--radius-sm) 0 0;
}

.user-info {
  display: flex;
  align-items: center;
  gap: 14px;
}
.user-info .who {
  color: var(--text-dim);
  font-size: 13px;
}
.user-info .logout {
  color: var(--text-dim);
  font-size: 13px;
}
.user-info .logout:hover { color: var(--text); }

main {
  padding: 24px 28px 48px;
  max-width: 1440px;
  margin: 0 auto;
}

/* ---- Header responsive (<=900px) ----
 * Below 900px the 7 nav links + brand + user-info overflow horizontally
 * on phones and narrow tablets (iPhone 13 mini observed clipping
 * `Dashboard` at 375pt). Collapse the nav + user-info into a hamburger
 * dropdown that slides under the header. Desktop layout unchanged. */
@media (max-width: 900px) {
  .site-header {
    flex-wrap: wrap;
    gap: 12px;
    padding: 10px 16px;
  }
  .nav-toggle { display: flex; }
  .nav-panel {
    /* Hidden by default on mobile; flex-basis:100% so when shown it
       drops to a full-width row beneath the brand+hamburger. */
    display: none;
    flex: 0 0 100%;
    flex-direction: column;
    align-items: stretch;
    gap: 4px;
    padding: 8px 0 4px;
    border-top: 1px solid var(--border);
  }
  .site-header.nav-open .nav-panel { display: flex; }
  .primary-nav {
    flex-direction: column;
    align-items: stretch;
    gap: 2px;
    flex: 0 0 auto;
  }
  .primary-nav a {
    padding: 10px 12px;
    font-size: 14px;
    border-radius: var(--radius-sm);
  }
  .primary-nav a.active {
    /* Reset the desktop tab-style underline; a full-width pill reads
       better in a vertical stacked menu. */
    box-shadow: none;
    border-radius: var(--radius-sm);
  }
  .user-info {
    justify-content: space-between;
    padding: 8px 12px 4px;
    margin-top: 4px;
    border-top: 1px solid var(--border);
  }
}

/* Very narrow phones — hide the version chip so the brand + hamburger
 * fit on one row without wrapping. The version is still discoverable
 * via /api/health and the GitHub release tag. */
@media (max-width: 480px) {
  .brand-version { display: none; }
  .brand { gap: 8px; }
  .brand-logo { height: 22px; }
}

.back-nav {
  margin-bottom: 12px;
}
.back-nav a {
  color: var(--text-dim);
  font-size: 13px;
}
.back-nav a:hover { color: var(--text); }

/* ---- Panels ---- */

.panel {
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 20px 24px;
  margin-bottom: 20px;
  box-shadow: var(--shadow);
}
.panel h2 {
  font-size: 14px;
  margin: 0;
  font-weight: 600;
  letter-spacing: 0.02em;
}
.panel h3 {
  font-size: 11px;
  margin: 0 0 14px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-weight: 600;
}
.panel-head {
  display: flex;
  align-items: baseline;
  justify-content: space-between;
  margin-bottom: 18px;
  padding-bottom: 12px;
  border-bottom: 1px solid var(--border);
}

/* ---- Window selector ---- */

.window-bar {
  display: flex;
  align-items: center;
  gap: 12px;
  margin-bottom: 14px;
}
.window-bar-label {
  font-size: 10.5px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-weight: 600;
}
.window-selector {
  display: inline-flex;
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 3px;
  gap: 2px;
}
.window-pill {
  padding: 6px 14px;
  font-size: 12px;
  font-weight: 500;
  color: var(--text-dim);
  border-radius: var(--radius-sm);
  text-decoration: none;
  transition: background 0.12s, color 0.12s;
  line-height: 1;
}
.window-pill:hover {
  color: var(--text);
  background: rgba(255,255,255,0.03);
}
.window-pill.is-active {
  background: var(--brand-soft);
  color: var(--accent-hi);
  box-shadow: inset 0 0 0 1px rgba(49,131,215,0.35);
}
.window-pill.is-active:hover {
  color: var(--accent-hi);
  background: var(--brand-soft);
}

/* ---- Auto-refresh pill — right-anchored in the window-bar -----------
 * Shares visual language with .window-selector: same bg-elev chrome,
 * same border, same outer radius. Inner layout mirrors .window-pill
 * (12px font, tabular numerics). SVG icons (not unicode) so the glyph
 * renders consistently on every OS. JS in static/auto-refresh.js. */
.auto-refresh-pill {
  margin-left: auto;
  display: inline-flex;
  align-items: center;
  gap: 7px;
  padding: 6px 12px;
  font-size: 12px;
  font-weight: 500;
  font-family: inherit;
  line-height: 1;
  color: var(--text-dim);
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  cursor: pointer;
  font-variant-numeric: tabular-nums;
  transition: color 0.12s, border-color 0.12s, background 0.12s;
}
.auto-refresh-pill:hover {
  color: var(--text);
  border-color: rgba(49,131,215,0.45);
  background: var(--bg-elev-2);
}
.auto-refresh-pill:hover .auto-refresh-icon {
  color: var(--accent-hi);
}
.auto-refresh-pill.is-paused {
  color: var(--gold);
  background: var(--gold-soft);
  border-color: rgba(247,163,0,0.35);
}
.auto-refresh-pill.is-paused .auto-refresh-icon {
  color: var(--gold);
}

.auto-refresh-icon {
  width: 12px;
  height: 12px;
  color: var(--text-dim);
  transition: color 0.12s;
  flex-shrink: 0;
}
.auto-refresh-icon--paused { display: none; }
.auto-refresh-pill.is-paused .auto-refresh-icon--running { display: none; }
.auto-refresh-pill.is-paused .auto-refresh-icon--paused  { display: inline-block; }

/* ---- Event Volume: chart on top, horizontal per-detector filter
 * rows below (one row per category). Boxes within a row flow left
 * to right and wrap naturally when a row fills up. Toggling a box
 * fires an AJAX refetch; see the dashboard template's <script> block.
 */
.volume-filter-bar {
  margin-top: 10px;
  padding-top: 8px;
  border-top: 1px solid var(--border);
  display: flex;
  flex-direction: column;
  gap: 4px;
  flex-shrink: 0;
}
.volume-filter-row {
  display: grid;
  grid-template-columns: 80px 1fr;
  gap: 12px;
  align-items: center;
}
.volume-group-label {
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
  line-height: 1.4;
}
.volume-filter-row-items {
  display: flex;
  flex-wrap: wrap;
  gap: 6px 16px;
}
.volume-filter {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  font-size: 11.5px;
  color: var(--text-dim);
  cursor: pointer;
  user-select: none;
  transition: color 0.12s;
  line-height: 1.2;
  padding: 1px 0;
  white-space: nowrap;
}
.volume-filter:hover { color: var(--text); }
.volume-filter-input {
  accent-color: var(--brand);
  width: 13px;
  height: 13px;
  margin: 0;
  cursor: pointer;
  flex-shrink: 0;
}
.volume-filter-input:checked ~ .volume-filter-label { color: var(--text); }
.volume-filter-label {
  white-space: nowrap;
}
.volume-filter-count {
  font-size: 10.5px;
  color: var(--text-mute);
  font-variant-numeric: tabular-nums;
}
@media (max-width: 700px) {
  .volume-filter-row {
    grid-template-columns: 1fr;
    gap: 4px;
  }
}

/* ---- KPI tiles ---- */

.kpi-row {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
  gap: 14px;
  margin-bottom: 20px;
}
.kpi-tile {
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-left: 3px solid var(--brand);
  border-radius: var(--radius);
  padding: 16px 20px;
  box-shadow: var(--shadow);
  transition: transform 0.12s, border-color 0.12s, background 0.12s;
}
.kpi-tile.accent-danger { border-left-color: var(--danger); }
.kpi-tile.accent-warn   { border-left-color: var(--warn); }
.kpi-tile.accent-ok     { border-left-color: var(--ok); }

/* Clickable variant — each tile is an <a>, so strip <a>'s default look
 * and add a subtle hover state so it reads as a button-like surface. */
.kpi-tile--link {
  display: block;
  color: inherit;
  text-decoration: none;
  cursor: pointer;
}
.kpi-tile--link:hover {
  background: var(--bg-elev-2, var(--bg-elev));
  transform: translateY(-1px);
  border-color: var(--accent);
}
.kpi-tile--link:hover .kpi-label {
  color: var(--text);
}
.kpi-tile--link:focus-visible {
  outline: 2px solid var(--accent);
  outline-offset: 2px;
}

/* Category-themed KPI tiles — the left border picks up the category
 * color by default; accent-danger / accent-warn override when the
 * category has actual issues to surface.
 */
.kpi-tile.cat-hardware { border-left-color: #b38cf0; }   /* violet */
.kpi-tile.cat-host     { border-left-color: var(--brand); }
.kpi-tile.cat-cpanel   { border-left-color: var(--ok); }
.kpi-tile.cat-security { border-left-color: var(--gold); }

.kpi-number {
  font-size: 28px;
  font-weight: 600;
  color: var(--text);
  line-height: 1.1;
  font-variant-numeric: tabular-nums;
}
.kpi-number .kpi-total {
  color: var(--text-mute);
  font-size: 18px;
  font-weight: 400;
}
.kpi-label {
  font-size: 10.5px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-weight: 600;
  margin-top: 6px;
}
.kpi-meta {
  font-size: 11.5px;
  color: var(--text-mute);
  margin-top: 2px;
}

/* ---- Chart row ---- */

.charts-row {
  display: grid;
  grid-template-columns: 2fr 1fr;
  gap: 20px;
  margin-bottom: 20px;
  /* Grid default is stretch — both panels in the row match the taller
   * one's height. Combined with the flex column inside .chart-panel,
   * this lets the "By Detector" chart grow to match Event Volume's
   * total height (chart + filter bar) so the row feels balanced. */
}
.chart-panel {
  margin-bottom: 0;
  display: flex;
  flex-direction: column;
}
.chart-box {
  position: relative;
  min-height: 200px;
  flex: 1 1 auto;
}
/* ---- Detector card grid ---- */

.detectors-grid {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
  gap: 14px;
}
.detector-card {
  background: linear-gradient(180deg, var(--bg-elev-2) 0%, var(--bg-elev) 100%);
  border: 1px solid var(--border);
  border-top: 3px solid var(--text-mute);
  border-radius: var(--radius);
  padding: 14px 16px 12px;
  display: flex;
  flex-direction: column;
  gap: 8px;
  box-shadow: var(--shadow);
  position: relative;
  transition: border-color 0.15s, transform 0.12s, box-shadow 0.15s;
  /* Card is an <a> so it's clickable-as-a-whole — strip link chrome. */
  color: inherit;
  text-decoration: none;
  cursor: pointer;
}
.detector-card:hover {
  transform: translateY(-1px);
  color: inherit;
  border-color: var(--border-lt);
}
.detector-card:hover .detector-name { color: var(--accent-hi); }
.detector-card.det-cat-hardware { border-top-color: #b38cf0; }
.detector-card.det-cat-host     { border-top-color: var(--brand); }
.detector-card.det-cat-cpanel   { border-top-color: var(--ok); }
.detector-card.det-cat-security { border-top-color: var(--gold); }
/* Heat — how active a detector is in the last 24h — is carried entirely by
 * the count number's color (gray → amber → red). No box-shadow ring on
 * warm/hot cards: two color systems on one card reads as noise. The top
 * border is always the category color, always. */

.detector-card-head {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 8px;
}
.detector-count {
  font-size: 20px;
  font-weight: 600;
  font-variant-numeric: tabular-nums;
  color: var(--text);
  line-height: 1;
}
.detector-card.det-warm .detector-count { color: var(--warn); }
.detector-card.det-hot  .detector-count { color: var(--danger); }
.detector-count-suffix {
  font-size: 10.5px;
  font-weight: 500;
  color: var(--text-mute);
  margin-left: 4px;
  letter-spacing: 0.04em;
  text-transform: uppercase;
}
.detector-name {
  font-size: 14px;
  font-weight: 600;
  color: var(--text);
  margin: 0;
  text-transform: none;
  letter-spacing: 0;
}
.detector-desc {
  font-size: 12px;
  color: var(--text-dim);
  margin: 0;
  line-height: 1.45;
  flex: 1;
}
.detector-foot {
  font-size: 11px;
  color: var(--text-mute);
  padding-top: 6px;
  border-top: 1px dashed var(--border);
}

/* ---- Particle background atmospheric glows ---- */
/* Canvas lives in base.html; these pseudo-elements paint the radial-gradient
 * "atmosphere" behind the particles so corners have a subtle brand-blue /
 * cyan wash that matches tools.ultrawebhosting.com. Both fixed, pointer-
 * events-disabled, z-index 0 to stay behind content. */
body::before {
  content: '';
  position: fixed;
  top: -30%;
  left: -10%;
  width: 60%;
  height: 60%;
  background: radial-gradient(ellipse, rgba(11, 61, 145, 0.15) 0%, transparent 70%);
  pointer-events: none;
  z-index: 0;
}
body::after {
  content: '';
  position: fixed;
  bottom: -20%;
  right: -10%;
  width: 50%;
  height: 50%;
  background: radial-gradient(ellipse, rgba(0, 194, 255, 0.06) 0%, transparent 70%);
  pointer-events: none;
  z-index: 0;
}

.site-header, main { position: relative; z-index: 1; }

/* ---- OMSA critical banner ---- */

.alert-banner {
  background: linear-gradient(90deg, rgba(255,92,122,0.18) 0%, rgba(255,92,122,0.08) 100%);
  border: 1px solid rgba(255,92,122,0.45);
  border-left: 4px solid var(--danger);
  border-radius: var(--radius);
  padding: 14px 18px;
  margin-bottom: 20px;
  display: flex;
  align-items: flex-start;
  gap: 14px;
  box-shadow: 0 2px 12px rgba(255,92,122,0.1);
  animation: alertPulse 3s ease-in-out infinite;
}
@keyframes alertPulse {
  0%, 100% { box-shadow: 0 2px 12px rgba(255,92,122,0.1); }
  50%      { box-shadow: 0 2px 16px rgba(255,92,122,0.22); }
}
.alert-banner-icon {
  font-size: 22px;
  line-height: 1;
  color: var(--danger);
  font-weight: 700;
  flex: 0 0 auto;
}
.alert-banner-body { flex: 1; }
.alert-banner-title {
  font-size: 13px;
  font-weight: 600;
  color: var(--danger);
  margin: 0 0 6px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
}
.alert-banner-list {
  margin: 0;
  padding: 0;
  list-style: none;
  display: grid;
  gap: 4px;
}
.alert-banner-list li {
  font-size: 13px;
  color: var(--text);
  line-height: 1.4;
}
.alert-banner-list li .server {
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-weight: 600;
}
.alert-banner-list li .component {
  color: var(--danger);
  font-weight: 600;
}
.alert-banner-list li a {
  color: var(--accent-hi);
  margin-left: 4px;
  font-size: 12px;
}

/* ---- Malware findings banner (orange variant of alert-banner) ----
 * Lower urgency than the red hardware banner — Imunify/CXS findings
 * already have agent-side auto-quarantine pushing back; the banner is
 * "operator visibility" not "drop everything." Slides in from the
 * left on initial render to draw the eye without competing with the
 * hardware banner's red pulse. */
.alert-banner-warn {
  background: linear-gradient(90deg, rgba(247,163,0,0.18) 0%, rgba(247,163,0,0.08) 100%);
  border: 1px solid rgba(247,163,0,0.45);
  border-left: 4px solid var(--warn);
  box-shadow: 0 2px 12px rgba(247,163,0,0.1);
  /* Override the hardware banner's red pulse — orange tier doesn't
   * need attention-pulsing, just a subtle resting glow. The slide-in
   * animation handles the "look at me" moment on initial render. */
  animation: none;
}
.alert-banner-icon-warn { color: var(--warn); }
.alert-banner-title-warn { color: var(--warn); }

.malware-banner {
  /* The whole banner slides in from the left on first paint. */
  animation: slideInLeft 360ms cubic-bezier(0.22, 0.61, 0.36, 1) both;
}
.malware-list { gap: 6px; }
.malware-row {
  display: flex;
  align-items: center;
  gap: 6px;
  flex-wrap: wrap;
  /* Per-row staggered slide-in (animation-delay set inline in template
   * so each row trails the one above). `both` keeps the row offscreen
   * before its delay so we don't see them in the final position briefly
   * before the animation kicks. */
  animation: slideInLeft 320ms cubic-bezier(0.22, 0.61, 0.36, 1) both;
  transition: opacity 260ms ease, transform 260ms ease, max-height 320ms ease;
}
.malware-row.is-resolving {
  /* Slide back out to the LEFT and fade — mirrors the entrance. */
  opacity: 0;
  transform: translateX(-32px);
  max-height: 0;
  overflow: hidden;
  pointer-events: none;
}
.malware-row .server {
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-weight: 600;
  color: var(--text);
}
.malware-row .user {
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-weight: 600;
  color: var(--warn);
}
.malware-row .muted-sep { color: var(--text-dim); }
.malware-row .malware-meta { font-size: 12.5px; }
.malware-row .malware-view {
  color: var(--accent-hi);
  font-size: 12px;
  margin-left: auto;
}
.malware-resolve-btn {
  background: rgba(247,163,0,0.12);
  color: var(--warn);
  border: 1px solid rgba(247,163,0,0.4);
  border-radius: var(--radius-sm);
  padding: 3px 10px;
  font-size: 11.5px;
  font-weight: 600;
  cursor: pointer;
  transition: background 140ms ease, color 140ms ease;
}
.malware-resolve-btn:hover {
  background: rgba(247,163,0,0.22);
}
.malware-resolve-btn:disabled {
  opacity: 0.5;
  cursor: progress;
}

@keyframes slideInLeft {
  from { opacity: 0; transform: translateX(-32px); }
  to   { opacity: 1; transform: translateX(0); }
}

/* Honor reduced-motion preference — keep the row visible but skip
 * the slide. Operators on motion-sensitive setups still see the
 * banner; they just don't get the entrance. */
@media (prefers-reduced-motion: reduce) {
  .malware-banner, .malware-row {
    animation: none;
  }
  .malware-row.is-resolving {
    transition: opacity 100ms ease;
    transform: none;
  }
}

/* ---- IP registry (/ips) ---- */

.ips-table .ip-cell {
  font-weight: 600;
  font-size: 13px;
}
.ips-table .col-source {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.06em;
}
.ips-table .ip-actions {
  white-space: nowrap;
  text-align: right;
}
.ips-table .ip-actions .btn + .btn,
.ips-table .ip-actions .btn + form,
.ips-table .ip-actions form + .btn {
  margin-left: 4px;
}

.btn-sm {
  padding: 3px 9px;
  font-size: 11.5px;
  line-height: 1.3;
}

/* Group header color dot — matches the category colors from the dashboard
 * for visual continuity across pages. */
.ip-group-dot {
  display: inline-block;
  width: 10px;
  height: 10px;
  border-radius: 50%;
  margin-right: 6px;
  vertical-align: middle;
  background: var(--text-mute);
}
/* Category-color rules. Written without the `.ip-group` prefix so the
 * same palette drives both the big group header dot on /ips and the
 * small inline chip that shows in the flat ("Sort by IP") view. */
.ip-group-firewall      .ip-group-dot { background: var(--danger);    box-shadow: 0 0 6px rgba(255,92,122,0.4); }
.ip-group-switch        .ip-group-dot { background: #b38cf0;          box-shadow: 0 0 6px rgba(179,140,240,0.4); }
.ip-group-backup        .ip-group-dot { background: var(--ok);        box-shadow: 0 0 6px rgba(95,208,104,0.4); }
.ip-group-monitoring    .ip-group-dot { background: var(--accent);    box-shadow: 0 0 6px rgba(49,131,215,0.4); }
.ip-group-dns_ns        .ip-group-dot { background: #00c2ff;          box-shadow: 0 0 6px rgba(0,194,255,0.4); }
.ip-group-hypervisor    .ip-group-dot { background: var(--brand);     box-shadow: 0 0 6px rgba(49,131,215,0.4); }
.ip-group-shared_server .ip-group-dot { background: var(--accent-hi); box-shadow: 0 0 6px rgba(90,165,234,0.4); }
.ip-group-customer_vps  .ip-group-dot { background: #5aa5ea;          box-shadow: 0 0 6px rgba(90,165,234,0.4); }
.ip-group-drac          .ip-group-dot { background: var(--gold);      box-shadow: 0 0 6px rgba(247,163,0,0.4); }
.ip-group-kvm           .ip-group-dot { background: #d4a0ff;          box-shadow: 0 0 6px rgba(212,160,255,0.4); }
.ip-group-office        .ip-group-dot { background: var(--text);      box-shadow: 0 0 6px rgba(232,236,243,0.3); }
.ip-group-cloud         .ip-group-dot { background: #6bd4a5;          box-shadow: 0 0 6px rgba(107,212,165,0.4); }
.ip-group-decommissioned .ip-group-dot { background: var(--text-mute); }
.ip-group-reserved      .ip-group-dot { background: var(--text-dim); }

/* Inline type chip used in the flat ("Sort by IP") view so each row
 * still shows its category without the section grouping. */
.ip-type-chip {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  font-size: 12px;
  color: var(--text-dim);
  white-space: nowrap;
}
.ip-type-chip .ip-group-dot {
  width: 8px;
  height: 8px;
  margin: 0;
}

/* Inline edit row — hidden by default; toggled open via JS onclick */
.ip-edit-row {
  display: none;
}
.ip-edit-row.open {
  display: table-row;
  background: var(--bg);
}
.ip-edit-row > td {
  padding: 12px 14px !important;
  border-bottom: 1px solid var(--border-lt);
}
.ip-inline-form {
  display: flex;
  flex-wrap: wrap;
  gap: 8px;
  align-items: center;
}
.ip-inline-form input,
.ip-inline-form select {
  background: var(--bg-elev);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 5px 8px;
  font-family: inherit;
  font-size: 12px;
}
.ip-inline-form input[name="ip"]             { width: 140px; }
.ip-inline-form input[name="backup_vlan_ip"] { width: 120px; }
.ip-inline-form input[name="assigned_to"]    { width: 140px; }
.ip-inline-form input[name="label"]          { flex: 1; min-width: 200px; }
.ip-inline-form input[name="notes"]          { flex: 1; min-width: 200px; }
.ip-inline-form select                       { width: 140px; }

/* Status badge cell ("assigned" / "available") — small pill */
.ip-status {
  display: inline-block;
  padding: 2px 8px;
  border-radius: 10px;
  font-size: 10.5px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  border: 1px solid var(--border);
  color: var(--text-dim);
  background: var(--bg);
}
.ip-status-assigned {
  color: var(--ok);
  border-color: rgba(95,208,104,0.35);
  background: rgba(95,208,104,0.08);
}
.ip-status-available {
  color: var(--accent-hi, var(--accent));
  border-color: rgba(90,165,234,0.35);
  background: rgba(90,165,234,0.08);
}

/* Subnet coverage: one card per tracked CIDR with a segmented fill bar. */
.subnet-coverage .panel-head h2 { font-size: 16px; }
.subnet-grid {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
  gap: 14px;
}
.subnet-card {
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 12px 14px;
}
.subnet-head {
  display: flex;
  justify-content: space-between;
  align-items: baseline;
  margin-bottom: 8px;
}
.subnet-cidr {
  font-size: 14px;
  font-weight: 600;
  color: var(--text);
}
.subnet-total {
  font-size: 11.5px;
}
.subnet-bar {
  display: flex;
  width: 100%;
  height: 10px;
  border-radius: 5px;
  overflow: hidden;
  background: var(--bg);
  border: 1px solid var(--border);
  margin-bottom: 10px;
}
.subnet-bar .seg {
  display: block;
  height: 100%;
}
.seg-assigned  { background: var(--ok); }
.seg-available { background: #5aa5ea; }
.seg-other     { background: var(--gold); }

.subnet-legend {
  display: flex;
  flex-wrap: wrap;
  gap: 12px;
  font-size: 12px;
  color: var(--text-dim);
}
.legend-item {
  display: inline-flex;
  align-items: center;
  gap: 5px;
}
.legend-item strong {
  color: var(--text);
  font-weight: 600;
}
.swatch {
  display: inline-block;
  width: 9px;
  height: 9px;
  border-radius: 2px;
  background: var(--text-mute);
}
.swatch-assigned  { background: var(--ok); }
.swatch-available { background: #5aa5ea; }
.swatch-other     { background: var(--gold); }
.swatch-unknown   { background: var(--text-mute); }

/* ---- Toggle grid + iOS-style switches ---- */

.panel-intro {
  color: var(--text-dim);
  font-size: 13.5px;
  line-height: 1.6;
  margin: 0 0 22px;
  max-width: 780px;
}
.panel-intro .emphasis {
  color: var(--text);
  font-weight: 600;
}
.panel-intro code {
  font-size: 12px;
}

.toggle-grid-wrap {
  overflow-x: auto;
  padding: 4px 0 0;
}
.toggle-grid {
  width: 100%;
  border-collapse: separate;
  border-spacing: 0;
}
.toggle-grid th {
  font-size: 11px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  text-align: center;
  padding: 6px 10px 10px;
  border-bottom: 1px solid var(--border);
  background: transparent;
  white-space: nowrap;
}
/* Category banner: colored bar that spans the detectors in one category */
.toggle-grid th.cat-banner {
  font-size: 10.5px;
  font-weight: 700;
  letter-spacing: 0.1em;
  padding: 8px 10px 6px;
  border-bottom: none;
  border-top-left-radius: 4px;
  border-top-right-radius: 4px;
  opacity: 0.95;
}
.toggle-grid th.cat-banner-hardware { color: #b38cf0; background: rgba(179,140,240,0.08); }
.toggle-grid th.cat-banner-host     { color: var(--brand); background: rgba(49,131,215,0.08); }
.toggle-grid th.cat-banner-cpanel   { color: var(--ok); background: rgba(95,208,104,0.08); }
.toggle-grid th.cat-banner-security { color: var(--gold); background: rgba(247,163,0,0.08); }

.toggle-grid th.toggle-host-col {
  text-align: left;
  padding-left: 4px;
}
.toggle-grid th.toggle-col-head {
  font-size: 10.5px;
  padding-top: 10px;
}
.toggle-grid td {
  padding: 12px 10px;
  border-bottom: 1px solid var(--border);
  vertical-align: middle;
  text-align: center;
}
.toggle-grid td.toggle-host-name {
  text-align: left;
  font-weight: 600;
  color: var(--text);
  font-size: 13.5px;
  padding-left: 4px;
  padding-right: 18px;
  white-space: nowrap;
}
.toggle-grid tbody tr:hover {
  background: rgba(255,255,255,0.015);
}
.toggle-grid tbody tr:last-child td {
  border-bottom: none;
}
/* Subtle column-group separators between categories — uses nth-child
   matching against the known 9-detector order. Keeps categories visually
   distinct without adding real vertical rules that would fight the toggles. */
.toggle-grid--detectors td:nth-child(2),  /* Hardware -> Host/OS boundary = col 2 */
.toggle-grid--detectors th.toggle-col-head:nth-child(2) { border-left: 1px solid transparent; }
.toggle-grid--detectors td:nth-child(3),   /* start of host group second item - skip */
.toggle-grid--detectors td:nth-child(6),   /* Host/OS -> cPanel */
.toggle-grid--detectors td:nth-child(7),   /* cPanel -> Security */
.toggle-grid--detectors th.toggle-col-head:nth-child(6),
.toggle-grid--detectors th.toggle-col-head:nth-child(7) {
  padding-left: 14px;
}

.toggle-form {
  display: inline-block;
  margin: 0;
  padding: 0;
  line-height: 0;
}

/* iOS-style slide toggle. Track is the <button>; knob is a ::before. */
.toggle-switch {
  position: relative;
  display: inline-block;
  width: 44px;
  height: 24px;
  padding: 0;
  border: 0;
  border-radius: 12px;
  cursor: pointer;
  background: rgba(138,148,165,0.28);
  transition: background-color 0.22s ease;
  vertical-align: middle;
  font-size: 0;                /* collapse any inadvertent whitespace */
}
.toggle-switch::before {
  content: '';
  position: absolute;
  top: 2px;
  left: 2px;
  width: 20px;
  height: 20px;
  border-radius: 50%;
  background: #fff;
  box-shadow: 0 1px 3px rgba(0,0,0,0.28), 0 0 0 1px rgba(0,0,0,0.04);
  transition: transform 0.22s ease, background-color 0.22s ease;
}
.toggle-switch.toggle-on {
  background: var(--brand);
  box-shadow: 0 0 0 1px rgba(49,131,215,0.25), 0 0 6px rgba(49,131,215,0.18);
}
.toggle-switch.toggle-on::before {
  transform: translateX(20px);
}
.toggle-switch:hover {
  background: rgba(138,148,165,0.4);
}
.toggle-switch.toggle-on:hover {
  background: var(--accent-hi);
}
.toggle-switch:focus-visible {
  outline: 2px solid var(--accent-hi);
  outline-offset: 3px;
}

/* ---- Config page / suppressions ---- */

.form-grid {
  display: grid;
  gap: 14px;
  max-width: 720px;
}
.form-grid label {
  display: flex;
  flex-direction: column;
  gap: 4px;
}
.form-grid input[type="text"],
.form-grid textarea,
.form-grid select {
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 8px 10px;
  font-family: inherit;
  font-size: 13px;
}
.form-grid input[type="text"]:focus,
.form-grid textarea:focus,
.form-grid select:focus {
  outline: none;
  border-color: var(--accent);
  background: var(--bg-elev);
}
.form-label {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
}
.form-hint {
  font-size: 11.5px;
  margin-top: 2px;
}
.form-fieldset {
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 10px 14px 12px;
}
.form-fieldset legend {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
  padding: 0 6px;
}
.form-row-pair {
  display: flex;
  align-items: center;
  gap: 8px;
  margin-top: 6px;
}
.form-row-pair input {
  flex: 1;
}
.form-actions {
  display: flex;
  gap: 10px;
  align-items: center;
}

.btn {
  display: inline-block;
  padding: 7px 14px;
  border-radius: var(--radius-sm);
  font-size: 13px;
  font-weight: 500;
  text-decoration: none;
  border: 1px solid transparent;
  cursor: pointer;
  transition: background 0.12s, border-color 0.12s;
  font-family: inherit;
}
.btn-primary {
  background: var(--brand-soft);
  color: var(--accent-hi);
  border-color: rgba(49,131,215,0.4);
}
.btn-primary:hover { background: rgba(49,131,215,0.25); }

/* Disabled-state for all .btn variants. Without this, .btn-primary's
   explicit background + color + cursor:pointer mask the browser's
   default disabled rendering — the button looks identical whether the
   `disabled` attribute is set or not. Driven by Phase 5c's
   "Analyze this view" gate landing as visually-no-op pre-2026-05-28. */
.btn:disabled,
.btn[disabled] {
  opacity: 0.45;
  cursor: not-allowed;
  pointer-events: none;
}
.btn-primary:disabled,
.btn-primary[disabled] {
  background: var(--bg-elev-2);
  color: var(--text-mute);
  border-color: var(--border-lt);
}
.btn-primary:disabled:hover,
.btn-primary[disabled]:hover { background: var(--bg-elev-2); }
.btn-secondary {
  background: var(--bg-elev-2);
  color: var(--text);
  border-color: var(--border-lt);
}
.btn-secondary:hover { background: var(--bg-row); }
.btn-danger {
  background: rgba(255,92,122,0.1);
  color: var(--danger);
  border-color: rgba(255,92,122,0.35);
}
.btn-danger:hover { background: rgba(255,92,122,0.2); }

.event-actions {
  margin-top: 14px;
  display: flex;
  align-items: center;
  gap: 10px;
}

.badge {
  display: inline-block;
  font-size: 10.5px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  padding: 2px 7px;
  border-radius: 3px;
  vertical-align: middle;
  margin-left: 6px;
}
.badge-suppressed {
  background: rgba(138,148,165,0.15);
  color: var(--text-dim);
  border: 1px solid var(--border);
}
.badge-resolved {
  background: var(--ok-soft);
  color: var(--ok);
  border: 1px solid rgba(95,208,104,0.35);
}
.badge-hidden {
  background: rgba(138,148,165,0.18);
  color: var(--text-dim);
  border: 1px dashed var(--border);
}

.row-suppressed,
.row-hidden {
  opacity: 0.55;
}
.row-suppressed td,
.row-hidden td {
  color: var(--text-dim);
}
.row-suppressed .mono { text-decoration: line-through; }

/* --- Runtime config (engine knob) form rows --- */
.runtime-knob-form {
  border-top: 1px dashed var(--border-lt);
  padding: 0.85em 0;
}
.runtime-knob-form:first-of-type {
  border-top: 0;
  padding-top: 0.4em;
}
.knob-row {
  display: grid;
  grid-template-columns: minmax(0, 2.4fr) minmax(220px, 1.2fr) auto;
  gap: 1em;
  align-items: start;
}
.knob-meta { min-width: 0; }
.knob-label { font-size: 14px; }
.knob-desc { font-size: 12.5px; line-height: 1.5; margin-top: 0.25em; }
.knob-default { font-size: 11.5px; margin-top: 0.4em; }
.knob-input input[type="number"],
.knob-input input[type="text"],
.knob-input input[type="password"],
.knob-input select {
  width: 100%;
  font-size: 13px;
  padding: 0.35em 0.55em;
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: 3px;
}
.knob-checkbox-grid {
  display: grid;
  grid-template-columns: 1fr;
  gap: 0.25em;
  font-size: 12.5px;
}
.knob-checkbox {
  display: flex;
  gap: 0.5em;
  align-items: flex-start;
  cursor: pointer;
}
.knob-checkbox input { margin-top: 0.25em; }
.knob-actions {
  display: flex;
  flex-direction: column;
  gap: 0.4em;
  align-items: stretch;
  min-width: 80px;
}
.badge-modified {
  background: rgba(217,138,38,0.15);
  color: #d98a26;
  border: 1px solid rgba(217,138,38,0.35);
}
.runtime-knob-advanced {
  margin-top: 1.2em;
  border-top: 1px solid var(--border);
  padding-top: 0.8em;
}
.runtime-knob-advanced > summary {
  cursor: pointer;
  font-size: 13px;
  padding: 0.3em 0;
  user-select: none;
}
.runtime-knob-advanced[open] > summary { margin-bottom: 0.6em; }

.chart-box--tall { height: 280px; }
.chart-empty {
  display: flex;
  align-items: center;
  justify-content: center;
}
.chart-empty-msg {
  color: var(--text-dim);
  font-size: 13px;
  margin: 0;
  padding: 0 16px;
  text-align: center;
}
@media (max-width: 1000px) {
  .charts-row { grid-template-columns: 1fr; }
}

/* ---- Firewall panel — 6-tile detector grid + attackers/targets ----------
 *
 * Top: one tile per fortigate detector (IPS, AV, UTM, Geo/DoS, Admin, VPN).
 * Each tile is a link to /events?detector=<slug> and shows count, a mini
 * sparkline of the 24h hourly series, and the top offender IP + hits.
 *
 * Bottom: attackers + targets side-by-side. align-items:start on the grid
 * means the shorter side never stretches to match the taller — so a card
 * with 8 attackers and 2 targets ends right after the attackers table
 * rather than leaving dead space in the bottom-right. The panel's own
 * height grows only to whichever column is longer.
 */

.fw-tiles {
  display: grid;
  grid-template-columns: repeat(5, minmax(0, 1fr));
  gap: 12px;
  margin: 0 0 16px;
}

.fw-tile {
  position: relative;
  display: flex;
  flex-direction: column;
  gap: 6px;
  padding: 12px 14px 10px;
  border: 1px solid var(--border);
  border-top: 3px solid var(--text-mute);
  border-radius: var(--radius-sm);
  background: linear-gradient(180deg, var(--bg-elev-2) 0%, var(--bg-elev) 100%);
  text-decoration: none;
  color: var(--text);
  transition: border-color 0.15s, background 0.15s, transform 0.08s;
  min-height: 108px;
}
.fw-tile:hover {
  border-color: var(--accent);
  background: linear-gradient(180deg, var(--bg-elev-2) 0%, var(--bg-elev-2) 100%);
}
.fw-tile:active { transform: translateY(1px); }

.fw-tile-label {
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
}
.fw-tile-n {
  font-size: 24px;
  font-weight: 700;
  font-variant-numeric: tabular-nums;
  line-height: 1;
  color: var(--text);
}
.fw-tile-n.zero { color: var(--text-mute); font-weight: 500; }

.fw-tile-spark {
  width: 100%;
  height: 22px;
  color: var(--text-mute);
  display: block;
}
.fw-tile-spark-empty {
  height: 22px;
}

.fw-tile-top {
  font-size: 11px;
  color: var(--text-dim);
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
.fw-tile-top b {
  color: var(--text);
  font-weight: 600;
}

/* Per-detector accent stripe + sparkline tint — same palette as the
 * fortigate activity chart, so tile colors and chart colors read as the
 * same taxonomy. */
.fw-tile--rate     { border-top-color: #00c2ff; }
.fw-tile--peak     { border-top-color: #b38cf0; }
.fw-tile--uniq     { border-top-color: #e88fc7; }
.fw-tile--utm      { border-top-color: #5aa5ea; }
.fw-tile--utm      .fw-tile-spark { color: #5aa5ea; }
.fw-tile--geoblock { border-top-color: var(--gold); }
.fw-tile--geoblock .fw-tile-spark { color: var(--gold); }

/* Block Spike tile — border + number color track current-vs-baseline
 * severity. Same ok/warn/hot taxonomy as the CSF attack cards so the
 * two firewall panels read as a coherent pair. */
.fw-tile--spike.fw-spike-ok   { border-top-color: #5fd068; }
.fw-tile--spike.fw-spike-warn { border-top-color: var(--warn); }
.fw-tile--spike.fw-spike-warn .fw-tile-n { color: var(--warn); }
.fw-tile--spike.fw-spike-hot  { border-top-color: var(--danger); }
.fw-tile--spike.fw-spike-hot  .fw-tile-n { color: var(--danger); }

.fw-tile.is-zero { opacity: 0.55; }
.fw-tile.is-zero:hover { opacity: 1; }

/* Bottom row: two columns (attackers | targets), independent heights.
 * align-items:start is the key — without it the shorter column stretches
 * to match the taller and leaves the empty space this layout was designed
 * to eliminate. */
.fw-bottom {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 20px;
  align-items: start;
}
.fw-col { min-width: 0; }

.fw-subhead {
  font-size: 10.5px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  margin: 0 0 8px;
  font-weight: 600;
}
.fw-subhead .muted {
  text-transform: none;
  letter-spacing: 0;
  font-size: 10px;
  margin-left: 4px;
}

@media (max-width: 1200px) {
  .fw-tiles { grid-template-columns: repeat(3, minmax(0, 1fr)); }
}
@media (max-width: 800px) {
  .fw-tiles { grid-template-columns: repeat(2, minmax(0, 1fr)); }
  .fw-bottom { grid-template-columns: 1fr; }
}

/* ---- ConfigServer Firewall panel (Design A — attack-focused).
 *
 * Top: 3 stat bars with radial-gradient accents (temp bans, total
 * denies, ongoing attacks). Below: one alert card per host flagged
 * "under attack" by fetch_csf_summary. Each card is a 3-column grid:
 *   col 1 (220px): identity stack — host, severity, rule, started,
 *                  host-level bans/denies, Investigate link
 *   col 2 (1fr):   attack body — target, summary, 6-metric grid,
 *                  correlated-events line
 *   col 3 (200px): spike hero — big delta, mini sparkline, Now/Peak/Avg
 * Quiet hosts compress into one inline row below.
 */

.csf-bar {
  display: grid;
  grid-template-columns: repeat(4, 1fr);
  gap: 14px;
  margin-bottom: 16px;
}
/* Progressive step-down on narrower viewports so tile labels don't
 * truncate. 4 → 2 → 1 matches the step pattern used by .fw-tiles. */
@media (max-width: 1100px) {
  .csf-bar { grid-template-columns: repeat(2, 1fr); }
}
@media (max-width: 600px) {
  .csf-bar { grid-template-columns: 1fr; }
}
.csf-bar-item {
  display: flex; align-items: center; gap: 14px;
  padding: 14px 18px;
  border-radius: var(--radius);
  background: linear-gradient(90deg, var(--bg-elev-2), transparent);
  border: 1px solid var(--border-lt);
  position: relative;
  overflow: hidden;
}
.csf-bar-item::before {
  content: ""; position: absolute; right: -60px; top: -60px;
  width: 180px; height: 180px; border-radius: 50%;
  opacity: 0.1; pointer-events: none;
}
.csf-bar-item--tempban::before   { background: radial-gradient(circle, var(--danger), transparent 70%); }
.csf-bar-item--deny::before      { background: radial-gradient(circle, #b38cf0,     transparent 70%); }
.csf-bar-item--active::before    { background: radial-gradient(circle, var(--gold),  transparent 70%); }
.csf-bar-item--blocklist::before { background: radial-gradient(circle, #3183d7,     transparent 70%); }
/* Any csf-bar-item rendered as an anchor (blocklist tile, malware-panel
   click-throughs, etc.) — inherit-looking underline-free link. Default
   browser <a> styling otherwise applies blue + underline which breaks
   the tile's visual treatment. */
a.csf-bar-item { text-decoration: none; color: inherit; cursor: pointer; }
a.csf-bar-item:hover { filter: brightness(1.15); }
/* Cap state — amber at 80%+, red at cap. Overrides the base gradient glow. */
.csf-bar-item--near-cap::before { background: radial-gradient(circle, var(--gold),   transparent 70%); }
.csf-bar-item--at-cap::before   { background: radial-gradient(circle, var(--danger), transparent 70%); }
.csf-bar-cap-sep {
  opacity: 0.35;
  margin: 0 0.1em;
  font-weight: 500;
}
.csf-bar-cap {
  font-size: 0.55em;
  color: var(--text-dim);
  font-weight: 500;
  vertical-align: 4px;
}
.csf-bar-icon {
  font-size: 26px;
  opacity: 0.6;
  flex-shrink: 0;
}
.csf-bar-text { display: flex; flex-direction: column; }
.csf-bar-n {
  font-size: 24px;
  font-weight: 700;
  font-variant-numeric: tabular-nums;
  line-height: 1;
  color: var(--text);
}
.csf-bar-n.zero { color: var(--text-mute); font-weight: 500; }
.csf-bar-label {
  font-size: 10.5px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
  margin-top: 4px;
}

/* Blocklist recent-auto strip — sits under the stat bar, single compact
 * line summarizing last-24h activity + the 5 most recent auto-promotes.
 * Hidden entirely when both counts are zero to keep quiet days quiet. */
.csf-blocklist-recent {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.5em 1em;
  padding: 0.55em 0.8em;
  margin-top: -0.25em;
  margin-bottom: 1em;
  font-size: 12.5px;
  color: var(--text-dim);
  background: var(--bg-elev);
  border: 1px solid var(--border-lt);
  border-radius: var(--radius);
}
.csf-bl-summary strong { color: var(--text); font-weight: 600; }
.csf-bl-recent-label {
  font-size: 10.5px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
}
.csf-bl-recent-list { flex: 1 1 auto; min-width: 0; }
.csf-bl-entry {
  color: var(--text);
  text-decoration: none;
  white-space: nowrap;
}
.csf-bl-entry:hover { text-decoration: underline; }
.csf-bl-class { margin-left: 0.3em; font-size: 11px; }

/* Recent fleet temp bans strip — same shape as the blocklist strip
 * but semantically different, so it gets its own class rather than
 * being overloaded. Sits just below the stat bar to answer "what are
 * those tempbans?" without an extra click. */
.csf-tempban-recent {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.4em 0.8em;
  padding: 0.55em 0.8em;
  margin-top: -0.25em;
  margin-bottom: 1em;
  font-size: 12.5px;
  color: var(--text-dim);
  background: var(--bg-elev);
  border: 1px solid var(--border-lt);
  border-radius: var(--radius);
}
.csf-tb-label {
  font-size: 10.5px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
  white-space: nowrap;
}
.csf-tb-list { flex: 1 1 auto; min-width: 0; }
.csf-tb-entry { white-space: nowrap; color: var(--text); }
.csf-tb-rule {
  margin-left: 0.25em;
  font-size: 11px;
  letter-spacing: 0.02em;
}
.csf-tb-remaining {
  margin-left: 0.4em;
  font-size: 11px;
  color: var(--text-dim);
}
.csf-tb-expired {
  color: var(--danger);
  font-weight: 600;
}

/* Alert card container */
.csf-alerts {
  border: 1px solid var(--border-lt);
  border-radius: var(--radius);
  background: var(--bg-elev-2);
  /* Vertical padding prevents the first/last card content from sitting
   * flush against the container border, which reads as a clipped edge
   * — the "odd cut-offs on the sides" the operator flagged. */
  padding: 8px 20px;
  overflow: hidden;
}
.csf-alert {
  display: grid;
  grid-template-columns: 220px 1fr 200px;
  gap: 16px;
  padding: 16px 0;
  border-bottom: 1px solid var(--border-lt);
}
.csf-alert:last-child { border-bottom: none; }

/* Override the generic .sev-p1 / .sev-p2 rules (defined globally for
 * severity pills) so they don't paint the whole attack-card body in
 * --danger-soft / --warn-soft. The warn-soft in particular reads as
 * a muddy brown on the dark card surface and the tint doesn't extend
 * to the container edges, producing the "brown cut-off" look the
 * operator flagged. We replace that with a cleaner treatment:
 *
 *   - transparent card body (inherits the container's elevated bg)
 *   - solid left-edge severity stripe (the accent indicator)
 *   - very faint left→right severity tint gradient (fades to none so
 *     the cut-off can't happen by construction)
 *   - inner card padding inside the grid so the stripe visually
 *     integrates with the row
 *
 * Result: severity reads clearly without muddying the card. */
.csf-alert.sev-p1,
.csf-alert.sev-p2 {
  background: transparent;
  color: inherit;
  position: relative;
  padding-left: 14px;
  margin-left: -4px;
  border-left: 4px solid transparent;
  border-radius: 3px 0 0 3px;
  transition: background 120ms ease;
}
.csf-alert.sev-p1 {
  border-left-color: var(--danger);
  background: linear-gradient(90deg, rgba(255,92,122,0.10) 0%, rgba(255,92,122,0) 30%);
}
.csf-alert.sev-p2 {
  border-left-color: var(--accent-hi);
  background: linear-gradient(90deg, rgba(90,165,234,0.10) 0%, rgba(90,165,234,0) 30%);
}
.csf-alert.sev-p1:hover {
  background: linear-gradient(90deg, rgba(255,92,122,0.16) 0%, rgba(255,92,122,0) 35%);
}
.csf-alert.sev-p2:hover {
  background: linear-gradient(90deg, rgba(90,165,234,0.16) 0%, rgba(90,165,234,0) 35%);
}

/* col 1 — identity */
.csf-alert-ident {
  display: flex;
  flex-direction: column;
  gap: 8px;
  padding-right: 12px;
  border-right: 1px solid var(--border-lt);
  min-width: 0;
}
.csf-alert-host-row {
  display: flex; align-items: center; gap: 8px;
}
.csf-alert-host {
  font-size: 17px;
  font-weight: 700;
  color: var(--text);
}
.csf-alert-badge {
  font-size: 9.5px;
  font-weight: 700;
  letter-spacing: 0.08em;
  padding: 2px 7px;
  border-radius: 2px;
  text-transform: uppercase;
}
.csf-alert-badge.hot  { background: var(--danger-soft); color: var(--danger); }
/* P2 tier — use Ultra brand blue instead of gold so the card reads
 * as on-brand accent rather than the brownish cast that gold at 15%
 * opacity picks up on a dark surface. */
.csf-alert-badge.warn { background: var(--brand-soft); color: var(--accent-hi); }
.csf-alert-rule {
  font-size: 11px;
  color: var(--text-dim);
}
.csf-alert-started {
  font-size: 11px;
  color: var(--text-dim);
}
.csf-alert-started b { color: var(--text); font-weight: 600; }
.csf-alert-ident-stats {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px 10px;
  margin-top: auto;
}
.csf-alert-ident-stats--single { grid-template-columns: 1fr; }
.csf-alert-stat { display: flex; flex-direction: column; }
.csf-alert-stat-l {
  font-size: 9.5px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--text-mute);
  font-weight: 600;
}
.csf-alert-stat-n {
  font-size: 14px;
  font-weight: 600;
  font-variant-numeric: tabular-nums;
  margin-top: 1px;
}
.csf-alert-action { margin-top: 4px; }
.csf-alert-investigate {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  padding: 5px 10px;
  border-radius: 4px;
  border: 1px solid var(--accent-hi);
  color: var(--accent-hi);
  font-size: 11px;
  font-weight: 600;
  text-decoration: none;
}
.csf-alert-investigate:hover { background: var(--brand-soft); }

/* col 2 — body */
.csf-alert-body {
  display: flex;
  flex-direction: column;
  gap: 8px;
  min-width: 0;
}
.csf-alert-target-row {
  display: flex;
  align-items: baseline;
  gap: 8px;
  flex-wrap: wrap;
}
.csf-alert-target-label {
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-mute);
  font-weight: 600;
}
.csf-alert-target {
  font-size: 15px;
  font-weight: 600;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  color: var(--text);
}
.csf-alert-target-sub {
  font-size: 11.5px;
  color: var(--text-dim);
}
.csf-alert-summary {
  font-size: 12.5px;
  color: var(--text);
}
.csf-alert-summary b {
  color: var(--danger);
  font-weight: 700;
}
.csf-alert-metrics {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(110px, 1fr));
  gap: 6px 14px;
  padding: 8px 10px;
  border-radius: var(--radius-sm);
  background: rgba(255,255,255,0.02);
  border: 1px solid var(--border-lt);
}
.csf-alert-metric { display: flex; flex-direction: column; }
.csf-alert-metric-l {
  font-size: 9.5px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--text-mute);
  font-weight: 600;
}
.csf-alert-metric-n {
  font-size: 13px;
  font-weight: 600;
  font-variant-numeric: tabular-nums;
  color: var(--text);
  margin-top: 1px;
}
.csf-alert-metric-n.hot  { color: var(--danger); }
.csf-alert-metric-n.warn { color: var(--accent-hi); }
.csf-alert-correlated {
  font-size: 11.5px;
  color: var(--text-dim);
  padding: 6px 10px;
  background: rgba(49,131,215,0.06);
  border-left: 2px solid var(--accent-hi);
  border-radius: 0 4px 4px 0;
}
.csf-alert-correlated b { color: var(--text); font-weight: 600; }
.csf-alert-correlated.muted {
  background: rgba(255,255,255,0.02);
  border-left-color: var(--border-lt);
}

/* col 3 — spike */
.csf-alert-spike {
  display: flex;
  flex-direction: column;
  gap: 8px;
  padding: 10px 12px;
  border-radius: var(--radius-sm);
  background: var(--bg-elev);
  border: 1px solid var(--border-lt);
}
.csf-alert-spike-head {
  display: flex;
  flex-direction: column;
  padding-bottom: 6px;
  border-bottom: 1px solid var(--border-lt);
}
.csf-alert-spike-delta {
  font-size: 20px;
  font-weight: 700;
  line-height: 1;
  font-variant-numeric: tabular-nums;
}
.csf-alert-spike-delta.hot  { color: var(--danger); }
.csf-alert-spike-delta.warn { color: var(--accent-hi); }
.csf-alert-spike-sub {
  font-size: 10.5px;
  color: var(--text-dim);
  margin-top: 3px;
}
.csf-alert-spike-nums {
  display: grid;
  grid-template-columns: 1fr 1fr 1fr;
  gap: 4px;
}
.csf-alert-spike-num-l {
  color: var(--text-mute);
  text-transform: uppercase;
  letter-spacing: 0.04em;
  font-weight: 600;
  font-size: 9px;
}
.csf-alert-spike-num-v {
  font-variant-numeric: tabular-nums;
  font-weight: 600;
  font-size: 13px;
  margin-top: 1px;
}
.csf-alert-spike-num-v.hot  { color: var(--danger); }
/* Typo-fix: selector was ".csf-alert-spike-spike-num-v.warn" — never
 * matched anything, so P2 "Now" values were rendering with the default
 * color instead of the accent. Also swapped gold → brand blue per
 * the panel's on-brand color direction. */
.csf-alert-spike-num-v.warn { color: var(--accent-hi); }
.csf-alert-spike-num-v.muted { color: var(--text-mute); }

/* Quiet state */
.csf-allquiet {
  border: 1px solid var(--border-lt);
  border-left: 3px solid var(--ok);
  background: linear-gradient(90deg, var(--ok-soft), transparent 60%);
  border-radius: var(--radius-sm);
  padding: 14px 18px;
}
.csf-allquiet-title {
  font-size: 13px;
  font-weight: 600;
  color: var(--ok);
}
.csf-allquiet-sub {
  font-size: 11.5px;
  color: var(--text-dim);
  margin-top: 3px;
}

.csf-quiet-row {
  display: flex;
  align-items: center;
  gap: 8px;
  padding: 10px 14px;
  margin-top: 12px;
  border-radius: 4px;
  background: rgba(255,255,255,0.02);
  font-size: 11.5px;
  color: var(--text-dim);
  flex-wrap: wrap;
}
.csf-quiet-row b {
  color: var(--text-mute);
  font-weight: 600;
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  margin-right: 4px;
}
.csf-quiet-host {
  display: inline-block;
  margin-right: 12px;
}

/* Per-host CSF breakdown table. Replaces the old compact "Quiet:" row
 * — shows every reporting host with their temp-ban / deny / block
 * counts so drift (one host at 40 bans while the rest sit at 0) and
 * cleanup candidates (host with big deny list but zero recent
 * activity) are obvious at a glance. */
.csf-per-host {
  margin-top: 14px;
  border: 1px solid var(--border-lt);
  border-radius: var(--radius-sm);
  overflow: hidden;
}
.csf-per-host-head {
  padding: 8px 14px;
  background: var(--bg-elev-2);
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-mute);
  font-weight: 600;
  border-bottom: 1px solid var(--border-lt);
}
.csf-per-host-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 12px;
  font-variant-numeric: tabular-nums;
}
.csf-per-host-table thead th {
  text-align: left;
  padding: 8px 14px;
  font-size: 9.5px;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  color: var(--text-mute);
  font-weight: 600;
  border-bottom: 1px solid var(--border-lt);
  background: var(--bg-elev);
}
.csf-per-host-table thead th.num { text-align: right; }
.csf-per-host-table tbody td {
  padding: 7px 14px;
  border-bottom: 1px solid var(--border-lt);
  color: var(--text);
}
.csf-per-host-table tbody tr:last-child td { border-bottom: none; }
.csf-per-host-table tbody tr:hover td { background: rgba(255,255,255,0.02); }
.csf-per-host-table td.num { text-align: right; font-weight: 600; }
.csf-per-host-table td.num.muted  { color: var(--text-dim); font-weight: 500; }
.csf-per-host-table td.num.hot    { color: var(--danger); }
.csf-per-host-table td.num.warn   { color: var(--accent-hi); }
.csf-per-host-table td a.mono     { color: var(--accent); text-decoration: none; }
.csf-per-host-table td a.mono:hover { color: var(--accent-hi); text-decoration: underline; }

/* Attacker-IP and modsec-rule inline lists on the CSF attack card.
 * Compact tags style — one line, wrap if needed, muted counts. */
.csf-alert-iplist {
  font-size: 11.5px;
  line-height: 1.6;
  margin-top: 4px;
  color: var(--text-dim);
}
.csf-alert-iplist-l {
  font-weight: 600;
  color: var(--text-mute);
  text-transform: uppercase;
  font-size: 9.5px;
  letter-spacing: 0.06em;
  margin-right: 6px;
}
.csf-alert-iplist .mono {
  color: var(--text);
  text-decoration: none;
}
.csf-alert-iplist a.mono:hover {
  color: var(--accent-hi);
  text-decoration: underline;
}

/* ----- CXS Scanner panel overrides -----
 * The CXS panel reuses every .csf-* class (alerts grid, bar, spike
 * block) so the two panels stack as a coherent pair. Overrides here
 * are cosmetic only: different accent for the top-bar stat cells,
 * styling for the confirmed-findings / auto-action lines that don't
 * exist in the CSF pattern. Teal accent keeps CXS visually distinct
 * from CSF's gold. */
/* CXS bar has 3 tiles (scans / hits / confirmed) vs CSF's 4 (tempban /
 * deny / active / blocklist) — override the inherited 4-col grid so we
 * don't leave a hanging empty cell. Step-down mirrors .csf-bar's pattern
 * (3 → 1 at the small breakpoint); we skip the 1100px 2-col stop since
 * 3 → 2 would leave the same empty-cell problem we're fixing here. */
.malware-bar{ grid-template-columns: repeat(3, 1fr); }
@media (max-width: 700px) {
  .malware-bar{ grid-template-columns: 1fr; }
}

.malware-bar-item--scans::before     { background: radial-gradient(circle, #5aa5ea,     transparent 70%); }
.malware-bar-item--hits::before      { background: radial-gradient(circle, var(--gold), transparent 70%); }
.malware-bar-item--confirmed::before { background: radial-gradient(circle, var(--danger), transparent 70%); }

.malware-findings .malware-finding-row {
  padding: 6px 0;
  border-top: 1px dashed var(--border-lt);
  font-size: 11.5px;
}
.malware-findings .malware-finding-row:first-of-type {
  border-top: none;
  padding-top: 2px;
}
.malware-finding-path {
  color: var(--text);
  text-decoration: none;
  word-break: break-all;
}
.malware-finding-path:hover { color: var(--danger); text-decoration: underline; }
.malware-finding-resolved {
  display: inline-block;
  margin-left: 6px;
  padding: 1px 6px;
  border-radius: 3px;
  background: rgba(95,208,104,0.15);
  color: #5fd068;
  font-size: 9.5px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  font-weight: 600;
}
.malware-finding-actions {
  margin-top: 4px;
  padding-left: 12px;
  font-size: 10.5px;
  color: var(--text-dim);
  line-height: 1.5;
}
.malware-finding-actions .mono { color: var(--text-dim); }

.csf-alert-stat-n.hot { color: var(--danger); }

@media (max-width: 1100px) {
  .csf-alert {
    grid-template-columns: 1fr 180px;
  }
  .csf-alert-ident {
    grid-column: 1 / -1;
    grid-row: 1;
    flex-direction: row;
    flex-wrap: wrap;
    gap: 12px;
    padding: 0 0 10px;
    border-right: none;
    border-bottom: 1px solid var(--border-lt);
  }
  .csf-alert-ident-stats { margin-top: 0; margin-left: auto; }
  .csf-alert-action { margin-top: 0; margin-left: auto; }
  .csf-alert-body  { grid-row: 2; grid-column: 1; }
  .csf-alert-spike { grid-row: 2; grid-column: 2; }
}
@media (max-width: 700px) {
  .csf-bar { grid-template-columns: 1fr; }
  .csf-alert { grid-template-columns: 1fr; }
  .csf-alert-spike { grid-column: 1; }
}

.attackers-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 12px;
  font-variant-numeric: tabular-nums;
}
.attackers-table th {
  text-align: left;
  padding: 6px 8px;
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  color: var(--text-dim);
  font-weight: 600;
  border-bottom: 1px solid var(--border);
  background: transparent;
}
.attackers-table td {
  padding: 6px 8px;
  border-bottom: 1px solid var(--border-lt);
  color: var(--text);
}
.attackers-table td.num, .attackers-table th.num {
  text-align: right;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
}
.attackers-table tr:last-child td { border-bottom: none; }
.attackers-table a {
  color: var(--accent-hi, var(--accent));
  text-decoration: none;
}
.attackers-table a:hover { text-decoration: underline; }

/* ---- Compact fleet status strip (dashboard) ------------------------------
 * One line per host: name · status pill · heartbeat age · P1/P2 counts.
 * Click-through to /hosts#<server> jumps to the full card. Lives on the
 * dashboard so first-paint stays fast at fleet scale; full per-host
 * detail (cards, sparklines, recent events) lives on /hosts.
 */
.fleet-status-strip {
  list-style: none;
  margin: 0;
  padding: 0;
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
  gap: 6px 14px;
}
.fleet-status-row {
  border-left: 3px solid transparent;
  background: var(--bg-elev);
  border-radius: var(--radius-sm);
  transition: background 120ms ease;
}
.fleet-status-row.status-alive  { border-left-color: var(--ok); }
.fleet-status-row.status-silent { border-left-color: var(--warn); }
.fleet-status-row.status-stale  { border-left-color: var(--danger); }
.fleet-status-row:hover { background: var(--bg-row); }
.fleet-status-link {
  display: flex;
  align-items: center;
  gap: 8px;
  padding: 6px 10px;
  text-decoration: none;
  color: var(--text);
  font-size: 12.5px;
}
.fleet-status-link:hover { text-decoration: none; }
.fleet-status-name {
  font-weight: 600;
  flex: 0 0 auto;
  min-width: 80px;
}
.fleet-status-age {
  flex: 1;
  font-size: 11px;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}

/* ---- Fleet hosts list — one full-width card per server --------------- */

.hosts-list {
  display: flex;
  flex-direction: column;
  gap: 14px;
}
.host-card {
  background: linear-gradient(180deg, var(--bg-row) 0%, var(--bg-elev) 100%);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 0;
  overflow: hidden;
  border-top: 3px solid var(--text-mute);
  box-shadow: 0 1px 2px rgba(0,0,0,0.2);
  transition: border-color 0.15s;
}
/* Alive = brand blue (the default, unremarkable state). Green is
 * reserved for explicit good-news signals; lighting up 22 boxes in
 * green every render washes out the visual hierarchy. Silent stays
 * gold (warn), stale stays red (danger). */
.host-card.status-alive   { border-top-color: var(--brand); }
.host-card.status-silent  { border-top-color: var(--warn); }
.host-card.status-stale   { border-top-color: var(--danger); }
.host-card.status-unknown { border-top-color: var(--text-mute); }

/* Header: name + meta on the left (two stacked text rows), pills on
 * the right (status + P1 count + P2 count). No dividing border here —
 * the card body starts a visual beat lower thanks to the body padding. */
.host-top {
  display: flex;
  align-items: flex-start;
  justify-content: space-between;
  gap: 16px;
  padding: 12px 18px 0;
}
.host-top-left {
  min-width: 0;
  flex: 1;
  display: flex;
  flex-direction: column;
  gap: 2px;
}
.host-name-row {
  display: flex;
  align-items: center;
  gap: 8px;
  min-width: 0;
}
/* Drag handle — the dotted-grip glyph signals "pick me up". The whole
 * card is draggable (HTML5 attribute on the <article>), but the handle
 * is the visual cue so users know it's allowed. Cursor-grab everywhere
 * on the card works in practice; changing it only on the handle keeps
 * the rest of the card feeling clickable/normal. */
.host-drag-handle {
  color: var(--text-mute);
  font-size: 14px;
  line-height: 1;
  letter-spacing: -1px;
  cursor: grab;
  user-select: none;
  padding: 2px 4px;
  border-radius: 3px;
  transition: color 0.12s, background 0.12s;
}
.host-drag-handle:hover {
  color: var(--text);
  background: rgba(255,255,255,0.04);
}
.host-card { cursor: grab; }
.host-card:active { cursor: grabbing; }
.host-card.is-dragging {
  opacity: 0.4;
  cursor: grabbing;
}
.host-card.is-dragging * { pointer-events: none; }

/* Small button to reset a customized order back to server-emitted */
.btn-reset-inline {
  background: transparent;
  color: var(--text-dim);
  border: 1px solid var(--border);
  border-radius: 3px;
  padding: 2px 8px;
  font-size: 10.5px;
  cursor: pointer;
  margin-left: 6px;
  transition: color 0.12s, border-color 0.12s;
}
.btn-reset-inline:hover {
  color: var(--text);
  border-color: var(--accent);
}
.host-name {
  font-weight: 600;
  font-size: 18px;
  letter-spacing: 0.01em;
  color: var(--text);
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}
.host-top-meta {
  font-size: 11.5px;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  letter-spacing: 0.01em;
  overflow: hidden;
  white-space: nowrap;
  text-overflow: ellipsis;
}
.host-top-meta .sep {
  color: var(--text-mute);
  margin: 0 4px;
}
.host-top-right {
  display: flex;
  align-items: center;
  gap: 6px;
  flex-shrink: 0;
  padding-top: 2px;
}

/* Card body: a left "mini dashboard" (4 × 3 tile grid) + a right
 * events rail. Mostly horizontal real estate goes to the dashboard;
 * the events rail is just wide enough for one-liner rule rows. */
.host-body {
  display: grid;
  grid-template-columns: minmax(0, 1fr) minmax(260px, 320px);
  gap: 16px;
  padding: 12px 16px 14px;
  align-items: start;
}

/* Inner 4 × 3 tile grid. Rows auto-size so each row is exactly as tall
 * as its content needs — no forced stretching. Middle row grows a bit
 * taller because the disk bar + sparkline deserve the breathing room. */
.host-dashboard {
  display: grid;
  grid-template-columns: repeat(4, minmax(0, 1fr));
  grid-template-rows: auto auto auto;
  gap: 8px;
}

/* Metric tile — label above value. Same structural shape for every tile;
 * the wide/tall variants just span extra grid cells. Subtle elevated
 * surface so the tiles read as distinct chunks against the card gradient. */
.host-tile {
  background: rgba(255,255,255,0.025);
  border: 1px solid var(--border-lt);
  border-radius: var(--radius-sm);
  padding: 8px 12px;
  display: flex;
  flex-direction: column;
  gap: 3px;
  min-width: 0;
}
.host-tile-label {
  font-size: 10px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-weight: 600;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}
.host-tile-value {
  font-size: 14px;
  color: var(--text);
  font-weight: 600;
  font-variant-numeric: tabular-nums;
  line-height: 1.25;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}
.host-tile-value.mono {
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
}

/* Middle row — Disk (col 1) · Sparkline (cols 2-3) · Uptime (col 4).
 * Sparkline is deliberately only 2 cols wide so it reads as one of
 * the four dashboard widgets, not as a centerpiece. */
.host-tile--disk    { grid-column: 1 / 2; grid-row: 2; }
.host-tile--spark   {
  grid-column: 2 / 4;
  grid-row: 2;
  color: var(--accent-hi, var(--accent));
  padding-bottom: 6px;
  position: relative;            /* anchor for the absolute-positioned tooltip */
}
.host-tile--spark .spark-svg {
  width: 100%;
  height: 52px;
  display: block;
  margin-top: 2px;
  cursor: crosshair;
}
.host-tile--spark .spark-line {
  stroke: currentColor; stroke-width: 1.5;
  filter: drop-shadow(0 0 2px rgba(49,131,215,0.35));
  vector-effect: non-scaling-stroke;
}
.host-tile--spark .spark-area { fill-opacity: 0.9; }
.host-tile--spark .spark-empty {
  font-size: 11px; font-style: italic; padding: 14px 0; text-align: center;
}
.host-tile--spark .spark-cursor { pointer-events: none; }
.host-tile--spark .spark-dot    { pointer-events: none; }

/* Floating tooltip above the sparkline. JS (host-spark.js) positions
 * it and toggles the `is-visible` class on mousemove / mouseleave. */
.spark-tooltip {
  position: absolute;
  bottom: 100%;
  left: 0;
  transform: translateX(-50%);
  background: var(--bg-elev-2, var(--bg-elev));
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 4px 8px;
  font-size: 11px;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-variant-numeric: tabular-nums;
  white-space: nowrap;
  pointer-events: none;
  opacity: 0;
  transition: opacity 0.1s ease;
  z-index: 2;
  box-shadow: 0 2px 8px rgba(0,0,0,0.4);
}
.spark-tooltip.is-visible { opacity: 1; }
.spark-tooltip .spark-tooltip-val { color: var(--accent-hi, var(--accent)); font-weight: 600; }
.spark-tooltip .spark-tooltip-ts  { color: var(--text-dim); margin-left: 6px; }

/* Disk progress bar — wider, thicker, with the blue-fade gradient fill
 * the operator liked. Track is a barely-visible tint so the unfilled
 * portion reads as "capacity still available" without distracting. */
.disk-bar-wide {
  width: 100%;
  height: 8px;
  background: rgba(255,255,255,0.05);
  border: 1px solid var(--border);
  border-radius: 4px;
  overflow: hidden;
  margin-top: 6px;
}
.disk-bar-wide .disk-bar-fill {
  display: block;
  height: 100%;
  background: linear-gradient(90deg, var(--brand) 0%, var(--accent-hi) 100%);
  transition: width 0.3s ease;
}
.disk-bar-wide.bar-warn .disk-bar-fill {
  background: linear-gradient(90deg, var(--warn) 0%, #ffcc66 100%);
}
.disk-bar-wide.bar-crit .disk-bar-fill {
  background: linear-gradient(90deg, var(--danger) 0%, #ff8a9f 100%);
}

/* Events rail on the right of the card */
.host-events {
  display: flex;
  flex-direction: column;
  gap: 4px;
  min-width: 0;
}

/* Column 2 — 24h bandwidth sparkline. Lives inside a subtle framed panel
 * so the chart reads as a deliberate data surface, not a floating line.
 * Wider than the others because trend-reading benefits from horizontal
 * resolution.                                                          */
.host-col--spark {
  color: var(--accent-hi, var(--accent));    /* polyline inherits via currentColor */
  gap: 6px;
}
.spark-head {
  display: flex;
  justify-content: space-between;
  align-items: baseline;
  gap: 12px;
}
.spark-label {
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.1em;
  font-weight: 600;
}
.spark-now-inline {
  font-size: 11.5px;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  color: var(--text);
  font-variant-numeric: tabular-nums;
}
.spark-frame {
  background: linear-gradient(180deg, rgba(49,131,215,0.06) 0%, rgba(49,131,215,0.02) 100%);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 6px 2px 2px;
}
.spark-svg {
  width: 100%;
  height: 80px;
  display: block;
}
.spark-line {
  stroke: currentColor;
  stroke-width: 1.5;
  filter: drop-shadow(0 0 2px rgba(49,131,215,0.35));
  vector-effect: non-scaling-stroke;
}
.spark-area {
  fill-opacity: 0.9;
}
.spark-axis {
  display: flex;
  justify-content: space-between;
  font-size: 10px;
  letter-spacing: 0.04em;
  color: var(--text-mute);
  padding: 0 4px;
}
.spark-empty {
  font-size: 11.5px;
  font-style: italic;
  padding: 32px 0;
  text-align: center;
  background: rgba(255,255,255,0.02);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
}

/* Column 3 — recent events feed with staggered entry animation */
.events-feed-head {
  display: flex;
  justify-content: space-between;
  align-items: baseline;
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
  margin-bottom: 4px;
}
.events-feed-all {
  color: var(--accent-hi, var(--accent));
  text-decoration: none;
  font-weight: 600;
}
.events-feed-all:hover { text-decoration: underline; }

.events-feed {
  list-style: none;
  padding: 0;
  margin: 0;
  display: flex;
  flex-direction: column;
  gap: 5px;
}
/* Each event row is a card with a 3px severity stripe down its left
 * edge (P1 → danger red, P2 → gold). The stripe carries the severity
 * signal so we drop the inline P1/P2 pill from inside the row.       */
.events-feed-row {
  opacity: 0;
  transform: translateX(12px);
  animation: event-slide-in 360ms cubic-bezier(0.2, 0.8, 0.2, 1) forwards;
  border-radius: var(--radius-sm);
  background: rgba(255,255,255,0.02);
  border: 1px solid var(--border-lt);
  border-left-width: 3px;
  border-left-color: var(--text-mute);
  transition: background 0.15s, border-color 0.15s, opacity 0.22s, transform 0.22s;
  display: flex;
  align-items: stretch;
}
.events-feed-row.is-resolving {
  opacity: 0;
  transform: translateX(24px);
  pointer-events: none;
}
.events-feed-row.sev-p1 {
  border-left-color: var(--danger);
  background: rgba(255,92,122,0.06);
}
.events-feed-row.sev-p2 {
  border-left-color: var(--warn);
  background: rgba(247,163,0,0.05);
}
.events-feed-row:hover {
  background: var(--bg-elev);
  border-color: var(--accent);
  border-left-color: inherit;       /* keep severity stripe visible on hover */
}
.events-feed-row.sev-p1:hover { border-left-color: var(--danger); }
.events-feed-row.sev-p2:hover { border-left-color: var(--warn); }
.events-feed-link {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 8px;
  padding: 6px 10px;
  color: var(--text);
  text-decoration: none;
  font-size: 11.5px;
  flex: 1 1 auto;
  min-width: 0;
}

/* Resolve button — appears on the right of each row. Gets a subtle
 * "hover to reveal" treatment so the events list reads clean at rest
 * but operators see the affordance when they move their pointer over
 * a row. Click POSTs to /api/dashboard/events/{id}/resolve; the JS
 * handler adds .is-resolving to the row for the fade-out, then removes
 * the li from the DOM. */
.events-feed-resolve {
  flex: 0 0 auto;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 28px;
  padding: 0;
  margin: 0;
  background: transparent;
  border: none;
  border-left: 1px solid var(--border-lt);
  color: var(--text-mute);
  cursor: pointer;
  opacity: 0;
  transition: opacity 0.12s, color 0.12s, background 0.12s;
  font-family: inherit;
}
.events-feed-resolve svg {
  width: 14px;
  height: 14px;
}
.events-feed-row:hover .events-feed-resolve,
.events-feed-resolve:focus-visible {
  opacity: 1;
}
.events-feed-resolve:hover {
  color: var(--ok);
  background: var(--ok-soft);
}
.events-feed-resolve:disabled {
  cursor: default;
  opacity: 0.5;
}
.sr-only {
  position: absolute;
  width: 1px;
  height: 1px;
  padding: 0;
  margin: -1px;
  overflow: hidden;
  clip: rect(0, 0, 0, 0);
  white-space: nowrap;
  border: 0;
}
.events-feed-rule {
  min-width: 0;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
  font-size: 12px;
  color: var(--text);
}
.events-feed-age {
  font-size: 11px;
  font-variant-numeric: tabular-nums;
  flex-shrink: 0;
}
.events-feed-empty {
  font-size: 11.5px;
  font-style: italic;
  padding: 12px 0;
}

@keyframes event-slide-in {
  from { opacity: 0; transform: translateX(12px); }
  to   { opacity: 1; transform: translateX(0); }
}

/* Stack the three columns on narrow viewports. */
@media (max-width: 1100px) {
  .host-body {
    grid-template-columns: 1fr;
    gap: 14px;
  }
}

/* Legacy grid rules kept below so the same `.host-card` styling works if
 * any other page still lists hosts in the old 2-col grid. */
.host-metrics-grid {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 12px 16px;
  padding: 4px 18px 12px;
}
.metric {
  display: flex;
  flex-direction: column;
  gap: 3px;
  min-width: 0;
}
.metric--wide { grid-column: 1 / -1; }
.metric-label {
  font-size: 10px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
}
.metric-value {
  font-size: 13px;
  color: var(--text);
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  display: flex;
  align-items: center;
  gap: 8px;
}
.metric-value.counts {
  flex-wrap: wrap;
}
/* Disk metric: up to three rows (Total / /home / /var) stacked
 * vertically. Each row shows mountpoint label, GB/percent text, and a
 * progress bar. Mountpoints that aren't a separate filesystem on a box
 * are omitted server-side (list_hosts), so cards on single-partition
 * boxes show just the "Total" row. */
.disk-stack {
  display: flex;
  flex-direction: column;
  gap: 6px;
  width: 100%;
}
.disk-row {
  display: grid;
  grid-template-columns: 52px 1fr;
  grid-template-rows: auto auto;
  gap: 2px 10px;
  align-items: center;
}
.disk-row .disk-mount {
  grid-column: 1;
  grid-row: 1 / 3;
  font-size: 10.5px;
  font-weight: 600;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.06em;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
}
.disk-row .disk-text {
  grid-column: 2;
  grid-row: 1;
  font-size: 12px;
  color: var(--text);
  font-variant-numeric: tabular-nums;
}
.disk-row .bar {
  grid-column: 2;
  grid-row: 2;
  max-width: none;
  width: 100%;
}

/* Detectors reference table — wider descriptions, category column narrow */
.detectors-table th,
.detectors-table td {
  vertical-align: middle;
}
.detectors-table .det-name  { font-weight: 600; white-space: nowrap; }
.detectors-table .det-desc  { font-size: 12.5px; line-height: 1.45; }
.detectors-table .det-age   { white-space: nowrap; color: var(--text-dim); font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 12px; }
.detectors-table .det-count { font-variant-numeric: tabular-nums; text-align: right; font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }

/* Inline progress bar for disk usage. Color is derived from the host
 * card's status-* class — healthy box shows the brand blue, warning
 * shows gold, stale shows red — so the bar doesn't need its own
 * percentage-threshold logic.
 */
.bar {
  flex: 1;
  height: 4px;
  background: var(--bg);
  border-radius: 2px;
  overflow: hidden;
  min-width: 60px;
  max-width: 120px;
}
/* Inside host cards the bar should span the whole remaining column
 * width — the 120px cap was nice for the old tight-grid layout but
 * leaves visual dead space in full-width cards. Also outline the
 * track so the empty portion is visible against the card gradient. */
.host-card .disk-row .bar {
  max-width: none;
  height: 5px;
  background: rgba(255,255,255,0.04);
  box-shadow: inset 0 0 0 1px var(--border);
}
.host-card .disk-row {
  grid-template-columns: 52px 1fr;
  gap: 1px 10px;
}
.host-card .disk-row .disk-text {
  font-size: 11.5px;
}
.bar-fill {
  display: block;
  height: 100%;
  background: var(--brand);
  transition: width 0.3s ease;
}
.host-card.status-alive   .bar-fill { background: var(--brand); }
.host-card.status-silent  .bar-fill { background: var(--warn); }
.host-card.status-stale   .bar-fill { background: var(--danger); }
/* Per-row threshold overrides for disk stacks — a /home row at 92%
 * should look alarming even on a healthy-status host card. */
.bar.bar-warn .bar-fill { background: var(--warn); }
.bar.bar-crit .bar-fill { background: var(--danger); }

.host-foot {
  padding: 10px 18px;
  border-top: 1px solid var(--border);
  font-size: 12px;
  background: rgba(0,0,0,0.1);
}

/* ---- Pills + severity badges ---- */

.pill {
  font-size: 10.5px;
  padding: 3px 10px;
  border-radius: 999px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
}
.pill.status-alive   { background: var(--ok-soft);     color: var(--ok); }
.pill.status-silent  { background: var(--warn-soft);   color: var(--warn); }
.pill.status-stale   { background: var(--danger-soft); color: var(--danger); }
.pill.status-unknown { background: rgba(138,148,165,0.15); color: var(--text-dim); }

.sev {
  display: inline-block;
  font-size: 10.5px;
  padding: 2px 7px;
  border-radius: 3px;
  font-weight: 700;
  letter-spacing: 0.04em;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
}
.sev.lg { font-size: 13px; padding: 4px 12px; }
.sev-p1 { background: var(--danger-soft); color: var(--danger); }
.sev-p2 { background: var(--warn-soft);   color: var(--warn); }
.sev-p3 { background: rgba(138,148,165,0.15); color: var(--text-dim); }

/* Category badges — subdued tint of the category color. Used in
 * event lists and event detail to indicate problem domain at a glance.
 */
.cat-pill {
  display: inline-block;
  font-size: 10.5px;
  padding: 2px 8px;
  border-radius: 3px;
  font-weight: 600;
  letter-spacing: 0.04em;
}
.cat-pill.lg { font-size: 12px; padding: 4px 10px; }
.cat-pill.cat-hardware { background: rgba(179,140,240,0.15); color: #c9a9f5; }
.cat-pill.cat-host     { background: var(--brand-soft);      color: #6baae4; }
.cat-pill.cat-cpanel   { background: var(--ok-soft);         color: var(--ok); }
.cat-pill.cat-security { background: var(--gold-soft);       color: var(--gold); }

/* ---- Events table ---- */

.events-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 13px;
}
.events-table th {
  text-align: left;
  font-weight: 600;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-size: 10.5px;
  padding: 10px 12px;
  border-bottom: 1px solid var(--border);
  background: var(--bg-elev-2);
}
.events-table td {
  padding: 10px 12px;
  border-bottom: 1px solid var(--border);
}
.events-table tr:last-child td { border-bottom: 0; }
.events-table tr:hover td { background: var(--bg-row); }
.events-table td.time {
  color: var(--text-dim);
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-size: 12px;
  white-space: nowrap;
}

/* ---- Multi-select column on /events.
 * Compact checkbox column on the left of the events-table when the
 * `--selectable` modifier is present. Sized just wide enough to hold
 * the checkbox; vertical-align centers it against the row's text. */
.events-table--selectable th.events-bulk-col,
.events-table--selectable td.events-bulk-col {
  width: 28px;
  padding-left: 12px;
  padding-right: 0;
  vertical-align: middle;
}
.events-table--selectable .events-bulk-row-cb,
.events-table--selectable #events-bulk-select-all {
  cursor: pointer;
  margin: 0;
}

/* ---- Sticky bulk-action bar at the bottom of /events.
 * Hidden via the [hidden] attribute by default; the JS removes it (and
 * adds .is-active) when the operator selects 1+ rows. Sits above page
 * content with a subtle elevation shadow + the same panel background
 * so it reads as connected to the table above. */
.events-bulk-bar {
  position: sticky;
  bottom: 0;
  z-index: 12;
  display: flex;
  align-items: center;
  gap: 16px;
  padding: 10px 16px;
  margin-top: 14px;
  background: var(--bg-elev-2);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  box-shadow: 0 -4px 12px rgba(0,0,0,0.25);
}
.events-bulk-bar[hidden] { display: none; }
.events-bulk-count {
  font-size: 12px;
  color: var(--text-dim);
  letter-spacing: 0.04em;
}
.events-bulk-count b {
  color: var(--text);
  font-weight: 700;
  font-variant-numeric: tabular-nums;
  margin-right: 2px;
}
.events-bulk-actions {
  display: flex;
  gap: 8px;
  margin-left: auto;
}
.events-bulk-actions .btn-link {
  background: transparent;
  border: none;
  color: var(--text-dim);
  text-decoration: underline;
  cursor: pointer;
  padding: 6px 10px;
  font-size: 12px;
}
.events-bulk-actions .btn-link:hover { color: var(--text); }

/* ---- Filter form ---- */

.filter-form {
  display: flex;
  gap: 14px;
  align-items: flex-end;
  flex-wrap: wrap;
}
.filter-form label {
  display: flex;
  flex-direction: column;
  gap: 5px;
  font-size: 10.5px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
  min-width: 160px;
}
.filter-form label.grow {
  flex: 1;
  min-width: 220px;
}
.filter-form input[type="text"],
.filter-form select {
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 8px 12px;
  font: inherit;
  font-size: 13px;
  text-transform: none;
  letter-spacing: 0;
}
.filter-form input:focus, .filter-form select:focus {
  outline: 2px solid var(--brand);
  outline-offset: -2px;
  border-color: var(--brand);
}
.filter-actions {
  display: flex;
  gap: 12px;
  align-items: center;
}
.filter-form button {
  background: var(--brand);
  color: white;
  border: 0;
  border-radius: var(--radius-sm);
  padding: 9px 18px;
  font: inherit;
  font-size: 13px;
  font-weight: 600;
  cursor: pointer;
  transition: background 0.12s;
}
.filter-form button:hover { background: var(--accent-hi); }
.filter-form .reset {
  color: var(--text-dim);
  font-size: 13px;
}
.filter-form .reset:hover { color: var(--text); }

.filter-form label.checkbox {
  flex-direction: row;
  align-items: center;
  gap: 8px;
  min-width: 0;
  text-transform: none;
  letter-spacing: 0;
  font-size: 13px;
  color: var(--text);
  font-weight: 400;
  margin-bottom: 2px;
  cursor: pointer;
}
.filter-form label.checkbox input {
  margin: 0;
  accent-color: var(--brand);
  cursor: pointer;
}

/* ---- Pagination ---- */

.pagination {
  display: flex;
  justify-content: space-between;
  align-items: center;
  margin-top: 18px;
  padding-top: 14px;
  border-top: 1px solid var(--border);
  font-size: 13px;
  color: var(--text-dim);
}
.pagination a { color: var(--accent); }
.pagination .disabled { color: var(--text-mute); cursor: default; }

/* ---- Event detail ---- */

.event-header {
  display: flex;
  align-items: center;
  gap: 18px;
  margin-bottom: 18px;
  padding-bottom: 14px;
  border-bottom: 1px solid var(--border);
}
.event-header h2 {
  margin: 0;
  font-size: 16px;
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
}

.kv-grid {
  display: grid;
  grid-template-columns: 180px 1fr;
  gap: 10px 20px;
  margin: 0;
}
.kv-grid dt {
  color: var(--text-dim);
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
  align-self: start;
  padding-top: 2px;
}
.kv-grid dd {
  margin: 0;
  word-break: break-word;
  color: var(--text);
}

/* Collapsed empty-fields panel on event detail page. Periodic snapshot
 * detectors (csf.status / cxs.status) emit ~14 fields most of which are
 * 0 / [] / "" on a quiet host; partition them behind a <details> so the
 * actually-populated fields stay scannable. */
.empty-fields {
  margin-top: 12px;
  padding-top: 10px;
  border-top: 1px dashed var(--border);
}
.empty-fields > summary {
  cursor: pointer;
  font-size: 12px;
  letter-spacing: 0.04em;
  list-style: revert;
  padding: 4px 0;
}
.empty-fields > summary:hover { color: var(--text); }
.empty-fields[open] > summary { margin-bottom: 10px; }

.actions-list {
  margin: 0;
  padding: 0;
  list-style: none;
}
.actions-list li { margin-bottom: 10px; }
.actions-list li code {
  display: block;
  padding: 10px 14px;
  font-size: 12.5px;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  word-break: break-word;
  white-space: pre-wrap;
}
/* actions_taken — sentinel-did-this records; brand-blue left accent so
   they're visually distinct from operator-follow-up suggested_actions. */
.actions-list--taken li code {
  border-left: 3px solid var(--accent, #3183d7);
  background: rgba(49, 131, 215, 0.05);
}
.panel > h3 .hint {
  font-weight: normal;
  font-size: 0.85em;
  color: var(--muted, #888);
  margin-left: 0.5em;
}

/* ---- Phase 5: tiered paste-ready action rows ----
 *
 * Each suggested_actions entry renders as one .action-row with the
 * command text in <code> and (for shell-command entries) a Copy button
 * on the right. Tier modifier classes drive the left-border color +
 * the button affordance:
 *
 *   --prose       no border, no button (sentence-style guidance)
 *   --safe        gray border (read-only investigation)
 *   --suggested   amber border (mutating but reversible)
 *   --destructive red border + red Copy button (irreversible)
 */
.actions-list--tiered li.action-row {
  display: grid;
  grid-template-columns: 1fr auto;
  align-items: start;
  gap: 10px;
  margin-bottom: 10px;
}
.actions-list--tiered li.action-row > code {
  display: block;
  padding: 10px 14px;
  font-size: 12.5px;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  word-break: break-word;
  white-space: pre-wrap;
}
.action-row--safe        > code { border-left: 3px solid var(--muted, #888); }
.action-row--suggested   > code { border-left: 3px solid #d29922; }
.action-row--destructive > code {
  border-left: 3px solid var(--danger);
  background: rgba(255, 92, 122, 0.04);
}
.action-row--prose > code {
  background: transparent;
  border: none;
  padding: 4px 0;
  font-family: inherit;
  font-size: 13px;
  color: var(--muted, #aaa);
  white-space: normal;
}

/* Compact Copy button shared between safe/suggested/destructive tiers. */
.btn-sm {
  padding: 4px 10px;
  font-size: 12px;
  line-height: 1.2;
  border-radius: var(--radius-sm);
}
/* Layout-only rules for the action Copy button. Safe/suggested tiers
   carry `.btn btn-primary btn-sm` in the markup so they inherit the
   dashboard-wide primary-button look (matches Save / Lookup / Add to
   blocklist etc.). Destructive tier carries `.action-copy-btn--destructive`
   which overrides to the danger palette. */
.action-copy-btn {
  white-space: nowrap;
  align-self: center;
}
.action-copy-btn--destructive {
  background: rgba(255, 92, 122, 0.08);
  color: var(--danger);
  border: 1px solid rgba(255, 92, 122, 0.35);
  cursor: pointer;
  font-family: inherit;
  transition: background 0.12s, border-color 0.12s, color 0.12s;
}
.action-copy-btn--destructive:hover {
  background: rgba(255, 92, 122, 0.18);
}
/* Post-action feedback states win over both the primary palette and
   the destructive override (specificity bumped by stacking the state
   class onto the button class) — the brief 1.2s flash uses an accent
   tint regardless of which tier the button originated from. */
.action-copy-btn.is-copied {
  background: rgba(49, 131, 215, 0.25);
  color: var(--accent-hi);
  border-color: rgba(49, 131, 215, 0.5);
}
.action-copy-btn.is-copy-failed {
  background: var(--danger-soft);
  color: var(--danger);
  border-color: rgba(255, 92, 122, 0.5);
}

/* ---- Related events cross-link (event_detail.html) ----
 *
 * Renders below .event-actions on the event detail page when the
 * event has a paired malware/hunter event for the same user on the
 * same host (within +/- 60 min). Compact one-line list — operator
 * scans, clicks through, doesn't need to hunt across /events. */
.related-events {
  margin-top: 12px;
  padding: 10px 14px;
  background: rgba(49, 131, 215, 0.04);
  border: 1px solid var(--border);
  border-left: 3px solid var(--accent);
  border-radius: var(--radius-sm);
  display: flex;
  align-items: baseline;
  gap: 12px;
  flex-wrap: wrap;
}
.related-events__label {
  font-size: 12.5px;
  white-space: nowrap;
}
.related-events__list {
  list-style: none;
  margin: 0;
  padding: 0;
  display: flex;
  flex-wrap: wrap;
  gap: 6px 14px;
}
.related-events__list li { margin: 0; }
.related-events__list a {
  display: inline-flex;
  align-items: center;
  gap: 8px;
  text-decoration: none;
  font-size: 13px;
}
.related-events__list a:hover { text-decoration: underline; }

/* v0.17.6: "Hunter ran clean" indicator on imunify_malware events that
   carry context.hunter_run_id but have no findings event in Mongo.
   Green accent so the operator parses "this is good news" at a glance,
   without needing to read the prose. */
.related-events--clean {
  border-left-color: var(--ok, #2da44e);
  background: rgba(45, 164, 78, 0.06);
}
.related-events--clean .related-events__label {
  color: var(--ok, #2da44e);
  font-weight: 600;
}
/* "Hunter scan in progress" — neutral amber accent (still working,
   no result yet). Operator should refresh in a few minutes. */
.related-events--in-progress {
  border-left-color: #d29922;
  background: rgba(210, 153, 34, 0.06);
}
.related-events--in-progress .related-events__label {
  color: #d29922;
  font-weight: 600;
}

/* ---- Phase 5 piece #2: Analyze-with-Claude panel ----
 *
 * Rendered below the event header's action row on event_detail.html.
 * Hidden until the operator clicks the Analyze button; populated by
 * /static/analyze.js with Markdown-rendered output from the Claude API.
 */
.analyze-panel {
  margin-top: 18px;
  padding: 16px 18px;
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-left: 3px solid var(--accent);
  border-radius: var(--radius-sm);
}
.analyze-panel[hidden] { display: none; }
.analyze-panel__head {
  display: flex;
  align-items: baseline;
  justify-content: space-between;
  gap: 12px;
  margin-bottom: 10px;
}
.analyze-panel__head h3 {
  margin: 0;
  font-size: 15px;
  color: var(--accent-hi);
}
.analyze-status { font-size: 12px; }
.analyze-status.is-error { color: var(--danger); }
.analyze-content {
  font-size: 14px;
  line-height: 1.55;
}
.analyze-content p { margin: 0 0 10px 0; }
.analyze-content h4,
.analyze-content h5,
.analyze-content h6 {
  margin: 14px 0 6px 0;
  font-size: 13.5px;
  color: var(--accent-hi);
}
.analyze-content code {
  padding: 1px 5px;
  font-size: 12.5px;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 3px;
}
.analyze-content strong { color: var(--text); }
.analyze-list {
  margin: 4px 0 14px 0;
  padding-left: 24px;
}
ol.analyze-list { padding-left: 28px; }
.analyze-list li { margin-bottom: 8px; line-height: 1.5; }
.analyze-list li:last-child { margin-bottom: 0; }
.analyze-destructive {
  color: var(--danger);
  font-weight: 600;
  letter-spacing: 0.02em;
}
.analyze-error {
  margin: 0;
  padding: 10px 12px;
  background: var(--danger-soft);
  color: var(--danger);
  border: 1px solid rgba(255, 92, 122, 0.4);
  border-radius: var(--radius-sm);
  font-size: 12.5px;
  white-space: pre-wrap;
  word-break: break-word;
}

/* Phase 5c-B — Claude-proposed IOC cards. Rendered after the analysis
   markdown when Claude's response includes one or more ```ioc-proposal
   fenced blocks. Each card displays the kind + value + label + note
   and an "Add to IOC list" button that POSTs to /api/config/iocs/
   propose. */
.ioc-proposals {
  margin-top: 1.2em;
  padding-top: 1em;
  border-top: 1px dashed var(--border-lt);
}
.ioc-proposals-title {
  margin: 0 0 0.6em 0;
  font-size: 12px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--text-dim);
  font-weight: 600;
}
.ioc-proposal-card {
  padding: 10px 12px;
  margin-bottom: 8px;
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-left: 3px solid var(--accent);
  border-radius: var(--radius-sm);
}
.ioc-proposal-card:last-child { margin-bottom: 0; }
.ioc-proposal-head {
  display: flex;
  gap: 10px;
  align-items: center;
  flex-wrap: wrap;
  margin-bottom: 6px;
}
.ioc-proposal-kind {
  display: inline-block;
  padding: 2px 7px;
  background: var(--bg);
  color: var(--accent-hi);
  border: 1px solid rgba(49, 131, 215, 0.35);
  border-radius: 3px;
  font-size: 11px;
  font-family: Consolas, ui-monospace, monospace;
}
.ioc-proposal-value {
  flex: 1 1 auto;
  font-family: Consolas, ui-monospace, monospace;
  font-size: 13px;
  color: var(--text);
  word-break: break-all;
}
.ioc-proposal-label {
  font-size: 12.5px;
  color: var(--text);
  margin-bottom: 4px;
}
.ioc-proposal-note {
  font-size: 12px;
  color: var(--text-dim);
  font-style: italic;
  line-height: 1.45;
}
.ioc-proposal-actions {
  margin-top: 8px;
}
.ioc-proposal-actions .btn { font-size: 12px; padding: 5px 11px; }
.ioc-proposal-actions .btn.is-success {
  background: rgba(56, 161, 105, 0.15);
  color: rgb(120, 209, 145);
  border-color: rgba(56, 161, 105, 0.35);
}
.ioc-proposal-actions .btn.is-error {
  background: var(--danger-soft);
  color: var(--danger);
  border-color: rgba(255, 92, 122, 0.4);
}
.ioc-proposal-error {
  margin-top: 6px;
  font-size: 11.5px;
  color: var(--danger);
}
.analyze-meta {
  margin-top: 12px;
  font-size: 11.5px;
  letter-spacing: 0.02em;
}

/* ---- Destructive-tier confirm modal ----
 *
 * Single-instance #action-copy-confirm raised by action-copy.js when an
 * operator clicks a .action-copy-btn--destructive. Visibility is driven
 * by the `hidden` attribute (toggled by JS). body.action-copy-modal-open
 * locks scroll while open. */
.action-copy-modal {
  position: fixed;
  inset: 0;
  z-index: 1000;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 16px;
}
.action-copy-modal[hidden] { display: none; }
body.action-copy-modal-open { overflow: hidden; }
.action-copy-modal__backdrop {
  position: absolute;
  inset: 0;
  background: rgba(0, 0, 0, 0.55);
  backdrop-filter: blur(2px);
}
.action-copy-modal__panel {
  position: relative;
  z-index: 1;
  width: min(560px, 100%);
  background: var(--bg-elev);
  border: 1px solid var(--border-lt);
  border-radius: var(--radius-sm);
  padding: 22px 24px;
  box-shadow: 0 14px 40px rgba(0, 0, 0, 0.5);
}
.action-copy-modal__panel h3 {
  margin-top: 0;
  margin-bottom: 10px;
  font-size: 16px;
  color: var(--danger);
}
.action-copy-modal__panel p { margin: 8px 0; font-size: 13.5px; }
.action-copy-modal__preview {
  background: var(--bg);
  border: 1px solid var(--border);
  border-left: 3px solid var(--danger);
  border-radius: var(--radius-sm);
  padding: 10px 12px;
  font-size: 12.5px;
  white-space: pre-wrap;
  word-break: break-word;
  max-height: 160px;
  overflow: auto;
  margin: 12px 0;
}
.action-copy-modal__input {
  width: 100%;
  padding: 8px 10px;
  font-family: inherit;
  font-size: 14px;
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border-lt);
  border-radius: var(--radius-sm);
  margin-bottom: 14px;
}
.action-copy-modal__input:focus {
  outline: 2px solid var(--brand-soft);
  border-color: var(--accent);
}
.action-copy-modal__buttons {
  display: flex;
  justify-content: flex-end;
  gap: 10px;
}

/* ---- Login page ---- */

.login-shell {
  min-height: 100vh;
  display: grid;
  place-items: center;
  padding: 24px;
  /* No local background — the body's radial-gradient pseudo-elements +
   * particle canvas paint the auth page's atmosphere. An opaque bg here
   * draws a visible seam against the body's ambient glow wherever the
   * shell's box ends, which looks like a spurious rectangle. */
}

/* Auth pages don't want main's 1440px column + padding — the login-shell
 * owns the whole viewport. :has() is supported in every evergreen browser
 * we care about; no template changes needed. */
body:has(.login-shell) main {
  max-width: none;
  padding: 0;
}

/* Honeypot field — visually removed but still present in the DOM so bots
 * that indiscriminately fill every <input> trip the BFD penalty. Uses
 * multiple belt-and-suspenders techniques: absolute-positioned off-screen,
 * zero dimensions, no pointer events, taken out of the tab order. */
.login-card .honeypot {
  position: absolute !important;
  left: -10000px !important;
  top: auto !important;
  width: 1px !important;
  height: 1px !important;
  overflow: hidden !important;
  opacity: 0 !important;
  pointer-events: none !important;
}
.login-card {
  width: 100%;
  max-width: 380px;
  background: var(--bg-elev);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 32px;
  box-shadow: var(--shadow);
  position: relative;
  overflow: hidden;
}
.login-card::before {
  content: "";
  position: absolute;
  top: 0;
  left: 0;
  right: 0;
  height: 2px;
  background: linear-gradient(90deg, var(--brand-deep) 0%, var(--brand) 50%, var(--gold) 100%);
}
.login-card .login-brand {
  font-size: 11px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.12em;
  margin-bottom: 4px;
}
.login-card h1 {
  margin: 0 0 4px;
  font-size: 22px;
  font-weight: 600;
  letter-spacing: 0.02em;
}
.login-card h1 .brand-mark { color: var(--brand); }
.login-card .sub {
  color: var(--text-dim);
  margin: 0 0 24px;
  font-size: 13px;
}
.login-card form {
  display: flex;
  flex-direction: column;
  gap: 14px;
}
.login-card label {
  display: flex;
  flex-direction: column;
  gap: 6px;
  font-size: 11px;
  color: var(--text-dim);
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
}
.login-card input[type="email"],
.login-card input[type="password"] {
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 10px 12px;
  font: inherit;
  font-size: 14px;
  text-transform: none;
  letter-spacing: 0;
}
.login-card input:focus {
  outline: 2px solid var(--brand);
  outline-offset: -2px;
  border-color: var(--brand);
}
.login-card button {
  margin-top: 8px;
  background: var(--brand);
  color: white;
  border: 0;
  border-radius: var(--radius-sm);
  padding: 11px;
  font: inherit;
  font-weight: 600;
  font-size: 14px;
  cursor: pointer;
  transition: background 0.12s;
}
.login-card button:hover { background: var(--accent-hi); }

.error {
  background: var(--danger-soft);
  border: 1px solid rgba(255, 92, 122, 0.35);
  color: var(--danger);
  border-radius: var(--radius-sm);
  padding: 10px 12px;
  margin-bottom: 16px;
  font-size: 13px;
}

/* ============================================
 * v0.15.5 mobile content layout
 * ============================================
 * Below 700px the desktop component rules truncate hostnames to one
 * letter ("backup" -> "b"), squeeze tile labels into "LO..." ellipses,
 * push subnet cards past the viewport edge, and clip REASON columns
 * off-screen. Fixes below; desktop (>=700px) unchanged.
 *
 * **CRITICAL — must stay at end of file.** Earlier this block lived
 * at line ~280 (immediately after the header media queries). That
 * placement is wrong: the desktop component rules (.host-name at
 * 2391, .host-tile-label at 2454, .events-table at 2973) sit LATER
 * in source, so on equal specificity they win the cascade regardless
 * of media-query state. Result: v0.15.3 shipped with rules that
 * never actually took effect. Confirmed empirically on 2026-05-24
 * via iPhone 13 mini — host card still showed "bac..." with ellipsis
 * after deploy. End-of-file placement guarantees the media-query
 * rules win on source order without needing !important or specificity-
 * inflation tricks. */
@media (max-width: 700px) {
  /* Tighter outer padding so content has more horizontal room.
   * Original main=28px + panel=24px = 104px lost on a 375pt viewport.
   * Compressed to main=10px + panel=12px = 44px = 60px more content. */
  main  { padding: 16px 10px 32px; }
  .panel { padding: 14px 12px; }

  /* ---- Host cards ---- */
  /* Stack the events rail BELOW the dashboard instead of beside it
   * (the desktop grid was 1fr + 260-320px which crushes the dashboard
   * to ~50px at phone widths). */
  .host-body {
    grid-template-columns: 1fr;
    padding: 10px 12px 12px;
    gap: 10px;
  }
  /* Inner tile grid: 2 cols instead of 4. */
  .host-dashboard {
    grid-template-columns: repeat(2, minmax(0, 1fr));
    gap: 6px;
  }
  /* Disk + sparkline span both columns at 2-col width. The desktop
   * placement uses explicit grid-row/grid-column to put them in row 2,
   * cols 1 and 2-3. At 2 cols we want them to flow naturally in the
   * source order, so reset the grid-row/column constraints. */
  .host-tile--disk  { grid-column: 1 / -1; grid-row: auto; }
  .host-tile--spark { grid-column: 1 / -1; grid-row: auto; }

  /* Drop nowrap-ellipsis everywhere inside the card. With more columns
   * cramped into less width, ellipsis hits at the FIRST letter ("b" for
   * "backup"). Wrapping is friendlier than truncation when there's room
   * for at most one line. */
  .host-name {
    white-space: normal;
    overflow: visible;
    text-overflow: clip;
    overflow-wrap: anywhere;
    font-size: 17px;
  }
  .host-tile-label,
  .host-tile-value {
    white-space: normal;
    overflow: visible;
    text-overflow: clip;
    line-height: 1.25;
  }
  .host-tile {
    padding: 6px 8px;
  }

  /* Card header: name on top, pills wrap below if needed. */
  .host-top {
    padding: 10px 12px 0;
    gap: 8px;
    flex-wrap: wrap;
  }
  .host-top-right { flex-wrap: wrap; gap: 4px; }

  /* ---- /ips subnet coverage cards ---- */
  /* Drop from minmax(320px, 1fr) to a single column so the cards never
   * exceed viewport width regardless of panel padding. */
  .subnet-grid {
    grid-template-columns: 1fr;
    gap: 10px;
  }
  .subnet-card {
    padding: 10px 12px;
  }
  /* Allow CIDR head to wrap if needed (long-ish CIDR + "512 addresses"
   * spread is fine to stack on narrow widths). */
  .subnet-head {
    flex-wrap: wrap;
    gap: 4px 12px;
  }

  /* ---- Tables (/events, /blocklist, history details, /ips registry) ---- */
  /* v0.15.5: switched from `overflow-wrap: anywhere` to a horizontal-
   * scroll strategy. v0.15.4 used per-cell anywhere-wrap which is
   * fine for 2-3 column tables but pathological for 7-8 column tables
   * (csf.deny Active Entries: 7 cols, ip-registry: 8 cols): each
   * column gets ~30px on a 375pt viewport, `anywhere` then breaks
   * EVERY character of the header text onto its own line — "CLASSIFICATION"
   * became 14 vertically-stacked single letters. Observed on
   * /blocklist + /ips 2026-05-24.
   *
   * New strategy: turn the table into a block-level element with its
   * own horizontal scroll, and let cells claim their natural width
   * (nowrap). The table itself scrolls inside its panel; nothing
   * else on the page is affected. thead/tbody flip back to
   * `display: table` so column alignment is preserved across rows.
   * `width: max-content` lets the table grow as wide as its widest
   * row needs, `min-width: 100%` keeps it filling its container when
   * the contents would otherwise be narrow. */
  .events-table {
    display: block;
    overflow-x: auto;
    -webkit-overflow-scrolling: touch;
    font-size: 12px;
  }
  .events-table thead,
  .events-table tbody {
    display: table;
    width: max-content;
    min-width: 100%;
  }
  .events-table tr { display: table-row; }
  .events-table th,
  .events-table td {
    padding: 8px 10px;
    white-space: nowrap;
  }
  /* Reason / message columns benefit from wrapping at word boundaries
   * (the strings are long but composed of words). Cells we know
   * contain text-heavy values can opt out of nowrap via the explicit
   * `.wrap` class — left as a future template tweak; the default
   * nowrap is safer than `anywhere` because it never produces
   * vertically-stacked single letters. */
  .events-table td.time { font-size: 11px; }

  /* ---- /config toggle grid ---- */
  /* The grid is too wide to fit on mobile (~12 columns of switches);
   * .toggle-grid-wrap already has overflow-x:auto. The UX hole is that
   * scrolling right hides the host-name column, so operators lose track
   * of which row's switch they're flipping. Pin the host column to the
   * left edge so it stays visible during horizontal scroll. */
  .toggle-grid td.toggle-host-name,
  .toggle-grid th.toggle-host-col {
    position: sticky;
    left: 0;
    background: var(--bg-elev);
    z-index: 2;
    /* Subtle right-edge shadow signals "this is pinned; content
     * underneath is scrolling beneath it" (instead of the column
     * looking flat against scrolled-away content). */
    box-shadow: 4px 0 6px -4px rgba(0,0,0,0.5);
  }
  .toggle-grid tbody tr:hover td.toggle-host-name {
    background: var(--bg-row);
  }
  /* Swipe-affordance hint above the grid so operators discover the
   * scroll instead of assuming the missing columns aren't there. */
  .toggle-grid-wrap::before {
    content: "← swipe horizontally to see all detectors →";
    display: block;
    text-align: center;
    color: var(--text-mute);
    font-size: 10.5px;
    letter-spacing: 0.04em;
    padding: 0 0 8px;
  }

  /* ---- v0.15.6: dashboard .attackers-table + .csf-per-host-table ----
   * Two separate table classes on /dashboard not styled as .events-table
   * (separate visual treatment for the top-attackers rollup + per-host
   * CSF metrics rollup). The block-scroll treatment from .events-table
   * applies cleanly here too — same many-column-on-narrow-viewport
   * shape. Replicated rather than added to .events-table's selector so
   * the per-table visual styling (paddings, borders, hover) keeps its
   * existing desktop look on >=700px viewports. */
  .attackers-table,
  .csf-per-host-table {
    display: block;
    overflow-x: auto;
    -webkit-overflow-scrolling: touch;
  }
  .attackers-table thead,
  .attackers-table tbody,
  .csf-per-host-table thead,
  .csf-per-host-table tbody {
    display: table;
    width: max-content;
    min-width: 100%;
  }
  .attackers-table tr,
  .csf-per-host-table tr { display: table-row; }
  .attackers-table th,
  .attackers-table td,
  .csf-per-host-table th,
  .csf-per-host-table td {
    white-space: nowrap;
  }

  /* ---- v0.15.6: /config runtime-knob form rows ----
   * Desktop layout is a 3-col grid: meta (label + desc) | input | save
   * button, with the input column claiming a 220px minimum. On a 375pt
   * viewport the 220px min forces the save button off-screen. Stack
   * the three cells vertically on mobile so the operator sees the
   * label first, then the input full-width, then the save button.
   * `align-items: stretch` (the grid default for column children) plus
   * 1fr width makes inputs span the full row naturally. */
  .knob-row {
    grid-template-columns: 1fr;
    gap: 0.5em;
  }
  .knob-actions {
    /* Save button typically right-aligned on desktop; left-align on
     * mobile so it sits flush with the input above it (avoids a
     * lonely button floating to the right edge of the stack). */
    justify-self: start;
  }

  /* ---- Misc cleanups ---- */
  .kpi-row { gap: 10px; }
  .kpi-tile { padding: 12px 14px; }

  /* Phase 5 paste-ready action rows: at <700px the two-column
   * grid crowds the Copy button against the right edge. Stack
   * the button under the command instead. */
  .actions-list--tiered li.action-row {
    grid-template-columns: 1fr;
  }
  .actions-list--tiered .action-copy-btn {
    justify-self: end;
  }
  .action-copy-modal__panel {
    padding: 18px 16px;
  }
}

/* ---- bandwidth.egress_high per-service breakdown (agent v0.11.84+) ----
 * Stacked horizontal bar + table. Each segment's width is set inline from
 * the row's share_pct. Color per service is matched between the bar
 * segment and the swatch in the adjacent table row so the operator can
 * eye-trace which segment belongs to which row.
 */
.bw-breakdown-bar {
  display: flex;
  width: 100%;
  height: 14px;
  border-radius: 4px;
  overflow: hidden;
  background: var(--bg-row);
}
.bw-breakdown-bar__seg {
  display: block;
  height: 100%;
}
.bw-breakdown-swatch {
  display: inline-block;
  width: 10px;
  height: 10px;
  border-radius: 2px;
  margin-right: 6px;
  vertical-align: middle;
}
/* Color mapping. web=blue (accent), email=green (ok),
 * unattributed=orange (warn) to draw the eye to the bucket that needs
 * follow-up investigation when it dominates. */
.bw-breakdown-bar__seg--web,
.bw-breakdown-swatch--web {
  background: var(--accent);
}
.bw-breakdown-bar__seg--email_imap_pop,
.bw-breakdown-swatch--email_imap_pop {
  background: var(--ok);
}
.bw-breakdown-bar__seg--email_smtp,
.bw-breakdown-swatch--email_smtp {
  background: #2faa5a;
}
.bw-breakdown-bar__seg--ftp,
.bw-breakdown-swatch--ftp {
  background: #9c5ad8;
}
.bw-breakdown-bar__seg--unattributed,
.bw-breakdown-swatch--unattributed {
  background: var(--warn);
}

/* ---- Malware Finding panel (backend v0.19.4+) ----
 * Unified rendering for imunify_malware.detected /
 * imunify_malware.cluster / maldet_watch.detected /
 * ultra_exploit_hunter.findings events. Worker stamps the glossary_*
 * fields at ingest time; the route builds a normalized
 * `malware_finding` dict; this stylesheet handles the visual layer.
 *
 * Design intent: red badge as the eye-anchor (confirmed malware =
 * danger color), monospace signature beside it for grep-ability,
 * description as plain text below for context, learn-more link as
 * the secondary call-to-action. The kv-grid carries the per-event
 * specifics (file path, hash, account, disposition).
 */
/* v0.19.8 — no panel-wide colored border. The v0.19.4 attempt had a
 * hardcoded red `border-left` regardless of category, which clashed
 * visually with the blue hunter-findings badge (red border + blue
 * badge = contradictory). Operator-reported on 2026-05-31. The
 * category color now lives ONLY on the badge next to the signature,
 * which is more focused and avoids the dissonance. */
.panel.malware-finding > h3 {
  margin-bottom: 10px;
}
.malware-finding__head {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 10px;
  margin-bottom: 6px;
}
.malware-finding__badge {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  padding: 4px 10px;
  border-radius: 3px;
  background: var(--danger-soft);
  color: var(--danger);
  font-size: 0.85em;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.04em;
  border: 1px solid rgba(255, 92, 122, 0.3);
}
.malware-finding__badge-dot {
  display: inline-block;
  width: 9px;
  height: 9px;
  border-radius: 2px;
  background: var(--danger);
  flex-shrink: 0;
}
/* Category-specific badge accent — keeps the red dominant for all
 * malware categories (these are all confirmed bad), but tweaks the
 * sub-accent so operators can distinguish at-a-glance between
 * categories when reviewing /events lists later. */
.malware-finding__badge--persistence,
.malware-finding__badge--obfuscation {
  /* Slight purple shift to suggest "secondary infection layer" rather
   * than primary malware. The red base color stays dominant. */
  background: rgba(174, 92, 255, 0.18);
  border-color: rgba(174, 92, 255, 0.35);
  color: #c294ff;
}
.malware-finding__badge--persistence .malware-finding__badge-dot,
.malware-finding__badge--obfuscation .malware-finding__badge-dot {
  background: #ae5cff;
}
.malware-finding__badge--htaccess-backdoor {
  /* Slight amber for config-layer findings — still red-family but
   * differentiated from straight webshells. */
  background: rgba(247, 163, 0, 0.18);
  border-color: rgba(247, 163, 0, 0.35);
  color: var(--warn);
}
.malware-finding__badge--htaccess-backdoor .malware-finding__badge-dot {
  background: var(--warn);
}
.malware-finding__badge--unclassified {
  /* Muted grey for unknown families — the panel still renders so the
   * operator sees the path + disposition, but the badge tone reflects
   * "we don't have a definitive label." */
  background: rgba(138, 148, 165, 0.18);
  border-color: rgba(138, 148, 165, 0.35);
  color: var(--text-dim);
}
.malware-finding__badge--unclassified .malware-finding__badge-dot {
  background: var(--text-dim);
}
.malware-finding__badge--hunter-findings {
  /* Blue accent for hunter rollups — distinct from the red/amber/purple
   * spread used for per-finding malware categories. Hunter findings are
   * scan summaries, not single-malware findings, so the visual tone
   * communicates "investigative result" rather than "active threat." */
  background: rgba(49, 131, 215, 0.18);
  border-color: rgba(49, 131, 215, 0.35);
  color: var(--accent);
}
.malware-finding__badge--hunter-findings .malware-finding__badge-dot {
  background: var(--accent);
}
.malware-finding__signature {
  font-size: 0.92em;
  color: var(--text);
  background: var(--bg-row);
  padding: 3px 8px;
  border-radius: 3px;
  word-break: break-all;
}
.malware-finding__cluster {
  font-size: 0.85em;
  color: var(--text-dim);
}
.malware-finding__label {
  margin: 2px 0 4px 0;
  font-size: 0.95em;
  color: var(--text);
  font-weight: 500;
}
.malware-finding__desc {
  margin: 4px 0 8px 0;
  color: var(--text-dim);
  font-size: 0.92em;
  line-height: 1.5;
  /* v0.19.9 — no max-width cap. The v0.19.4/v0.19.7 80ch cap left
   * ~half the panel as empty right-side whitespace on wide screens,
   * which operator-reported as "text bunched to the left." The
   * panel already has explicit padding (20px 24px) so the prose
   * never reaches the literal panel edge. */
}
.malware-finding__kv {
  display: grid;
  /* Fixed-width first column matches the dashboard's existing
   * .kv-grid convention so labels have consistent width across
   * panels and long file paths don't squeeze the label column.
   * Single label-value pair per row — multi-pair-per-row layouts
   * break on long-content rows like the disposition pill or
   * findings file path. */
  grid-template-columns: 180px 1fr;
  gap: 10px 20px;
  margin: 8px 0 0 0;
}
.malware-finding__kv dt {
  color: var(--text-dim);
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  font-weight: 600;
  align-self: start;
  padding-top: 2px;
}
.malware-finding__kv dd {
  margin: 0;
  color: var(--text);
  word-break: break-word;
}
.malware-finding__state {
  display: inline-block;
  padding: 2px 8px;
  border-radius: 3px;
  font-size: 0.85em;
  font-weight: 600;
}
.malware-finding__state--quarantined {
  background: var(--ok-soft);
  color: var(--ok);
}
.malware-finding__state--cleaned {
  background: var(--ok-soft);
  color: var(--ok);
}
.malware-finding__state--pending {
  background: var(--warn-soft);
  color: var(--warn);
}
.malware-finding__state--imunify_detected {
  /* Detected-but-cleanup-pending state. Amber tone communicates "this
   * needs scanner follow-through" without the alarm of cleanup_failed.
   * On the fleet where Imunify runs in cleanup mode, this state lasts
   * only minutes between detection and cleanup_done. */
  background: var(--warn-soft);
  color: var(--warn);
}
.malware-finding__state--cleanup_failed {
  background: var(--danger-soft);
  color: var(--danger);
}
.malware-finding__state--unknown {
  background: var(--bg-row);
  color: var(--text-dim);
}
.malware-finding__state--hunter_per_ioc {
  /* Hunter rollup events: blue tone matching the hunter-findings
   * badge accent. Communicates "this is an investigative artifact"
   * not "active threat needs cleanup." */
  background: rgba(49, 131, 215, 0.18);
  color: var(--accent);
}
.malware-finding__refs {
  margin: 10px 0 0 0;
  font-size: 0.9em;
}
.malware-finding__ref-link {
  color: var(--accent);
  text-decoration: none;
  border-bottom: 1px dotted var(--accent);
}
.malware-finding__ref-link:hover {
  color: var(--accent-hi);
  border-bottom-color: var(--accent-hi);
}

@media (max-width: 700px) {
  .malware-finding__head {
    flex-direction: column;
    align-items: flex-start;
    gap: 6px;
  }
  .malware-finding__kv {
    grid-template-columns: 1fr;
    gap: 2px 0;
  }
  .malware-finding__kv dt {
    margin-top: 8px;
  }
}