/*
 * Design tokens + layout for the waf-mke admin console
 * (odd/tasks/admin-panel-v2.md, P5a restyled by V1a).
 *
 * Palette: cool neutral grays, one teal accent, and status colours that map
 * 1:1 onto internal/events action kinds so a colour always means the same
 * thing in every view: blocked = red, challenged = amber, logged/would-block
 * = violet, allowed = green.
 *
 * Themes: every colour token is defined EXACTLY ONCE as
 * `light-dark(<light>, <dark>)` in the first block below, so the two themes
 * cannot drift apart and always share the same token names. Which side wins
 * is decided by `color-scheme` only:
 *   - explicit `data-theme="light|dark"` on <html> (js/theme.js) wins;
 *   - with no data-theme, prefers-color-scheme decides;
 *   - default (no preference / before theme.js runs): light.
 * Contrast (WCAG AA 4.5:1) of the text/accent pairs is enforced by
 * uitest/css-tokens.test.mjs, which parses these light-dark() pairs.
 * Keep colour values as plain #hex or rgba() so that test can read them.
 */

:root {
  color-scheme: light;

  --bg: light-dark(#f4f6f8, #0f1316);
  --bg-elevated: light-dark(#ffffff, #171c21);
  --bg-sunken: light-dark(#eceff2, #0b0e11);
  --border: light-dark(#dde2e8, #262d35);
  --text: light-dark(#14181f, #e6eaee);
  --text-muted: light-dark(#4b5563, #a3adb8);
  --text-faint: light-dark(#5f6b7a, #8994a0);

  --accent: light-dark(#0f766e, #2dd4bf);
  --accent-contrast: light-dark(#ffffff, #04211e);
  --accent-soft: light-dark(#e3f4f2, #12302f);
  --accent-grad-a: light-dark(#0f766e, #2dd4bf);
  --accent-grad-b: light-dark(#0b5f59, #14b8a6);

  --status-blocked: light-dark(#b91c1c, #f87171);
  --status-challenged: light-dark(#92400e, #fbbf24);
  --status-logged: light-dark(#6d28d9, #a78bfa);
  --status-allowed: light-dark(#166534, #4ade80);

  --shadow-color: light-dark(rgba(16, 24, 40, 0.10), rgba(0, 0, 0, 0.55));
  --shadow-ambient: light-dark(rgba(16, 24, 40, 0.05), rgba(0, 0, 0, 0.35));
  --focus-ring-color: light-dark(#0f766e, #5eead4);
}

[data-theme="dark"] { color-scheme: dark; }

@media (prefers-color-scheme: dark) {
  :root:not([data-theme]) { color-scheme: dark; }
}

/* Non-colour tokens (same in both themes). */
:root {
  --font-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji";
  --font-mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;

  --radius-sm: 6px;
  --radius-md: 10px;
  --radius-lg: 14px;
  --radius-pill: 999px;

  --space-1: 4px;
  --space-2: 8px;
  --space-3: 12px;
  --space-4: 16px;
  --space-5: 24px;
  --space-6: 32px;
  --space-7: 48px;

  --sidebar-width: 236px;
  --topbar-height: 60px;

  --brand-gradient: linear-gradient(135deg, var(--accent-grad-a), var(--accent-grad-b));

  --shadow-sm: 0 1px 2px var(--shadow-ambient), 0 1px 1px var(--shadow-ambient);
  --shadow-md: 0 1px 2px var(--shadow-ambient), 0 4px 10px var(--shadow-color);
  --shadow-lg: 0 2px 4px var(--shadow-ambient), 0 10px 24px var(--shadow-color), 0 24px 48px var(--shadow-ambient);
  --shadow: var(--shadow-sm);
  --focus-ring: 0 0 0 2px var(--bg-elevated), 0 0 0 4px var(--focus-ring-color);

  --ease: cubic-bezier(0.2, 0, 0, 1);
  --dur: 160ms;
}

* { box-sizing: border-box; }

html, body {
  height: 100%;
}

body {
  margin: 0;
  font-family: var(--font-sans);
  font-size: 14px;
  line-height: 1.5;
  color: var(--text);
  background: var(--bg);
  -webkit-font-smoothing: antialiased;
  scrollbar-color: var(--border) transparent;
}

* { scrollbar-color: var(--border) transparent; }

a { color: var(--accent); }

code, .mono {
  font-family: var(--font-mono);
}

.icon { flex: none; display: inline-block; vertical-align: middle; }

/* --- Shell ------------------------------------------------------------ */

.app {
  display: grid;
  grid-template-columns: var(--sidebar-width) 1fr;
  grid-template-rows: var(--topbar-height) 1fr;
  grid-template-areas:
    "sidebar topbar"
    "sidebar main";
  min-height: 100vh;
}

.sidebar {
  grid-area: sidebar;
  background: var(--bg-elevated);
  border-right: 1px solid var(--border);
  display: flex;
  flex-direction: column;
  padding: var(--space-4) var(--space-3);
  gap: var(--space-2);
}

.sidebar.collapsed {
  display: none;
}

.brand {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  padding: var(--space-2) var(--space-3);
  font-weight: 700;
  font-size: 1.05rem;
  letter-spacing: -0.01em;
  color: var(--text);
}

.brand .dot {
  width: 10px;
  height: 10px;
  border-radius: 50%;
  background: var(--accent);
  flex: none;
}

.brand-mark {
  width: 32px;
  height: 32px;
  border-radius: var(--radius-md);
  background: var(--brand-gradient);
  color: var(--accent-contrast);
  display: inline-flex;
  align-items: center;
  justify-content: center;
  flex: none;
  box-shadow: var(--shadow-sm);
}

.brand-name { display: flex; flex-direction: column; line-height: 1.15; }
.brand-sub { font-size: 0.72rem; font-weight: 500; color: var(--text-faint); }

.nav {
  display: flex;
  flex-direction: column;
  gap: var(--space-1);
  margin-top: var(--space-4);
}

.nav a {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  padding: 10px var(--space-3);
  border-radius: var(--radius-md);
  color: var(--text-muted);
  text-decoration: none;
  font-weight: 500;
  transition: background-color var(--dur) var(--ease), color var(--dur) var(--ease);
}

.nav a:hover {
  background: var(--bg-sunken);
  color: var(--text);
}

.nav a.active {
  background: var(--brand-gradient);
  color: var(--accent-contrast);
  font-weight: 600;
  box-shadow: var(--shadow-md);
}

.nav a.active:hover { background: var(--brand-gradient); color: var(--accent-contrast); }

.sidebar-version {
  margin-top: auto;
  padding: var(--space-2) var(--space-3);
  font-size: 0.75rem;
  overflow-wrap: anywhere;
}

.nav a:focus-visible,
button:focus-visible,
input:focus-visible,
select:focus-visible {
  /* transparent (not none): forced-colors mode repaints it, box-shadow is dropped there */
  outline: 2px solid transparent;
  box-shadow: var(--focus-ring);
}

.topbar {
  grid-area: topbar;
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: var(--space-3);
  padding: 0 var(--space-5);
  border-bottom: 1px solid var(--border);
  background: var(--bg-elevated);
}

.topbar h1 {
  font-size: 1rem;
  font-weight: 600;
  margin: 0;
}

.breadcrumb { display: flex; align-items: center; gap: var(--space-2); min-width: 0; }
.breadcrumb-root { color: var(--text-faint); font-size: 0.9rem; }
.breadcrumb-sep { color: var(--text-faint); }

.topbar-actions {
  display: flex;
  align-items: center;
  gap: var(--space-3);
}

.main {
  grid-area: main;
  padding: var(--space-6);
  overflow-y: auto;
}

.sidebar-toggle {
  display: none;
}

@media (max-width: 900px) {
  .app {
    grid-template-columns: 1fr;
    grid-template-areas:
      "topbar"
      "main";
  }
  /* Starts BELOW the topbar: the hamburger lives in the topbar, so an overlay that covered
     it could never be closed. */
  .sidebar {
    position: fixed;
    inset: var(--topbar-height) 25% 0 0;
    z-index: 20;
    box-shadow: var(--shadow-lg);
    overflow-y: auto;
  }
  .sidebar.collapsed {
    display: none;
  }
  .sidebar:not(.collapsed) {
    display: flex;
  }
  .sidebar-toggle {
    display: inline-flex;
  }
  .main { padding: var(--space-4); }
  .topbar { padding: 0 var(--space-4); }
}

/* Narrow phones: the user chip shrinks with an ellipsis instead of widening the page. */
@media (max-width: 480px) {
  .topbar, .main { min-width: 0; }
  .topbar-actions { min-width: 0; gap: var(--space-2); }
  .user-chip {
    min-width: 0;
    max-width: 8rem;
    overflow: hidden;
    text-overflow: ellipsis;
    white-space: nowrap;
  }
  .topbar-actions button {
    flex-shrink: 0;
    white-space: nowrap;
    min-height: 44px;
  }
}

/* --- Buttons, inputs ---------------------------------------------------- */

button, .btn {
  font: inherit;
  color: var(--text);
  background: var(--bg-elevated);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 7px var(--space-3);
  min-height: 34px;
  cursor: pointer;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  gap: var(--space-2);
  box-shadow: var(--shadow-sm);
  transition: background-color var(--dur) var(--ease), border-color var(--dur) var(--ease), box-shadow var(--dur) var(--ease), transform var(--dur) var(--ease);
}

button:hover { background: var(--bg-sunken); }
button:active, .btn:active { transform: translateY(1px); box-shadow: none; }
button:disabled { opacity: 0.55; cursor: not-allowed; }

.btn-primary {
  background: var(--brand-gradient);
  border-color: transparent;
  color: var(--accent-contrast);
  font-weight: 600;
}

.btn-primary:hover { background: var(--brand-gradient); filter: brightness(1.08); }

.btn-secondary { background: var(--bg-elevated); }

.btn-ghost { background: transparent; border-color: transparent; box-shadow: none; color: var(--text-muted); }
.btn-ghost:hover { background: var(--bg-sunken); color: var(--text); }

.btn-danger {
  background: var(--status-blocked);
  border-color: transparent;
  color: var(--accent-contrast);
  font-weight: 600;
}
.btn-danger:hover { background: var(--status-blocked); filter: brightness(1.08); }

.btn-icon {
  padding: 7px;
  display: inline-flex;
  align-items: center;
  justify-content: center;
}

input, select {
  font: inherit;
  color: var(--text);
  background: var(--bg-elevated);
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  padding: 7px var(--space-3);
  min-height: 34px;
  transition: border-color var(--dur) var(--ease), box-shadow var(--dur) var(--ease);
}

input:hover, select:hover { border-color: var(--text-faint); }
input::placeholder { color: var(--text-faint); }

/* Selects: no native chrome, a chevron drawn with two gradients (no image, no external URL, so the
 * CSP stays untouched). The chevron uses currentColor, so light, dark and forced-colors follow the text. */
select {
  appearance: none;
  cursor: pointer;
  padding-right: 34px;
  background-image:
    linear-gradient(45deg, transparent 50%, currentColor 50%),
    linear-gradient(135deg, currentColor 50%, transparent 50%);
  background-position: calc(100% - 17px) 50%, calc(100% - 12px) 50%;
  background-size: 5px 5px, 5px 5px;
  background-repeat: no-repeat;
}
select:disabled { cursor: not-allowed; opacity: 0.6; }
select option { background: var(--bg-elevated); color: var(--text); }

/* Progressive enhancement: where the browser can style the picker itself (appearance: base-select),
 * the open list gets the same card look. Everywhere else the native list is used, unchanged. */
@supports (appearance: base-select) {
  select, select::picker(select) { appearance: base-select; }
  select { background-image: none; padding-right: var(--space-3); }
  select::picker-icon { color: var(--text-faint); transition: rotate var(--dur) var(--ease); }
  select:open::picker-icon { rotate: 180deg; }
  select::picker(select) {
    background: var(--bg-elevated);
    border: 1px solid var(--border);
    border-radius: var(--radius-sm);
    padding: 4px;
    margin-top: 4px;
    box-shadow: 0 8px 24px color-mix(in srgb, var(--text) 16%, transparent);
  }
  select option { padding: 7px var(--space-3); border-radius: 4px; }
  select option:hover, select option:focus-visible { background: var(--accent-soft); }
  select option:checked { color: var(--accent); font-weight: 600; }
  select option::checkmark { color: var(--accent); }
}

.field {
  display: flex;
  flex-direction: column;
  gap: var(--space-1);
}

.field label {
  font-size: 0.82rem;
  color: var(--text-muted);
  font-weight: 600;
}

.field-error {
  color: var(--status-blocked);
  font-size: 0.82rem;
}

.input-group { display: flex; gap: var(--space-2); align-items: stretch; }
.input-group input { flex: 1; min-width: 0; }

/* --- Cards, tables ------------------------------------------------------ */

.card {
  background: var(--bg-elevated);
  border: 1px solid var(--border);
  border-radius: var(--radius-lg);
  padding: var(--space-5);
  box-shadow: var(--shadow-md);
}

.card-interactive { transition: transform var(--dur) var(--ease), box-shadow var(--dur) var(--ease); cursor: pointer; }
.card-interactive:hover { transform: translateY(-2px); box-shadow: var(--shadow-lg); }

.card-grid {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
  gap: var(--space-5);
}

.kpi-card .kpi-label {
  color: var(--text-muted);
  font-size: 0.82rem;
  font-weight: 600;
  letter-spacing: 0.01em;
}

.kpi-card .kpi-value {
  font-size: 1.85rem;
  font-weight: 700;
  line-height: 1.15;
  margin-top: var(--space-1);
  letter-spacing: -0.02em;
}

table {
  width: 100%;
  border-collapse: collapse;
}

th, td {
  text-align: left;
  padding: 10px var(--space-3);
  border-bottom: 1px solid var(--border);
  font-size: 0.88rem;
}

th {
  color: var(--text-muted);
  font-weight: 600;
  font-size: 0.75rem;
  text-transform: uppercase;
  letter-spacing: 0.04em;
}

.table-scroll th { position: sticky; top: 0; background: var(--bg-elevated); z-index: 1; }
tbody tr:last-child td { border-bottom: none; }

tbody tr { transition: background-color var(--dur) var(--ease); }
tbody tr:hover {
  background: var(--bg-sunken);
}

/* --- Badges (status colors) --------------------------------------------- */

.badge {
  display: inline-flex;
  align-items: center;
  gap: var(--space-1);
  padding: 2px 10px;
  border-radius: var(--radius-pill);
  font-size: 0.78rem;
  font-weight: 600;
}

.badge-blocked {
  color: var(--status-blocked);
  background: color-mix(in srgb, var(--status-blocked) 15%, transparent);
}

.badge-challenged {
  color: var(--status-challenged);
  background: color-mix(in srgb, var(--status-challenged) 15%, transparent);
}

.badge-logged {
  color: var(--status-logged);
  background: color-mix(in srgb, var(--status-logged) 15%, transparent);
}

.badge-allowed {
  color: var(--status-allowed);
  background: color-mix(in srgb, var(--status-allowed) 15%, transparent);
}

.badge-neutral {
  color: var(--text-muted);
  background: var(--bg-sunken);
}

.badge-accent {
  color: var(--accent);
  background: var(--accent-soft);
}

/* --- States: empty / error / skeleton ----------------------------------- */

.empty-state, .error-state {
  text-align: center;
  padding: var(--space-6);
  color: var(--text-muted);
}

.state-icon { display: block; margin: 0 auto var(--space-2); color: var(--text-faint); }

.error-state {
  color: var(--status-blocked);
}

.skeleton {
  background: linear-gradient(90deg, var(--bg-sunken) 25%, var(--border) 37%, var(--bg-sunken) 63%);
  background-size: 400% 100%;
  animation: skeleton-loading 1.4s ease infinite;
  border-radius: var(--radius-md);
  min-height: 1em;
}

@keyframes skeleton-loading {
  0% { background-position: 100% 50%; }
  100% { background-position: 0 50%; }
}

/* --- Toasts -------------------------------------------------------------- */

.toast-region {
  position: fixed;
  right: var(--space-4);
  bottom: var(--space-4);
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
  z-index: 50;
}

.toast {
  min-width: 240px;
  max-width: 360px;
  padding: var(--space-3) var(--space-4);
  border-radius: var(--radius-md);
  box-shadow: var(--shadow-lg);
  background: var(--bg-elevated);
  border: 1px solid var(--border);
  border-left: 4px solid var(--text-muted);
  font-size: 0.88rem;
}

.toast-success { border-left-color: var(--status-allowed); }
.toast-error { border-left-color: var(--status-blocked); }
.toast-info { border-left-color: var(--accent); }

/* --- Login view ----------------------------------------------------------- */

.login-screen {
  min-height: 100vh;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: var(--space-4);
  background: var(--bg);
  background-image: radial-gradient(60% 50% at 50% 0%, var(--accent-soft), transparent);
}

.login-card {
  width: 100%;
  max-width: 400px;
  display: flex;
  flex-direction: column;
  gap: var(--space-4);
  padding: var(--space-6);
  box-shadow: var(--shadow-lg);
}

.login-brand { display: flex; flex-direction: column; align-items: center; gap: var(--space-3); text-align: center; }
.login-brand .brand-mark { width: 48px; height: 48px; border-radius: var(--radius-lg); }
.login-card h1 {
  font-size: 1.3rem;
  margin: 0;
  letter-spacing: -0.01em;
}
.login-card p { margin: 0; }
.login-hint { font-size: 0.82rem; }

.login-card form {
  display: flex;
  flex-direction: column;
  gap: var(--space-4);
}

.login-card .btn-primary { width: 100%; min-height: 40px; }
.login-error:empty { display: none; }

/* --- Utility -------------------------------------------------------------- */

.text-muted { color: var(--text-muted); }
.text-faint { color: var(--text-faint); }
.truncate {
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
  max-width: 320px;
}
.stack { display: flex; flex-direction: column; gap: var(--space-3); }
.row { display: flex; align-items: center; gap: var(--space-2); }
.row-between { display: flex; align-items: center; justify-content: space-between; }

/* --- Security dashboard (P5b) --------------------------------------------- */
/* Sizing is done with SVG attributes; colors come from these classes over
   the --status-* variables (the CSP forbids inline style attributes). */

.visually-hidden {
  position: absolute;
  width: 1px;
  height: 1px;
  margin: -1px;
  padding: 0;
  overflow: hidden;
  clip: rect(0 0 0 0);
  white-space: nowrap;
  border: 0;
}
.sr-label { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
[hidden] { display: none !important; }
.nowrap { white-space: nowrap; }
.table-scroll { overflow-x: auto; }

.dashboard h2 { margin: 0; font-size: 1.15rem; }
.dashboard h3 { margin: 0 0 var(--space-3); font-size: 0.9rem; font-weight: 600; }
.dash-controls { flex-wrap: wrap; gap: var(--space-3); }
.dash-controls .row { flex-wrap: wrap; }
.dash-body.is-loading { opacity: 0.6; transition: opacity 0.15s; }
.updated { font-size: 0.8rem; }
.stale-marker {
  color: var(--status-challenged);
  background: color-mix(in srgb, var(--status-challenged) 14%, transparent);
  border-radius: 999px;
  padding: 2px var(--space-3);
  font-size: 0.8rem;
  font-weight: 600;
}

.kpi-grid { grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: var(--space-5); align-items: stretch; }
.kpi-group { display: flex; flex-direction: column; gap: var(--space-4); }
.kpi-group-title { margin: 0; font-size: 0.8rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.06em; color: var(--text-muted); }
.kpi-tiles { display: grid; grid-template-columns: repeat(auto-fit, minmax(120px, 1fr)); gap: var(--space-5); }
/* Tiles inside a group are plain (the group is the card); a standalone
   .kpi-card keeps working as a card. */
.kpi-tile { display: flex; align-items: flex-start; gap: var(--space-3); min-width: 0; }
.kpi-tile .kpi-body { min-width: 0; }
.kpi-icon { width: 36px; height: 36px; border-radius: var(--radius-md); display: inline-flex; align-items: center; justify-content: center; flex: none; color: var(--accent); background: var(--accent-soft); }
.kpi-icon.kpi-blocked { color: var(--status-blocked); background: color-mix(in srgb, var(--status-blocked) 14%, transparent); }
.kpi-icon.kpi-challenged { color: var(--status-challenged); background: color-mix(in srgb, var(--status-challenged) 14%, transparent); }
.kpi-icon.kpi-logged { color: var(--status-logged); background: color-mix(in srgb, var(--status-logged) 14%, transparent); }
.kpi-card .kpi-value, .kpi-tile .kpi-value { font-variant-numeric: tabular-nums; }
.kpi-tile .kpi-label { color: var(--text-muted); font-size: 0.82rem; font-weight: 600; }
.kpi-tile .kpi-value { font-size: 1.85rem; font-weight: 700; line-height: 1.15; letter-spacing: -0.02em; }
.kpi-sub { font-size: 0.75rem; margin-top: 2px; }
.kpi-note { font-size: 0.75rem; margin: var(--space-3) 0 0; }
.kpi-skel { height: 132px; }
.chart-skel { height: 220px; }

.grid-2-1 { display: grid; grid-template-columns: minmax(0, 2fr) minmax(0, 1fr); gap: var(--space-4); }
.top-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(280px, 1fr)); gap: var(--space-3); }
@media (max-width: 900px) { .grid-2-1 { grid-template-columns: 1fr; } }

/* Chart */
.chart-wrap { position: relative; }
.chart-svg { width: 100%; height: 240px; display: block; }
.chart-grid { stroke: var(--border); stroke-width: 1; stroke-dasharray: 2 4; opacity: 0.8; vector-effect: non-scaling-stroke; }
.chart-axis { fill: var(--text-faint); font-size: 10px; font-family: var(--font-sans); }
.chart-fill { stroke: none; }
.chart-max { fill: var(--text-muted); font-size: 10px; font-family: var(--font-sans); font-weight: 600; }
.chart-max-line { stroke: var(--text-faint); stroke-width: 1; stroke-dasharray: 3 3; opacity: 0.6; vector-effect: non-scaling-stroke; }
.chart-stop-top { stop-opacity: 0.55; }
.chart-stop-bottom { stop-opacity: 0.04; }
.chart-stop.chart-blocked { stop-color: var(--status-blocked); }
.chart-stop.chart-challenged { stop-color: var(--status-challenged); }
.chart-stop.chart-logged { stop-color: var(--status-logged); }
.chart-fill.chart-blocked, .legend-swatch.chart-blocked, .bar-seg.chart-blocked { fill: var(--status-blocked); background: var(--status-blocked); }
.chart-fill.chart-challenged, .legend-swatch.chart-challenged, .bar-seg.chart-challenged { fill: var(--status-challenged); background: var(--status-challenged); }
.chart-fill.chart-logged, .legend-swatch.chart-logged, .bar-seg.chart-logged { fill: var(--status-logged); background: var(--status-logged); }
.chart-fill { opacity: 0.8; }
/* Area layers reference the <linearGradient> defs charts.js creates (same-document url(#id), not an external URL). */
.chart-fill.chart-grad.chart-blocked { fill: url(#chart-grad-blocked); opacity: 1; }
.chart-fill.chart-grad.chart-challenged { fill: url(#chart-grad-challenged); opacity: 1; }
.chart-fill.chart-grad.chart-logged { fill: url(#chart-grad-logged); opacity: 1; }
.chart-line { fill: none; stroke-width: 2; vector-effect: non-scaling-stroke; }
.chart-line.chart-allowed { stroke: var(--status-allowed); }
.chart-dot.chart-allowed { fill: var(--status-allowed); }
.legend-swatch.chart-allowed { background: var(--status-allowed); }
.bar-seg.chart-accent { fill: var(--accent); }
.chart-hit { fill: transparent; }
.chart-hit:hover, .chart-hit:focus { fill: color-mix(in srgb, var(--text) 8%, transparent); outline: none; }
.chart-tooltip {
  position: absolute;
  top: 8px;
  transform: translateX(-50%);
  min-width: 150px;
  padding: var(--space-2) var(--space-3);
  background: var(--bg-elevated);
  border: 1px solid var(--border);
  border-radius: var(--radius-md);
  box-shadow: var(--shadow);
  font-size: 0.78rem;
  pointer-events: none;
  z-index: 5;
}
.tip-row { display: flex; align-items: center; gap: var(--space-2); font-variant-numeric: tabular-nums; }
.chart-legend { display: flex; gap: var(--space-2); flex-wrap: wrap; }
.legend-btn { display: inline-flex; align-items: center; gap: var(--space-1); padding: 2px var(--space-2); font-size: 0.78rem; border-radius: 999px; text-transform: capitalize; }
.legend-btn[aria-pressed="false"] { opacity: 0.45; text-decoration: line-through; }
.legend-swatch { display: inline-block; width: 10px; height: 10px; border-radius: 2px; }

/* Bars and top-N lists */
.bar-list, .top-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: var(--space-2); }
.bar-list li { display: grid; grid-template-columns: 84px 1fr 48px; align-items: center; gap: var(--space-2); font-size: 0.85rem; }
.bar-list.category-list li { grid-template-columns: 11rem 1fr 48px; }
.bar-count, .top-count { text-align: right; font-variant-numeric: tabular-nums; }
.bar-track { width: 100%; height: 8px; display: block; }
.bar-bg { fill: var(--bg-sunken); }
.top-list li { display: grid; grid-template-columns: 1fr auto; gap: 2px var(--space-2); font-size: 0.82rem; }
.top-list li .bar-track { grid-column: 1 / -1; height: 4px; }
.top-key { max-width: none; min-width: 0; color: var(--text); }
.top-list a.top-key { color: var(--accent); text-decoration: none; }
.top-list a.top-key:hover { text-decoration: underline; }
.top-basis { font-size: 0.72rem; margin-top: var(--space-3); }

/* Store health */
.health-card { border-left: 4px solid var(--status-allowed); }
.health-degraded { border-left-color: var(--status-challenged); }
.health-open_error { border-left-color: var(--status-blocked); }
.health-disabled { border-left-color: var(--text-faint); }
.health-badge { color: var(--text-muted); background: var(--bg-sunken); }
.health-ok .health-badge { color: var(--status-allowed); }
.health-degraded .health-badge { color: var(--status-challenged); }
.health-open_error .health-badge { color: var(--status-blocked); }
.health-msg { margin: 0 0 var(--space-2); font-size: 0.82rem; color: var(--text-muted); word-break: break-word; }
.kv { display: grid; grid-template-columns: auto 1fr; gap: 2px var(--space-4); margin: 0; font-size: 0.82rem; }
.kv dt { color: var(--text-muted); }
.kv dd { margin: 0; text-align: right; font-variant-numeric: tabular-nums; }
.unavailable-card h3 { color: var(--status-blocked); }

.feed .truncate { max-width: 360px; }
.dashboard td .truncate, .dashboard .truncate { display: inline-block; vertical-align: bottom; }
.top-list .truncate { display: block; max-width: none; }

/* --- Attack log (P6) ------------------------------------------------------- */

.events-view h2 { margin: 0; font-size: 1.15rem; }
.events-view h3, .events-view h4 { margin: 0 0 var(--space-2); font-size: 0.9rem; font-weight: 600; }
.filter-bar { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: var(--space-3); align-items: end; }
.filter-bar input, .filter-bar select { width: 100%; }
.filter-actions { grid-column: 1 / -1; justify-content: flex-end; flex-wrap: wrap; }
.toggle-btn[aria-pressed="true"] { background: var(--accent-soft); border-color: var(--accent); color: var(--accent); font-weight: 600; }
.notice { margin-top: var(--space-3); padding: var(--space-2) var(--space-3); border-radius: var(--radius-sm); color: var(--status-challenged); background: color-mix(in srgb, var(--status-challenged) 14%, transparent); font-size: 0.85rem; }
.chips { display: flex; flex-wrap: wrap; gap: var(--space-2); margin-top: var(--space-3); }
.chips:empty { display: none; }
.chip { border-radius: 999px; padding: 2px var(--space-3); font-size: 0.8rem; word-break: break-all; }
.chip-clear { color: var(--text-muted); }
.events-card.is-loading { opacity: 0.6; transition: opacity 0.15s; }
.events-table .truncate { display: inline-block; vertical-align: bottom; max-width: 320px; }
/* A <td> must stay a table cell: display:inline-block on it pulls the cell out of the row and shifts every column after it. */
.events-table td.truncate { display: table-cell; vertical-align: middle; }
.ev-row { cursor: pointer; }
.ev-row:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
.pager { flex-wrap: wrap; gap: var(--space-2); }
.export-bar { flex-wrap: wrap; }
.export-note { font-size: 0.78rem; }
.spinner { display: none; width: 14px; height: 14px; border: 2px solid var(--border); border-top-color: var(--accent); border-radius: 50%; animation: ev-spin 0.8s linear infinite; }
.spinner.is-on { display: inline-block; }
@keyframes ev-spin { to { transform: rotate(360deg); } }

.drawer {
  position: fixed; top: 0; right: 0; bottom: 0; width: min(460px, 100vw); z-index: 30; overflow-y: auto;
  padding: var(--space-4); background: var(--bg-elevated); border-left: 1px solid var(--border); box-shadow: var(--shadow);
}
.drawer-group { margin-bottom: var(--space-4); }
.drawer-kv { display: grid; grid-template-columns: 110px 1fr; gap: var(--space-1) var(--space-3); margin: 0; font-size: 0.85rem; }
.drawer-kv dt { color: var(--text-muted); }
.drawer-kv dd { margin: 0; display: flex; gap: var(--space-2); align-items: flex-start; min-width: 0; }
.drawer-val { overflow-wrap: anywhere; min-width: 0; flex: 1; }
.copy-btn { padding: 0 var(--space-2); font-size: 0.72rem; flex: none; }
.drawer-links, .fp-list { display: flex; flex-direction: column; gap: var(--space-2); margin: 0 0 var(--space-4); padding: 0; list-style: none; }
.fp-action { display: inline-block; text-decoration: none; overflow-wrap: anywhere; }
.fp-warn { font-size: 0.78rem; margin: var(--space-2) 0 0; }
.pending-intent ul { text-align: left; }

/* --- Readable CRS rules (R1b) --- */
/* Tones reuse the status tokens only; no colours outside the token set. */
.rule-chip {
  --tone: var(--text-muted);
  display: inline-flex; align-items: baseline; gap: var(--space-1); max-width: 100%; min-width: 0; padding: 1px var(--space-2);
  border: 1px solid color-mix(in srgb, var(--tone) 45%, transparent); border-radius: 999px;
  color: var(--text); background: color-mix(in srgb, var(--tone) 12%, transparent); font-size: 0.78rem; line-height: 1.5; text-align: left;
}
button.rule-chip { cursor: pointer; }
button.rule-chip:hover { background: color-mix(in srgb, var(--tone) 24%, transparent); }
button.rule-chip:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
.rule-chip-id { flex: none; color: var(--tone); font-weight: 600; }
.rule-chip-title { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 22ch; }
.rule-chip.is-unknown { border-style: dashed; }
.tone-danger { --tone: var(--status-blocked); }
.tone-warn { --tone: var(--status-challenged); }
.tone-info { --tone: var(--accent); }
.tone-neutral { --tone: var(--text-muted); }
.rule-badge { color: var(--tone); background: color-mix(in srgb, var(--tone) 15%, transparent); }
/* rules-cell is a <td>: keep it a table cell (display:flex would detach it from the row); chips wrap as inline-flex boxes. */
.rules-cell { min-width: 160px; }
.rules-cell > * { margin: 0 var(--space-1) var(--space-1) 0; vertical-align: middle; }
.rule-list, .rule-tags { display: flex; flex-direction: column; gap: var(--space-2); margin: 0 0 var(--space-4); padding: 0; list-style: none; }
.rule-list li { display: flex; flex-wrap: wrap; gap: var(--space-2); align-items: center; }
.rule-meta { font-size: 0.78rem; }
.rule-tags { flex-direction: row; flex-wrap: wrap; gap: var(--space-1); margin: 0; }
.rule-tag { padding: 0 var(--space-2); border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--bg-sunken); font-size: 0.75rem; overflow-wrap: anywhere; }
.rule-source { margin: 0; padding: var(--space-2); max-height: 50vh; overflow: auto; background: var(--bg-sunken); border: 1px solid var(--border); border-radius: var(--radius-sm); font-size: 0.75rem; white-space: pre-wrap; overflow-wrap: anywhere; }
.rule-source:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }
.rule-missing p { margin: 0 0 var(--space-2); overflow-wrap: anywhere; }

/* --- Sites list (P7a) --- */
.sites-grid { grid-template-columns: repeat(auto-fill, minmax(280px, 1fr)); }
.site-card { display: flex; flex-direction: column; gap: var(--space-2); min-width: 0; }
.site-card.is-disabled, .sites-table tr.is-disabled { opacity: 0.6; }
.site-card h3 { margin: 0; min-width: 0; }
.site-meta { font-size: 0.85rem; }
.site-domains, .site-target { font-size: 0.85rem; overflow-wrap: anywhere; min-width: 0; }
.site-target { display: block; }
.site-badges { display: flex; flex-wrap: wrap; gap: var(--space-1); }
.prot-badge { background: transparent; border: 1px solid var(--border); font-size: 0.72rem; }
.prot-badge.prot-hard { border-color: var(--status-allowed); color: var(--status-allowed); }
.prot-badge.prot-soft { border-color: var(--status-logged); color: var(--status-logged); }
.sparkline { width: 100%; height: 32px; display: block; }
.sites-table .sparkline { width: 120px; }
.spark-allowed { fill: var(--status-allowed); opacity: 0.35; stroke: none; }
.spark-attack { fill: var(--status-blocked); opacity: 0.9; stroke: none; }
.spark-empty { stroke: var(--border); stroke-width: 1; vector-effect: non-scaling-stroke; }
.spark-off { height: 32px; display: flex; align-items: center; font-size: 0.8rem; }
.site-stats { display: flex; flex-wrap: wrap; gap: var(--space-3); font-size: 0.85rem; }
.site-links { gap: var(--space-2); flex-wrap: wrap; min-width: 0; }
.site-links .btn { text-decoration: none; }
.site-actions { align-items: center; padding-top: var(--space-2); border-top: 1px solid var(--border); }
.site-actions-quiet { margin-left: auto; gap: var(--space-1); flex-wrap: wrap; min-width: 0; justify-content: flex-end; }
.btn-quiet-danger:hover { color: var(--status-blocked); }
.sites-summary .summary-cell { min-width: 0; }
.sites-table td { vertical-align: middle; }
.site-target-cell { max-width: 220px; }
.th-sort { background: none; border: none; padding: 0; font: inherit; font-weight: 600; cursor: pointer; color: inherit; }

/* --- Sites editor (P7b-2) --- */
.editor-head { flex-wrap: wrap; gap: var(--space-2); }
.editor-head h2 { margin: 0; min-width: 0; }
.tab-bar { display: flex; flex-wrap: wrap; gap: var(--space-1); border-bottom: 1px solid var(--border); }
.tab { border: 1px solid transparent; border-bottom: none; border-radius: var(--radius-sm) var(--radius-sm) 0 0; background: transparent; display: inline-flex; align-items: center; gap: var(--space-2); }
.tab.is-active { background: var(--bg-elevated); border-color: var(--border); color: var(--accent); font-weight: 600; }
.tab-badge { min-width: 1.3em; padding: 0 var(--space-1); border-radius: 999px; text-align: center; font-size: 0.72rem; font-weight: 700; color: var(--accent-contrast); background: var(--status-blocked); }
.editor-grid { display: grid; grid-template-columns: minmax(0, 3fr) minmax(0, 2fr); gap: var(--space-3); align-items: start; }
@media (max-width: 900px) { .editor-grid { grid-template-columns: minmax(0, 1fr); } }
.editor-panel, .editor-side { display: flex; flex-direction: column; gap: var(--space-3); min-width: 0; }
.editor-panel input[type="text"], .editor-panel input[type="number"], .editor-panel input[type="password"], .editor-panel input[type="search"], .editor-panel select { width: 100%; box-sizing: border-box; }
.field-check .row { align-items: center; }
.field-hint { font-size: 0.78rem; }
.upstream-preview { gap: var(--space-2); }
.upstream-preview-item { padding: var(--space-2) var(--space-3); border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--bg-sunken); font-size: 0.8rem; overflow-wrap: anywhere; }
.field-errors:empty { display: none; }
.field-errors p, .field-error { margin: 0; overflow-wrap: anywhere; }
.list-rows { display: flex; flex-direction: column; gap: var(--space-2); }
.list-row input { flex: 1; min-width: 0; }
.chip-list { display: flex; flex-wrap: wrap; gap: var(--space-1); margin: 0 0 var(--space-2); padding: 0; list-style: none; }
.chip { display: inline-flex; align-items: center; gap: var(--space-1); padding: 2px var(--space-2); border: 1px solid var(--border); border-radius: 999px; background: var(--bg-sunken); font-size: 0.82rem; }
.chip-remove { border: none; background: transparent; padding: 0 var(--space-1); line-height: 1; color: var(--text-muted); border-radius: 999px; }
.chip-remove:hover { color: var(--status-blocked); }
.country-results { display: flex; flex-wrap: wrap; gap: var(--space-1); margin: var(--space-2) 0; }
.country-add { font-size: 0.78rem; padding: 2px var(--space-2); }
.callout { margin: 0; padding: var(--space-2) var(--space-3); border-radius: var(--radius-sm); border: 1px solid var(--border); background: var(--bg-sunken); font-size: 0.85rem; }
.callout-warn { color: var(--status-challenged); border-color: var(--status-challenged); background: color-mix(in srgb, var(--status-challenged) 12%, transparent); }
.state-chip { display: inline-flex; padding: 2px var(--space-3); border-radius: 999px; font-size: 0.82rem; font-weight: 700; border: 1px solid var(--border); }
.state-ok { color: var(--status-allowed); border-color: var(--status-allowed); }
.state-bad { color: var(--status-blocked); border-color: var(--status-blocked); }
.state-warn, .state-busy { color: var(--status-challenged); border-color: var(--status-challenged); }
.state-neutral { color: var(--text-muted); }
.problem-group ul { margin: var(--space-1) 0 0; padding-left: var(--space-4); }
.problem-item { overflow-wrap: anywhere; font-size: 0.85rem; }
.link-btn { background: none; border: none; padding: 0; color: var(--accent); text-decoration: underline; font-weight: 600; }
.link-btn:hover { background: none; }
.diff-block.is-stale { opacity: 0.6; }
.diff-table { width: 100%; border-collapse: collapse; font-size: 0.82rem; }
.diff-table th, .diff-table td { text-align: left; vertical-align: top; padding: var(--space-1) var(--space-2); border-bottom: 1px solid var(--border); overflow-wrap: anywhere; }
.intent-card.is-refused { border-color: var(--status-blocked); }
.intent-card ul { text-align: left; }
.tab:focus-visible, .chip-remove:focus-visible, .link-btn:focus-visible, .country-add:focus-visible, a:focus-visible, textarea:focus-visible { outline: 2px solid var(--focus-ring-color); outline-offset: 2px; }

/* --- Motion ---------------------------------------------------------------- */

@media (prefers-reduced-motion: reduce) {
  *, *::before, *::after {
    animation: none !important;
    transition: none !important;
    scroll-behavior: auto !important;
  }
}

/* --- V1b: dashboard tabs, geo ranking, site cards, events polish --- */
.dash-tabs { margin-bottom: var(--space-2); }
.geo-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: var(--space-2); }
.geo-row { display: grid; grid-template-columns: 2ch auto 1fr auto 6ch; gap: 2px var(--space-2); font-size: 0.85rem; align-items: baseline; }
.geo-row .geo-bar { grid-column: 1 / -1; height: 4px; }
.geo-count, .geo-pct { text-align: right; }
.geo-list a.geo-name { color: var(--accent); text-decoration: none; }
.geo-list a.geo-name:hover { text-decoration: underline; }
.category-row .bar-seg { fill: var(--tone, var(--accent)); }
.categories-unavailable { gap: var(--space-2); }
.site-head { align-items: flex-start; gap: var(--space-2); }
.site-chips { gap: var(--space-1); flex-shrink: 0; }
.mode-chip { background: var(--accent-soft); color: var(--accent); }
.mode-chip.mode-static, .mode-chip.mode-redirect { background: var(--bg-sunken); color: var(--text-muted); }
.site-ports { display: flex; flex-wrap: wrap; gap: var(--space-1); }
.site-tags { display: flex; flex-wrap: wrap; gap: var(--space-1); }
.tag-chip { background: var(--bg-sunken); border: 1px solid var(--border); color: var(--text-muted); font-size: 0.72rem; }
button.tag-chip { cursor: pointer; }
button.tag-chip:hover { color: var(--accent); border-color: var(--accent); }
button.tag-chip:focus-visible { outline: 2px solid var(--focus-ring-color); outline-offset: 2px; }
.port-chip { background: transparent; border: 1px solid var(--border); font-family: var(--font-mono, monospace); font-size: 0.72rem; }
.port-chip.port-https { border-color: var(--status-allowed); color: var(--status-allowed); }
.site-rqs { display: flex; gap: var(--space-4); }
.site-num { display: flex; flex-direction: column; min-width: 0; }
.site-num .mono { font-size: 1.15rem; font-weight: 600; }
.events-table th { white-space: nowrap; }
.events-table td, .events-table th { padding-block: var(--space-1); }
.events-table tbody tr:hover { background: var(--bg-sunken); }

.new-site-form { display: flex; flex-direction: column; gap: var(--space-3); max-width: 28rem; }
.new-site-form h3 { margin: 0; overflow-wrap: anywhere; }
.new-site-form .field-error:empty { display: none; }
.new-site-slot:empty { display: none; }

/* P7c-3a: the delete danger zone of the site editor. Tokens only; works in light and dark. */
.danger-zone { border-color: var(--status-blocked); }
.danger-zone h3 { color: var(--status-blocked); margin: 0; }
.danger-zone .delete-form { gap: var(--space-2); }
.danger-zone .delete-status:empty, .danger-zone .delete-reason:empty { display: none; }
.danger-zone .delete-status { margin: 0; }
.btn-danger:disabled { opacity: 0.5; cursor: not-allowed; filter: none; }

/* P7c-3b: enable/disable status slot of the Sites list (outside the list, never repainted away). */
.toggle-status { display: flex; flex-direction: column; gap: var(--space-2); align-items: flex-start; }
.toggle-status[hidden] { display: none; }
.toggle-status .toggle-text, .toggle-status .toggle-problems { margin: 0; }
.toggle-status .toggle-problems { padding-left: var(--space-4); }
.toggle-status .btn { text-decoration: none; }

/* P8a-2c: Operations page (Backups tab + restore review). Tokens only. */
.restore-review { margin-top: var(--space-3); }
.restore-diff { font-family: var(--font-mono); overflow-wrap: anywhere; word-break: break-word; }
.ops-notice { display: flex; align-items: center; justify-content: space-between; gap: var(--space-3); }
.ops-reason { font-size: 0.85rem; }

/* Operations > Activity (P8b-1) */
.audit-filters { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: var(--space-3); align-items: end; }
.audit-filters input, .audit-filters select { width: 100%; }
.audit-filters .filter-actions { flex-wrap: wrap; gap: var(--space-2); }
.audit-msg { display: inline-block; max-width: 420px; overflow-wrap: anywhere; white-space: pre-wrap; vertical-align: top; }
.audit-diff pre { margin: var(--space-1) 0 0; white-space: pre-wrap; overflow-wrap: anywhere; }

/* Step-up confirmation modal (js/stepup.js) */
.stepup-backdrop {
  position: fixed;
  inset: 0;
  z-index: 1000;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 16px;
  background: rgba(0, 0, 0, 0.45);
}
.stepup-dialog {
  width: 100%;
  max-width: 420px;
  max-height: 100%;
  overflow: auto;
  padding: 20px;
  background: var(--bg-elevated);
  border: 1px solid var(--border);
  border-radius: var(--radius-lg);
  box-shadow: var(--shadow-md);
}
.stepup-dialog:focus { outline: none; }
#app[inert] { pointer-events: none; user-select: none; }
.stepup-actions {
  display: flex;
  flex-wrap: wrap;
  justify-content: flex-end;
  gap: 8px;
  margin-top: 16px;
}

/* Login / enroll / recover screens (js/views/login.js, enroll.js, recover.js) */
.login-card .field input { width: 100%; box-sizing: border-box; }
.login-card .field-error, .login-card .text-muted, .login-card .login-hint { overflow-wrap: anywhere; }
.login-card .btn-ghost { width: 100%; min-height: 40px; }
.login-link { align-self: center; color: var(--accent); font-size: 0.9rem; }
.login-link:focus-visible { outline: 2px solid var(--focus-ring-color); outline-offset: 2px; }
.login-token-slot:empty { display: none; }
.login-token-slot form { padding-top: var(--space-2); border-top: 1px solid var(--border); }
.enroll-panel, .recover-body { display: flex; flex-direction: column; gap: var(--space-4); }
.enroll-success { font-weight: 600; }
@media (max-width: 480px) {
  .login-screen { padding: var(--space-2); align-items: flex-start; }
  .login-card { padding: var(--space-4); }
}

/* My security (js/views/security*.js, js/confirm-dialog.js) */
.security-view { max-width: 960px; min-width: 0; }
.security-section { min-width: 0; }
.security-section h2 { margin-top: 0; }
.security-body { display: flex; flex-direction: column; gap: var(--space-3); min-width: 0; }
.security-body > .row { flex-wrap: wrap; gap: var(--space-2); }
.security-table td, .security-table th { overflow-wrap: anywhere; }
.security-table .session-agent { max-width: 320px; }
.security-table td .badge { margin-right: var(--space-2); }
.passkey-add { display: flex; flex-direction: column; gap: var(--space-2); max-width: 420px; padding-top: var(--space-3); border-top: 1px solid var(--border); }
.passkey-add input { width: 100%; box-sizing: border-box; }
.passkey-message:empty { display: none; }
.passkey-synced { margin-left: var(--space-2); }
.recovery-status { margin: 0; }
.recovery-warning { color: var(--status-challenged); }
.recovery-panel { display: flex; flex-direction: column; gap: var(--space-3); padding: var(--space-3); border: 1px solid var(--border); border-radius: var(--radius-lg); background: var(--bg-sunken); }
.recovery-note { margin: 0; font-weight: 600; }
.recovery-codes { display: grid; grid-template-columns: repeat(auto-fit, minmax(170px, 1fr)); gap: var(--space-2); margin: 0; padding: 0; list-style: none; }
.recovery-code { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 0.95rem; user-select: all; overflow-wrap: anywhere; padding: var(--space-1) var(--space-2); background: var(--bg-elevated); border-radius: var(--radius-sm, 4px); }
.recovery-actions { flex-wrap: wrap; gap: var(--space-2); }
.login-notice { margin: 0 0 var(--space-3); padding: var(--space-2) var(--space-3); border-radius: var(--radius-lg); background: var(--accent-soft); color: var(--text); overflow-wrap: anywhere; }
.confirm-dialog h2 { margin-top: 0; overflow-wrap: anywhere; }
.confirm-dialog p { overflow-wrap: anywhere; }
.security-body button:focus-visible, .security-section input:focus-visible, .confirm-dialog button:focus-visible { outline: 2px solid var(--focus-ring-color); outline-offset: 2px; }
@media (max-width: 480px) {
  .security-table thead { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
  .security-table, .security-table tbody, .security-table tr, .security-table td { display: block; width: 100%; box-sizing: border-box; }
  .security-table tr { padding: var(--space-2) 0; border-bottom: 1px solid var(--border); }
  .security-table td { display: flex; justify-content: space-between; gap: var(--space-3); border-bottom: none; padding: 4px 0; text-align: right; }
  .security-table td::before { content: attr(data-label); color: var(--text-muted); font-weight: 600; text-align: left; flex: none; }
  .security-table td[data-label=""]::before { content: none; }
  .security-table td[data-label=""] { justify-content: flex-end; }
  .security-table tbody tr:hover { background: transparent; }
  .recovery-codes { grid-template-columns: 1fr; }
}
@media (prefers-reduced-motion: reduce) {
  .security-view *, .confirm-dialog, .confirm-dialog * { transition: none; animation: none; }
}

/* Users screen (js/views/users*.js) -- U4c-2. Reuses .security-table (incl. its
   stacked-card degradation at 480px), .card, .field, .badge and .stepup-dialog. */
.users-view { max-width: 960px; min-width: 0; }
.users-table td, .users-table th { overflow-wrap: anywhere; }
.users-table .users-actions { display: flex; flex-wrap: wrap; gap: var(--space-1); justify-content: flex-end; align-items: center; }
.users-table .users-actions select { min-width: 8.5rem; }
.users-table .users-actions button { white-space: nowrap; }
.user-row-own { background: var(--bg-sunken); }
.user-self { margin-left: var(--space-2); }
.user-self-hint { margin: var(--space-1) 0 0; font-size: 0.85rem; }
.users-create { display: flex; flex-direction: column; gap: var(--space-2); padding: var(--space-3); max-width: 480px; border: 1px solid var(--border); border-radius: var(--radius-lg); }
.users-create h3 { margin: 0; }
.users-message:empty { display: none; }
.users-dialog .users-link, .users-dialog .users-confirm, .users-dialog .users-sessions { display: flex; flex-direction: column; gap: var(--space-3); min-width: 0; }
.enroll-link-code { display: block; padding: var(--space-2); background: var(--bg-sunken); border: 1px solid var(--border); border-radius: var(--radius-sm, 4px); font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 0.9rem; overflow-wrap: anywhere; user-select: all; }
.users-confirm input { width: 100%; box-sizing: border-box; }
.users-dialog .table-scroll { max-width: 100%; }
.users-dialog .session-agent { max-width: 320px; }
.users-dialog button:focus-visible, .users-dialog input:focus-visible, .users-dialog select:focus-visible { outline: 2px solid var(--focus-ring-color); outline-offset: 2px; }
@media (max-width: 480px) {
  .users-table .users-actions { justify-content: flex-start; }
  .users-table td[data-label=""]::before { content: none; }
  .users-table td[data-label=""] { justify-content: flex-start; }
  .users-create { max-width: 100%; }
}
@media (prefers-reduced-motion: reduce) {
  .users-view *, .users-dialog, .users-dialog * { transition: none; animation: none; }
}

/* --- Live traffic view (V1D) ------------------------------------------------ */
.live-view .is-hidden { display: none; }
.live-app-row { gap: var(--space-3); flex-wrap: wrap; }
.live-app-name { font-weight: 600; }
.live-app-status { min-width: 12ch; }
.live-filters { flex-wrap: wrap; }
.live-filters input[type="text"] { min-width: 16rem; }
.live-table tr[hidden] { display: none; }
.live-table td.truncate { max-width: 420px; }

/* --- Client cell: flag, IP, country code, ASN chip, ISP (events-visual) --- */

.client-td { min-width: 190px; max-width: 280px; }
.client-cell { display: inline-flex; flex-direction: column; gap: 3px; max-width: 100%; vertical-align: middle; }
.client-top { display: inline-flex; align-items: center; gap: var(--space-1); white-space: nowrap; }
/* Flag glyphs, one size wherever a country is shown: the Events list, the
   Access log (client-cell.js) and the dashboard's country card. */
.client-flag, .geo-flag { font-size: 1.05rem; line-height: 1; }
.client-cc { font-size: 0.72rem; font-weight: 600; letter-spacing: 0.04em; }
.client-net { display: inline-flex; align-items: center; gap: var(--space-1); min-width: 0; max-width: 100%; }
.client-asn { flex: none; padding: 1px 8px; font-size: 0.72rem; }
.client-isp { min-width: 0; font-size: 0.78rem; color: var(--text-muted); }
.client-net .client-isp { display: block; max-width: 190px; }