* {
  box-sizing: border-box;
}

:root {
  --bg: #0f1117;
  --panel: #171a23;
  --panel-2: #1e222d;
  --border: #272c3a;
  --text: #e6e8ee;
  --muted: #8b91a3;
  --accent: #4c8dff;
  --clean: #2ecc71;
  --low: #3ddc84;
  --medium: #f5c542;
  --high: #ff9f43;
  --critical: #ff5c5c;
  --collect: #6b8afd;
  /* "We have no record here" — used as an SVG fill by the online-history chart
     and as a background by its legend swatch. Defined once so the two cannot
     drift apart. Deliberately neutral: no data is not the same as known-offline,
     and colouring it as a fault would overstate what the chart knows. */
  --nodata: rgba(255, 255, 255, 0.05);
}

body {
  margin: 0;
  background: var(--bg);
  color: var(--text);
  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
  font-size: 14px;
}

.hidden {
  display: none !important;
}

button {
  border: 1px solid var(--border);
  background: var(--panel-2);
  color: var(--text);
  padding: 8px 14px;
  border-radius: 8px;
  font-size: 13px;
  cursor: pointer;
}

button:hover {
  background: #262b38;
}

button.primary {
  background: var(--accent);
  border-color: var(--accent);
  color: #fff;
}

button.primary:hover {
  filter: brightness(1.08);
}

button.block {
  width: 100%;
}

/* ---- deployment health ----
   Traffic-light rows. The tinted left edge carries the state at a glance; the
   ✓/!/✕ mark repeats it for anyone who cannot rely on the colour. */
.healthrows {
  display: flex;
  flex-direction: column;
  gap: 8px;
}

.healthrow {
  display: flex;
  gap: 12px;
  align-items: flex-start;
  padding: 10px 14px;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-left-width: 3px;
  border-radius: 8px;
}

.healthrow.ok {
  border-left-color: var(--clean);
}

.healthrow.warn {
  border-left-color: var(--medium);
}

.healthrow.bad {
  border-left-color: var(--critical);
}

.healthrow .hmark {
  font-weight: 700;
  font-size: 14px;
  line-height: 1.4;
  width: 16px;
  text-align: center;
  flex: none;
}

.healthrow.ok .hmark {
  color: var(--clean);
}

.healthrow.warn .hmark {
  color: var(--medium);
}

.healthrow.bad .hmark {
  color: var(--critical);
}

.healthrow .htitle {
  font-weight: 600;
  font-size: 13px;
  margin-bottom: 2px;
}

.healthrow .htext {
  color: var(--muted);
  font-size: 12.5px;
  line-height: 1.5;
}

/* ---- login ---- */
.login-wrap {
  min-height: 100vh;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: 24px;
}

.login-card {
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 16px;
  padding: 34px 30px;
  width: 100%;
  max-width: 380px;
  text-align: center;
}

.login-logo {
  font-size: 40px;
}

.login-card h1 {
  font-size: 20px;
  margin: 10px 0 4px;
}

.login-card .sub {
  color: var(--muted);
  font-size: 13px;
  margin: 0 0 20px;
}

.login-card input {
  width: 100%;
  padding: 11px 13px;
  margin-bottom: 12px;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 8px;
  color: var(--text);
  font-size: 14px;
}

.login-card input:focus {
  outline: none;
  border-color: var(--accent);
}

.login-error {
  color: var(--critical);
  font-size: 13px;
  margin-top: 12px;
  min-height: 18px;
}

/* ---- layout ---- */
header {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 14px 26px;
  background: var(--panel);
  border-bottom: 1px solid var(--border);
  position: sticky;
  top: 0;
  z-index: 20;
}

.brand {
  font-size: 16px;
  font-weight: 600;
}

.brand em {
  color: var(--muted);
  font-style: normal;
  font-weight: 400;
  margin-left: 4px;
}

.header-actions {
  display: flex;
  align-items: center;
  gap: 10px;
}

main {
  padding: 22px 26px 60px;
  max-width: 1180px;
  margin: 0 auto;
}

.meta {
  color: var(--muted);
  font-size: 12px;
}

.card {
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 14px;
  margin-bottom: 20px;
  overflow: hidden;
}

.card-head {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 16px 20px;
  border-bottom: 1px solid var(--border);
}

.card-head h2 {
  font-size: 14px;
  margin: 0;
  font-weight: 600;
}

/* ---- stat cards ---- */
.stats {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(165px, 1fr));
  gap: 14px;
  margin-bottom: 20px;
}

.stat {
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 14px;
  padding: 16px 18px;
}

.stat .label {
  color: var(--muted);
  font-size: 12px;
  margin-bottom: 6px;
}

.stat .value {
  font-size: 26px;
  font-weight: 600;
  line-height: 1.1;
}

.stat .value.small {
  font-size: 17px;
}

/* ---- machines ---- */
.machines {
  padding: 8px 20px 18px;
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
  gap: 12px;
}

.machine {
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 10px;
  padding: 13px 15px;
}

.machine .name {
  font-weight: 600;
  margin-bottom: 6px;
}

.machine .when {
  color: var(--muted);
  font-size: 12px;
  margin-top: 6px;
}

.machine .name {
  display: flex;
  align-items: center;
  gap: 8px;
}

.dot {
  width: 8px;
  height: 8px;
  border-radius: 50%;
  display: inline-block;
  flex: none;
}

.dot.online {
  background: var(--clean);
  box-shadow: 0 0 0 3px rgba(46, 204, 113, 0.18);
}

.dot.offline {
  background: var(--muted);
  opacity: 0.5;
}

.dot.archived {
  background: var(--muted);
  opacity: 0.3;
}

.mbtns {
  display: flex;
  gap: 6px;
  margin-top: 10px;
  flex-wrap: wrap;
}

.mbtns button {
  font-size: 11.5px;
  padding: 5px 10px;
}

.mbtns button:disabled {
  opacity: 0.4;
  cursor: not-allowed;
}

.mbtns .removebtn {
  color: var(--critical);
}

/* ---- paused machines ----
   Pausing and archiving must not look alike. Archived cards fade out because
   they are out of service; a paused machine is in service and only its
   scanning schedule is off, so its card keeps full contrast and instead gets a
   marked left edge plus the "paused" badge. Faded-vs-marked reads as
   "retired vs deliberately held", which is exactly the distinction. */
.machine.paused {
  border-left: 3px solid var(--medium);
  padding-left: 12px;
  /* keeps the text aligned with the 1px-bordered cards */
}

/* Amber rather than red: paused is a chosen state, not a fault. Reuses the
   .badge shape every other status on this page already uses. */
.badge.paused {
  background: rgba(245, 197, 66, 0.16);
  color: var(--medium);
}

/* Informational, not an alarm: on a fresh deployment every machine carries this
   until it enrols, so it is kept quieter than the paused badge. */
.badge.sharedkey {
  background: rgba(255, 255, 255, 0.07);
  color: var(--muted);
}

/* Same quiet treatment as the shared-key badge, and for the same reason: on the
   current fleet every machine carries it, so an alarm colour would make the
   whole grid look broken rather than pointing at a job to do. */
.badge.noid {
  background: rgba(255, 255, 255, 0.07);
  color: var(--muted);
}

/* Amber, unlike the two quiet badges above. A machine with undelivered scans
   looks healthy by every other signal on this card — online, checking in, seen
   a minute ago — while its findings are reaching nobody, so it needs to catch
   the eye rather than blend in. */
.badge.waiting {
  background: rgba(245, 197, 66, 0.16);
  color: var(--medium);
}

/* Amber too: an out-of-date agent keeps working, but it is a job to do — the
   badge names the machines a rollout has not reached yet. */
.badge.oldver {
  background: rgba(245, 197, 66, 0.16);
  color: var(--medium);
}

/* Deep scan: a distinct accent so a deep report stands out in the history from
   the routine ones, without reading as a risk level. */
.badge.deep {
  background: rgba(107, 138, 253, 0.16);
  color: var(--collect);
}

/* The per-card Deep scan button: outlined in the same accent as its badge, so
   the heavier action is visually distinct from the ordinary scan buttons
   without being alarming. */
.mbtns .deepbtn {
  color: var(--collect);
  border-color: rgba(107, 138, 253, 0.4);
}

/* Muted like .when — it is an explanation of the badge above it, not an alert.
   Wraps (unlike .alsoseen) because it is meant to be read. */
.machine .pausenote {
  color: var(--muted);
  font-size: 11.5px;
  line-height: 1.45;
  margin-top: 6px;
}

.machines-note {
  padding: 4px 20px 0;
  max-width: 82ch;
}

/* ---- archived machines ---- */
.machine.archived {
  opacity: 0.62;
}

.machine.archived:hover {
  opacity: 1;
}

.archived-wrap {
  margin: 0 20px 16px;
  border-top: 1px solid var(--border);
  padding-top: 12px;
}

.archived-wrap>summary {
  cursor: pointer;
  color: var(--muted);
  font-size: 13px;
  font-weight: 600;
  list-style: revert;
}

.archived-wrap .meta {
  font-size: 12px;
  margin: 8px 0 0;
  max-width: 62ch;
}

.archived-wrap .machines {
  padding: 10px 0 4px;
}

.cmdmsg {
  padding: 0 20px;
  font-size: 13px;
  min-height: 18px;
}

.cmdmsg.ok {
  color: var(--clean);
}

.cmdmsg.err {
  color: var(--critical);
}

/* ---- filters ---- */
.filters {
  display: flex;
  gap: 6px;
  align-items: center;
  flex-wrap: wrap;
}

.filter,
.view,
.phishfilter {
  padding: 5px 12px;
  font-size: 12px;
  border-radius: 20px;
}

.filter.active,
.view.active,
.phishfilter.active {
  background: var(--accent);
  border-color: var(--accent);
  color: #fff;
}

.filter-sep {
  width: 1px;
  align-self: stretch;
  background: var(--border);
  margin: 2px 4px;
}

/* ---- host × day matrix ---- */
#grid {
  table-layout: auto;
}

#grid th.gridhost {
  text-align: left;
  padding: 10px 14px 10px 20px;
  position: sticky;
  left: 0;
  background: var(--panel);
  z-index: 1;
}

/* Row headers repeat the host name; keep them readable rather than the
   small-caps treatment the column headers use. */
#grid tbody th.gridhost {
  font-size: 12.5px;
  font-weight: 600;
  color: var(--text);
  text-transform: none;
  letter-spacing: 0;
  border-bottom: 1px solid var(--border);
}

#grid tbody tr:hover th.gridhost {
  background: var(--panel-2);
}

#grid tbody tr:last-child th.gridhost {
  border-bottom: none;
}

#grid th.gridday {
  text-align: center;
  padding: 10px 8px;
}

.gridcell {
  text-align: center;
  padding: 9px 8px;
  white-space: nowrap;
  cursor: pointer;
}

.gridcell.empty {
  color: var(--muted);
  opacity: 0.35;
  cursor: default;
}

.gridcell .badge {
  font-size: 10px;
  padding: 2px 7px;
}

.gridcount {
  color: var(--muted);
  font-size: 10.5px;
  margin-left: 4px;
}

.gridlegend {
  padding: 12px 20px 16px;
  color: var(--muted);
  font-size: 12px;
  max-width: 78ch;
}

.gridlegend p {
  margin: 0 0 8px;
}

.gridlegend p:last-child {
  margin: 8px 0 0;
}

/* What each risk colour means. A row of the real .badge elements rather than
   hand-made swatches, so the legend cannot drift from the badges it explains. */
.risklegend {
  list-style: none;
  margin: 0;
  padding: 0;
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(210px, 1fr));
  gap: 5px 16px;
}

.risklegend li {
  display: flex;
  align-items: center;
  gap: 8px;
}

.risklegend .badge {
  flex: none;
  min-width: 62px;
  text-align: center;
}

/* ---- table ---- */
.table-wrap {
  overflow-x: auto;
}

table {
  width: 100%;
  border-collapse: collapse;
}

th {
  text-align: left;
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--muted);
  padding: 10px 20px;
  border-bottom: 1px solid var(--border);
  font-weight: 600;
  white-space: nowrap;
}

td {
  padding: 12px 20px;
  border-bottom: 1px solid var(--border);
  vertical-align: middle;
}

tbody tr {
  cursor: pointer;
}

tbody tr:hover {
  background: var(--panel-2);
}

tbody tr:last-child td {
  border-bottom: none;
}

td.summary {
  color: var(--muted);
  max-width: 420px;
}

.nowrap {
  white-space: nowrap;
}

.empty {
  padding: 34px 20px;
  text-align: center;
  color: var(--muted);
}

/* ---- admin activity ---- */
.auditnote {
  padding: 4px 20px 0;
  max-width: 82ch;
}

/* Scan-history rows open a drawer; these rows are the whole record and open
   nothing, so they must not offer a pointer that promises otherwise. */
#audit tbody tr {
  cursor: default;
}

#audit td.summary {
  color: var(--text);
}

/* The change itself ("Studio → Amir's Mac") sits beside the target and stays
   secondary to it. */
#audit td.summary .meta {
  margin-left: 6px;
}

/* ---- badges ---- */
.badge {
  display: inline-block;
  padding: 3px 10px;
  border-radius: 20px;
  font-size: 11px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.03em;
  white-space: nowrap;
}

.badge.clean,
.badge.low {
  background: rgba(46, 204, 113, 0.16);
  color: var(--clean);
}

.badge.medium {
  background: rgba(245, 197, 66, 0.16);
  color: var(--medium);
}

.badge.high {
  background: rgba(255, 159, 67, 0.16);
  color: var(--high);
}

.badge.critical {
  background: rgba(255, 92, 92, 0.18);
  color: var(--critical);
}

.badge.info {
  background: rgba(139, 145, 163, 0.16);
  color: var(--muted);
}

.badge.collect {
  background: rgba(107, 138, 253, 0.16);
  color: var(--collect);
}

.badge.report {
  background: rgba(76, 141, 255, 0.16);
  color: var(--accent);
}

.badge.none {
  background: rgba(139, 145, 163, 0.12);
  color: var(--muted);
}

/* ---- drawer ---- */
.drawer {
  position: fixed;
  inset: 0;
  z-index: 50;
}

.drawer-backdrop {
  position: absolute;
  inset: 0;
  background: rgba(0, 0, 0, 0.55);
}

.drawer-panel {
  position: absolute;
  top: 0;
  right: 0;
  height: 100%;
  width: min(720px, 100%);
  background: var(--panel);
  border-left: 1px solid var(--border);
  display: flex;
  flex-direction: column;
}

.drawer-head {
  display: flex;
  justify-content: space-between;
  align-items: center;
  padding: 16px 22px;
  border-bottom: 1px solid var(--border);
}

.drawer-head h2 {
  font-size: 15px;
  margin: 0;
}

.icon-btn {
  padding: 4px 10px;
}

.drawer-body {
  padding: 20px 22px 50px;
  overflow-y: auto;
}

.drawer-body h3 {
  font-size: 13px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--muted);
  margin: 22px 0 10px;
}

.drawer-body h3:first-child {
  margin-top: 0;
}

.kv {
  display: grid;
  grid-template-columns: 120px 1fr;
  gap: 6px 14px;
  font-size: 13px;
}

.kv .k {
  color: var(--muted);
}

.lead {
  font-size: 14px;
  line-height: 1.6;
  margin: 0 0 4px;
}

.finding {
  border-left: 3px solid var(--border);
  background: var(--panel-2);
  border-radius: 0 10px 10px 0;
  padding: 12px 15px;
  margin-bottom: 10px;
}

.finding.critical,
.finding.high {
  border-left-color: var(--critical);
}

.finding.medium {
  border-left-color: var(--medium);
}

.finding.low,
.finding.info {
  border-left-color: var(--clean);
}

.finding .ft {
  font-weight: 600;
  margin-bottom: 5px;
  display: flex;
  gap: 8px;
  align-items: center;
}

.finding .fd {
  color: #c3c8d6;
  font-size: 13px;
  line-height: 1.55;
}

.finding .fr {
  color: var(--clean);
  font-size: 12.5px;
  margin-top: 7px;
}

ul.recs {
  margin: 0;
  padding-left: 20px;
  line-height: 1.7;
  color: #c3c8d6;
}

.nochange {
  color: var(--clean);
  font-size: 13px;
}

.changeblock {
  margin-bottom: 12px;
}

.ctitle {
  font-size: 13px;
  font-weight: 600;
  margin-bottom: 5px;
}

.cline {
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 11.5px;
  padding: 3px 9px;
  border-radius: 4px;
  margin-bottom: 2px;
  word-break: break-all;
}

.cline.added {
  background: rgba(46, 204, 113, 0.12);
  color: var(--clean);
}

.cline.removed {
  background: rgba(255, 92, 92, 0.12);
  color: var(--critical);
}

.newbadge {
  background: var(--critical);
  color: #fff;
  font-size: 10px;
  font-weight: 700;
  padding: 2px 7px;
  border-radius: 4px;
  letter-spacing: 0.04em;
}

details.check {
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 10px;
  margin-bottom: 8px;
}

details.check summary {
  padding: 11px 15px;
  cursor: pointer;
  font-size: 13px;
  font-weight: 500;
  list-style: none;
}

details.check summary::-webkit-details-marker {
  display: none;
}

details.check summary::before {
  content: "▸ ";
  color: var(--muted);
}

details.check[open] summary::before {
  content: "▾ ";
}

details.check pre {
  margin: 0;
  padding: 0 15px 14px;
  font-size: 11.5px;
  line-height: 1.5;
  color: #aeb4c4;
  white-space: pre-wrap;
  word-break: break-word;
  max-height: 420px;
  overflow-y: auto;
}

.machine .realhost {
  color: var(--muted);
  font-size: 11.5px;
  margin: -2px 0 6px 16px;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
}

/* The other hostnames a machine has checked in under. Deliberately quieter
   than .realhost — it is a recognition aid, not something to act on — and
   truncated to one line so a machine that has moved network many times cannot
   stretch its card. The full list is in the title attribute. */
.machine .alsoseen {
  color: var(--muted);
  font-size: 11px;
  margin: -2px 0 6px 16px;
  opacity: 0.8;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}

/* ---- machine org tag & assignment ---- */
.machine .mrow {
  display: flex;
  align-items: center;
  gap: 8px;
  flex-wrap: wrap;
}

.orgtag {
  font-size: 10.5px;
  padding: 2px 8px;
  border-radius: 20px;
  background: rgba(76, 141, 255, 0.16);
  color: var(--accent);
  font-weight: 600;
}

.assignrow {
  display: flex;
  align-items: center;
  gap: 6px;
  margin-top: 8px;
}

.assignrow label {
  color: var(--muted);
  font-size: 11.5px;
}

.assignsel {
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: 4px 6px;
  font-size: 11.5px;
  flex: 1;
}

/* ---- viewer note (org user) ---- */
.viewer-note {
  color: var(--accent);
  font-size: 12.5px;
  font-weight: 600;
}

/* ---- organizations panel ---- */
.orgpanel {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
  gap: 20px;
  padding: 16px 20px 20px;
}

@media (max-width: 720px) {
  .orgpanel {
    grid-template-columns: 1fr;
  }
}

/* Feedback for this card sits under its header, above the three columns — the
   form that caused it is right there. It always reserves its line so showing a
   message never pushes the Add login button down under the cursor. */
.orgmsg {
  padding-top: 10px;
}

.orgsub {
  font-size: 12px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--muted);
  margin: 0 0 10px;
}

.orgform {
  display: flex;
  gap: 8px;
  margin-bottom: 12px;
}

.orgform.wrap {
  flex-wrap: wrap;
}

.orgform input,
.orgform select {
  background: var(--bg);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 8px 10px;
  font-size: 13px;
  flex: 1;
  min-width: 120px;
}

.orglist {
  display: flex;
  flex-direction: column;
  gap: 6px;
}

.orgrow {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 10px;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 8px 12px;
}

.orgrow .meta {
  margin-left: 8px;
}

.orgrow button {
  font-size: 11.5px;
  padding: 4px 10px;
  color: var(--critical);
}

/* ---- AI analysis settings ---- */
.analysispanel {
  padding: 16px 20px 20px;
}

.analysispanel .meta {
  max-width: 74ch;
  margin: 0 0 12px;
}

.analysispanel .orgform {
  max-width: 640px;
}

.assignrow .analysissel {
  flex: 1;
}

/* Accepted conditions. Laid out so the long "what" field gets the room and the
   scope selector stays narrow — a fleet-wide entry is the common case and should
   not look like the exception. */
.ackform {
  display: flex;
  flex-wrap: wrap;
  gap: 8px;
  align-items: center;
}

.ackform input[type="text"] {
  flex: 1 1 240px;
  min-width: 0;
}

.ackform select {
  flex: 0 1 200px;
}

.acklist {
  margin-top: 12px;
  display: flex;
  flex-direction: column;
  gap: 6px;
}

.ackitem {
  display: flex;
  gap: 10px;
  align-items: baseline;
  padding: 8px 10px;
  border-radius: 6px;
  background: rgba(255, 255, 255, 0.04);
}

.ackitem .acktitle {
  font-weight: 600;
}

.ackitem .acknote {
  color: var(--muted);
  font-size: 13px;
}

.ackitem .ackscope {
  margin-left: auto;
  white-space: nowrap;
  font-size: 12px;
  color: var(--muted);
}

/* A targeted entry whose machine is gone suppresses nothing — it has to look
   wrong rather than merely sit in the list. */
.ackitem.orphan {
  outline: 1px solid var(--medium);
}

.ackitem .ackdel {
  margin-left: 8px;
}

/* ---- online history chart ----
   Geometry lives in SVG attributes, not in styles: the panel's CSP is
   style-src 'self', so nothing here can be an inline style attribute. This
   block is only colour and type. */
.uptime-wrap {
  padding: 14px 20px 4px;
  overflow-x: hidden;
}

.upchart {
  width: 100%;
  height: auto;
  display: block;
  font-family: inherit;
}

/* Alternating row ground, so a long row is easy to follow across the width. */
.upchart .rowbg {
  fill: transparent;
}

.upchart .uprow:nth-child(even) .rowbg {
  fill: rgba(255, 255, 255, 0.02);
}

/* The ground beneath every row: "we have no record of this machine here".
   Deliberately NOT red — no data is not the same as known-offline, and
   colouring it as a fault would overstate what the chart knows. */
.upchart .nodata {
  fill: var(--nodata);
}

/* Online. Same green as the online dot in the machine list, so the two agree. */
.upchart .up {
  fill: var(--clean);
}

/* A scan point: proof of one moment online, not a stretch of uptime. Drawn in
   the collect blue rather than green so it cannot be misread as a period the
   machine was up. */
.upchart .up.scan {
  fill: var(--collect);
}

.upchart .tick {
  stroke: var(--border);
  stroke-width: 1;
}

.upchart .ticklabel,
.upchart .colhead {
  fill: var(--muted);
  font-size: 10px;
}

.upchart .colhead {
  font-weight: 600;
}

.upchart .rowlabel {
  fill: var(--text);
  font-size: 11.5px;
}

.upchart .rowstat {
  fill: var(--text);
  font-size: 11px;
}

.upchart .rowgap {
  fill: var(--muted);
  font-size: 11px;
}

/* What each bar colour means. The swatches reuse the chart's own classes
   (.up, .up.scan, .nodata) so a colour can never be changed in one place and
   left stale in the other — but those classes set `fill`, which is an SVG
   property, so each swatch also needs a background here. Both are driven from
   the same custom properties, which is what keeps them in step. */
.uplegend {
  list-style: none;
  margin: 0;
  padding: 10px 20px 4px;
  display: grid;
  gap: 7px;
  max-width: 104ch;
  color: var(--muted);
  font-size: 12px;
  line-height: 1.5;
}

.uplegend li {
  display: flex;
  align-items: baseline;
  gap: 9px;
}

.uplegend strong {
  color: var(--text);
  font-weight: 600;
}

.uplegend em {
  font-style: normal;
  color: var(--text);
}

.uplegend .swatch {
  flex: none;
  width: 26px;
  height: 11px;
  border-radius: 2px;
  /* Nudged down so a block sits on the text's baseline rather than above it. */
  transform: translateY(1px);
}

.uplegend .swatch.up {
  background: var(--clean);
}

.uplegend .swatch.up.scan {
  background: var(--collect);
  width: 6px;
}

.uplegend .swatch.nodata {
  background: var(--nodata);
}

.uptime-note {
  padding: 6px 20px 16px;
  max-width: 96ch;
  line-height: 1.5;
}

/* ---- remote sessions ---- */
.remotenote {
  padding: 10px 20px 0;
  max-width: 88ch;
  line-height: 1.5;
}

.remotesessions {
  padding: 10px 20px 4px;
  display: grid;
  gap: 10px;
}

.remoteclosed {
  padding: 0 20px 16px;
}

.remotesession {
  background: var(--panel-2);
  border: 1px solid var(--border);
  /* A marked edge, like a paused machine: this is a live state somebody chose,
     and it should read as deliberate rather than as an alert. */
  border-left: 3px solid var(--accent);
  border-radius: 10px;
  padding: 12px 14px;
}

.remotesession .rsname {
  font-weight: 600;
  margin-bottom: 6px;
}

.remotesession .rsstate {
  display: flex;
  align-items: center;
  gap: 8px;
  margin-bottom: 8px;
}

.remotesession .rswait {
  max-width: 80ch;
  line-height: 1.5;
}

.remotesession .rscmd {
  margin: 0 0 8px;
  padding: 9px 11px;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 8px;
  font-size: 11.5px;
  line-height: 1.55;
  color: var(--text);
  white-space: pre-wrap;
  /* The connect command is the one thing on this card meant to be copied, so it
     must be selectable and must not be truncated. */
  user-select: all;
  overflow-x: auto;
}

.mbtns .remotebtn {
  color: var(--accent);
}

.mbtns .rsclosebtn {
  color: var(--critical);
}

/* The connect commands. Each on its own line with a label above it, because the
   thing being explained is a sequence and running them out of order fails in a
   way that reads as the feature being broken. */
.remotesession .rsconnect {
  margin-bottom: 8px;
}

.remotesession .rslabel {
  color: var(--muted);
  font-size: 11.5px;
  margin: 0 0 4px;
}

.remotesession .rsalt {
  margin-top: 8px;
}

.remotesession .rsalt>summary {
  cursor: pointer;
  color: var(--muted);
  font-size: 11.5px;
  list-style: revert;
}

.remotesession .rsalt .rslabel {
  margin-top: 8px;
}

/* ---- bulk selection ---- */
.bulkbar {
  display: flex;
  align-items: center;
  gap: 10px;
  margin: 4px 20px 10px;
  padding: 9px 12px;
  background: var(--panel-2);
  border: 1px solid var(--border);
  border-radius: 10px;
  /* Marked, because it appears mid-page and its buttons act on several machines
     at once — it should not read as part of the quiet furniture. */
  border-left: 3px solid var(--accent);
  flex-wrap: wrap;
}

.bulkbar .bulkspacer {
  flex: 1 1 auto;
}

.bulkbar button {
  font-size: 12px;
  padding: 6px 12px;
}

.bulkbar button:disabled {
  opacity: 0.4;
  cursor: not-allowed;
}

.bulkall {
  display: flex;
  align-items: center;
  gap: 6px;
  font-size: 12px;
  color: var(--muted);
}

/* The one destructive bulk action, coloured like the other destructive ones. */
.bulkbar .danger {
  color: var(--critical);
  border-color: rgba(255, 92, 92, 0.35);
}

.bulkbar .danger:disabled {
  color: var(--muted);
  border-color: var(--border);
}

.machine .mpick {
  display: inline-flex;
  align-items: center;
  margin-right: 2px;
}

.machine .mpickbox {
  cursor: pointer;
}

/* A selected card is outlined rather than filled: the risk badge and the paused
   edge already carry colour, and a filled background would fight them. */
.machine.picked {
  outline: 1px solid var(--accent);
  outline-offset: -1px;
}

/* ---- phishing card ---- */
/* .card carries no padding (tables span edge to edge by design), so the
   status line and the paste form get the same wrapper treatment as
   .analysispanel — without it they sat flush against the card border. */
.phishpanel {
  padding: 0 20px 16px;
}

/* Capped like .analysispanel .meta: the per-account status lines can run long,
   and full-width 12px text is hard to scan. */
.phishpanel .meta {
  margin: 0 0 12px;
  max-width: 80ch;
}

/* The manual-submission form: a column (the body wants full width), with the
   button row reusing .orgform's flex. Inputs follow the same convention as
   .orgform inputs above — var(--bg) fill, var(--text) ink — so the form reads
   as native to the panel rather than a foreign insert. */
.phishform {
  display: flex;
  flex-direction: column;
  gap: 8px;
  max-width: 720px;
}

.phishform input,
.phishform textarea {
  width: 100%;
  box-sizing: border-box;
  padding: 8px 10px;
  border: 1px solid var(--border);
  border-radius: 8px;
  background: var(--bg);
  color: var(--text);
  font-size: 13px;
  font-family: inherit;
}

.phishform textarea {
  resize: vertical;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 12px;
}

.phishform input:focus,
.phishform textarea:focus {
  outline: none;
  border-color: var(--accent);
}

/* .cmdmsg is shaped for the card-head row (20px side padding); inside the
   form's button row that spacing reads as a gap. It lines up with the button
   and takes the remaining width instead. */
.phishform .cmdmsg {
  padding: 0;
  min-height: 0;
  align-self: center;
  flex: 1;
}

/* An unjudged message is neither good nor bad news yet — muted, never green. */
.badge.unanalyzed {
  background: rgba(139, 145, 163, 0.16);
  color: var(--muted);
}

/* Verdict rows open the drawer, like the scan rows do. */
#phishingTable tbody tr {
  cursor: pointer;
}

.wrapcell {
  max-width: 260px;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}

/* Indicator lists and the stored body excerpt in the drawer. */
ul.indicators {
  margin: 6px 0 10px;
  padding-left: 20px;
}

ul.indicators li {
  margin: 3px 0;
}

pre.snippet {
  max-height: 320px;
  overflow: auto;
  white-space: pre-wrap;
  word-break: break-all;
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 10px;
  font-size: 12px;
}