/* Terraformation palette, taken from the tokens published on
   terraformation.com rather than eyeballed, so this stays recognisably the
   same brand as everything else the team uses.

   Layout follows Sophos Central - dark rail, light content, dense table -
   because operators move between the two tools all day and a familiar shape
   is worth more than a distinctive one.

   Fonts are a system stack rather than a webfont: the VM should keep working
   with egress locked down, and the same reasoning already applies to the
   vendored htmx. */
:root {
  --forest:        #1a5035;
  --forest-dark:   #143f2a;
  --forest-light:  #244d34;
  --green:         #339966;
  --green-hover:   #2c905e;
  --green-wash:    #f2f8f4;
  --seedling:      #8ac656;
  --accent:        #ef7048;

  --ink:           #1d1d1f;
  --body:          #3a4445;
  --muted:         #737373;
  --faint:         #a9b7b8;

  --bg:            #f6f7f8;
  --surface:       #ffffff;
  --rule:          #e2e6e5;
  --rule-soft:     #eef1f0;

  --danger:        #c0392b;
  --danger-wash:   #fdf2f0;
  --warn:          #b7791f;
  --warn-wash:     #fdf8ec;
  --ok:            #2c905e;
  --ok-wash:       #f0f8f3;

  --rail: 232px;
  --shadow: 0 1px 2px rgba(20,63,42,.06), 0 1px 3px rgba(20,63,42,.04);
}

* { box-sizing: border-box; }
html, body { height: 100%; }
body {
  margin: 0;
  background: var(--bg);
  color: var(--body);
  font: 14px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Inter, Heebo,
        Roboto, "Helvetica Neue", Arial, sans-serif;
  -webkit-font-smoothing: antialiased;
}
a { color: var(--green); text-decoration: none; }
a:hover { text-decoration: underline; }
h1 { font-size: 20px; font-weight: 600; color: var(--ink); margin: 0 0 4px; letter-spacing: -.01em; }
h2 { font-size: 13px; font-weight: 600; color: var(--ink); margin: 0 0 10px;
     text-transform: uppercase; letter-spacing: .06em; }
.sub { color: var(--muted); font-size: 13px; margin: 0 0 20px; }
.muted { color: var(--muted); }

/* ---------- shell ---------- */
.shell { display: grid; grid-template-columns: var(--rail) 1fr; min-height: 100vh; }

.rail { background: var(--forest); color: #fff; display: flex; flex-direction: column; }
.rail .brand {
  padding: 18px 20px; font-size: 15px; font-weight: 700; letter-spacing: .02em;
  border-bottom: 1px solid rgba(255,255,255,.1); display: flex; align-items: center; gap: 9px;
}
.rail .brand .dot { width: 8px; height: 8px; border-radius: 50%; background: var(--seedling); }
.rail nav { padding: 10px 0; flex: 1; }
.rail nav a {
  display: flex; align-items: center; justify-content: space-between; gap: 8px;
  padding: 9px 20px; color: rgba(255,255,255,.82); font-size: 14px; border-left: 3px solid transparent;
}
.rail nav a:hover { background: rgba(255,255,255,.07); color: #fff; text-decoration: none; }
.rail nav a.on { background: var(--forest-light); color: #fff; border-left-color: var(--seedling); font-weight: 500; }
.rail nav .group {
  padding: 16px 20px 6px; font-size: 11px; text-transform: uppercase;
  letter-spacing: .08em; color: rgba(255,255,255,.45);
}
.rail nav .count {
  background: rgba(255,255,255,.16); border-radius: 10px; padding: 1px 7px; font-size: 11px;
}
.rail nav a.on .count { background: rgba(0,0,0,.22); }
.rail .who { padding: 14px 20px; border-top: 1px solid rgba(255,255,255,.1); font-size: 12px; }
.rail .who .email { color: #fff; word-break: break-all; }
.rail .who .role { color: rgba(255,255,255,.55); text-transform: uppercase; letter-spacing: .05em; font-size: 10px; }
.rail .who a { color: rgba(255,255,255,.7); font-size: 12px; }

.main { min-width: 0; display: flex; flex-direction: column; }
.topbar {
  background: var(--surface); border-bottom: 1px solid var(--rule);
  padding: 16px 28px; display: flex; align-items: baseline; gap: 14px;
}
.content { padding: 24px 28px 60px; }

/* ---------- cards & tables ---------- */
.card {
  background: var(--surface); border: 1px solid var(--rule);
  border-radius: 8px; box-shadow: var(--shadow); margin-bottom: 20px;
}
.card > header {
  padding: 13px 18px; border-bottom: 1px solid var(--rule-soft);
  display: flex; align-items: center; justify-content: space-between;
}
.card > header h2 { margin: 0; }
.card .body { padding: 18px; }

.stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px,1fr)); gap: 14px; margin-bottom: 22px; }
.stat { background: var(--surface); border: 1px solid var(--rule); border-radius: 8px;
        padding: 14px 16px; box-shadow: var(--shadow); }
.stat .n { font-size: 26px; font-weight: 600; color: var(--ink); line-height: 1.1; }
.stat .n.bad { color: var(--danger); }
.stat .n.warn { color: var(--warn); }
.stat .l { font-size: 11px; text-transform: uppercase; letter-spacing: .06em; color: var(--muted); margin-top: 4px; }

table { width: 100%; border-collapse: collapse; font-size: 13.5px; }
thead th {
  text-align: left; padding: 9px 14px; background: #fafbfb;
  border-bottom: 1px solid var(--rule); color: var(--muted);
  font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: .06em;
  position: sticky; top: 0;
}
tbody td { padding: 11px 14px; border-bottom: 1px solid var(--rule-soft); vertical-align: middle; }
tbody tr:hover { background: var(--green-wash); }
tbody tr:focus { outline: 2px solid var(--green); outline-offset: -2px; background: var(--green-wash); }
tbody tr:last-child td { border-bottom: none; }
td.nowrap, th.nowrap { white-space: nowrap; }
td.num { font-variant-numeric: tabular-nums; }

/* ---------- verdicts ---------- */
.v { display: inline-block; padding: 2px 9px; border-radius: 4px; font-size: 11px;
     font-weight: 600; text-transform: uppercase; letter-spacing: .04em; white-space: nowrap; }
.v-spoofed_self, .v-spoofed_partner, .v-impersonation { background: var(--danger-wash); color: var(--danger); }
.v-review_high  { background: var(--warn-wash); color: var(--warn); }
.v-review_low, .v-unknown { background: #f1f3f4; color: var(--muted); }
.v-auto_allow   { background: var(--ok-wash); color: var(--ok); }

.badge { display: inline-block; padding: 1px 8px; border-radius: 4px; font-size: 11px; font-weight: 600; }
.badge.block { background: var(--danger-wash); color: var(--danger); }
.badge.allow { background: var(--ok-wash); color: var(--ok); }
.badge.admin { background: var(--green-wash); color: var(--forest); }
.badge.triager { background: #f1f3f4; color: var(--body); }
.badge.viewer { background: #f1f3f4; color: var(--muted); }

/* ---------- controls ---------- */
button, .btn {
  font: inherit; font-size: 13px; padding: 6px 12px; border-radius: 6px;
  border: 1px solid var(--rule); background: var(--surface); color: var(--body);
  cursor: pointer; white-space: nowrap;
}
button:hover, .btn:hover { border-color: var(--faint); background: #fbfcfc; text-decoration: none; }
button.primary, .btn.primary { background: var(--green); border-color: var(--green); color: #fff; font-weight: 500; }
button.primary:hover, .btn.primary:hover { background: var(--green-hover); border-color: var(--green-hover); }
button.danger { color: var(--danger); }
button.danger:hover { background: var(--danger-wash); border-color: var(--danger); }
button:disabled { opacity: .45; cursor: not-allowed; }
.actions { display: flex; gap: 6px; }

input[type=text], input[type=search], input:not([type]), select {
  font: inherit; font-size: 13.5px; padding: 7px 11px; border: 1px solid var(--rule);
  border-radius: 6px; background: var(--surface); color: var(--ink);
}
input:focus, select:focus { outline: none; border-color: var(--green); box-shadow: 0 0 0 3px rgba(51,153,102,.13); }
form.inline { display: flex; gap: 8px; flex-wrap: wrap; align-items: center; }

kbd {
  font: inherit; font-size: 11px; padding: 1px 5px; border: 1px solid var(--rule);
  border-bottom-width: 2px; border-radius: 4px; background: var(--surface); color: var(--body);
}

/* ---------- notices ---------- */
.notice { border-radius: 8px; padding: 12px 16px; margin-bottom: 18px; font-size: 13.5px;
          border: 1px solid; }
.notice.warn { background: var(--warn-wash); border-color: #f0dfb8; color: #7a5510; }
.notice.bad  { background: var(--danger-wash); border-color: #f2ccc6; color: #922b21; }
.notice.info { background: var(--green-wash); border-color: #cfe6da; color: var(--forest); }
.notice strong { font-weight: 600; }

/* ---------- message detail ---------- */
.panels { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px,1fr)); gap: 18px; margin-bottom: 20px; }
table.kv { font-size: 13px; }
table.kv td { border: none; padding: 4px 10px 4px 0; }
table.kv td:first-child { color: var(--muted); width: 108px; white-space: nowrap; }
.reasons { list-style: none; padding: 0; margin: 0; font-size: 13px; }
.reasons li { padding: 8px 0; border-bottom: 1px solid var(--rule-soft); }
.reasons li:last-child { border-bottom: none; }
.reasons .src {
  display: inline-block; min-width: 74px; color: var(--muted);
  font-size: 10px; text-transform: uppercase; letter-spacing: .06em; font-weight: 600;
}
.warnflag { color: var(--warn); font-weight: 600; font-size: 12px; }
pre { background: #fafbfb; border: 1px solid var(--rule-soft); border-radius: 6px;
      padding: 14px; overflow: auto; max-height: 420px; font-size: 12.5px;
      white-space: pre-wrap; word-break: break-word; color: var(--body); }

/* ---------- login ---------- */
.login-wrap { display: grid; place-items: center; min-height: 100vh; background: var(--forest); }
.login {
  background: var(--surface); border-radius: 12px; padding: 40px 44px;
  width: min(420px, 92vw); text-align: center; box-shadow: 0 10px 40px rgba(0,0,0,.2);
}
.login h1 { font-size: 22px; margin-bottom: 6px; }
.login .btn { display: inline-block; margin-top: 22px; padding: 10px 20px; }

/* Evidence is colour-coded by weight so the eye lands on what decided the
   verdict. A long list of equally-grey lines reads as undifferentiated noise,
   and the operator ends up trusting the badge instead of the reasoning. */
.reasons li { display: flex; gap: 10px; align-items: baseline;
              border-left: 3px solid transparent; padding-left: 10px; }
.reasons li.sev-high   { border-left-color: var(--danger); }
.reasons li.sev-medium { border-left-color: var(--warn); }
.reasons li.sev-low    { border-left-color: var(--faint); }
.reasons li.sev-info   { border-left-color: transparent; }
.reasons .w {
  margin-left: auto; font-variant-numeric: tabular-nums; font-size: 11px;
  font-weight: 600; padding: 1px 6px; border-radius: 4px; white-space: nowrap;
}
.reasons li.sev-high   .w { background: var(--danger-wash); color: var(--danger); }
.reasons li.sev-medium .w { background: var(--warn-wash); color: var(--warn); }
.reasons li.sev-low    .w { background: #f1f3f4; color: var(--muted); }
.reasons li .text { flex: 1; }

/* The IP-block callout needs to read differently from a normal action - it is
   a different kind of rule and the operator should notice. */
.ipblock { background: var(--warn-wash); border: 1px solid #f0dfb8; border-radius: 8px;
           padding: 12px 16px; margin-bottom: 14px; font-size: 13.5px; color: #7a5510; }
.ipblock code { background: rgba(0,0,0,.06); padding: 1px 5px; border-radius: 3px; }

/* Identity fields carry the severity of whatever contradicts them. Stating a
   forged From address in the same grey as the recipient makes a forgery read
   as ordinary metadata, and at message forty of fifty nobody re-derives the
   contradiction - they scan for what looks wrong. */
table.kv td.val { position: relative; }
.f-bad  { color: var(--danger); font-weight: 500; }
.f-warn { color: var(--warn); }
.f-ok   { color: var(--ok); }
.f-info { color: var(--muted); }
.f-bad .mark, .f-warn .mark, .f-ok .mark {
  display: inline-block; margin-left: 6px; font-size: 10px; font-weight: 700;
  padding: 0 5px; border-radius: 3px; vertical-align: 1px;
}
.f-bad .mark  { background: var(--danger-wash); color: var(--danger); }
.f-warn .mark { background: var(--warn-wash); color: var(--warn); }
.f-ok .mark   { background: var(--ok-wash); color: var(--ok); }
.why {
  display: block; font-size: 11.5px; line-height: 1.45; color: var(--muted);
  font-weight: 400; margin-top: 2px;
}

/* A list meant to be copied into another system's UI, not downloaded. */
textarea.copyable {
  width: 100%; font: 13px/1.6 ui-monospace, SFMono-Regular, Menlo, monospace;
  padding: 10px 12px; border: 1px solid var(--rule); border-radius: 6px;
  background: #fafbfb; color: var(--ink); resize: vertical;
}
textarea.copyable:focus { outline: none; border-color: var(--green); }
.card > header form { margin: 0; }