/*!
 * Mashtu app overlay stylesheet.
 *
 * A THIN, app-specific overlay layered on top of the vendored Pico.css v2 base
 * (served alongside this file from the same `/css` surface; the shell links Pico
 * FIRST, then this). Pico supplies the design system — typography, body frame,
 * tables, forms, buttons, the definition list — classlessly from the semantic
 * HTML the shell and the client module emit, so this file no longer carries a
 * reset, typography/surface utilities, or base element rules that would fight
 * Pico. It keeps ONLY what Pico does not provide: the APPLICATION SHELL LAYOUT
 * (the left sidebar + top bar grid and the constrained <main>, which Pico has
 * no opinion about), the client-side quick-find's `.filtered-hidden` row toggle,
 * the Overview landing's count tiles, the lifecycle phase badge, the hand-drawn
 * MTU-distribution SVG chart + its legend, and the scan-start form row.
 *
 * It is intentionally self-hosted (no @import, no url(), no external font) so it
 * can be served under a `style-src 'self'` Content-Security-Policy with no other
 * relaxations. Colours reuse Pico's CSS custom properties where a semantic token
 * exists, so the overlay follows Pico's light/dark auto theme; the chart's
 * categorical palette is fixed (the four MTU-boundary outcomes need stable,
 * meaning-bearing colours regardless of theme).
 */

/* --- Application shell: left sidebar + top bar + constrained content --------
 * The core fix for the full-bleed problem (ui-layout-direction-note-2026-10-12):
 * a persistent left-nav + a top bar wrapping a constrained, padded <main>. A CSS
 * grid gives a fixed sidebar column beside a fluid content column; the content
 * column caps its <main> at a readable measure so views are no longer edge-to-
 * edge. All colours/spacing reuse Pico custom properties so the shell follows
 * Pico's light/dark auto theme; no inline styles anywhere (CSP style-src 'self').
 */
.app-shell {
  display: grid;
  grid-template-columns: 15rem 1fr;
  min-height: 100vh;
}

.sidebar {
  display: flex;
  flex-direction: column;
  gap: 1rem;
  padding: 1rem 0.75rem;
  border-right: 1px solid var(--pico-muted-border-color);
  background-color: var(--pico-card-background-color);
}

.sidebar .brand {
  padding: 0.25rem 0.5rem;
}

.sidebar .brand h1 {
  font-size: 1.125rem;
  margin: 0;
}

.sidebar nav {
  display: flex;
  flex-direction: column;
  gap: 1rem;
}

.nav-group {
  list-style: none;
  margin: 0;
  padding: 0;
  display: flex;
  flex-direction: column;
  gap: 0.125rem;
}

/* A nav row: icon + label, comfortable hit area, hover/active affordance. */
.nav-link {
  display: flex;
  align-items: center;
  gap: 0.625rem;
  padding: 0.5rem 0.625rem;
  border-radius: var(--pico-border-radius);
  color: var(--pico-color);
  text-decoration: none;
  font-weight: 500;
  line-height: 1.2;
}

.nav-link:hover,
.nav-link:focus-visible {
  background-color: var(--pico-secondary-background, var(--pico-muted-border-color));
  text-decoration: none;
}

/* The active (current-route) item: a tinted pill + the Pico primary accent. */
.nav-link.active,
.nav-link[aria-current="page"] {
  background-color: var(--pico-primary-background);
  color: var(--pico-primary-inverse);
}

.nav-icon {
  flex: 0 0 auto;
  width: 1rem;
  height: 1rem;
  fill: currentColor;
}

.nav-label {
  flex: 1 1 auto;
}

.content-col {
  display: flex;
  flex-direction: column;
  min-width: 0; /* let the column shrink so <main>'s max-width governs, not content */
}

/* The top bar: sticky, holding the search affordance and the server status. */
.topbar {
  position: sticky;
  top: 0;
  z-index: 10;
  display: flex;
  align-items: center;
  gap: 1rem;
  flex-wrap: wrap;
  padding: 0.75rem 1.5rem;
  border-bottom: 1px solid var(--pico-muted-border-color);
  background-color: var(--pico-background-color);
}

/* The quick-find search cluster (grows to take the free space in the bar). */
.topsearch {
  display: flex;
  align-items: center;
  gap: 0.5rem;
  flex: 1 1 20rem;
  margin: 0;
}

.topsearch input[type="search"] {
  flex: 1 1 auto;
  min-width: 8rem;
  margin-bottom: 0;
}

/* The ⌘K keyboard hint shown beside the search box. */
.kbd-hint {
  flex: 0 0 auto;
  font-size: 0.75rem;
  padding: 0.1rem 0.4rem;
  border-radius: var(--pico-border-radius);
  border: 1px solid var(--pico-muted-border-color);
  color: var(--pico-muted-color);
  background-color: var(--pico-card-background-color);
}

/* The honest scope note next to the search box. */
.search-scope {
  flex: 0 0 auto;
  color: var(--pico-muted-color);
}

/* The server-name/time status, pushed to the right of the top bar. */
.server-status {
  display: flex;
  align-items: baseline;
  gap: 0.25rem 0.75rem;
  flex-wrap: wrap;
  margin: 0;
  margin-left: auto;
  font-size: 0.8125rem;
  color: var(--pico-muted-color);
}

.server-status dt {
  font-weight: 600;
}

.server-status dt,
.server-status dd {
  margin: 0;
  display: inline;
}

.server-status dt::after {
  content: ":";
}

/* The constrained content region — no longer full-bleed. A readable max-width
 * with generous padding; this is the central layout fix. */
#app {
  width: 100%;
  max-width: 72rem;
  margin: 0 auto;
  padding: 1.5rem;
}

/* A row hidden by the client-side quick-find filter (toggled, never inline). */
.filtered-hidden {
  display: none;
}

/* --- Login view (chrome-free centered card) --------------------------------
 * The unauthenticated login renders in its OWN top-level `#login-view`
 * container (a sibling of `.app-shell`, which stays hidden pre-auth), so there
 * is NO sidebar/topbar chrome. This host grid centers a single bounded card on
 * an otherwise-empty viewport (DigitalOcean / Cloudflare / GitHub style). All
 * colours reuse Pico custom properties (light/dark auto preserved); no inline
 * styles, no @import/url()/external font — `style-src 'self'`-clean.
 */
.login-view {
  display: grid;
  place-items: center;
  min-height: 100vh;
  padding: 1.5rem;
}

/* The bounded card: ~360px (420px ceiling acceptable), centered by the host
 * grid, a quiet bordered surface. */
.login-card {
  width: 100%;
  max-width: 22.5rem; /* ~360px */
  display: flex;
  flex-direction: column;
  gap: 1rem;
  padding: 1.5rem 1.75rem;
  border: 1px solid var(--pico-muted-border-color);
  border-radius: var(--pico-border-radius);
  background-color: var(--pico-card-background-color);
}

/* The brand/title block at the top of the card. */
.login-brand {
  display: flex;
  align-items: center;
  gap: 0.5rem;
}

.login-brand h1 {
  margin: 0;
  font-size: 1.25rem;
}

/* The form: label-above-input stacking (Pico's natural flow), inputs + button
 * sized to the CARD, not the viewport. */
.login-form {
  display: flex;
  flex-direction: column;
  gap: 0.5rem;
  margin: 0;
}

.login-form input {
  width: 100%;
  margin-bottom: 0;
}

/* A prominent primary Sign-in button the full width of the card (Pico styles a
 * bare <button> as the primary accent). */
.login-form button {
  width: 100%;
}

/* A subtle status/error line WITHIN the card (reusing the shared `.error`
 * colour), not a stray full-width line. */
.login-status {
  margin: 0;
  font-size: 0.875rem;
}

/* On a very narrow viewport let the card use the full width. */
@media (max-width: 30rem) {
  .login-card {
    max-width: 100%;
  }
}

/* --- Overview landing ------------------------------------------------------
 * The summarize-then-drill home: a small grid of count tiles + a recent-runs
 * list + quick links. NOT a map (operator hard NO). Minimal this increment.
 */
.overview-counts {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(10rem, 1fr));
  gap: 1rem;
  margin: 1rem 0;
  padding: 0;
  list-style: none;
}

.count-tile {
  padding: 1rem;
  border: 1px solid var(--pico-muted-border-color);
  border-radius: var(--pico-border-radius);
  background-color: var(--pico-card-background-color);
}

.count-tile .count-value {
  display: block;
  font-size: 1.75rem;
  font-weight: 700;
  line-height: 1.1;
}

.count-tile .count-label {
  display: block;
  color: var(--pico-muted-color);
  font-size: 0.875rem;
}

.quick-links {
  display: flex;
  flex-wrap: wrap;
  gap: 0.75rem;
  margin-top: 1rem;
}

/* --- Responsive: stack the sidebar above the content on narrow viewports ---- */
@media (max-width: 48rem) {
  .app-shell {
    grid-template-columns: 1fr;
  }

  .sidebar {
    border-right: none;
    border-bottom: 1px solid var(--pico-muted-border-color);
  }

  .sidebar nav {
    flex-direction: row;
    flex-wrap: wrap;
  }

  .nav-group {
    flex-direction: row;
    flex-wrap: wrap;
  }

  .server-status {
    margin-left: 0;
  }

  #app {
    padding: 1rem;
  }
}

/* --- Monospace helper -------------------------------------------------------
 * The shell/module never adds a utility-class vocabulary, but a monospace run of
 * identifiers reads better in Pico's font stack; expose one small opt-in class.
 */
.font-mono {
  font-family: var(--pico-font-family-monospace);
}

/* --- Phase badge (live scan-progress view) ---------------------------------
 * A small pill whose colour reflects the lifecycle phase. Toggled by class only
 * (never an inline style), self-hosted colours, so it stays under
 * `style-src 'self'`.
 */
.badge {
  display: inline-block;
  padding: 0.125rem 0.5rem;
  border-radius: var(--pico-border-radius);
  font-size: 0.75rem;
  font-weight: 600;
  color: #1e293b; /* slate-800 */
  background-color: #e2e8f0; /* slate-200 (default/queued) */
}

.badge.phase-resolving {
  background-color: #fef9c3; /* yellow-100 */
  color: #854d0e; /* yellow-800 */
}

.badge.phase-running {
  background-color: #dbeafe; /* blue-100 */
  color: #1e40af; /* blue-800 */
}

.badge.phase-completed {
  background-color: #dcfce7; /* green-100 */
  color: #166534; /* green-800 */
}

.badge.phase-failed {
  background-color: #fee2e2; /* red-100 */
  color: #991b1b; /* red-800 */
}

.badge.phase-cancelled {
  background-color: #f1f5f9; /* slate-100 */
  color: #475569; /* slate-600 */
}

/* --- MTU-distribution chart (hand-drawn SVG) -------------------------------
 * One stacked bar per observed MTU. Every colour is set by CLASS here (never an
 * inline style/presentation attribute in the JS), so the chart stays under
 * `style-src 'self'` and a palette change is a one-line stylesheet edit.
 */
.mtu-chart {
  display: block;
  max-width: 100%;
  height: auto;
  margin-top: 1rem;
}

/* The four stacked segments — fill set via CSS so the JS carries no colours. */
.chart-seg {
  stroke: var(--pico-card-background-color, #ffffff);
  stroke-width: 1;
}

.seg-compliant {
  fill: #16a34a; /* green-600 — RFC-1191 compliant */
}

.seg-filtered {
  fill: #ca8a04; /* yellow-600 — filtered */
}

.seg-blackhole {
  fill: #dc2626; /* red-600 — silent-drop blackhole */
}

.seg-clean {
  fill: #2563eb; /* blue-600 — no boundary behaviour observed */
}

/* Axis, gridlines, and the numeric labels. */
.chart-axis {
  stroke: #334155; /* slate-700 */
  stroke-width: 1;
}

.chart-grid {
  stroke: #e2e8f0; /* slate-200 */
  stroke-width: 1;
}

.chart-ylabel,
.chart-xlabel {
  font-size: 0.75rem;
  fill: #64748b; /* slate-500 */
}

.chart-total {
  font-size: 0.75rem;
  font-weight: 600;
  fill: #334155; /* slate-700 */
}

/* The colour legend above the chart (semantic <ul>; swatch colour reuses the
 * same segment class as the chart). */
.chart-legend {
  list-style: none;
  display: flex;
  flex-wrap: wrap;
  gap: 1rem;
  padding: 0;
  margin: 1rem 0 0;
  font-size: 0.875rem;
}

.legend-item {
  display: flex;
  align-items: center;
  gap: 0.375rem;
}

.legend-swatch {
  display: inline-block;
  width: 0.875rem;
  height: 0.875rem;
  border-radius: 0.125rem;
}

/* The swatch reuses the segment fill as a background-color. */
.legend-swatch.seg-compliant {
  background-color: #16a34a;
}

.legend-swatch.seg-filtered {
  background-color: #ca8a04;
}

.legend-swatch.seg-blackhole {
  background-color: #dc2626;
}

.legend-swatch.seg-clean {
  background-color: #2563eb;
}

/* --- Scan-start form -------------------------------------------------------
 * Pico stacks form controls full-width by default; the scan-start row is a
 * compact inline cluster (ASN / target-set / submit), so lay it out horizontally
 * and keep the inputs from stretching to full width.
 */
.scan-start {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.5rem;
  margin-top: 0.5rem;
  margin-bottom: 1rem;
}

.scan-start input {
  width: auto;
  margin-bottom: 0;
}

/* --- Admin-only Debug KB browser (read-only) ------------------------------ */
.debug-layout {
  display: grid;
  grid-template-columns: minmax(14rem, 20rem) 1fr;
  gap: 1rem;
  align-items: start;
}
.debug-table-list {
  list-style: none;
  margin: 0;
  padding: 0;
  border: 1px solid #e2e8f0; /* slate-200 */
  border-radius: 0.375rem;
  overflow: auto;
  max-height: 70vh;
}
.debug-table-list li {
  padding: 0;
  border-bottom: 1px solid #f1f5f9; /* slate-100 */
}
.debug-table-list li.active {
  background: #eff6ff; /* blue-50 */
}
.debug-table-list a {
  display: block;
  padding: 0.4rem 0.6rem;
  text-decoration: none;
  font-size: 0.85rem;
}
.debug-kind {
  color: #64748b; /* slate-500 */
  font-size: 0.75rem;
}
.debug-rowcount {
  color: #64748b; /* slate-500 */
  font-size: 0.75rem;
}
.debug-detail {
  min-width: 0;
}
.debug-sql {
  white-space: pre-wrap;
  word-break: break-word;
  background: #f8fafc; /* slate-50 */
  padding: 0.5rem;
  border-radius: 0.375rem;
  font-size: 0.8rem;
}
.debug-filter {
  display: flex;
  gap: 0.5rem;
  flex-wrap: wrap;
  align-items: center;
  margin: 0.75rem 0;
}
.debug-filter select,
.debug-filter input {
  width: auto;
  margin-bottom: 0;
}
.debug-rows {
  display: block;
  overflow-x: auto;
  font-size: 0.8rem;
}
.debug-sort {
  background: none;
  border: none;
  padding: 0;
  margin: 0;
  font: inherit;
  font-weight: 600;
  cursor: pointer;
  color: inherit;
}
.debug-pager {
  display: flex;
  gap: 0.5rem;
  align-items: center;
  margin-top: 0.75rem;
}
.debug-total {
  color: #64748b; /* slate-500 */
  font-size: 0.8rem;
}