/* dark fiber admin console
 * ---------------------------------------------------------------------------
 * One stylesheet, served from the jar at /static/app.css. No CDN, no webfont,
 * no build step: the portal must render identically on a box with no route to
 * the internet, and the CSP is `default-src 'self'`.
 *
 * Archetype: restrained "dark future". The console is read at 2am by someone
 * deciding whether a human gets an account, so: near-black ground, one cold
 * accent, data in monospace, and colour reserved for state. Glow is used only
 * on focus and on the single primary action of a page.
 */

:root {
  color-scheme: dark;

  --bg:        #07080b;
  --bg-grad:   radial-gradient(120% 80% at 50% -20%, #101724 0%, #07080b 62%);
  --surface:   #0f1116;
  --surface-2: #151822;
  --surface-3: #1b1f2b;
  --line:      #232838;
  --line-soft: #1a1e29;

  --fg:        #e7eaf1;
  --fg-muted:  #98a1b5;
  /* DF-2026-016: was #626c81, which measured 3.12-3.80:1 on the four surfaces below and so
   * failed WCAG 1.4.3 (4.5:1) for the 10-13px labels that use it. #828da3 measures 4.92:1 on
   * the lightest of them (--surface-3, the badge/row-hover ground) and 6.00:1 on --bg, while
   * staying a clear step below --fg-muted. Any new value here must keep >=4.5:1 against ALL of
   * --bg / --surface / --surface-2 / --surface-3; PortalStyleContrastTest enforces that. */
  --fg-dim:    #828da3;

  --accent:      #35e0c8;
  --accent-ink:  #04120f;
  --accent-soft: rgba(53, 224, 200, 0.12);
  --accent-line: rgba(53, 224, 200, 0.38);

  --ok:    #7ee787;
  --warn:  #f0b429;
  --crit:  #ff6b6b;
  --info:  #7c8cff;

  --r-sm: 6px;
  --r-md: 10px;
  --r-lg: 14px;

  --s-1: 4px;  --s-2: 8px;  --s-3: 12px; --s-4: 16px;
  --s-5: 24px; --s-6: 32px; --s-7: 48px; --s-8: 64px;

  --sans: ui-sans-serif, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
  --mono: ui-monospace, "SF Mono", SFMono-Regular, "JetBrains Mono", Menlo, Consolas, monospace;

  --shadow: 0 1px 2px rgba(0,0,0,.4), 0 8px 24px rgba(0,0,0,.35);
}

*, *::before, *::after { box-sizing: border-box; }

html { -webkit-text-size-adjust: 100%; }

body {
  margin: 0;
  min-height: 100vh;
  background: var(--bg);
  background-image: var(--bg-grad);
  background-attachment: fixed;
  color: var(--fg);
  font-family: var(--sans);
  font-size: 14px;
  line-height: 1.55;
  -webkit-font-smoothing: antialiased;
}

a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }

:focus-visible {
  outline: 2px solid var(--accent);
  outline-offset: 2px;
  border-radius: 3px;
}

.skip {
  position: absolute; left: -9999px; top: 0; z-index: 100;
  background: var(--accent); color: var(--accent-ink);
  padding: var(--s-2) var(--s-4); border-radius: 0 0 var(--r-sm) 0;
}
.skip:focus { left: 0; }

/* ---- shell ------------------------------------------------------------- */

.shell { display: grid; grid-template-columns: 232px minmax(0, 1fr); min-height: 100vh; }

.rail {
  border-right: 1px solid var(--line-soft);
  background: linear-gradient(180deg, rgba(21,24,34,.9), rgba(15,17,22,.6));
  padding: var(--s-5) var(--s-4);
  display: flex; flex-direction: column; gap: var(--s-5);
  position: sticky; top: 0; height: 100vh;
}

.brand { display: flex; flex-direction: column; gap: 2px; }
.brand b {
  font-size: 15px; font-weight: 600; letter-spacing: .16em;
  text-transform: uppercase; color: var(--fg);
}
.brand b::before {
  content: ""; display: inline-block; width: 8px; height: 8px; margin-right: 9px;
  border-radius: 50%; background: var(--accent);
  box-shadow: 0 0 10px var(--accent-line); vertical-align: middle;
}
.brand span { font: 500 10px/1 var(--mono); letter-spacing: .22em; color: var(--fg-dim); text-transform: uppercase; }

.nav { display: flex; flex-direction: column; gap: 2px; }
.nav a {
  display: block; padding: 9px var(--s-3); border-radius: var(--r-sm);
  color: var(--fg-muted); font-weight: 500; border-left: 2px solid transparent;
}
.nav a:hover { background: var(--surface-2); color: var(--fg); text-decoration: none; }
.nav a[aria-current="page"] {
  background: var(--accent-soft); color: var(--fg);
  border-left-color: var(--accent);
}

.rail-foot { margin-top: auto; display: flex; flex-direction: column; gap: var(--s-2); }
.whoami { font: 500 12px/1.4 var(--mono); color: var(--fg-dim); word-break: break-all; }

main { padding: var(--s-6) var(--s-6) var(--s-8); min-width: 0; }
.wrap { max-width: 1180px; margin: 0 auto; }

.page-head {
  display: flex; align-items: flex-end; justify-content: space-between;
  gap: var(--s-4); flex-wrap: wrap; margin-bottom: var(--s-5);
}
h1 { font-size: 22px; font-weight: 600; letter-spacing: -0.01em; margin: 0; }
h2 { font-size: 15px; font-weight: 600; margin: 0 0 var(--s-3); }
.eyebrow {
  font: 600 10px/1 var(--mono); letter-spacing: .22em; text-transform: uppercase;
  color: var(--fg-dim); margin-bottom: 6px;
}
.sub { color: var(--fg-muted); margin: 4px 0 0; }

/* ---- surfaces ---------------------------------------------------------- */

.card {
  background: var(--surface); border: 1px solid var(--line-soft);
  border-radius: var(--r-md); padding: var(--s-5); box-shadow: var(--shadow);
}
.card + .card { margin-top: var(--s-4); }
.grid { display: grid; gap: var(--s-4); }
.grid.two { grid-template-columns: minmax(0, 1fr) minmax(0, 1fr); }
.grid.side { grid-template-columns: minmax(0, 1.6fr) minmax(280px, 1fr); }

.banner {
  border: 1px solid var(--line); border-left-width: 3px;
  border-radius: var(--r-sm); padding: var(--s-3) var(--s-4);
  background: var(--surface-2); margin-bottom: var(--s-4);
}
.banner.warn { border-left-color: var(--warn); }
.banner.crit { border-left-color: var(--crit); }
.banner.ok   { border-left-color: var(--ok); }
.banner b { display: block; margin-bottom: 2px; }
.banner p { margin: 0; color: var(--fg-muted); }

/* The bot-offline alarm. Deliberately NOT just `.banner.crit` with different words: a dropped
 * invite is invisible everywhere else in the console -- the admin is told "invite created" and
 * the sponsor is never told anything -- so this one gets a tinted ground, a live state pill and
 * the only pulsing element in the product. One pulse in the whole UI is what keeps it reading as
 * an alarm rather than as decoration. (The global prefers-reduced-motion rule at the bottom of
 * this file turns the animation off; the colour and the pill carry it on their own.) */

.banner.alarm {
  display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 2px var(--s-3);
  align-items: start; padding: var(--s-4);
  border-color: rgba(255,107,107,.30); border-left-color: var(--crit);
  background:
    linear-gradient(90deg, rgba(255,107,107,.10), rgba(255,107,107,0) 44%),
    var(--surface-2);
}
.banner.alarm .dot {
  width: 9px; height: 9px; margin-top: 7px; border-radius: 50%;
  background: var(--crit); animation: alarm-pulse 2.4s ease-out infinite;
}
@keyframes alarm-pulse {
  0%   { box-shadow: 0 0 0 0 rgba(255,107,107,.55); }
  70%  { box-shadow: 0 0 0 7px rgba(255,107,107,0); }
  100% { box-shadow: 0 0 0 0 rgba(255,107,107,0); }
}
.banner.alarm > b {
  display: flex; flex-wrap: wrap; align-items: center; gap: var(--s-3);
  margin: 0 0 2px; color: var(--fg);
}
.banner.alarm > b > .badge { color: var(--crit); border-color: rgba(255,107,107,.35); }
.banner.alarm > p { grid-column: 2; }
.banner.alarm > p b { color: var(--fg); }

/* The DURESS alarm: an operator was coerced into unlocking their device. It has to outrank the
 * bot-offline alarm above -- that one means invites are not being delivered, this one means a
 * person is in danger right now -- so it escalates the SAME crit hue rather than inventing a
 * second red the palette would have to argue with. What escalates: a solid 4px rail instead of a
 * hairline, a ground tint carried the full width instead of fading out at 44%, and the alarm dot.
 * It inherits the .banner.alarm grid, so only the differences are declared here. */

.banner.duress {
  display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 2px var(--s-3);
  align-items: start; padding: var(--s-4);
  border-color: rgba(255,107,107,.55); border-left-width: 4px; border-left-color: var(--crit);
  background: linear-gradient(90deg, rgba(255,107,107,.16), rgba(255,107,107,.06)), var(--surface-2);
}
.banner.duress .dot {
  width: 9px; height: 9px; margin-top: 7px; border-radius: 50%;
  background: var(--crit); animation: alarm-pulse 2.4s ease-out infinite;
}
.banner.duress > b {
  margin: 0 0 2px; color: var(--crit);
  font: 700 13px/1.5 var(--mono); letter-spacing: .06em;
}
.banner.duress > p { grid-column: 2; }
.banner.duress > p a { color: var(--fg); }
/* Column 2 as well, so the button lines up under the sentence rather than under the dot. */
.banner.duress > .duress-ack { grid-column: 2; margin-top: var(--s-3); }

/* ---- data -------------------------------------------------------------- */

.scroll-x { overflow-x: auto; }

table { width: 100%; border-collapse: collapse; font-size: 13px; }
thead th {
  text-align: left; padding: 0 var(--s-3) var(--s-2); white-space: nowrap;
  font: 600 10px/1 var(--mono); letter-spacing: .16em; text-transform: uppercase;
  /* 10px uppercase: the smallest normal text in the console, so it takes the muted tier. */
  color: var(--fg-muted); border-bottom: 1px solid var(--line);
}
tbody td { padding: var(--s-3); border-bottom: 1px solid var(--line-soft); vertical-align: middle; }
tbody tr:hover td { background: var(--surface-2); }
td.num, .mono { font-family: var(--mono); font-size: 12.5px; }
td .name { font-weight: 600; display: flex; align-items: center; gap: var(--s-2); flex-wrap: wrap; }
td .meta { color: var(--fg-dim); font-size: 12px; }

.kv { display: grid; grid-template-columns: 132px minmax(0, 1fr); gap: 7px var(--s-4); margin: 0; }
.kv dt { color: var(--fg-muted); font: 600 10px/1.7 var(--mono); letter-spacing: .12em; text-transform: uppercase; }
.kv dd { margin: 0; font-family: var(--mono); font-size: 12.5px; word-break: break-all; }

.badge {
  display: inline-flex; align-items: center; gap: 6px; white-space: nowrap;
  padding: 3px 9px; border-radius: 999px; border: 1px solid var(--line);
  background: var(--surface-3); color: var(--fg-muted);
  font: 600 10px/1.6 var(--mono); letter-spacing: .1em; text-transform: uppercase;
}
.badge::before { content: ""; width: 6px; height: 6px; border-radius: 50%; background: currentColor; }
.badge.invited           { color: var(--info); }
.badge.scanned           { color: var(--warn); }
.badge.sponsor_confirmed { color: var(--accent); }
.badge.sponsor_rejected  { color: var(--crit); }
.badge.approved          { color: var(--ok); }
.badge.active            { color: var(--ok); }
.badge.revoked           { color: var(--crit); }
.badge.expired           { color: var(--fg-dim); }
.badge.disabled          { color: var(--fg-dim); }
.badge.passkey           { color: var(--info); }
.badge.hardware_2fa      { color: var(--accent); }
/* Not a status: a classification. It drops the status dot on purpose so one row never reads as
   carrying two states at once. */
.badge.service           { color: var(--fg-dim); }
.badge.service::before   { display: none; }

/* Dead-man's-switch states. `overdue` is the only badge in the console that is an ALARM rather
   than a status, so it is the only one that takes a filled ground and the alarm pulse: at 2am it
   has to be findable without reading. `unarmed` is deliberately the quietest badge here --
   most operators are not armed most of the time, and a console that shouts about all of them
   is a console nobody reads. */
.badge.armed             { color: var(--ok); }
.badge.blocked           { color: var(--warn); }
.badge.unarmed           { color: var(--fg-dim); }
.badge.overdue {
  color: var(--crit); border-color: rgba(255,107,107,.45); background: rgba(255,107,107,.12);
}
.badge.overdue::before { animation: alarm-pulse 2.4s ease-out infinite; }
/* The only badge louder than `overdue`: a filled crit ground rather than a tinted one, because
   it is the one row state that means a person is being coerced right now. */
.badge.duress {
  color: var(--crit); border-color: var(--crit); background: rgba(255,107,107,.22);
}
.badge.duress::before { animation: alarm-pulse 2.4s ease-out infinite; }

.liveness { display: flex; align-items: center; flex-wrap: wrap; gap: var(--s-3); margin: 0 0 var(--s-4); }
.liveness-note { color: var(--fg-dim); font-size: 12.5px; }

.timeline { list-style: none; margin: 0; padding: 0 0 0 var(--s-4); border-left: 1px solid var(--line); }
.timeline li { position: relative; padding: 0 0 var(--s-4) var(--s-4); }
.timeline li::before {
  content: ""; position: absolute; left: calc(-1 * var(--s-4) - 5px); top: 6px;
  width: 9px; height: 9px; border-radius: 50%;
  background: var(--surface-3); border: 1px solid var(--line);
}
.timeline li.done::before { background: var(--accent); border-color: var(--accent); }
.timeline b { display: block; font-size: 13px; }
.timeline time { font-family: var(--mono); font-size: 12px; color: var(--fg-dim); }

.qr { background: #fff; padding: var(--s-3); border-radius: var(--r-md); line-height: 0; display: inline-block; }
.qr img { width: 208px; height: 208px; image-rendering: pixelated; }

.token {
  display: block; font-family: var(--mono); font-size: 12px; word-break: break-all;
  background: #0a0c11; border: 1px solid var(--line); border-radius: var(--r-sm);
  padding: var(--s-3); color: var(--accent);
}

.empty { text-align: center; padding: var(--s-7) var(--s-4); color: var(--fg-dim); }

/* ---- controls ---------------------------------------------------------- */

.btn {
  display: inline-flex; align-items: center; justify-content: center; gap: 8px;
  min-height: 40px; padding: 0 var(--s-4); border-radius: var(--r-sm);
  border: 1px solid var(--line); background: var(--surface-3); color: var(--fg);
  font: 600 13px/1 var(--sans); cursor: pointer; text-decoration: none;
  transition: transform .12s ease, background .12s ease, border-color .12s ease;
}
.btn:hover:not(:disabled) { background: #222736; border-color: #2e3446; text-decoration: none; }
.btn:active:not(:disabled) { transform: translateY(1px); }
.btn:disabled { opacity: .38; cursor: not-allowed; }
.btn.primary {
  background: var(--accent); border-color: var(--accent); color: var(--accent-ink);
  box-shadow: 0 0 0 1px rgba(53,224,200,.18), 0 6px 22px rgba(53,224,200,.16);
}
.btn.primary:hover:not(:disabled) { background: #4bf0d8; border-color: #4bf0d8; }
.btn.danger { color: var(--crit); border-color: rgba(255,107,107,.35); }
.btn.danger:hover:not(:disabled) { background: rgba(255,107,107,.12); }
.btn.wide { width: 100%; }
.btn.sm { min-height: 32px; padding: 0 var(--s-3); font-size: 12px; }
/* Value plus its copy button on one line; wraps rather than overflowing a narrow card. */
.copy-row { display: flex; align-items: center; gap: var(--s-3); flex-wrap: wrap; }

.actions { display: flex; flex-wrap: wrap; gap: var(--s-2); }

.field { display: block; margin-bottom: var(--s-4); }
.field > span {
  display: block; margin-bottom: 6px;
  font: 600 10px/1 var(--mono); letter-spacing: .14em; text-transform: uppercase; color: var(--fg-muted);
}
.field .hint { display: block; margin-top: 6px; font-size: 12px; color: var(--fg-dim); text-transform: none; letter-spacing: 0; font-family: var(--sans); }

input[type=text], input[type=search], input[type=number], select, textarea {
  width: 100%; min-height: 40px; padding: 9px var(--s-3);
  background: #0a0c11; color: var(--fg);
  border: 1px solid var(--line); border-radius: var(--r-sm);
  font: 400 14px/1.5 var(--sans);
}
textarea { min-height: 168px; font: 400 13px/1.6 var(--mono); resize: vertical; }
input:focus, select:focus, textarea:focus {
  outline: none; border-color: var(--accent-line);
  box-shadow: 0 0 0 3px var(--accent-soft);
}
input::placeholder, textarea::placeholder { color: var(--fg-dim); }
select[multiple], select[size] { min-height: 168px; }

.row { display: flex; gap: var(--s-4); flex-wrap: wrap; align-items: flex-end; }
.row > .field { flex: 1 1 200px; margin-bottom: 0; }
/* Vertical rhythm between a .row and the field under it. A class, not an inline style:
   the CSP has no 'unsafe-inline', so a style attribute would simply be dropped. */
.gap { height: var(--s-4); }

.filters { display: flex; gap: var(--s-2); flex-wrap: wrap; align-items: center; margin-bottom: var(--s-4); }
.chip {
  padding: 6px var(--s-3); border-radius: 999px; border: 1px solid var(--line);
  background: var(--surface-2); color: var(--fg-muted); font-size: 12px; font-weight: 600;
}
.chip:hover { color: var(--fg); text-decoration: none; }
.chip[aria-current="true"] { background: var(--accent-soft); border-color: var(--accent-line); color: var(--fg); }

/* ---- danger zone ------------------------------------------------------- */
/* Deleting an enrolment cannot be undone, so the control is two-step and shut by
 * default: a <details>, not a modal. No script (the CSP has no 'unsafe-inline' and
 * this must work with JS off), and the closed state is the honest resting state --
 * the card announces the option without ever putting the button under the cursor. */

.card.danger { border-color: rgba(255,107,107,.28); }
.card.danger > h2 { color: var(--crit); }

.reveal > summary {
  display: inline-flex; align-items: center; gap: var(--s-2);
  min-height: 40px; padding: 0 var(--s-4); margin-top: var(--s-4);
  border: 1px solid rgba(255,107,107,.35); border-radius: var(--r-sm);
  color: var(--crit); font: 600 13px/1 var(--sans); cursor: pointer;
  list-style: none; user-select: none;
  transition: background .12s ease, border-color .12s ease;
}
.reveal > summary::-webkit-details-marker { display: none; }
.reveal > summary::before { content: "+"; font-family: var(--mono); font-size: 15px; line-height: 1; }
.reveal[open] > summary::before { content: "\2212"; }
.reveal > summary:hover { background: rgba(255,107,107,.12); }
.reveal > summary:focus-visible { outline: none; box-shadow: 0 0 0 3px rgba(255,107,107,.22); }

.reveal-body { margin-top: var(--s-4); padding-top: var(--s-4); border-top: 1px solid var(--line); }
.reveal-body p { margin: 0 0 var(--s-3); color: var(--fg-muted); font-size: 13px; line-height: 1.6; }
.reveal-body b { color: var(--fg); }
.reveal-body code { font-family: var(--mono); font-size: 12.5px; color: var(--fg); }

/* Pending linked-device face: the capture itself, beside the device and time it came from. */
.face-review { display: grid; grid-template-columns: 148px minmax(0, 1fr); gap: var(--s-4); align-items: start; margin: var(--s-4) 0; }
.face-capture {
  display: block; width: 148px; aspect-ratio: 3 / 4; object-fit: cover;
  border: 1px solid var(--line); border-radius: var(--r-md); background: var(--surface-2);
}
@media (max-width: 520px) { .face-review { grid-template-columns: minmax(0, 1fr); } }

.confirm { display: flex; gap: var(--s-3); flex-wrap: wrap; align-items: flex-end; margin-top: var(--s-4); }
.confirm > .field { flex: 1 1 220px; margin-bottom: 0; }
.confirm input[type=text] { font-family: var(--mono); font-size: 13px; }

/* ---- auth pages -------------------------------------------------------- */

.auth { display: flex; align-items: center; justify-content: center; min-height: 100vh; padding: var(--s-5); }
.auth .card { width: 100%; max-width: 420px; }
.auth .brand { align-items: center; text-align: center; margin-bottom: var(--s-5); }
.steps { display: flex; gap: var(--s-2); margin-bottom: var(--s-5); }
.steps div {
  flex: 1; height: 3px; border-radius: 2px; background: var(--line);
}
.steps div.on { background: var(--accent); box-shadow: 0 0 12px var(--accent-line); }
.status-line { min-height: 20px; margin: var(--s-3) 0 0; font-size: 13px; color: var(--fg-muted); }
.status-line.err { color: var(--crit); }
.status-line.ok { color: var(--ok); }
[hidden] { display: none !important; }

/* ---- responsive -------------------------------------------------------- */

@media (max-width: 900px) {
  .shell { grid-template-columns: minmax(0, 1fr); }
  .rail {
    position: static; height: auto; flex-direction: row; align-items: center;
    gap: var(--s-4); overflow-x: auto; border-right: none;
    border-bottom: 1px solid var(--line-soft); padding: var(--s-3) var(--s-4);
  }
  .nav { flex-direction: row; gap: var(--s-1); }
  .nav a { border-left: none; border-bottom: 2px solid transparent; white-space: nowrap; }
  .nav a[aria-current="page"] { border-left-color: transparent; border-bottom-color: var(--accent); }
  .rail-foot { margin-top: 0; margin-left: auto; }
  .whoami { white-space: nowrap; }
  main { padding: var(--s-4) var(--s-4) var(--s-7); }
  .grid.two, .grid.side { grid-template-columns: minmax(0, 1fr); }
  .kv { grid-template-columns: minmax(0, 1fr); gap: 2px var(--s-3); }
  .kv dd { margin-bottom: var(--s-3); }
}

@media (prefers-reduced-motion: reduce) {
  * { transition: none !important; animation: none !important; }
}