/*
 * MeshCheck design system — the single stylesheet for every web surface
 * (the Phase 8 dashboard and the public result page).
 *
 * Source of truth: doc/decisions/design-system.md. Components reference the
 * tokens in :root below; they never hardcode a color, size, or radius.
 */

:root {
  color-scheme: light;

  /* --- Color: neutrals (blue-gray / slate) --- */
  --c-ink:       #0f172a;
  --c-ink-soft:  #334155;
  --c-muted:     #64748b;
  --c-faint:     #94a3b8;
  --c-border:    #e2e8f0;
  --c-surface:   #ffffff;
  --c-surface-2: #f1f5f9;
  --c-surface-soft: #f8fafc; /* recessed inset rows / disabled fields */
  --c-bg:        #f8fafc;

  /* --- Color: accent (blue) --- */
  --c-accent:       #2563eb;
  --c-accent-hover: #1d4ed8;
  --c-accent-soft:  #dbeafe;

  /* --- Color: status (semantic, fixed) --- */
  --c-pass-bg: #dcfce7; --c-pass-fg: #166534;
  --c-fail-bg: #fee2e2; --c-fail-fg: #991b1b;
  --c-warn-bg: #fef9c3; --c-warn-fg: #854d0e;

  /* --- Typography --- */
  --font-sans: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  --font-mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  --text-xs:   0.78rem;
  --text-sm:   0.88rem;
  --text-base: 1rem;
  --text-lg:   1.1rem;
  --text-xl:   1.3rem;

  /* --- Spacing scale --- */
  --space-1: 0.25rem;
  --space-2: 0.5rem;
  --space-3: 0.75rem;
  --space-4: 1rem;
  --space-5: 1.5rem;
  --space-6: 2rem;

  /* --- Shape & elevation --- */
  --radius-sm:   6px;
  --radius:      10px;
  --radius-pill: 999px;
  --shadow: 0 1px 2px rgba(15, 23, 42, 0.06), 0 1px 3px rgba(15, 23, 42, 0.10);
}

/* --- Color: dark theme -------------------------------------------------- */

/* Applied when /assets/theme.js sets <html data-theme="dark"> — either from
 * a stored choice or, by default, from the OS color-scheme preference. It is
 * the same slate scale inverted: surfaces darken, text lightens, and the
 * accent and status hues shift to readable-on-dark variants. */
:root[data-theme="dark"] {
  color-scheme: dark;

  --c-ink:       #e2e8f0;
  --c-ink-soft:  #cbd5e1;
  --c-muted:     #94a3b8;
  --c-faint:     #64748b;
  --c-border:    #334155;
  --c-surface:   #1e293b;
  --c-surface-2: #334155;
  --c-surface-soft: #172033; /* recessed inset rows / disabled fields */
  --c-bg:        #0f172a;

  --c-accent:       #3b82f6;
  --c-accent-hover: #60a5fa;
  --c-accent-soft:  #1e3a5f;

  --c-pass-bg: #14532d; --c-pass-fg: #86efac;
  --c-fail-bg: #7f1d1d; --c-fail-fg: #fca5a5;
  --c-warn-bg: #713f12; --c-warn-fg: #fde68a;

  --shadow: 0 1px 2px rgba(0, 0, 0, 0.4), 0 1px 3px rgba(0, 0, 0, 0.5);
}

/* The global nav bar and the sign-in backdrop are chrome, not content: they
 * stay dark in both themes. In dark mode --c-ink is a light text color, so
 * these surfaces take an explicit near-black instead. */
:root[data-theme="dark"] .topbar,
:root[data-theme="dark"] .auth-page { background: #020617; }
:root[data-theme="dark"] .topbar .btn-soft { background: var(--c-surface-2); color: #cbd5e1; }
:root[data-theme="dark"] .topbar .btn-soft:hover { background: var(--c-border); color: #fff; }
:root[data-theme="dark"] .field input,
:root[data-theme="dark"] .field select { border-color: var(--c-border); }

/* --- Base --------------------------------------------------------------- */

* { box-sizing: border-box; }

body {
  margin: 0;
  font-family: var(--font-sans);
  line-height: 1.5;
  background: var(--c-bg);
  color: var(--c-ink);
}

a { color: var(--c-accent); }
a:hover { color: var(--c-accent-hover); }

.mono { font-family: var(--font-mono); word-break: break-all; }
.muted { color: var(--c-faint); }

/* --- Shared global nav bar (every page) --------------------------------- */

.topbar {
  background: var(--c-ink);
  color: #fff;
  padding: var(--space-3) var(--space-5);
  display: flex;
  align-items: center;
  gap: var(--space-4);
  flex-wrap: wrap;
}
.topbar-brand {
  font-weight: 700;
  font-size: var(--text-lg);
  color: #fff;
  text-decoration: none;
}
.topbar-nav { display: flex; gap: var(--space-1); flex: 1; flex-wrap: wrap; }
.topbar-nav a {
  color: #cbd5e1;
  text-decoration: none;
  padding: var(--space-1) var(--space-3);
  border-radius: var(--radius-sm);
  font-size: var(--text-sm);
}
.topbar-nav a:hover { background: var(--c-ink-soft); color: #fff; }
.topbar-nav a.active { background: var(--c-accent); color: #fff; }
.topbar-account { display: flex; align-items: center; gap: var(--space-3); }
.topbar-account form { margin: 0; }
.topbar-who { font-size: var(--text-sm); color: var(--c-faint); }

/* Dark-mode toggle — an icon button on the global nav bar. It shows the
 * theme it switches *to*: a moon while light, a sun while dark. */
.theme-toggle {
  background: transparent;
  border: 0;
  color: #cbd5e1;
  cursor: pointer;
  font-size: var(--text-base);
  line-height: 1;
  padding: var(--space-1) var(--space-2);
  border-radius: var(--radius-sm);
}
.theme-toggle:hover { background: rgba(255, 255, 255, 0.12); }
.theme-toggle .on-light { display: inline; }
.theme-toggle .on-dark { display: none; }
:root[data-theme="dark"] .theme-toggle .on-light { display: none; }
:root[data-theme="dark"] .theme-toggle .on-dark { display: inline; }

/* --- App shell: dashboard chrome on the global bar, main, footer -------- */

/* The dashboard folds its role-scoped nav into the single global bar: the
 * brand is followed by the role nav links (.topbar-nav, shared with the
 * public bar). */

/* The switcher to other dashboards this user may enter. */
.topbar-switch { font-size: var(--text-xs); color: var(--c-faint); }
.topbar-switch a { color: #cbd5e1; text-decoration: none; margin-left: var(--space-1); }
.topbar-switch a:hover { color: #fff; }

/* Active-organization picker (Monitor dashboard). */
.app-org { margin: 0; }
.app-org select {
  background: var(--c-surface-2);
  color: var(--c-ink);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  padding: var(--space-1) var(--space-2);
  font: inherit;
  font-size: var(--text-sm);
}

.app-main {
  max-width: 960px;
  margin: var(--space-6) auto;
  padding: 0 var(--space-5);
}
.app-footer {
  max-width: 960px;
  margin: var(--space-6) auto;
  padding: 0 var(--space-5);
  font-size: var(--text-xs);
  color: var(--c-faint);
}

/* --- Page heading ------------------------------------------------------- */

.page-title { font-size: var(--text-xl); margin: 0 0 var(--space-1); }
.page-sub { color: var(--c-muted); margin-top: 0; }

/* --- Card --------------------------------------------------------------- */

.card {
  background: var(--c-surface);
  border: 1px solid var(--c-border);
  border-radius: var(--radius);
  padding: var(--space-4) var(--space-5);
  margin: var(--space-4) 0;
  box-shadow: var(--shadow);
}
.card h3 { margin: 0 0 var(--space-3); font-size: var(--text-lg); }
.card h4 { margin: var(--space-5) 0 var(--space-2); font-size: var(--text-base); }
.card-head {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  margin-bottom: var(--space-3);
}
.card-head h3 { margin: 0; flex: 1; }
.card-link { text-decoration: none; font-weight: 600; }

/* --- Grid & metric tiles ----------------------------------------------- */

.grid {
  display: grid;
  gap: var(--space-4);
  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
}
.metric {
  background: var(--c-surface-2);
  border-radius: var(--radius-sm);
  padding: var(--space-3) var(--space-4);
}
.metric .n { font-size: var(--text-xl); font-weight: 700; }
.metric .l {
  font-size: var(--text-xs);
  color: var(--c-muted);
  text-transform: uppercase;
  letter-spacing: 0.03em;
}

/* --- Table -------------------------------------------------------------- */

.table { border-collapse: collapse; width: 100%; }
.table th, .table td {
  text-align: left;
  padding: var(--space-2) var(--space-3);
  border-bottom: 1px solid var(--c-border);
  font-size: var(--text-sm);
}
.table th { color: var(--c-muted); font-weight: 600; }

/* --- Result table (check-host-style per-node rows) --------------------- */
/* One line per row: every datum is its own column. The same table renders in
   both states — while the check runs the Result cell holds the countdown and the
   metric cells are "—"; once it finishes the values fill in, so the table never
   changes shape or order. Numeric timing columns are right-aligned with tabular
   figures; identity, result, target, and route columns stay on one line. */
/* Fixed column widths (set by the per-type <colgroup> in public_live.html) so the
   table is pixel-identical while the check runs and after it finishes — only the
   cell values change, never the column widths. */
.result-table, [data-resizable] { table-layout: fixed; width: 100%; }
.result-table td, .result-table th { vertical-align: middle; }
.result-table .node-ip { font-weight: 600; }
/* Text columns clip with an ellipsis so a long value can't widen its column. */
.result-table .node-ip,
.result-table .col-clip { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
.result-table .col-nowrap { white-space: nowrap; }
.result-table th.col-num, .result-table td.col-num {
  text-align: right;
  white-space: nowrap;
  overflow: hidden;
  font-variant-numeric: tabular-nums;
}
.result-table .col-net .pill.verified { margin-left: var(--space-2); }
.result-table .resolved-ip { font-size: var(--text-xs); }
/* The DNS Answer cell: a record-type tag followed by the comma-joined records,
   clipped to its column (full list in the cell title). The tag reuses the muted
   token so the record values read as the primary content. */
.result-table .col-records .rec-type { font-size: var(--text-xs); margin-right: var(--space-1); }
.result-table .result-cell .progress.countdown { min-width: 64px; }
/* The route cell holds an always-on latency sparkline + an "N hops →" label,
   both inside one link to the full route page. It fits its column and never
   overflows the table; the per-hop hover detail is a separate body-level card
   (see .trace-tip / trace-pop.js), so nothing here escapes the cell. */
.result-table .route-cell { white-space: nowrap; }
/* Visible column separators: a light vertical rule between every column so the
   seams read clearly (not just the horizontal row lines). The header seam doubles
   as the drag handle — columns.js injects a .col-resizer grip into each header. */
[data-resizable] th, [data-resizable] td { border-right: 1px solid var(--c-border); }
[data-resizable] th:last-child, [data-resizable] td:last-child { border-right: 0; }

/* Failure points stay visible on the finished result page: any node that did not
   pass — a failed check, a timeout, or a node that never responded — gets a soft
   red row so the failures read at a glance. Uses the --c-fail-* tokens, so it
   tracks both the light and dark themes automatically. */
.result-table tbody tr.failed { background: var(--c-fail-bg); }

/* Drag-to-resize: a grip on the right edge of each header (columns.js injects it).
   Dragging transfers width to/from the neighbour so the table keeps fitting the
   page. An always-visible grip bar marks the seam as movable; it grows and turns
   accent-coloured on hover/drag. All colours use design tokens, so both themes work. */
[data-resizable] th { position: relative; }
[data-resizable] th .col-resizer {
  position: absolute; top: 0; right: -4px; width: 9px; height: 100%; z-index: 1;
  display: flex; align-items: center; justify-content: center;
  cursor: col-resize; user-select: none; touch-action: none;
}
[data-resizable] th .col-resizer::before {
  content: ""; width: 2px; height: 55%; border-radius: 1px;
  background: var(--c-muted); opacity: 0.5;
  transition: background 0.1s, height 0.1s, opacity 0.1s;
}
[data-resizable] th .col-resizer:hover::before,
body.col-dragging [data-resizable] th .col-resizer::before {
  background: var(--c-accent); opacity: 1; height: 100%;
}
body.col-dragging { cursor: col-resize; user-select: none; }

/* Drag-to-reorder columns: the header label is the grab handle (the resize grip
   keeps col-resize). The dragged header dims; the header under the cursor shows
   an accent edge on the side the column will land. columns.js drives the classes. */
[data-col-reorder] thead th { cursor: grab; }
[data-col-reorder] thead th .col-resizer { cursor: col-resize; }
[data-col-reorder] thead th.col-drag-src { opacity: 0.4; }
[data-col-reorder] thead th.col-drop-before { box-shadow: inset 3px 0 0 var(--c-accent); }
[data-col-reorder] thead th.col-drop-after { box-shadow: inset -3px 0 0 var(--c-accent); }
body.col-reordering { cursor: grabbing; user-select: none; }

/* --- Traceroute: always-on sparkline glance + hover detail ------------ */

/* The whole glance is one link to the full route page: a latency sparkline
   followed by an "N hops →" label. */
.route-glance {
  display: inline-flex;
  align-items: center;
  gap: var(--space-2);
  max-width: 100%;
  min-width: 0;
  text-decoration: none;
  color: var(--c-accent);
  cursor: pointer;
}
.route-glance:hover .route-spark-label { text-decoration: underline; }

/* The sparkline: one bar per hop, drawn from a fixed-height baseline. The strip
   sizes to its bars but never grows past the space left by the label; if the
   column is too tight it clips its oldest (leftmost) hops rather than spilling
   over the label, and the bars hug the label so the target stays visible. */
.route-spark {
  display: flex;
  align-items: flex-end;
  justify-content: flex-end;
  gap: 1px;
  height: 18px;
  flex: 0 1 auto;
  min-width: 0;
  overflow: hidden;
}
.route-bar {
  flex: 0 1 3px;
  min-width: 1px;
  /* --h is this hop's RTT as 0–100 of the route's slowest hop. */
  height: max(2px, calc(var(--h, 12) * 1%));
  align-self: flex-end;
  border-radius: 1px;
  background: var(--c-muted);
}
/* Heat: absolute-latency colour bands (set server-side via lat-* classes). */
.route-bar.lat-fast { background: var(--c-pass-fg); }
.route-bar.lat-mid  { background: var(--c-warn-fg); }
.route-bar.lat-slow { background: var(--c-fail-fg); }
/* A hop that did not answer: no bar, a dim dashed baseline gap instead. */
.route-bar.miss {
  height: 18px;
  background: transparent;
  border-bottom: 2px dashed var(--c-border);
  opacity: 0.7;
}
/* The target hop (last reached) is a touch wider with an inset ring (clip-safe)
   so the destination stands out at the right end of the strip. */
.route-bar.target {
  flex-basis: 5px;
  min-width: 5px;
  box-shadow: inset 0 0 0 1px var(--c-ink);
}
.route-spark-label { flex: 0 0 auto; font-size: var(--text-xs); white-space: nowrap; }

/* The hover/focus detail card listing every hop. trace-pop.js moves a single
   instance to <body> and positions it with position:fixed from the trigger's
   viewport rect — outside every scroll/overflow box, so showing it can never
   change the document height (no scroll jump). */
.trace-tip {
  position: fixed;
  z-index: 50;
  min-width: 220px;
  max-width: 340px;
  padding: var(--space-2) var(--space-3);
  background: var(--c-surface);
  color: var(--c-ink);
  border: 1px solid var(--c-border);
  border-radius: var(--radius);
  box-shadow: 0 6px 24px rgba(15, 23, 42, 0.18);
  white-space: normal;
  opacity: 0;
  transform: translateY(-4px);
  transition: opacity 0.12s ease, transform 0.12s ease;
  pointer-events: none;
}
.trace-tip:not([hidden]) { opacity: 1; transform: none; }
@media (prefers-reduced-motion: reduce) { .trace-tip { transition: none; } }
.trace-hop {
  display: grid;
  grid-template-columns: 1.6rem 1fr auto;
  gap: var(--space-2);
  align-items: baseline;
  padding: 1px 0;
}
.trace-hop-n { color: var(--c-muted); text-align: right; }
.trace-hop-rtt { font-size: var(--text-xs); }

/* --- Traceroute: full-route page -------------------------------------- */

.trace-table .trace-hop-n { color: var(--c-muted); width: 3rem; }
.trace-table tr.trace-target td { font-weight: 600; }
.trace-note { margin-top: var(--space-3); font-size: var(--text-xs); }

/* --- Pill (status badge) ----------------------------------------------- */

.pill {
  display: inline-block;
  padding: 0.1rem var(--space-2);
  border-radius: var(--radius-pill);
  font-size: var(--text-xs);
  font-weight: 600;
  background: var(--c-border);
  color: var(--c-ink-soft);
}
.pill.pass, .pill.complete, .pill.active, .pill.verified {
  background: var(--c-pass-bg); color: var(--c-pass-fg);
}
.pill.fail, .pill.suspended {
  background: var(--c-fail-bg); color: var(--c-fail-fg);
}
.pill.pending, .pill.dispatched, .pill.timeout, .pill.inconclusive,
.pill.paused, .pill.acknowledged, .pill.seen, .pill.broadcast {
  background: var(--c-warn-bg); color: var(--c-warn-fg);
}
.pill.resolved, .pill.confirmed { background: var(--c-pass-bg); color: var(--c-pass-fg); }
.pill.open, .pill.reorged, .pill.failed, .pill.failed_dispatch,
.pill.insufficient_balance { background: var(--c-fail-bg); color: var(--c-fail-fg); }

/* Live connection state, separate from the admin active/suspended status. A
   node can be active yet offline; offline is neutral grey, not red. */
.pill.online  { background: var(--c-pass-bg);  color: var(--c-pass-fg); }
.pill.offline { background: var(--c-surface-2); color: var(--c-ink-soft); }

/* Cost-preview box used on the Check and Scheduled Check submission forms. */
.quote-box {
  margin-top: 0.5rem;
  padding: 0.65rem 0.9rem;
  border-radius: 0.5rem;
  border: 1px solid var(--c-border);
  font-size: 0.95rem;
}
.quote-box.quote-free { background: var(--c-pass-bg); color: var(--c-pass-fg); }
.quote-box.quote-paid { background: var(--c-accent-soft); color: var(--c-accent); }

/* Billing-ledger entry types. */
.pill.deposit { background: var(--c-pass-bg); color: var(--c-pass-fg); }
.pill.platform_fee, .pill.check_charge { background: var(--c-warn-bg); color: var(--c-warn-fg); }
.pill.adjustment { background: var(--c-accent-soft); color: var(--c-accent); }

/* Signed amounts in the billing ledger. */
.amount-pos { color: var(--c-pass-fg); font-variant-numeric: tabular-nums; }
.amount-neg { color: var(--c-fail-fg); font-variant-numeric: tabular-nums; }

/* --- Buttons ------------------------------------------------------------ */

.btn, .btn-soft {
  display: inline-block;
  border: 0;
  border-radius: var(--radius-sm);
  padding: var(--space-2) var(--space-4);
  font-size: var(--text-sm);
  font-family: inherit;
  text-decoration: none;
  cursor: pointer;
}
.btn { background: var(--c-accent); color: #fff; }
.btn:hover { background: var(--c-accent-hover); }
.btn-soft { background: var(--c-surface-2); color: var(--c-ink-soft); }
.btn-soft:hover { background: var(--c-border); }

/* The log-out control sits on the dark global nav bar. */
.topbar .btn-soft { background: var(--c-ink-soft); color: #cbd5e1; }
.topbar .btn-soft:hover { background: #475569; color: var(--c-bg); }

/* HTMX sets this on an element while its request is in flight. */
.htmx-request.btn, .htmx-request .btn { opacity: 0.6; }

/* A row of filter links above a table. */
.filters a { margin-right: var(--space-3); }

/* A row of action buttons, each its own little form. */
.actions {
  display: flex;
  gap: var(--space-2);
  flex-wrap: wrap;
  margin-top: var(--space-4);
}
.actions form { margin: 0; }

/* --- Public result page: the verdict banner ---------------------------- */
/* A flush, full-width strip above the table (the .grid-add scaffolding gives it
   the topbar inset and the divider). The verdict headline and the outcome /
   latency breakdown sit on one baseline-aligned row, wrapping on narrow widths. */
.result-summary {
  display: flex;
  flex-wrap: wrap;
  align-items: baseline;
  gap: var(--space-2) var(--space-4);
}
.result-summary .summary {
  font-size: var(--text-lg);
  font-weight: 600;
}

/* --- Sign-in page ------------------------------------------------------- */

.auth-page {
  min-height: 100vh;
  margin: 0;
  display: flex;
  flex-direction: column;
  background: var(--c-ink);
}
.auth-main {
  flex: 1;
  display: flex;
  align-items: center;
  justify-content: center;
  padding: var(--space-5);
}
.auth-box {
  background: var(--c-surface);
  border-radius: var(--radius);
  padding: var(--space-6) calc(var(--space-6) + var(--space-1));
  /* Fluid up to a comfortable width so the box scales down on narrow phones
     instead of overflowing the viewport padding. */
  width: 100%;
  max-width: 20rem;
  box-shadow: 0 10px 40px rgba(0, 0, 0, 0.35);
}

.auth-box h1 { font-size: var(--text-xl); margin: 0 0 var(--space-1); }
.field { display: block; }
.field label {
  display: block;
  font-size: var(--text-xs);
  color: var(--c-ink-soft);
  font-weight: 600;
  margin: var(--space-4) 0 var(--space-1);
}
.field input, .field select {
  width: 100%;
  padding: var(--space-2) var(--space-3);
  border: 1px solid #cbd5e1;
  border-radius: var(--radius-sm);
  font-size: var(--text-base);
  font-family: inherit;
}
.auth-box .btn { width: 100%; margin-top: var(--space-5); padding: var(--space-3); }
/* Footer link ("New to MeshCheck?" / "Already have an account?") sits below the
   submit button; give it room so it doesn't crowd the button. */
.auth-box .page-sub { margin-top: var(--space-4); }
.form-error {
  background: var(--c-fail-bg);
  color: var(--c-fail-fg);
  border-radius: var(--radius-sm);
  padding: var(--space-2) var(--space-3);
  font-size: var(--text-sm);
  margin-top: var(--space-3);
}
.form-ok {
  background: var(--c-pass-bg);
  color: var(--c-pass-fg);
  border-radius: var(--radius-sm);
  padding: var(--space-2) var(--space-3);
  font-size: var(--text-sm);
  margin-bottom: var(--space-3);
}

/* --- Sign-up page: two-pane (pitch + form) ----------------------------- */

/* A wide card split into a value-prop panel and the form. Below 48rem the
   panel drops away and the form behaves like the single sign-in card. */
.auth-split {
  display: grid;
  grid-template-columns: 1fr 1fr;
  width: 100%;
  max-width: 56rem;
  background: var(--c-surface);
  border-radius: var(--radius);
  overflow: hidden;
  box-shadow: 0 10px 40px rgba(0, 0, 0, 0.35);
}
/* Inside the split the form sheds its own shell — the split owns it. */
.auth-split .auth-box {
  width: auto;
  max-width: none;
  border-radius: 0;
  box-shadow: none;
}

/* The brand/value panel. Stays brand-blue in both themes (accent is
   readable-on-white text in light and dark variants alike). */
.auth-aside {
  background: var(--c-accent);
  color: #fff;
  padding: var(--space-6) calc(var(--space-6) + var(--space-1));
  display: flex;
  flex-direction: column;
  gap: var(--space-4);
  justify-content: center;
}
.auth-aside-brand { margin: 0; font-size: var(--text-xl); font-weight: 700; }
.auth-aside-tag { margin: 0; font-size: var(--text-lg); }
.auth-aside-points {
  margin: 0;
  padding-left: var(--space-4);
  display: flex;
  flex-direction: column;
  gap: var(--space-2);
  font-size: var(--text-sm);
  color: rgba(255, 255, 255, 0.85);
}

/* --- Role picker: two selectable cards --------------------------------- */
.role-picker { border: 0; margin: var(--space-5) 0 0; padding: 0; }
.role-picker legend {
  padding: 0;
  font-size: var(--text-xs);
  font-weight: 600;
  color: var(--c-ink-soft);
  text-transform: uppercase;
  letter-spacing: 0.04em;
}
.role-hint {
  text-transform: none;
  letter-spacing: 0;
  font-weight: 400;
  color: var(--c-faint);
}
.role-cards {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: var(--space-3);
  margin-top: var(--space-3);
}
.role-card {
  display: flex;
  gap: var(--space-3);
  padding: var(--space-3) var(--space-4);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  cursor: pointer;
  transition: border-color 0.1s, background 0.1s;
}
.role-card:hover { border-color: var(--c-accent); }
.role-card:has(input:checked) {
  border-color: var(--c-accent);
  background: var(--c-accent-soft);
}
.role-card input { margin-top: 0.2rem; accent-color: var(--c-accent); }
.role-card-body { display: flex; flex-direction: column; gap: var(--space-1); }
.role-card-title { font-weight: 700; color: var(--c-ink); }
.role-card-desc { font-size: var(--text-xs); color: var(--c-muted); }

/* --- Schedule timing form ---------------------------------------------- */

/* A monitor's schedule is either interval- or cron-style. The kind radios
   reveal exactly one field group via :has(), so no JavaScript is needed and
   the irrelevant input is never submitted-but-ignored confusingly. */
.timing-kinds { display: flex; gap: var(--space-4); margin-bottom: var(--space-3); }
.timing-kind { display: inline-flex; align-items: center; gap: var(--space-2); cursor: pointer; }
.timing-kind input { accent-color: var(--c-accent); }
.timing-form .timing-interval,
.timing-form .timing-cron { display: none; }
.timing-form:has(input[value="interval"]:checked) .timing-interval { display: block; }
.timing-form:has(input[value="cron"]:checked) .timing-cron { display: block; }

/* Stack to one column and drop the brand panel on narrow screens. */
@media (max-width: 48rem) {
  .auth-split { grid-template-columns: 1fr; max-width: 26rem; }
  .auth-aside { display: none; }
  .role-cards { grid-template-columns: 1fr; }
}

/* --- Admin settings form ----------------------------------------------- */

.settings-group { margin-bottom: var(--space-6); }
.settings-group + .settings-group {
  border-top: 1px solid var(--c-border);
  padding-top: var(--space-5);
}
.settings-group-title {
  margin: 0 0 var(--space-4);
  font-size: var(--text-sm);
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  color: var(--c-faint);
}
.settings-form .setting { margin-bottom: var(--space-5); }
.settings-form .setting:last-child { margin-bottom: 0; }
.settings-form .setting label { font-weight: 600; }
.setting-help { margin: var(--space-1) 0 var(--space-2); font-size: var(--text-sm); }
.setting-input {
  display: flex;
  align-items: baseline;
  gap: var(--space-2);
  flex-wrap: wrap;
}
.settings-form input {
  width: 12rem;
  padding: var(--space-2) var(--space-3);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  font: inherit;
}
.setting-unit { font-size: var(--text-sm); color: var(--c-faint); }
.setting-convert {
  font-size: var(--text-sm);
  font-weight: 600;
  color: var(--c-accent);
}
.setting-meta { margin: var(--space-2) 0 0; font-size: var(--text-sm); }

/* On/off toggle for boolean settings (e.g. public module flags). The native
 * checkbox is hidden but stays focusable; the pill + knob is drawn from it. */
.setting-toggle {
  display: inline-flex;
  align-items: center;
  gap: var(--space-3);
  cursor: pointer;
  font-weight: 600;
}
.setting-toggle input {
  position: absolute;
  width: 1px;
  height: 1px;
  margin: -1px;
  padding: 0;
  border: 0;
  overflow: hidden;
  clip: rect(0 0 0 0);
}
.setting-toggle-track {
  position: relative;
  flex: none;
  width: 2.5rem;
  height: 1.4rem;
  border-radius: 999px;
  background: var(--c-border);
  transition: background 0.15s ease;
}
.setting-toggle-track::after {
  content: "";
  position: absolute;
  top: 2px;
  left: 2px;
  width: calc(1.4rem - 4px);
  height: calc(1.4rem - 4px);
  border-radius: 50%;
  /* The knob is intentionally light in both themes (conventional switch look);
   * the shadow keeps it defined against the light off-track. */
  background: #fff;
  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.3);
  transition: transform 0.15s ease;
}
.setting-toggle input:checked + .setting-toggle-track {
  background: var(--c-accent);
}
.setting-toggle input:checked + .setting-toggle-track::after {
  transform: translateX(1.1rem);
}
.setting-toggle input:focus-visible + .setting-toggle-track {
  outline: 2px solid var(--c-accent);
  outline-offset: 2px;
}

/* --- Feature flags (menu item visibility) ------------------------------ */

/* Each flag stacks its toggle, audience choice, and (when "Selected users")
 * a scrollable user picker. */
.flag-audience {
  display: flex;
  flex-wrap: wrap;
  gap: var(--space-4);
  margin: var(--space-2) 0 0;
}
.flag-radio {
  display: inline-flex;
  align-items: center;
  gap: var(--space-2);
  font-weight: 400;
  cursor: pointer;
}
.flag-radio input { width: auto; }
.flag-users {
  margin-top: var(--space-3);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  padding: var(--space-3);
  max-height: 14rem;
  overflow-y: auto;
  background: var(--c-surface-soft);
}
.flag-users[hidden] { display: none; }
.flag-users-list {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(15rem, 1fr));
  gap: var(--space-2) var(--space-4);
}
.flag-user {
  display: flex;
  align-items: center;
  gap: var(--space-2);
  font-weight: 400;
  font-size: var(--text-sm);
  cursor: pointer;
}
.flag-user input { width: auto; }

/* --- Dashboard chooser -------------------------------------------------- */

/* The landing screen for a user entitled to more than one dashboard. It is a
   full-bleed split, not a boxed card: each dashboard is a full-height
   clickable panel filling the area below the nav bar, side by side (left/right
   for two, even columns for three). The column count is data-driven, threaded
   in as --cols (the sanctioned custom-property pattern), so two roles render
   as a clean left/right choice. */
.chooser-split {
  flex: 1;
  display: grid;
  grid-template-columns: repeat(var(--cols, 2), 1fr);
  min-height: 0;
}
.chooser-panel {
  display: flex;
  flex-direction: column;
  align-items: center;
  justify-content: center;
  gap: var(--space-3);
  padding: var(--space-6);
  text-align: center;
  text-decoration: none;
  background: var(--c-surface);
  color: var(--c-ink);
  border-left: 1px solid var(--c-border);
  transition: background 0.12s;
}
.chooser-panel:first-child { border-left: 0; }
.chooser-panel:hover { background: var(--c-accent-soft); }
.chooser-panel .nav-icon { width: 48px; height: 48px; color: var(--c-accent); }
.chooser-panel-name { font-size: var(--text-xl); font-weight: 700; }
.chooser-panel-desc { font-size: var(--text-sm); color: var(--c-muted); max-width: 22rem; }
.chooser-panel-go { font-size: var(--text-sm); font-weight: 600; color: var(--c-accent); }

/* The link styling reused by the "Back to your dashboards" link on the
   forbidden page. */
.chooser-link {
  display: block;
  margin-top: var(--space-3);
  padding: var(--space-3) var(--space-4);
  background: var(--c-surface-2);
  border-radius: var(--radius-sm);
  color: var(--c-accent);
  text-decoration: none;
  font-weight: 600;
}
.chooser-link:hover { background: var(--c-accent-soft); }
.auth-box form { margin-top: var(--space-4); }

/* Stack the panels into full-width rows on narrow screens. */
@media (max-width: 48rem) {
  .chooser-split { grid-template-columns: 1fr; }
  .chooser-panel { border-left: 0; border-top: 1px solid var(--c-border); }
  .chooser-panel:first-child { border-top: 0; }
}

/* --- Node detail panel (MaxMind observed geo/network) ------------------- */
/* The read-only detail view shown in the peer "MaxMind details" drawer. */
.node-detail {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr));
  gap: var(--space-3);
  margin: var(--space-2) 0;
}
.node-detail .dt {
  display: block;
  font-size: var(--text-xs);
  color: var(--c-muted);
  font-weight: 600;
}
.node-detail .dd { font-size: var(--text-sm); }
/* Capability badges: the check types a node self-declares it serves. */
.caps { display: inline-flex; flex-wrap: wrap; gap: var(--space-2); }
.pill.cap { background: var(--c-accent-soft); color: var(--c-accent); }

/* --- Admin data tables: single-line rows, row menus, bulk actions ------- */
/* Shared by the admin Nodes and Organizations tables (.data-table). */

/* The table always fits the page width — it never scrolls horizontally; only
   the page scrolls, vertically. Text-heavy columns wrap and the timestamp wraps
   at its space; only the compact atomic columns (checkbox, tier/status pills,
   row menu) stay on a single line via .col-nowrap. */
.table-wrap { overflow-x: visible; }
.data-table { width: 100%; }
.data-table th, .data-table td { vertical-align: middle; }
.data-table .col-select { width: 1%; white-space: nowrap; }
.data-table .col-actions { width: 1%; text-align: right; white-space: nowrap; }
.data-table .col-nowrap { white-space: nowrap; }
.data-table input[type="checkbox"] { accent-color: var(--c-accent); }
/* Cells that should clip rather than wrap once the column is narrowed by a drag. */
.data-table .col-clip { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }

/* Drag-to-reorder: the whole row is the drag target (no separate grip) and dims
   while dragged so its new resting place reads clearly. The cursor hints "grab"
   across the row — except over the interactive cells, which keep a pointer. */
[data-reorder] tbody tr[data-node-id] { cursor: grab; }
[data-reorder] tbody tr[data-node-id]:active { cursor: grabbing; }
[data-reorder] tbody .col-select,
[data-reorder] tbody .col-actions,
[data-reorder] tbody a { cursor: auto; }
.data-table tbody tr.dragging {
  opacity: 0.5;
  background: var(--c-surface-2);
}

/* Highlight a checked row across its full width — the same accent wash as the
   bulk-action toolbar, plus a left accent bar, legible in both themes. */
.data-table tbody tr:has(input[data-bulk-select]:checked) {
  background: var(--c-accent-soft);
  box-shadow: inset 3px 0 0 0 var(--c-accent);
}

/* Visible per-row actions (Edit / Remove), an alternative to the kebab menu
   when a row has only a couple of actions. */
.row-actions { display: inline-flex; gap: var(--space-2); justify-content: flex-end; }
.btn-sm { padding: var(--space-1) var(--space-3); font-size: var(--text-sm); }

/* --- Full-bleed grid page (the Targets list) --------------------------- */
/* A table-first page: the main content fills the whole area beside the sidebar
   and below the topbar — no centred 960px column, no card box around the
   table. Bars, panels, and flash strips span the full width with the same
   horizontal inset as the topbar; the table's edge cells align to it too. */
.app-main-bleed { max-width: none; margin: 0; padding: 0; }

/* A horizontal bar (toolbar / footer) spanning the content width. */
.grid-bar {
  display: flex;
  align-items: center;
  justify-content: flex-end;
  gap: var(--space-3);
  padding: var(--space-3) var(--space-5);
  border-bottom: 1px solid var(--c-border);
}
.grid-foot { border-bottom: 0; }
.grid-foot .pager { margin-top: 0; width: 100%; }

/* The collapsible "Add monitor" form (and the empty / no-org states) — a
   full-width panel inset to match the topbar, divided from the table below. */
.grid-add {
  padding: var(--space-4) var(--space-5);
  border-bottom: 1px solid var(--c-border);
}
.grid-add form { max-width: 520px; }

/* Result banners as flush full-width strips rather than rounded cards. */
.grid-flash { margin: 0; border-radius: 0; }

/* The grid table fills the width; its first/last cells align to the topbar
   inset so columns line up with the toolbar and page chrome. */
.grid-table th:first-child, .grid-table td:first-child { padding-left: var(--space-5); }
.grid-table th:last-child,  .grid-table td:last-child  { padding-right: var(--space-5); }

/* --- Slide-over drawer (Add / Edit forms) ------------------------------ */
/* A right-edge panel that slides in over a dimmed backdrop; the list stays
   visible behind it. The form is HTMX-loaded into .drawer-body; open/close is
   driven by app.js (a class toggle for the transition). */
.drawer { position: fixed; inset: 0; z-index: 50; }
.drawer[hidden] { display: none; }
.drawer-backdrop {
  position: absolute;
  inset: 0;
  background: rgba(15, 23, 42, 0.5);
  opacity: 0;
  transition: opacity 0.2s ease;
}
.drawer.open .drawer-backdrop { opacity: 1; }
.drawer-panel {
  position: absolute;
  top: 0;
  right: 0;
  height: 100%;
  width: min(440px, 100%);
  display: flex;
  flex-direction: column;
  padding: var(--space-6) var(--space-5) var(--space-5);
  background: var(--c-surface);
  border-left: 1px solid var(--c-border);
  box-shadow: var(--shadow);
  overflow-y: auto;
  transform: translateX(100%);
  transition: transform 0.2s ease;
}
.drawer.open .drawer-panel { transform: translateX(0); }
.drawer-close { position: absolute; top: var(--space-3); right: var(--space-3); }
.drawer-title { margin: 0 0 var(--space-4); font-size: var(--text-lg); }
.drawer-foot {
  display: flex;
  justify-content: flex-end;
  gap: var(--space-3);
  margin-top: var(--space-5);
}
/* A group of stacked checkbox rows inside a drawer form (e.g. a user's roles),
   and a rule dividing two stacked forms in one drawer. */
.drawer-checks { border: 0; padding: 0; margin: var(--space-4) 0 0; display: flex; flex-direction: column; gap: var(--space-2); }
.drawer-checks legend { font-size: var(--text-xs); color: var(--c-ink-soft); font-weight: 600; padding: 0; margin-bottom: var(--space-1); }
.drawer-checks .check { display: inline-flex; align-items: center; gap: var(--space-2); font-size: var(--text-sm); }
.drawer-checks .check input { accent-color: var(--c-accent); }
.drawer-divider { border: 0; border-top: 1px solid var(--c-border); margin: var(--space-5) 0; }
/* The once-only API-key reveal input in the admin nodes flash banner. */
.key-input { width: 100%; margin-top: var(--space-2); }
/* An input whose value is an upper-case code (e.g. an ISO country override). */
.input-upper { text-transform: uppercase; }

/* Node cell: bold resolved name, the override marker, and a short id — all on
   one line, with the full ULID on hover and in the edit panel. */
.node-name-line { display: inline-flex; flex-wrap: wrap; align-items: baseline; gap: var(--space-2); }
.node-name .node-id { font-size: var(--text-xs); }
/* Device name, shown on its own line beneath the IP. */
.node-name .node-device { display: block; font-size: var(--text-xs); }
/* Agent platform/type, shown on its own line beneath the version. */
.agent-platform { display: block; font-size: var(--text-xs); }

/* "admin" marker beside an overridden datum. */
.ovr {
  display: inline-block;
  padding: 0 var(--space-1);
  border-radius: var(--radius-sm);
  background: var(--c-accent-soft);
  color: var(--c-accent);
  font-size: var(--text-xs);
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.03em;
}

/* Tier pills: FREE reads quiet/neutral, PAID picks up the accent. */
.pill.tier-free { background: var(--c-surface-2); color: var(--c-ink-soft); }
.pill.tier-paid { background: var(--c-accent-soft); color: var(--c-accent); }

/* Free/Paid in-table switch: the contributor flips a node between the free (vps)
   and paid (peer) tiers without opening the drawer. Off = Free (neutral),
   on = Paid (accent); both themes via tokens. */
.tier-toggle {
  display: inline-flex; align-items: center; gap: var(--space-2);
  padding: 0; border: 0; background: none; cursor: pointer;
  font: inherit; color: var(--c-ink-soft); line-height: 1;
}
.tier-toggle .switch {
  position: relative; flex: none; width: 32px; height: 18px;
  border-radius: 9px; background: var(--c-surface-2);
  transition: background 0.15s;
}
.tier-toggle .switch::after {
  content: ""; position: absolute; top: 2px; left: 2px;
  width: 14px; height: 14px; border-radius: 50%;
  background: #fff; box-shadow: 0 1px 2px rgba(0, 0, 0, 0.35);
  transition: transform 0.15s;
}
.tier-toggle .switch-label { font-size: var(--text-xs); font-weight: 600; }
.tier-toggle.is-paid { color: var(--c-accent); }
.tier-toggle.is-paid .switch { background: var(--c-accent); }
.tier-toggle.is-paid .switch::after { transform: translateX(14px); }
.tier-toggle:focus-visible { outline: 2px solid var(--c-accent); outline-offset: 2px; border-radius: var(--radius-sm); }

/* Row action menu — a compact dropdown modelled on the account menu. */
.menu { position: relative; display: inline-block; }
.menu-list {
  position: absolute;
  top: calc(100% + var(--space-1));
  right: 0;
  z-index: 20;
  min-width: 12rem;
  padding: var(--space-1);
  display: none;
  background: var(--c-surface);
  border: 1px solid var(--c-border);
  border-radius: var(--radius);
  box-shadow: var(--shadow);
}
.menu.open .menu-list { display: block; }
.menu-item {
  display: block;
  width: 100%;
  padding: var(--space-2) var(--space-3);
  text-align: left;
  border: 0;
  border-radius: var(--radius-sm);
  background: transparent;
  color: var(--c-ink-soft);
  font: inherit;
  font-size: var(--text-sm);
  cursor: pointer;
  white-space: nowrap;
}
.menu-item:hover { background: var(--c-surface-2); color: var(--c-ink); }
.menu-item.danger { color: var(--c-fail-fg); }
.menu-item.danger:hover { background: var(--c-fail-bg); color: var(--c-fail-fg); }

/* Bulk action toolbar — a flush full-width strip that appears above the table
   when rows are selected, inset to the topbar like the other grid bars. */
.bulk-bar {
  display: flex;
  align-items: center;
  gap: var(--space-4);
  flex-wrap: wrap;
  padding: var(--space-3) var(--space-5);
  background: var(--c-accent-soft);
  border-bottom: 1px solid var(--c-accent);
}
.bulk-count { font-size: var(--text-sm); color: var(--c-ink-soft); }
.bulk-actions { display: flex; gap: var(--space-2); flex-wrap: wrap; }
.btn-soft.danger { color: var(--c-fail-fg); }
.btn-soft.danger:hover { background: var(--c-fail-bg); }

/* The node-id / observed-reference meta line under the admin node edit form. */
.node-meta { font-size: var(--text-xs); color: var(--c-muted); }

/* --- Client-side pagination (the Monitor facet tables) ------------------ */
/* A [data-paginate] table shows a page of rows at a time; rows off the page
   are hidden with .pager-hide. The control row below it carries the page-size
   select, the range readout, and the prev/next buttons. Driven entirely by
   app.js, so it needs no extra handler and works after an HTMX table swap. */
.pager-hide { display: none !important; }
.pager {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  flex-wrap: wrap;
  margin-top: var(--space-3);
  font-size: var(--text-sm);
  color: var(--c-ink-soft);
}
.pager-size { display: inline-flex; align-items: center; gap: var(--space-2); }
.pager-size select {
  padding: var(--space-1) var(--space-2);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  background: var(--c-surface);
  color: var(--c-ink);
  font: inherit;
  font-size: var(--text-sm);
}
.pager-info { color: var(--c-muted); }
.pager-controls { display: inline-flex; gap: var(--space-2); margin-left: auto; }

/* The compact status a facet table shows for a facet it does not itself edit —
   "set" / "not set", read quietly so the row's own facet stands out. */
.facet-status { font-size: var(--text-sm); }
.facet-status.unset { color: var(--c-muted); }

.visually-hidden {
  position: absolute;
  width: 1px; height: 1px;
  margin: -1px; padding: 0; border: 0;
  overflow: hidden; clip: rect(0 0 0 0);
}

/* --- Public check page (homepage + standalone result) ------------------ */

/* Both the homepage and the shareable result page are one full-bleed surface: a
   persistent check bar over a result region that spans the whole content width.
   The homepage's main carries .landing; the result page's carries .result-bleed;
   both drop the centred column. */
.landing { max-width: none; margin: 0; padding: 0; }

/* The result region is empty (hidden) until a check is run; on a result page it
   is populated from the start. */
#result-stage:empty { display: none; }

/* The persistent control bar: target input · type select · (TCP) port · Check —
   a flush full-width band with the same inset as the result bars below it. */
.check-bar {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  padding: var(--space-4) var(--space-5);
  border-bottom: 1px solid var(--c-border);
}
.check-bar-input {
  padding: var(--space-3) var(--space-4);
  font-size: var(--text-base);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  font-family: inherit;
  background: var(--c-surface);
  color: var(--c-ink);
}
.check-bar-target { flex: 1 1 auto; min-width: 0; font-size: var(--text-lg); }
.check-bar-type { flex: 0 0 auto; cursor: pointer; }
.check-bar-port { flex: 0 0 auto; width: 7rem; }
.check-bar-input:focus { outline: 2px solid var(--c-accent-soft); border-color: var(--c-accent); }
.check-bar-go { flex: 0 0 auto; white-space: nowrap; }

/* The port field is shown only when the TCP type is selected (pure CSS). */
.port-field { display: none; }
.check-bar:has(option[value="tcp"]:checked) .port-field { display: block; }

.hint-line { font-size: var(--text-xs); margin: var(--space-2) 0 var(--space-5); }

.callout { border-left: 3px solid var(--c-accent); }
.callout p { max-width: 60ch; color: var(--c-ink-soft); }

/* The live / result panel that fills #result-stage under the check bar (on both
 * the homepage and the standalone result page). It is a card-less, full-bleed
 * stack: a status bar, the summary strip, the per-node table, and the actions —
 * each a full-width block whose own border divides it from the next (no gap, no
 * card box). The blocks re-render together as the panel polls itself running. */
.live-panel { display: flex; flex-direction: column; gap: 0; }

/* The standalone result page is full-bleed like a grid list page — no centred
 * 960px column, so the table and bars span the content area beside the chrome. */
.result-bleed { max-width: none; margin: 0; padding: 0; }

.live-bar { display: flex; align-items: center; gap: var(--space-3); flex-wrap: wrap; }
.live-bar-title { flex: 1; font-weight: 600; }

.progress {
  min-width: 90px;
  height: 9px;
  background: var(--c-surface-2);
  border-radius: var(--radius-pill);
  overflow: hidden;
}
/* The bar's width is the one data-driven dimension on a page: it threads in
   through the --pct custom property (set on the element, or by countdown.js for
   the live ticker) rather than a literal inline style rule. */
.progress .bar {
  height: 100%;
  width: var(--pct, 0);
  background: var(--c-accent);
  transition: width 0.4s ease;
}
.progress .bar.pass { background: var(--c-pass-fg); }
.progress .bar.fail { background: var(--c-fail-fg); }
.progress .bar.timeout { background: var(--c-warn-fg); }

/* The live countdown bar is taller than the static progress bar so its
   remaining-seconds number fits, and it depletes as a node's deadline
   approaches. countdown.js updates the width and the number each tick; the
   text-shadow keeps the number legible over both the filled (accent) and
   empty (surface) track in either theme. */
.progress.countdown {
  position: relative;
  height: 18px;
}
.progress.countdown .bar { transition: width 0.25s linear; }
.progress-num {
  position: absolute;
  inset: 0;
  display: flex;
  align-items: center;
  justify-content: center;
  font-size: var(--text-xs);
  font-weight: 600;
  font-variant-numeric: tabular-nums;
  color: var(--c-ink);
  text-shadow: 0 0 2px var(--c-surface), 0 1px 2px var(--c-surface);
  pointer-events: none;
}

/* The "Keep result" / "Kept permanently" pin action lives in the live-bar header
   beside the status pill — a flush inline control, not a bottom strip. */
.live-bar-keep { margin: 0; }

/* --- Public check page on a phone -------------------------------------- */
/* Below the shared 48rem breakpoint the desktop layouts break down: the check
   bar's three controls won't fit one row, and the fixed-layout per-node table
   crushes its up-to-12 columns to a few illegible pixels each. So the bar wraps
   and the table collapses into one stacked card per node — each cell a
   `label : value` row (the label is the hidden column header, surfaced via
   `::before { content: attr(data-label) }`). Cells become block boxes, which
   makes `table-layout: fixed` and the <colgroup> percent widths inert, so the
   desktop column resizer (columns.js) writes have no effect here. */
@media (max-width: 48rem) {
  /* Check-bar: full-width target on its own row; type + Check (+ TCP port when
     shown) share the next row. */
  .check-bar { flex-wrap: wrap; padding: var(--space-3) var(--space-4); gap: var(--space-2); }
  .check-bar-target { flex: 1 1 100%; font-size: var(--text-base); }
  .check-bar-type { flex: 1 1 auto; }
  .check-bar-go { flex: 0 0 auto; }
  .check-bar .port-field { flex: 0 0 6rem; }

  /* Result table -> one stacked card per node. */
  .result-table,
  .result-table tbody,
  .result-table tr,
  .result-table td { display: block; width: auto; }
  .result-table colgroup,
  .result-table thead { display: none; }
  .result-table tr {
    border: 1px solid var(--c-border);
    border-radius: var(--radius-sm);
    margin: var(--space-3) var(--space-4);
    padding: var(--space-2) var(--space-3);
  }
  .result-table td {
    border: 0;
    padding: var(--space-1) 0;
    white-space: normal;          /* undo desktop col-clip/col-nowrap ellipsis */
    overflow: visible;
    text-overflow: clip;
    text-align: left;             /* undo col-num right-align */
    display: flex;
    justify-content: space-between;
    gap: var(--space-3);
  }
  .result-table td::before {
    content: attr(data-label);
    color: var(--c-muted);
    font-size: var(--text-xs);
    font-weight: 600;
    flex: 0 0 auto;
  }
  /* The node IP is the card heading, not a label : value row. */
  .result-table .node-ip {
    display: block;
    font-size: var(--text-base);
    font-weight: 700;
    padding-bottom: var(--space-2);
    margin-bottom: var(--space-1);
    border-bottom: 1px solid var(--c-border);
    overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
  }
  .result-table .node-ip::before { content: none; }
  /* The route sparkline + the running-state countdown bar sit right of their
     label without stretching to fill the row. */
  .result-table .route-cell { white-space: normal; }
  /* On a stacked row the answer has the full width, so let it wrap rather than
     clip — the title tooltip is unavailable on touch. */
  .result-table .col-records { white-space: normal; overflow: visible; }
  .route-glance { max-width: 60%; }
  .result-table .result-cell .progress { flex: 0 0 auto; }
  /* Drag-to-resize is meaningless on touch. */
  .result-table th .col-resizer { display: none; }
}

.link-copy {
  width: 100%;
  padding: var(--space-2) var(--space-3);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  background: var(--c-surface-2);
  font-size: var(--text-sm);
}

/* --- Device pairing QR code -------------------------------------------- */

/* The deep-link + copy-code row shown to Android visitors pairing on-device. */
.pair-actions {
  display: flex;
  flex-wrap: wrap;
  gap: var(--space-2);
  margin: var(--space-4) 0 var(--space-2);
}

.qr-box {
  display: inline-block;
  padding: var(--space-4);
  margin: var(--space-4) 0;
  background: #fff;
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
}
.qr-box img, .qr-box canvas { display: block; }

.qr-manual { margin-top: var(--space-2); }
.qr-manual summary { cursor: pointer; color: var(--c-ink-soft); font-size: var(--text-sm); }

/* --- Install a node ---------------------------------------------------- */

/* Pick-a-platform segmented control. A no-JS tab strip: hidden radios drive
 * both the active segment and which panel shows, via `~` sibling selectors.
 * All colours are theme tokens, so light and dark are both covered. */
.install-tabs { margin: var(--space-4) 0; }

/* The radios are visually hidden but still focusable, so arrow keys move
 * between segments (same clip technique as the settings toggle). */
.install-tab-input {
  position: absolute;
  width: 1px;
  height: 1px;
  margin: -1px;
  padding: 0;
  border: 0;
  overflow: hidden;
  clip: rect(0 0 0 0);
}
.install-tabbar {
  display: flex;
  flex-wrap: wrap;
  gap: var(--space-2);
  padding: var(--space-1);
  background: var(--c-surface-2);
  border: 1px solid var(--c-border);
  border-radius: var(--radius);
}
.install-tabbar label {
  flex: 1 1 auto;
  text-align: center;
  padding: var(--space-2) var(--space-4);
  border: 1px solid transparent;
  border-radius: var(--radius-sm);
  font-size: var(--text-sm);
  font-weight: 600;
  color: var(--c-ink-soft);
  cursor: pointer;
  transition: background 0.1s, border-color 0.1s, color 0.1s;
}
.install-tabbar label:hover { color: var(--c-ink); }

/* Active segment — one rule per radio (no :has on the label itself). */
#tab-docker:checked ~ .install-tabbar label[for="tab-docker"],
#tab-linux:checked ~ .install-tabbar label[for="tab-linux"],
#tab-routeros:checked ~ .install-tabbar label[for="tab-routeros"] {
  background: var(--c-accent-soft);
  border-color: var(--c-accent);
  color: var(--c-ink);
}
/* Keyboard focus ring on the focused segment's label. */
#tab-docker:focus-visible ~ .install-tabbar label[for="tab-docker"],
#tab-linux:focus-visible ~ .install-tabbar label[for="tab-linux"],
#tab-routeros:focus-visible ~ .install-tabbar label[for="tab-routeros"] {
  outline: 2px solid var(--c-accent);
  outline-offset: 2px;
}

/* Panels: card-like surfaces; only the checked radio's panel shows. */
.install-panels { margin-top: var(--space-4); }
.tab-panel {
  display: none;
  background: var(--c-surface);
  border: 1px solid var(--c-border);
  border-radius: var(--radius);
  padding: var(--space-4) var(--space-5);
  box-shadow: var(--shadow);
}
#tab-docker:checked ~ .install-panels #panel-docker,
#tab-linux:checked ~ .install-panels #panel-linux,
#tab-routeros:checked ~ .install-panels #panel-routeros { display: block; }

/* The "Then: enable ping" step is set off from the install command above it. */
.install-step {
  margin-top: var(--space-5);
  padding-top: var(--space-4);
  border-top: 1px solid var(--c-border);
}

/* Inline "show more" expanders inside a panel. */
.tab-panel .more { margin-top: var(--space-3); }
.tab-panel .more summary {
  cursor: pointer;
  color: var(--c-ink-soft);
  font-size: var(--text-sm);
}

/* A copyable command block: monospace, scrollable, with a Copy button. It is a
 * terminal-style surface, so its colours are pinned to constants — NOT theme
 * tokens — and stay legible (light text on dark) in both light and dark mode.
 * The Copy button floats top-right in a reserved top band so the first command
 * line never renders under it, even when a long line scrolls horizontally. */
.code-block { position: relative; margin: var(--space-3) 0; }
.code-block pre {
  margin: 0;
  padding: var(--space-4);
  padding-top: 2.6rem;
  background: #0f172a;
  color: #e5edff;
  border: 1px solid #1e293b;
  border-radius: var(--radius-sm);
  overflow-x: auto;
}
.code-block code {
  font-family: var(--font-mono);
  font-size: var(--text-sm);
  line-height: 1.5;
  white-space: pre;
}
.code-copy {
  position: absolute;
  top: var(--space-2);
  right: var(--space-2);
  padding: var(--space-1) var(--space-3);
  font-size: var(--text-xs);
  color: #cbd5e1;
  background: rgba(255, 255, 255, 0.08);
  border: 1px solid rgba(255, 255, 255, 0.2);
  border-radius: var(--radius-sm);
  cursor: pointer;
}
.code-copy:hover {
  color: #fff;
  background: rgba(255, 255, 255, 0.16);
  border-color: rgba(255, 255, 255, 0.45);
}

/* ======================================================================= */
/* Dashboard app shell: collapsible sidebar + slim topbar                  */
/*                                                                         */
/* The authenticated dashboard has its own chrome — a left sidebar and a   */
/* slim .app-topbar — and never the public .topbar above. Everything below */
/* draws from the same theme tokens, so light and dark are both covered.   */
/* ======================================================================= */

:root { --sidebar-w: 248px; --rail-w: 68px; }

.app-shell { display: flex; min-height: 100vh; }

/* --- Sidebar ----------------------------------------------------------- */
.sidebar {
  width: var(--sidebar-w);
  flex-shrink: 0;
  background: var(--c-surface);
  border-right: 1px solid var(--c-border);
  display: flex;
  flex-direction: column;
  position: sticky;
  top: 0;
  height: 100vh;
  overflow-y: auto;
  transition: width 0.18s ease;
}

.sidebar-brand {
  display: flex;
  align-items: center;
  gap: var(--space-2);
  height: 60px;
  padding: 0 var(--space-4);
  border-bottom: 1px solid var(--c-border);
}
.brand-link {
  display: flex;
  align-items: center;
  gap: var(--space-2);
  flex: 1;
  min-width: 0;
  text-decoration: none;
  color: var(--c-ink);
  font-weight: 700;
  font-size: var(--text-lg);
}
.brand-logo { width: 26px; height: 26px; color: var(--c-accent); flex-shrink: 0; }
.brand-name { white-space: nowrap; overflow: hidden; }
.rail-toggle {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 30px; height: 30px;
  flex-shrink: 0;
  border: 0;
  border-radius: var(--radius-sm);
  background: transparent;
  color: var(--c-muted);
  cursor: pointer;
}
.rail-toggle:hover { background: var(--c-surface-2); color: var(--c-ink); }
.rail-toggle .icon { width: 18px; height: 18px; }

/* --- Sidebar nav ------------------------------------------------------- */
.sidebar-nav { padding: var(--space-3) var(--space-2) var(--space-5); }
.nav-group + .nav-group { margin-top: var(--space-2); }

.nav-group-toggle {
  display: flex;
  align-items: center;
  gap: var(--space-2);
  width: 100%;
  padding: var(--space-2) var(--space-3);
  border: 0;
  background: transparent;
  cursor: pointer;
  color: var(--c-faint);
  font: inherit;
  font-size: var(--text-xs);
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.05em;
}
.nav-group-toggle:hover { color: var(--c-muted); }
.nav-group-label { flex: 1; text-align: left; white-space: nowrap; overflow: hidden; }
.nav-group-chevron { width: 14px; height: 14px; flex-shrink: 0; transition: transform 0.18s ease; }
.nav-group[data-collapsed] .nav-group-chevron { transform: rotate(-90deg); }

.nav-group-items { list-style: none; margin: var(--space-1) 0 0; padding: 0; }
.nav-group[data-collapsed] .nav-group-items { display: none; }

.nav-item {
  display: flex;
  align-items: center;
  gap: var(--space-3);
  /* The extra left padding indents children beneath their group label. */
  padding: var(--space-2) var(--space-3) var(--space-2) var(--space-4);
  margin: 1px var(--space-1);
  border-radius: var(--radius-sm);
  text-decoration: none;
  color: var(--c-ink-soft);
  font-size: var(--text-sm);
  white-space: nowrap;
}
.nav-item:hover { background: var(--c-surface-2); color: var(--c-ink); }
.nav-item.active { background: var(--c-accent-soft); color: var(--c-accent); font-weight: 600; }
.nav-icon { width: 18px; height: 18px; flex-shrink: 0; }
.nav-text { overflow: hidden; text-overflow: ellipsis; }

/* --- Content column + slim topbar -------------------------------------- */
.content { flex: 1; min-width: 0; display: flex; flex-direction: column; }

.app-topbar {
  position: sticky;
  top: 0;
  z-index: 20;
  display: flex;
  align-items: center;
  gap: var(--space-3);
  height: 60px;
  padding: 0 var(--space-5);
  background: var(--c-surface);
  border-bottom: 1px solid var(--c-border);
}
.topbar-left { display: flex; align-items: center; gap: var(--space-3); flex: 1; min-width: 0; }
.app-title {
  margin: 0;
  font-size: var(--text-lg);
  font-weight: 600;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}
.topbar-actions { display: flex; align-items: center; gap: var(--space-2); }

.icon-btn {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 38px; height: 38px;
  border: 0;
  border-radius: var(--radius-sm);
  background: transparent;
  color: var(--c-muted);
  cursor: pointer;
  font-size: var(--text-lg);
  line-height: 1;
}
.icon-btn:hover { background: var(--c-surface-2); color: var(--c-ink); }
.icon-btn .icon { width: 20px; height: 20px; }

/* The theme toggle reuses .icon-btn here; override the dark-bar base colours
 * it inherits from the public .theme-toggle rule. */
.app-topbar .theme-toggle { color: var(--c-muted); }
.app-topbar .theme-toggle:hover { background: var(--c-surface-2); }

.hamburger { display: none; } /* shown only on mobile */

.app-topbar .app-org select {
  background: var(--c-surface-2);
  color: var(--c-ink);
  border: 1px solid var(--c-border);
  border-radius: var(--radius-sm);
  padding: var(--space-2) var(--space-3);
  font: inherit;
  font-size: var(--text-sm);
}

/* --- Account avatar + dropdown ----------------------------------------- */
.avatar {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 32px; height: 32px;
  flex-shrink: 0;
  border-radius: var(--radius-pill);
  background: var(--c-accent);
  color: #fff;
  font-size: var(--text-xs);
  font-weight: 700;
}
.avatar-lg { width: 40px; height: 40px; font-size: var(--text-sm); }

.user-menu { position: relative; }
.user-trigger {
  display: flex;
  align-items: center;
  gap: var(--space-2);
  max-width: 14rem;
  padding: var(--space-1) var(--space-2);
  border: 1px solid transparent;
  border-radius: var(--radius-pill);
  background: transparent;
  cursor: pointer;
  color: var(--c-ink);
  font: inherit;
}
.user-trigger:hover { background: var(--c-surface-2); }
.user-name { font-size: var(--text-sm); font-weight: 600; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
.user-trigger .caret { width: 16px; height: 16px; color: var(--c-muted); transition: transform 0.15s ease; }
.user-menu.open .user-trigger .caret { transform: rotate(180deg); }

.user-dropdown {
  position: absolute;
  top: calc(100% + var(--space-2));
  right: 0;
  z-index: 30;
  min-width: 15rem;
  padding: var(--space-2);
  display: none;
  background: var(--c-surface);
  border: 1px solid var(--c-border);
  border-radius: var(--radius);
  box-shadow: var(--shadow);
}
.user-menu.open .user-dropdown { display: block; }
.user-dropdown-head { display: flex; align-items: center; gap: var(--space-3); padding: var(--space-2); }
.user-dropdown-id { min-width: 0; }
.user-dropdown-name { font-weight: 600; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
.user-dropdown-role { font-size: var(--text-xs); color: var(--c-muted); }
.user-dropdown-section {
  padding: var(--space-2) var(--space-2) var(--space-1);
  font-size: var(--text-xs);
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.04em;
  color: var(--c-faint);
}
.user-dropdown-divider { height: 1px; margin: var(--space-2) 0; background: var(--c-border); }
.user-dropdown form { margin: 0; }
.user-dropdown-item {
  display: block;
  width: 100%;
  padding: var(--space-2) var(--space-3);
  text-align: left;
  border: 0;
  border-radius: var(--radius-sm);
  background: transparent;
  color: var(--c-ink-soft);
  text-decoration: none;
  font: inherit;
  font-size: var(--text-sm);
  cursor: pointer;
}
.user-dropdown-item:hover { background: var(--c-surface-2); color: var(--c-ink); }
.user-dropdown-danger { color: var(--c-fail-fg); }
.user-dropdown-danger:hover { background: var(--c-fail-bg); color: var(--c-fail-fg); }

/* --- Mobile drawer backdrop -------------------------------------------- */
.sidebar-backdrop { position: fixed; inset: 0; z-index: 40; background: rgba(15, 23, 42, 0.5); }
.sidebar-backdrop[hidden] { display: none; }

/* --- Desktop: collapse the sidebar to an icon-rail --------------------- */
@media (min-width: 60.0625rem) {
  .sidebar-backdrop { display: none; }

  :root[data-rail] .sidebar { width: var(--rail-w); }
  :root[data-rail] .brand-name,
  :root[data-rail] .nav-text,
  :root[data-rail] .nav-group-toggle { display: none; }
  :root[data-rail] .sidebar-brand { justify-content: center; padding: 0; }
  /* In rail mode the logo gives way to the toggle, which becomes the
     "expand" affordance — its chevron flips to point the other way. */
  :root[data-rail] .brand-link { display: none; }
  :root[data-rail] .rail-toggle .icon { transform: scaleX(-1); }
  :root[data-rail] .nav-group + .nav-group {
    margin-top: var(--space-2);
    padding-top: var(--space-2);
    border-top: 1px solid var(--c-border);
  }
  :root[data-rail] .nav-group-items { display: block; }
  :root[data-rail] .nav-item { justify-content: center; padding: var(--space-2); margin: 2px var(--space-1); }
  :root[data-rail] .nav-icon { width: 20px; height: 20px; }
}

/* --- Mobile: sidebar becomes an off-canvas drawer ---------------------- */
@media (max-width: 60rem) {
  .hamburger { display: inline-flex; }
  .user-name { display: none; }
  .sidebar {
    position: fixed;
    top: 0; left: 0; bottom: 0;
    height: 100vh;
    z-index: 50;
    transform: translateX(-100%);
    transition: transform 0.2s ease;
    box-shadow: 0 10px 40px rgba(0, 0, 0, 0.35);
  }
  .app-shell.drawer-open .sidebar { transform: none; }
}
