/* ============================================================================
   CertainGuard — application stylesheet ("The Crest" brand)
   Guardian Teal primary · Sentinel Indigo depth · Verified Lime (status only).
   Palette/typography from brand/tokens + brand-book.md. Plain CSS, no build step.
   ============================================================================ */

/* --- Self-hosted brand fonts (offline/prod-safe; OFL/SIL, embeddable) -------
   Inter + Space Grotesk are variable woff2 (one file spans the weight range);
   IBM Plex Mono ships per-weight. Sources documented in fonts/README.md. */
@font-face {
  font-family: "Inter";
  font-style: normal;
  font-weight: 400 700;
  font-display: swap;
  src: url("../fonts/inter.woff2") format("woff2");
}
@font-face {
  font-family: "Space Grotesk";
  font-style: normal;
  font-weight: 400 700;
  font-display: swap;
  src: url("../fonts/spacegrotesk.woff2") format("woff2");
}
@font-face {
  font-family: "IBM Plex Mono";
  font-style: normal;
  font-weight: 400;
  font-display: swap;
  src: url("../fonts/ibmplexmono-400.woff2") format("woff2");
}
@font-face {
  font-family: "IBM Plex Mono";
  font-style: normal;
  font-weight: 500;
  font-display: swap;
  src: url("../fonts/ibmplexmono-500.woff2") format("woff2");
}

:root {
  /* --- Brand palette tokens (from brand/tokens/colors.css) ----------------- */
  --cg-primary-900: #052E2B;
  --cg-primary-800: #0A3F3A;
  --cg-primary-700: #0E524B;
  --cg-primary-600: #126B62;   /* Guardian Teal — primary brand color */
  --cg-primary-500: #178A7E;
  --cg-primary-400: #34A89B;
  --cg-primary-300: #6CC4BA;   /* brand on dark */
  --cg-primary-200: #A6DDD6;
  --cg-primary-100: #D6F0EC;
  --cg-primary-050: #EEF8F6;

  --cg-secondary-900: #0B1130;   /* Sentinel Indigo night */
  --cg-secondary-800: #131B4A;
  --cg-secondary-700: #1C2A6B;   /* Sentinel Indigo — secondary brand */
  --cg-secondary-500: #3A4FB0;
  --cg-secondary-300: #8E9CE0;
  --cg-secondary-100: #E2E7FA;

  --cg-accent-600: #4F8A12;
  --cg-accent-400: #84CF2C;   /* Verified Lime — status/validity only */

  --cg-neutral-900: #0E1417;
  --cg-neutral-700: #2C3A41;
  --cg-neutral-600: #45565E;
  --cg-neutral-400: #8597A0;
  --cg-neutral-200: #D2DBDF;
  --cg-neutral-100: #E8EDEF;
  --cg-neutral-050: #F5F8F9;

  /* --- App semantic mapping (existing var names → brand tokens) ------------ */
  --bg: var(--cg-neutral-050);
  --surface: #ffffff;
  --surface-2: var(--cg-neutral-050);
  --border: var(--cg-neutral-200);
  --border-strong: #c2cdd3;
  --text: var(--cg-neutral-900);
  --text-muted: var(--cg-neutral-600);
  --text-faint: var(--cg-neutral-400);

  --brand: var(--cg-primary-600);        /* Guardian Teal — links, buttons */
  --brand-dark: var(--cg-primary-700);   /* hover/pressed (AAA on white) */
  --brand-tint: var(--cg-primary-100);

  /* Dark surfaces use Sentinel Indigo night (header, code blocks). */
  --night: var(--cg-secondary-900);
  --night-2: #111a45;

  --ok: #1f7e45;            /* success-text — AA on white */
  --ok-bg: #e6f4ec;
  --warn: #9a6310;          /* warn-text — AA on white */
  --warn-bg: #fbf3df;
  --danger: #c8362f;        /* danger — AA on white */
  --danger-bg: #fdecea;
  --info: #2a6fb0;          /* info */
  --info-bg: #e4f0f6;
  --neutral: var(--cg-neutral-600);
  --neutral-bg: var(--cg-neutral-100);
  --purple: var(--cg-secondary-700);     /* role badge → Sentinel Indigo */
  --purple-bg: var(--cg-secondary-100);

  --radius: 8px;
  --radius-sm: 5px;
  --shadow: 0 1px 2px rgba(11, 17, 48, 0.06), 0 1px 3px rgba(11, 17, 48, 0.08);
  --mono: "IBM Plex Mono", ui-monospace, "SFMono-Regular", "Consolas", Menlo, monospace;
  --sans: "Inter", ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  --display: "Space Grotesk", var(--sans);
}

* { box-sizing: border-box; }

html, body {
  margin: 0;
  padding: 0;
  background: var(--bg);
  color: var(--text);
  font-family: var(--sans);
  font-size: 14px;
  line-height: 1.5;
  -webkit-font-smoothing: antialiased;
}

a { color: var(--brand); text-decoration: none; }
a:hover { text-decoration: underline; }

/* Display face (Space Grotesk) for headings & logotype, per brand book. */
h1, h2, h3, .page-head h1, .card .card-head h2 {
  font-family: var(--display);
  letter-spacing: -0.3px;
}
/* Certificate data, fingerprints, domains, code → IBM Plex Mono (tabular). */
.mono, .kv, code, pre { font-variant-numeric: tabular-nums; }

/* ---------- Top header ---------- */
.app-header {
  background: var(--night);              /* Sentinel Indigo night */
  color: #e7edf3;
  border-bottom: 3px solid var(--cg-primary-500);
}
.app-header .bar {
  max-width: 1240px;
  margin: 0 auto;
  display: flex;
  align-items: center;
  gap: 24px;
  padding: 0 24px;
  /* min-height, not height: .app-nav wraps on narrow viewports, and a hard 56px would let the
     wrapped row spill out of the bar and overlap the page below. */
  min-height: 56px;
}
/* The Crest horizontal lockup, inlined so currentColor = header text (white). */
.app-header .logo {
  display: flex;
  align-items: center;
  color: #fff;
  white-space: nowrap;
}
.app-header .logo:hover { text-decoration: none; opacity: 0.92; }
.app-header .logo .cg-lockup {
  height: 28px;
  width: auto;
  display: block;
}
.app-nav {
  display: flex;
  gap: 2px;
  flex: 1;
  flex-wrap: wrap;
}
.app-nav a {
  color: #b9c6d2;
  padding: 7px 11px;
  border-radius: 6px;
  font-size: 13px;
  font-weight: 500;
}
.app-nav a:hover { background: rgba(255,255,255,0.08); color: #fff; text-decoration: none; }
.app-nav a.active { background: var(--brand); color: #fff; }
/* Endpoint-warning count on the "Endpoints" nav item (UX #2): amber-on-dark, same family as the
   staging env chip, so it reads as "warning" without shouting. Visible on hover/active too. */
.app-nav .nav-badge {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  min-width: 18px;
  height: 18px;
  margin-left: 2px;
  padding: 0 5px;
  border-radius: 999px;
  font-size: 10.5px;
  font-weight: 700;
  font-variant-numeric: tabular-nums;
  background: #ffd884;
  color: #5a3e00;
}

/* ---------- Global cert quick-search in the header (UX #3) ---------- */
/* A subtle dark-field input: from any page, type a name/SAN + Enter → /Certs?q=… (plain GET). */
.header-search { position: relative; flex: none; }
.header-search .ico {
  position: absolute;
  left: 10px;
  top: 50%;
  transform: translateY(-50%);
  font-size: 12px;
  color: #8fa1b0;
  pointer-events: none;
}
.header-search input {
  width: 200px;
  padding: 6px 10px 6px 30px;
  font: inherit;
  font-size: 12.5px;
  color: #e7edf3;
  background: rgba(255,255,255,0.07);
  border: 1px solid rgba(255,255,255,0.16);
  border-radius: 999px;
  transition: background 0.12s ease, border-color 0.12s ease;
}
.header-search input::placeholder { color: #8fa1b0; }
.header-search input:hover { background: rgba(255,255,255,0.10); }
.header-search input:focus {
  outline: none;
  background: rgba(255,255,255,0.12);
  border-color: var(--cg-primary-300);
  box-shadow: 0 0 0 3px rgba(23,138,126,0.35);   /* --cg-primary-500 at 35% — visible ring on the dark bar */
}
/* Narrow widths: shrink, then drop the quick-search so the bar never overflows (the cert list's
   own search stays one nav click away). */
@media (max-width: 1120px) { .header-search input { width: 140px; } }
@media (max-width: 900px) { .header-search { display: none; } }

/* The env-pill is still used inside the Settings page (ACME card). */
.env-pill {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  font-size: 11.5px;
  font-weight: 700;
  letter-spacing: 0.4px;
  text-transform: uppercase;
  padding: 5px 10px;
  border-radius: 999px;
  white-space: nowrap;
}
.env-pill.staging { background: #5a3e00; color: #ffd884; border: 1px solid #806000; }
.env-pill.production { background: #5b1512; color: #ffb3ad; border: 1px solid #8a201b; }
.env-pill .dot { width: 7px; height: 7px; border-radius: 50%; background: currentColor; }

/* ---------- Compact, icon-first header status cluster ---------- */
.status-cluster {
  display: flex;
  align-items: center;
  gap: 10px;
  white-space: nowrap;
}

/* Env: a small dot+label chip; full text ("ACME environment: …") lives in the title tooltip. */
.env-chip {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  font-size: 11px;
  font-weight: 700;
  letter-spacing: 0.4px;
  text-transform: uppercase;
  padding: 4px 9px;
  border-radius: 999px;
  cursor: default;
}
.env-chip .dot { width: 7px; height: 7px; border-radius: 50%; background: currentColor; flex: none; }
.env-chip.staging { background: #5a3e00; color: #ffd884; border: 1px solid #806000; }
.env-chip.production { background: #5b1512; color: #ffb3ad; border: 1px solid #8a201b; }
/* Narrow widths: collapse to just the coloured dot to protect the bar from overflow. */
@media (max-width: 760px) { .env-chip .env-text { display: none; } .env-chip { padding: 5px; } }

/* Account: an avatar button that opens a CSS-only popover (no JS) with name/role + dev switcher. */
.user-menu { position: relative; }
.user-menu > summary {
  list-style: none;
  display: inline-flex;
  align-items: center;
  gap: 6px;
  cursor: pointer;
  border-radius: 999px;
  padding: 2px;
}
.user-menu > summary::-webkit-details-marker { display: none; }
.user-menu > summary:focus-visible { outline: 2px solid var(--cg-primary-300); outline-offset: 2px; }
.user-menu .avatar {
  width: 30px; height: 30px;
  border-radius: 50%;
  background: var(--brand);
  color: #fff;
  display: grid; place-items: center;
  font-size: 12px; font-weight: 700;
  flex: none;
}
.user-menu .avatar.lg { width: 38px; height: 38px; font-size: 14px; }
.user-menu .dev-tag {
  font-size: 9.5px; font-weight: 700; letter-spacing: 0.5px;
  color: #ffd884; background: #5a3e00; border: 1px solid #806000;
  border-radius: 4px; padding: 1px 4px;
}

/* The popover panel (light surface, anchored to the avatar button). */
.user-popover {
  position: absolute;
  top: calc(100% + 8px);
  right: 0;
  min-width: 230px;
  background: var(--surface);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  box-shadow: 0 8px 24px rgba(11, 17, 48, 0.18);
  padding: 14px;
  z-index: 50;
}
.user-popover .who { display: flex; align-items: center; gap: 10px; }
.user-popover .who .meta { line-height: 1.3; display: flex; flex-direction: column; }
.user-popover .who .name { font-size: 13.5px; font-weight: 650; color: var(--text); }
.user-popover .who .role { font-size: 11.5px; color: var(--text-muted); }

/* Sign-out sits below the identity block with the same separator as the dev switcher,
   so the button never crowds/overlaps the avatar + name row. */
.user-popover .sign-out-block {
  margin-top: 12px;
  padding-top: 12px;
  border-top: 1px solid var(--border);
}
.user-popover .sign-out-block form { margin: 0; }
.user-popover .sign-out-block .btn { width: 100%; justify-content: center; }

/* Dev-only identity switcher (never rendered under Entra), now inside the account popover. */
.user-popover .dev-switch-block {
  margin-top: 12px;
  padding-top: 12px;
  border-top: 1px solid var(--border);
}
.user-popover .dev-switcher { display: flex; flex-direction: column; gap: 6px; }
.user-popover .dev-switcher label {
  display: inline-flex; align-items: center; gap: 6px;
  font-size: 11.5px; font-weight: 600; color: var(--text-muted);
}
.user-popover .dev-switcher .dev-tag {
  font-size: 9.5px; font-weight: 700; letter-spacing: 0.5px;
  color: #7a5200; background: var(--warn-bg); border: 1px solid #e8cd86;
  border-radius: 4px; padding: 1px 5px;
}
.user-popover .dev-switcher select {
  font: inherit; font-size: 12.5px;
  padding: 7px 9px;
  border: 1px solid var(--border-strong); border-radius: var(--radius-sm);
  background: #fff; color: var(--text); cursor: pointer;
}
.user-popover .dev-switcher select:focus { outline: none; border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-tint); }

/* CSS-only SAN disclosure (same <details> popover pattern as the account menu, no JavaScript). */
.sans-pop { position: relative; display: inline-block; }
.sans-pop > summary {
  list-style: none;
  cursor: pointer;
  font-size: 11.5px; font-weight: 600;
  color: var(--brand);
}
.sans-pop > summary::-webkit-details-marker { display: none; }
.sans-pop > summary:focus-visible { outline: 2px solid var(--cg-primary-300); outline-offset: 2px; }
.sans-popover {
  position: absolute;
  top: calc(100% + 6px);
  left: 0;
  min-width: 220px; max-width: 360px;
  background: var(--surface);
  color: var(--text);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  box-shadow: 0 8px 24px rgba(11, 17, 48, 0.18);
  padding: 10px 12px;
  font-size: 12.5px; line-height: 1.5;
  white-space: normal; overflow-wrap: anywhere;
  /* A cert can carry dozens of SANs: cap the panel and scroll the list inside it rather than
     running past the bottom of the viewport. Short lists stay well under the cap — no scrollbar. */
  max-height: min(320px, 60vh);
  overflow-y: auto;
  z-index: 50;
}

/* ---------- Layout ---------- */
.page {
  max-width: 1240px;
  margin: 0 auto;
  padding: 24px;
}
.page-head {
  display: flex;
  align-items: flex-start;
  justify-content: space-between;
  gap: 16px;
  margin-bottom: 18px;
  flex-wrap: wrap;
}
.page-head h1 {
  font-size: 22px;
  margin: 0 0 4px;
  font-weight: 650;
}
.page-head .sub { color: var(--text-muted); font-size: 13.5px; }
.breadcrumb { font-size: 12.5px; color: var(--text-muted); margin-bottom: 8px; }
.breadcrumb a { color: var(--text-muted); }

/* ---------- Section sub-navigation (tabs) ---------- */
/* Used to group related admin pages under one top-nav destination (Groups | API tokens,
   General | Users) without a framework — each is a plain link with an active state. */
.tabnav {
  display: flex;
  gap: 4px;
  border-bottom: 1px solid var(--border);
  margin-bottom: 18px;
  flex-wrap: wrap;
}
.tabnav a {
  font-size: 13px;
  font-weight: 600;
  color: var(--text-muted);
  padding: 9px 14px;
  border-radius: var(--radius-sm) var(--radius-sm) 0 0;
  border: 1px solid transparent;
  border-bottom: none;
  margin-bottom: -1px;
}
.tabnav a:hover { color: var(--text); text-decoration: none; background: var(--surface-2); }
.tabnav a.active {
  color: var(--brand-dark);
  background: var(--surface);
  border-color: var(--border);
  border-bottom: 1px solid var(--surface);
}

/* ---------- Cards ---------- */
.card {
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  box-shadow: var(--shadow);
}
.card .card-head {
  padding: 13px 18px;
  border-bottom: 1px solid var(--border);
  display: flex; align-items: center; justify-content: space-between; gap: 12px;
}
.card .card-head h2 { font-size: 14.5px; margin: 0; font-weight: 650; }
.card .card-head .hint { font-size: 12px; color: var(--text-faint); font-weight: 400; }
.card .card-body { padding: 18px; }
.card .card-body.tight { padding: 0; }

.grid { display: grid; gap: 18px; }
.grid-2 { grid-template-columns: 1fr 1fr; }
.grid-3 { grid-template-columns: repeat(3, 1fr); }
.grid-4 { grid-template-columns: repeat(4, 1fr); }
.grid-5 { grid-template-columns: repeat(5, 1fr); }
.grid-main { grid-template-columns: 2fr 1fr; align-items: start; }
@media (max-width: 980px) {
  .grid-2, .grid-3, .grid-4, .grid-5, .grid-main { grid-template-columns: 1fr; }
}
@media (min-width: 981px) and (max-width: 1240px) {
  .grid-5 { grid-template-columns: repeat(3, 1fr); }
}

/* ---------- Stat tiles ---------- */
/* Every stat tile is a peer: one shared min-height and one value size, with the label at the top,
   the value under it, and the foot pinned to the bottom edge — so tiles with short/long labels and
   1-digit/4-digit values all line up across every dashboard row. */
.stat {
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 16px 18px;
  box-shadow: var(--shadow);
  min-height: 112px;
  display: flex;
  flex-direction: column;
}
.stat .label { font-size: 12px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.4px; font-weight: 600; }
.stat .value { font-size: 26px; font-weight: 700; margin-top: 6px; line-height: 1.1; }
.stat .foot { font-size: 12px; color: var(--text-faint); margin-top: auto; padding-top: 6px; }
.stat.accent-ok { border-left: 4px solid var(--ok); }
.stat.accent-warn { border-left: 4px solid var(--warn); }
.stat.accent-warn-soft { border-left: 4px solid var(--warn); background: var(--warn-bg); }
.stat.accent-danger { border-left: 4px solid var(--danger); }
.stat.accent-info { border-left: 4px solid var(--info); }
.stat.accent-brand { border-left: 4px solid var(--brand); }
/* Clickable dashboard tiles deep-link into the pre-filtered certificate list. */
a.stat.tile { text-decoration: none; color: inherit; transition: box-shadow .12s ease, transform .12s ease, border-color .12s ease; }
a.stat.tile:hover { box-shadow: 0 4px 14px rgba(0,0,0,.10); transform: translateY(-1px); border-color: var(--border-strong); }
a.stat.tile:focus-visible { outline: 2px solid var(--brand); outline-offset: 2px; }

/* ---------- Dashboard layout ---------- */
.stat-row { margin-bottom: 18px; }                       /* one rhythm between tile rows (matches the grid gap) */
.section-head { display: flex; align-items: baseline; gap: 10px; margin: 4px 0 8px; }
.section-head h2 { font-size: 14px; margin: 0; }
.section-head .hint { font-size: 12px; color: var(--text-faint); font-weight: 400; }
.stack { display: grid; gap: 18px; align-content: start; }
/* The dashboard's lower row stretches its cards to equal height so the single right-hand card
   doesn't float loose next to the two stacked left-hand cards. */
.dash-main { align-items: stretch; }
.dash-main .card { min-height: 160px; }

/* ---------- Needs-attention triage band (dashboard, UX #1) ---------- */
/* One prominent strip above the stat grid answering "what needs me right now?". Alert mode is a
   surface card with a danger accent and big-count chips (danger/warn tints from the semantic
   tokens); the all-clear mode mirrors the Endpoints all-clear banner's calm confidence. */
.attention-band { border-radius: var(--radius); margin-bottom: 18px; }
.attention-band.alert {
  background: var(--surface);
  border: 1px solid var(--border);
  border-left: 4px solid var(--danger);
  box-shadow: var(--shadow);
  padding: 14px 18px 16px;
}
.attention-band .attention-head { display: flex; align-items: baseline; gap: 10px; margin-bottom: 10px; }
.attention-band .attention-head h2 { font-size: 14px; margin: 0; }
.attention-band .attention-head .hint { font-size: 12px; color: var(--text-faint); font-weight: 400; }
.attention-chips { display: flex; gap: 12px; flex-wrap: wrap; }
.attention-chip {
  display: inline-flex;
  align-items: center;
  gap: 12px;
  padding: 10px 16px;
  border-radius: var(--radius);
  border: 1px solid transparent;
  text-decoration: none;
  transition: box-shadow .12s ease, transform .12s ease;
}
.attention-chip:hover { text-decoration: none; box-shadow: 0 4px 14px rgba(0, 0, 0, .10); transform: translateY(-1px); }
.attention-chip:focus-visible { outline: 2px solid var(--brand); outline-offset: 2px; }
.attention-chip .count { font-size: 24px; font-weight: 700; line-height: 1; font-variant-numeric: tabular-nums; }
.attention-chip .what { display: flex; flex-direction: column; font-size: 12.5px; font-weight: 650; line-height: 1.25; }
.attention-chip .why { font-size: 11px; font-weight: 400; opacity: .8; }
.attention-chip.danger { background: var(--danger-bg); color: var(--danger); border-color: #f3b7b1; }
.attention-chip.warn { background: var(--warn-bg); color: var(--warn); border-color: #e8cd86; }
.attention-band.all-clear {
  display: flex;
  align-items: center;
  gap: 13px;
  padding: 14px 18px;
  background: var(--ok-bg);
  border: 1px solid #b4ddc4;
  border-left: 4px solid var(--ok);
  color: #14572f;
}
.attention-band.all-clear .ico { font-size: 18px; line-height: 1; flex: none; }
.attention-band.all-clear h2 { font-size: 14px; margin: 0 0 2px; }
.attention-band.all-clear p { margin: 0; font-size: 13px; }

/* LimitedUser lead card (UX #6): "My assigned certificates" hoisted above the estate stat grid. */
.my-certs-lead { margin-bottom: 18px; }

/* ---------- Badges ---------- */
.badge {
  display: inline-flex;
  align-items: center;
  gap: 5px;
  font-size: 11.5px;
  font-weight: 650;
  padding: 3px 9px;
  border-radius: 999px;
  white-space: nowrap;
  line-height: 1.4;
  border: 1px solid transparent;
}
.badge .dot { width: 6px; height: 6px; border-radius: 50%; background: currentColor; }
.badge.active     { background: var(--ok-bg);     color: var(--ok); }
/* "Valid" pulse: the one place Verified Lime is allowed — the active status dot. */
.badge.active .dot { background: var(--cg-accent-400); }
.badge.renewing   { background: var(--info-bg);   color: var(--info); }
.badge.issuing    { background: var(--info-bg);   color: var(--info); }
.badge.queued     { background: var(--brand-tint);color: var(--brand-dark); }
.badge.pending    { background: var(--neutral-bg);color: var(--neutral); }
.badge.cnamemissing { background: var(--warn-bg); color: var(--warn); }
.badge.failed     { background: var(--danger-bg); color: var(--danger); }
.badge.purged     { background: #322; color: #e6c9c6; }
.badge.disabled   { background: var(--neutral-bg);color: var(--neutral); border-color: var(--border-strong); }
.badge.renewaldue { background: var(--warn-bg);   color: var(--warn); }

.badge.tag { background: var(--surface-2); color: var(--text-muted); border-color: var(--border); font-weight: 500; }
/* "Not IP-restricted" flag on tokens with an empty CIDR allow-list. */
.badge.warn-ip { background: var(--warn-bg); color: var(--warn); border-color: #e8cd86; }

/* CSS-only "no IP restriction" warning in the token create form: visible only while the CIDR
   textarea is empty (its placeholder is showing). No JavaScript required. */
.cidr-field .cidr-empty-warning { display: none; margin: 10px 0 0; }
.cidr-field textarea:placeholder-shown ~ .cidr-empty-warning { display: flex; }
.badge.role { background: var(--purple-bg); color: var(--purple); }
.badge.success { background: var(--ok-bg); color: var(--ok); }
.badge.denied { background: var(--danger-bg); color: var(--danger); }
.badge.failure { background: var(--warn-bg); color: var(--warn); }

/* ---------- Tables ---------- */
/* The shared data-grid treatment: comfortable row height, clear sticky-capable headers, subtle
   separators + row hover, tabular numerics, truncation and empty-state utilities, and horizontal
   scroll on narrow viewports. Purely additive over the existing markup — every table.data across
   the app picks this up without changes. */

/* Every .data table lives in a .card-body.tight — that wrapper is the responsive scroll container. */
.card .card-body.tight { overflow-x: auto; }
/* overflow-x:auto makes the wrapper a scroll container on BOTH axes (overflow-y computes to auto),
   which would clip an open .sans-pop popover — or spawn a spurious vertical scrollbar to reach it.
   While a SAN popover is open, lift the clipping so the panel escapes the card; the moment it
   closes, the responsive horizontal scroll is back. */
.card .card-body.tight:has(.sans-pop[open]) { overflow-x: visible; }
/* Opt-in vertical scroll region: cap the height and the sticky header earns its keep. */
.card .card-body.tight.scroll-y { max-height: 70vh; overflow-y: auto; }

table.data {
  width: 100%;
  border-collapse: separate;   /* keeps the header's border attached while position:sticky */
  border-spacing: 0;
  font-size: 13px;
}
table.data th {
  position: sticky;
  top: 0;
  z-index: 2;
  text-align: left;
  font-size: 11.5px;
  text-transform: uppercase;
  letter-spacing: 0.4px;
  color: var(--text-muted);
  font-weight: 650;
  padding: 11px 16px;
  border-bottom: 1px solid var(--border);
  background: var(--surface-2);
  white-space: nowrap;
}
table.data td {
  padding: 12px 16px;
  border-bottom: 1px solid var(--cg-neutral-100);   /* softer row separator than the header rule */
  vertical-align: middle;
}
table.data tr:last-child td { border-bottom: none; }
/* Row hover at tr level so per-row tints (e.g. denied audit rows) keep precedence. */
table.data tbody tr:hover { background: var(--cg-primary-050); }
table.data .name-cell { font-weight: 600; }
table.data .name-cell a { color: var(--text); }
table.data .name-cell a:hover { color: var(--brand); }
/* Numeric / date columns: right-aligned, lining tabular figures so digits stack cleanly. */
table.data th.num, table.data td.num { text-align: right; font-variant-numeric: tabular-nums; }
/* Sortable column headers (UX #5): the whole label is the link; the active column (th[aria-sort])
   is brand-tinted and shows a small direction arrow. Keyboard: plain links + visible focus ring. */
table.data th .sort-link {
  color: inherit;
  display: inline-flex;
  align-items: center;
  gap: 3px;
}
table.data th .sort-link:hover { color: var(--brand); text-decoration: none; }
table.data th .sort-link:focus-visible { outline: 2px solid var(--brand); outline-offset: 1px; border-radius: 3px; }
table.data th[aria-sort] .sort-link { color: var(--brand-dark); }
table.data th .sort-ind { font-size: 10px; line-height: 1; }
/* Long-value truncation: wrap the value in <span class="truncate" title="…">…</span>. */
table.data .truncate {
  display: block;
  max-width: 48ch;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
/* Tidy empty state: <td colspan class="table-empty">…</td>. */
table.data td.table-empty {
  padding: 26px 18px;
  text-align: center;
  color: var(--text-muted);
}
.mono { font-family: var(--mono); font-size: 12.5px; }
.muted { color: var(--text-muted); }
.faint { color: var(--text-faint); }
.nowrap { white-space: nowrap; }
.right { text-align: right; }

.expiry-ok { color: var(--ok); font-weight: 600; }
.expiry-soon { color: var(--warn); font-weight: 600; }
.expiry-crit { color: var(--danger); font-weight: 700; }

/* ---------- Confirm dialog (_ConfirmDialog.cshtml + js/ui.js) ---------- */
/* Native <dialog>: the platform supplies focus trap, Esc, and ::backdrop; we supply the brand.
   Sizing: our confirm dialogs are always short (icon+title, a target chip, a few lines, two
   buttons), so the dialog simply sizes to its content and NOTHING inside it scrolls — every line is
   always visible, no scrollbars on either axis. `overflow: clip` makes the dialog itself not a
   scroll container, which also defeats the UA modal-dialog `overflow:auto` that used to paint a
   full-height scrollbar for a sub-pixel spill of the asymmetric 3px accent border. Long/unbreakable
   strings WRAP (overflow-wrap on the text nodes) instead of forcing a horizontal scrollbar.
   NB: do NOT put `overflow-y:auto` on the body — per spec that forces `overflow-x` to `auto` too,
   which reintroduces a spurious horizontal scrollbar (the bug this replaced). */
.confirm-dialog {
  width: min(440px, calc(100vw - 32px));
  overflow: clip;
  padding: 22px 24px 20px;
  border: 1px solid var(--border);
  border-top: 3px solid var(--brand);   /* echoes the app header / auth panel accent */
  border-radius: 12px;
  background: var(--surface);
  color: var(--text);
  box-shadow: 0 18px 48px rgba(4, 10, 30, 0.35);
}
.confirm-dialog.danger { border-top-color: var(--danger); }
.confirm-dialog::backdrop {
  background: rgba(11, 17, 48, 0.45);   /* Sentinel Indigo night, translucent */
  backdrop-filter: blur(1.5px);
}
.confirm-dialog .confirm-dialog-head {
  display: flex;
  align-items: center;
  gap: 10px;
  margin-bottom: 6px;
}
.confirm-dialog .confirm-dialog-icon {
  display: grid;
  place-items: center;
  width: 34px;
  height: 34px;
  flex: none;
  border-radius: 50%;
  background: var(--brand-tint);
  color: var(--brand-dark);
}
.confirm-dialog.danger .confirm-dialog-icon { background: var(--danger-bg); color: var(--danger); }
.confirm-dialog .confirm-dialog-title {
  font-family: var(--display);
  font-size: 16px;
  font-weight: 650;
  margin: 0;
  letter-spacing: -0.2px;
  min-width: 0;
  overflow-wrap: anywhere;   /* a long title wraps in the flex row rather than overflowing */
}
.confirm-dialog .confirm-dialog-target {
  display: inline-block;
  max-width: 100%;
  margin: 4px 0 2px;
  padding: 2px 8px;
  border: 1px solid var(--border);
  border-radius: var(--radius-sm);
  background: var(--surface-2);
  overflow-wrap: anywhere;   /* a long target name (slug/host) wraps instead of overflowing */
}
.confirm-dialog .confirm-dialog-body {
  margin: 8px 0 0;
  font-size: 13px;
  line-height: 1.55;
  color: var(--text-muted);
  overflow-wrap: anywhere;   /* wrap long/unbreakable text; never a horizontal scrollbar */
}
.confirm-dialog .confirm-dialog-actions {
  display: flex;
  justify-content: flex-end;
  gap: 9px;
  margin-top: 18px;
}
.confirm-dialog .btn:focus-visible { outline: 2px solid var(--brand); outline-offset: 2px; }

/* ---------- Pagination bar (_Pagination.cshtml) ---------- */
.pagination {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 14px;
  padding: 11px 16px;
  flex-wrap: wrap;
  font-size: 12.5px;
  color: var(--text-muted);
}
.card > .pagination { border-top: 1px solid var(--border); }
.pagination .pagination-summary { white-space: nowrap; }
.pagination .pagination-summary strong { color: var(--text); font-variant-numeric: tabular-nums; }
.pagination .pagination-pages {
  display: flex;
  align-items: center;
  gap: 4px;
  flex-wrap: wrap;
}
.pagination .page-btn {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  min-width: 30px;
  height: 30px;
  padding: 0 7px;
  border: 1px solid transparent;
  border-radius: var(--radius-sm);
  color: var(--text);
  font-weight: 600;
  font-variant-numeric: tabular-nums;
  text-decoration: none;
  transition: background .12s, border-color .12s;
}
.pagination a.page-btn:hover { background: var(--surface-2); border-color: var(--border-strong); text-decoration: none; }
.pagination a.page-btn:focus-visible { outline: 2px solid var(--brand); outline-offset: 1px; }
.pagination .page-btn.is-current { background: var(--brand); border-color: var(--brand); color: #fff; }
.pagination .page-btn.is-disabled { color: var(--text-faint); cursor: default; }
.pagination .page-ellipsis { min-width: 22px; text-align: center; color: var(--text-faint); }
.pagination .pagination-size { display: flex; align-items: center; gap: 8px; margin: 0; }
.pagination .pagination-size label { display: inline-flex; align-items: center; gap: 8px; }
.pagination .pagination-size .pagination-size-label { white-space: nowrap; font-weight: 600; }
.pagination .pagination-size select {
  font: inherit;
  font-size: 12.5px;
  padding: 5px 8px;
  border: 1px solid var(--border-strong);
  border-radius: var(--radius-sm);
  background: #fff;
  color: var(--text);
  cursor: pointer;
}
.pagination .pagination-size select:focus { outline: none; border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-tint); }

/* ---------- Cert-type badge (_CertTypeBadge.cshtml) ---------- */
/* Managed ("full-ops") vs Monitor-only (imported): icon + label + tint — obvious at a glance,
   restrained in volume. Managed wears Guardian Teal; Monitor-only wears Sentinel Indigo. */
.cert-type {
  display: inline-flex;
  align-items: center;
  gap: 5px;
  font-size: 11px;
  font-weight: 700;
  letter-spacing: 0.2px;
  padding: 3px 9px;
  border-radius: 999px;
  border: 1px solid transparent;
  white-space: nowrap;
  line-height: 1.4;
  cursor: default;
}
.cert-type svg { flex: none; }
.cert-type.managed { background: var(--brand-tint); color: var(--brand-dark); border-color: var(--cg-primary-200); }
.cert-type.monitor { background: var(--cg-secondary-100); color: var(--cg-secondary-700); border-color: var(--cg-secondary-300); }

/* ---------- SAN link (_SanLink.cshtml) ---------- */
/* A navigable DNS SAN opens https://<name>/ in a new tab; the small arrow is the external cue.
   Wildcards / IPs / emails render as .san-plain (no affordance). */
.san-link {
  display: inline-flex;
  align-items: center;
  gap: 3px;
  font-family: var(--mono);
  color: inherit;
  text-decoration: none;
}
.san-link:hover { color: var(--brand-dark); text-decoration: underline; }
.san-link:focus-visible { outline: 2px solid var(--brand); outline-offset: 1px; border-radius: 3px; }
.san-link .san-ext { flex: none; opacity: 0.5; }
.san-link:hover .san-ext { opacity: 1; }
.san-plain { font-family: var(--mono); }

/* ---------- Buttons ---------- */
.btn {
  display: inline-flex;
  align-items: center;
  gap: 7px;
  font: inherit;
  font-size: 13px;
  font-weight: 600;
  padding: 8px 14px;
  border-radius: var(--radius-sm);
  border: 1px solid var(--border-strong);
  background: var(--surface);
  color: var(--text);
  cursor: pointer;
  white-space: nowrap;
  transition: background .12s, border-color .12s;
}
.btn:hover { background: var(--surface-2); text-decoration: none; }
.btn.primary { background: var(--brand); border-color: var(--brand); color: #fff; }
.btn.primary:hover { background: var(--brand-dark); }
.btn.danger { background: var(--danger); border-color: var(--danger); color: #fff; }
.btn.danger:hover { background: #97150d; }
.btn.ghost { border-color: transparent; background: transparent; color: var(--brand); }
.btn.ghost:hover { background: var(--brand-tint); }
.btn.sm { padding: 5px 10px; font-size: 12px; }
.btn[disabled], .btn.is-disabled {
  opacity: 0.5;
  cursor: not-allowed;
  pointer-events: none;
}
.btn-row { display: flex; gap: 9px; flex-wrap: wrap; align-items: center; }

/* ---------- Toggle switch ---------- */
.switch {
  position: relative;
  display: inline-flex;
  align-items: center;
  gap: 8px;
  cursor: pointer;
  font-size: 12.5px;
  color: var(--text-muted);
}
.switch .track {
  width: 38px; height: 21px;
  border-radius: 999px;
  background: var(--border-strong);
  position: relative;
  transition: background .15s;
  flex: none;
}
.switch .track::after {
  content: "";
  position: absolute;
  top: 2px; left: 2px;
  width: 17px; height: 17px;
  border-radius: 50%;
  background: #fff;
  box-shadow: 0 1px 2px rgba(0,0,0,.25);
  transition: left .15s;
}
.switch.on .track { background: var(--ok); }
.switch.on .track::after { left: 19px; }

/* ---------- Forms ---------- */
.field { margin-bottom: 16px; }
.field label { display: block; font-size: 13px; font-weight: 600; margin-bottom: 5px; }
.field .desc { font-size: 12px; color: var(--text-muted); margin: -2px 0 7px; }
/* One rule for every text-like input (text, search, password, email, …) so all fields in a form
   look identical. The old [type=text]/[type=search] whitelist left password inputs unstyled. */
.field input:not([type="checkbox"], [type="radio"]), .field select, .field textarea {
  width: 100%;
  font: inherit;
  font-size: 13.5px;
  padding: 9px 11px;
  border: 1px solid var(--border-strong);
  border-radius: var(--radius-sm);
  background: #fff;
  color: var(--text);
}
.field input:focus, .field select:focus, .field textarea:focus {
  outline: none;
  border-color: var(--brand);
  box-shadow: 0 0 0 3px var(--brand-tint);
}
/* Normalize Chromium/WebKit autofill so autofilled fields keep the design-system look. */
.field input:-webkit-autofill,
.field input:-webkit-autofill:hover,
.field input:-webkit-autofill:focus {
  -webkit-box-shadow: 0 0 0 1000px #fff inset;
  box-shadow: 0 0 0 1000px #fff inset;
  -webkit-text-fill-color: var(--text);
  caret-color: var(--text);
}
/* Password show/hide: the toggle ships `hidden` and is revealed by js/auth.js (progressive
   enhancement — the field is fully usable without JavaScript). */
.field .password-wrap { position: relative; }
.field .password-wrap input { padding-right: 62px; }
.field .pw-toggle {
  position: absolute;
  top: 50%; right: 5px;
  transform: translateY(-50%);
  font: inherit; font-size: 11.5px; font-weight: 700; letter-spacing: 0.3px;
  color: var(--text-muted);
  background: transparent;
  border: none; border-radius: var(--radius-sm);
  padding: 4px 8px;
  cursor: pointer;
}
.field .pw-toggle:hover { color: var(--text); background: var(--surface-2); }
.field .pw-toggle:focus-visible { outline: 2px solid var(--brand); outline-offset: 1px; }
.field textarea { resize: vertical; min-height: 72px; }
.field .suffix-input { display: flex; align-items: stretch; }
.field .suffix-input input { border-radius: var(--radius-sm) 0 0 var(--radius-sm); }
.field .suffix-input .suffix {
  display: flex; align-items: center;
  padding: 0 11px;
  background: var(--surface-2);
  border: 1px solid var(--border-strong);
  border-left: none;
  border-radius: 0 var(--radius-sm) var(--radius-sm) 0;
  font-family: var(--mono);
  font-size: 12.5px;
  color: var(--text-muted);
}
fieldset { border: none; padding: 0; margin: 0; }

/* checkbox chips */
.chip-row { display: flex; gap: 9px; flex-wrap: wrap; }
.chip {
  display: inline-flex; align-items: center; gap: 7px;
  padding: 7px 12px;
  border: 1px solid var(--border-strong);
  border-radius: 999px;
  font-size: 12.5px;
  cursor: pointer;
  background: #fff;
}
.chip input { accent-color: var(--brand); }

/* ---------- Toolbar / filters ---------- */
.toolbar {
  display: flex;
  gap: 10px;
  align-items: center;
  flex-wrap: wrap;
  margin-bottom: 16px;
}
.toolbar .search { flex: 1; min-width: 220px; position: relative; }
.toolbar .search input { width: 100%; padding: 9px 11px 9px 32px; border: 1px solid var(--border-strong); border-radius: var(--radius-sm); font: inherit; font-size: 13.5px; background:#fff; }
.toolbar .search .ico { position: absolute; left: 10px; top: 50%; transform: translateY(-50%); color: var(--text-faint); }
.seg {
  display: inline-flex;
  border: 1px solid var(--border-strong);
  border-radius: var(--radius-sm);
  overflow: hidden;
}
.seg button {
  font: inherit; font-size: 12.5px; font-weight: 600;
  padding: 8px 13px; border: none; background: #fff; color: var(--text-muted);
  cursor: pointer; border-right: 1px solid var(--border);
}
.seg button:last-child { border-right: none; }
.seg button.active { background: var(--brand); color: #fff; }
/* Compact filter dropdowns in the certificate-list toolbar. */
.toolbar .filter-select {
  font: inherit; font-size: 13px; padding: 8px 10px; min-width: 140px;
  border: 1px solid var(--border-strong); border-radius: var(--radius-sm);
  background: #fff; color: var(--text); cursor: pointer;
}
.toolbar .filter-select:focus { outline: none; border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-tint); }
.toolbar .clear-filter { white-space: nowrap; }
.btn.ghost { background: transparent; }
/* Monitor-only toggle: a binary on/off pill, deliberately distinct from the combo dropdowns. */
.toolbar .monitor-only-toggle { white-space: nowrap; font-weight: 600; }
.toolbar .monitor-only-toggle.active {
  background: var(--brand);
  border-color: var(--brand);
  color: #fff;
}
.toolbar .monitor-only-toggle.active:hover { background: var(--brand-dark); }

/* ---------- Banners / callouts ---------- */
.banner {
  display: flex;
  gap: 13px;
  align-items: flex-start;
  padding: 14px 16px;
  border-radius: var(--radius);
  border: 1px solid transparent;
  margin-bottom: 18px;
}
.banner .ico { font-size: 18px; line-height: 1.3; flex: none; }
.banner .body { flex: 1; }
.banner .body h3 { margin: 0 0 3px; font-size: 14px; }
.banner .body p { margin: 0; font-size: 13px; }
.banner.warn { background: var(--warn-bg); border-color: #e8cd86; color: #7a5200; }
.banner.danger { background: var(--danger-bg); border-color: #f3b7b1; color: #8a1810; }
.banner.info { background: var(--info-bg); border-color: #b6d6e6; color: #1f5570; }
.banner.ok { background: var(--ok-bg); border-color: #b4ddc4; color: #14572f; }

/* ---------- Definition list (metadata) ---------- */
.dl {
  display: grid;
  grid-template-columns: 180px 1fr;
  gap: 0;
}
.dl dt {
  padding: 9px 0;
  font-size: 12.5px;
  color: var(--text-muted);
  border-bottom: 1px solid var(--border);
  font-weight: 600;
}
.dl dd {
  padding: 9px 0;
  margin: 0;
  border-bottom: 1px solid var(--border);
  font-size: 13px;
  /* Values include unbreakable mono strings (thumbprints, CNAME targets); without a min-width
     the 1fr track grows to their min-content width and the card spills horizontally. */
  min-width: 0;
  overflow-wrap: anywhere;
}
.dl dt:last-of-type, .dl dd:last-of-type { border-bottom: none; }
@media (max-width: 560px) { .dl { grid-template-columns: 1fr; } .dl dt { border: none; padding-bottom: 0; } }

/* ---------- Code / copy blocks ---------- */
.codeblock {
  position: relative;
  background: var(--night);
  color: #d7e3ee;
  border-radius: var(--radius-sm);
  padding: 14px 16px;
  font-family: var(--mono);
  font-size: 12.5px;
  line-height: 1.7;
  overflow-x: auto;
  white-space: pre;
}
.codeblock .copy {
  position: absolute; top: 9px; right: 9px;
  background: rgba(255,255,255,0.12);
  color: #d7e3ee;
  border: none; border-radius: 4px;
  padding: 4px 9px; font-size: 11.5px; cursor: pointer; font-weight: 600;
}
.codeblock .copy:hover { background: rgba(255,255,255,0.22); }
.codeblock .hl { color: #ffd884; }
.codeblock .hl2 { color: #7fd1a3; }

.inline-code {
  font-family: var(--mono);
  font-size: 12px;
  background: var(--surface-2);
  border: 1px solid var(--border);
  padding: 1px 6px;
  border-radius: 4px;
}

/* ---------- Timeline (comments / activity) ---------- */
.timeline { list-style: none; margin: 0; padding: 0; }
.timeline li {
  position: relative;
  padding: 0 0 18px 28px;
  border-left: 2px solid var(--border);
  margin-left: 6px;
}
.timeline li:last-child { border-left-color: transparent; padding-bottom: 0; }
.timeline li::before {
  content: "";
  position: absolute; left: -7px; top: 2px;
  width: 12px; height: 12px; border-radius: 50%;
  background: var(--surface); border: 2px solid var(--border-strong);
}
.timeline li.evt-ok::before { border-color: var(--ok); }
.timeline li.evt-warn::before { border-color: var(--warn); }
.timeline li.evt-danger::before { border-color: var(--danger); }
.timeline li.evt-info::before { border-color: var(--info); }
.timeline .who { font-weight: 600; font-size: 13px; }
.timeline .when { color: var(--text-faint); font-size: 11.5px; margin-left: 6px; }
.timeline .body { font-size: 13px; margin-top: 2px; }
.timeline .body.system { color: var(--text-muted); }

/* assignment list */
.assignee {
  display: flex; align-items: center; gap: 10px;
  padding: 9px 0; border-bottom: 1px solid var(--border);
}
.assignee:last-child { border-bottom: none; }
.assignee .avatar {
  width: 30px; height: 30px; border-radius: 50%;
  background: var(--brand-tint); color: var(--brand-dark);
  display: grid; place-items: center; font-size: 12px; font-weight: 700; flex: none;
}
.assignee .meta { flex: 1; line-height: 1.3; }
.assignee .meta .n { font-weight: 600; font-size: 13px; }
.assignee .meta .u { font-size: 11.5px; color: var(--text-faint); }

/* download rows */
.dl-row {
  display: flex; align-items: center; justify-content: space-between; gap: 12px;
  padding: 12px 0; border-bottom: 1px solid var(--border);
}
.dl-row:last-child { border-bottom: none; }
.dl-row .meta .t { font-weight: 600; font-size: 13px; display:flex; align-items:center; gap:7px;}
.dl-row .meta .d { font-size: 12px; color: var(--text-muted); margin-top: 1px; }

/* danger zone */
.danger-zone {
  border: 1px solid #f0c4bf;
  background: #fdf4f3;
  border-radius: var(--radius);
}
.danger-zone .card-head { border-bottom-color: #f3cfca; }
.danger-zone .card-head h2 { color: var(--danger); }

/* ---------- Misc ---------- */
.divider { height: 1px; background: var(--border); margin: 16px 0; border: none; }
.spacer { height: 18px; }
.tag-list { display: flex; gap: 6px; flex-wrap: wrap; }
.kv { font-family: var(--mono); font-size: 12px; }

/* role-gated visibility helpers (used by index role switcher) */
.role-only { } /* base; JS toggles data-visible */
.note {
  font-size: 12px; color: var(--text-faint); font-style: italic;
}

/* index launcher cards */
.launch-grid { display: grid; grid-template-columns: repeat(3, 1fr); gap: 16px; }
@media (max-width: 900px) { .launch-grid { grid-template-columns: 1fr 1fr; } }
@media (max-width: 600px) { .launch-grid { grid-template-columns: 1fr; } }
.launch {
  display: block;
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 16px;
  box-shadow: var(--shadow);
  color: var(--text);
}
.launch:hover { border-color: var(--brand); text-decoration: none; box-shadow: 0 2px 8px rgba(16,24,40,.1); }
.launch .ti { font-weight: 650; font-size: 15px; margin-bottom: 4px; display:flex; align-items:center; gap:8px;}
.launch .de { font-size: 12.5px; color: var(--text-muted); }
.launch .ro { margin-top: 9px; }

/* legend */
.legend { display: flex; gap: 18px; flex-wrap: wrap; }
.legend .item { font-size: 12.5px; color: var(--text-muted); display:flex; align-items:center; gap:7px; }

/* role switcher control on index */
.role-switch {
  display: inline-flex; align-items: center; gap: 10px;
  background: var(--surface); border: 1px solid var(--border);
  border-radius: var(--radius); padding: 10px 14px; box-shadow: var(--shadow);
}
.role-switch label { font-weight: 600; font-size: 13px; }
.role-switch .seg button { padding: 7px 14px; }

/* footer note on each page — carries the G9 endorsement */
.app-foot {
  max-width: 1240px;
  margin: 8px auto 32px;
  padding: 14px 24px 0;
  border-top: 1px solid var(--border);
  display: flex;
  align-items: center;
  gap: 8px;
  flex-wrap: wrap;
  font-size: 11.5px;
  color: var(--text-faint);
}
.app-foot .foot-brand {
  font-family: var(--display);
  font-weight: 600;
  color: var(--brand-dark);
  letter-spacing: -0.2px;
}
.app-foot .foot-promise { color: var(--text-muted); }
.app-foot .foot-sep { opacity: 0.5; }
/* The G9 endorsement: subordinate, muted, tracked — never co-equal the brand. */
.app-foot .foot-endorse {
  margin-left: auto;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  font-size: 10.5px;
  color: var(--text-muted);
  opacity: 0.85;
}
.app-foot .foot-endorse strong { color: var(--cg-secondary-700); font-weight: 700; }

/* simple modal-ish reveal panel */
.reveal-panel {
  background: var(--night); color: #e7edf3;
  border-radius: var(--radius);
  padding: 18px;
}
.reveal-panel h3 { margin: 0 0 8px; font-size: 14px; color:#fff; }
.reveal-panel .pw {
  font-family: var(--mono); font-size: 16px; letter-spacing: 1px;
  background: rgba(255,255,255,.1); padding: 10px 14px; border-radius: 6px;
  display: flex; justify-content: space-between; align-items: center; margin: 10px 0;
}
.reveal-panel .warnline { font-size: 12px; color: #ffd884; }

ul.bare { list-style: none; padding: 0; margin: 0; }
.help-row { display:flex; gap:8px; align-items:flex-start; font-size:12.5px; color:var(--text-muted); margin-top:6px;}

/* Audit time-window inputs and table pager (next/prev + page indicator). */
.toolbar .range-field { display:flex; flex-direction:column; gap:3px; }
.toolbar .range-field .range-label { font-size:10.5px; font-weight:600; text-transform:uppercase; letter-spacing:.04em; color:var(--text-faint); }
.toolbar .range-field input[type="date"] { font: inherit; font-size:13px; padding:7px 9px; border:1px solid var(--border-strong); border-radius:var(--radius-sm); background:#fff; color:var(--text); }
.toolbar .range-field input[type="date"]:focus { outline:none; border-color:var(--brand); box-shadow:0 0 0 3px var(--brand-tint); }
.pager { display:flex; align-items:center; justify-content:space-between; gap:12px; padding:12px 14px; border-top:1px solid var(--border); flex-wrap:wrap; }
.pager .pager-info { font-size:12.5px; color:var(--text-muted); }
.pager .pager-nav { display:flex; gap:8px; align-items:center; }

/* "Mine" tag shown inline in the Assigned-to column */
.badge.mine-tag {
  background: var(--brand-tint);
  color: var(--brand-dark);
  border: 1px solid var(--brand);
  font-size: 10.5px;
  font-weight: 700;
  padding: 2px 7px;
  letter-spacing: 0.3px;
}

/* "Mine" quick-filter button — stands out within the segmented control */
.seg button.mine-filter-btn {
  color: var(--brand-dark);
  font-weight: 700;
}
.seg button.mine-filter-btn.active { background: var(--brand); color: #fff; }

/* Download link expiry hint shown under each download row */
.dl-expiry {
  font-size: 11.5px;
  color: var(--warn);
  font-weight: 600;
  display: flex;
  align-items: center;
  gap: 4px;
  margin-top: 2px;
}

/* ACME paused inline banner (compact, used on cert-add page) */
.banner.acme-paused-inline {
  background: var(--danger-bg);
  border-color: #f3b7b1;
  color: #8a1810;
}

/* Enable/disable note on the detail page */
.disable-note {
  font-size: 12.5px;
  color: var(--text-muted);
  font-style: italic;
  margin-top: 4px;
}

/* ============================================================================
   Full-page auth experience (_AuthLayout): login, forced password change,
   sign out. Chrome-free — no app header/nav/footer — a night-indigo canvas
   with a soft Guardian-Teal glow, the crest lockup, one centered panel, and
   the brand promise kept subtle underneath.
   ============================================================================ */
.auth-body {
  min-height: 100vh;
  min-height: 100dvh;
  margin: 0;
  color: #e7edf3;
  background:
    radial-gradient(1100px 560px at 82% -12%, rgba(23, 138, 126, 0.30), transparent 62%),
    radial-gradient(900px 520px at -12% 112%, rgba(28, 42, 107, 0.55), transparent 58%),
    linear-gradient(160deg, var(--cg-secondary-900) 0%, #06211e 100%);
}
.auth-shell {
  min-height: 100vh;
  min-height: 100dvh;
  display: flex;
  flex-direction: column;
  align-items: center;
  justify-content: center;
  gap: 26px;
  padding: 40px 20px;
}
/* The Crest lockup inherits currentColor → white on the night canvas. */
.auth-brand { color: #fff; }
.auth-brand .cg-lockup { height: 34px; width: auto; display: block; }

.auth-main { width: 100%; display: flex; justify-content: center; }
.auth-panel {
  width: 100%;
  max-width: 420px;
  background: var(--surface);
  color: var(--text);
  border: 1px solid var(--border);
  border-top: 3px solid var(--cg-primary-500); /* echoes the app header's teal accent */
  border-radius: 12px;
  box-shadow: 0 18px 48px rgba(4, 10, 30, 0.45);
  padding: 28px 28px 22px;
}
.auth-panel h1 {
  font-family: var(--display);
  font-size: 21px;
  font-weight: 650;
  margin: 0 0 4px;
}
.auth-panel .auth-sub {
  margin: 0 0 18px;
  color: var(--text-muted);
  font-size: 13px;
}
.auth-panel .banner { margin-bottom: 16px; }
.auth-panel .btn.block {
  width: 100%;
  justify-content: center;
  padding: 10px 14px;
  font-size: 13.5px;
}
.auth-panel .btn:focus-visible { outline: 2px solid var(--brand); outline-offset: 2px; }

/* "or" separator between the local form and SSO — rendered only when both are enabled. */
.auth-divider {
  display: flex;
  align-items: center;
  gap: 12px;
  margin: 18px 0;
  color: var(--text-faint);
  font-size: 11px;
  font-weight: 700;
  letter-spacing: 0.6px;
  text-transform: uppercase;
}
.auth-divider::before, .auth-divider::after {
  content: "";
  flex: 1;
  height: 1px;
  background: var(--border);
}
.auth-panel .btn.sso .ms-logo { flex: none; }

/* "Need help signing in?" — a quiet disclosure with honest, product-true guidance. */
.auth-help {
  margin-top: 20px;
  padding-top: 14px;
  border-top: 1px solid var(--border);
  font-size: 12.5px;
}
.auth-help > summary {
  list-style: none;
  cursor: pointer;
  display: inline-block;
  color: var(--brand);
  font-weight: 600;
}
.auth-help > summary::-webkit-details-marker { display: none; }
.auth-help > summary:hover { color: var(--brand-dark); text-decoration: underline; }
.auth-help > summary:focus-visible { outline: 2px solid var(--brand); outline-offset: 2px; border-radius: 3px; }
.auth-help .auth-help-body { margin-top: 8px; }
.auth-help .auth-help-body p { margin: 0 0 8px; color: var(--text-muted); line-height: 1.55; }
.auth-help .auth-help-body p:last-child { margin-bottom: 0; }

/* Subtle brand promise / deployment footer on the dark canvas. */
.auth-foot {
  display: flex;
  align-items: center;
  justify-content: center;
  gap: 8px;
  flex-wrap: wrap;
  text-align: center;
  font-size: 11.5px;
  color: rgba(231, 237, 243, 0.55);
}
.auth-foot .foot-promise { color: rgba(231, 237, 243, 0.7); }
.auth-foot .foot-sep { opacity: 0.5; }
.auth-foot .foot-endorse {
  text-transform: uppercase;
  letter-spacing: 0.5px;
  font-size: 10.5px;
}
.auth-foot .foot-endorse strong { color: var(--cg-secondary-300); font-weight: 700; }

@media (max-width: 480px) {
  .auth-shell { padding: 24px 14px; gap: 20px; justify-content: flex-start; padding-top: 48px; }
  .auth-brand .cg-lockup { height: 28px; }
  .auth-panel { padding: 22px 18px 18px; }
}