/**
 * hush² web UI.
 *
 * One stylesheet for every page. Templates carry classes, never `style=""`.
 * The look is a dense admin console: system fonts, one accent colour, borders
 * instead of shadows, no motion.
 */

/* ==========================================================================
   Tokens
   ========================================================================== */

:root {
    --font: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
    --mono: ui-monospace, "Cascadia Code", Consolas, "SF Mono", monospace;
    --fs: 13px;
    --fs-sm: 12px;
    --fs-xs: 11px;
    --lh: 1.4;

    --bg: #fff;
    --bg-alt: #f6f8fa;
    --fg: #1f2328;
    --fg-muted: #656d76;
    --border: #d0d7de;
    --border-strong: #8c959f;
    --accent: #0969da;
    --accent-fg: #fff;
    --accent-hover: #0860ca;
    --accent-bg: #ddf4ff;
    --ok: #1a7f37;
    --ok-bg: #dafbe1;
    --warn: #9a6700;
    --warn-bg: #fff8c5;
    --err: #cf222e;
    --err-hover: #a40e26;
    --err-bg: #ffebe9;

    --sp-1: 4px;
    --sp-2: 8px;
    --sp-3: 12px;
    --sp-4: 16px;
    --sp-6: 24px;
    --radius: 4px;
    --row-h: 32px;
    --control-h: 28px;
    --header-h: 40px;
    --content-max: 1400px;
    --form-max: 720px;
}

@media (prefers-color-scheme: dark) {
    :root {
        --bg: #0d1117;
        --bg-alt: #161b22;
        --fg: #e6edf3;
        --fg-muted: #8d96a0;
        --border: #30363d;
        --border-strong: #6e7681;
        --accent: #2f81f7;
        --accent-fg: #fff;
        --accent-hover: #4b92f8;
        --accent-bg: #121d2f;
        --ok: #3fb950;
        --ok-bg: #12261e;
        --warn: #d29922;
        --warn-bg: #272115;
        --err: #f85149;
        --err-hover: #da3633;
        --err-bg: #291415;
    }
}

/* ==========================================================================
   Base
   ========================================================================== */

* {
    box-sizing: border-box;
}

[x-cloak] {
    display: none !important;
}

/* The UA sheet applies `hidden` to HTML elements only, and SVGElement has no
   `hidden` IDL attribute at all. Declaring it here makes the attribute work on
   the SVG groups the password eye toggles as well as on the divs. */
[hidden] {
    display: none !important;
}

html {
    color-scheme: light dark;
}

body {
    margin: 0;
    font-family: var(--font);
    font-size: var(--fs);
    line-height: var(--lh);
    background: var(--bg);
    color: var(--fg);
}

a {
    color: var(--accent);
    text-decoration: none;
}

a:hover {
    text-decoration: underline;
}

code,
kbd,
pre,
.mono {
    font-family: var(--mono);
    font-size: var(--fs-sm);
}

h1,
h2,
h3,
h4 {
    margin: 0;
    font-weight: 600;
    line-height: 1.25;
}

h1 {
    font-size: 16px;
}

h2 {
    font-size: 15px;
}

h3 {
    font-size: 13px;
}

h4 {
    font-size: var(--fs-sm);
}

p {
    margin: 0 0 var(--sp-3);
}

hr {
    border: 0;
    border-top: 1px solid var(--border);
    margin: var(--sp-4) 0;
}

:focus-visible {
    outline: 2px solid var(--accent);
    outline-offset: 1px;
}

.muted {
    color: var(--fg-muted);
}

.small {
    font-size: var(--fs-sm);
}

.nowrap {
    white-space: nowrap;
}

.right {
    text-align: right;
}

.visually-hidden {
    position: absolute;
    width: 1px;
    height: 1px;
    margin: -1px;
    padding: 0;
    overflow: hidden;
    clip: rect(0 0 0 0);
    white-space: nowrap;
    border: 0;
}

/* ==========================================================================
   Header
   ========================================================================== */

.header {
    display: flex;
    align-items: center;
    gap: var(--sp-4);
    height: var(--header-h);
    padding: 0 var(--sp-4);
    background: var(--bg-alt);
    border-bottom: 1px solid var(--border);
}

.wordmark {
    font-size: 14px;
    font-weight: 600;
    color: var(--fg);
    letter-spacing: -0.01em;
}

.wordmark:hover {
    text-decoration: none;
}

.nav {
    display: flex;
    align-items: center;
    gap: var(--sp-1);
}

.nav a,
.nav-group-button {
    display: inline-flex;
    align-items: center;
    gap: var(--sp-1);
    height: var(--control-h);
    padding: 0 var(--sp-2);
    border: 0;
    border-radius: var(--radius);
    background: none;
    font: inherit;
    color: var(--fg-muted);
    cursor: pointer;
}

.nav a:hover,
.nav-group-button:hover {
    background: var(--bg);
    color: var(--fg);
    text-decoration: none;
}

.nav a.active,
.nav-group.active .nav-group-button {
    color: var(--fg);
    font-weight: 600;
    box-shadow: inset 0 -2px 0 var(--accent);
}

.nav-group {
    position: relative;
}

.header-right {
    display: flex;
    align-items: center;
    gap: var(--sp-3);
    margin-left: auto;
}

/* ==========================================================================
   Menus (nav group, user menu)
   ========================================================================== */

.menu {
    position: relative;
}

.menu-button {
    display: inline-flex;
    align-items: center;
    gap: var(--sp-1);
    height: var(--control-h);
    padding: 0 var(--sp-2);
    border: 1px solid transparent;
    border-radius: var(--radius);
    background: none;
    font: inherit;
    color: var(--fg);
    cursor: pointer;
}

.menu-button:hover {
    background: var(--bg);
    border-color: var(--border);
}

.menu-panel {
    position: absolute;
    top: calc(100% + 2px);
    right: 0;
    z-index: 50;
    min-width: 240px;
    padding: var(--sp-1) 0;
    background: var(--bg);
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

.menu-panel.left {
    right: auto;
    left: 0;
}

.menu-panel a,
.menu-item {
    display: block;
    width: 100%;
    padding: var(--sp-1) var(--sp-3);
    border: 0;
    background: none;
    font: inherit;
    color: var(--fg);
    text-align: left;
    cursor: pointer;
}

.menu-panel a:hover,
.menu-item:hover {
    background: var(--bg-alt);
    text-decoration: none;
}

.menu-section {
    padding: var(--sp-2) var(--sp-3);
}

.menu-section + .menu-section,
.menu-section + .menu-item,
.menu-item + .menu-section {
    border-top: 1px solid var(--border);
}

.menu-label {
    display: block;
    margin-bottom: var(--sp-1);
    font-size: var(--fs-xs);
    color: var(--fg-muted);
}

.menu-value {
    font-size: var(--fs-sm);
}

.chevron {
    flex: none;
    fill: currentColor;
}

/* ==========================================================================
   Layout
   ========================================================================== */

.main {
    max-width: var(--content-max);
    margin: 0 auto;
    padding: 0 var(--sp-4) var(--sp-6);
}

.page-header {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: var(--sp-3);
    min-height: 48px;
    padding: var(--sp-3) 0;
    border-bottom: 1px solid var(--border);
    margin-bottom: var(--sp-4);
}

.page-header h1,
.page-header h2 {
    font-size: 16px;
    font-weight: 600;
}

.page-actions {
    display: flex;
    align-items: center;
    gap: var(--sp-2);
    margin-left: auto;
}

/* Membership tags in a page header: take the remaining width and wrap onto as
   many lines as needed instead of pushing the page past the viewport. */
.page-header > .tag-list {
    flex: 1 1 240px;
    min-width: 0;
}

.page-description {
    margin: 0;
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.section-title {
    margin: var(--sp-6) 0 var(--sp-2);
    font-size: 13px;
    font-weight: 600;
}

.section-title:first-child {
    margin-top: 0;
}

.stack {
    display: flex;
    flex-direction: column;
    gap: var(--sp-4);
}

.row {
    display: flex;
    align-items: center;
    gap: var(--sp-2);
}

.row-wrap {
    flex-wrap: wrap;
}

.scroll-x {
    overflow-x: auto;
}

/* A bordered box that groups form sections. Lists are not wrapped in one. */
.card {
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg);
}

.card > .card-header {
    display: flex;
    align-items: center;
    gap: var(--sp-3);
    padding: var(--sp-2) var(--sp-3);
    background: var(--bg-alt);
    border-bottom: 1px solid var(--border);
    border-radius: var(--radius) var(--radius) 0 0;
}

.card > .card-header h2,
.card > .card-header h3 {
    font-size: 13px;
}

.card-body {
    padding: var(--sp-3);
}

.empty-state {
    padding: var(--sp-6);
    text-align: center;
    color: var(--fg-muted);
}

.empty-state p {
    margin: 0 0 var(--sp-1);
}

/* ==========================================================================
   Buttons
   ========================================================================== */

.btn {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    gap: var(--sp-1);
    height: var(--control-h);
    padding: 0 var(--sp-3);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg);
    color: var(--fg);
    font: inherit;
    font-size: var(--fs-sm);
    line-height: 1;
    white-space: nowrap;
    cursor: pointer;
}

.btn:hover {
    background: var(--bg-alt);
    border-color: var(--border-strong);
    text-decoration: none;
}

.btn:disabled,
.btn[aria-disabled="true"] {
    opacity: 0.6;
    cursor: not-allowed;
}

.btn-primary {
    background: var(--accent);
    border-color: var(--accent);
    color: var(--accent-fg);
}

.btn-primary:hover {
    background: var(--accent-hover);
    border-color: var(--accent-hover);
    color: var(--accent-fg);
}

.btn-danger {
    color: var(--err);
    border-color: var(--border);
}

.btn-danger:hover {
    background: var(--err);
    border-color: var(--err);
    color: #fff;
}

/* Kept as aliases so a page does not have to choose between two spellings. */
.btn-secondary,
.btn-success {
    background: var(--bg);
    color: var(--fg);
}

.btn-small,
.btn-sm {
    height: 24px;
    padding: 0 var(--sp-2);
    font-size: var(--fs-xs);
}

.btn-icon {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 24px;
    height: 24px;
    padding: 0;
    border: 0;
    border-radius: var(--radius);
    background: none;
    color: var(--fg-muted);
    cursor: pointer;
}

.btn-icon:hover {
    background: var(--bg-alt);
    color: var(--fg);
}

.btn-icon svg {
    width: 14px;
    height: 14px;
    fill: currentColor;
}

/* Text links used as row actions in the last table column. */
.link-action {
    font-size: var(--fs-sm);
}

/* An action the caller is not allowed to take. Shown greyed out rather than
   hidden, so the row reads the same for everyone and the tooltip says why. */
.link-action.is-disabled,
.btn.is-disabled {
    opacity: 0.5;
    cursor: not-allowed;
    pointer-events: auto;
    text-decoration: none;
}

.link-action.is-disabled {
    color: var(--fg-muted);
}

.actions {
    display: flex;
    justify-content: flex-end;
    gap: var(--sp-3);
    white-space: nowrap;
}

/* ==========================================================================
   Forms
   ========================================================================== */

form {
    margin: 0;
}

.form {
    max-width: var(--form-max);
}

.form-wide {
    max-width: none;
}

.form-group {
    margin-bottom: var(--sp-4);
}

/* A fieldset groups related controls under one heading; the browser's box and
   inset legend are undone so it lays out exactly like any other form group. */
fieldset.form-group {
    min-width: 0;
    padding: 0;
    border: 0;
}

fieldset.form-group > legend {
    padding: 0;
}

/* Names a control for a screen reader where a visible label would only repeat what
   the surrounding panel already says. Clipped rather than hidden, because
   display:none and visibility:hidden take it out of the accessibility tree too. */
.sr-only {
    position: absolute;
    width: 1px;
    height: 1px;
    margin: -1px;
    padding: 0;
    overflow: hidden;
    clip-path: inset(50%);
    white-space: nowrap;
    border: 0;
}

.form-label,
.form-group > label {
    display: block;
    margin-bottom: var(--sp-1);
    font-size: var(--fs-sm);
    font-weight: 600;
}

.form-label .required,
.required-mark {
    color: var(--err);
}

input[type="text"],
input[type="url"],
input[type="number"],
input[type="password"],
input[type="date"],
input[type="email"],
input[type="search"],
select,
.form-input,
.form-select {
    width: 100%;
    height: var(--control-h);
    padding: 0 var(--sp-2);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg);
    color: var(--fg);
    font: inherit;
    font-size: var(--fs-sm);
}

textarea,
.form-textarea {
    width: 100%;
    min-height: 64px;
    padding: var(--sp-2);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg);
    color: var(--fg);
    font: inherit;
    font-size: var(--fs-sm);
    line-height: var(--lh);
    resize: vertical;
}

input:disabled,
select:disabled,
textarea:disabled {
    background: var(--bg-alt);
    color: var(--fg-muted);
    cursor: not-allowed;
}

/* A read-only field still allows selecting and copying, so it reads as inert
   rather than forbidden. */
input:read-only,
textarea:read-only {
    background: var(--bg-alt);
}

.json-editor:read-only {
    background: var(--bg-alt);
}

input[type="checkbox"],
input[type="radio"] {
    margin: 0 var(--sp-1) 0 0;
    accent-color: var(--accent);
}

/* Values that are read character by character: FQIDs, ARNs, JSON, patterns. */
.mono-input,
input.mono-input,
textarea.mono-input {
    font-family: var(--mono);
}

.form-help,
.form-hint,
.fqid-helper,
.builder-section small {
    display: block;
    margin-top: var(--sp-1);
    font-size: var(--fs-sm);
    color: var(--fg-muted);
}

.form-error {
    display: block;
    margin-top: var(--sp-1);
    font-size: var(--fs-sm);
    color: var(--err);
}

.field-invalid {
    border-color: var(--err);
}

/* No rule above the buttons: a full-width border reads as the heading of the
   next section rather than the end of this form. Spacing alone separates it. */
.form-actions {
    display: flex;
    align-items: center;
    gap: var(--sp-2);
    margin-top: var(--sp-3);
}

.form-section {
    margin-bottom: var(--sp-6);
}

.form-example {
    display: block;
    margin-top: var(--sp-1);
    padding: var(--sp-2);
    background: var(--bg-alt);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    font-family: var(--mono);
    font-size: var(--fs-sm);
}

/* Label column beside the control once there is room for it. */
@media (min-width: 900px) {
    .form-grid .form-group {
        display: grid;
        grid-template-columns: 160px minmax(0, 1fr);
        gap: var(--sp-3);
        align-items: start;
    }

    .form-grid .form-group > .form-label,
    .form-grid .form-group > label {
        margin-top: 6px;
        margin-bottom: 0;
    }

    .form-grid .form-group > .form-label + *,
    .form-grid .form-group > label + * {
        min-width: 0;
    }

    /* Buttons sit flush left, under the labels, rather than indented under the
       controls: an indented "Back to list" reads as a mis-aligned control. */
    .form-grid .form-actions {
        padding-left: 0;
    }

    /* A multi-line secret value wants the full row, so the label goes above it. */
    .form-grid .form-group.form-group-stacked {
        display: block;
    }

    .form-grid .form-group.form-group-stacked > label {
        margin-top: 0;
        margin-bottom: var(--sp-1);
    }
}

/* ==========================================================================
   Segmented FQID input
   ========================================================================== */

/* The four segments share one row. Each shrinks rather than wrapping, so the
   last one ("operation") never drops to a second line. */
.fqid-input-group {
    display: flex;
    flex-wrap: nowrap;
    align-items: flex-end;
    gap: var(--sp-1);
    min-width: 0;
}

.fqid-segment {
    flex: 1 1 0;
    min-width: 0;
}

.fqid-segment input,
.fqid-segment select {
    width: 100%;
    min-width: 0;
    font-family: var(--mono);
}

.fqid-segment label {
    display: block;
    margin-bottom: var(--sp-1);
    font-size: var(--fs-xs);
    color: var(--fg-muted);
}

.fqid-segment input.invalid {
    border-color: var(--err);
}

.fqid-separator {
    flex: none;
    height: var(--control-h);
    line-height: var(--control-h);
    color: var(--fg-muted);
    font-family: var(--mono);
}

.fqid-preview {
    margin-top: var(--sp-2);
    font-family: var(--mono);
    font-size: var(--fs-sm);
    color: var(--fg-muted);
}

.fqid-preview.invalid {
    color: var(--err);
}

/* Segments on top, the resolved pattern preview underneath: side by side the
   preview steals width from the segments and forces the last one to wrap. */
.fqid-input-with-actions {
    display: flex;
    flex-direction: column;
    align-items: stretch;
    gap: var(--sp-1);
    min-width: 0;
}

/* ==========================================================================
   Tables
   ========================================================================== */

table,
.table {
    width: 100%;
    border-collapse: collapse;
    font-size: var(--fs-sm);
}

th,
td {
    padding: var(--sp-1) var(--sp-2);
    text-align: left;
    border-bottom: 1px solid var(--border);
    vertical-align: middle;
}

th {
    height: var(--row-h);
    background: var(--bg-alt);
    font-size: var(--fs-sm);
    font-weight: 600;
    white-space: nowrap;
}

td {
    height: var(--row-h);
}

th.num,
td.num {
    text-align: right;
    font-variant-numeric: tabular-nums;
}

td .mono,
td code {
    font-family: var(--mono);
}

/* Cells that hold a list of identifiers or free text wrap at their separators
   instead of forcing the table past the viewport, which hid the Actions column
   behind a scrollbar. `break-word` rather than `anywhere`: the latter makes the
   column's minimum width one character and the browser crushes it to that. */
td.wrap {
    white-space: normal;
    overflow-wrap: break-word;
}

/* The free-text column takes the slack so a table of one-word descriptions does
   not spread it across the identifier columns instead. */
th.grow,
td.grow {
    width: 18%;
}

/* Multi-grant policies: each grant is one line with its subjects stacked on the
   left and its scope tag on the right, spanning the Subject and Scope columns. */
td.grants .grant {
    display: flex;
    align-items: flex-start;
    justify-content: space-between;
    gap: var(--space-3);
}

td.grants .grant + .grant {
    margin-top: var(--space-2);
}

td.grants .grant-subjects code {
    display: block;
}

tbody tr:hover {
    background: var(--bg-alt);
}

.table-footer {
    display: flex;
    align-items: center;
    gap: var(--sp-3);
    padding: var(--sp-2) 0;
    font-size: var(--fs-sm);
    color: var(--fg-muted);
}

.table-footer .spacer {
    margin-left: auto;
}

/* Sortable columns show the arrow only on the active column. */
th.sortable a {
    color: inherit;
}

th.sortable a:hover {
    text-decoration: none;
    color: var(--accent);
}

th.sortable .sort-arrow {
    visibility: hidden;
}

th.sortable.sorted .sort-arrow {
    visibility: visible;
}

/* ==========================================================================
   Tags and status
   ========================================================================== */

.tag,
.badge,
.type-badge,
.access-badge,
.expiry-badge {
    display: inline-block;
    height: 18px;
    padding: 0 6px;
    border: 1px solid transparent;
    border-radius: var(--radius);
    background: var(--bg-alt);
    color: var(--fg-muted);
    font-size: var(--fs-xs);
    font-weight: 400;
    line-height: 16px;
    white-space: nowrap;
    vertical-align: middle;
}

.tag-ok,
.badge-success,
.expiry-ok,
.access-read,
.type-kv {
    background: var(--ok-bg);
    color: var(--ok);
}

.tag-warn,
.badge-warning,
.expiry-expiring,
.access-write,
.type-aws {
    background: var(--warn-bg);
    color: var(--warn);
}

.tag-err,
.badge-danger,
.expiry-expired {
    background: var(--err-bg);
    color: var(--err);
}

.tag-accent,
.badge-info,
.badge-primary,
.access-grant,
.type-minio {
    background: var(--accent-bg);
    color: var(--accent);
}

.access-renew {
    background: var(--warn-bg);
    color: var(--warn);
}

.tag-neutral,
.badge-secondary,
.badge-scope,
.access-none,
.expiry-undeclared {
    background: var(--bg-alt);
    color: var(--fg-muted);
}

.tag-list {
    display: flex;
    flex-wrap: wrap;
    gap: var(--sp-1);
}

/* ==========================================================================
   Banners
   ========================================================================== */

.banner,
.alert {
    display: flex;
    align-items: flex-start;
    gap: var(--sp-2);
    padding: var(--sp-2) var(--sp-3);
    margin-bottom: var(--sp-4);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg-alt);
    font-size: var(--fs-sm);
}

.banner-error,
.alert-error,
.validation-errors {
    background: var(--err-bg);
    border-color: var(--err);
    color: var(--fg);
}

.banner-success,
.alert-success {
    background: var(--ok-bg);
    border-color: var(--ok);
}

.banner-warn,
.alert-warning,
.info-note {
    background: var(--warn-bg);
    border-color: var(--warn);
}

.banner-info,
.alert-info {
    background: var(--accent-bg);
    border-color: var(--accent);
}

.banner-body {
    flex: 1;
    min-width: 0;
}

.banner-title {
    font-weight: 600;
}

.banner ul,
.validation-errors ul {
    margin: var(--sp-1) 0 0;
    padding-left: var(--sp-4);
}

.banner-dismiss {
    flex: none;
    border: 0;
    background: none;
    color: inherit;
    font-size: 14px;
    line-height: 1;
    padding: 0 var(--sp-1);
    cursor: pointer;
}

.validation-errors {
    margin-top: var(--sp-2);
    padding: var(--sp-2) var(--sp-3);
    border-radius: var(--radius);
}

.validation-errors ul {
    color: var(--err);
}

/* One row of the S3 or MinIO resource-pattern list, built by policy-form.js. */
.pattern-row {
    display: flex;
    align-items: center;
    gap: var(--sp-2);
    margin-bottom: var(--sp-2);
}

.pattern-row-label {
    flex: none;
    color: var(--fg-muted);
    font-size: var(--fs-sm);
    white-space: nowrap;
}

.s3-pattern,
.minio-pattern {
    flex: 1;
    font-family: var(--mono);
}

/* ==========================================================================
   Configuration builder / JSON editor
   ========================================================================== */

.config-tabs {
    display: flex;
    gap: var(--sp-1);
    margin-bottom: var(--sp-3);
    border-bottom: 1px solid var(--border);
}

.config-tab {
    height: var(--control-h);
    padding: 0 var(--sp-3);
    border: 0;
    border-bottom: 2px solid transparent;
    margin-bottom: -1px;
    background: none;
    color: var(--fg-muted);
    font: inherit;
    font-size: var(--fs-sm);
    cursor: pointer;
}

.config-tab:hover {
    color: var(--fg);
}

.config-tab.active {
    color: var(--fg);
    font-weight: 600;
    border-bottom-color: var(--accent);
}

.config-section {
    margin-top: var(--sp-4);
}

.config-section h3 {
    margin-bottom: var(--sp-2);
}

.builder-section {
    padding: var(--sp-3);
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

.builder-section .form-group:last-child {
    margin-bottom: 0;
}

/* A read-only policy view has nothing to edit, so the box around the fields is
   noise. */
.builder-plain {
    padding: 0;
    border: 0;
}

.quick-actions {
    display: flex;
    flex-wrap: wrap;
    gap: var(--sp-1);
    margin-bottom: var(--sp-2);
}

.btn-quick {
    height: 24px;
    padding: 0 var(--sp-2);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg);
    color: var(--fg);
    font: inherit;
    font-size: var(--fs-xs);
    cursor: pointer;
}

.btn-quick:hover {
    background: var(--bg-alt);
    border-color: var(--border-strong);
}

.ip-range-entry {
    display: flex;
    gap: var(--sp-2);
    margin-bottom: var(--sp-2);
}

.ip-range-entry input {
    flex: 1;
}

.json-editor {
    width: 100%;
    min-height: 260px;
    padding: var(--sp-2);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg-alt);
    color: var(--fg);
    font-family: var(--mono);
    font-size: var(--fs-sm);
    line-height: var(--lh);
    resize: vertical;
}

.json-preview,
.arn-preview {
    padding: var(--sp-2);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg-alt);
    font-family: var(--mono);
    font-size: var(--fs-sm);
    white-space: pre-wrap;
    word-break: break-all;
    max-height: 400px;
    overflow-y: auto;
}

.arn-preview {
    margin-top: var(--sp-2);
    max-height: none;
}

.bucket-entry,
.mapping-row,
.grant-row {
    display: flex;
    flex-wrap: wrap;
    align-items: flex-start;
    gap: var(--sp-2);
    padding: var(--sp-2);
    margin-bottom: var(--sp-2);
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

.bucket-entry input[type="text"],
.mapping-row .form-group,
.bucket-name {
    flex: 1;
    min-width: 160px;
}

.kv-value-wrapper {
    position: relative;
}

.bucket-entry label {
    display: inline-flex;
    align-items: center;
    font-size: var(--fs-sm);
    font-weight: 400;
}

.mapping-row .form-group {
    margin-bottom: 0;
}

.grant-row {
    flex-direction: column;
    gap: var(--sp-3);
    /* The shared rule above sets align-items: flex-start, which is the vertical
       alignment a row needs. Turning the direction to column makes that the
       horizontal one, and every field shrink-wraps to the width of its own help
       text. Stretch is the flex default and the one this wants. */
    align-items: stretch;
}

/* The container spaces its children with `gap`, so the default margin would add
   to it. */
.grant-row .form-group {
    margin-bottom: 0;
}

.grant-row-title {
    display: flex;
    align-items: center;
    width: 100%;
    font-size: var(--fs-sm);
    font-weight: 600;
}

.grant-remove {
    margin-left: auto;
}

.kv-secret-input {
    width: 100%;
    font-family: var(--mono);
    white-space: pre;
}

/* Textarea masking is not standardized; Chromium and WebKit take this one. */
.kv-secret-input.kv-masked {
    -webkit-text-security: disc;
}

/* The toggle is a button so it is reachable by keyboard; the positioning that used
   to sit on the icon now sits on the button, and the icon fills it. */
.eye-button {
    position: absolute;
    right: var(--sp-2);
    top: var(--sp-2);
    padding: 0;
    border: none;
    background: none;
    color: inherit;
    line-height: 0;
    cursor: pointer;
}

.eye-icon {
    width: 18px;
    height: 18px;
}

/* ==========================================================================
   Tag input (subjects, buckets, scopes)
   ========================================================================== */

.tag-input-container {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: var(--sp-1);
    min-height: var(--control-h);
    padding: var(--sp-1);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg);
}

.tag-input {
    flex: 1;
    min-width: 120px;
    height: 20px;
    padding: 0;
    border: 0;
    background: none;
    font-family: var(--mono);
    font-size: var(--fs-sm);
    color: var(--fg);
}

.tag-input:focus {
    outline: none;
}

.tag-remove {
    border: 0;
    background: none;
    color: inherit;
    font-size: var(--fs-sm);
    line-height: 1;
    padding: 0 0 0 var(--sp-1);
    cursor: pointer;
}

.scope-checkbox-group {
    display: flex;
    flex-wrap: wrap;
    gap: var(--sp-3);
}

.scope-checkbox-label {
    display: inline-flex;
    align-items: center;
    gap: var(--sp-1);
    font-size: var(--fs-sm);
    font-weight: 400;
}

/* ==========================================================================
   Pattern preview
   ========================================================================== */

.pattern-preview {
    margin-top: var(--sp-2);
    font-size: var(--fs-sm);
}

.pattern-preview code,
.pattern-code {
    font-family: var(--mono);
}

.pattern-exact {
    display: block;
    color: var(--ok);
}

.pattern-wildcard {
    display: block;
}

.pattern-error {
    display: block;
    color: var(--err);
}

.pattern-critical,
.pattern-high,
.pattern-medium,
.pattern-low {
    display: block;
    padding: var(--sp-1) var(--sp-2);
    border: 1px solid transparent;
    border-radius: var(--radius);
}

.pattern-critical,
.pattern-high {
    background: var(--err-bg);
    border-color: var(--err);
    color: var(--fg);
}

.pattern-medium {
    background: var(--warn-bg);
    border-color: var(--warn);
}

.pattern-low {
    background: var(--accent-bg);
    border-color: var(--accent);
}

/* ==========================================================================
   Detail lists (read-only views)
   ========================================================================== */

.detail-grid {
    display: grid;
    grid-template-columns: 160px minmax(0, 1fr);
    gap: var(--sp-1) var(--sp-3);
    align-items: baseline;
}

.detail-grid > dt,
.detail-item > label,
.detail-label {
    color: var(--fg-muted);
    font-size: var(--fs-sm);
    font-weight: 400;
}

.detail-grid > dd {
    margin: 0;
}

.detail-row {
    display: grid;
    grid-template-columns: 160px minmax(0, 1fr);
    gap: var(--sp-3);
    padding: var(--sp-1) 0;
    border-bottom: 1px solid var(--border);
}

.detail-row:last-child {
    border-bottom: 0;
}

.detail-value {
    min-width: 0;
    overflow-wrap: anywhere;
}

.detail-item {
    display: grid;
    grid-template-columns: 160px minmax(0, 1fr);
    gap: var(--sp-3);
    padding: var(--sp-1) 0;
}

/* ==========================================================================
   Dashboard
   ========================================================================== */

.stat-row {
    display: flex;
    flex-wrap: wrap;
    align-items: baseline;
    gap: var(--sp-1) var(--sp-3);
    padding: var(--sp-3) 0;
    border-bottom: 1px solid var(--border);
    margin-bottom: var(--sp-4);
}

.stat {
    display: inline-flex;
    align-items: baseline;
    gap: var(--sp-1);
    color: var(--fg);
}

.stat:hover {
    text-decoration: none;
    color: var(--accent);
}

.stat-value {
    font-size: 16px;
    font-weight: 600;
    font-variant-numeric: tabular-nums;
}

.stat-label {
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.stat-sep {
    color: var(--border-strong);
}

.stat-attention .stat-value {
    color: var(--err);
}

/* ==========================================================================
   Expiry and renewal panel
   ========================================================================== */

.expiry-panel {
    padding: var(--sp-3);
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

.expiry-panel-header {
    margin-bottom: var(--sp-2);
}

.expiry-panel-title-row {
    display: flex;
    align-items: center;
    gap: var(--sp-2);
}

.expiry-panel-title,
.expiry-panel-heading {
    font-size: 13px;
    font-weight: 600;
}

.expiry-panel-description {
    margin: var(--sp-1) 0 0;
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.expiry-fields {
    display: grid;
    grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
    gap: var(--sp-3);
}

.expiry-field-wide {
    grid-column: 1 / -1;
}

.expiry-field label {
    display: block;
    margin-bottom: var(--sp-1);
    font-size: var(--fs-sm);
    font-weight: 600;
}

.expiry-field-help {
    display: block;
    margin-top: var(--sp-1);
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.expiry-field-message {
    display: block;
    margin-top: var(--sp-1);
    color: var(--err);
    font-size: var(--fs-sm);
}

.expiry-panel-readonly {
    display: block;
    margin-top: var(--sp-1);
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.expiry-panel-icon {
    display: none;
}

.expiry-panel-readonly svg,
.expiry-field-message svg {
    display: none;
}

/* The submit button swaps its own label while the POST is in flight; there is
   no spinner, so the element only reserves the live region. */
.submit-spinner {
    display: none;
}

.secret-form-actions .btn-danger {
    margin-left: auto;
}

/* ==========================================================================
   Audit page
   ========================================================================== */

.filter-bar {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: var(--sp-2);
    padding: var(--sp-2) 0;
}

/* All six column panels are built from the same three sections, so the padding
   lives on the sections and the panel itself has none. */
.filter-menu {
    min-width: 240px;
    padding: 0;
}

.filter-menu-header,
.filter-menu-options,
.filter-menu-actions {
    padding: var(--sp-2) var(--sp-3);
}

.filter-menu-options {
    max-height: 240px;
}

/* A list long enough to scroll needs a rule at each end, or its content runs
   into the search box above and the buttons below as it moves. A short fixed
   list does not, and a rule there would only add noise. */
.filter-menu-options.scrollable {
    overflow-y: auto;
    border-top: 1px solid var(--border);
    border-bottom: 1px solid var(--border);
}

.filter-option {
    display: flex;
    align-items: center;
    gap: var(--sp-1);
    padding: 2px 0;
    font-size: var(--fs-sm);
}

/* Whether the checked values are shown or hidden. Two halves of one control, so
   they read as a segmented switch rather than two buttons that happen to sit
   together. */
.filter-mode {
    display: flex;
    gap: 0;
}

.filter-mode-option {
    flex: 1;
    padding: 4px var(--sp-2);
    border: 1px solid var(--border);
    background: var(--bg);
    color: var(--fg-muted);
    font-size: var(--fs-sm);
    cursor: pointer;
}

.filter-mode-option:first-child {
    border-radius: var(--radius) 0 0 var(--radius);
}

.filter-mode-option:last-child {
    border-left: none;
    border-radius: 0 var(--radius) var(--radius) 0;
}

.filter-mode-option.active {
    background: var(--accent-bg);
    border-color: var(--accent);
    color: var(--accent);
    font-weight: 600;
}

/* The active half owns the shared edge, so its border is not painted over by the
   inactive half sitting on top of it. */
.filter-mode-option.active + .filter-mode-option {
    border-left: 1px solid var(--accent);
}

.filter-active {
    color: var(--accent);
    font-weight: 600;
}

.audit-table tbody tr.focused-row {
    background: var(--accent-bg);
    outline: 2px solid var(--accent);
    outline-offset: -2px;
}

.audit-table tbody tr {
    cursor: pointer;
}

.audit-scrim {
    position: fixed;
    inset: 0;
    z-index: 90;
    padding: 0;
    border: 0;
    border-radius: 0;
    background: rgba(0, 0, 0, 0.4);
    cursor: default;
}

.audit-drawer {
    position: fixed;
    top: 0;
    right: 0;
    bottom: 0;
    z-index: 100;
    width: min(600px, 90%);
    padding: var(--sp-4);
    overflow-y: auto;
    background: var(--bg);
    border-left: 1px solid var(--border);
}

.drawer-section {
    padding: var(--sp-3);
    margin-bottom: var(--sp-4);
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

/* A column header carrying a filter button. The funnel hugs the title: pushed to
   the far edge it sits against the next column and reads as that column's. */
.th-filter {
    display: flex;
    align-items: center;
    justify-content: flex-start;
    gap: var(--sp-1);
}

.filter-menu-actions {
    display: flex;
    gap: var(--sp-1);
}

.filter-menu-field + .filter-menu-field {
    margin-top: var(--sp-2);
}

.page-size {
    width: 72px;
}

.page-indicator {
    padding: 0 var(--sp-2);
    font-variant-numeric: tabular-nums;
}

/* Indentation of one level of the JSON tree in the audit drawer; the depth is
   the only value the renderer sets. */
.json-node {
    margin-left: calc(var(--indent, 0) * 1rem);
}

.grow {
    flex: 1;
}

.rel {
    position: relative;
}

.break {
    word-break: break-all;
}

.keyboard-hint {
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.keyboard-hint kbd {
    padding: 0 4px;
    border: 1px solid var(--border);
    border-radius: 3px;
    background: var(--bg-alt);
}

.success td:first-child {
    box-shadow: inset 2px 0 0 var(--ok);
}

.failure td:first-child {
    box-shadow: inset 2px 0 0 var(--err);
}

/* ==========================================================================
   Login
   ========================================================================== */

.login {
    max-width: 320px;
    margin: 96px auto;
    padding: 0 var(--sp-4);
    text-align: center;
}

.login img {
    display: block;
    margin: 0 auto var(--sp-3);
}

.login h1 {
    font-size: 20px;
}

.login p {
    color: var(--fg-muted);
}

.login .btn {
    width: 100%;
    margin-top: var(--sp-2);
}

/* ==========================================================================
   Tools page
   ========================================================================== */

.policies-container {
    display: flex;
    flex-direction: column;
    gap: var(--sp-2);
}

.policy-card {
    padding: var(--sp-3);
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

.policy-header {
    display: flex;
    align-items: baseline;
    gap: var(--sp-2);
}

.policy-title {
    font-size: 13px;
    font-weight: 600;
}

.policy-id,
.policy-description {
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.policy-details {
    margin-top: var(--sp-2);
}

.loading-spinner {
    color: var(--fg-muted);
    font-size: var(--fs-sm);
}

.mapping-id-display {
    font-family: var(--mono);
    font-size: var(--fs-sm);
    color: var(--fg-muted);
}