/* HEXCORE SIEM — mission-control phosphor theme. Dark-only by design.
   Flat, square, dense instrument panels: phosphor green + amber on near-black
   (TsUP mission-control reference). Palette validated with the dataviz
   six-checks validator against #0a0e0b: chroma/CVD/contrast pass; severity
   colors are labeled status chips, never color-alone. No border-radius
   anywhere — this is deliberate, not an omission. */

:root {
  color-scheme: dark;
  --bg: #050806;            /* page plane */
  --panel: #0a0e0b;         /* panels / chart surface */
  --panel-raised: #101511;
  --border: #223026;
  --ink: #d2e8d6;
  --ink-2: #7ba283;
  --ink-3: #48604f;
  --accent: #3ddc78;        /* phosphor green — interactive text/links */
  --accent-dim: #123c22;
  --amber: #ffb000;         /* highlights, panel headings */
  --viz-bar: #2fbf5f;       /* single-series histogram */
  --viz-bar-hover: #7fe6a4;
  --viz-grid: #142018;
  --viz-ink: #7ba283;
  --viz-baseline: #2a3a2e;
  --sev-critical: #d03b3b;
  --sev-high: #ec835a;
  --sev-medium: #fab219;
  --sev-low: #3987e5;
  --sev-info: #8b93a7;
  --match: rgba(255, 176, 0, 0.20);  /* amber highlight wash */
  --glow-green: 0 0 6px rgba(61, 220, 120, 0.45);
  --glow-amber: 0 0 6px rgba(255, 176, 0, 0.4);
  --mono: ui-monospace, "Cascadia Mono", Consolas, monospace;
  --sans: system-ui, "Segoe UI", sans-serif;
}

* { box-sizing: border-box; margin: 0; padding: 0; }
html, body { height: 100%; }
body {
  background: var(--bg);
  color: var(--ink);
  font: 13px/1.45 var(--sans);
}
a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }
code, kbd, pre, .mono { font-family: var(--mono); }
button {
  font: inherit;
  color: var(--ink);
  background: var(--panel-raised);
  border: 1px solid var(--border);
  padding: 4px 10px;
  cursor: pointer;
}
button:hover { border-color: var(--ink-3); }
button:disabled { opacity: 0.4; cursor: not-allowed; }
button.primary {
  background: var(--bg);
  border-color: var(--accent);
  color: var(--accent);
}
button.primary:hover { background: var(--accent-dim); }
button.linkish { background: none; border: none; color: var(--accent); padding: 2px 4px; }
button.linkish:hover { text-decoration: underline; }
a.btn-link {
  display: inline-block;
  background: var(--bg);
  border: 1px solid var(--accent);
  padding: 3px 12px;
  color: var(--accent);
  font-size: 12px;
}
a.btn-link:hover { text-decoration: none; background: var(--accent-dim); }
input, select {
  font: inherit;
  color: var(--ink);
  background: var(--bg);
  border: 1px solid var(--border);
  padding: 5px 8px;
}
input:focus, select:focus, button:focus-visible {
  outline: 1px solid var(--accent);
  outline-offset: 0;
}
input[type="datetime-local"] { font-family: var(--mono); font-size: 12px; }
mark { background: var(--match); color: inherit; }
[hidden] { display: none !important; }

/* ---------- top bar ---------- */
.topbar {
  display: flex;
  align-items: center;
  gap: 24px;
  height: 48px;
  padding: 0 16px;
  background: #030503;
  border-bottom: 1px solid var(--border);
  position: sticky;
  top: 0;
  z-index: 20;
}
.brand {
  font-weight: 600;
  letter-spacing: 0.06em;
  text-shadow: var(--glow-green);
}
.brand-mark { color: var(--accent); }
.brand-sub { color: var(--ink-2); font-weight: 400; }
.topnav { display: flex; gap: 4px; }
.topnav a {
  color: var(--ink-2);
  padding: 6px 12px;
}
.topnav a:hover { color: var(--ink); text-decoration: none; }
.topnav a.active { color: var(--accent); background: var(--panel-raised); }
.topright { margin-left: auto; color: var(--ink-2); font-family: var(--mono); font-size: 12px; }
#utc-clock { color: var(--accent); text-shadow: var(--glow-green); }

/* ---------- banners / loading ---------- */
#banners { position: sticky; top: 48px; z-index: 19; }
.banner {
  display: flex;
  gap: 12px;
  align-items: baseline;
  padding: 6px 16px;
  border-bottom: 1px solid var(--border);
  font-size: 12px;
}
.banner.warn { background: #191204; color: var(--amber); }
.banner.error { background: #1d0808; color: #f08c8c; }
.banner button { margin-left: auto; padding: 1px 8px; font-size: 11px; }
.loading {
  position: fixed;
  inset: 0;
  display: flex;
  align-items: center;
  justify-content: center;
  background: var(--bg);
  z-index: 50;
}
.loading-box { text-align: center; color: var(--ink-2); }
.loading-box .brand { font-size: 18px; margin-bottom: 12px; }

/* ---------- layout ---------- */
main { padding: 16px; max-width: 1600px; margin: 0 auto; }
.panel {
  background: var(--panel);
  border: 1px solid var(--border);
}
.panel > h2 {
  font-size: 12px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--amber);
  text-shadow: var(--glow-amber);
  padding: 10px 14px;
  border-bottom: 1px solid var(--border);
}

/* ---------- dashboard ---------- */
.tiles { display: grid; grid-template-columns: repeat(4, 1fr); gap: 12px; margin-bottom: 16px; }
.tile { padding: 14px; }
.tile .tile-label { font-size: 11px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--ink-2); }
.tile .tile-value {
  font-family: var(--mono);
  font-variant-numeric: tabular-nums;
  font-size: 26px;
  margin-top: 4px;
  color: var(--accent);
  text-shadow: var(--glow-green);
}
.tile .tile-sub { font-size: 12px; color: var(--ink-2); margin-top: 2px; }
.dash-cols { display: grid; grid-template-columns: 65fr 35fr; gap: 12px; align-items: start; }

.sev-chips { display: flex; gap: 6px; flex-wrap: wrap; padding: 10px 14px; }
.sev-chip {
  font-size: 11px;
  padding: 2px 8px;
  border: 1px solid var(--border);
  background: var(--panel-raised);
  color: var(--ink-2);
  cursor: pointer;
}
.sev-chip.active { color: var(--accent); border-color: var(--accent); }

.alert-card {
  border-top: 1px solid var(--border);
  padding: 10px 14px 10px 11px;
  border-left: 3px solid var(--border);
  display: grid;
  grid-template-columns: 1fr auto;
  gap: 2px 12px;
}
.alert-card.acked { opacity: 0.45; }
.alert-card .alert-head { display: flex; gap: 8px; align-items: baseline; flex-wrap: wrap; }
.alert-card .alert-rule { font-weight: 600; }
.alert-card .alert-id { font-family: var(--mono); font-size: 11px; color: var(--ink-2); }
.alert-card .alert-time { font-family: var(--mono); font-size: 11px; color: var(--ink-2); }
.alert-card .alert-desc { color: var(--ink-2); font-size: 12px; grid-column: 1; }
.alert-card .alert-entities { display: flex; gap: 6px; flex-wrap: wrap; grid-column: 1; margin-top: 4px; }
.alert-card .alert-actions { grid-column: 2; grid-row: 1 / span 3; display: flex; flex-direction: column; gap: 6px; align-items: end; justify-content: center; }
.alert-card .ack-label { font-size: 11px; color: var(--ink-2); display: flex; gap: 4px; align-items: center; cursor: pointer; }
.entity-tag {
  font-family: var(--mono);
  font-size: 11px;
  background: var(--panel-raised);
  border: 1px solid var(--border);
  padding: 1px 6px;
}
.sev-badge {
  font-size: 10px;
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.06em;
  padding: 1px 7px;
  color: #050806;
}
.sev-critical-bg { background: var(--sev-critical); color: #fff; }
.sev-high-bg { background: var(--sev-high); }
.sev-medium-bg { background: var(--sev-medium); }
.sev-low-bg { background: var(--sev-low); color: #fff; }
.sev-info-bg { background: var(--sev-info); }
.bl-critical { border-left-color: var(--sev-critical); }
.bl-high { border-left-color: var(--sev-high); }
.bl-medium { border-left-color: var(--sev-medium); }
.bl-low { border-left-color: var(--sev-low); }
.bl-info { border-left-color: var(--sev-info); }

.source-table { width: 100%; border-collapse: collapse; }
.source-table td, .source-table th {
  padding: 7px 14px;
  border-top: 1px solid var(--border);
  text-align: left;
  font-size: 12px;
}
.source-table th { color: var(--ink-2); font-weight: 400; border-top: none; }
.source-table td.num { text-align: right; font-family: var(--mono); }
.source-table tr:hover td { background: var(--panel-raised); }

/* ---------- search ---------- */
.search-form {
  display: flex;
  gap: 8px;
  align-items: center;
  flex-wrap: wrap;
  margin-bottom: 4px;
  position: relative;
}
.search-form .q-wrap { flex: 1; min-width: 280px; position: relative; }
#q {
  width: 100%;
  font-family: var(--mono);
  font-size: 13px;
  padding: 7px 10px;
  background: var(--panel);
}
.time-wrap { display: flex; gap: 6px; align-items: center; color: var(--ink-2); font-size: 12px; }
.q-error {
  font-family: var(--mono);
  font-size: 12px;
  color: var(--amber);
  white-space: pre;
  padding: 6px 10px;
  margin-bottom: 8px;
  background: #140e02;
  border: 1px solid #4a3808;
}
.q-hint { font-size: 12px; color: var(--amber); padding: 4px 2px; }
.hist-wrap { position: relative; padding: 8px 10px 4px; margin-bottom: 10px; }
#hist { width: 100%; height: 130px; display: block; }
.viz-tooltip {
  position: absolute;
  z-index: 40;
  background: var(--panel-raised);
  border: 1px solid var(--border);
  padding: 3px 8px;
  font: 11px var(--mono);
  pointer-events: none;
  white-space: nowrap;
}
.result-meta {
  display: flex;
  gap: 14px;
  align-items: center;
  flex-wrap: wrap;
  padding: 6px 2px 10px;
  color: var(--ink-2);
  font-size: 12px;
}
.result-meta .count { color: var(--ink); font-weight: 600; }
.search-cols { display: grid; grid-template-columns: 260px 1fr; gap: 12px; align-items: start; }

.fields-panel .field-row {
  display: flex;
  justify-content: space-between;
  gap: 8px;
  width: 100%;
  text-align: left;
  background: none;
  border: none;
  border-top: 1px solid var(--border);
  padding: 6px 14px;
  font-family: var(--mono);
  font-size: 12px;
  color: var(--accent);
}
.fields-panel .field-row:hover { background: var(--panel-raised); }
.fields-panel .field-row .distinct { color: var(--ink-3); }
.fields-panel details summary {
  padding: 6px 14px;
  color: var(--ink-2);
  font-size: 12px;
  cursor: pointer;
  border-top: 1px solid var(--border);
}

.popover {
  position: absolute;
  z-index: 40;
  background: var(--panel-raised);
  border: 1px solid var(--border);
  box-shadow: 0 6px 24px rgba(0, 0, 0, 0.6);
  min-width: 220px;
  max-width: 420px;
}
.popover .pop-title {
  font-family: var(--mono);
  font-size: 12px;
  padding: 8px 12px;
  border-bottom: 1px solid var(--border);
  color: var(--ink-2);
}
.popover .pop-row {
  display: grid;
  grid-template-columns: 1fr auto auto;
  gap: 10px;
  width: 100%;
  text-align: left;
  background: none;
  border: none;
  padding: 5px 12px;
  font-family: var(--mono);
  font-size: 12px;
  position: relative;
}
.popover .pop-row:hover { background: var(--accent-dim); }
.popover .pop-row .val { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 240px; }
.popover .pop-row .pct { color: var(--ink-2); }
.popover .pop-row .bar { position: absolute; left: 0; bottom: 0; height: 2px; background: var(--viz-bar); opacity: 0.6; }
.popover .pop-actions { display: flex; flex-direction: column; }
.popover .pop-actions button {
  background: none;
  border: none;
  text-align: left;
  padding: 7px 12px;
}
.popover .pop-actions button:hover { background: var(--accent-dim); }

.cheatsheet { padding: 12px 14px; max-width: 480px; }
.cheatsheet h3 { font-size: 13px; margin-bottom: 8px; color: var(--amber); }
.cheatsheet table td { padding: 3px 10px 3px 0; vertical-align: top; font-size: 12px; }
.cheatsheet td:first-child { white-space: nowrap; }
.cheatsheet .hint-line { margin-top: 8px; color: var(--ink-2); font-size: 12px; }
.cheatsheet kbd {
  border: 1px solid var(--border);
  padding: 0 4px;
  font-size: 11px;
  background: var(--bg);
}

.hist-note { font-size: 11px; color: var(--ink-3); padding: 0 10px 6px; }

/* results table */
.events { border-top: 1px solid var(--border); }
.event { border-bottom: 1px solid var(--border); }
.event > summary {
  display: grid;
  grid-template-columns: 155px 130px 110px 1fr;
  gap: 10px;
  padding: 4px 10px;
  cursor: pointer;
  font-family: var(--mono);
  font-size: 12px;
  align-items: baseline;
  min-height: 28px;
  list-style: none;
}
.event > summary::-webkit-details-marker { display: none; }
.event > summary:hover { background: var(--panel-raised); }
.event .ev-time { color: var(--ink-2); }
.event .ev-src { color: var(--accent); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.event .ev-host { color: var(--ink-2); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.event .ev-preview { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--ink); }
.event .ev-body {
  display: grid;
  grid-template-columns: minmax(260px, 38%) 1fr;
  gap: 12px;
  padding: 10px 12px 12px;
  background: #070a08;
  border-top: 1px solid var(--border);
}
.event .ev-fields { font-family: var(--mono); font-size: 12px; }
.event .ev-fields td { padding: 2px 10px 2px 0; vertical-align: top; word-break: break-all; }
.event .ev-fields td.fname { color: var(--ink-2); white-space: nowrap; }
.event .ev-fields .fval {
  background: none;
  border: none;
  padding: 0 2px;
  font: inherit;
  color: var(--ink);
  text-align: left;
  word-break: break-all;
}
.event .ev-fields .fval:hover { background: var(--accent-dim); color: var(--accent); }
.event .ev-raw { position: relative; min-width: 0; }
.event .ev-raw pre {
  font-size: 12px;
  white-space: pre-wrap;
  word-break: break-all;
  color: var(--ink);
  background: var(--bg);
  border: 1px solid var(--border);
  padding: 8px 10px;
  max-height: 240px;
  overflow: auto;
}
.event .ev-raw .copy-btn { position: absolute; top: 6px; right: 6px; font-size: 11px; padding: 2px 8px; opacity: 0.8; }

.pager { display: flex; gap: 10px; align-items: center; justify-content: center; padding: 12px; color: var(--ink-2); font-size: 12px; }

.zero-help { padding: 24px 16px; text-align: center; color: var(--ink-2); }
.zero-help .zh-big { font-size: 14px; color: var(--ink); margin-bottom: 6px; }

/* ---------- brief page (static prose, rendered from SOC-BRIEF.md) ---------- */
.prose { max-width: 960px; padding: 24px 16px 64px; }
.prose h1 {
  font-size: 22px;
  color: var(--accent);
  text-shadow: var(--glow-green);
  margin-bottom: 4px;
}
.prose h2 {
  font-size: 15px;
  text-transform: uppercase;
  letter-spacing: 0.08em;
  color: var(--amber);
  text-shadow: var(--glow-amber);
  margin: 28px 0 10px;
  padding-bottom: 6px;
  border-bottom: 1px solid var(--border);
}
.prose h3 { font-size: 13px; color: var(--ink); margin: 20px 0 8px; }
.prose p { margin: 8px 0; max-width: 76ch; }
.prose ul, .prose ol { margin: 8px 0 8px 22px; max-width: 76ch; }
.prose li { margin: 4px 0; }
.prose hr { border: none; border-top: 1px solid var(--border); margin: 24px 0; }
.prose code {
  background: var(--panel-raised);
  border: 1px solid var(--border);
  padding: 0 4px;
  font-size: 12px;
  color: var(--accent);
}
.prose blockquote {
  border-left: 3px solid var(--amber);
  background: var(--panel);
  padding: 10px 14px;
  margin: 14px 0;
  max-width: 76ch;
  color: var(--ink);
}
.prose .table-wrap { overflow-x: auto; margin: 12px 0; }
.prose table {
  border-collapse: collapse;
  background: var(--panel);
  border: 1px solid var(--border);
  font-size: 12px;
}
.prose th, .prose td {
  border: 1px solid var(--border);
  padding: 5px 10px;
  text-align: left;
  vertical-align: top;
}
.prose th {
  color: var(--ink-2);
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  font-size: 11px;
  background: var(--panel-raised);
}
.prose strong { color: #fff; }

/* history dropdown */
.hist-drop {
  position: absolute;
  top: 100%;
  left: 0;
  right: 0;
  z-index: 30;
  background: var(--panel-raised);
  border: 1px solid var(--border);
  max-height: 300px;
  overflow: auto;
}
.hist-drop button {
  display: flex;
  gap: 10px;
  width: 100%;
  text-align: left;
  background: none;
  border: none;
  border-top: 1px solid var(--border);
  padding: 6px 10px;
  font-family: var(--mono);
  font-size: 12px;
}
.hist-drop button:hover { background: var(--accent-dim); }
.hist-drop .hq { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.hist-drop .hc { color: var(--ink-3); }