/*
 * app.css — the core stylesheet. Embedded in the binary; a theme may not
 * replace it, only add rules after it via /theme/theme.css.
 *
 * Every colour and dimension is a custom property so a theme can rebrand the
 * product without touching a single selector. That is the whole reason the
 * theme contract can forbid overriding component markup and still allow real
 * branding: the variables are the supported surface.
 */

:root {
  /* Palette — overridable by themes */
  --color-bg: #f6f7f9;
  --color-surface: #ffffff;
  --color-surface-alt: #f0f2f5;
  --color-border: #d8dce3;
  --color-text: #1c2128;
  --color-text-muted: #656d76;
  --color-primary: #1f5fa9;
  --color-primary-hover: #17497f;
  --color-primary-contrast: #ffffff;
  --color-ok: #1a7f45;
  --color-warn: #a86a12;
  --color-bad: #b3261e;
  --color-focus: #1f5fa9;

  /* Typography */
  --font-sans: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
  --font-mono: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
  --font-size: 15px;
  --line-height: 1.5;

  /* Shape and spacing */
  --radius: 6px;
  --radius-small: 4px;
  --space-1: 4px;
  --space-2: 8px;
  --space-3: 12px;
  --space-4: 16px;
  --space-5: 24px;
  --space-6: 32px;
  --shadow: 0 1px 2px rgba(16, 22, 26, .08), 0 2px 8px rgba(16, 22, 26, .04);
  --max-width: 1360px;
}

@media (prefers-color-scheme: dark) {
  :root {
    --color-bg: #14171c;
    --color-surface: #1c2027;
    --color-surface-alt: #232830;
    --color-border: #333a45;
    --color-text: #e6e9ee;
    --color-text-muted: #98a1ae;
    --color-primary: #5b9bef;
    --color-primary-hover: #7fb3f5;
    --color-primary-contrast: #0d1117;
    --color-ok: #4cc38a;
    --color-warn: #e0a145;
    --color-bad: #f2716a;
  }
}

*, *::before, *::after { box-sizing: border-box; }

html { font-size: var(--font-size); }

body {
  margin: 0;
  font-family: var(--font-sans);
  line-height: var(--line-height);
  color: var(--color-text);
  background: var(--color-bg);
  -webkit-text-size-adjust: 100%;
}

/* Focus is never removed, only restyled. Keyboard operators exist. */
:focus-visible {
  outline: 2px solid var(--color-focus);
  outline-offset: 2px;
}

.skip-link {
  position: absolute;
  left: -9999px;
  background: var(--color-surface);
  padding: var(--space-2) var(--space-3);
  z-index: 100;
}
.skip-link:focus { left: var(--space-3); top: var(--space-3); }

a { color: var(--color-primary); text-decoration: none; }
a:hover { text-decoration: underline; }

code, pre { font-family: var(--font-mono); font-size: .875em; }

.muted { color: var(--color-text-muted); }
.strong { font-weight: 600; }
.numeric { text-align: right; font-variant-numeric: tabular-nums; }

/* ---------- shell ---------- */

.app-header {
  display: flex;
  align-items: center;
  gap: var(--space-5);
  padding: var(--space-3) var(--space-5);
  background: var(--color-surface);
  border-bottom: 1px solid var(--color-border);
  flex-wrap: wrap;
}

.brand { display: inline-flex; align-items: center; gap: var(--space-2); color: var(--color-text); }
.brand:hover { text-decoration: none; }
.brand__logo { display: block; }
.brand__name { font-weight: 650; letter-spacing: -.01em; }

.app-nav { flex: 1 1 auto; }
.nav-list { display: flex; flex-wrap: wrap; gap: var(--space-1); list-style: none; margin: 0; padding: 0; align-items: center; }

.nav-link {
  display: inline-block;
  padding: var(--space-2) var(--space-3);
  border-radius: var(--radius-small);
  color: var(--color-text-muted);
  font-size: .925rem;
}
.nav-link:hover { background: var(--color-surface-alt); color: var(--color-text); text-decoration: none; }
.nav-link.is-active { background: var(--color-surface-alt); color: var(--color-text); font-weight: 600; }

/* --- two-level navigation ---------------------------------------------------
   The submenu opens on hover AND on focus-within. The second is what makes it
   usable without a mouse: tabbing to the label or into any child reveals the
   group. A hover-only menu is simply unreachable by keyboard.

   No JavaScript is involved, which is a resilience property rather than a
   stylistic one -- the CSP forbids inline script, so a scripted menu that
   failed to load would leave the application unnavigable. */

.nav-group { position: relative; }

.nav-group__label {
  display: inline-block;
  padding: var(--space-2) var(--space-3);
  border-radius: var(--radius-small);
  color: var(--color-text-muted);
  font-size: .925rem;
  cursor: default;
  user-select: none;
}
/* The caret marks the label as openable. Decorative, so it is hidden from
   assistive technology -- aria-haspopup on the element carries that meaning. */
.nav-group__label::after { content: " \25BE"; font-size: .7em; opacity: .7; }
.nav-group:hover > .nav-group__label,
.nav-group:focus-within > .nav-group__label { background: var(--color-surface-alt); color: var(--color-text); }
.nav-group__label.is-active { background: var(--color-surface-alt); color: var(--color-text); font-weight: 600; }

.nav-submenu {
  position: absolute;
  top: 100%;
  left: 0;
  z-index: 40;
  min-width: 13rem;
  display: flex;
  flex-direction: column;
  gap: 2px;
  margin: 0;
  padding: var(--space-1);
  list-style: none;
  background: var(--color-surface);
  border: 1px solid var(--color-border);
  border-radius: var(--radius-small);
  box-shadow: 0 6px 20px rgb(0 0 0 / 12%);
  /* visibility, not display: none, so the transition works and so assistive
     technology still reports the items as part of the menu structure. */
  visibility: hidden;
  opacity: 0;
  transition: opacity .12s ease, visibility .12s;
}
.nav-group:hover > .nav-submenu,
.nav-group:focus-within > .nav-submenu { visibility: visible; opacity: 1; }
.nav-submenu .nav-link { display: block; white-space: nowrap; }

/* Touch devices have no hover, and :focus-within alone would need a tap that
   lands on the label. Below the desktop breakpoint the menu is simply always
   open -- a slightly longer bar beats an unreachable one. */
@media (max-width: 720px) {
  .nav-submenu { position: static; visibility: visible; opacity: 1; box-shadow: none;
                 border: 0; background: transparent; padding: 0; min-width: 0;
                 flex-direction: row; flex-wrap: wrap; }
  .nav-group__label::after { content: ""; }
}

.app-header__account { display: flex; align-items: center; gap: var(--space-2); }
.account-link { font-size: .9rem; }

.app-main { max-width: var(--max-width); margin: 0 auto; padding: var(--space-5); }

.app-footer {
  max-width: var(--max-width);
  margin: 0 auto;
  padding: var(--space-4) var(--space-5) var(--space-6);
  display: flex;
  justify-content: space-between;
  gap: var(--space-4);
  flex-wrap: wrap;
  font-size: .85rem;
  color: var(--color-text-muted);
  border-top: 1px solid var(--color-border);
}
.app-footer__brand, .app-footer__meta { display: flex; gap: var(--space-3); align-items: center; }

.version-badge {
  font-family: var(--font-mono);
  background: var(--color-surface-alt);
  border: 1px solid var(--color-border);
  border-radius: var(--radius-small);
  padding: 1px var(--space-2);
}

/* ---------- auth shell ---------- */

.auth-body { background: var(--color-surface-alt); }
.auth-shell {
  min-height: 100vh;
  display: grid;
  grid-template-columns: minmax(0, 1fr) minmax(0, 420px);
  align-items: stretch;
}
.auth-aside {
  background: var(--color-surface);
  padding: var(--space-6);
  display: flex;
  flex-direction: column;
  justify-content: center;
  gap: var(--space-3);
  border-right: 1px solid var(--color-border);
}
.auth-title { margin: 0; font-size: 1.6rem; }
.auth-subtitle { color: var(--color-text-muted); max-width: 40ch; }
.auth-panel { padding: var(--space-6); display: flex; flex-direction: column; justify-content: center; gap: var(--space-4); }
.auth-heading { margin: 0; font-size: 1.25rem; }
.auth-form { display: flex; flex-direction: column; gap: var(--space-3); }
.auth-providers { display: flex; flex-direction: column; gap: var(--space-2); }
.auth-divider { display: flex; align-items: center; gap: var(--space-3); color: var(--color-text-muted); font-size: .85rem; }
.auth-divider::before, .auth-divider::after { content: ""; flex: 1; height: 1px; background: var(--color-border); }
.auth-hint { font-size: .85rem; }
.auth-version { font-size: .8rem; }

@media (max-width: 800px) {
  .auth-shell { grid-template-columns: 1fr; }
  .auth-aside { border-right: none; border-bottom: 1px solid var(--color-border); }
}

/* ---------- page furniture ---------- */

.page-header {
  display: flex;
  justify-content: space-between;
  align-items: flex-start;
  gap: var(--space-4);
  margin-bottom: var(--space-5);
  flex-wrap: wrap;
}
.page-title { margin: 0 0 var(--space-1); font-size: 1.5rem; letter-spacing: -.015em; }
.page-subtitle { margin: 0; font-size: .9rem; display: flex; gap: var(--space-2); align-items: center; flex-wrap: wrap; }
.page-actions { display: flex; gap: var(--space-2); }

.version-panel {
  background: var(--color-surface);
  border: 1px solid var(--color-border);
  border-radius: var(--radius);
  padding: var(--space-3) var(--space-4);
  display: grid;
  gap: 2px;
  min-width: 220px;
}
.version-panel__label { font-size: .7rem; text-transform: uppercase; letter-spacing: .06em; color: var(--color-text-muted); }
.version-panel__value { font-family: var(--font-mono); font-size: 1.35rem; font-weight: 650; }
.version-panel__meta { font-size: .78rem; }

.grid { display: grid; gap: var(--space-4); }
.grid--2 { grid-template-columns: repeat(auto-fit, minmax(380px, 1fr)); }

.card {
  background: var(--color-surface);
  border: 1px solid var(--color-border);
  border-radius: var(--radius);
  padding: var(--space-4);
  box-shadow: var(--shadow);
}
.card--wide { grid-column: 1 / -1; }
.card--centered { max-width: 40rem; margin: var(--space-6) auto; text-align: center; }
.card--danger { border-color: color-mix(in srgb, var(--color-bad) 40%, var(--color-border)); }
.card__header { display: flex; justify-content: space-between; align-items: center; gap: var(--space-3); }
.card__title { margin: 0 0 var(--space-2); font-size: 1.05rem; }
.card__hint { font-size: .875rem; margin: 0 0 var(--space-3); }
.subhead { font-size: .95rem; margin: var(--space-3) 0 var(--space-2); }

.rule { border: 0; border-top: 1px solid var(--color-border); margin: var(--space-4) 0; }

/* ---------- tiles ---------- */

.tiles { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: var(--space-3); margin-bottom: var(--space-5); }
.tile {
  background: var(--color-surface);
  border: 1px solid var(--color-border);
  border-radius: var(--radius);
  padding: var(--space-4);
  display: grid;
  gap: var(--space-1);
  color: var(--color-text);
}
a.tile:hover { border-color: var(--color-primary); text-decoration: none; }
.tile__value { font-size: 1.75rem; font-weight: 650; font-variant-numeric: tabular-nums; line-height: 1.1; }
.tile__label { font-size: .8rem; color: var(--color-text-muted); text-transform: uppercase; letter-spacing: .04em; }
.tile--ok { border-color: var(--color-ok); }
.tile--warn { border-color: var(--color-warn); }
.tile--bad { border-color: var(--color-bad); }

/* ---------- tables ---------- */

.table { width: 100%; border-collapse: collapse; background: var(--color-surface);
         border: 1px solid var(--color-border); border-radius: var(--radius); overflow: hidden;
         margin-bottom: var(--space-4); }
.table th, .table td { padding: var(--space-3); text-align: left; vertical-align: top;
                        border-bottom: 1px solid var(--color-border); font-size: .9rem; }
.table thead th { background: var(--color-surface-alt); font-size: .78rem; text-transform: uppercase;
                   letter-spacing: .04em; color: var(--color-text-muted); font-weight: 600; }
.table tbody tr:last-child td { border-bottom: 0; }
.table tbody tr:hover { background: var(--color-surface-alt); }
.table--compact th, .table--compact td { padding: var(--space-2) var(--space-3); }
.row--attention { background: color-mix(in srgb, var(--color-bad) 6%, transparent); }
.row-detail td { background: var(--color-surface-alt); }
.actions { display: flex; gap: var(--space-2); flex-wrap: wrap; }
.service-flags { display: flex; gap: var(--space-1); flex-wrap: wrap; }

.empty-state { color: var(--color-text-muted); text-align: center; padding: var(--space-5) !important; font-style: italic; }

.definition-list { display: grid; grid-template-columns: max-content 1fr; gap: var(--space-2) var(--space-4); margin: 0; }
.definition-list dt { color: var(--color-text-muted); font-size: .85rem; }
.definition-list dd { margin: 0; font-size: .9rem; word-break: break-word; }

.plain-list { margin: 0; padding-left: 1.1rem; font-size: .9rem; }
.two-col { display: grid; grid-template-columns: 1fr 1fr; gap: var(--space-4); }

/* ---------- badges and meters ---------- */

.badge {
  display: inline-block;
  padding: 1px var(--space-2);
  border-radius: 999px;
  font-size: .72rem;
  font-weight: 600;
  letter-spacing: .02em;
  text-transform: lowercase;
  border: 1px solid transparent;
  white-space: nowrap;
}
.badge--ok    { background: color-mix(in srgb, var(--color-ok) 14%, transparent);   color: var(--color-ok);   border-color: color-mix(in srgb, var(--color-ok) 35%, transparent); }
.badge--warn  { background: color-mix(in srgb, var(--color-warn) 14%, transparent); color: var(--color-warn); border-color: color-mix(in srgb, var(--color-warn) 35%, transparent); }
.badge--bad   { background: color-mix(in srgb, var(--color-bad) 14%, transparent);  color: var(--color-bad);  border-color: color-mix(in srgb, var(--color-bad) 35%, transparent); }
.badge--muted { background: var(--color-surface-alt); color: var(--color-text-muted); border-color: var(--color-border); }

.meter { height: 6px; background: var(--color-surface-alt); border-radius: 999px; overflow: hidden; min-width: 90px; }
.meter--large { height: 12px; margin-bottom: var(--space-2); }
.meter__fill { height: 100%; border-radius: 999px; }
.meter__fill--ok { background: var(--color-ok); }
.meter__fill--warn { background: var(--color-warn); }
.meter__fill--bad { background: var(--color-bad); }

.stat-list { list-style: none; margin: 0; padding: 0; display: grid; gap: var(--space-2); }
.stat-list__item { display: flex; align-items: center; gap: var(--space-3); }
.stat-list__value { font-variant-numeric: tabular-nums; font-weight: 600; }

.issue-list { list-style: none; margin: 0; padding: 0; display: grid; gap: var(--space-2); }
.issue-list__item { display: flex; gap: var(--space-2); align-items: baseline; font-size: .875rem; }

/* ---------- forms ---------- */

.form { display: flex; flex-direction: column; gap: var(--space-3); }
.form--grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); gap: var(--space-3); align-items: start; }
.form--inline { flex-direction: row; align-items: center; gap: var(--space-2); flex-wrap: wrap; }
.form__actions { grid-column: 1 / -1; display: flex; gap: var(--space-2); }
.inline-form { display: inline; }
.action-row { margin-bottom: var(--space-3); }

.field { display: grid; gap: var(--space-1); }
.field--wide { grid-column: 1 / -1; }
.field--inline { grid-template-columns: max-content 1fr; align-items: center; gap: var(--space-2); }
.field--checkbox { grid-template-columns: max-content 1fr; align-items: start; gap: var(--space-2); }
.field__label { font-size: .82rem; font-weight: 600; color: var(--color-text-muted); }
.field__hint { font-size: .78rem; color: var(--color-text-muted); grid-column: 1 / -1; }

.field__input {
  font: inherit;
  font-size: .9rem;
  padding: var(--space-2) var(--space-3);
  border: 1px solid var(--color-border);
  border-radius: var(--radius-small);
  background: var(--color-surface);
  color: var(--color-text);
  width: 100%;
  min-width: 0;
}
.field__input--compact { max-width: 220px; display: inline-block; width: auto; }
.field__input:focus { border-color: var(--color-primary); }
textarea.field__input { resize: vertical; font-family: var(--font-mono); }

.fieldset { border: 1px solid var(--color-border); border-radius: var(--radius-small);
            padding: var(--space-3); display: grid; gap: var(--space-2); }
.fieldset legend { font-size: .82rem; font-weight: 600; color: var(--color-text-muted); padding: 0 var(--space-2); }

.filter-bar { display: flex; gap: var(--space-3); align-items: end; margin-bottom: var(--space-4); flex-wrap: wrap; }
.filter-bar--wrap { align-items: center; }

.btn {
  font: inherit;
  font-size: .875rem;
  font-weight: 550;
  padding: var(--space-2) var(--space-4);
  border-radius: var(--radius-small);
  border: 1px solid var(--color-border);
  background: var(--color-surface);
  color: var(--color-text);
  cursor: pointer;
  display: inline-flex;
  align-items: center;
  gap: var(--space-2);
  white-space: nowrap;
}
.btn:hover { background: var(--color-surface-alt); text-decoration: none; }
.btn--primary { background: var(--color-primary); border-color: var(--color-primary); color: var(--color-primary-contrast); }
.btn--primary:hover { background: var(--color-primary-hover); border-color: var(--color-primary-hover); }
.btn--secondary { border-color: var(--color-primary); color: var(--color-primary); }
.btn--ghost { border-color: transparent; background: transparent; color: var(--color-text-muted); }
.btn--ghost:hover { background: var(--color-surface-alt); color: var(--color-text); }
.btn--warning { border-color: var(--color-warn); color: var(--color-warn); }
.btn--warning:hover { background: color-mix(in srgb, var(--color-warn) 12%, transparent); }
.btn--danger { border-color: var(--color-bad); color: var(--color-bad); }
.btn--danger:hover { background: color-mix(in srgb, var(--color-bad) 12%, transparent); }
.btn--small { padding: 2px var(--space-2); font-size: .78rem; }
.btn--block { width: 100%; justify-content: center; }
.btn:disabled { opacity: .5; cursor: not-allowed; }

/* ---------- flashes ---------- */

.flash-region { display: grid; gap: var(--space-2); margin-bottom: var(--space-4); }
.flash {
  display: flex;
  justify-content: space-between;
  gap: var(--space-3);
  padding: var(--space-3) var(--space-4);
  border-radius: var(--radius);
  border: 1px solid var(--color-border);
  background: var(--color-surface);
  font-size: .9rem;
}
.flash--success { border-color: var(--color-ok); background: color-mix(in srgb, var(--color-ok) 8%, var(--color-surface)); }
.flash--error   { border-color: var(--color-bad); background: color-mix(in srgb, var(--color-bad) 8%, var(--color-surface)); }
.flash--warning { border-color: var(--color-warn); background: color-mix(in srgb, var(--color-warn) 8%, var(--color-surface)); }
.flash__text { word-break: break-word; }
.flash__close { background: none; border: 0; font-size: 1.1rem; cursor: pointer; color: var(--color-text-muted); line-height: 1; }

.warning-block {
  border-left: 3px solid var(--color-warn);
  background: color-mix(in srgb, var(--color-warn) 8%, transparent);
  padding: var(--space-3) var(--space-4);
  border-radius: var(--radius-small);
  font-size: .9rem;
  margin: 0 0 var(--space-3);
}

/* ---------- code and details ---------- */

.code-block {
  background: var(--color-surface-alt);
  border: 1px solid var(--color-border);
  border-radius: var(--radius-small);
  padding: var(--space-3);
  overflow-x: auto;
  white-space: pre-wrap;
  word-break: break-word;
  margin: var(--space-2) 0;
  position: relative;
}
.detail-block { margin-top: var(--space-2); }
.detail-block summary { cursor: pointer; font-size: .82rem; color: var(--color-text-muted); }

.copy-button {
  position: absolute;
  top: var(--space-2);
  right: var(--space-2);
  font-size: .72rem;
  padding: 1px var(--space-2);
}

.pagination { display: flex; justify-content: space-between; align-items: center; gap: var(--space-3);
              flex-wrap: wrap; font-size: .85rem; color: var(--color-text-muted); margin-bottom: var(--space-5); }
.pagination__controls { display: flex; gap: var(--space-2); align-items: center; }

.dns-table td { max-width: 620px; }
.theme-report { padding: var(--space-3) 0; border-bottom: 1px solid var(--color-border); }
.theme-report:last-child { border-bottom: 0; }
.error-code { font-family: var(--font-mono); }

@media (max-width: 720px) {
  .app-main { padding: var(--space-3); }
  .grid--2, .two-col { grid-template-columns: 1fr; }
  .table { display: block; overflow-x: auto; }
}

@media print {
  .app-header, .app-footer, .form__actions, .actions, .filter-bar { display: none; }
  .card { break-inside: avoid; box-shadow: none; }
}

/* The audit time window appears only for a single-day range. Inline-flex so it
   sits in the filter row as one unit and collapses cleanly when hidden --
   [hidden] needs the explicit rule because display:inline-flex would otherwise
   override the browser default. */
.audit-times { display: inline-flex; gap: var(--space-2); align-items: flex-end; }
.audit-times[hidden] { display: none; }

/* The timezone is displayed wherever a time is entered or read. A time filter
   whose zone is invisible is a time filter people misread -- especially when
   correlating against Postfix logs, which timestamp in the server local zone. */
.tz-badge { display: inline-block; padding: 2px var(--space-2); border-radius: var(--radius-small);
            background: var(--color-surface-alt); color: var(--color-text-muted);
            font-size: .75rem; font-weight: 600; letter-spacing: .02em; white-space: nowrap; }
.tz-badge--title { vertical-align: middle; margin-left: var(--space-2); font-weight: 500; }