/* OPN Compliance UI stylesheet.
 *
 * All styling lives here (or in per-page rules below) — templates must not use
 * `style="..."` attributes or `<style>` blocks: the strict Content-Security-
 * Policy (`style-src 'self'`, see app/security_headers.py) blocks both, and
 * tests/test_security_headers.py gates the templates. Compose the utility
 * classes at the bottom instead of adding new inline styles.
 */

:root {
  --bg: #eaebed; --card: #fff; --ink: #1c2330; --muted: #69748a;
  --line: #e3e7ee; --brand: #1f5fd1; --brand-ink: #fff;
  --ok: #1f9254; --warn: #b7791f; --bad: #c0392b; --chip: #eef2f8;
}
* { box-sizing: border-box; }
body {
  margin: 0; background: var(--bg); color: var(--ink);
  font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
}
a { color: var(--brand); text-decoration: none; }
a:hover { text-decoration: underline; }
header.topbar {
  background: var(--card); border-bottom: 1px solid var(--line);
  padding: 12px 24px; display: flex; align-items: center; gap: 16px;
  position: sticky; top: 0; z-index: 100;
}
header.topbar .brand { font-weight: 700; font-size: 16px; }
header.topbar .brand a { display: flex; }
header.topbar .brand-logo { display: block; width: 32px; height: 32px; }
header.topbar .spacer { flex: 1; }
header.topbar .who { color: var(--muted); font-size: 13px; }
header.topbar nav { display: flex; gap: 16px; }
header.topbar form.topbar-search input { width: 180px; }
/* Full-width: pages span the window (minus side gutters) so wide tables
   aren't arbitrarily constrained. */
main { margin: 24px 0; padding: 0 24px; }
h1 { font-size: 22px; margin: 0 0 16px; }
h2 { font-size: 16px; margin: 24px 0 10px; }
.card {
  background: var(--card); border: 1px solid var(--line);
  border-radius: 10px; padding: 18px 20px; margin-bottom: 16px;
}
/* Card tints: a success / caution wash over .card (seed notices, live stats). */
.card-ok { background: #e4f5ec; border-color: #bfe6cf; }
.card-warn { background: #fffaf0; border-color: #f0dcb4; }
/* Dismissable banner (e.g. seed-result notices): close button on the right. */
.banner { display: flex; align-items: center; gap: 12px; }
.banner > .banner-msg { flex: 1; }
.banner-close {
  background: none; border: none; cursor: pointer; padding: 0 4px;
  font-size: 20px; line-height: 1; color: var(--muted);
}
.banner-close:hover { color: var(--ink); }
table { width: 100%; border-collapse: collapse; }
th, td { text-align: left; padding: 9px 10px; border-bottom: 1px solid var(--line); }
th { font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); }
th a.sortlink { color: inherit; cursor: pointer; }
th a.sortlink:hover { color: var(--ink); text-decoration: underline; }
.btn {
  display: inline-block; background: var(--brand); color: var(--brand-ink);
  border: none; border-radius: 7px; padding: 8px 14px; font-size: 14px;
  cursor: pointer; font-weight: 600;
}
.btn:hover { filter: brightness(1.05); text-decoration: none; }
.btn.ghost { background: var(--chip); color: var(--ink); }
.btn.danger { background: var(--bad); }
.btn.small { padding: 5px 10px; font-size: 13px; }
input, select, textarea {
  font: inherit; padding: 8px 10px; border: 1px solid var(--line);
  border-radius: 7px; width: 100%; background: #fff;
}
label { display: block; font-size: 13px; color: var(--muted); margin: 10px 0 4px; }
.row { display: flex; gap: 12px; flex-wrap: wrap; }
.row > * { flex: 1; min-width: 160px; }
.badge {
  display: inline-block; padding: 3px 9px; border-radius: 999px;
  font-size: 12px; font-weight: 700; background: var(--chip); color: var(--muted);
}
.badge.draft, .badge.retracted { background:#eef2f8; color:#54617a; }
.badge.submitted, .badge.approved { background:#fff4e0; color: var(--warn); }
.badge.deployed, .badge.closed { background:#e4f5ec; color: var(--ok); }
.badge.rejected, .badge.rolled_back { background:#fbe6e3; color: var(--bad); }
/* Derived open/closed status (closed shares the green rule above). */
.badge.open { background:#fff4e0; color: var(--warn); }
/* Derived schedule status (recurring compliance tasks). */
.badge.on_track { background:#e4f5ec; color: var(--ok); }
.badge.due_soon { background:#fff4e0; color: var(--warn); }
.badge.overdue { background:#fbe6e3; color: var(--bad); }
.badge.inactive { background:#eef2f8; color:#54617a; }
/* Derived BCDR recovery posture. */
.badge.compliant { background:#e4f5ec; color: var(--ok); }
.badge.at_risk { background:#fff4e0; color: var(--warn); }
.badge.untested { background:#eef2f8; color:#54617a; }
.badge.breached { background:#fbe6e3; color: var(--bad); }
/* BCDR criticality tiers. */
.badge.critical { background:#fbe6e3; color: var(--bad); }
.badge.high { background:#fff4e0; color: var(--warn); }
.badge.medium { background:#eef2f8; color:#54617a; }
.badge.low { background:#eef2f8; color:#54617a; }
/* Trusted-timestamp (stamp) status. */
.badge.pending { background:#fff4e0; color: var(--warn); }
.badge.confirmed { background:#e4f5ec; color: var(--ok); }
td.bad { color: var(--bad); font-weight:600; }
.meta { display: grid; grid-template-columns: 160px 1fr; gap: 6px 16px; font-size: 14px; }
.meta dt { color: var(--muted); }
.meta dd { margin: 0; }
.gates { list-style: none; padding: 0; margin: 0; }
.gates li { padding: 4px 0; }
.gates .done::before { content: "\2714  "; color: var(--ok); font-weight: 700; }
.gates .todo::before { content: "\25CB  "; color: var(--muted); }
.timeline { list-style: none; padding: 0; margin: 0; font-size: 14px; }
.timeline li { padding: 6px 0; border-bottom: 1px dashed var(--line); }
.timeline .when { color: var(--muted); font-size: 12px; }
.err { background:#fbe6e3; color: var(--bad); border:1px solid #f0c4bd;
       padding: 8px 12px; border-radius: 7px; margin-bottom: 12px; font-size: 14px; }
.muted { color: var(--muted); }
.req { color: var(--bad); }
.actions form { display: inline-block; margin: 4px 6px 0 0; }
/* Rendered Markdown (narrative fields) — block children inside a <dd>. */
.md > :first-child { margin-top: 0; }
.md > :last-child { margin-bottom: 0; }
.md p { margin: 0 0 8px; }
.md ul, .md ol { margin: 0 0 8px; padding-left: 22px; }
.md code {
  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  font-size: .9em; background: var(--chip); padding: 1px 5px; border-radius: 4px;
}
.md pre {
  background: var(--chip); padding: 10px 12px; border-radius: 7px;
  overflow-x: auto; margin: 0 0 8px;
}
.md pre code { background: none; padding: 0; }
.md blockquote {
  margin: 0 0 8px; padding: 2px 12px; border-left: 3px solid var(--line);
  color: var(--muted);
}

/* --- Access-tokens page (/ui/tokens) ------------------------------------- */
/* Wide enough for the local-time-zone hint to sit on one line; the datetime
   input fills that width so the field and its hint stay aligned. */
.token-expires { width: 21rem; max-width: 100%; }
.token-expires .ldt-dt { width: 100%; box-sizing: border-box; }
/* The top row: Purpose / Expires / button, top-aligned so labels and controls line up. */
.token-top-row { display: flex; gap: 10px; align-items: flex-start; flex-wrap: wrap; }
/* margin:0 overrides the global `label { margin:10px 0 4px }` that would drop
   the Purpose column below its sibling <div> columns. */
.token-field { display: flex; flex-direction: column; gap: 4px; margin: 0; }
.token-roles { margin-top: 18px; }
.token-role-opts { display: flex; flex-direction: column; gap: 8px; margin-top: 6px; }
/* Checkboxes wrap under the "specific" radio, indented to align past the dot.
   The [hidden] override beats `.token-role-grid` so the JS toggle actually
   hides the grid (an author `display:flex` otherwise outranks the UA
   `[hidden] { display:none }` rule and it'd always show). */
.token-role-grid { display: flex; flex-wrap: wrap; gap: 8px 20px; padding: 8px 0 2px 26px; }
.token-role-grid[hidden] { display: none; }
/* A radio/checkbox + its text. width:auto + flex:0 0 auto undo the global
   `input { width:100% }`, which otherwise stretches each control full-width
   and scatters the row. */
.role-opt { display: flex; align-items: center; gap: 8px; margin: 0; font-weight: normal; }
.role-opt input[type="radio"],
.role-opt input[type="checkbox"] { width: auto; flex: 0 0 auto; margin: 0; }
/* The freshly-created token secret: shown once, click selects the whole value. */
.token-secret {
  display: block; padding: 10px; background: #f4f4f4;
  border-radius: 6px; word-break: break-all; user-select: all;
}

/* --- Utilities (replace inline style= attributes; compose freely) --------- */
/* Horizontal flex row; add a .gap-* and margins as needed. */
.hrow { display: flex; align-items: center; }
.wrap { flex-wrap: wrap; }
.gap-6 { gap: 6px; }
.gap-8 { gap: 8px; }
.gap-10 { gap: 10px; }
.gap-12 { gap: 12px; }
.gap-16 { gap: 16px; }
.ai-center { align-items: center; }
.grow { flex: 1; }
.minw-200 { min-width: 200px; }
.w-auto { width: auto; }
.block { display: block; }
.inline { display: inline; }
.hide { display: none; }
/* A checkbox/radio + label pair sitting inline in a row of controls. */
.check-label {
  display: inline-flex; align-items: center; gap: 6px;
  margin: 0; flex: 0 0 auto; width: auto; color: var(--ink);
}
.fs-12 { font-size: 12px; }
.fs-13 { font-size: 13px; }
.pointer { cursor: pointer; }
.ink-ok { color: var(--ok); }
.ink-warn { color: var(--warn); }
.ink-bad { color: var(--bad); }
/* Dashboard-style stat number. */
.stat { font-size: 16px; font-weight: 700; }
.prewrap { white-space: pre-wrap; overflow-wrap: anywhere; }
.plainlist { list-style: none; padding: 0; margin: 0; }
.mono-input { font-family: monospace; font-size: 12px; padding: 4px 8px; min-width: 220px; }
.maxw-560 { max-width: 560px; }
.maxw-70ch { max-width: 70ch; }
/* A lone centered card (login, forbidden). */
.solo-center { max-width: 480px; margin: 56px auto; text-align: center; }
/* Section divider row (e.g. list footers). */
.rule-top { border-top: 1px solid var(--line); padding: 12px 0; }
/* Wrapping grid of checkbox options (e.g. the column picker). */
.opt-grid { display: flex; flex-wrap: wrap; gap: 6px 18px; }
/* A hint line pulled up tight under its heading. */
.sub-hint { margin: -6px 0 10px; font-size: 13px; }
/* Margins last so they win inside any utility combo (e.g. "m-0 mt-8"). */
.m-0 { margin: 0; }
.m-2 { margin: 2px; }
.ml-4 { margin-left: 4px; }
.mt-0 { margin-top: 0; }
.mt-4 { margin-top: 4px; }
.mt-6 { margin-top: 6px; }
.mt-8 { margin-top: 8px; }
.mt-10 { margin-top: 10px; }
.mt-12 { margin-top: 12px; }
.mt-14 { margin-top: 14px; }
.mt-16 { margin-top: 16px; }
.mt-18 { margin-top: 18px; }
.mt-20 { margin-top: 20px; }
.mb-0 { margin-bottom: 0; }
.mb-4 { margin-bottom: 4px; }
.mb-6 { margin-bottom: 6px; }
.mb-8 { margin-bottom: 8px; }
.mb-10 { margin-bottom: 10px; }
.mb-12 { margin-bottom: 12px; }
.mb-14 { margin-bottom: 14px; }
.mb-16 { margin-bottom: 16px; }