/* The portal stylesheet, shared by every page under ui/ via <link href="/app.css">.

   It was three verbatim copies of a <style> block before the dashboard existed; at four
   pages, "keep them identical by hand" stops being a plan. Two login-shaped pages that
   drift apart look broken in a way nobody files a bug for.

   The tokens are from the Salawaku design canvas: a near-white ground, near-black ink
   and type, indigo for focus and the one accent, 16px cards over 10px controls. One
   deliberate deviation: the design loads Inter from fonts.googleapis.com and this does
   not. A page that administers a vault of real credentials should not call a third party
   to render, and the portal has to work on a box with no route to the internet -- so
   Inter is used when the reader has it and the system face stands in when they do not. */
:root {
  --bg: #FAFAFA; --card: #FFFFFF; --line: #E4E4E7; --field: #D4D4D8; --hover: #F4F4F5;
  --ink: #18181B; --muted: #52525B; --faint: #737373;
  --accent: #4338CA; --ring: rgba(67,56,202,.16);
  --bad: #B91C1C; --ok: #166534;
  --r: 16px; --r-sm: 10px;
  --side: 248px; --side-shut: 76px;
}
* { box-sizing: border-box; }
[hidden] { display: none !important; }
body {
  margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 48px 20px;
  background: var(--bg); color: var(--ink);
  font: 15px/1.5 "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, sans-serif;
}
main { width: 100%; max-width: 400px; }

.mark { width: 40px; height: 40px; margin: 0 auto 20px; display: block; border-radius: 12px; object-fit: cover; }
h1 { margin: 0; font-size: 26px; font-weight: 600; text-align: center; letter-spacing: -.02em; }
.sub { margin: 8px 0 32px; text-align: center; color: var(--muted); }

.card {
  background: var(--card); border: 1px solid var(--line); border-radius: var(--r);
  padding: 28px; box-shadow: 0 1px 2px rgba(24,24,27,.04);
}
.field + .field { margin-top: 20px; }
.label { display: flex; align-items: center; justify-content: space-between; margin-bottom: 8px; }
label { font-size: 14px; font-weight: 500; }
.note { font-size: 13px; color: var(--muted); }
.link { font-size: 13px; color: var(--ink); text-decoration: none; font-weight: 500; }
.link:hover { text-decoration: underline; }
/* A link that follows the field it is about, rather than sharing its label row. */
.link.after { display: block; width: fit-content; margin: 8px 0 0 auto; }
/* An anchor inside a paragraph has nothing else marking it out, so it keeps the
   underline. The login page's links are not in prose and stay plain. */
.sub .link { text-decoration: underline; }
button.link { border: 0; background: none; padding: 0; cursor: pointer; font-family: inherit; }

input, select {
  width: 100%; height: 46px; padding: 0 14px; border: 1px solid var(--field);
  border-radius: var(--r-sm); background: #fff; color: var(--ink); font: inherit;
  transition: border-color .15s, box-shadow .15s;
}
input::placeholder { color: var(--faint); }
input:hover, select:hover { border-color: #B5B5BA; }
input:focus, select:focus { outline: none; border-color: var(--accent); box-shadow: 0 0 0 3px var(--ring); }

.with-toggle { position: relative; }
.with-toggle input { padding-right: 68px; }
.toggle {
  position: absolute; right: 6px; top: 6px; height: 34px; padding: 0 10px;
  border: 0; border-radius: 8px; background: none; color: var(--muted);
  font: 500 13px inherit; cursor: pointer;
}
.toggle:hover { background: var(--hover); color: var(--ink); }

button.primary {
  width: 100%; height: 46px; margin-top: 24px; border: 0; border-radius: var(--r-sm);
  background: var(--ink); color: #fff; font: 500 15px inherit; cursor: pointer;
  transition: background .15s;
}
button.primary:hover { background: #27272A; }
button.primary:disabled { opacity: .6; cursor: default; }

:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; }

/* One row, reserved, so an error does not shift the card when it appears. */
.status { min-height: 20px; margin-top: 14px; font-size: 13.5px; text-align: center; }
.status[data-tone="bad"] { color: var(--bad); }
.status[data-tone="ok"]  { color: var(--ok); }
.status[data-tone="busy"]{ color: var(--muted); }
/* A card holding no form has nothing to shift, so it does not pay for the space. */
.status.quiet:empty { min-height: 0; margin: 0; }
.status.left { text-align: left; }

.foot { margin: 24px 0 0; text-align: center; font-size: 14px; color: var(--muted); }
.who { display: grid; gap: 4px; text-align: center; }
.who .mail { font-weight: 600; }
.who .role { font-size: 13px; color: var(--muted); }
button.quiet {
  width: 100%; height: 44px; margin-top: 20px; border: 1px solid var(--field);
  border-radius: var(--r-sm); background: #fff; color: var(--ink);
  font: 500 14px inherit; cursor: pointer;
}
button.quiet:hover { background: var(--hover); }
code { font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
@media (prefers-reduced-motion: reduce) { * { transition: none !important; } }

/* --- the app shell: a collapsible sidebar, a top bar, and the page under it ----------
   The login card is 400px because a login form should not be wider than it needs to be.
   The signed-in pages are a different shape, so they use .shell instead of <main>. */
.shell { display: flex; align-items: stretch; min-height: 100vh; width: 100%; }
body:has(.shell) { display: block; padding: 0; }

aside.side {
  flex: none; width: var(--side); padding: 12px 16px; overflow: hidden;
  display: flex; flex-direction: column; gap: 4px;
  background: #fff; border-right: 1px solid var(--line);
  position: sticky; top: 0; height: 100vh; transition: width .2s ease, padding .2s ease;
}
/* Collapsed is a width and an alignment, not a second sidebar: the same markup, so
   nothing can be present in one state and missing in the other. The labels are hidden
   with `display:none` rather than clipped, so a screen reader reads the aria-label
   once instead of reading both. */
.shell.shut aside.side { width: var(--side-shut); padding: 12px 14px; }
.shell.shut .side .label-text, .shell.shut .side .brand-text, .shell.shut .side .foot-user .mail,
.shell.shut .side .foot-user .role { display: none; }
.shell.shut .side .item, .shell.shut .side .brand { justify-content: center; padding-left: 0; padding-right: 0; }
.shell.shut .side .foot-user { text-align: center; }

.side .brand { display: flex; align-items: center; gap: 12px; height: 40px; padding: 0 6px; }
.side .brand .mark { width: 32px; height: 32px; margin: 0; border-radius: 10px; flex: none; }
.side .brand-text { display: flex; align-items: center; line-height: 1.2; white-space: nowrap; }
.side .brand-text b { font-size: 16px; font-weight: 600; letter-spacing: -.01em; }
.side nav { display: flex; flex-direction: column; gap: 4px; margin-top: 24px; }

 /* Links and the sign-out button share one shape: in the design the log-out sits in
    the same column as the nav items and looks like one. */
.side .item {
  display: flex; align-items: center; gap: 12px; height: 44px; flex: none; padding: 0 12px;
  border: 0; width: 100%; background: none; text-align: left; cursor: pointer;
  border-radius: var(--r-sm); color: var(--muted); text-decoration: none;
  font: 500 14px inherit; white-space: nowrap;
}
.side .item:hover { background: var(--hover); color: var(--ink); }
.side .item[aria-current="page"] { background: var(--hover); color: var(--ink); }
.side svg { flex: none; }

.side .spacer { flex: 1; }
.side .foot-user { padding: 10px 0 4px; border-top: 1px solid var(--line); }
.side .foot-user .mail {
  font-size: 13px; font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
}
.side .foot-user .role { font-size: 12px; color: var(--faint); }

.main { flex: 1 1 0; min-width: 0; display: flex; flex-direction: column; }
.topbar {
  display: flex; align-items: center; justify-content: space-between; gap: 16px;
  height: 64px; flex: none; padding: 0 24px; background: #fff;
  border-bottom: 1px solid var(--line); position: sticky; top: 0; z-index: 2;
}
.topbar .burger {
  width: 44px; height: 44px; flex: none; display: flex; align-items: center; justify-content: center;
  border: 0; border-radius: var(--r-sm); background: none; color: var(--muted); cursor: pointer;
}
.topbar .burger:hover { background: var(--hover); color: var(--ink); }
.topbar .me { display: flex; align-items: center; gap: 12px; min-width: 0; }
.topbar .me .mail { font-size: 14px; color: var(--muted); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.avatar {
  width: 36px; height: 36px; flex: none; border-radius: 50%; background: var(--ink); color: #fff;
  font-size: 13px; font-weight: 600; display: flex; align-items: center; justify-content: center;
}
.avatar.grey { background: var(--hover); color: #3F3F46; }

.page { flex: 1; width: 100%; max-width: 1120px; margin: 0 auto; padding: 40px 24px 56px; }
/* Centred is the login card's shape, not a page's. One rule for every heading inside
   the shell, because the vault view's h1 sits two divs deep and a `>` selector missed
   it -- which is exactly the kind of thing that only shows up in a screenshot. */
.page h1 { font-size: 24px; font-weight: 600; letter-spacing: -.02em; text-align: left; margin: 0 0 6px; }
.page .sub { text-align: left; margin: 0 0 28px; }
/* A heading with a control on its right: the page title and its one action. */
.viewhead { display: flex; flex-wrap: wrap; align-items: flex-end; justify-content: space-between; gap: 16px; margin-bottom: 28px; }
.viewhead h1 { margin: 0 0 6px; }
.viewhead .sub { margin: 0; }

/* On a phone the sidebar is a drawer, not a column: it overlays the page instead of
   taking a share of a width there is none of. .main reserves nothing for it -- the
   earlier version reserved the collapsed width and pushed the content off the right
   edge, which no amount of reading the CSS showed and one screenshot did. */
@media (max-width: 720px) {
  aside.side { position: fixed; z-index: 3; width: var(--side); box-shadow: 0 8px 32px rgba(24,24,27,.12); }
  .shell.shut aside.side { width: 0; padding: 12px 0; border-right: 0; box-shadow: none; }
  .shell.shut .side .item, .shell.shut .side .brand, .shell.shut .side .foot-user { visibility: hidden; }
  .main { margin-left: 0; }
  .topbar { padding: 0 12px; }
  .page { padding: 24px 16px 40px; }
  .topbar .me .mail { display: none; }
}

/* A number worth reading at a glance: the vault's size and what is in it. */
.stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 16px; }
.stat {
  background: var(--card); border: 1px solid var(--line); border-radius: var(--r); padding: 20px;
  box-shadow: 0 1px 2px rgba(24,24,27,.04);
}
.stat .k { font-size: 13px; font-weight: 500; color: var(--muted); }
.stat .n { font-size: 30px; font-weight: 600; letter-spacing: -.02em; line-height: 1; margin: 10px 0; }
.stat .hint { font-size: 13px; color: var(--muted); }

.mono { font: 13px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }

.card + .card, .stats + .card, .card + .stats { margin-top: 16px; }
.card h2 { margin: 0; font-size: 16px; font-weight: 600; }
.card h2 + .sub { margin: 4px 0 20px; text-align: left; font-size: 13px; }
/* A card that is nothing but a list of rows: the heading carries the padding instead. */
.card.flush { padding: 0; overflow: hidden; }
.card.flush > h2 { padding: 20px 24px; }
.card.flush > h2 + .sub { padding: 0 24px; margin: -8px 0 20px; }

/* A share-of-the-whole bar: the design's "detections by type", on real counts. */
.bars { display: grid; gap: 18px; }
.bar .top { display: flex; justify-content: space-between; font-size: 14px; margin-bottom: 8px; }
.bar .top b { font-weight: 500; }
.bar .top span { color: var(--muted); }
.bar .track { height: 8px; border-radius: 999px; background: var(--hover); }
.bar .fill { height: 100%; border-radius: 999px; background: var(--ink); }

/* A list of rows: one layout for rules, people and downloads. */
.rows { display: grid; }
.row { display: flex; align-items: center; gap: 16px; padding: 16px 0; border-top: 1px solid var(--line); }
.card.flush .row { padding: 16px 24px; }
.row:first-child { border-top: 0; }
.row .grow { flex: 1; min-width: 0; }
.row .title { font-weight: 500; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.row .meta { font-size: 13px; color: var(--muted); margin-top: 2px; }
.empty { padding: 24px; text-align: center; color: var(--muted); font-size: 14px; }

.tag {
  flex: none; padding: 4px 10px; border-radius: 999px; font-size: 12px; font-weight: 500;
  background: var(--hover); color: #3F3F46; white-space: nowrap;
}
.tag[data-tone="admin"] { background: #DCFCE7; color: var(--ok); }
.tag[data-tone="off"]   { background: #FEF3C7; color: #92400E; }

/* Small inline buttons on a row, and the download link, share one shape. */
.act {
  flex: none; height: 38px; padding: 0 14px; display: inline-flex; align-items: center; gap: 7px;
  border: 1px solid var(--field); border-radius: var(--r-sm); background: #fff;
  color: var(--ink); font: 500 13px inherit; cursor: pointer; text-decoration: none;
}
.act:hover { background: var(--hover); }
.act:disabled { opacity: .5; cursor: default; }
.act[data-tone="bad"] { color: var(--bad); }
.act[data-tone="solid"] { height: 44px; padding: 0 18px; border: 0; background: var(--ink); color: #fff; font-size: 14px; }
.act[data-tone="solid"]:hover { background: #27272A; }

.inline { display: flex; gap: 12px; align-items: flex-end; flex-wrap: wrap; }
.inline .field { flex: 1 1 220px; margin: 0; }
.inline .act { height: 46px; }
.check { display: flex; align-items: center; gap: 8px; font-size: 14px; height: 46px; }
.check input { width: auto; height: auto; }

/* The vault inventory: columns, so it is a table. */
.scroll { overflow-x: auto; }
table { width: 100%; min-width: 620px; border-collapse: collapse; font-size: 14px; }
th {
  text-align: left; font-size: 13px; font-weight: 500; color: var(--muted);
  padding: 12px 24px; border-bottom: 1px solid var(--line); white-space: nowrap;
}
td { padding: 14px 24px; border-top: 1px solid var(--line); vertical-align: middle; }
tbody tr:first-child td { border-top: 0; }
tbody tr:hover { background: var(--bg); }
.right { text-align: right; white-space: nowrap; }
.acts { display: inline-flex; gap: 8px; flex: none; }
/* The revealed value. Pre-wrap, because a secret may be long and must not be re-flowed
   into something that is not what it is. */
.value {
  margin: 8px 0 0; padding: 10px 12px; max-width: 520px; white-space: pre-wrap; word-break: break-all;
  background: var(--bg); border: 1px solid var(--line); border-radius: var(--r-sm); color: var(--ink);
}
.filter { padding: 16px 24px; border-bottom: 1px solid var(--line); }
.filter input { max-width: 320px; height: 40px; }

/* The pager sits under the table, inside the same card. */
.pager {
  display: flex; align-items: center; gap: 12px; flex-wrap: wrap;
  padding: 14px 24px; border-top: 1px solid var(--line);
}
.pager select { width: auto; height: 38px; padding: 0 10px; font-size: 13px; }
.pager .grow { flex: 1; }

/* The file unmasker's drop target. A label wrapping a hidden <input type=file>, so it
   is a real control: Tab reaches it and Space opens the picker, with no keydown
   handlers of our own. */
.drop {
  display: flex; flex-direction: column; align-items: center; gap: 10px;
  padding: 40px 20px; text-align: center; cursor: pointer; color: var(--muted);
  border: 1.5px dashed var(--field); border-radius: 12px; background: var(--bg);
  transition: border-color .15s, background .15s;
}
.drop:hover, .drop[data-over="true"] { border-color: var(--accent); background: #fff; }
.drop b { color: var(--ink); font-weight: 500; font-size: 14px; }
.drop small { font-size: 13px; }
.drop input[type="file"] { position: absolute; width: 1px; height: 1px; opacity: 0; }
.drop:focus-within { outline: 2px solid var(--accent); outline-offset: 2px; }

pre.cmd {
  margin: 10px 0 0; padding: 12px 14px; overflow-x: auto;
  background: var(--bg); border: 1px solid var(--line); border-radius: var(--r-sm);
  font: 13px/1.6 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
}

/* The identity block at the foot of the sidebar is the way into your own account.
   Profile is not a menu item: it is not a section of the product, it is the account
   you are signed in as, and that already has a place on screen. */
.side .who-link {
  display: flex; align-items: center; gap: 10px; min-width: 0;
  padding: 8px 10px; margin-bottom: 6px; border-radius: var(--r-sm);
  color: var(--ink); text-decoration: none;
}
.side .who-link:hover { background: var(--hover); }
.side .who-link[aria-current="page"] { background: var(--hover); }
.side .who-link .avatar { width: 30px; height: 30px; font-size: 12px; }
.side .who-link .label-text { display: flex; flex-direction: column; min-width: 0; }
.shell.shut .side .who-link { justify-content: center; padding-left: 0; padding-right: 0; }

/* A count on a sidebar item. Only the password queue has one, and only because nothing
   else announces a request: no mail is sent, so an unread marker is the notification.
   margin-left:auto pushes it to the right edge while the sidebar is open; when it is
   collapsed the label is display:none and this sits beside the icon instead. */
.side .item .count {
  flex: none; margin-left: auto; min-width: 20px; padding: 0 6px; border-radius: 999px;
  background: var(--accent); color: #fff; font-size: 11.5px; font-weight: 600;
  line-height: 19px; text-align: center;
}
.shell.shut .side .item .count { margin-left: 0; }

/* A banner at the top of a view, for a state the reader has to act on before anything
   else works -- currently just "you are on a temporary password". Louder than .sub and
   quieter than an error, because nothing has gone wrong. */
.notice {
  display: flex; gap: 12px; align-items: flex-start; margin: 0 0 28px; padding: 16px 18px;
  border: 1px solid #FDE68A; border-radius: var(--r); background: #FFFBEB; color: #78350F;
  font-size: 14px; line-height: 1.5;
}
.notice b { display: block; margin-bottom: 2px; color: #78350F; }

/* The one-shot temporary password, shown to the administrator who just minted it. Same
   shape as a revealed vault value: it is the same kind of thing. */
.once { display: flex; gap: 12px; align-items: center; flex-wrap: wrap; margin-top: 12px; }
.once .value { margin: 0; flex: 1 1 260px; font: 14px ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }