/* === Reset & base === */
*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

:root {
    --bg:        #f7fbf9;
    --bg-card:   #ffffff;
    --bg-hover:  #f0f4f3;
    --border:    #e0e0e0;
    --text:      #1a1a1a;
    --text-dim:  #555;
    --accent:    #1a5f4a;
    --green:     #1a5f4a;
    --amber:     #b45309;
    --red:       #dc2626;
    --radius:    10px;
    --font:      'DM Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
    --font-space: 'Orbitron', 'DM Sans', sans-serif;
    --logo-mark:  #0d1f2a;
    --logo-dish:  #1a4d6b;
}

html { font-size: 16px; }

body {
    font-family: var(--font);
    background: var(--bg);
    color: var(--text);
    line-height: 1.55;
    min-height: 100vh;
}

code {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.82em;
    background: rgba(0,0,0,0.05);
    padding: 0.15em 0.4em;
    border-radius: 4px;
    word-break: break-all;
}

a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }

/* === Layout === */
.app {
    max-width: 900px;
    margin: 0 auto;
    padding: 2rem 1.25rem 3rem;
}

.app-wide {
    max-width: 900px;
}

.app-header {
    margin-bottom: 2rem;
    position: relative;
    z-index: 2;
}

.app-header-row {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: 0.75rem 1.25rem;
}

.logo {
    display: flex;
    align-items: center;
    flex: 0 0 auto;
    max-width: 100%;
    width: max-content;
    box-sizing: border-box;
    overflow: visible;
    background: transparent;
    text-decoration: none;
    color: inherit;
}

.logo-brand {
    display: flex;
    align-items: center;
    gap: 0.6rem;
}

.logo-icon {
    height: 2.65rem;
    width: 2.65rem;
    flex-shrink: 0;
    display: block;
    color: var(--logo-dish);
}
img.logo-icon {
    object-fit: contain;
    object-position: left center;
}
svg.logo-icon {
    overflow: visible;
}

.logo-text {
    font-family: var(--font-space);
    font-weight: 600;
    font-size: 1.2rem;
    letter-spacing: 0.1em;
    text-transform: uppercase;
    color: var(--logo-mark);
    line-height: 1;
}

.app-header-text {
    flex: 1 1 12rem;
    min-width: 0;
    text-align: center;
}

.app-header h1 {
    font-size: 1.6rem;
    font-weight: 700;
    letter-spacing: -0.02em;
    color: var(--text);
    margin: 0;
}

.tagline {
    color: var(--text-dim);
    font-size: 0.95rem;
    margin-top: 0.2rem;
}

.app-footer {
    text-align: center;
    margin-top: 2.5rem;
    color: var(--text-dim);
    font-size: 0.82rem;
}

/* === Cards === */
.card {
    background: var(--bg-card);
    border: 1px solid var(--border);
    border-radius: var(--radius);
    padding: 1.5rem;
    margin-bottom: 1rem;
}

.card-error {
    border-color: var(--red);
    color: var(--red);
}

.hidden { display: none !important; }

/* === Drop zone === */
.drop-zone {
    border: 2px dashed var(--border);
    border-radius: var(--radius);
    padding: 3rem 1.5rem;
    text-align: center;
    cursor: pointer;
    transition: border-color 0.2s, background 0.2s;
}

.drop-zone:hover,
.drop-zone.drag-over {
    border-color: var(--accent);
    background: rgba(26, 95, 74, 0.04);
}

.drop-icon {
    width: 40px;
    height: 40px;
    color: var(--text-dim);
    margin-bottom: 0.75rem;
}

.drop-text {
    font-size: 1rem;
    font-weight: 500;
}

.drop-sub {
    font-size: 0.85rem;
    color: var(--text-dim);
    margin-top: 0.25rem;
}

.drop-formats {
    font-size: 0.75rem;
    color: var(--text-dim);
    margin: 0;
    line-height: 1.6;
    opacity: 0.7;
}
.drop-formats:first-of-type {
    margin-top: 0.75rem;
}

/* Sharing-agreement notice rendered under the upload control. Sized
   smaller than the format-hint copy so the disclaimer recedes
   visually but stays legible; centred to match the rest of the
   upload-card chrome. */
.upload-sharing-notice {
    margin: 0.75rem 0 0 0;
    font-size: 0.68rem;
    line-height: 1.4;
    color: var(--text-dim);
    text-align: center;
}

/* === File info bar === */
.file-info {
    display: flex;
    align-items: center;
    gap: 0.75rem;
    margin-top: 1rem;
    padding: 0.75rem 1rem;
    background: var(--bg-hover);
    border-radius: var(--radius);
    flex-wrap: wrap;
}

.file-info-name {
    font-weight: 500;
    flex: 1;
    min-width: 0;
    overflow: hidden;
    text-overflow: ellipsis;
    white-space: nowrap;
}

.file-info-size {
    color: var(--text-dim);
    font-size: 0.85rem;
    white-space: nowrap;
}

/* === Buttons === */
.btn {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    padding: 0.55rem 1.25rem;
    font-size: 0.9rem;
    font-weight: 500;
    border-radius: 6px;
    border: none;
    cursor: pointer;
    transition: background 0.15s, opacity 0.15s;
    font-family: inherit;
}

.btn-primary {
    background: var(--accent);
    color: #ffffff;
}

.btn-primary:hover { opacity: 0.85; }

.btn-mt-lg { margin-top: 1.5rem; }

.btn-ghost {
    background: transparent;
    color: var(--text-dim);
    border: 1px solid var(--border);
}

.btn-ghost:hover {
    background: var(--bg-hover);
    color: var(--text);
}

/* === Progress === */
.progress-bar {
    height: 4px;
    background: var(--border);
    border-radius: 2px;
    overflow: hidden;
    margin-bottom: 0.75rem;
}

.progress-bar-fill {
    width: 0%;
    height: 100%;
    background: var(--accent);
    border-radius: 2px;
    animation: progress-indeterminate 1.5s ease-in-out infinite;
}

@keyframes progress-indeterminate {
    0%   { width: 0%;   margin-left: 0; }
    50%  { width: 60%;  margin-left: 20%; }
    100% { width: 0%;   margin-left: 100%; }
}

.progress-text {
    text-align: center;
    color: var(--text-dim);
    font-size: 0.9rem;
}

/* === Results === */
.results-header {
    display: flex;
    align-items: flex-start;
    gap: 1rem;
    flex-wrap: wrap;
}

.verdict-badge {
    padding: 0.35rem 0.9rem;
    border-radius: 20px;
    font-weight: 600;
    font-size: 0.85rem;
    text-transform: uppercase;
    letter-spacing: 0.04em;
    white-space: nowrap;
}

.verdict-clean      { background: rgba(26,95,74,0.1);  color: var(--green); }
.verdict-suspicious { background: rgba(180,83,9,0.1);   color: var(--amber); }
.verdict-malicious  { background: rgba(220,38,38,0.1);  color: var(--red); }
.verdict-error      { background: rgba(220,38,38,0.1);  color: var(--red); }

.results-meta {
    flex: 1;
    min-width: 0;
}

.results-meta h2 {
    font-size: 1.1rem;
    font-weight: 600;
    word-break: break-all;
}

.meta-row {
    display: flex;
    gap: 1rem;
    color: var(--text-dim);
    font-size: 0.85rem;
    margin-top: 0.2rem;
    flex-wrap: wrap;
}

.meta-row.hashes {
    flex-direction: column;
    gap: 0.15rem;
    margin-top: 0.5rem;
}

.risk-score {
    display: flex;
    flex-direction: column;
    align-items: center;
    min-width: 64px;
}

.risk-number {
    font-size: 2rem;
    font-weight: 700;
    line-height: 1;
}

.risk-label {
    font-size: 0.7rem;
    color: var(--text-dim);
    text-transform: uppercase;
    letter-spacing: 0.05em;
    margin-top: 0.15rem;
}

/* "Result looks wrong" flag, top right of the results header. Renders as
   an icon-only button: gray when unflagged, red once anyone has reported
   the scan. Clicking submits a flag; admins clear flags from /admin/flagged. */
.flag-inaccurate {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    width: 32px;
    height: 32px;
    padding: 0;
    background: transparent;
    color: #9aa0a6;
    border: none;
    border-radius: 6px;
    cursor: pointer;
    align-self: flex-start;
}

.flag-inaccurate:hover:not(:disabled):not(.is-flagged) {
    color: #6b7280;
    background: rgba(0, 0, 0, 0.05);
}

.flag-inaccurate.is-flagged {
    color: var(--red);
    cursor: default;
}

.flag-inaccurate.is-flagged:hover {
    background: transparent;
}

.flag-inaccurate .flag-icon {
    width: 18px;
    height: 18px;
    display: block;
}

.flag-inaccurate:disabled {
    opacity: 0.6;
    cursor: progress;
}

/* === Heuristics === */
#heuristics-section {
    margin-top: 1.5rem;
}

#heuristics-section h3 {
    font-size: 1rem;
    font-weight: 600;
    margin-bottom: 0.75rem;
    display: flex;
    align-items: center;
    gap: 0.5rem;
}

.badge {
    font-size: 0.75rem;
    font-weight: 500;
    background: var(--bg-hover);
    padding: 0.15rem 0.5rem;
    border-radius: 10px;
    color: var(--text-dim);
}

.heuristics-list {
    list-style: none;
    display: flex;
    flex-direction: column;
    gap: 0.5rem;
}

/* === Machine Learning section === */
#ml-section {
    margin-top: 1.5rem;
}
#ml-section h3 {
    font-size: 1rem;
    font-weight: 600;
    margin-bottom: 0.75rem;
    display: flex;
    align-items: center;
    gap: 0.5rem;
}
.ml-list {
    list-style: none;
    display: flex;
    flex-direction: column;
    gap: 0.5rem;
    padding: 0;
}
.ml-item {
    display: flex;
    align-items: center;
    flex-wrap: wrap;
    gap: 0.6rem;
    padding: 0.65rem 0.9rem;
    border: 1px solid #e3e6e5;
    border-radius: 6px;
    background: #fafbfb;
}
.ml-brand {
    display: inline-block;
    padding: 0.18rem 0.6rem;
    background: var(--logo-dish);
    color: #fff;
    font-weight: 700;
    font-size: 0.75rem;
    letter-spacing: 0.06em;
    text-transform: uppercase;
    border-radius: 6px;
    font-family: var(--font-space);
}
.ml-name {
    color: var(--text);
}
.ml-verdict-tag {
    display: inline-block;
    margin-left: auto;
    padding: 0.18rem 0.65rem;
    font-size: 0.72rem;
    font-weight: 700;
    letter-spacing: 0.06em;
    text-transform: uppercase;
    border-radius: 6px;
    color: #fff;
}
.ml-verdict-tag-malicious { background: var(--red); }
.ml-verdict-tag-benign    { background: var(--green); }
.ml-verdict-tag-error     { background: var(--text-dim); }
.ml-score-chip {
    padding: 0.18rem 0.55rem;
    background: #eef0ef;
    border-radius: 6px;
    font-size: 0.78rem;
    color: var(--text-dim);
    font-variant-numeric: tabular-nums;
}
.ml-score-chip strong {
    color: var(--text);
    font-weight: 600;
    margin-left: 0.25rem;
}
.ml-note {
    font-size: 0.72rem;
    color: var(--text-dim);
    font-style: italic;
}
.ml-error {
    width: 100%;
    color: var(--red);
    font-size: 0.85rem;
    margin-top: 0.25rem;
}

/* === Score composition bar === */
.score-breakdown { margin: 1.5rem 0; }
.score-breakdown h3 { margin-bottom: 0.6rem; }

.score-bar-frame {
    position: relative;
    height: 30px;
    border-radius: 6px;
    background: #eef0ef;
    overflow: visible;
    margin-bottom: 2rem;
}
.score-bands {
    position: absolute; top: 0; bottom: 0; left: 0; right: 0;
    border-radius: 6px;
    overflow: hidden;
}
.score-band {
    position: absolute; top: 0; bottom: 0;
    opacity: 0.22;
    pointer-events: none;
}
.band-clean     { background: #1a5f4a; }
.band-low       { background: #eab308; }
.band-high      { background: #ea580c; }
.band-malicious { background: #dc2626; }

.score-segments {
    position: absolute; top: 0; bottom: 0; left: 0; right: 0;
    display: flex;
    border-radius: 6px;
    overflow: hidden;
}
.score-segment {
    height: 100%;
    display: flex; align-items: center;
    padding: 0 6px;
    font-size: 10.5px; font-weight: 600;
    color: #fff;
    white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
    border-right: 1px solid rgba(255,255,255,0.35);
    cursor: help;
}
.score-segment:last-child { border-right: none; }
.score-segment.sev-critical { background: #dc2626; }
.score-segment.sev-high     { background: #ea580c; }
.score-segment.sev-medium   { background: #eab308; color: #222; }
.score-segment.sev-low      { background: #22c55e; color: #0d2818; }
.score-segment.sev-info     { background: #9ca3af; color: #222; }

.score-tooltip {
    position: absolute;
    bottom: calc(100% + 8px);
    transform: translateX(-50%);
    padding: 0.3rem 0.55rem;
    background: #1a1a1a;
    color: #fff;
    border-radius: 4px;
    font-size: 0.75rem;
    line-height: 1.2;
    white-space: nowrap;
    pointer-events: none;
    opacity: 0;
    transition: opacity 90ms ease-out;
    z-index: 20;
    box-shadow: 0 2px 6px rgba(0,0,0,0.18);
}
.score-tooltip.visible { opacity: 1; }

/* Cursor-following immediate tooltip (ATT&CK chips, and any attachHoverTip
   target). Same look as the score-bar tooltip but position:fixed so it works
   outside a positioned frame. */
.hover-tooltip {
    position: fixed;
    transform: translate(-50%, -100%);
    padding: 0.3rem 0.55rem;
    background: #1a1a1a;
    color: #fff;
    border-radius: 4px;
    font-size: 0.75rem;
    line-height: 1.2;
    white-space: nowrap;
    pointer-events: none;
    opacity: 0;
    transition: opacity 90ms ease-out;
    z-index: 1000;
    box-shadow: 0 2px 6px rgba(0,0,0,0.18);
}
.hover-tooltip.visible { opacity: 1; }
.score-tooltip::after {
    content: "";
    position: absolute;
    top: 100%; left: 50%;
    transform: translateX(-50%);
    border: 5px solid transparent;
    border-top-color: #1a1a1a;
}

.score-marker {
    position: absolute; top: -5px; bottom: -5px;
    width: 3px; background: #111;
    transform: translateX(-1.5px);
    box-shadow: 0 0 0 1.5px #fff;
    pointer-events: none;
}
.score-marker::after {
    content: attr(data-score);
    position: absolute; bottom: calc(100% + 2px); left: 50%;
    transform: translateX(-50%);
    font-size: 11px; font-weight: 700;
    color: #111;
    background: #fff;
    padding: 1px 6px;
    border-radius: 3px;
    border: 1px solid #ccc;
    white-space: nowrap;
}
.score-thresholds {
    position: absolute; top: 0; bottom: 0; left: 0; right: 0;
    pointer-events: none;
}
.score-threshold {
    position: absolute; top: 100%; bottom: auto;
    height: 6px;
    border-left: 1px dashed #9ca3af;
}
.score-threshold span {
    position: absolute; top: 6px; left: -10px;
    font-size: 10px; color: var(--text-dim);
}

/* === Heuristic items === */
.heuristic-item {
    padding: 0.75rem 1rem;
    background: var(--bg);
    border-radius: 8px;
    border-left: 3px solid var(--border);
}

.heuristic-item.sev-info     { border-left-color: var(--text-dim); }
.heuristic-item.sev-low      { border-left-color: var(--accent); }
.heuristic-item.sev-medium   { border-left-color: var(--amber); }
.heuristic-item.sev-high     { border-left-color: #c2410c; }
.heuristic-item.sev-critical { border-left-color: var(--red); }

/* CVE or CVE-related findings: faint red wash to draw the analyst's eye
   before they read severity, since attribution to a known CVE family
   changes the triage flow. Applied via JS when rule_id starts with CVE_
   or cve_confidence is set. */
.heuristic-item.heuristic-item-cve { background: rgba(220, 38, 38, 0.08); }

.heuristic-head {
    display: flex;
    align-items: center;
    gap: 0.5rem;
    flex-wrap: wrap;
}

.heuristic-name {
    font-weight: 600;
    font-size: 0.9rem;
}

.sev-tag {
    font-size: 0.7rem;
    font-weight: 600;
    text-transform: uppercase;
    padding: 0.1rem 0.45rem;
    border-radius: 4px;
    letter-spacing: 0.03em;
}

.sev-tag-info     { background: rgba(85,85,85,0.1);    color: var(--text-dim); }
.sev-tag-low      { background: rgba(26,95,74,0.1);     color: var(--accent); }
.sev-tag-medium   { background: rgba(180,83,9,0.1);     color: var(--amber); }
.sev-tag-high     { background: rgba(234,88,12,0.12);   color: #c2410c; }
.sev-tag-critical { background: rgba(220,38,38,0.1);    color: var(--red); }

.cve-confidence {
    font-size: 0.68rem;
    font-weight: 700;
    text-transform: uppercase;
    letter-spacing: 0.03em;
    padding: 0.1rem 0.45rem;
    border-radius: 999px;
    border: 1px solid currentColor;
}

.cve-confidence-exact { color: var(--red); background: rgba(220,38,38,0.06); }
.cve-confidence-likely { color: #c2410c; background: rgba(234,88,12,0.08); }
.cve-confidence-related { color: var(--amber); background: rgba(180,83,9,0.08); }

.heuristic-rule {
    font-size: 0.75rem;
    color: var(--text-dim);
    font-family: 'SF Mono', 'Fira Code', monospace;
}

.heuristic-desc {
    margin-top: 0.3rem;
    font-size: 0.85rem;
    color: var(--text-dim);
}

.heuristic-detail {
    margin-top: 0.2rem;
    font-size: 0.8rem;
    color: var(--text-dim);
    opacity: 0.7;
    overflow-wrap: break-word;
    word-break: break-all;
}

/* === URL scan per-page report === */
.url-scan-domain {
    font-weight: 700;
    color: var(--text);
    margin-top: 0.6rem;
    margin-bottom: 0.25rem;
    font-size: 0.85rem;
}
.url-scan-domain:first-child { margin-top: 0; }
.url-scan-check {
    padding: 0.1rem 0;
    line-height: 1.5;
    overflow-wrap: break-word;
    word-break: break-all;
}
.url-scan-check strong {
    color: var(--text-dim);
}
.url-scan-alert {
    color: var(--red, #ef4444);
    opacity: 1;
}
.url-scan-alert strong {
    color: var(--red, #ef4444);
}

/* === Per-heuristic URLs === */
.heuristic-urls {
    margin-top: 0.45rem;
    padding: 0.5rem 0.65rem;
    background: var(--bg-card);
    border: 1px solid var(--border);
    border-radius: 6px;
}

.heuristic-url-first {
    display: flex;
    align-items: baseline;
    gap: 0.5rem;
    min-width: 0;
    font-size: 0.8rem;
}

.heuristic-url-label {
    flex: 0 0 auto;
    font-size: 0.68rem;
    font-weight: 700;
    color: var(--text-dim);
    text-transform: uppercase;
    letter-spacing: 0.03em;
}

/* Per-URL provenance tag — shown after the URL on EMBEDDED_URL findings
   so the analyst knows whether the URL was reached via a macro, link
   annotation, document text, etc.  Quiet visual treatment (chip with
   dimmed text) so it doesn't distract from the URL itself. */
.heuristic-url-source {
    flex: 0 0 auto;
    font-size: 0.68rem;
    font-weight: 500;
    color: var(--text-dim);
    background: rgba(0, 0, 0, 0.04);
    border: 1px solid var(--border);
    padding: 0.05rem 0.4rem;
    border-radius: 999px;
    white-space: nowrap;
    margin-left: 0.3rem;
}
@media (prefers-color-scheme: dark) {
    .heuristic-url-source { background: rgba(255, 255, 255, 0.05); }
}
.heuristic-url-list .heuristic-url-source { margin-left: 0.4rem; }

.heuristic-urls a,
.heuristic-urls span {
    overflow-wrap: anywhere;
    word-break: break-word;
}

.heuristic-urls a {
    color: var(--accent);
    text-decoration: none;
}

.heuristic-urls a:hover {
    text-decoration: underline;
}

.btn-heuristic-url-toggle {
    margin-top: 0.4rem;
}

/* Toggle buttons sit in a row above the URL block so analysts see the
   "Show N more" / "Show N assumed-good" affordances before any URLs.
   The button → list link is the data-target attribute on the button,
   not DOM nesting, so the lists below render in source order while
   the buttons stay grouped at the top. */
.heuristic-url-toggles {
    display: flex;
    flex-wrap: wrap;
    gap: 0.4rem;
    margin-bottom: 0.4rem;
}
.heuristic-url-toggles .btn-heuristic-url-toggle {
    margin-top: 0;
}

.heuristic-url-list {
    list-style: none;
    margin: 0.45rem 0 0;
    padding: 0;
    display: grid;
    gap: 0.3rem;
    font-size: 0.8rem;
}

.heuristic-url-list li {
    padding-top: 0.3rem;
    border-top: 1px solid var(--border);
}

/* === Hex context toggle === */
.hex-toggle {
    margin-top: 0.35rem;
}

.btn-hex-toggle {
    margin-bottom: 0.25rem;
}

.hex-dump {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.78rem;
    line-height: 1.6;
    color: var(--text);
    background: rgba(0,0,0,0.04);
    border: 1px solid var(--border);
    border-radius: 6px;
    padding: 0.5rem 0.75rem;
    margin: 0;
    white-space: pre-wrap;
    word-break: break-all;
    overflow-x: auto;
}

/* === ClamAV section === */
.clamav-section {
    margin-top: 1.25rem;
    padding: 0.75rem 1rem;
    background: var(--bg-hover);
    border-radius: 8px;
}

.clamav-section h3 {
    font-size: 0.9rem;
    font-weight: 600;
    margin-bottom: 0.3rem;
}

.clamav-section p {
    font-size: 0.85rem;
    color: var(--text-dim);
}

.clamav-clean { color: var(--green); }
.clamav-detected { color: var(--red); font-weight: 600; }
.clamav-unavailable { color: var(--text-dim); font-style: italic; }

/* === Heuristic explanation === */
.heuristic-explanation {
    margin-top: 0.35rem;
    font-size: 0.82rem;
    color: var(--text);
    line-height: 1.5;
    padding: 0.5rem 0.75rem;
    background: var(--bg-card);
    border-radius: 6px;
    border: 1px solid var(--border);
}

.btn-small {
    padding: 0.2rem 0.6rem;
    font-size: 0.75rem;
}

.heuristic-url-text.url-rep-green {
    color: var(--green);
}

.heuristic-url-text.url-rep-unknown {
    color: var(--text);
}

/* Admin audit-log viewer. Plain table with subtle styling — column
   widths grow with content and a small filter form sits above. */
.admin-audit-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.85rem;
}
.admin-audit-table th, .admin-audit-table td {
    border-bottom: 1px solid var(--border, rgba(0,0,0,0.1));
    padding: 0.35rem 0.5rem;
    vertical-align: top;
}
.admin-audit-table .audit-ts { white-space: nowrap; }
.admin-audit-table .audit-details {
    font-size: 0.78rem;
    color: var(--text-muted, #555);
}
.audit-detail-kv {
    display: inline-block;
    margin-right: 0.75rem;
}
.audit-filters {
    display: flex;
    align-items: end;
    gap: 0.6rem;
    flex-wrap: wrap;
}
.audit-filters label {
    display: flex;
    flex-direction: column;
    gap: 0.2rem;
    font-size: 0.8rem;
}

/* Analyst-applied actor tags on the sample report. Tags appear as
   chips between the verdict header and the heuristics list; auth users
   get an inline form to add new ones. */
.sample-tags-section {
    padding: 0.6rem 0.9rem;
    margin: 0.6rem 0;
    background: var(--card-bg, transparent);
    border: 1px solid var(--border, rgba(0,0,0,0.12));
    border-radius: 6px;
}
.sample-tags-row {
    display: flex;
    align-items: center;
    flex-wrap: wrap;
    gap: 0.4rem;
}
.sample-tags-label {
    font-weight: 600;
    font-size: 0.85rem;
    opacity: 0.75;
    margin-right: 0.3rem;
}
.sample-tags-list {
    display: flex;
    flex-wrap: wrap;
    gap: 0.5rem 0.75rem;
}
.sample-tag-wrap {
    display: inline-flex;
    flex-direction: column;
    align-items: flex-start;
    gap: 0.2rem;
}
.sample-tag-links {
    list-style: none;
    padding: 0;
    margin: 0;
    font-size: 0.78rem;
    opacity: 0.8;
    max-width: 32rem;
}
.sample-tag-links li { margin: 0; }
.sample-tag-links a {
    word-break: break-all;
    color: inherit;
    text-decoration: underline dotted;
    text-underline-offset: 2px;
}
.sample-tag-links a:hover { text-decoration-style: solid; }
.sample-tag {
    display: inline-flex;
    align-items: center;
    gap: 0.25rem;
    padding: 0.18rem 0.55rem;
    background: rgba(120, 90, 200, 0.15);
    border: 1px solid rgba(120, 90, 200, 0.4);
    border-radius: 999px;
    font-size: 0.85rem;
}
.sample-tag-name {
    color: inherit;
    text-decoration: none;
}
.sample-tag-name:hover {
    text-decoration: underline;
}
.sample-tag-remove {
    background: transparent;
    border: none;
    cursor: pointer;
    padding: 0 0.15rem;
    font-size: 1rem;
    line-height: 1;
    color: inherit;
    opacity: 0.5;
}
.sample-tag-remove:hover { opacity: 1; }
.sample-tag-add-form {
    display: flex;
    align-items: center;
    flex-wrap: wrap;
    gap: 0.4rem;
    margin-top: 0.5rem;
}
.sample-tag-input { flex: 0 0 12rem; }
.sample-tag-links-input { flex: 1 1 18rem; min-width: 14rem; }
.sample-tag-status {
    font-size: 0.85rem;
    opacity: 0.7;
}

/* Compact summary block rendered server-side on /stats, /exploits,
   /creators so crawlers (and the first paint) see real corpus content
   alongside the interactive JS-driven charts. Visible to humans too —
   not hidden — but kept tight so it doesn't crowd the live view. */
.seo-summary dl.seo-summary-list { margin: 0; }
.seo-summary dl.seo-summary-list dt { font-weight: 600; margin-top: 0.7rem; }
.seo-summary dl.seo-summary-list dd { margin: 0.15rem 0 0 0; font-size: 0.92rem; }
.seo-summary dl.seo-summary-list dd a { word-break: break-all; }

/* Host / filename portions of a URL that drill into a partial-URL
   sample search when clicked. Subtle dotted underline + pointer cursor
   so an analyst sees the affordance without it overpowering the URL
   text the way a bare anchor would. Inherit the reputation colour from
   the surrounding .heuristic-url-text so green/unknown classification
   is preserved on the click target as well as the rest of the URL. */
.url-clickable {
    cursor: pointer;
    text-decoration: underline dotted;
    text-underline-offset: 2px;
}
.url-clickable:hover {
    text-decoration-style: solid;
}

/* === Ollama status indicator (admin page) === */
/* CSS-only circle so we don't depend on a font that includes ●. */
.ollama-status-light {
    display: inline-block;
    width: 12px;
    height: 12px;
    border-radius: 50%;
    margin-right: 0.5rem;
    vertical-align: middle;
    border: 1px solid rgba(0,0,0,0.2);
    box-shadow: inset 0 -1px 1px rgba(0,0,0,0.15);
}
.ollama-status-ok      {
    background: #2ecc71;
    box-shadow: 0 0 6px rgba(46, 204, 113, 0.8),
                inset 0 -1px 1px rgba(0,0,0,0.15);
}
.ollama-status-err     { background: #e74c3c; }
.ollama-status-unknown { background: #b0b4ba; }

#ollama-status-text { font-size: 0.9rem; }

/* Inline-style replacements (CSP style-src 'self' blocks style="..."). */
.ai-card-spaced { margin-top: 1rem; }
.ai-h2-with-action { display: flex; align-items: center; gap: 0.75rem; }
.ai-form-spaced { margin-top: 0.75rem; }
.ai-test-output {
    margin-top: 0.75rem;
    min-height: 4rem;
    max-height: 40rem;
    overflow: auto;
}
.ai-model-hint { margin-top: 0.25rem; display: block; }
.ai-url-row {
    display: flex;
    align-items: center;
    gap: 0.5rem;
    flex-wrap: wrap;
}
.ai-url-row input[type="url"] { flex: 1 1 16rem; }
.ai-url-test-result {
    margin-top: 0.4rem;
    font-size: 0.85rem;
    min-height: 1.2em;
}
.ai-url-test-result.ok  { color: #2ecc71; }
.ai-url-test-result.err { color: #e74c3c; }

/* Malware Insights settings form — three-column grid where wide
   fields (URL, model name, JSON, template id) span the row and the
   narrow toggles/numbers share a row. Collapses to one column on
   narrow viewports. Tuned for visual density: tight gaps, compact
   inputs, small labels. */
.ai-settings-form {
    display: grid;
    grid-template-columns: repeat(3, 1fr);
    gap: 0.35rem 0.8rem;
    align-items: end;
}
.ai-settings-form label {
    display: flex;
    flex-direction: column;
    gap: 0.15rem;
    font-size: 0.72rem;
    color: var(--text-dim);
    line-height: 1.2;
}
/* `el.hidden = true` sets the [hidden] attribute, which the UA
   stylesheet maps to display:none — but our `.ai-settings-form label`
   rule above has higher specificity than the UA rule, so without this
   explicit override the provider-toggle JS sets the attribute and
   nothing visually changes. */
.ai-settings-form label[hidden] { display: none; }
.ai-settings-form label small { font-size: 0.92em; opacity: 0.75; }
.ai-settings-form input,
.ai-settings-form select {
    padding: 0.32rem 0.55rem;
    border: 1px solid var(--border);
    border-radius: 5px;
    font-family: inherit;
    font-size: 0.82rem;
    width: 100%;
    box-sizing: border-box;
}
.ai-settings-form .ai-model-hint { font-size: 0.7rem; margin-top: 0.1rem; }
.ai-settings-form .ai-url-test-result { margin-top: 0.2rem; font-size: 0.75rem; }
.ai-field-full { grid-column: 1 / -1; }
.ai-settings-form .ai-settings-submit {
    grid-column: 1 / -1;
    justify-self: end;
    margin-top: 0.2rem;
    padding: 0.4rem 1rem;
    font-size: 0.85rem;
}
@media (max-width: 720px) {
    .ai-settings-form { grid-template-columns: 1fr; }
    .ai-field-full   { grid-column: 1; }
}

/* === AI Insights panel === */
.ai-insight-section {
    margin-top: 1.25rem;
    padding: 0.85rem 1rem;
    background: #eef4fb;
    border-radius: 8px;
    border: 1px solid #cdd9e6;
}
.ai-insight-section h3 {
    font-size: 1rem;
    font-weight: 600;
    margin: 0 0 0.5rem 0;
    display: flex;
    align-items: center;
    gap: 0.5rem;
}
.ai-insight-status {
    font-size: 0.85rem;
    color: var(--text-dim);
    margin-bottom: 0.6rem;
}
.ai-insight-attack {
    font-weight: 600;
    margin: 0 0 0.35rem 0;
    line-height: 1.35;
}
.ai-insight-meta {
    margin: 0 0 0.5rem 0;
    font-size: 0.9rem;
    color: var(--text-dim);
}
.ai-insight-family {
    font-weight: 500;
    color: var(--text);
}
.ai-insight-confidence {
    margin-left: 0.25rem;
}
.ai-insight-mitre-wrap {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: 0.4rem;
    margin-bottom: 0.6rem;
}
.ai-insight-mitre-label {
    font-size: 0.75rem;
    font-weight: 600;
    text-transform: uppercase;
    letter-spacing: 0.04em;
    color: var(--text-dim);
}
.ai-insight-mitre {
    display: flex;
    flex-wrap: wrap;
    gap: 0.3rem;
}
.ai-insight-mitre-chip {
    font-size: 0.75rem;
    font-family: 'SF Mono', 'Fira Code', monospace;
    padding: 0.15rem 0.5rem;
    background: var(--bg-secondary, #f0f0f0);
    border: 1px solid var(--border);
    border-radius: 12px;
    cursor: help;
}
.ai-insight-mitre-chip-name {
    font-family: inherit;
    color: var(--text-secondary, #666);
    font-weight: 500;
}
.ai-insight-iocs-wrap h4 {
    font-size: 0.85rem;
    font-weight: 600;
    margin: 0.5rem 0 0.25rem 0;
}
.ai-insight-iocs {
    list-style: none;
    padding: 0;
    margin: 0 0 0.6rem 0;
    font-family: 'SF Mono', 'Fira Code', monospace;
    font-size: 0.8rem;
    word-break: break-all;
}
.ai-insight-iocs li {
    padding: 0.15rem 0;
    color: var(--text);
}
.ai-insight-rationale {
    color: var(--text);
    margin-bottom: 0.5rem;
}
.ai-insight-rationale-text {
    margin: 0;
    line-height: 1.5;
    white-space: pre-wrap;
}
.ai-insight-admin-only summary {
    cursor: pointer;
    color: var(--text-dim);
    font-size: 0.8rem;
}
.ai-insight-pre {
    margin: 0.4rem 0 0 0;
    padding: 0.5rem;
    background: var(--pre-bg, var(--bg));
    border: 1px solid var(--border);
    border-radius: 6px;
    font-family: 'SF Mono', 'Fira Code', monospace;
    font-size: 0.75rem;
    line-height: 1.4;
    white-space: pre-wrap;
    word-break: break-word;
    max-height: 20rem;
    overflow: auto;
}
.ai-insight-admin-actions {
    margin-top: 0.5rem;
}

.unknown-exploit-section {
    margin-top: 1.25rem;
}

.unknown-exploit-section h3 {
    font-size: 1rem;
    font-weight: 600;
    margin-bottom: 0.5rem;
    display: flex;
    align-items: center;
    gap: 0.5rem;
}

.unknown-exploit-section .section-hint {
    margin-bottom: 0.6rem;
    color: var(--text-dim);
    font-size: 0.85rem;
}

.unknown-exploit-reasons {
    list-style: disc;
    padding: 0.5rem 0.5rem 0.5rem 1.5rem;
    background: var(--bg);
    border-radius: 8px;
    margin: 0;
}

.unknown-exploit-reasons li {
    padding: 0.2rem 0;
    font-size: 0.85rem;
    color: var(--text);
    line-height: 1.4;
}

/* === Help page === */
.help-intro {
    margin-bottom: 1.5rem;
    color: var(--text-dim);
    font-size: 0.95rem;
    line-height: 1.6;
}

.help-intro a {
    color: var(--accent);
    text-decoration: none;
}

.help-intro a:hover {
    text-decoration: underline;
}

.help-cve-confidence {
    background: rgba(220, 38, 38, 0.05);
    border-color: rgba(220, 38, 38, 0.25);
}

.help-cve-confidence p {
    font-size: 0.82rem;
    line-height: 1.5;
    margin: 0.5rem 0;
    display: flex;
    align-items: baseline;
    gap: 0.6rem;
}

.help-cve-confidence .cve-confidence {
    flex: 0 0 auto;
}

.help-category {
    margin-bottom: 1.5rem;
}

.help-category h2 {
    font-size: 1.15rem;
    font-weight: 700;
    margin-bottom: 0.75rem;
    display: flex;
    align-items: center;
    gap: 0.5rem;
}

.help-rules {
    display: flex;
    flex-direction: column;
    gap: 0.5rem;
}

.help-rule .heuristic-explanation {
    margin-top: 0.35rem;
}

.loading-text {
    color: var(--text-dim);
    text-align: center;
    padding: 2rem;
}

/* === Archive member results === */
.archive-section {
    margin-top: 1.25rem;
}
.archive-section h3 {
    margin-bottom: 0.75rem;
}
.archive-member-card {
    margin-bottom: 0.75rem;
    padding: 0.75rem 1rem;
    background: var(--bg);
    border-radius: 8px;
    border: 1px solid var(--border);
}
.verdict-border-malicious { border-left: 4px solid var(--red, #ef4444); }
.verdict-border-suspicious { border-left: 4px solid var(--amber, #f59e0b); }
.verdict-border-clean { border-left: 4px solid var(--green, #22c55e); }
.verdict-border-error { border-left: 4px solid var(--red, #ef4444); }
.archive-member-header {
    display: flex;
    align-items: center;
    gap: 0.5rem;
    flex-wrap: wrap;
    margin-bottom: 0.4rem;
}
.archive-member-name {
    font-weight: 600;
    font-size: 0.95rem;
    color: var(--text);
    word-break: break-all;
}
.verdict-badge-small {
    font-size: 0.65rem;
    padding: 0.1rem 0.5rem;
}
.archive-member-meta {
    font-size: 0.75rem;
    color: var(--text-dim);
    opacity: 0.7;
}
.archive-member-clamav {
    font-size: 0.8rem;
    color: var(--text-dim);
    margin-bottom: 0.3rem;
}
.archive-member-findings {
    margin-top: 0.3rem;
}
.archive-finding {
    font-size: 0.8rem;
    padding: 0.15rem 0;
    line-height: 1.5;
}
.archive-finding-name {
    font-weight: 500;
}
.archive-finding-desc {
    color: var(--text-dim);
    opacity: 0.8;
}
.archive-member-clean {
    font-size: 0.8rem;
    color: var(--green, #22c55e);
    opacity: 0.8;
}

/* === Email details section === */
.email-section {
    margin-top: 1.25rem;
    padding: 1rem 1.25rem;
    background: var(--bg);
    border-radius: 8px;
    border: 1px solid var(--border);
}

.email-section h3 {
    font-size: 1rem;
    font-weight: 600;
    margin-bottom: 0.75rem;
    color: var(--text);
}

.email-headers-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.85rem;
}

.email-headers-table th {
    text-align: left;
    vertical-align: top;
    width: 100px;
    padding: 0.35rem 0.75rem 0.35rem 0;
    color: var(--text-dim);
    font-weight: 500;
    white-space: nowrap;
    border-bottom: 1px solid rgba(0,0,0,0.04);
}

.email-headers-table td {
    padding: 0.35rem 0;
    color: var(--text);
    word-break: break-word;
    border-bottom: 1px solid rgba(0,0,0,0.04);
}

.email-from-display {
    font-weight: 600;
}

.email-subject {
    font-weight: 600;
    font-size: 0.9rem;
}

.email-attachments {
    margin-top: 0.75rem;
}

.email-attachments h4 {
    font-size: 0.9rem;
    font-weight: 600;
    margin-bottom: 0.4rem;
    display: flex;
    align-items: center;
    gap: 0.4rem;
}

.email-attachments-list {
    list-style: none;
    display: flex;
    flex-direction: column;
    gap: 0.3rem;
}

.email-attach-item {
    padding: 0.4rem 0.65rem;
    background: var(--bg-card);
    border-radius: 6px;
    border: 1px solid var(--border);
    font-size: 0.82rem;
}

.email-attach-meta {
    color: var(--text-dim);
    font-size: 0.78rem;
}

.email-attach-danger {
    border-color: rgba(220,38,38,0.3);
    background: rgba(220,38,38,0.04);
}

.email-attach-danger strong {
    color: var(--red);
}

.email-body-section {
    margin-top: 0.75rem;
}

.email-body-section h4 {
    font-size: 0.9rem;
    font-weight: 600;
    margin-bottom: 0.4rem;
    display: flex;
    align-items: center;
    gap: 0.5rem;
}

.email-body-preview {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.78rem;
    line-height: 1.55;
    color: var(--text);
    background: var(--bg-card);
    border: 1px solid var(--border);
    border-radius: 6px;
    padding: 0.65rem 0.85rem;
    white-space: pre-wrap;
    word-break: break-word;
    max-height: 300px;
    overflow-y: auto;
}

/* === Forensic disclaimer === */
.forensic-disclaimer {
    margin: 1rem 0 0.25rem;
    padding: 0.6rem 1rem;
    background: rgba(100,116,139,0.07);
    border: 1px solid rgba(100,116,139,0.2);
    border-radius: 6px;
    color: var(--text-dim);
    font-size: 0.82rem;
    line-height: 1.5;
}

/* === Results actions (cached banner + re-scan) === */
.results-actions {
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 1rem;
    margin: 1rem 0 0.25rem;
    flex-wrap: wrap;
}

/* === Cached result banner === */
.cached-banner {
    display: flex;
    align-items: center;
    flex: 1;
    padding: 0.6rem 1rem;
    background: rgba(26, 95, 74, 0.07);
    border: 1px solid rgba(26, 95, 74, 0.2);
    border-radius: 6px;
    color: var(--accent);
    font-size: 0.82rem;
    line-height: 1.5;
}

/* === Search section === */
.search-card {
    padding: 1.25rem 1.5rem;
}
.search-heading {
    font-size: 0.95rem;
    font-weight: 600;
    margin: 0 0 0.75rem;
    color: var(--text);
}
.search-row {
    display: flex;
    gap: 0.5rem;
}
.hash-input {
    flex: 1;
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.82rem;
    padding: 0.5rem 0.75rem;
    border: 1px solid var(--border);
    border-radius: 6px;
    background: var(--bg-card);
    color: var(--text);
    outline: none;
    transition: border-color 0.15s;
}
.hash-input:focus {
    border-color: var(--accent);
}
.search-error {
    margin: 0.5rem 0 0;
    font-size: 0.82rem;
    color: var(--red);
}

/* === Heuristic tag search results === */
.tag-results-section {
    padding: 1.25rem 1.5rem;
}

.tag-results-header {
    display: flex;
    justify-content: space-between;
    gap: 1rem;
    align-items: flex-start;
    margin-bottom: 1rem;
}

.tag-results-header h2 {
    font-size: 1.05rem;
    font-weight: 600;
    margin: 0 0 0.25rem;
}

.tag-results-summary {
    margin: 0;
    color: var(--text-dim);
    font-size: 0.85rem;
}

.tag-results-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.88rem;
}

.tag-results-table th,
.tag-results-table td {
    text-align: left;
    padding: 0.45rem 0.5rem;
    border-bottom: 1px solid var(--border);
    vertical-align: middle;
}

.tag-results-table th {
    font-weight: 600;
    font-size: 0.75rem;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    color: var(--text-dim);
}

.tag-results-table tr:last-child td {
    border-bottom: none;
}

.tag-results-hash {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.78rem;
    word-break: break-all;
}

.tag-results-score {
    font-variant-numeric: tabular-nums;
}

.tag-results-time {
    color: var(--text-dim);
    font-size: 0.82rem;
    white-space: nowrap;
}

.tag-results-empty {
    color: var(--text-dim);
    font-style: italic;
}

/* === URL-aggregate view (search-box "url:" queries) === */
.url-aggregate-controls {
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 1rem;
    margin: 0.5rem 0 0.75rem;
    flex-wrap: wrap;
}

.url-aggregate-toggle {
    display: inline-flex;
    align-items: center;
    gap: 0.4rem;
    color: var(--text-dim);
    font-size: 0.9rem;
    cursor: pointer;
}

.url-aggregate-toggle input[type="checkbox"] {
    margin: 0;
}

.url-aggregate-table .url-aggregate-count {
    text-align: right;
    width: 6rem;
    font-variant-numeric: tabular-nums;
}

.url-aggregate-table .url-aggregate-channel {
    text-align: right;
    width: 12rem;
    color: var(--text-dim);
    font-size: 0.85rem;
}

.url-aggregate-link {
    word-break: break-all;
    color: var(--link);
    cursor: pointer;
}

.url-aggregate-link:hover,
.url-aggregate-link:focus {
    text-decoration: underline;
}

/* === Extracted artifacts (carved from inside the sample) === */
.extracted-section {
    margin-top: 1.5rem;
    padding: 1rem 1.25rem;
    background: var(--card-bg);
    border: 1px solid var(--border);
    border-radius: 8px;
}

.extracted-section h3 {
    margin: 0 0 0.25rem;
}

.extracted-section .section-hint {
    margin: 0 0 0.75rem;
    color: var(--text-dim);
    font-size: 0.85rem;
}

.extracted-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.88rem;
}

.extracted-table th,
.extracted-table td {
    text-align: left;
    padding: 0.45rem 0.5rem;
    border-bottom: 1px solid var(--border);
    vertical-align: top;
}

.extracted-table th {
    font-weight: 600;
    font-size: 0.75rem;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    color: var(--text-dim);
}

.extracted-table tr:last-child td {
    border-bottom: none;
}

.extracted-table code {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.82rem;
    word-break: break-all;
}

.extracted-kind {
    color: var(--text-dim);
    font-size: 0.82rem;
    white-space: nowrap;
}

.extracted-source {
    color: var(--text-dim);
    font-size: 0.82rem;
}

.extracted-size {
    font-variant-numeric: tabular-nums;
    white-space: nowrap;
    color: var(--text-dim);
}

.extracted-sha {
    display: block;
    margin-top: 0.25rem;
    color: var(--text-dim);
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.75rem;
    overflow-wrap: anywhere;
    word-break: break-all;
    white-space: normal;
}

.extracted-detection-row td {
    padding-top: 0;
}

.extracted-detection {
    margin: 0.15rem 0 0.55rem 1.25rem;
    padding: 0.55rem 0.7rem;
    border-left: 3px solid var(--border);
    background: color-mix(in srgb, var(--card-bg) 75%, var(--bg) 25%);
}

.extracted-detection-title {
    margin-bottom: 0.25rem;
    color: var(--text-dim);
    font-size: 0.72rem;
    font-weight: 700;
    letter-spacing: 0.04em;
    text-transform: uppercase;
}

.extracted-detection-line {
    display: flex;
    flex-wrap: wrap;
    gap: 0.35rem;
    align-items: baseline;
    margin-top: 0.15rem;
    font-size: 0.84rem;
}

.extracted-detection-label {
    color: var(--text-dim);
    font-weight: 600;
}

.extracted-detection-value {
    color: var(--text);
    overflow-wrap: anywhere;
}

.extracted-detection-description {
    margin-top: 0.3rem;
    color: var(--text-dim);
    font-size: 0.8rem;
    line-height: 1.35;
}

.extracted-flagged {
    color: var(--red);
    font-weight: 600;
}

.extracted-payload-likely {
    color: var(--red);
    font-weight: 700;
}

.extracted-payload-unlikely {
    color: var(--green);
    font-weight: 700;
}

.extracted-payload-verdict {
    margin-top: 0.25rem;
    font-size: 0.82rem;
}

.extracted-payload-verdict.likely strong {
    color: var(--red);
}

.extracted-payload-verdict.unlikely strong {
    color: var(--green);
}

.extracted-row-flagged {
    background: color-mix(in srgb, var(--red) 8%, transparent);
}

.extracted-triage {
    margin-top: 0.35rem;
    display: grid;
    gap: 0.25rem;
}

/* "Find: Identical / Similar" buttons + inline siblings panel */
.extracted-find-label {
    display: inline-block;
    margin-left: 0.5rem;
    margin-right: 0.15rem;
    color: var(--text-dim);
    font-size: 0.78rem;
    font-weight: 600;
    text-transform: uppercase;
    letter-spacing: 0.04em;
}

.extracted-similar-btn {
    margin-left: 0.25rem;
}

.extracted-similar-score {
    display: inline-block;
    min-width: 3rem;
    padding: 0.05rem 0.4rem;
    margin-right: 0.2rem;
    border-radius: 3px;
    background: color-mix(in srgb, var(--accent) 22%, transparent);
    color: var(--text);
    font-variant-numeric: tabular-nums;
    font-size: 0.78rem;
    font-weight: 600;
    text-align: center;
}

.extracted-siblings-panel {
    margin: 0.6rem 0 0.4rem 1.25rem;
    padding: 0.55rem 0.7rem;
    border-left: 3px solid var(--border);
    background: color-mix(in srgb, var(--card-bg) 70%, var(--bg) 30%);
    font-size: 0.85rem;
}

.extracted-siblings-status,
.extracted-siblings-error,
.extracted-siblings-title {
    color: var(--text-dim);
    font-size: 0.78rem;
    text-transform: uppercase;
    letter-spacing: 0.04em;
    font-weight: 700;
    margin-bottom: 0.35rem;
}

.extracted-siblings-error {
    color: var(--red);
    text-transform: none;
    letter-spacing: 0;
    font-weight: 500;
    font-size: 0.85rem;
}

.extracted-siblings-list {
    list-style: none;
    margin: 0;
    padding: 0;
    display: grid;
    gap: 0.35rem;
}

.extracted-siblings-list li {
    display: flex;
    flex-wrap: wrap;
    gap: 0.3rem;
    align-items: baseline;
    padding: 0.25rem 0;
    border-bottom: 1px dashed var(--border);
}

.extracted-siblings-list li:last-child {
    border-bottom: none;
}

.extracted-siblings-meta {
    color: var(--text-dim);
    font-size: 0.82rem;
}

.extracted-siblings-parentsha {
    color: var(--text-dim);
    font-size: 0.72rem;
    flex-basis: 100%;
    overflow-wrap: anywhere;
}

.extracted-siblings-parentsha-link {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.82rem;
    overflow-wrap: anywhere;
    word-break: break-all;
}

/* Authoring-application — rendered as a button so it can carry a click
   handler, but visually looks like an inline `<code>` link inside the
   results meta row to match the surrounding hash codes. */
.result-authoring-application {
    appearance: none;
    border: none;
    background: transparent;
    padding: 0;
    margin: 0;
    font: inherit;
    color: var(--text);
    text-decoration: underline dotted;
    text-underline-offset: 0.18em;
    cursor: pointer;
    overflow-wrap: anywhere;
}

.result-authoring-application:hover,
.result-authoring-application:focus-visible {
    color: var(--accent, #5c8df0);
    text-decoration-style: solid;
    outline: none;
}

.stats-summary-line {
    margin: 0 0 0.6rem 0;
    color: var(--text-dim);
    font-size: 0.85rem;
}

/* Embedded-artifact search page (/artifacts) */
.artifacts-search-form {
    display: grid;
    gap: 0.7rem;
    margin-bottom: 1rem;
}

.artifacts-filter-row {
    display: grid;
    grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
    gap: 0.7rem;
    align-items: end;
}

.artifacts-filter-flags {
    grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
    align-items: center;
}

.artifacts-filter {
    display: flex;
    flex-direction: column;
    gap: 0.25rem;
    font-size: 0.78rem;
    color: var(--text-dim);
    text-transform: uppercase;
    letter-spacing: 0.04em;
    font-weight: 600;
}

.artifacts-filter input[type="text"],
.artifacts-filter select {
    padding: 0.45rem 0.55rem;
    border: 1px solid var(--border);
    background: var(--bg);
    color: var(--text);
    border-radius: 4px;
    font: inherit;
    font-size: 0.9rem;
    text-transform: none;
    letter-spacing: 0;
    font-weight: 400;
}

.artifacts-checkbox {
    display: flex;
    align-items: center;
    gap: 0.4rem;
    color: var(--text);
    font-size: 0.9rem;
}

.artifacts-actions {
    display: flex;
    gap: 0.5rem;
    justify-content: flex-end;
}

.artifacts-list {
    display: grid;
    gap: 0.55rem;
}

.artifacts-card {
    padding: 0.7rem 0.8rem;
    border: 1px solid var(--border);
    border-radius: 5px;
    background: color-mix(in srgb, var(--card-bg) 90%, var(--bg) 10%);
    display: grid;
    gap: 0.4rem;
}

.artifacts-card-row {
    display: flex;
    flex-wrap: wrap;
    align-items: baseline;
    gap: 0.6rem;
    justify-content: space-between;
}

.artifacts-card-name {
    display: flex;
    flex-wrap: wrap;
    gap: 0.5rem;
    align-items: baseline;
}

.artifacts-card-name code {
    font-size: 0.95rem;
    color: var(--text);
    background: transparent;
}

.artifacts-card-kind {
    font-size: 0.75rem;
    color: var(--text-dim);
    text-transform: uppercase;
    letter-spacing: 0.04em;
}

.artifacts-card-flags {
    display: flex;
    gap: 0.4rem;
    flex-wrap: wrap;
}

.artifacts-flag {
    display: inline-block;
    padding: 0.15rem 0.45rem;
    border-radius: 3px;
    font-size: 0.78rem;
    font-weight: 600;
}

.artifacts-flag.artifacts-clamav {
    background: color-mix(in srgb, var(--red) 18%, transparent);
    color: var(--red);
}

.artifacts-flag.artifacts-triage {
    background: color-mix(in srgb, var(--yellow, #d39e00) 18%, transparent);
    color: var(--yellow, #d39e00);
}

.artifacts-card-triage {
    display: flex;
    flex-direction: column;
    gap: 0.25rem;
    margin-top: 0.15rem;
    padding: 0.5rem 0.75rem;
    border-radius: 6px;
    background: color-mix(in srgb, var(--yellow, #d39e00) 9%, transparent);
    border-left: 2px solid var(--yellow, #d39e00);
}

.artifacts-card-triage-reason {
    font-size: 0.82rem;
    color: var(--text);
    line-height: 1.35;
}

.artifacts-card-meta,
.artifacts-card-shas,
.artifacts-card-parent {
    display: flex;
    flex-wrap: wrap;
    gap: 0.5rem;
    align-items: baseline;
    font-size: 0.82rem;
    color: var(--text-dim);
}

.artifacts-card-shalabel,
.artifacts-card-parentlabel {
    text-transform: uppercase;
    letter-spacing: 0.04em;
    font-size: 0.7rem;
    font-weight: 700;
    color: var(--text-dim);
    margin-right: 0.15rem;
}

.artifacts-card-parent a {
    color: var(--text);
    font-weight: 500;
}

.artifacts-card-parent code,
.artifacts-card-shas code,
.artifacts-card-parentsha {
    overflow-wrap: anywhere;
    font-size: 0.78rem;
}

/* Pivot row inside an artifacts-card. Mirrors the per-result page layout
   so the buttons live beneath the parent line. The inline panel rendered
   by togglePivot expands the card vertically when opened. */
.artifacts-card-pivot {
    margin-top: 0.5rem;
    display: flex;
    flex-wrap: wrap;
    gap: 0.25rem;
    align-items: center;
}
.artifacts-card-pivot .extracted-siblings-panel {
    flex-basis: 100%;
    margin: 0.5rem 0 0 0;
}

.extracted-triage-signal {
    color: var(--text);
    font-size: 0.78rem;
    line-height: 1.35;
}

.extracted-triage-signal.sev-high,
.extracted-triage-signal.sev-critical {
    color: var(--red);
    font-weight: 600;
}

.extracted-triage-signal.sev-medium {
    color: var(--orange);
}

.tag-results-pagination {
    display: flex;
    align-items: center;
    justify-content: flex-end;
    gap: 0.75rem;
    margin-top: 1rem;
}

.tag-results-page {
    color: var(--text-dim);
    font-size: 0.82rem;
}

.tag-results-pagination button:disabled {
    opacity: 0.45;
    cursor: not-allowed;
}

/* === Clean state === */
.no-findings {
    text-align: center;
    padding: 2rem 1rem;
    color: var(--green);
}

.no-findings svg {
    width: 48px;
    height: 48px;
    margin-bottom: 0.5rem;
}

.no-findings p {
    font-size: 1rem;
    font-weight: 500;
}

/* === Statistics page === */
.stats-summary-row {
    display: flex;
    flex-wrap: wrap;
    gap: 2rem;
}

.stats-summary-row > div {
    display: flex;
    flex-direction: column;
}

.stats-summary-label {
    font-size: 0.78rem;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    color: var(--text-dim);
}

.stats-summary-value {
    font-size: 1.5rem;
    font-weight: 600;
    color: var(--text);
}

.stats-summary-time {
    font-size: 0.85rem;
    font-weight: 400;
    color: var(--text-dim);
}

.stats-filetype-head {
    display: flex;
    align-items: baseline;
    justify-content: space-between;
    gap: 1rem;
    margin-bottom: 1rem;
}

.stats-filetype-head h2 {
    font-size: 1.2rem;
    font-weight: 600;
}

.stats-total {
    font-size: 0.95rem;
    color: var(--text-dim);
    font-variant-numeric: tabular-nums;
}

.stats-verdict-row {
    display: grid;
    grid-template-columns: repeat(4, 1fr);
    gap: 0.75rem;
    margin-bottom: 0.75rem;
}

.stats-verdict {
    display: flex;
    flex-direction: column;
    padding: 0.6rem 0.8rem;
    border-radius: var(--radius);
    border: 1px solid var(--border);
}

.stats-verdict-label {
    font-size: 0.75rem;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    color: var(--text-dim);
}

.stats-verdict-count {
    font-size: 1.25rem;
    font-weight: 600;
    font-variant-numeric: tabular-nums;
}

.stats-verdict-clean      { border-left: 4px solid var(--green); }
.stats-verdict-suspicious { border-left: 4px solid var(--amber); }
.stats-verdict-malicious  { border-left: 4px solid var(--red); }
.stats-verdict-error      { border-left: 4px solid var(--red); }

.stats-verdict-bar {
    display: flex;
    height: 8px;
    border-radius: 4px;
    overflow: hidden;
    background: var(--bg-hover);
    margin-bottom: 1.25rem;
}

.stats-verdict-bar .bar-clean      { background: var(--green); }
.stats-verdict-bar .bar-suspicious { background: var(--amber); }
.stats-verdict-bar .bar-malicious  { background: var(--red); }
.stats-verdict-bar .bar-error      { background: var(--red); }

.stats-pie-title {
    font-size: 0.95rem;
    font-weight: 600;
    margin-bottom: 0.75rem;
    color: var(--text-dim);
    text-transform: uppercase;
    letter-spacing: 0.05em;
}

.stats-pie-wrap {
    display: flex;
    align-items: center;
    gap: 1.5rem;
    flex-wrap: wrap;
}

.stats-pie {
    width: 180px;
    height: 180px;
    flex-shrink: 0;
}

.stats-legend {
    list-style: none;
    flex: 1;
    min-width: 14rem;
}

.stats-legend-item {
    display: flex;
    align-items: center;
    gap: 0.5rem;
    padding: 0.2rem 0;
    font-size: 0.88rem;
}

.stats-legend-swatch {
    width: 12px;
    height: 12px;
    border-radius: 2px;
    flex-shrink: 0;
}

.stats-legend-rule {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.82rem;
    flex: 1;
    word-break: break-all;
    /* Reset <button> defaults so the legend still reads as plain text. */
    background: none;
    border: none;
    padding: 0;
    margin: 0;
    color: inherit;
    text-align: left;
    cursor: pointer;
    text-decoration: underline dotted;
    text-underline-offset: 2px;
}

.stats-legend-rule:hover,
.stats-legend-rule:focus-visible {
    color: var(--accent, #0e7490);
    text-decoration: underline;
    outline: none;
}

/* === Heuristic detail modal === */
.rule-modal-overlay {
    position: fixed;
    inset: 0;
    background: rgba(0, 0, 0, 0.45);
    display: flex;
    align-items: flex-start;
    justify-content: center;
    padding: 4rem 1rem 2rem;
    z-index: 1000;
}

.rule-modal-overlay[hidden] { display: none; }

.rule-modal {
    background: var(--bg, #fff);
    color: var(--text, #111);
    border-radius: 8px;
    box-shadow: 0 20px 60px rgba(0, 0, 0, 0.35);
    width: min(900px, 100%);
    max-height: calc(100vh - 6rem);
    overflow: auto;
    padding: 1.25rem 1.5rem 1.5rem;
}

.rule-modal-head {
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 1rem;
    margin-bottom: 1rem;
}

.rule-modal-title {
    margin: 0;
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 1.05rem;
    word-break: break-all;
}

.rule-modal-close {
    background: none;
    border: none;
    font-size: 1.5rem;
    line-height: 1;
    cursor: pointer;
    color: var(--text-dim);
    padding: 0.25rem 0.5rem;
}

.rule-modal-close:hover,
.rule-modal-close:focus-visible {
    color: var(--text);
    outline: none;
}

.rule-modal-body { font-size: 0.9rem; }

.stats-legend-count {
    color: var(--text-dim);
    font-variant-numeric: tabular-nums;
    white-space: nowrap;
}

.stats-empty {
    color: var(--text-dim);
    font-style: italic;
}

.stats-recent h2 {
    font-size: 1.1rem;
    font-weight: 600;
    margin-bottom: 0.75rem;
}

.stats-recent-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.88rem;
}

.stats-recent-table th,
.stats-recent-table td {
    text-align: left;
    padding: 0.45rem 0.5rem;
    border-bottom: 1px solid var(--border);
    vertical-align: middle;
}

.stats-recent-table th {
    font-weight: 600;
    font-size: 0.75rem;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    color: var(--text-dim);
}

.stats-recent-table tr:last-child td {
    border-bottom: none;
}

.stats-recent-hash {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.78rem;
    word-break: break-all;
}

.stats-recent-score {
    font-variant-numeric: tabular-nums;
}

.stats-recent-time {
    color: var(--text-dim);
    font-size: 0.82rem;
    white-space: nowrap;
}

/* === Collapsible card sections === */
.collapsible-card > summary {
    list-style: none;
    cursor: pointer;
    user-select: none;
    display: block;
    position: relative;
    padding-right: 1.75rem;
}

.collapsible-card > summary::-webkit-details-marker {
    display: none;
}

.collapsible-card > summary::after {
    content: "";
    position: absolute;
    right: 0.25rem;
    top: 50%;
    width: 0.5rem;
    height: 0.5rem;
    border-right: 2px solid var(--text-dim);
    border-bottom: 2px solid var(--text-dim);
    transform: translateY(-75%) rotate(-45deg);
    transition: transform 0.15s ease;
}

.collapsible-card[open] > summary::after {
    transform: translateY(-25%) rotate(45deg);
}

.collapsible-card > summary h2 {
    margin: 0;
    display: inline-block;
}

.collapsible-card > summary:hover h2 {
    color: var(--text);
}

.collapsible-card[open] > summary {
    margin-bottom: 0.75rem;
}

/* === Account widget (top-right of every header) === */
.account-widget {
    margin-left: auto;
    display: flex;
    align-items: center;
    gap: 0.75rem;
    flex-shrink: 0;
}

.account-user {
    color: var(--text-dim);
    font-size: 0.85rem;
    font-weight: 500;
    overflow: hidden;
    text-overflow: ellipsis;
    white-space: nowrap;
    max-width: 16ch;
}

.account-link {
    color: var(--accent);
    font-size: 0.85rem;
    font-weight: 500;
}

.account-logout-form {
    margin: 0;
    display: inline;
}

.btn-small {
    padding: 0.35rem 0.85rem;
    font-size: 0.8rem;
}

.account-login-btn {
    text-decoration: none;
}

/* === Login form === */
.login-card {
    max-width: 420px;
    margin: 2rem auto;
}

.login-form {
    display: flex;
    flex-direction: column;
    gap: 0.85rem;
}

.login-form label {
    display: flex;
    flex-direction: column;
    gap: 0.3rem;
    font-size: 0.85rem;
    color: var(--text-dim);
}

.login-form input[type="text"],
.login-form input[type="password"],
.login-form select {
    padding: 0.55rem 0.8rem;
    border: 1px solid var(--border);
    border-radius: 6px;
    font-family: inherit;
    font-size: 0.95rem;
    background: var(--bg-card);
    color: var(--text);
}

.login-form input:focus,
.login-form select:focus {
    outline: none;
    border-color: var(--accent);
    box-shadow: 0 0 0 2px rgba(26, 95, 74, 0.2);
}

.login-error {
    color: var(--red);
    font-size: 0.85rem;
    background: rgba(220, 38, 38, 0.08);
    padding: 0.5rem 0.75rem;
    border-radius: 6px;
    border: 1px solid rgba(220, 38, 38, 0.25);
}

/* === Admin user table === */
.admin-users-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.9rem;
}

.admin-users-table th,
.admin-users-table td {
    text-align: left;
    padding: 0.6rem 0.5rem;
    border-bottom: 1px solid var(--border);
}

.admin-users-table th {
    color: var(--text-dim);
    font-weight: 600;
    font-size: 0.78rem;
    text-transform: uppercase;
    letter-spacing: 0.04em;
}

.admin-role-badge {
    display: inline-block;
    padding: 0.15rem 0.55rem;
    border-radius: 999px;
    font-size: 0.72rem;
    font-weight: 600;
    background: var(--bg-hover);
    color: var(--text-dim);
}

.admin-role-badge.admin {
    background: rgba(26, 95, 74, 0.12);
    color: var(--accent);
}

.admin-flash {
    padding: 0.55rem 0.85rem;
    border-radius: 6px;
    margin-bottom: 1rem;
    font-size: 0.88rem;
}

.admin-flash.ok {
    background: rgba(26, 95, 74, 0.1);
    color: var(--accent);
    border: 1px solid rgba(26, 95, 74, 0.25);
}

.admin-flash.err {
    background: rgba(220, 38, 38, 0.08);
    color: var(--red);
    border: 1px solid rgba(220, 38, 38, 0.25);
}

/* Reuses the user-admin table styling; the only new pieces are the
   per-flagger chip (so multiple flaggers on one row stay visually distinct)
   and the empty-state line. */
.admin-flagged-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.9rem;
}

.admin-flagged-table th,
.admin-flagged-table td {
    text-align: left;
    padding: 0.6rem 0.5rem;
    border-bottom: 1px solid var(--border);
    vertical-align: top;
}

.admin-flagged-table th {
    color: var(--text-dim);
    font-weight: 600;
    font-size: 0.78rem;
    text-transform: uppercase;
    letter-spacing: 0.04em;
}

.admin-flagged-table code {
    font-size: 0.82rem;
}

.flagger-chip {
    display: inline-block;
    padding: 0.1rem 0.45rem;
    margin: 0.05rem 0.15rem 0.05rem 0;
    border-radius: 999px;
    background: var(--bg-hover);
    color: var(--text-dim);
    font-size: 0.75rem;
}

.admin-empty {
    color: var(--text-dim);
    font-style: italic;
    margin: 0.5rem 0 0;
}

.admin-clear-flag-form {
    display: inline;
    margin: 0;
}

.admin-row-actions {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: 0.4rem;
}

.admin-rescan-status {
    font-size: 0.78rem;
    color: var(--text-dim);
}

.admin-rescan-status.pending { color: var(--text-dim); font-style: italic; }
.admin-rescan-status.ok      { color: var(--accent); }
.admin-rescan-status.err     { color: var(--red); }

.admin-delete-form {
    display: inline;
    margin: 0;
}

.admin-create-form {
    display: grid;
    grid-template-columns: 1fr 1fr 0.6fr auto;
    gap: 0.6rem;
    align-items: end;
}

.admin-create-form label {
    display: flex;
    flex-direction: column;
    gap: 0.3rem;
    font-size: 0.78rem;
    color: var(--text-dim);
}

.admin-create-form input,
.admin-create-form select {
    padding: 0.5rem 0.7rem;
    border: 1px solid var(--border);
    border-radius: 6px;
    font-family: inherit;
    font-size: 0.9rem;
}

/* === 0-day hunting page === */
.hunt-filters {
    display: flex;
    gap: 0.5rem;
    align-items: center;
    flex-wrap: wrap;
    margin-bottom: 1rem;
}

.hunt-filters .filter-label {
    color: var(--text-dim);
    font-size: 0.85rem;
    margin-right: 0.25rem;
}

.hunt-filter-btn {
    padding: 0.35rem 0.85rem;
    border-radius: 999px;
    border: 1px solid var(--border);
    background: var(--bg-card);
    color: var(--text-dim);
    cursor: pointer;
    font-family: inherit;
    font-size: 0.82rem;
}

.hunt-filter-btn.active {
    background: var(--accent);
    color: #fff;
    border-color: var(--accent);
}

/* === Sticky primary topbar (always visible) ===
   Authenticated users get the search box + account/Log out. Anonymous
   visitors see a Log in button in the same slot. The Hunting dropdown
   renders for everyone; its 0-day entry routes anon users to the login
   page rather than letting them bounce through a 302. */
.topbar {
    position: sticky;
    top: 0;
    z-index: 100;
    background: #143d33;
    color: rgba(255, 255, 255, 0.9);
    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12);
    font-family: var(--font);
}

.topbar-inner {
    max-width: 1100px;
    margin: 0 auto;
    padding: 0 24px;
    display: flex;
    justify-content: space-between;
    align-items: center;
    gap: 0 24px;
    min-height: 44px;
}

.topbar-brand {
    font-family: var(--font-space);
    font-weight: 600;
    font-size: 1rem;
    letter-spacing: 0.12em;
    text-transform: uppercase;
    color: #ffffff;
    text-decoration: none;
    white-space: nowrap;
}

.topbar-brand:hover {
    text-decoration: none;
    color: #ffffff;
}

.topbar-nav {
    list-style: none;
    margin: 0;
    padding: 0;
    display: flex;
    align-items: center;
    gap: 0 8px;
    flex-wrap: wrap;
}

.topbar-nav li {
    display: flex;
    align-items: center;
}

.topbar-nav a,
.topbar-nav .topbar-dropdown-toggle,
.topbar-logout-form button {
    display: inline-flex;
    align-items: center;
    color: rgba(255, 255, 255, 0.85);
    font-weight: 600;
    font-size: 14px;
    line-height: 1;
    padding: 12px 12px;
    text-decoration: none;
    background: transparent;
    border: none;
    cursor: pointer;
    font-family: inherit;
    border-radius: 4px;
    transition: color 0.15s, background 0.15s;
    white-space: nowrap;
}

.topbar-nav a:hover,
.topbar-nav .topbar-dropdown-toggle:hover,
.topbar-logout-form button:hover {
    color: #ffffff;
    background: rgba(255, 255, 255, 0.08);
    text-decoration: none;
}

.topbar-nav a.active,
.topbar-nav .topbar-dropdown-toggle.active {
    color: #ffffff;
    background: rgba(255, 255, 255, 0.12);
}

/* Header search box. Shows only inside the topbar (auth-only). */
.topbar-search {
    flex: 1 1 240px;
    max-width: 360px;
    margin: 0;
    display: flex;
    align-items: center;
}
.topbar-search-input {
    width: 100%;
    background: rgba(255, 255, 255, 0.10);
    color: #ffffff;
    border: 1px solid rgba(255, 255, 255, 0.18);
    border-radius: 4px;
    padding: 7px 10px;
    font: inherit;
    font-size: 13px;
    line-height: 1.2;
    transition: background 0.15s, border-color 0.15s;
}
.topbar-search-input::placeholder {
    color: rgba(255, 255, 255, 0.55);
}
.topbar-search-input:focus {
    background: rgba(255, 255, 255, 0.16);
    border-color: rgba(255, 255, 255, 0.45);
    outline: none;
}
.topbar-search-input.topbar-search-error {
    border-color: #f87171;
    background: rgba(248, 113, 113, 0.18);
}

/* Hunting dropdown — hover/focus-within reveal, no caret, no JS toggle.
   Layout matches the menu pattern used on daemon.be (the analyst's external
   site): trigger is a plain link, the panel fades + slides down 4px on
   open. */
.topbar-dropdown {
    position: relative;
}
.topbar-dropdown-menu {
    position: absolute;
    top: 100%;
    left: 0;
    min-width: 160px;
    margin: 0;
    padding: 6px 0;
    background: #1b4332;
    border-radius: 6px;
    box-shadow: 0 4px 12px rgba(0, 0, 0, 0.2);
    opacity: 0;
    visibility: hidden;
    transform: translateY(-4px);
    transition: opacity 0.15s ease, visibility 0.15s ease, transform 0.15s ease;
    display: flex;
    flex-direction: column;
    gap: 0;
    z-index: 110;
}
.topbar-dropdown:hover .topbar-dropdown-menu,
.topbar-dropdown:focus-within .topbar-dropdown-menu {
    opacity: 1;
    visibility: visible;
    transform: translateY(0);
}
.topbar-dropdown-menu a {
    display: flex;
    align-items: center;
    padding: 12px 16px;
    min-height: 44px;
    color: rgba(255, 255, 255, 0.9);
    font-size: 14px;
    font-weight: 400;
    text-decoration: none;
    white-space: nowrap;
    border-radius: 0;
    background: transparent;
}
.topbar-dropdown-menu a:hover {
    background: rgba(255, 255, 255, 0.10);
    color: #ffffff;
}
.topbar-dropdown-menu a.active {
    background: rgba(255, 255, 255, 0.16);
    color: #ffffff;
}

.topbar-user {
    color: rgba(255, 255, 255, 0.7) !important;
    font-weight: 500 !important;
    border-left: 1px solid rgba(255, 255, 255, 0.18);
    margin-left: 8px;
    padding-left: 16px !important;
}

.topbar-logout-form {
    margin: 0;
    display: inline;
}

@media (max-width: 600px) {
    .topbar-inner {
        padding: 0 12px;
        flex-wrap: wrap;
        gap: 4px 12px;
    }
    .topbar-search {
        order: 3;
        flex: 1 1 100%;
        max-width: none;
    }
    .topbar-nav {
        gap: 0 4px;
        flex: 1 1 100%;
        justify-content: flex-end;
    }
    .topbar-nav a,
    .topbar-nav .topbar-dropdown-toggle,
    .topbar-logout-form button {
        font-size: 13px;
        padding: 10px 8px;
    }
    .topbar-user {
        margin-left: 0;
        padding-left: 8px !important;
    }
    .topbar-dropdown-menu {
        right: 0;
        left: auto;
    }
}

/* === Account / TOTP === */
.totp-state {
    color: var(--text-dim);
    margin-bottom: 0.85rem;
}

.totp-state.totp-enabled {
    color: var(--accent);
}

.totp-setup {
    display: grid;
    grid-template-columns: minmax(180px, 220px) 1fr;
    gap: 1.5rem;
    align-items: start;
    margin-top: 0.85rem;
}

.totp-qr {
    width: 100%;
    max-width: 220px;
    height: auto;
    background: #ffffff;
    padding: 0.5rem;
    border: 1px solid var(--border);
    border-radius: var(--radius);
}

.totp-setup-side {
    display: flex;
    flex-direction: column;
    gap: 0.6rem;
    min-width: 0;
}

.totp-manual-secret {
    display: block;
    font-family: 'SF Mono', 'Fira Code', monospace;
    font-size: 0.78rem;
    background: var(--bg-hover);
    padding: 0.55rem 0.75rem;
    border-radius: 6px;
    word-break: break-all;
    user-select: all;
}

.totp-confirm-form,
.totp-cancel-form {
    margin: 0;
}

.totp-confirm-form input[type="text"] {
    font-family: 'SF Mono', 'Fira Code', monospace;
    font-size: 1.15rem;
    letter-spacing: 0.3em;
    text-align: center;
}

.extracted-download {
    text-align: right;
    white-space: nowrap;
    width: 1%;
}

.extracted-zip-note {
    margin-top: 0.5rem;
    font-size: 0.78rem;
    color: var(--text-dim);
}

.extracted-zip-note code {
    font-size: 0.78rem;
    background: rgba(26, 95, 74, 0.1);
    color: var(--accent);
}

.hunt-list {
    display: flex;
    flex-direction: column;
    gap: 0.6rem;
}

.hunt-card {
    display: flex;
    align-items: center;
    gap: 1rem;
    padding: 0.85rem 1rem;
    border: 1px solid var(--border);
    border-radius: var(--radius);
    background: var(--bg-card);
    transition: border-color 0.15s, box-shadow 0.15s;
}

.hunt-card:hover {
    border-color: rgba(26, 95, 74, 0.4);
    box-shadow: 0 1px 4px rgba(0, 0, 0, 0.04);
}

.hunt-card-body {
    flex: 1 1 auto;
    min-width: 0;
}

.hunt-card-sha {
    font-family: 'SF Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.82rem;
    color: var(--text);
    word-break: break-all;
    line-height: 1.4;
    font-weight: 500;
}

.hunt-card-sha-link {
    color: inherit;
    text-decoration: none;
    border-bottom: 1px dotted var(--text-dim);
}

.hunt-card-sha-link:hover,
.hunt-card-sha-link:focus {
    color: var(--accent);
    border-bottom-color: var(--accent);
}

.hunt-card-meta {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    gap: 0.4rem 0.85rem;
    margin-top: 0.5rem;
    font-size: 0.82rem;
    color: var(--text-dim);
}

.hunt-card-score {
    display: inline-flex;
    align-items: center;
    justify-content: center;
    min-width: 2.4rem;
    padding: 0.15rem 0.55rem;
    border-radius: 999px;
    background: rgba(220, 38, 38, 0.12);
    color: var(--red);
    font-weight: 700;
    font-variant-numeric: tabular-nums;
    font-size: 0.82rem;
}

.hunt-card-type {
    font-weight: 500;
    color: var(--text);
}

.hunt-card-verdict {
    font-weight: 600;
    font-size: 0.74rem;
    text-transform: uppercase;
    letter-spacing: 0.04em;
}

.hunt-verdict-malicious { color: var(--red); }
.hunt-verdict-suspicious { color: var(--amber); }
.hunt-verdict-clean { color: var(--text-dim); }

.hunt-card-risk {
    font-variant-numeric: tabular-nums;
}

.hunt-card-time {
    color: var(--text-dim);
    font-size: 0.78rem;
    font-variant-numeric: tabular-nums;
}

.hunt-card-reasons {
    margin: 0.55rem 0 0;
    padding-left: 1.15rem;
    color: var(--text-dim);
    font-size: 0.82rem;
    line-height: 1.55;
    list-style: disc;
}

.hunt-card-reasons li {
    padding-left: 0.15rem;
    margin: 0.1rem 0;
}

.hunt-card-reasons li::marker {
    color: rgba(220, 38, 38, 0.55);
}

.hunt-card-actions {
    flex: 0 0 auto;
    align-self: center;
}

.hunt-empty {
    color: var(--text-dim);
    text-align: center;
    padding: 1.5rem 0;
}

/* === Responsive === */
@media (max-width: 600px) {
    .app { padding: 1.25rem 1rem 2rem; }
    .app-header-text { flex-basis: 100%; }
    .logo { max-width: 100%; }
    .logo-text { font-size: 1.05rem; letter-spacing: 0.08em; }
    .results-header { flex-direction: column; }
    .risk-score { flex-direction: row; gap: 0.5rem; }
    .risk-number { font-size: 1.5rem; }
    .drop-zone { padding: 2rem 1rem; }
    .stats-verdict-row { grid-template-columns: 1fr; }
    .stats-pie-wrap { flex-direction: column; align-items: stretch; }
    .stats-pie { margin: 0 auto; }
    .account-widget { width: 100%; justify-content: flex-end; }
    .admin-create-form { grid-template-columns: 1fr; }
    .hunt-card { flex-direction: column; align-items: stretch; }
    .hunt-card-actions { align-self: flex-end; }
    .totp-setup { grid-template-columns: 1fr; }
    .totp-qr { margin: 0 auto; }
}

/* === Creators page === */
.creators-section-title {
    margin: 0 0 12px;
    font-size: 1.1rem;
    font-weight: 600;
    color: var(--text);
}
.creators-subtle {
    color: var(--text-dim);
    font-size: 0.92rem;
    margin: -4px 0 14px;
}
.creators-charts-grid {
    display: grid;
    grid-template-columns: repeat(auto-fit, minmax(360px, 1fr));
    gap: 16px;
}
.creators-filetype {
    margin: 0;
}
.creators-filetype .stats-filetype-head {
    margin-bottom: 8px;
}

.exploits-phishing-toggle {
    display: flex;
    align-items: center;
    gap: 0.4rem;
    margin-top: 8px;
    font-size: 0.82rem;
    color: var(--text-dim);
    cursor: pointer;
    user-select: none;
}
.exploits-phishing-toggle input[type="checkbox"] {
    margin: 0;
    cursor: pointer;
}
.creators-table-wrap {
    overflow-x: auto;
}
.creators-table {
    width: 100%;
    border-collapse: collapse;
    font-size: 0.95rem;
}
.creators-table th,
.creators-table td {
    text-align: left;
    padding: 8px 10px;
    border-bottom: 1px solid var(--border);
}
.creators-table th {
    font-weight: 600;
    color: var(--text-dim);
    background: var(--surface-2, transparent);
}
.creators-table td.creators-count,
.creators-table th.creators-th-count,
.creators-table td.stats-recent-score,
.creators-table th.creators-th-score {
    text-align: right;
    font-variant-numeric: tabular-nums;
}
.creators-name a {
    color: var(--text);
    font-weight: 500;
}
.creators-name a:hover { text-decoration: underline; }

/* Combos block on the per-creator detail page. */
.creator-combos {
    display: flex;
    flex-direction: column;
    gap: 8px;
}
.creator-combo {
    border: 1px solid var(--border);
    border-radius: 6px;
    padding: 10px 12px;
    background: var(--surface, transparent);
}
.creator-combo-head {
    display: flex;
    justify-content: space-between;
    align-items: baseline;
    gap: 12px;
    margin-bottom: 4px;
}
.creator-combo-rule {
    font-family: var(--font-mono, monospace);
    font-size: 0.92rem;
    font-weight: 600;
    color: var(--text);
}
.creator-combo-count {
    color: var(--text-dim);
    font-size: 0.88rem;
    font-variant-numeric: tabular-nums;
}
.creator-combo-samples {
    display: flex;
    flex-direction: column;
    gap: 2px;
    margin-top: 4px;
}
.creator-combo-sample {
    color: var(--text);
    text-decoration: none;
}
.creator-combo-sample code {
    font-family: var(--font-mono, monospace);
    font-size: 0.78rem;
    color: var(--text-dim);
}
.creator-combo-sample:hover code { color: var(--text); }


/* === /search — search-language documentation ===
   Cards on /search are prose, not data. A definition list keeps each
   operator's term on one line and lets the description use the full
   card width, so long examples wrap naturally instead of fighting a
   fixed-width middle column. */
.search-help-section {
    padding: 20px 22px;
    /* Match the prose density of /help — the body / dt / dd inherit
       this so the page no longer renders one notch larger than the
       heuristic reference. */
    font-size: 0.85rem;
    line-height: 1.55;
}
.search-help-section p {
    margin: 0 0 0.85em 0;
}
.search-help-section p:last-child {
    margin-bottom: 0;
}
.search-help-section h2 {
    margin: 0 0 0.6em 0;
    font-size: 1.05rem;
}
.search-help-section code {
    font-family: var(--font-mono, monospace);
    font-size: 0.92em;
    background: rgba(255, 255, 255, 0.06);
    padding: 1px 5px;
    border-radius: 3px;
    /* Long sha256 hashes shouldn't force a horizontal scrollbar — let
       inline chips wrap at any character if the column gets narrow. */
    overflow-wrap: anywhere;
}
.search-ops-list {
    margin: 0;
    padding: 0;
}
.search-ops-list dt {
    margin: 12px 0 3px 0;
    font-weight: 600;
}
.search-ops-list dt:first-child {
    margin-top: 0;
}
.search-ops-list dd {
    margin: 0 0 0 0;
    padding: 0;
    color: var(--text-dim, #c8c8c8);
    line-height: 1.55;
}
.search-ops-list dd code {
    color: var(--text, #e8e8e8);
}
.search-ops-badge {
    display: inline-block;
    background: #143d33;
    color: #fff;
    font-size: 0.68em;
    font-weight: 600;
    padding: 1px 6px;
    border-radius: 3px;
    margin-left: 8px;
    vertical-align: middle;
    letter-spacing: 0.04em;
    text-transform: uppercase;
}
.search-ops-examples {
    background: rgba(255, 255, 255, 0.04);
    border: 1px solid var(--border, #2a2a2a);
    border-radius: 4px;
    padding: 12px 14px;
    margin: 0;
    font-family: var(--font-mono, monospace);
    font-size: 0.82rem;
    line-height: 1.55;
    white-space: pre;
    overflow-x: auto;
}

/* Breadcrumb on the server-rendered /scan report page (mirrors the
   BreadcrumbList structured data emitted in scan_result.html). */
.breadcrumb {
    font-size: 0.85rem;
    margin: 0 0 1rem;
    color: var(--text-dim);
}
.breadcrumb a {
    color: var(--text-dim);
    text-decoration: none;
}
.breadcrumb a:hover { text-decoration: underline; }
.breadcrumb-sep { margin: 0 0.4rem; opacity: 0.6; }
.breadcrumb-current { color: var(--text); }