/* Nepsis — self-contained styles. No CDN, no external fonts: this runs on an
   isolated malware-analysis box.

   Design rule, and the reason this file is short: this is a readout, not a
   product page. Separation is a 1px line, never a shadow. There are no
   gradients, no blur, no decorative animation and one radius. Monospace is the
   default for data (hashes, IPs, counts, timestamps); the sans face is for
   prose and labels only.

   Colour carries meaning in exactly one place — the five risk hues below, which
   match the warehouse explorer and never appear without a number or label
   beside them. Everything else is neutral so that red means something. The
   single accent is for interaction (links, focus, active tab) and is never used
   as a fill. */
:root {
  --bg:       #101215;
  --panel:    #16181c;
  --panel-2:  #1b1e23;
  --line:     #2a2e35;
  --ink:      #e6e8eb;
  --muted:    #878d97;
  --accent:   #d9822b;
  --risk-good: #4a9e5c;
  --risk-warning: #c9922b;
  --risk-serious: #cf7043;
  --risk-critical: #d05353;
  --risk-none: #4a515c;
  --font-sans: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
  --font-mono: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
  --radius: 3px;
}
* { box-sizing: border-box; }
html { color-scheme: dark; }
body {
  margin: 0; min-height: 100vh; background: var(--bg); color: var(--ink);
  font: 13px/1.5 var(--font-sans);
  -webkit-font-smoothing: antialiased;
}
a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }
:focus-visible { outline: 1px solid var(--accent); outline-offset: 2px; }
::selection { background: #3a2a17; }

/* ---------- top bar ---------- */
.topbar {
  display: flex; align-items: stretch; gap: 1.5rem; padding: 0 1rem;
  border-bottom: 1px solid var(--line); position: sticky; top: 0; z-index: 20;
  background: var(--bg);
}
.brand { display: flex; align-items: center; font-weight: 600; color: var(--ink);
         letter-spacing: .04em; font-size: .85rem; text-transform: uppercase; }
.brand:hover { text-decoration: none; }
.tabs { display: flex; gap: 1.1rem; margin-right: auto; }
.tabs a { display: flex; align-items: center; color: var(--muted); font-size: .8rem;
          border-bottom: 1px solid transparent; margin-bottom: -1px; }
.tabs a:hover { color: var(--ink); text-decoration: none; }
.tabs a.active { color: var(--ink); border-bottom-color: var(--accent); }

/* ---------- layout ---------- */
.view { max-width: 1100px; margin: 0; padding: 1.25rem 1rem 4rem; display: grid; gap: 1.25rem; }
.card { border: 1px solid var(--line); background: var(--panel); padding: .9rem 1rem; }
.card-head { display: flex; align-items: baseline; justify-content: space-between; gap: 1rem;
             flex-wrap: wrap; margin-bottom: .5rem; }
.cols { display: grid; grid-template-columns: repeat(auto-fit, minmax(19rem, 1fr)); gap: 1.25rem; }
.crumbs { font-size: .8rem; }
h1 { font-size: 1.15rem; margin: 0 0 .2rem; font-weight: 600; }
h2, h3 { font-size: .68rem; text-transform: uppercase; letter-spacing: .1em; color: var(--muted);
         font-family: var(--font-mono); font-weight: 400; margin: 0 0 .5rem; }
h3 { margin: .9rem 0 .3rem; }
p { margin: .35rem 0; }
.muted { color: var(--muted); }
.small { font-size: .8rem; }
.mono { font-family: var(--font-mono); font-size: .82rem; }
.err-text { color: var(--risk-critical); }
.warn-text { color: var(--risk-warning); }
.ok-text  { color: var(--risk-good); }
.copy { cursor: pointer; }
code { background: var(--panel-2); border: 1px solid var(--line); padding: 0 .25rem;
       font-family: var(--font-mono); font-size: .8rem; }

/* ---------- forms ---------- */
form { display: grid; gap: .6rem; }
.row { display: flex; flex-wrap: wrap; gap: .6rem; align-items: end; }
.row.tight { gap: .4rem; }
label { display: grid; gap: .25rem; font-size: .7rem; color: var(--muted);
        font-family: var(--font-mono); text-transform: uppercase; letter-spacing: .06em; }
label.check { display: flex; align-items: center; gap: .4rem; text-transform: none;
              letter-spacing: 0; font-family: var(--font-sans); font-size: .8rem; }
label.grow { flex: 1 1 20rem; }
input[type=text], input[type=number], input[type=search], input[type=password], select, textarea {
  background: var(--bg); border: 1px solid var(--line); color: var(--ink);
  padding: .4rem .5rem; min-width: 8rem; font: 13px/1.5 var(--font-sans); border-radius: var(--radius);
}
input:focus, select:focus, textarea:focus { outline: none; border-color: var(--accent); }
input[type=checkbox] { accent-color: var(--accent); }

/* One input, one action. The analyst pastes what they have — a file, or a
   sha256 — and the box works out which it is. */
.dropzone { border: 1px dashed var(--line); padding: 1.5rem 1rem; text-align: center;
            cursor: pointer; color: var(--muted); border-radius: var(--radius); }
.dropzone.over, .dropzone:hover { border-color: var(--accent); color: var(--ink); }
.dropzone input[type=file] { display: none; }
.dropzone .hint { display: block; font-size: .78rem; margin-top: .3rem; }
.hashbox { width: 100%; font-family: var(--font-mono); }

button {
  background: transparent; color: var(--ink); border: 1px solid var(--line);
  border-radius: var(--radius); padding: .4rem .9rem; font: inherit; cursor: pointer;
}
button:hover { border-color: var(--muted); }
button:disabled { opacity: .45; cursor: progress; }
button.primary { border-color: var(--accent); color: var(--accent); }
button.small-btn, button.ghost { padding: .2rem .5rem; font-size: .76rem; }
.ghost-link { font-size: .78rem; }
.link-btn { background: none; border: 0; color: var(--accent); font: inherit; font-size: .76rem;
            cursor: pointer; padding: 0 .2rem; }
.link-btn.drop { color: var(--muted); }
.link-btn.drop:hover { color: var(--risk-critical); }

/* ---------- flash ---------- */
.flash { position: fixed; right: 1rem; bottom: 1rem; max-width: 28rem; z-index: 40;
         padding: .6rem .8rem; font-size: .85rem; background: var(--panel-2);
         border: 1px solid var(--line); border-left-width: 2px; }
.flash.ok { border-left-color: var(--risk-good); }
.flash.err { border-left-color: var(--risk-critical); }

/* ---------- tables: dense on purpose. 40 rows on screen, not 12. ---------- */
table { width: 100%; border-collapse: collapse; font-size: .82rem;
        font-variant-numeric: tabular-nums; }
th { text-align: left; font-weight: 400; color: var(--muted); font-size: .66rem;
     text-transform: uppercase; letter-spacing: .08em; padding: .3rem .5rem;
     border-bottom: 1px solid var(--line); font-family: var(--font-mono); }
td { padding: .35rem .5rem; border-bottom: 1px solid var(--line); vertical-align: top; }
tbody tr:hover td { background: var(--panel-2); }
tr:last-child td { border-bottom: 0; }
td.actions { text-align: right; white-space: nowrap; }
table.sub { margin-top: .3rem; }

/* ---------- status, risk, meters ---------- */
.pill { font-family: var(--font-mono); font-size: .72rem; color: var(--muted); }
.pill.running, .pill.queued, .pill.received { color: var(--risk-warning); }
.pill.completed, .pill.succeeded { color: var(--risk-good); }
.pill.failed, .pill.rejected { color: var(--risk-critical); }
.pill.detonated { color: var(--muted); }
/* cache hits are provenance, not a category — one glyph, explained on hover */
.cache-glyph { color: var(--accent); cursor: help; font-size: .8rem; }
.tag { display: inline-block; padding: 0 .3rem; font-size: .7rem; font-family: var(--font-mono);
       border: 1px solid var(--line); color: var(--muted); border-radius: var(--radius); }
.tag.on { color: var(--risk-good); }
.tag.hot { color: var(--risk-serious); border-color: var(--risk-serious); }
.tag.lat { color: var(--accent); border-color: var(--accent); }
.badge.breach { color: var(--risk-critical); border: 1px solid var(--risk-critical);
                padding: 0 .3rem; font-size: .7rem; font-family: var(--font-mono);
                border-radius: var(--radius); }
.score { font-family: var(--font-mono); font-weight: 600; }
.risk-good .score, .score.risk-good { color: var(--risk-good); }
.risk-warning .score, .score.risk-warning { color: var(--risk-warning); }
.risk-serious .score, .score.risk-serious { color: var(--risk-serious); }
.risk-critical .score, .score.risk-critical { color: var(--risk-critical); }
.risk-dot { width: 7px; height: 7px; display: inline-block; background: var(--risk-none); }
.risk-dot.risk-good { background: var(--risk-good); }
.risk-dot.risk-warning { background: var(--risk-warning); }
.risk-dot.risk-serious { background: var(--risk-serious); }
.risk-dot.risk-critical { background: var(--risk-critical); }
.meter { width: 9rem; height: 3px; background: var(--line); }
.meter > span { display: block; height: 100%; background: currentColor; }
.bar { width: 5rem; height: 3px; background: var(--line); display: inline-block;
       vertical-align: middle; }
.bar > span { display: block; height: 100%; background: var(--muted); }

/* ---------- report header ---------- */
.hero-main { display: flex; justify-content: space-between; align-items: center; gap: 1.5rem;
             flex-wrap: wrap; }
.verdict { display: flex; align-items: center; gap: .8rem; }
.verdict.risk-good { color: var(--risk-good); }
.verdict.risk-warning { color: var(--risk-warning); }
.verdict.risk-serious { color: var(--risk-serious); }
.verdict.risk-critical { color: var(--risk-critical); }
.score-big { font-size: 2rem; font-weight: 600; font-family: var(--font-mono); line-height: 1; }
.verdict-name { font-weight: 600; margin-bottom: .25rem; font-size: .95rem; }
.facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(7rem, 1fr));
         gap: .5rem; margin-top: .9rem; }
.facts.compact { margin: 0; flex: 1 1 28rem; }
.fact { display: grid; gap: .1rem; font-size: .82rem; }
.fact .muted { font-size: .64rem; text-transform: uppercase; letter-spacing: .07em;
               font-family: var(--font-mono); }
.hero-foot { display: flex; justify-content: space-between; align-items: flex-end; gap: 1rem;
             flex-wrap: wrap; margin-top: .9rem; }
.actions-row { display: flex; gap: .4rem; align-items: center; flex-wrap: wrap; }
.assess { font-size: .9rem; line-height: 1.6; }
.tag-row { display: flex; flex-wrap: wrap; gap: .3rem; margin-top: .7rem; }
.run-details { margin-top: .9rem; }

/* "can I believe this verdict" — the line that decides whether an analyst acts */
.trust { margin-top: .8rem; padding: .5rem .7rem; font-size: .85rem;
         border: 1px solid var(--line); border-left-width: 2px; background: var(--panel-2); }
.trust.ok { border-left-color: var(--risk-good); }
.trust.warn { border-left-color: var(--risk-warning); }
.trust.bad { border-left-color: var(--risk-critical); }
.trust a { margin-left: .3rem; }

/* ---------- report tabs ---------- */
.rtabs { display: flex; gap: 1.1rem; flex-wrap: wrap; border-bottom: 1px solid var(--line); }
.rtabs a { padding: .4rem 0; color: var(--muted); border-bottom: 1px solid transparent;
           margin-bottom: -1px; font-size: .82rem; display: flex; align-items: center; gap: .35rem; }
.rtabs a:hover { color: var(--ink); text-decoration: none; }
.rtabs a.active { color: var(--ink); border-bottom-color: var(--accent); }
.tab-count { font-size: .68rem; font-family: var(--font-mono); color: var(--muted); }

/* ---------- ATT&CK chain graph ---------- */
.graph-wrap { overflow-x: auto; border: 1px solid var(--line); padding: .5rem; }
#chain-svg { display: block; }
.g-col { fill: var(--muted); font-size: 10px; text-transform: uppercase; letter-spacing: .08em; }
.g-edge { fill: none; stroke: var(--line); stroke-width: 1.5; }
.g-arrow { fill: var(--line); }
.g-node circle { fill: var(--risk-none); stroke: var(--panel); stroke-width: 2; cursor: pointer; }
.g-node.risk-good circle { fill: var(--risk-good); }
.g-node.risk-warning circle { fill: var(--risk-warning); }
.g-node.risk-serious circle { fill: var(--risk-serious); }
.g-node.risk-critical circle { fill: var(--risk-critical); }
.g-node.lat circle { stroke: var(--accent); }
.g-node:hover circle { stroke: var(--ink); }
.g-step { fill: var(--bg); font-size: 10px; font-weight: 700; pointer-events: none; }
.g-label { fill: var(--muted); font-size: 9px; font-family: var(--font-mono); pointer-events: none; }
/* ghost nodes/edges read as "would happen", not "did happen" */
.g-node.ghost circle { fill-opacity: .25; stroke: var(--muted); stroke-dasharray: 3 2.5; }
.g-node.ghost .g-step { fill: var(--ink); }
.g-node.ghost .g-label { fill: var(--muted); font-style: italic; }
.g-edge.ghost { stroke: var(--muted); stroke-dasharray: 4 4; }
.g-arrow.ghost { fill: var(--muted); }
.legend { display: flex; gap: 1rem; flex-wrap: wrap; margin-top: .5rem; font-size: .75rem;
          color: var(--muted); }
.legend-item { display: flex; align-items: center; gap: .3rem; }
.lat-dot { width: 7px; height: 7px; border: 1px solid var(--accent); display: inline-block; }
.ghost-dot { width: 7px; height: 7px; border: 1px dashed var(--muted); display: inline-block; }
.tip { position: fixed; pointer-events: none; opacity: 0; transition: opacity .1s; z-index: 50;
       background: var(--panel-2); border: 1px solid var(--line); padding: .5rem .6rem;
       font-size: .78rem; max-width: 24rem; line-height: 1.45; }
.tip-title { font-weight: 600; margin-bottom: .3rem; }
.tip p { margin: .3rem 0; }
.tip-warn { margin-top: .4rem; padding-top: .35rem; border-top: 1px solid var(--line);
            color: var(--risk-warning); display: grid; gap: .2rem; }
.score-big.has-tip { cursor: help; outline: none; }
.tip-hint { font-size: .6rem; vertical-align: super; opacity: .5; margin-left: .1rem; }

/* ---------- ATT&CK matrix ---------- */
.view-toggle { display: flex; gap: .3rem; margin-bottom: .5rem; }
.view-toggle button.active { border-color: var(--accent); color: var(--accent); }
.matrix { display: flex; gap: .5rem; overflow-x: auto; padding-bottom: .3rem; }
.matrix-col { flex: 0 0 11.5rem; display: grid; gap: .25rem; align-content: start; }
.matrix-head { font-size: .64rem; text-transform: uppercase; letter-spacing: .07em;
               color: var(--muted); font-family: var(--font-mono); display: flex;
               justify-content: space-between; border-bottom: 1px solid var(--line);
               padding-bottom: .25rem; }
.matrix-cell { display: grid; gap: .1rem; padding: .3rem .4rem; background: var(--panel-2);
               border-left: 2px solid var(--risk-none); }
.matrix-cell.risk-good { border-left-color: var(--risk-good); }
.matrix-cell.risk-warning { border-left-color: var(--risk-warning); }
.matrix-cell.risk-serious { border-left-color: var(--risk-serious); }
.matrix-cell.risk-critical { border-left-color: var(--risk-critical); }
.matrix-cell.lat { outline: 1px solid var(--accent); outline-offset: -1px; }
.matrix-cell.ghost { background: transparent; border-left-style: dashed; opacity: .7; }
.cell-name { font-size: .7rem; color: var(--muted); }

/* ---------- lists ---------- */
.kv { display: flex; gap: .5rem; align-items: baseline; flex-wrap: wrap; margin-bottom: .2rem; }
.kv > .muted:first-child { min-width: 6rem; font-size: .66rem; text-transform: uppercase;
                           letter-spacing: .06em; font-family: var(--font-mono); }
ul.events, ul.sig-list, ul.ptree, ul.mono-list { list-style: none; margin: .2rem 0 0; padding: 0;
                                                 display: grid; gap: .2rem; }
ul.events li, ul.sig-list li { border-left: 1px solid var(--line); padding-left: .6rem; }
ul.sig-list li { display: flex; gap: .5rem; align-items: flex-start; }
.sev { flex: 0 0 auto; width: 1.15rem; height: 1.15rem; display: grid; place-items: center;
       font-size: .68rem; font-weight: 700; font-family: var(--font-mono);
       border: 1px solid var(--line); color: var(--muted); }
.sev-1, .sev-2 { color: var(--risk-warning); border-color: var(--risk-warning); }
.sev-3 { color: var(--risk-serious); border-color: var(--risk-serious); }
.sev-4, .sev-5 { color: var(--risk-critical); border-color: var(--risk-critical); }
ul.ptree li { padding-left: calc(var(--depth, 0) * 1rem); border-left: 1px solid var(--line);
              padding-top: .1rem; }
.cmd { white-space: nowrap; overflow: hidden; text-overflow: ellipsis; max-width: 100%; }
ul.mono-list li { display: flex; align-items: baseline; justify-content: space-between; gap: .5rem;
                  border-left: 1px solid var(--line); padding: .05rem .4rem; overflow: hidden; }
ul.mono-list li .mono { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
ul.mono-list li button { opacity: 0; flex: 0 0 auto; }
ul.mono-list li:hover button { opacity: 1; }
details.behave { border-top: 1px solid var(--line); padding: .4rem 0; }
details.behave summary { cursor: pointer; font-size: .82rem; }
.counts { display: flex; flex-wrap: wrap; gap: .5rem; margin-top: .6rem; }
.count-chip { font-size: .72rem; font-family: var(--font-mono); color: var(--muted); }
.chip-row { display: flex; flex-wrap: wrap; align-items: center; gap: .35rem; margin: .5rem 0; }
.chip { display: inline-flex; align-items: center; gap: .35rem; padding: .15rem .45rem;
        border: 1px solid var(--line); font-size: .78rem; }
.chip.ghost { border-style: dashed; }
.arrow { color: var(--muted); }
tr.on-path td { background: var(--panel-2); }
.family { color: var(--accent); }
.tag-chip { display: inline-flex; align-items: center; gap: .1rem; }
.inline-form { display: flex; gap: .4rem; align-items: center; margin-top: .5rem; }
.inline-form input { flex: 1 1 16rem; }

/* ---------- anti-sandbox highlight ---------- */
.evasion-card.clear { border-left: 2px solid var(--risk-good); }
.evasion-card.weak { border-left: 2px solid var(--risk-warning); }
.evasion-card.strong { border-left: 2px solid var(--risk-serious); }
.evasion-card.critical { border-left: 2px solid var(--risk-critical); }
.suppressed { border: 1px solid var(--line); border-left: 2px solid var(--risk-critical);
              padding: .7rem; margin: .6rem 0; background: var(--panel-2); }
.suppressed.soft { border-left-color: var(--risk-warning); }
.suppressed ul { margin: .3rem 0 .4rem 1rem; padding: 0; font-size: .82rem; }
.breach-card.reached { border-left: 2px solid var(--risk-critical); }

/* ---------- identity ---------- */
.whoami { display: flex; align-items: center; gap: .5rem; font-size: .78rem; white-space: nowrap; }
.whoami .who { color: var(--ink); }
.role-chip { font-size: .64rem; font-family: var(--font-mono); text-transform: uppercase;
             letter-spacing: .06em; color: var(--muted); }
.login-wrap { min-height: 60vh; display: grid; place-items: center; }
.login { width: min(22rem, 92vw); }
.login label { font-size: .7rem; }
.login input, .login button { width: 100%; }
.login .err-text { margin-top: .5rem; font-size: .82rem; }
.setup-note { font-size: .82rem; line-height: 1.6; }
.setup-note code { display: block; margin: .5rem 0; padding: .4rem .5rem; }
.key-token { word-break: break-all; background: var(--panel-2); border: 1px solid var(--line);
             border-left: 2px solid var(--risk-warning); padding: .6rem; margin-top: .5rem; }

/* ---------- search ---------- */
.search { margin: 0; display: flex; align-items: center; }
.search input { width: 13rem; font-size: .8rem; padding: .25rem .5rem; }
.search input:focus { width: 20rem; }
.kind-chip { font-family: var(--font-mono); font-size: .72rem; color: var(--accent); }
.match { display: inline-flex; gap: .3rem; align-items: baseline; margin: .05rem .3rem .05rem 0;
         font-size: .76rem; max-width: 100%; }
.match .where { color: var(--muted); font-size: .64rem; font-family: var(--font-mono);
                text-transform: uppercase; white-space: nowrap; }
.match .what { font-family: var(--font-mono); overflow: hidden; text-overflow: ellipsis;
               white-space: nowrap; }
mark { background: #4a3a17; color: var(--ink); padding: 0 .1rem; }

/* ---------- auth-disabled warning ---------- */
.auth-warning { background: var(--risk-critical); color: #150303; padding: .45rem 1rem;
                font-size: .82rem; position: sticky; top: 0; z-index: 30; }
.auth-warning code { background: rgba(0, 0, 0, .2); color: inherit; border-color: transparent; }

/* ---------- live progress ---------- */
.progress-chip { display: inline-flex; align-items: center; gap: .3rem; font-size: .74rem;
                 font-family: var(--font-mono); color: var(--risk-warning); white-space: nowrap; }
.progress-chip .spinner { width: 7px; height: 7px; border-radius: 50%;
                          border: 1px solid var(--line); border-top-color: var(--risk-warning);
                          animation: spin 1s linear infinite; }
.progress-chip.pending { color: var(--muted); }
.progress-chip.pending .spinner { border-top-color: var(--muted); animation-duration: 2s; }
@keyframes spin { to { transform: rotate(360deg); } }
@media (prefers-reduced-motion: reduce) { .progress-chip .spinner { animation: none; } }

@media (max-width: 700px) {
  .topbar { flex-wrap: wrap; gap: .6rem; padding-bottom: .4rem; }
  .search input, .search input:focus { width: 100%; }
  .facts { grid-template-columns: repeat(2, 1fr); }
}