:root {
  --bg: #0d1117;
  --panel: #161b22;
  --panel-2: #1c232c;
  --line: #2b3340;
  --fg: #e6edf3;
  --muted: #9aa7b4;
  --accent: #4493f8;
  --accent-2: #1f6feb;
  --ok: #3fb950;
  --warn: #d29922;
  --crit: #f85149;
  --med: #db8b00;
  --low: #58a6ff;
  --radius: 10px;
  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
}

* { box-sizing: border-box; }
html, body { margin: 0; padding: 0; }
body {
  background: var(--bg);
  color: var(--fg);
  min-height: 100dvh;
  font-size: 15px;
  line-height: 1.45;
}

.topbar {
  display: flex; align-items: center; justify-content: space-between;
  gap: 16px; padding: 14px 22px;
  border-bottom: 1px solid var(--line);
  background: linear-gradient(180deg, #11161d, #0d1117);
  position: sticky; top: 0; z-index: 5;
}
.brand { display: flex; align-items: center; gap: 14px; }
.logo {
  display: grid; place-items: center;
  width: 38px; height: 38px; border-radius: 9px;
  background: linear-gradient(135deg, var(--accent), var(--accent-2));
  color: #fff; font-size: 20px;
}
.title { font-weight: 650; letter-spacing: .2px; }
.subtitle { color: var(--muted); font-size: 12.5px; }
.who {
  background: var(--panel-2); border: 1px solid var(--line);
  padding: 6px 12px; border-radius: 999px; font-size: 13px; color: var(--muted);
  max-width: 40vw; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
}

main { max-width: 920px; margin: 22px auto; padding: 0 18px; display: flex; flex-direction: column; gap: 18px; }

.card {
  background: var(--panel); border: 1px solid var(--line);
  border-radius: var(--radius); padding: 18px 20px;
}
.card h2 { margin: 0 0 14px; font-size: 14px; color: var(--muted); font-weight: 600; text-transform: uppercase; letter-spacing: .6px; }

.grid { display: grid; grid-template-columns: 1fr 1fr; gap: 14px; }
@media (max-width: 620px) { .grid { grid-template-columns: 1fr; } }
label { display: flex; flex-direction: column; gap: 6px; font-size: 13px; color: var(--muted); }
input[type=text] {
  background: var(--bg); border: 1px solid var(--line); color: var(--fg);
  border-radius: 8px; padding: 10px 12px; font-size: 15px; outline: none;
}
input[type=text]:focus { border-color: var(--accent); box-shadow: 0 0 0 3px rgba(68,147,248,.18); }
.hint { color: var(--muted); font-size: 12.5px; margin: 12px 0 0; }

.dropzone {
  border: 1.6px dashed var(--line); border-radius: var(--radius);
  background: var(--panel-2); padding: 34px 20px; text-align: center; cursor: pointer;
  transition: border-color .15s, background .15s;
}
.dropzone:hover, .dropzone:focus-visible { border-color: var(--accent); }
.dropzone.drag { border-color: var(--accent); background: rgba(68,147,248,.08); }
.drop-icon { font-size: 30px; color: var(--accent); }
.drop-text { margin-top: 8px; }
.drop-text .link { color: var(--accent); text-decoration: underline; }
.drop-sub { margin-top: 8px; color: var(--muted); font-size: 12.5px; }
.drop-sub code { background: #0b0f14; border: 1px solid var(--line); border-radius: 5px; padding: 1px 5px; font-size: 11.5px; }

.jobs { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 12px; }
.job { border: 1px solid var(--line); border-radius: 9px; background: var(--panel-2); padding: 13px 15px; }
.job-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
.job-name { font-weight: 600; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; max-width: 55%; }
.job-status { margin-left: auto; color: var(--muted); font-size: 12.5px; }
.job.err .job-status { color: var(--crit); }
.job.done .job-status { color: var(--ok); }

.bar { height: 6px; background: #0b0f14; border-radius: 999px; overflow: hidden; margin: 11px 0 2px; }
.bar-fill { height: 100%; width: 0; background: linear-gradient(90deg, var(--accent), var(--accent-2)); transition: width .2s; }
.job.done .bar-fill { background: var(--ok); }
.job.err .bar-fill { background: var(--crit); }

.badge { font-size: 11px; padding: 2px 8px; border-radius: 999px; border: 1px solid var(--line); color: var(--muted); }
.badge.type { background: #10243f; border-color: #1d3c63; color: #8fc0ff; text-transform: uppercase; letter-spacing: .4px; }

.job-result { margin-top: 12px; border-top: 1px solid var(--line); padding-top: 12px; }
.summary { display: flex; flex-wrap: wrap; gap: 8px 16px; font-size: 13px; color: var(--muted); margin-bottom: 12px; }
.summary b { color: var(--fg); }

.tabs { display: flex; gap: 6px; flex-wrap: wrap; margin-bottom: 10px; }
.tab {
  background: transparent; border: 1px solid var(--line); color: var(--muted);
  padding: 5px 11px; border-radius: 7px; font-size: 12.5px; cursor: pointer;
}
.tab.active { color: var(--fg); border-color: var(--accent); background: rgba(68,147,248,.10); }
.tab .count { color: var(--accent); font-weight: 600; }

.panel { font-size: 13px; }
table { width: 100%; border-collapse: collapse; }
th, td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--line); vertical-align: top; }
th { color: var(--muted); font-weight: 600; font-size: 11.5px; text-transform: uppercase; letter-spacing: .4px; }
td.val { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: 12px; word-break: break-all; }
.sev { font-size: 11px; padding: 1px 7px; border-radius: 999px; border: 1px solid; white-space: nowrap; }
.sev.critical { color: var(--crit); border-color: var(--crit); }
.sev.high { color: var(--crit); border-color: var(--crit); }
.sev.medium { color: var(--med); border-color: var(--med); }
.sev.low { color: var(--low); border-color: var(--low); }
.sev.info { color: var(--muted); border-color: var(--line); }
.empty { color: var(--muted); padding: 8px 2px; }
pre.raw { background: #0b0f14; border: 1px solid var(--line); border-radius: 8px; padding: 12px; overflow: auto; max-height: 360px; font-size: 12px; }

.foot { max-width: 920px; margin: 8px auto 40px; padding: 0 18px; color: var(--muted); font-size: 12px; display: flex; align-items: center; gap: 8px; }
.foot code { background: #0b0f14; border: 1px solid var(--line); border-radius: 5px; padding: 1px 5px; }
.health { color: var(--warn); }
.health.ok { color: var(--ok); }
.health.bad { color: var(--crit); }

/* ===== top nav (Upload / Investigation) ===== */
.modes { display: flex; gap: 6px; margin-left: auto; margin-right: 14px; }
.mode { background: transparent; border: 1px solid var(--line); color: var(--muted); padding: 7px 16px; border-radius: 8px; font-size: 13.5px; cursor: pointer; }
.mode.active { color: var(--fg); border-color: var(--accent); background: rgba(68,147,248,.12); }

.btn { background: linear-gradient(135deg, var(--accent), var(--accent-2)); color: #fff; border: 0; border-radius: 8px; padding: 10px 18px; font-size: 14px; cursor: pointer; margin-top: 12px; }
.btn.ghost { background: transparent; border: 1px solid var(--line); color: var(--muted); margin: 12px auto 0; display: block; }
.link-btn { background: transparent; border: 0; color: var(--accent); cursor: pointer; font-size: 14px; }
.openinv { margin-left: 6px; }

/* ===== case overview: host cards ===== */
.host-cards { display: grid; grid-template-columns: repeat(auto-fill, minmax(240px, 1fr)); gap: 12px; }
.host-card { border: 1px solid var(--line); border-radius: 10px; background: var(--panel-2); padding: 14px; cursor: pointer; transition: border-color .15s, transform .1s; }
.host-card:hover { border-color: var(--accent); transform: translateY(-1px); }
.hc-top { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
.hc-host { font-weight: 650; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.hc-sev { display: flex; gap: 5px; flex-wrap: wrap; margin: 10px 0 8px; }
.hc-meta { color: var(--muted); font-size: 12.5px; }
.hc-file { color: var(--muted); font-size: 11px; margin-top: 4px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }

/* ===== host investigation ===== */
.host-head { display: flex; align-items: center; gap: 16px; padding: 4px 2px 14px; }
.host-name { font-size: 18px; font-weight: 650; }
.host-meta { color: var(--muted); font-size: 12.5px; }
.sev-chips { margin-left: auto; display: flex; gap: 5px; flex-wrap: wrap; }
.investigate { display: grid; grid-template-columns: 200px 1fr; gap: 16px; align-items: start; }
@media (max-width: 720px) { .investigate { grid-template-columns: 1fr; } }
.cat-nav { display: flex; flex-direction: column; gap: 2px; background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 8px; position: sticky; top: 78px; }
.cat-item { display: flex; justify-content: space-between; align-items: center; background: transparent; border: 0; color: var(--muted); text-align: left; padding: 8px 11px; border-radius: 7px; font-size: 13.5px; cursor: pointer; }
.cat-item:hover { background: var(--panel-2); color: var(--fg); }
.cat-item.active { background: rgba(68,147,248,.12); color: var(--fg); }
.cat-item .cn { background: #0b0f14; border: 1px solid var(--line); border-radius: 999px; padding: 0 7px; font-size: 11px; color: var(--accent); }
.cat-main { background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; min-height: 300px; }
.cat-toolbar { display: flex; align-items: center; gap: 12px; margin-bottom: 12px; }
.cat-title { font-weight: 600; }
#catSearch { margin-left: auto; background: var(--bg); border: 1px solid var(--line); color: var(--fg); border-radius: 8px; padding: 7px 11px; font-size: 13px; min-width: 200px; }
.cat-content table.ev td { font-size: 12.5px; }
.cat-content table.ev tbody tr:hover { background: var(--panel-2); }
.ov-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 18px; }
.ov-grid h4 { margin: 0 0 8px; color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .5px; }
.ov-grid table { width: 100%; } .ov-grid td { padding: 4px 6px; }

/* ===== timeline ===== */
.tl { display: flex; flex-direction: column; }
.tl-row { display: grid; grid-template-columns: 150px auto 90px 1fr; gap: 10px; align-items: center; padding: 6px 4px; border-bottom: 1px solid var(--line); font-size: 12.5px; }
.tl-time { color: var(--muted); }
.tl-cat { color: var(--accent); font-size: 11px; }
.tl-msg { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }

/* ===== auto-score badges + row tint ===== */
.score { font-size: 10.5px; font-weight: 700; padding: 1px 7px; border-radius: 999px; letter-spacing: .4px; }
.score.bad { background: #3a1417; color: #ff6b6b; border: 1px solid #f85149; }
.score.suspicious { background: #3a2c12; color: #e3a008; border: 1px solid #d29922; }
.score.good { background: #112417; color: #3fb950; border: 1px solid #2ea043; }
table.ev tr.sc-bad td { background: rgba(248,81,73,.06); }
table.ev tr.sc-suspicious td { background: rgba(210,153,34,.05); }
.host-actions { margin-left: 12px; }
.host-actions .btn { margin: 0; padding: 7px 13px; font-size: 12.5px; }

/* ===== review controls ===== */
select.rv { background: var(--bg); border: 1px solid var(--line); color: var(--muted); border-radius: 6px; padding: 3px 6px; font-size: 11.5px; }
select.rv.noted { border-color: var(--accent); color: var(--accent); }
.rv-cell { white-space: nowrap; }

/* ===== process tree ===== */
.tree { font-size: 12.5px; }
.tnode { display: flex; align-items: center; gap: 8px; padding: 4px 6px; border-left: 2px solid var(--line); margin-bottom: 2px; border-radius: 0 6px 6px 0; }
.tnode.sc-bad { border-left-color: var(--crit); background: rgba(248,81,73,.06); }
.tnode.sc-suspicious { border-left-color: var(--med); background: rgba(210,153,34,.05); }
.tnode:hover { background: var(--panel-2); }
.tn-pid { color: var(--muted); font-family: ui-monospace, monospace; min-width: 52px; }
.tn-name { flex: 1; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.tn-user { color: var(--muted); font-size: 11.5px; }

/* ===== correlation + enrichment + report ===== */
.card-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 12px; }
.card-head h2 { margin: 0; }
.muted-note { color: var(--muted); font-weight: 400; font-size: 12px; text-transform: none; letter-spacing: 0; }
.hostcount { background: #10243f; border: 1px solid #1d3c63; color: #8fc0ff; border-radius: 999px; padding: 1px 8px; font-size: 11.5px; font-weight: 700; }
.enrich-btn { background: transparent; border: 1px solid var(--line); color: var(--muted); border-radius: 6px; padding: 2px 8px; font-size: 11px; cursor: pointer; white-space: nowrap; }
.enrich-btn:hover { border-color: var(--accent); color: var(--accent); }
.enrich-na { color: var(--muted); font-size: 11px; }
.enrich-clean { color: var(--ok); font-size: 11px; }
.enrich-hit { color: var(--crit); font-size: 11px; font-weight: 600; }

/* ===== upload tokens (investigation: mint/list/share) ===== */
.token-create { display: flex; flex-wrap: wrap; gap: 12px; align-items: flex-end; }
.token-create label { display: flex; flex-direction: column; gap: 4px; font-size: 12.5px; color: var(--muted); }
.token-create input[type="text"] { min-width: 240px; }
.token-create input[type="number"] { width: 110px; }
.token-create .btn { margin-top: 0; }
.token-new { margin-top: 14px; padding: 12px 14px; border: 1px solid var(--ok); border-radius: var(--radius); background: rgba(63,185,80,.06); }
.tn-title { font-weight: 700; color: var(--ok); margin-bottom: 8px; font-size: 13px; }
.tn-linkrow { display: flex; gap: 8px; align-items: center; }
.tn-link { flex: 1; font-family: ui-monospace, monospace; font-size: 12px; background: var(--bg); border: 1px solid var(--line); color: var(--fg); border-radius: 6px; padding: 8px 10px; }
.tn-linkrow .btn { margin-top: 0; white-space: nowrap; }
.tn-hint { color: var(--muted); font-size: 12px; margin-top: 8px; }
.token-list { margin-top: 14px; }
.tok-st { border-radius: 999px; padding: 1px 9px; font-size: 11px; font-weight: 700; border: 1px solid var(--line); }
.tok-st.ok { color: var(--ok); border-color: var(--ok); }
.tok-st.bad { color: var(--muted); }
.tok-revoke { margin: 0 !important; padding: 3px 9px; font-size: 11px; }

/* ===== public upload portal (token state + receipt) ===== */
.token-state { margin-top: 10px; font-size: 13px; min-height: 18px; }
.token-state.checking { color: var(--muted); }
.token-state.ok { color: var(--ok); font-weight: 600; }
.token-state.bad { color: var(--crit); font-weight: 600; }
.job-receipt { margin-top: 8px; border-top: 1px solid var(--line); padding-top: 8px; display: grid; gap: 4px; }
.rcpt-row { display: flex; gap: 10px; font-size: 12.5px; }
.rcpt-k { color: var(--muted); min-width: 90px; }
.rcpt-v { font-family: ui-monospace, monospace; word-break: break-all; color: var(--fg); }
.job.ok .job-status { color: var(--ok); }
.job.err .job-status { color: var(--crit); }

/* ===== case list / dashboard (analyst landing) ===== */
.cl-actions { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
.cl-actions label.inline { display: flex; align-items: center; gap: 6px; color: var(--muted); font-size: 12.5px; }
.cl-actions select, .cl-actions input[type="search"] { background: var(--bg); border: 1px solid var(--line); color: var(--fg); border-radius: 7px; padding: 7px 10px; font-size: 13px; }
.cl-actions .btn.ghost { margin: 0; padding: 7px 12px; }
.case-stats { display: grid; grid-template-columns: repeat(auto-fit, minmax(96px, 1fr)); gap: 10px; margin-bottom: 16px; }
.stat { background: var(--panel-2); border: 1px solid var(--line); border-radius: var(--radius); padding: 12px 14px; text-align: center; }
.stat-v { font-size: 24px; font-weight: 700; line-height: 1; }
.stat-l { font-size: 11.5px; color: var(--muted); margin-top: 5px; text-transform: uppercase; letter-spacing: .04em; }
.stat.bad .stat-v { color: var(--crit); }
.stat.susp .stat-v { color: var(--med); }
.case-list-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); gap: 12px; }
.case-card { background: var(--panel-2); border: 1px solid var(--line); border-radius: var(--radius); padding: 14px; cursor: pointer; transition: border-color .12s, transform .12s; }
.case-card:hover { border-color: var(--accent); transform: translateY(-1px); }
.cc-top { display: flex; align-items: center; justify-content: space-between; gap: 10px; margin-bottom: 8px; }
.cc-id { font-weight: 700; font-size: 14px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.cc-badges { display: flex; gap: 5px; flex-shrink: 0; }
.cc-sev { display: flex; gap: 5px; margin-bottom: 8px; flex-wrap: wrap; }
.cc-meta { font-size: 12px; color: var(--muted); }
.cc-foot { font-size: 11px; color: var(--muted); margin-top: 8px; }
.tok-badge { background: #10243f; border: 1px solid #1d3c63; color: #8fc0ff; border-radius: 999px; padding: 1px 8px; font-size: 11px; font-weight: 700; }
.st-analyzing { color: var(--warn); font-size: 11px; font-weight: 600; }
.open-manual { margin-top: 18px; border-top: 1px solid var(--line); padding-top: 12px; }
.open-manual summary { cursor: pointer; color: var(--muted); font-size: 13px; }
.open-manual summary:hover { color: var(--accent); }
.open-manual .grid { margin-top: 12px; }
.ch-left { display: flex; align-items: center; gap: 12px; }
.ch-left h2 { margin: 0; }
.link-btn { background: none; border: 0; color: var(--accent); cursor: pointer; font-size: 13px; padding: 0; }
.link-btn:hover { text-decoration: underline; }

/* ===== collector downloads (public page) ===== */
.downloads { display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 10px; margin-top: 6px; }
.dl-item { display: block; text-decoration: none; background: var(--panel-2); border: 1px solid var(--line); border-radius: var(--radius); padding: 12px 14px; transition: border-color .12s, transform .12s; }
.dl-item:hover { border-color: var(--accent); transform: translateY(-1px); }
.dl-top { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
.dl-os { font-weight: 700; color: var(--fg); }
.dl-size { color: var(--muted); font-size: 12px; }
.dl-name { color: var(--accent); font-size: 12.5px; margin-top: 6px; word-break: break-all; }
.dl-sha { color: var(--muted); font-size: 11px; font-family: ui-monospace, monospace; margin-top: 4px; }