/* Security Dashboard — Defender-inspired dark theme */

:root {
  --bg-primary: #0d1117;
  --bg-secondary: #161b22;
  --bg-card: #1c2128;
  --bg-nav: #0e1726;
  --bg-sidebar: #0a1929;
  --border: #21262d;
  --accent-blue: #4493f8;
  --accent-cyan: #39d2c0;
  --text-primary: #e6edf3;
  --text-secondary: #8b949e;
  --severity-high: #f85149;
  --severity-medium: #d29922;
  --severity-low: #58a6ff;
  --severity-info: #6e7681;
  --status-active: #f85149;
  --status-new: #d29922;
  --status-closed: #3fb950;
  --chart-grid: #21262d;
  --chart-text: #8b949e;
}

/* ── Light theme overrides ─────────────────────────────────────────────────── */

[data-theme="light"] {
  --bg-primary: #f6f8fa;
  --bg-secondary: #ffffff;
  --bg-card: #ffffff;
  --bg-nav: #f0f3f6;
  --bg-sidebar: #ffffff;
  --border: #d1d9e0;
  --accent-blue: #0969da;
  --accent-cyan: #1a7f72;
  --text-primary: #1f2328;
  --text-secondary: #656d76;
  --severity-high: #cf222e;
  --severity-medium: #bf8700;
  --severity-low: #0969da;
  --severity-info: #656d76;
  --status-active: #cf222e;
  --status-new: #bf8700;
  --status-closed: #1a7f37;
  --chart-grid: #d1d9e0;
  --chart-text: #656d76;
}

* { box-sizing: border-box; }

body {
  background: var(--bg-primary);
  color: var(--text-primary);
  font-family: 'Segoe UI', system-ui, -apple-system, sans-serif;
  font-size: 13px;
  margin: 0;
  display: flex;
  min-height: 100vh;
}

/* ── Sidebar (Defender-style left nav) ─────────────────────────────────────── */

.sidebar {
  width: 220px;
  min-height: 100vh;
  background: var(--bg-sidebar);
  border-right: 1px solid var(--border);
  display: flex;
  flex-direction: column;
  position: fixed;
  top: 0;
  left: 0;
  z-index: 100;
}

.sidebar-brand {
  padding: 16px 16px 12px;
  display: flex;
  align-items: center;
  gap: 8px;
  font-size: 14px;
  font-weight: 600;
  color: var(--accent-cyan);
  border-bottom: 1px solid var(--border);
  text-decoration: none;
}

.sidebar-brand svg { flex-shrink: 0; }

.sidebar-nav {
  list-style: none;
  padding: 8px 0;
  margin: 0;
  flex: 1;
}

.sidebar-nav li a {
  display: flex;
  align-items: center;
  gap: 10px;
  padding: 10px 16px;
  color: var(--text-secondary);
  text-decoration: none;
  font-size: 13px;
  transition: background .15s, color .15s;
}

.sidebar-nav li a:hover,
.sidebar-nav li a.active {
  background: rgba(68, 147, 248, 0.08);
  color: var(--accent-blue);
}

.sidebar-nav li a.active {
  border-left: 3px solid var(--accent-blue);
  padding-left: 13px;
}

/* ── Theme toggle button ────────────────────────────────────────────────── */

.theme-toggle {
  display: flex;
  align-items: center;
  gap: 10px;
  padding: 10px 16px;
  border: none;
  background: none;
  color: var(--text-secondary);
  font-size: 13px;
  cursor: pointer;
  width: 100%;
  transition: background .15s, color .15s;
  font-family: inherit;
}

.theme-toggle:hover {
  background: rgba(68, 147, 248, 0.08);
  color: var(--accent-blue);
}

.sidebar-user {
  padding: 12px 16px;
  border-top: 1px solid var(--border);
  display: flex;
  align-items: center;
  gap: 8px;
  font-size: 12px;
  color: var(--text-secondary);
}

.sidebar-user .avatar {
  width: 28px;
  height: 28px;
  border-radius: 50%;
  background: var(--accent-blue);
  color: #fff;
  display: flex;
  align-items: center;
  justify-content: center;
  font-size: 12px;
  font-weight: 600;
}

/* ── Main content ──────────────────────────────────────────────────────────── */

.main-content {
  flex: 1;
  margin-left: 220px;
  padding: 24px 28px;
}

.page-header {
  margin-bottom: 20px;
}

.page-header h2 {
  font-size: 20px;
  font-weight: 600;
  margin: 0 0 4px;
}

.page-header .subtitle {
  color: var(--text-secondary);
  font-size: 13px;
}

/* ── Cards ─────────────────────────────────────────────────────────────────── */

.card {
  background: var(--bg-card);
  border: 1px solid var(--border);
  border-radius: 8px;
  color: var(--text-primary);
}

.card-body { padding: 16px; }

.card-title {
  font-size: 12px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
  margin-bottom: 12px;
}

.card-body canvas { max-height: 260px; }

/* ── KPI cards ─────────────────────────────────────────────────────────────── */

.kpi-card {
  background: var(--bg-card);
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 16px;
  text-align: center;
  cursor: pointer;
  transition: border-color .2s, transform .1s;
}

.kpi-card:hover {
  border-color: var(--accent-blue);
  transform: translateY(-1px);
}

.kpi-card .kpi-value {
  font-size: 28px;
  font-weight: 700;
  margin: 4px 0;
}

.kpi-card .kpi-label {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
}

.kpi-card.severity-high   .kpi-value { color: var(--severity-high); }
.kpi-card.severity-medium  .kpi-value { color: var(--severity-medium); }
.kpi-card.severity-low     .kpi-value { color: var(--severity-low); }
.kpi-card.severity-success .kpi-value { color: var(--status-closed); }

.kpi-card.kpi-critical .kpi-value { color: var(--severity-high); }
.kpi-card.kpi-high     .kpi-value { color: var(--severity-high); }
.kpi-card.kpi-medium   .kpi-value { color: var(--severity-medium); }
.kpi-card.kpi-info     .kpi-value { color: var(--severity-low); }

.kpi-row {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
  gap: 12px;
  margin-bottom: 20px;
}

.kpi-row a.kpi-card { text-decoration: none; color: inherit; }

/* ── KPI grouped — agents left | risk/alerts right ────────────────────────── */
.kpi-grouped {
  display: flex;
  gap: 20px;
  margin-bottom: 20px;
}
.kpi-grouped .kpi-group { flex: 1; }
.kpi-grouped .kpi-group .kpi-row { margin-bottom: 0; }
.kpi-grouped .kpi-group-label {
  font-size: 10px;
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.8px;
  color: var(--text-secondary);
  margin-bottom: 6px;
}
.kpi-grouped .kpi-divider {
  width: 1px;
  background: var(--border);
  align-self: stretch;
  min-height: 60px;
}
@media (max-width: 768px) {
  .kpi-grouped { flex-direction: column; }
  .kpi-grouped .kpi-divider { width: auto; height: 1px; min-height: unset; }
}

/* ── Page title ────────────────────────────────────────────────────────────── */

.page-title {
  font-size: 20px;
  font-weight: 600;
  margin: 0 0 20px;
}

/* ── Chart grids ───────────────────────────────────────────────────────────── */

.chart-grid {
  display: grid;
  grid-template-columns: repeat(3, 1fr);
  gap: 16px;
}

.chart-grid-2 {
  grid-template-columns: repeat(2, 1fr);
}

.card-header {
  font-size: 12px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
  padding: 12px 16px;
  border-bottom: 1px solid var(--border);
  background: transparent;
  display: flex;
  align-items: center;
}

/* ── Data tables ───────────────────────────────────────────────────────────── */

.data-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 12px;
  color: var(--text-primary);
}

.data-table thead th {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
  border-bottom: 1px solid var(--border);
  padding: 8px 12px;
  text-align: left;
}

.data-table td {
  padding: 8px 12px;
  border-bottom: 1px solid var(--border);
  vertical-align: middle;
}

.data-table tbody tr:hover { background: rgba(68,147,248,.06); }

/* ── Severity badges ───────────────────────────────────────────────────────── */

.severity-badge {
  display: inline-block;
  padding: 2px 8px;
  border-radius: 4px;
  font-size: 11px;
  font-weight: 500;
  text-transform: capitalize;
}

.severity-badge.severity-high,
.severity-badge.severity-critical { background: rgba(248,81,73,.15); color: var(--severity-high); }
.severity-badge.severity-medium   { background: rgba(210,153,34,.15); color: var(--severity-medium); }
.severity-badge.severity-low      { background: rgba(88,166,255,.15); color: var(--severity-low); }
.severity-badge.severity-informational { background: rgba(110,118,129,.15); color: var(--severity-info); }

/* ── Go Hunt button ─────────────────────────────────────────────────────────── */

.hunt-btn {
  display: inline-block;
  padding: 2px 8px;
  border-radius: 4px;
  font-size: 11px;
  font-weight: 500;
  white-space: nowrap;
  background: rgba(63,185,80,.12);
  color: #3fb950;
  text-decoration: none;
  border: 1px solid rgba(63,185,80,.25);
  transition: background .15s, border-color .15s;
}
.hunt-btn:hover { background: rgba(63,185,80,.22); border-color: rgba(63,185,80,.5); text-decoration: none; }
[data-theme="light"] .hunt-btn { background: rgba(31,136,61,.08); color: #1a7f37; border-color: rgba(31,136,61,.25); }
[data-theme="light"] .hunt-btn:hover { background: rgba(31,136,61,.16); border-color: rgba(31,136,61,.5); }

/* ── Health badges ─────────────────────────────────────────────────────────── */

.health-badge {
  display: inline-block;
  padding: 2px 8px;
  border-radius: 4px;
  font-size: 11px;
  font-weight: 500;
  text-transform: capitalize;
}
.health-badge.health-active   { background: rgba(63,185,80,.15); color: #3fb950; }
.health-badge.health-inactive { background: rgba(110,118,129,.15); color: var(--text-secondary); }

/* ── Filter bar ────────────────────────────────────────────────────────────── */

.filter-bar {
  display: flex;
  align-items: center;
  gap: 10px;
  margin-bottom: 16px;
  flex-wrap: wrap;
}
.filter-bar label {
  font-size: 13px;
  font-weight: 500;
  color: var(--text-secondary);
}
.filter-select {
  padding: 5px 10px;
  border-radius: 6px;
  border: 1px solid var(--border);
  background: var(--bg-card);
  color: var(--text-primary);
  font-size: 13px;
  cursor: pointer;
}
.filter-toggle {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  cursor: pointer;
}
.filter-toggle input { accent-color: #3fb950; }

/* ── Back button ───────────────────────────────────────────────────────────── */

.btn-back {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 32px;
  height: 32px;
  border-radius: 6px;
  border: 1px solid var(--border);
  background: var(--bg-card);
  color: var(--text-secondary);
  text-decoration: none;
  transition: border-color .15s, color .15s;
}

.btn-back:hover { border-color: var(--accent-blue); color: var(--accent-blue); }

/* ── Run button ────────────────────────────────────────────────────────────── */

.btn-run {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  background: var(--accent-blue);
  color: #fff;
  border: none;
  border-radius: 6px;
  padding: 6px 14px;
  font-size: 12px;
  font-weight: 600;
  cursor: pointer;
  transition: background .15s;
}

.btn-run:hover { background: #3182e0; }
.btn-run:disabled { opacity: .5; cursor: not-allowed; }

/* ── Tables ────────────────────────────────────────────────────────────────── */

.table {
  font-size: 12px;
  color: var(--text-primary);
  --bs-table-bg: transparent;
  --bs-table-striped-bg: rgba(255,255,255,.02);
  --bs-table-hover-bg: rgba(68,147,248,.06);
}

.table thead th {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
  border-bottom: 1px solid var(--border);
  padding: 8px 12px;
}

.table td {
  padding: 8px 12px;
  border-bottom: 1px solid var(--border);
  vertical-align: middle;
}

.table tbody tr { cursor: pointer; }
.table tbody tr:hover { background: rgba(68,147,248,.06); }

/* ── Badges ────────────────────────────────────────────────────────────────── */

.badge { text-transform: capitalize; font-weight: 500; font-size: 11px; }

.badge.bg-danger  { background: rgba(248,81,73,.15) !important; color: var(--severity-high); }
.badge.bg-warning { background: rgba(210,153,34,.15) !important; color: var(--severity-medium); }
.badge.bg-info    { background: rgba(88,166,255,.15) !important; color: var(--severity-low); }
.badge.bg-secondary { background: rgba(110,118,129,.15) !important; color: var(--severity-info); }
.badge.bg-success { background: rgba(63,185,80,.15) !important; color: var(--status-closed); }

/* ── Timeline ──────────────────────────────────────────────────────────────── */

.timeline {
  position: relative;
  padding-left: 32px;
}

.timeline::before {
  content: '';
  position: absolute;
  left: 11px;
  top: 0;
  bottom: 0;
  width: 2px;
  background: var(--border);
}

.timeline-item {
  position: relative;
  padding: 12px 0;
}

.timeline-item::before {
  content: '';
  position: absolute;
  left: -25px;
  top: 18px;
  width: 10px;
  height: 10px;
  border-radius: 50%;
  background: var(--accent-blue);
  border: 2px solid var(--bg-primary);
}

.timeline-item.sev-high::before   { background: var(--severity-high); }
.timeline-item.sev-medium::before { background: var(--severity-medium); }
.timeline-item.sev-low::before    { background: var(--severity-low); }

.timeline-time {
  font-size: 11px;
  color: var(--text-secondary);
  margin-bottom: 2px;
}

.timeline-title {
  font-size: 13px;
  font-weight: 600;
}

.timeline-detail {
  font-size: 12px;
  color: var(--text-secondary);
  margin-top: 2px;
}

/* ── Login page ────────────────────────────────────────────────────────────── */

.login-container {
  display: flex;
  align-items: center;
  justify-content: center;
  min-height: 100vh;
  width: 100%;
  background: var(--bg-primary);
}

.login-box {
  background: var(--bg-card);
  border: 1px solid var(--border);
  border-radius: 12px;
  padding: 40px;
  max-width: 400px;
  width: 100%;
  text-align: center;
}

.login-box h1 {
  font-size: 22px;
  margin-bottom: 8px;
}

.login-box p {
  color: var(--text-secondary);
  margin-bottom: 24px;
}

.btn-entra {
  background: var(--accent-blue);
  color: #fff;
  border: none;
  border-radius: 6px;
  padding: 10px 24px;
  font-size: 14px;
  font-weight: 600;
  cursor: pointer;
  text-decoration: none;
  display: inline-block;
  transition: background .15s;
}

.btn-entra:hover { background: #3182e0; color: #fff; }

/* ── KQL Console ───────────────────────────────────────────────────────────── */

.kql-editor {
  background: var(--bg-secondary);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: 12px;
  font-family: 'Cascadia Code', 'Consolas', monospace;
  font-size: 13px;
  color: var(--accent-cyan);
  width: 100%;
  min-height: 100px;
  resize: vertical;
}

.kql-editor:focus {
  outline: none;
  border-color: var(--accent-blue);
}

/* ── AI Assistant Chat ─────────────────────────────────────────────────────── */

.ai-chat-messages {
  max-height: 400px;
  overflow-y: auto;
  display: flex;
  flex-direction: column;
  gap: 10px;
  padding: 4px 0 12px;
}

.ai-msg {
  padding: 10px 14px;
  border-radius: 8px;
  font-size: 13px;
  line-height: 1.5;
  max-width: 90%;
}

.ai-msg-user {
  background: rgba(68, 147, 248, 0.15);
  border: 1px solid rgba(68, 147, 248, 0.25);
  align-self: flex-end;
  color: var(--accent-blue);
}

.ai-msg-assistant {
  background: var(--bg-secondary);
  border: 1px solid var(--border);
  align-self: flex-start;
  color: var(--text-primary);
}

.ai-msg-assistant em {
  color: var(--text-secondary);
}

.ai-chat-input-row {
  display: flex;
  gap: 8px;
  margin-top: 4px;
}

.ai-chat-input {
  flex: 1;
  background: var(--bg-secondary);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: 10px 14px;
  font-size: 13px;
  color: var(--text-primary);
  font-family: inherit;
}

.ai-chat-input:focus {
  outline: none;
  border-color: var(--accent-cyan);
}

.ai-chat-input::placeholder {
  color: var(--text-secondary);
}

.ai-kql-block {
  background: var(--bg-primary);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: 10px 12px;
  font-family: 'Cascadia Code', 'Consolas', monospace;
  font-size: 12px;
  color: var(--accent-cyan);
  overflow-x: auto;
  margin: 8px 0;
  white-space: pre-wrap;
}

.ai-thinking {
  color: var(--text-secondary);
  font-style: italic;
}

.ai-status-indicator {
  display: flex;
  align-items: center;
  gap: 10px;
}

.ai-status-spinner {
  width: 14px;
  height: 14px;
  border: 2px solid var(--border);
  border-top-color: var(--accent-cyan);
  border-radius: 50%;
  animation: ai-spin 0.8s linear infinite;
}

@keyframes ai-spin {
  to { transform: rotate(360deg); }
}

.ai-status-text {
  color: var(--text-secondary);
  font-style: italic;
}

.ai-status-timer {
  color: var(--accent-cyan);
  font-variant-numeric: tabular-nums;
  font-size: 12px;
  min-width: 30px;
}

.ai-msg .data-table {
  font-size: 12px;
}

/* ── Attack Story ──────────────────────────────────────────────────────────── */

#attack-story-body {
  color: #e6edf3;
  font-size: 13px;
  line-height: 1.7;
}

#attack-story-body strong {
  color: #ffffff;
  font-weight: 600;
}

#attack-story-body .ai-kql-block {
  background: #0d1117;
  color: #58d5ba;
  border: 1px solid #30363d;
}

#attack-story-body .text-danger {
  color: #f85149 !important;
}

#attack-story-body .data-table {
  color: #e6edf3;
}

#attack-story-body .data-table thead th {
  color: #c9d1d9;
}

/* ── Incident Timeline ─────────────────────────────────────────────────────── */

.incident-timeline {
  position: relative;
  padding-left: 24px;
}

.incident-timeline::before {
  content: '';
  position: absolute;
  left: 7px;
  top: 4px;
  bottom: 4px;
  width: 2px;
  background: var(--border);
}

.tl-event {
  position: relative;
  padding-bottom: 20px;
  display: flex;
  gap: 12px;
}

.tl-dot {
  width: 14px;
  height: 14px;
  border-radius: 50%;
  border: 2px solid var(--border);

/* ── Incident search box ── */
.search-input {
  width: 100%;
  padding: 10px 14px;
  background: var(--bg-secondary);
  border: 1px solid var(--border);
  border-radius: 8px;
  color: var(--text-primary);
  font-size: 14px;
}
.search-input::placeholder { color: var(--text-secondary); }
.search-input:focus { outline: none; border-color: var(--accent-blue); }
.search-results-list {
  list-style: none;
  padding: 0;
  margin: 8px 0 0;
}
.search-result-item {
  padding: 10px 12px;
  border-bottom: 1px solid var(--border);
  display: flex;
  justify-content: space-between;
  align-items: center;
}
.search-result-item:hover { background: var(--bg-secondary); }
.search-result-item a {
  color: var(--accent-blue);
  text-decoration: none;
  font-weight: 500;
}
.search-result-item a:hover { text-decoration: underline; }

/* ── Top recommendations ── */
.rec-item {
  display: flex;
  gap: 12px;
  align-items: flex-start;
  padding: 10px 0;
  border-bottom: 1px solid var(--border);
}
.rec-item:last-child { border-bottom: none; }
.rec-rank {
  min-width: 28px;
  height: 28px;
  line-height: 28px;
  text-align: center;
  border-radius: 50%;
  background: var(--accent-blue);
  color: #fff;
  font-weight: 700;
  font-size: 13px;
}
.rec-body { flex: 1; }
.rec-title { color: var(--text-primary); font-weight: 600; font-size: 14px; line-height: 1.4; }
.rec-meta { color: var(--text-secondary); font-size: 12px; margin-top: 2px; }
.rec-remediation {
  font-size: 12px;
  color: var(--text-secondary);
  margin-top: 4px;
  line-height: 1.4;
  opacity: 0.85;
}

/* ── Alert links (incident detail) ── */
.alert-link {
  color: var(--accent-blue);
  text-decoration: none;
  cursor: pointer;
}
.alert-link:hover { text-decoration: underline; }
  background: var(--bg-card);
  position: absolute;
  left: -24px;
  top: 2px;
  z-index: 1;
}

.tl-dot-high { border-color: var(--severity-high); background: rgba(248, 81, 73, 0.2); }
.tl-dot-medium { border-color: var(--severity-medium); background: rgba(210, 153, 34, 0.2); }
.tl-dot-low { border-color: var(--severity-low); background: rgba(88, 166, 255, 0.2); }
.tl-dot-informational { border-color: var(--text-secondary); background: rgba(110, 118, 129, 0.2); }

.tl-content { flex: 1; }

.tl-time {
  font-size: 11px;
  color: var(--text-secondary);
}

.tl-type {
  font-size: 11px;
  font-weight: 600;
  color: var(--accent-blue);
  text-transform: uppercase;
  letter-spacing: 0.5px;
}

.tl-title {
  font-size: 13px;
  color: var(--text-primary);
  margin-top: 2px;
}

/* ── Entity Tags ───────────────────────────────────────────────────────────── */

.entity-grid {
  display: flex;
  flex-wrap: wrap;
  gap: 16px;
}

.entity-group {
  min-width: 160px;
}

.entity-type {
  font-size: 12px;
  font-weight: 600;
  color: var(--accent-cyan);
  margin-bottom: 6px;
}

.entity-tag {
  display: inline-block;
  background: rgba(68, 147, 248, 0.1);
  border: 1px solid rgba(68, 147, 248, 0.2);
  border-radius: 4px;
  padding: 3px 8px;
  font-size: 12px;
  color: var(--text-primary);
  margin: 2px 4px 2px 0;
}

.entity-clickable {
  cursor: pointer;
  transition: background 0.15s, border-color 0.15s;
}

.entity-clickable:hover {
  background: rgba(68, 147, 248, 0.25);
  border-color: var(--accent);
}

.btn-close-sm {
  background: none;
  border: none;
  color: var(--text-secondary);
  font-size: 16px;
  cursor: pointer;
  padding: 2px 6px;
  line-height: 1;
}

.btn-close-sm:hover {
  color: var(--text-primary);
}

/* ── Entity Enrichment Panel ───────────────────────────────────────────────── */

.enrich-grid {
  display: flex;
  flex-direction: column;
  gap: 8px;
}

.enrich-row {
  display: flex;
  align-items: baseline;
  gap: 10px;
  font-size: 13px;
}

.enrich-label {
  color: var(--text-secondary);
  min-width: 120px;
  flex-shrink: 0;
  font-weight: 500;
}

.enrich-value {
  color: var(--text-primary);
  word-break: break-word;
}

.enrich-danger { color: var(--severity-high); font-weight: 600; }
.enrich-warn   { color: var(--severity-medium); font-weight: 600; }
.enrich-ok     { color: var(--severity-informational, #4ade80); font-weight: 600; }

.enrich-section-label {
  font-size: 12px;
  font-weight: 600;
  color: var(--accent-cyan);
  margin: 14px 0 6px;
}

/* ── History Navigation ────────────────────────────────────────────────────── */

.history-select {
  background: var(--bg-secondary);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: 5px 10px;
  font-size: 12px;
  color: var(--text-primary);
  cursor: pointer;
  max-width: 220px;
}

.history-select:focus {
  outline: none;
  border-color: var(--accent-blue);
}

.history-select option {
  background: var(--bg-secondary);
  color: var(--text-primary);
}

.history-label {
  display: block;
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
  margin-bottom: 4px;
}

.history-grid {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
  gap: 12px;
}

.history-banner {
  background: rgba(68, 147, 248, 0.1);
  border: 1px solid rgba(68, 147, 248, 0.2);
  border-radius: 6px;
  padding: 8px 12px;
  font-size: 12px;
  color: var(--accent-blue);
  margin-bottom: 12px;
}

/* ── Light theme element overrides ─────────────────────────────────────────── */

[data-theme="light"] .sidebar-nav li a:hover,
[data-theme="light"] .sidebar-nav li a.active {
  background: rgba(9, 105, 218, 0.08);
}

[data-theme="light"] .data-table tbody tr:hover,
[data-theme="light"] .table tbody tr:hover {
  background: rgba(9, 105, 218, 0.06);
}

[data-theme="light"] .badge.bg-danger  { background: rgba(207,34,46,.12) !important; }
[data-theme="light"] .badge.bg-warning { background: rgba(191,135,0,.12) !important; }
[data-theme="light"] .badge.bg-info    { background: rgba(9,105,218,.12) !important; }
[data-theme="light"] .badge.bg-secondary { background: rgba(101,109,118,.12) !important; }
[data-theme="light"] .badge.bg-success { background: rgba(26,127,55,.12) !important; }

[data-theme="light"] .severity-badge.severity-high,
[data-theme="light"] .severity-badge.severity-critical { background: rgba(207,34,46,.10); }
[data-theme="light"] .severity-badge.severity-medium   { background: rgba(191,135,0,.10); }
[data-theme="light"] .severity-badge.severity-low      { background: rgba(9,105,218,.10); }
[data-theme="light"] .severity-badge.severity-informational { background: rgba(101,109,118,.10); }

[data-theme="light"] .ai-msg-user {
  background: rgba(9, 105, 218, 0.1);
  border-color: rgba(9, 105, 218, 0.2);
}

[data-theme="light"] .ai-kql-block {
  background: #f0f3f6;
  color: #1a7f72;
}

[data-theme="light"] #attack-story-body { color: #1f2328; }
[data-theme="light"] #attack-story-body strong { color: #000; }
[data-theme="light"] #attack-story-body .ai-kql-block { background: #f0f3f6; color: #1a7f72; border-color: #d1d9e0; }

[data-theme="light"] .sidebar {
  box-shadow: 1px 0 3px rgba(0,0,0,.06);
}

/* ── Refresh bar ───────────────────────────────────────────────────────────── */

.refresh-bar {
  display: flex;
  align-items: center;
  gap: 10px;
  margin-bottom: 16px;
  font-size: 12px;
  color: var(--text-secondary);
}

.refresh-bar .cache-status {
  display: flex;
  align-items: center;
  gap: 6px;
}

.refresh-bar .cache-dot {
  width: 8px;
  height: 8px;
  border-radius: 50%;
  display: inline-block;
}

.refresh-bar .cache-dot.cached { background: var(--severity-medium); }
.refresh-bar .cache-dot.live   { background: var(--status-closed); }

.btn-refresh {
  display: inline-flex;
  align-items: center;
  gap: 5px;
  background: transparent;
  color: var(--accent-blue);
  border: 1px solid var(--border);
  border-radius: 6px;
  padding: 4px 12px;
  font-size: 12px;
  font-weight: 500;
  cursor: pointer;
  transition: border-color .15s, background .15s;
}

.btn-refresh:hover { border-color: var(--accent-blue); background: rgba(68, 147, 248, 0.08); }
.btn-refresh:disabled { opacity: .5; cursor: not-allowed; }

.btn-refresh .spinner {
  width: 12px;
  height: 12px;
  border: 2px solid var(--border);
  border-top-color: var(--accent-blue);
  border-radius: 50%;
  animation: ai-spin 0.8s linear infinite;
  display: none;
}

.btn-refresh.loading .spinner { display: inline-block; }
.btn-refresh.loading svg { display: none; }

/* ── Alert detail row ──────────────────────────────────────────────────────── */

.alert-row-clickable { cursor: pointer; }
.alert-row-clickable:hover { background: rgba(68, 147, 248, 0.08) !important; }

.alert-detail-row td {
  padding: 0 !important;
  border-bottom: 1px solid var(--border);
}

.alert-detail-content {
  padding: 12px 16px;
  background: var(--bg-secondary);
  border-left: 3px solid var(--accent-blue);
  font-size: 12px;
  line-height: 1.6;
}

.alert-detail-content .detail-label {
  color: var(--text-secondary);
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  margin-top: 8px;
  margin-bottom: 2px;
}

.alert-detail-content .detail-label:first-child { margin-top: 0; }

.alert-detail-content .detail-value {
  color: var(--text-primary);
}

.alert-detail-content .technique-tag {
  display: inline-block;
  background: rgba(57, 210, 192, 0.12);
  border: 1px solid rgba(57, 210, 192, 0.25);
  border-radius: 4px;
  padding: 2px 6px;
  font-size: 11px;
  color: var(--accent-cyan);
  margin: 2px 4px 2px 0;
}

@media (max-width: 768px) {
  .sidebar { width: 56px; }
  .sidebar-brand span,
  .sidebar-nav li a span,
  .sidebar-user .user-info { display: none; }
  .sidebar-nav li a { justify-content: center; padding: 12px; }
  .main-content { margin-left: 56px; padding: 16px; }
  .chart-grid, .chart-grid-2 { grid-template-columns: 1fr; }
  .kpi-row { grid-template-columns: repeat(2, 1fr); }
}

/* ── MITRE ATT&CK Mapping ─────────────────────────────────────────────────── */

.mitre-section { margin-bottom: 12px; }
.mitre-section:last-child { margin-bottom: 0; }
.mitre-section-label {
  font-size: 11px;
  font-weight: 600;
  color: var(--text-secondary);
  text-transform: uppercase;
  letter-spacing: 0.5px;
  margin-bottom: 6px;
}
.mitre-tags { display: flex; flex-wrap: wrap; gap: 6px; }
.mitre-tag {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  padding: 4px 10px;
  border-radius: 4px;
  font-size: 12px;
  font-weight: 500;
  text-decoration: none;
  transition: background .15s;
}
.mitre-tactic {
  background: rgba(248, 81, 73, 0.12);
  border: 1px solid rgba(248, 81, 73, 0.25);
  color: var(--severity-high);
}
.mitre-tactic:hover { background: rgba(248, 81, 73, 0.22); }
.mitre-technique {
  background: rgba(210, 153, 34, 0.12);
  border: 1px solid rgba(210, 153, 34, 0.25);
  color: var(--severity-medium);
}
.mitre-technique:hover { background: rgba(210, 153, 34, 0.22); }
.mitre-count {
  background: rgba(255,255,255,0.1);
  border-radius: 3px;
  padding: 0 5px;
  font-size: 10px;
  min-width: 16px;
  text-align: center;
}

/* ── Expandable Machine Vulnerabilities ────────────────────────────────────── */

.machine-row:hover { background: rgba(68, 147, 248, 0.06) !important; }
.expand-arrow {
  font-size: 10px;
  color: var(--text-secondary);
  width: 20px;
  text-align: center;
  transition: transform .15s;
}
.vuln-detail-row td { padding: 0 !important; border-bottom: 1px solid var(--border); }
.vuln-panel {
  padding: 12px 16px;
  background: var(--bg-secondary);
  border-left: 3px solid var(--severity-medium);
}
.vuln-summary {
  font-size: 12px;
  font-weight: 600;
  color: var(--severity-medium);
  margin-bottom: 8px;
}
.vuln-inner-table { font-size: 12px; }
.vuln-inner-table th { font-size: 11px; }
.vuln-cve-link {
  color: var(--accent-blue);
  text-decoration: none;
  font-weight: 500;
}
.vuln-cve-link:hover { text-decoration: underline; }
.exploit-yes {
  color: var(--severity-high);
  font-weight: 600;
}
.vuln-loading, .vuln-error, .vuln-none {
  padding: 12px 16px;
  font-size: 12px;
  color: var(--text-secondary);
}
.vuln-error { color: var(--severity-high); }

/* Vuln tabs */
.vuln-tabs {
  display: flex;
  gap: 4px;
  margin-bottom: 10px;
  border-bottom: 1px solid var(--border);
  padding-bottom: 6px;
}
.vuln-tab {
  background: none;
  border: 1px solid transparent;
  border-radius: 4px 4px 0 0;
  color: var(--text-secondary);
  cursor: pointer;
  font-size: 12px;
  padding: 4px 10px;
  transition: color .15s, background .15s;
}
.vuln-tab:hover { color: var(--text-primary); background: var(--bg-card); }
.vuln-tab.active {
  color: var(--accent-blue);
  border-color: var(--border);
  background: var(--bg-card);
  font-weight: 600;
}
.vuln-tab-content.hidden { display: none; }

/* Remediation badge in machine table */
.patch-badge {
  background: rgba(68, 147, 248, 0.12);
  color: var(--accent-blue);
  border: 1px solid rgba(68, 147, 248, 0.3);
  border-radius: 4px;
  font-size: 11px;
  padding: 2px 6px;
  white-space: nowrap;
}
.patch-loading { color: var(--text-secondary); font-size: 11px; }

/* CVE blast-radius */
.blast-btn {
  background: none;
  border: 1px solid var(--border);
  border-radius: 4px;
  color: var(--text-secondary);
  cursor: pointer;
  font-size: 11px;
  padding: 2px 6px;
  transition: color .15s, border-color .15s;
}
.blast-btn:hover { color: var(--text-primary); border-color: var(--accent-blue); }
.blast-count {
  font-size: 11px;
  color: var(--text-secondary);
  margin-left: 6px;
}

/* ── Expandable Improvement Actions ────────────────────────────────────────── */

.action-row:hover { background: rgba(68, 147, 248, 0.06) !important; }
.action-detail-row td { padding: 0 !important; border-bottom: 1px solid var(--border); }
.action-detail-panel {
  padding: 14px 18px;
  background: var(--bg-secondary);
  border-left: 3px solid var(--accent-cyan);
}
.action-field { margin-bottom: 10px; }
.action-field:last-child { margin-bottom: 0; }
.action-field-label {
  font-size: 11px;
  font-weight: 600;
  color: var(--text-secondary);
  text-transform: uppercase;
  letter-spacing: 0.5px;
  margin-bottom: 3px;
}
.action-field-value {
  font-size: 13px;
  color: var(--text-primary);
  line-height: 1.5;
}
.action-meta-grid {
  display: flex;
  flex-wrap: wrap;
  gap: 16px;
  margin-bottom: 10px;
}
.action-meta-item {
  display: flex;
  flex-direction: column;
  gap: 2px;
}
.action-meta-label {
  font-size: 10px;
  font-weight: 600;
  color: var(--text-secondary);
  text-transform: uppercase;
  letter-spacing: 0.5px;
}
.action-meta-value {
  font-size: 13px;
  color: var(--text-primary);
  font-weight: 500;
}
.action-threats { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 4px; }
.action-threat-tag {
  display: inline-block;
  background: rgba(248, 81, 73, 0.1);
  border: 1px solid rgba(248, 81, 73, 0.2);
  border-radius: 4px;
  padding: 3px 8px;
  font-size: 11px;
  color: var(--severity-high);
}
.btn-action-link {
  display: inline-block;
  padding: 5px 14px;
  background: rgba(68, 147, 248, 0.1);
  border: 1px solid rgba(68, 147, 248, 0.25);
  border-radius: 6px;
  color: var(--accent-blue);
  font-size: 12px;
  font-weight: 500;
  text-decoration: none;
  transition: background .15s;
}
.btn-action-link:hover { background: rgba(68, 147, 248, 0.2); }

/* ── Clickable rows ────────────────────────────────────────────────────────── */

.clickable-row { cursor: pointer; }
.clickable-row:hover { background: rgba(68, 147, 248, 0.08) !important; }

.user-link {
  color: var(--accent-blue);
  font-weight: 500;
}

.clickable-row:hover .user-link { text-decoration: underline; }

/* ── Flyout panel ──────────────────────────────────────────────────────────── */

.flyout-overlay {
  position: fixed;
  inset: 0;
  background: rgba(0, 0, 0, 0.45);
  z-index: 200;
  opacity: 0;
  pointer-events: none;
  transition: opacity .2s;
}

.flyout-overlay.active { opacity: 1; pointer-events: auto; }

.flyout-panel {
  position: fixed;
  top: 0;
  right: -520px;
  width: 500px;
  max-width: 90vw;
  height: 100vh;
  background: var(--bg-card);
  border-left: 1px solid var(--border);
  z-index: 201;
  display: flex;
  flex-direction: column;
  transition: right .25s ease;
  overflow: hidden;
}

.flyout-panel.active { right: 0; }

.flyout-header {
  display: flex;
  align-items: center;
  justify-content: space-between;
  padding: 16px 20px;
  border-bottom: 1px solid var(--border);
  background: var(--bg-secondary);
}

.flyout-title {
  font-size: 16px;
  font-weight: 600;
  color: var(--text-primary);
}

.flyout-subtitle {
  font-size: 12px;
  color: var(--text-secondary);
  margin-top: 2px;
}

.flyout-close {
  background: none;
  border: none;
  color: var(--text-secondary);
  font-size: 22px;
  cursor: pointer;
  padding: 4px 8px;
  line-height: 1;
  border-radius: 4px;
  transition: color .15s, background .15s;
}

.flyout-close:hover {
  color: var(--text-primary);
  background: rgba(255, 255, 255, 0.06);
}

.flyout-body {
  flex: 1;
  overflow-y: auto;
  padding: 20px;
}

.flyout-loading {
  color: var(--text-secondary);
  font-style: italic;
  font-size: 13px;
  padding: 20px 0;
}

.flyout-section {
  margin-bottom: 24px;
}

.flyout-section:last-child { margin-bottom: 0; }

.flyout-section-title {
  font-size: 11px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--accent-cyan);
  margin-bottom: 10px;
  padding-bottom: 6px;
  border-bottom: 1px solid var(--border);
}

.flyout-profile-grid {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px;
}

.flyout-field {
  display: flex;
  flex-direction: column;
  gap: 2px;
}

.flyout-field-label {
  font-size: 10px;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.5px;
  color: var(--text-secondary);
}

.flyout-field-value {
  font-size: 13px;
  color: var(--text-primary);
}

.ip-cell {
  font-family: 'Cascadia Code', 'Consolas', monospace;
  font-size: 12px;
}