/*
 * The one stylesheet. Every custom property and every rule below is taken
 * from docs/design.html; what is not here is the review chrome — the tabs,
 * the browser frames and the annotation columns, which belong to the review
 * page and not to the product.
 *
 * The three typefaces are served from static/fonts/ rather than from
 * fonts.googleapis.com, because a page that fetches from Google tells Google
 * every time somebody in this lab authorizes an MCP server. Every stack still
 * ends in a system font, so a font that fails to load costs nothing but the
 * shapes.
 */

/* Two of the three files are variable fonts, which is why one @font-face
   covers a weight range: Google serves the same URL for every weight of
   Bricolage Grotesque and of IBM Plex Sans. font-display: swap is the whole
   point of self-hosting them — text is readable from the first paint and the
   face arrives when it arrives. */
@font-face {
  font-family: "Bricolage Grotesque";
  src: url("fonts/bricolage-grotesque-variable-latin.woff2") format("woff2");
  font-weight: 500 700;
  font-style: normal;
  font-display: swap;
}

@font-face {
  font-family: "IBM Plex Sans";
  src: url("fonts/ibm-plex-sans-variable-latin.woff2") format("woff2");
  font-weight: 400 600;
  font-style: normal;
  font-display: swap;
}

@font-face {
  font-family: "IBM Plex Mono";
  src: url("fonts/ibm-plex-mono-400-latin.woff2") format("woff2");
  font-weight: 400;
  font-style: normal;
  font-display: swap;
}

@font-face {
  font-family: "IBM Plex Mono";
  src: url("fonts/ibm-plex-mono-500-latin.woff2") format("woff2");
  font-weight: 500;
  font-style: normal;
  font-display: swap;
}

:root {
  --ground: #F2F4F7;
  --paper: #FFFFFF;
  --paper-2: #F7F8FA;
  --line: #D8DDE4;
  --line-strong: #B9C1CC;
  --ink: #121820;
  --ink-2: #3D4854;
  --muted: #6B7683;
  --accent: #3538A6;
  --accent-ink: #FFFFFF;
  --accent-soft: #E7E8F8;
  --ok: #1B7A3E;
  --ok-soft: #E3F3E8;
  --warn: #9A5B0A;
  --warn-soft: #FBEEDB;
  --bad: #B3261E;
  --bad-soft: #FBE5E3;
  --focus: #3538A6;
  --shadow: 0 1px 0 rgba(18, 24, 32, .04), 0 12px 32px -16px rgba(18, 24, 32, .25);
  --radius: 6px;
  --font-display: "Bricolage Grotesque", "IBM Plex Sans", "Helvetica Neue", Arial, sans-serif;
  --font-body: "IBM Plex Sans", "Helvetica Neue", Arial, sans-serif;
  --font-mono: "IBM Plex Mono", "SFMono-Regular", Menlo, Consolas, monospace;
  color-scheme: light;
}

@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) {
    --ground: #0E1217;
    --paper: #161B22;
    --paper-2: #1C222B;
    --line: #2A323D;
    --line-strong: #3B4552;
    --ink: #E8ECF1;
    --ink-2: #B8C0CA;
    --muted: #8B95A1;
    --accent: #9DA0F5;
    --accent-ink: #0E1217;
    --accent-soft: #22254A;
    --ok: #5CC985;
    --ok-soft: #12291B;
    --warn: #E0A24A;
    --warn-soft: #2E2210;
    --bad: #F0776F;
    --bad-soft: #341715;
    --focus: #9DA0F5;
    --shadow: 0 1px 0 rgba(0, 0, 0, .4), 0 12px 32px -16px rgba(0, 0, 0, .7);
    color-scheme: dark;
  }
}

:root[data-theme="dark"] {
  --ground: #0E1217;
  --paper: #161B22;
  --paper-2: #1C222B;
  --line: #2A323D;
  --line-strong: #3B4552;
  --ink: #E8ECF1;
  --ink-2: #B8C0CA;
  --muted: #8B95A1;
  --accent: #9DA0F5;
  --accent-ink: #0E1217;
  --accent-soft: #22254A;
  --ok: #5CC985;
  --ok-soft: #12291B;
  --warn: #E0A24A;
  --warn-soft: #2E2210;
  --bad: #F0776F;
  --bad-soft: #341715;
  --focus: #9DA0F5;
  --shadow: 0 1px 0 rgba(0, 0, 0, .4), 0 12px 32px -16px rgba(0, 0, 0, .7);
  color-scheme: dark;
}

* { box-sizing: border-box; }

body {
  margin: 0;
  background: var(--ground);
  color: var(--ink);
  font-family: var(--font-body);
  font-size: 15px;
  line-height: 1.5;
  -webkit-font-smoothing: antialiased;
}

h1, h2, h3 {
  font-family: var(--font-display);
  font-weight: 600;
  letter-spacing: -0.01em;
  text-wrap: balance;
  margin: 0;
}

code, .mono {
  font-family: var(--font-mono);
  font-size: 0.93em;
}

a { color: var(--accent); }
:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }

@media (prefers-reduced-motion: reduce) {
  * { transition: none !important; animation: none !important; }
}

/* ---- shell ---- */
.page {
  max-width: 760px;
  margin: 24px auto;
  background: var(--paper);
  border: 1px solid var(--line);
  border-radius: 10px;
  box-shadow: var(--shadow);
  overflow: hidden;
}

@media (max-width: 720px) {
  .page { margin: 0; border-radius: 0; border-left: 0; border-right: 0; }
}

.wordmark {
  font-family: var(--font-mono);
  font-size: 13px;
  letter-spacing: .08em;
  text-transform: uppercase;
  color: var(--ink-2);
  display: inline-flex;
  align-items: center;
  gap: 8px;
}

.wordmark::before {
  content: "";
  width: 10px;
  height: 10px;
  border-radius: 2px;
  background: var(--accent);
  transform: rotate(45deg) scale(.8);
  display: inline-block;
}

.eyebrow {
  font-family: var(--font-mono);
  font-size: 12px;
  letter-spacing: .08em;
  text-transform: uppercase;
  color: var(--muted);
}

.btn {
  font: inherit;
  font-weight: 600;
  font-size: 15px;
  padding: 10px 18px;
  border-radius: var(--radius);
  border: 1px solid transparent;
  cursor: pointer;
  display: inline-flex;
  align-items: center;
  gap: 8px;
}

.btn-primary { background: var(--accent); color: var(--accent-ink); }
.btn-secondary { background: var(--paper); color: var(--ink); border-color: var(--line-strong); }
.btn-danger { background: var(--paper); color: var(--bad); border-color: var(--line-strong); }

.pill {
  display: inline-flex;
  align-items: center;
  gap: 6px;
  font-family: var(--font-mono);
  font-size: 11.5px;
  letter-spacing: .02em;
  padding: 2px 8px;
  border-radius: 999px;
  border: 1px solid var(--line);
  color: var(--ink-2);
  background: var(--paper-2);
  white-space: nowrap;
}

.pill.doc { border-color: var(--accent); color: var(--accent); background: var(--accent-soft); }
.pill.dyn { border-color: var(--warn); color: var(--warn); background: var(--warn-soft); }
.pill.ok { border-color: var(--ok); color: var(--ok); background: var(--ok-soft); }
.pill.bad { border-color: var(--bad); color: var(--bad); background: var(--bad-soft); }

/* ---- consent ---- */
.consent-top {
  display: flex;
  justify-content: space-between;
  align-items: center;
  gap: 12px;
  flex-wrap: wrap;
  padding: 12px 28px;
  border-bottom: 1px solid var(--line);
  font-size: 13px;
  color: var(--muted);
}

.consent-top .who b { color: var(--ink); font-weight: 500; }

.consent { padding: 40px 28px 44px; }
.consent h1 { font-size: 30px; margin: 10px 0 26px; line-height: 1.15; }

.consent h1 .res {
  font-family: var(--font-mono);
  font-weight: 500;
  font-size: 0.86em;
  background: var(--accent-soft);
  color: var(--accent);
  padding: 1px 8px;
  border-radius: 4px;
  white-space: nowrap;
}

.block { border-top: 1px solid var(--line); padding: 18px 0; }

.block h2 {
  font-size: 13px;
  font-family: var(--font-mono);
  letter-spacing: .08em;
  text-transform: uppercase;
  color: var(--muted);
  font-weight: 500;
  margin-bottom: 10px;
}

.provenance { display: flex; flex-wrap: wrap; align-items: baseline; gap: 6px 12px; }

.provenance .host {
  font-family: var(--font-display);
  font-weight: 700;
  font-size: 26px;
  letter-spacing: -0.01em;
  word-break: break-all;
}

.provenance .path { font-family: var(--font-mono); color: var(--muted); font-size: 13.5px; word-break: break-all; }
.provenance .meta { flex-basis: 100%; display: flex; gap: 8px; flex-wrap: wrap; margin-top: 4px; }

.gets { list-style: none; margin: 0; padding: 0; display: grid; gap: 8px; }
.gets li { display: grid; grid-template-columns: 18px 1fr; gap: 10px; align-items: start; color: var(--ink-2); }
.gets li b { color: var(--ink); font-weight: 500; }

.gets li i {
  width: 18px;
  height: 18px;
  border-radius: 50%;
  border: 1.5px solid var(--line-strong);
  display: block;
  margin-top: 2px;
  position: relative;
}

.gets li i::after { content: ""; position: absolute; inset: 4px; border-radius: 50%; background: var(--accent); }

/* The localhost note. Quiet on purpose: it is true of every native client, so
   it has to read as a fact worth checking rather than as an alarm — an alarm
   shown every time is an alarm nobody reads. */
.consent .warn {
  margin: 12px 0 0;
  padding: 9px 11px;
  border-left: 2px solid var(--warn);
  background: var(--warn-soft);
  color: var(--ink-2);
  font-size: 13px;
  line-height: 1.5;
}

.remember { display: flex; gap: 10px; align-items: start; color: var(--ink-2); font-size: 14px; }
.remember input { margin-top: 4px; accent-color: var(--accent); }

.actions { display: flex; gap: 10px; justify-content: flex-end; padding-top: 22px; border-top: 1px solid var(--line); }
.consent .foot { margin: 16px 0 0; font-size: 13px; color: var(--muted); }

/* ---- denied ---- */
.denied { padding: 56px 28px; }

.denied .mark {
  width: 40px;
  height: 40px;
  border-radius: 50%;
  background: var(--bad-soft);
  color: var(--bad);
  display: grid;
  place-items: center;
  font-weight: 700;
  margin-bottom: 18px;
}

.denied h1 { font-size: 28px; margin-bottom: 10px; }
.denied p { color: var(--ink-2); margin: 0 0 14px; }
.denied .facts { border-top: 1px solid var(--line); margin-top: 20px; }

.denied .facts div {
  display: grid;
  grid-template-columns: 140px 1fr;
  gap: 12px;
  padding: 9px 0;
  border-bottom: 1px solid var(--line);
  font-size: 14px;
}

.denied .facts span:first-child { color: var(--muted); }

/* ---- shared pieces the portal adds ---- */
.btn-small { font-size: 13px; padding: 5px 10px; font-weight: 500; }
.btn:disabled { opacity: .5; cursor: not-allowed; }
.pill.grace { border-color: var(--accent); color: var(--accent); background: transparent; }
.num { font-variant-numeric: tabular-nums; }

/* A submit button that has to read as a link, because signing out mutates
   state and must therefore be a POST, while the design draws it as the quiet
   text link it is. */
.linkish {
  font: inherit;
  font-size: 13px;
  background: none;
  border: 0;
  padding: 0;
  color: var(--accent);
  text-decoration: underline;
  cursor: pointer;
}

/* ---- sign-in ---- */
.signin {
  min-height: 100vh;
  display: grid;
  place-items: center;
  padding: 48px 24px;
  background:
    radial-gradient(1200px 400px at 50% -10%, var(--accent-soft), transparent 60%),
    var(--ground);
}

.signin-card {
  width: min(100%, 440px);
  background: var(--paper);
  border: 1px solid var(--line);
  border-radius: 10px;
  padding: 32px;
  box-shadow: var(--shadow);
}

.signin-card h1 { font-size: 28px; margin: 18px 0 8px; }
.signin-card p { margin: 0 0 22px; color: var(--ink-2); }
.signin-card .btn { width: 100%; justify-content: center; padding: 12px; }
.signin-card form { margin: 0; }
.signin-card .fine { margin: 18px 0 0; font-size: 13px; color: var(--muted); }

.signin-foot {
  margin-top: 28px;
  display: flex;
  gap: 18px;
  flex-wrap: wrap;
  justify-content: center;
  color: var(--muted);
  font-size: 12.5px;
}

/* ---- portal shell ---- */
.portal-body { background: var(--ground); }

.shell {
  display: grid;
  grid-template-columns: 200px minmax(0, 1fr);
  min-height: 100vh;
  max-width: 1180px;
  margin: 0 auto;
  background: var(--paper);
  border-left: 1px solid var(--line);
  border-right: 1px solid var(--line);
}

.side {
  border-right: 1px solid var(--line);
  padding: 18px 14px;
  background: var(--paper-2);
  display: flex;
  flex-direction: column;
  gap: 22px;
}

.side nav { display: grid; gap: 2px; }

.side nav a {
  text-decoration: none;
  color: var(--ink-2);
  padding: 7px 10px;
  border-radius: 5px;
  font-weight: 500;
  font-size: 14px;
  display: flex;
  justify-content: space-between;
  gap: 8px;
}

.side nav a.on { background: var(--paper); color: var(--ink); box-shadow: inset 0 0 0 1px var(--line); }
.side nav a .n { color: var(--muted); font-family: var(--font-mono); font-size: 12px; }
.side .me { margin-top: auto; font-size: 13px; color: var(--muted); line-height: 1.4; }
.side .me b { color: var(--ink); display: block; font-weight: 500; }
.side .me form { margin: 6px 0 0; }
.side .me .pill { margin-top: 6px; }

.main { padding: 22px 28px 30px; min-width: 0; }

.main-head {
  display: flex;
  align-items: end;
  justify-content: space-between;
  gap: 16px;
  flex-wrap: wrap;
  margin-bottom: 18px;
}

.main-head h1 { font-size: 24px; }
.main-head p { margin: 4px 0 0; color: var(--muted); font-size: 14px; }

.summary {
  display: flex;
  flex-wrap: wrap;
  border: 1px solid var(--line);
  border-radius: var(--radius);
  overflow: hidden;
  margin-bottom: 18px;
}

.summary div { flex: 1 1 150px; padding: 10px 14px; border-right: 1px solid var(--line); }
.summary div:last-child { border-right: 0; }
.summary .k { font-size: 12px; color: var(--muted); }
.summary .v { font-family: var(--font-display); font-weight: 600; font-size: 20px; }

.summary .v small {
  font-family: var(--font-body);
  font-weight: 400;
  font-size: 13px;
  color: var(--muted);
  margin-left: 6px;
}

/* Every table on every page scrolls inside this rather than widening the
   document: a portal read on a phone must not scroll the body sideways. */
.tablewrap { overflow-x: auto; }

table { width: 100%; border-collapse: collapse; font-size: 14px; }

th {
  text-align: left;
  font-weight: 500;
  font-size: 12px;
  color: var(--muted);
  letter-spacing: .04em;
  text-transform: uppercase;
  padding: 8px 10px;
  border-bottom: 1px solid var(--line);
  white-space: nowrap;
}

td { padding: 10px; border-bottom: 1px solid var(--line); vertical-align: top; }
td .sub { display: block; color: var(--muted); font-size: 12.5px; margin-top: 2px; }
td.act { text-align: right; white-space: nowrap; }
td.act form { display: inline; }
tr.has-chain td { border-bottom: 0; }
.expand td { background: var(--paper-2); padding: 0 10px 14px 10px; }

/* The rotation chain is a <details>, so it opens with the keyboard and
   without JavaScript. */
.expand details summary {
  cursor: pointer;
  font-size: 13px;
  color: var(--accent);
  padding: 8px 0;
  width: fit-content;
}

.chain-head {
  display: flex;
  justify-content: space-between;
  flex-wrap: wrap;
  gap: 8px;
  font-size: 13px;
  color: var(--ink-2);
  margin: 0 0 8px;
}

.chain-head b { color: var(--ink); font-weight: 500; }
.chain { width: 100%; height: auto; display: block; min-width: 520px; }
.chain text { font-family: var(--font-mono); font-size: 11px; fill: var(--muted); }
.chain .lnk { fill: var(--paper); stroke: var(--line-strong); }
.chain .lnk.live { fill: var(--accent); stroke: var(--accent); }
.chain .lnk.dead { fill: var(--paper-2); stroke: var(--line); stroke-dasharray: 3 3; }
.chain .rail { stroke: var(--line-strong); }
.chain .grace { fill: var(--accent-soft); stroke: var(--accent); stroke-dasharray: 3 3; }
.chain .gtxt { fill: var(--accent); font-weight: 500; }
.chainwrap { overflow-x: auto; }

.empty {
  padding: 28px;
  text-align: center;
  color: var(--muted);
  border: 1px dashed var(--line-strong);
  border-radius: var(--radius);
}

.empty b { color: var(--ink); font-weight: 500; display: block; margin-bottom: 4px; }

.cli {
  background: var(--paper-2);
  border: 1px solid var(--line);
  border-radius: var(--radius);
  padding: 12px 14px;
  font-family: var(--font-mono);
  font-size: 13px;
  color: var(--ink-2);
  white-space: pre;
  overflow-x: auto;
  margin: 14px 0 0;
}

.cli b { color: var(--ink); font-weight: 500; }

.step {
  display: grid;
  grid-template-columns: 24px 1fr;
  gap: 12px;
  padding: 10px 0;
  border-top: 1px solid var(--line);
  color: var(--ink-2);
  font-size: 14px;
}

.step i { font-style: normal; font-family: var(--font-mono); font-size: 12px; color: var(--muted); padding-top: 3px; }
.step b { color: var(--ink); font-weight: 500; }

/* The one banner the portal shows after an action, so that a POST that
   redirected back to a list still says what it did. */
.flash {
  margin: 0 0 16px;
  padding: 10px 12px;
  border-left: 3px solid var(--ok);
  background: var(--ok-soft);
  color: var(--ink-2);
  font-size: 14px;
  border-radius: 0 var(--radius) var(--radius) 0;
}

.flash.bad { border-left-color: var(--bad); background: var(--bad-soft); }

/* Below the sidebar's own width the two columns become two rows: the nav is
   four short links and reads fine as a strip. */
@media (max-width: 720px) {
  .shell { grid-template-columns: 1fr; border-left: 0; border-right: 0; }
  .side { border-right: 0; border-bottom: 1px solid var(--line); }
  .side nav { grid-auto-flow: column; grid-auto-columns: max-content; overflow-x: auto; }
  .side .me { margin-top: 0; }
  .main { padding: 18px 16px 24px; }
}

/* ---- corrections measured against a rendered page ------------------------
   Everything below was found by rendering the four screens in a browser and
   looking at them, not by reading the design file again. Each one is a place
   where the markup and the design's CSS met and did something neither of them
   says. */

/* "Sign in with Authelia" is an <a> — it starts a login rather than changing
   anything — so it inherits the link underline and has to be told not to. */
.btn { text-decoration: none; }
a.btn-primary { color: var(--accent-ink); }

/* The card is narrower than the footer beneath it, so the block that holds
   both is as wide as the footer and the card sat left of centre inside it. */
.signin > div { display: grid; justify-items: center; }

/* The heading block's paragraph is a full sentence, so without a basis it
   claimed the whole row and wrapped the page's one action onto the next line,
   left-aligned under the title. */
.main-head > div { flex: 1 1 30ch; }
.main-head > form, .main-head > .btn { flex: 0 0 auto; }

/* A timestamp column is the one place wrapping is never right: "Aug 30,\n
   18:25" reads as two facts. */
td.num { white-space: nowrap; }
/* …but the note under one, which is a phrase and not a value, may wrap. */
td.num .sub { white-space: normal; }

/* …and a list of registered redirect URIs is the one place it always is.
   Without a bound, one long https URI pushed the actions column off the end
   of the table, where the only way to reach it was a horizontal scroll
   nothing suggested. */
td.uris { max-width: 30ch; overflow-wrap: anywhere; }

/* A hostname is one word however it is hyphenated, so breaking
   "mikrotik-mcp.example" after the dash invents two. */
td.host { white-space: nowrap; }

/* The collapsed rotation-chain row is a full-width band of paper-2 under
   every grant, which doubled the apparent row count. It earns its background
   once it is open. */
.expand td { background: transparent; }
.expand:has(details[open]) td { background: var(--paper-2); padding-bottom: 18px; }