:root {
  --bg: #0d1117; --panel: #161b22; --panel2: #1c2230; --line: #2a3240;
  --fg: #e6edf3; --dim: #8b949e; --acc: #58a6ff;
  --ok: #3fb950; --warn: #d29922; --bad: #f85149;
}
* { box-sizing: border-box; }
body { margin: 0; font: 14px/1.5 system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
  background: var(--bg); color: var(--fg); }

header { padding: 14px 20px; background: var(--panel); border-bottom: 1px solid var(--line);
  display: grid; grid-template-columns: auto 1fr; grid-auto-rows: auto; gap: 2px 16px; align-items: center; }
.brand { font-size: 18px; font-weight: 700; }
.sub { color: var(--dim); font-size: 12px; grid-column: 1; }
#search { grid-column: 2; grid-row: 1 / span 2; justify-self: end; width: min(380px, 45vw);
  padding: 9px 12px; background: var(--bg); border: 1px solid var(--line); border-radius: 8px;
  color: var(--fg); font-size: 13px; }

.kpis { display: grid; grid-template-columns: repeat(4, 1fr); gap: 12px; padding: 16px 20px; }
.kpi { background: var(--panel); border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; }
.kpi .n { font-size: 26px; font-weight: 700; }
.kpi .l { color: var(--dim); font-size: 12px; margin-top: 2px; }

.tabs { display: flex; gap: 8px; padding: 0 20px; }
.tabs button { background: none; border: none; color: var(--dim); padding: 8px 14px;
  border-radius: 8px 8px 0 0; cursor: pointer; font-size: 14px; }
.tabs button.active { color: var(--fg); background: var(--panel); border: 1px solid var(--line); border-bottom: none; }

main { padding: 0 20px 24px; }
.tab { background: var(--panel); border: 1px solid var(--line); border-radius: 0 10px 10px 10px; padding: 16px; }

.split { display: grid; grid-template-columns: 340px 1fr; gap: 16px; }
.list { display: flex; flex-direction: column; gap: 8px; max-height: 68vh; overflow-y: auto; }
.card { background: var(--panel2); border: 1px solid var(--line); border-radius: 10px;
  padding: 12px; cursor: pointer; }
.card:hover { border-color: var(--acc); }
.card.sel { border-color: var(--acc); box-shadow: 0 0 0 1px var(--acc) inset; }
.card .top { display: flex; justify-content: space-between; align-items: center; }
.card .sig { font-family: ui-monospace, monospace; font-size: 13px; }
.card .meta { color: var(--dim); font-size: 12px; margin-top: 4px; }
.pill-spoof { color: var(--warn); font-size: 11px; border: 1px solid var(--warn);
  border-radius: 6px; padding: 0 5px; margin-left: 6px; }

.risk { font-weight: 700; padding: 2px 9px; border-radius: 20px; font-size: 13px; }
.risk.hi { background: rgba(248,81,73,.15); color: var(--bad); }
.risk.md { background: rgba(210,153,34,.15); color: var(--warn); }
.risk.lo { background: rgba(63,185,80,.15); color: var(--ok); }

.detail { min-height: 40vh; }
.detail .empty { color: var(--dim); }
.detail h2 { margin: 0 0 4px; font-family: ui-monospace, monospace; }
.detail .grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px,1fr)); gap: 10px; margin: 14px 0; }
.detail .box { background: var(--panel2); border: 1px solid var(--line); border-radius: 8px; padding: 10px 12px; }
.detail .box .bl { color: var(--dim); font-size: 11px; text-transform: uppercase; letter-spacing: .04em; }
.detail .box .bv { font-size: 16px; margin-top: 3px; word-break: break-word; }
.detail h3 { margin: 16px 0 6px; font-size: 13px; color: var(--dim); text-transform: uppercase; letter-spacing: .04em; }
.chips { display: flex; flex-wrap: wrap; gap: 6px; }
.chip { background: var(--bg); border: 1px solid var(--line); border-radius: 6px; padding: 2px 8px; font-size: 12px; }
.chip.bad { border-color: var(--bad); color: var(--bad); }
.mono { font-family: ui-monospace, monospace; font-size: 12px; }
.note { color: var(--dim); font-size: 12px; margin-top: 6px; }
.timeline { border-left: 2px solid var(--line); margin: 6px 0 0 6px; padding-left: 12px; }
.timeline div { position: relative; padding: 3px 0; font-size: 12px; }
.timeline div::before { content: ""; position: absolute; left: -17px; top: 8px; width: 8px; height: 8px;
  background: var(--acc); border-radius: 50%; }

table.feed { width: 100%; border-collapse: collapse; font-size: 12.5px; }
table.feed th, table.feed td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--line); white-space: nowrap; }
table.feed th { color: var(--dim); font-weight: 600; position: sticky; top: 0; background: var(--panel); }
tr.flag td { background: rgba(248,81,73,.06); }
.tag { padding: 1px 7px; border-radius: 6px; font-size: 11px; }
.tag.known { background: rgba(63,185,80,.15); color: var(--ok); }
.tag.suspicious { background: rgba(210,153,34,.15); color: var(--warn); }
.tag.attacker { background: rgba(248,81,73,.15); color: var(--bad); }
.tag.block { background: rgba(248,81,73,.2); color: var(--bad); }
.tag.accept { background: rgba(63,185,80,.12); color: var(--ok); }

footer { color: var(--dim); font-size: 12px; padding: 12px 20px; border-top: 1px solid var(--line); }

.btn { background: var(--panel2); color: var(--fg); border: 1px solid var(--line);
  border-radius: 7px; padding: 4px 10px; font-size: 12px; cursor: pointer; }
.btn:hover { border-color: var(--acc); }
.btn.danger { color: var(--bad); border-color: var(--bad); }
.btn.ok { color: var(--ok); border-color: var(--ok); }
#reset { grid-column: 2; grid-row: 1 / span 2; justify-self: end; padding: 9px 14px; font-size: 13px; }
.link { color: var(--acc); text-decoration: none; }
td.ops { white-space: nowrap; }
td.ops .btn { margin-right: 4px; }
input.ed { width: 90px; padding: 3px 6px; background: var(--bg); border: 1px solid var(--acc);
  border-radius: 6px; color: var(--fg); font-size: 12px; font-family: ui-monospace, monospace; }
@media (max-width: 720px) {
  .kpis { grid-template-columns: repeat(2,1fr); }
  .split { grid-template-columns: 1fr; }
  #search { grid-column: 1 / -1; grid-row: auto; justify-self: stretch; width: 100%; }
}

/* ══════════ CTI platform console (index.html) ═══════════════════════════
   Chart colours are the data-viz palette's dark steps, validated against
   this surface (#161b22): categorical blue/orange/aqua for series, the fixed
   status four for severity. Severity marks always carry their label, because
   warning and serious sit too close to be told apart by hue alone.        */
:root {
  --series-1: #3987e5;   /* captured frames */
  --series-2: #d95926;
  --series-3: #199e70;
  --st-good: #0ca30c; --st-warning: #fab219;
  --st-serious: #ec835a; --st-critical: #d03b3b;
  --grid: #2a3240; --ink-dim: #8b949e;
}

.pill-live { font-size: 12px; padding: 2px 9px; border-radius: 20px;
  border: 1px solid var(--line); color: var(--dim); }
.pill-live.live { color: var(--ok); border-color: var(--ok); }
.pill-live.idle { color: var(--warn); border-color: var(--warn); }

.kpi .d { color: var(--dim); font-size: 11px; margin-top: 4px; }
body:has(#tabs) .kpis { grid-template-columns: repeat(auto-fit, minmax(190px, 1fr)); }
.riskcell { display: flex; align-items: center; gap: 8px; }
.riskcell .bar-track { flex: 1; }
.kpi.alarm .n { color: var(--bad); }

.charts { display: grid; grid-template-columns: 1.6fr 1fr; gap: 16px; }
figure { margin: 0; background: var(--panel2); border: 1px solid var(--line);
  border-radius: 10px; padding: 12px 14px; }
figure.wide { margin-bottom: 16px; }
figcaption { font-size: 13px; margin-bottom: 10px; }
figcaption .sub-cap { color: var(--dim); font-size: 12px; margin-left: 8px; }
.legend-row { display: flex; gap: 14px; flex-wrap: wrap; margin-top: 8px;
  color: var(--dim); font-size: 12px; }
.legend-row span.k { display: inline-flex; align-items: center; gap: 6px; }
.legend-row i { width: 10px; height: 10px; border-radius: 3px; display: inline-block; }
svg .grid-line { stroke: var(--grid); stroke-width: 1; }
svg text { fill: var(--ink-dim); font-size: 10.5px; }
svg text.val { fill: var(--fg); font-size: 11px; }
svg .hit { fill: transparent; cursor: crosshair; }

.split2 { display: grid; grid-template-columns: 1fr 1fr; gap: 16px; margin-top: 16px; }
.split2 h3, .tab h3 { margin: 0 0 8px; font-size: 13px; color: var(--dim);
  text-transform: uppercase; letter-spacing: .04em; }

.filters { display: flex; align-items: center; gap: 14px; flex-wrap: wrap;
  margin-bottom: 12px; font-size: 12px; color: var(--dim); }
.filters .spacer { flex: 1; }
.filters label { display: inline-flex; align-items: center; gap: 6px; }
.filters label.check { gap: 4px; }
select, input[type="range"] { background: var(--bg); color: var(--fg);
  border: 1px solid var(--line); border-radius: 6px; padding: 3px 6px; font-size: 12px; }

.sev { padding: 1px 7px; border-radius: 6px; font-size: 11px; font-weight: 600;
  text-transform: uppercase; letter-spacing: .03em; }
.sev.critical { background: rgba(208,59,59,.18); color: #f08b8b; }
.sev.high { background: rgba(236,131,90,.18); color: #ec835a; }
.sev.medium { background: rgba(250,178,25,.16); color: #fab219; }
.sev.low { background: rgba(139,148,158,.16); color: var(--dim); }

.alert-card { background: var(--panel2); border: 1px solid var(--line);
  border-radius: 10px; padding: 9px 11px; cursor: pointer; }
.alert-card:hover { border-color: var(--acc); }
.alert-card.sel { border-color: var(--acc); box-shadow: 0 0 0 1px var(--acc) inset; }
.alert-card .top { display: flex; justify-content: space-between; gap: 8px;
  align-items: center; }
.alert-card .ttl { font-size: 12.5px; margin-top: 4px; }
.alert-card .meta { color: var(--dim); font-size: 11.5px; margin-top: 3px; }

.kv { display: grid; grid-template-columns: repeat(auto-fit, minmax(140px,1fr));
  gap: 10px; margin: 10px 0; }
.kv .box { background: var(--bg); border: 1px solid var(--line);
  border-radius: 8px; padding: 8px 10px; }
.kv .box .bl { color: var(--dim); font-size: 11px; text-transform: uppercase;
  letter-spacing: .04em; }
.kv .box .bv { font-size: 15px; margin-top: 3px; word-break: break-word; }

.bar-track { background: var(--bg); border: 1px solid var(--line);
  border-radius: 5px; height: 8px; overflow: hidden; min-width: 70px; }
.bar-fill { height: 100%; background: var(--acc); }

table.feed tr.pick { cursor: pointer; }
table.feed tr.pick:hover td { background: rgba(88,166,255,.07); }
table.feed tr.sel td { background: rgba(88,166,255,.12); }
.wl-1 { color: var(--ok); }
.wl-2 { color: var(--bad); font-weight: 600; }
.wl-0 { color: var(--dim); }

.fz-table { width: 100%; border-collapse: collapse; font-size: 12px; margin-top: 8px; }
.fz-table th, .fz-table td { text-align: left; padding: 5px 8px;
  border-bottom: 1px solid var(--line); }
.fz-table th { color: var(--dim); font-weight: 600; }
.fz-table tr.best td { background: rgba(88,166,255,.08); }
.fuzzy-explainer { margin-top: 16px; background: var(--panel2);
  border: 1px solid var(--line); border-radius: 10px; padding: 12px 14px; }

.tip { position: fixed; pointer-events: none; z-index: 30; background: var(--panel);
  border: 1px solid var(--line); border-radius: 8px; padding: 7px 9px;
  font-size: 12px; color: var(--fg); box-shadow: 0 6px 20px rgba(0,0,0,.45);
  max-width: 260px; }
.tip .t-k { color: var(--dim); }

@media (max-width: 900px) {
  .charts, .split2 { grid-template-columns: 1fr; }
}