:root {
  --navy: #14284a; --navy-2: #1f3a63; --ink: #10151c; --body: #38414d;
  --muted: #6b7684; --line: #e6e9ee; --line-2: #eef1f5; --bg: #f4f6f9;
  --panel: #ffffff; --accent: #2563eb; --accent-ink: #1d4ed8;
  --ok: #0f8a5f; --ok-bg: #e5f4ee; --warn: #b7791f; --warn-bg: #fdf3e2;
  --danger: #c0392b; --danger-bg: #fdecea; --radius: 10px;
  --shadow: 0 1px 2px #0b1a340d, 0 4px 16px #0b1a340a;
}
* { box-sizing: border-box; }
html, body { margin: 0; }
body { font: 14.5px/1.55 -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
  color: var(--body); background: var(--bg); -webkit-font-smoothing: antialiased; }
a { color: var(--accent); text-decoration: none; }
a:hover { color: var(--accent-ink); }
h1, h2, h3 { color: var(--ink); }

/* ---------------------------------------------------------------- shell */
.shell { display: flex; min-height: 100vh; }
.sidebar { width: 244px; flex: 0 0 244px; background: var(--navy);
  color: #cdd7e6; display: flex; flex-direction: column; position: sticky;
  top: 0; height: 100vh; }
.brand { display: flex; align-items: center; gap: .6rem; padding: 1.1rem 1.2rem;
  font-size: 1.05rem; line-height: 1.05; color: #fff; border-bottom: 1px solid #ffffff14; }
.brand-mark { font-size: 1.4rem; }
.brand b { font-weight: 700; }
.side-nav { padding: .6rem .6rem; flex: 1; overflow-y: auto; }
.nav-group { font-size: .68rem; text-transform: uppercase; letter-spacing: .08em;
  color: #7f92ad; margin: 1rem .6rem .3rem; }
.nav-item { display: flex; align-items: center; gap: .6rem; padding: .5rem .7rem;
  border-radius: 8px; color: #cdd7e6; font-size: .92rem; margin: 1px 0; }
.nav-item span { width: 1.1rem; text-align: center; font-size: .95rem; filter: grayscale(.2); }
.nav-item:hover { background: #ffffff12; color: #fff; }
.nav-item.active { background: var(--accent); color: #fff; }
.nav-item.active span { filter: none; }
.signout { margin: .6rem; padding: .55rem .7rem; border-radius: 8px; color: #9fb0c9;
  border: 1px solid #ffffff1f; text-align: center; font-size: .88rem; }
.signout:hover { background: #ffffff12; color: #fff; }

.main { flex: 1; min-width: 0; padding: 2rem 2.4rem 3rem; max-width: 1180px; }

/* --------------------------------------------------------------- headers */
.page-header { margin-bottom: 1.4rem; }
.page-header h1 { font-size: 1.5rem; margin: 0 0 .3rem; letter-spacing: -.01em; }
.page-header .sub { color: var(--muted); max-width: 70ch; margin: 0; }
.saved { display: inline-block; margin-left: .6rem; color: var(--ok);
  background: var(--ok-bg); padding: .1rem .5rem; border-radius: 20px; font-size: .8rem;
  font-weight: 600; }

/* ---------------------------------------------------------------- cards */
.stat-row { display: grid; grid-template-columns: repeat(auto-fit,minmax(160px,1fr));
  gap: 1rem; margin: 0 0 1.6rem; }
.stat { background: var(--panel); border: 1px solid var(--line); border-radius: var(--radius);
  padding: 1rem 1.1rem; box-shadow: var(--shadow); }
.stat .n { font-size: 1.8rem; font-weight: 700; color: var(--ink); letter-spacing: -.02em; }
.stat .l { color: var(--muted); font-size: .85rem; margin-top: .1rem; }
.stat.accent .n { color: var(--accent); }
.stat.warn .n { color: var(--warn); }

.cards { display: grid; grid-template-columns: repeat(auto-fit,minmax(230px,1fr));
  gap: 1rem; margin: 0 0 1.6rem; }
.tile { background: var(--panel); border: 1px solid var(--line); border-radius: var(--radius);
  padding: 1.1rem 1.2rem; box-shadow: var(--shadow); color: var(--body); display: block; }
.tile:hover { border-color: #c9d6ea; transform: translateY(-1px); transition: .12s; }
.tile h3 { margin: 0 0 .25rem; font-size: 1rem; color: var(--navy-2); }
.tile p { margin: 0; color: var(--muted); font-size: .88rem; }

.panel { background: var(--panel); border: 1px solid var(--line); border-radius: var(--radius);
  box-shadow: var(--shadow); padding: 1.2rem 1.3rem; margin-bottom: 1.2rem; }
.panel > h2 { margin: 0 0 .2rem; font-size: 1.05rem; }
.panel > .hint { color: var(--muted); font-size: .88rem; margin: 0 0 .9rem; }

/* --------------------------------------------------------------- tables */
.table { width: 100%; border-collapse: separate; border-spacing: 0; background: var(--panel);
  border: 1px solid var(--line); border-radius: var(--radius); overflow: hidden; box-shadow: var(--shadow); }
.table th, .table td { text-align: left; padding: .6rem .85rem; border-bottom: 1px solid var(--line-2); vertical-align: middle; }
.table thead th { background: #f7f9fc; font-size: .72rem; text-transform: uppercase;
  letter-spacing: .04em; color: var(--muted); font-weight: 600; }
.table tbody tr:hover { background: #f9fbfe; }
.table tr:last-child td { border-bottom: 0; }
.table td.num { text-align: right; font-variant-numeric: tabular-nums; }
.nowrap { white-space: nowrap; }
code { background: #eef1f6; padding: 1px 6px; border-radius: 5px; font-size: .82em;
  color: #334; font-family: ui-monospace, "SF Mono", Menlo, monospace; }

/* ----------------------------------------------------------------- pills */
.pill { display: inline-block; padding: .1rem .55rem; border-radius: 20px; font-size: .78rem;
  font-weight: 600; }
.pill.ok { background: var(--ok-bg); color: var(--ok); }
.pill.muted { background: #eef1f5; color: var(--muted); }
.pill.warn { background: var(--warn-bg); color: var(--warn); }
.pill.danger { background: var(--danger-bg); color: var(--danger); }

/* ----------------------------------------------------------------- forms */
label { font-size: .9rem; }
.field { margin-bottom: .9rem; }
.field > .lab { display: block; font-weight: 600; color: var(--ink); margin-bottom: .3rem; font-size: .85rem; }
select, input[type=text], input[type=password], input[type=search] {
  font: inherit; padding: .5rem .6rem; border: 1px solid #cdd5e0; border-radius: 8px;
  background: #fff; color: var(--ink); min-width: 180px; }
select:focus, input:focus { outline: 2px solid #2563eb33; border-color: var(--accent); }
select[multiple] { padding: .2rem; }
.inline-form { display: flex; flex-wrap: wrap; gap: .8rem; align-items: flex-end; }
.btn { font: inherit; font-weight: 600; background: var(--accent); color: #fff; border: 0;
  padding: .55rem 1.1rem; border-radius: 8px; cursor: pointer; }
.btn:hover { background: var(--accent-ink); }
.btn.ghost { background: #fff; color: var(--ink); border: 1px solid #cdd5e0; }
.btn.ghost:hover { background: #f4f6f9; }
.btn.sm { padding: .35rem .7rem; font-size: .85rem; }
.toolbar { position: sticky; bottom: 0; background: linear-gradient(#f4f6f9cc,#f4f6f9);
  padding: .9rem 0; margin-top: 1rem; backdrop-filter: blur(2px); }

.chips { display: flex; flex-wrap: wrap; gap: .3rem; margin-top: .3rem; }
.chip { background: #eaf0fb; color: var(--accent-ink); border-radius: 20px;
  padding: .08rem .55rem; font-size: .78rem; font-weight: 600; }
.lvl-hidden { color: var(--danger); }
.select-hidden { border-color: #e6b0a8; background: #fdf5f4; }

.empty { text-align: center; color: var(--muted); padding: 2rem; }

/* --------------------------------------------------------------- login */
.login-wrap { display: flex; align-items: center; justify-content: center; min-height: 100vh;
  background: radial-gradient(1200px 600px at 30% -10%, #22467e 0%, var(--navy) 60%); }
.login-card { width: 360px; background: #fff; border-radius: 14px; padding: 2rem;
  box-shadow: 0 20px 60px #0008; }
.login-card h1 { font-size: 1.35rem; margin: .2rem 0 .1rem; }
.login-card p { color: var(--muted); margin: 0 0 1.2rem; }
.login-card input { width: 100%; margin-bottom: .9rem; }
.login-card .btn { width: 100%; }
.login-card .err { color: var(--danger); background: var(--danger-bg); padding: .5rem .7rem;
  border-radius: 8px; font-size: .88rem; margin-bottom: .8rem; }

/* ------------------------------------------------------------ combobox */
.combo { position: relative; min-width: 320px; }
.combo input { width: 100%; }
.combo-list { position: absolute; z-index: 20; left: 0; right: 0; top: 100%; margin-top: 4px;
  background: #fff; border: 1px solid var(--line); border-radius: 8px; box-shadow: var(--shadow);
  max-height: 260px; overflow-y: auto; display: none; }
.combo-list.open { display: block; }
.combo-opt { padding: .45rem .7rem; cursor: pointer; font-size: .9rem; }
.combo-opt:hover, .combo-opt.active { background: #eef4ff; }
.combo-empty { padding: .5rem .7rem; color: var(--muted); font-size: .88rem; }

.verdict { display: flex; gap: 1rem; align-items: center; padding: 1rem 1.1rem;
  border-radius: var(--radius); border: 1px solid var(--line); background: var(--panel); }
.verdict .badge { font-size: 1.5rem; }

@media (max-width: 820px) {
  .shell { flex-direction: column; }
  .sidebar { width: 100%; height: auto; position: static; flex-direction: row;
    flex-wrap: wrap; align-items: center; }
  .side-nav { display: flex; flex-wrap: wrap; padding: .4rem; }
  .nav-group { display: none; }
  .main { padding: 1.2rem; }
}

/* ================================================================
   Phase 1 additions (appended): health panel, backups, record
   shares, rule builder, visibility cards. Append-only section.
   ================================================================ */

/* generic bits */
.warn-box { background: var(--warn-bg); border: 1px solid #ecd9b0; color: var(--warn);
  border-radius: 8px; padding: .6rem .85rem; font-size: .9rem; margin: .6rem 0; }
.warn-box.danger { background: var(--danger-bg); border-color: #efc7c0; color: var(--danger); }
.btn.danger { background: var(--danger); }
.btn.danger:hover { background: #a93226; }
.btn[disabled] { opacity: .55; cursor: not-allowed; pointer-events: none; }
input[type=date] { font: inherit; padding: .5rem .6rem; border: 1px solid #cdd5e0;
  border-radius: 8px; background: #fff; color: var(--ink); }
input[type=date]:focus { outline: 2px solid #2563eb33; border-color: var(--accent); }
.input-wide { min-width: 340px; }
.form-note { color: var(--muted); font-size: .88rem; }
.row-link { font-size: .85rem; white-space: nowrap; margin-left: .45rem; }
.table th.num { text-align: right; }

/* security health (home) */
.health-top { display: flex; flex-wrap: wrap; gap: 1.2rem 2rem; align-items: center;
  margin-bottom: .9rem; }
.health-score { font-size: 2.3rem; font-weight: 700; letter-spacing: -.02em; line-height: 1.1;
  color: var(--ink); }
.health-score .health-max { font-size: 1rem; font-weight: 600; color: var(--muted); }
.health-score.good { color: var(--ok); }
.health-score.mid { color: var(--warn); }
.health-score.bad { color: var(--danger); }
.health-cap { color: var(--muted); font-size: .85rem; }
.trend { display: flex; align-items: flex-end; gap: 2px; height: 46px; }
.trend-bar { width: 7px; background: #c9d6ea; border-radius: 2px 2px 0 0; min-height: 2px; }
.trend-bar.good { background: #7fbfa2; }
.trend-bar.mid { background: #e2c186; }
.trend-bar.bad { background: #e39c90; }
.backup-chips { display: flex; align-items: center; flex-wrap: wrap; gap: .6rem;
  font-size: .88rem; color: var(--body); margin-left: auto; }
.health-checks td { padding: .45rem .85rem; }
.check-ico { width: 2rem; text-align: center; }
.check-detail { color: var(--muted); font-size: .85rem; margin-left: .35rem; font-weight: 400; }
.selftest-box { border-top: 1px dashed var(--line); margin-top: 1.1rem; padding-top: 1rem; }
.selftest-head { display: flex; align-items: center; flex-wrap: wrap; gap: .6rem; }
.selftest-run { margin-left: auto; }
.selftest-checks { list-style: none; margin: .6rem 0 0; padding: 0; font-size: .9rem; }
.selftest-checks li { padding: .15rem 0; }
.health-note { color: var(--muted); font-size: .82rem; margin: .8rem 0 0; }

/* rule builder (rules page) */
.rule-sentence { display: flex; flex-wrap: wrap; align-items: center; gap: .5rem .6rem; }
.rule-sentence select { min-width: 0; }
.rule-sentence input[type=text] { min-width: 230px; }
.rs-word { color: var(--muted); font-weight: 600; font-size: .88rem; }
#crit-extra:not([hidden]) { display: inline-flex; align-items: center; gap: .5rem .6rem; }
.rule-preview, .owd-meaning { background: #f7f9fc; border: 1px solid var(--line-2);
  border-radius: 8px; padding: .55rem .75rem; font-size: .9rem; color: var(--body);
  margin-top: .8rem; }

/* record shares */
.row-expired td { color: var(--muted); }
.row-expired td b { color: var(--muted); font-weight: 600; }

/* default-visibility cards */
.owd-card { background: var(--panel); border: 1px solid var(--line); border-radius: var(--radius);
  box-shadow: var(--shadow); margin-bottom: .8rem; }
.owd-card > summary { list-style: none; cursor: pointer; display: flex; align-items: center;
  flex-wrap: wrap; gap: .7rem; padding: .85rem 1.15rem; }
.owd-card > summary::-webkit-details-marker { display: none; }
.owd-card > summary b { color: var(--ink); }
.owd-card[open] > summary { border-bottom: 1px solid var(--line-2); }
.owd-sum { color: var(--muted); font-size: .85rem; }
.owd-caret { margin-left: auto; color: var(--muted); transition: transform .15s; }
.owd-card[open] .owd-caret { transform: rotate(180deg); }
.owd-form { padding: 1rem 1.15rem 1.2rem; }
.owd-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
  gap: .9rem; margin: .9rem 0; }
.owd-form fieldset { border: 1px solid var(--line-2); border-radius: 8px; margin: 0;
  padding: .6rem .8rem .8rem; min-width: 0; }
.owd-form legend { font-size: .72rem; font-weight: 600; text-transform: uppercase;
  letter-spacing: .05em; color: var(--muted); padding: 0 .3rem; }
.owd-form select, .owd-form input[type=text] { width: 100%; min-width: 0; }
.owd-form .field { margin-bottom: .6rem; }
.owd-meaning { margin: .8rem 0; }
.owd-hint { color: var(--muted); font-size: .85rem; margin: .2rem 0 0; }

/* backups page */
.stat-pill { margin: .5rem 0 .2rem; }
.log-tail { background: #10151c; color: #c7d0dc; border-radius: 8px; padding: .9rem 1.05rem;
  margin: 0; font: .8rem/1.55 ui-monospace, "SF Mono", Menlo, monospace;
  overflow: auto; max-height: 340px; white-space: pre-wrap; }

/* ================================================================
   Phase 2 additions (appended): identity & lifecycle — sidebar user
   chip, account login, console admins, TOTP setup, users & lifecycle,
   offboarding wizard, tier gating. Append-only section.
   ================================================================ */

/* sidebar user chip */
.user-chip { margin: .6rem .6rem 0; padding: .5rem .7rem; border: 1px solid #ffffff1f;
  border-radius: 8px; display: flex; align-items: center; gap: .5rem; min-width: 0; }
.user-chip-name { color: #fff; font-size: .88rem; font-weight: 600; flex: 1; min-width: 0;
  overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.user-chip .pill { flex: 0 0 auto; }

/* login (bootstrap-mode note) */
.login-card .login-note { color: var(--muted); font-size: .84rem; margin: 1rem 0 0; }

/* generic: muted sub-line inside table cells, compact selects, action clusters */
.cell-sub { color: var(--muted); font-size: .84rem; font-weight: 400; }
.sel-compact { min-width: 120px; }
.row-actions { display: flex; flex-wrap: wrap; gap: .4rem; align-items: center; }

/* inline collapsible (reset password) */
.row-details { display: inline-block; }
.row-details > summary { list-style: none; display: inline-block; cursor: pointer; }
.row-details > summary::-webkit-details-marker { display: none; }
.row-reset { display: inline-flex; gap: .4rem; align-items: center; margin-left: .45rem; }
.row-reset input { min-width: 170px; padding: .35rem .5rem; }

/* console admins — TOTP setup */
.totp-panel { border-left: 3px solid var(--accent); }
.totp-secret code { font-size: 1.25rem; letter-spacing: .12em; padding: .45rem .8rem;
  display: inline-block; margin: .2rem 0 .5rem; }
.totp-uri { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: .8rem;
  color: var(--body); background: #f7f9fc; border: 1px solid var(--line-2); border-radius: 8px;
  padding: .5rem .7rem; word-break: break-all; margin: 0 0 .9rem; }

/* users & lifecycle */
.row-frozen td { color: var(--muted); }
.row-frozen td b { color: var(--muted); }

/* offboarding */
.sample-list { list-style: none; margin: .45rem 0 0; padding: 0; color: var(--muted);
  font-size: .84rem; }
.sample-list li { padding: .05rem 0; overflow: hidden; text-overflow: ellipsis;
  white-space: nowrap; }

/* tier gating (read-only fieldsets) */
fieldset.fieldset-plain { border: 0; padding: 0; margin: 0; min-width: 0; }
.inline-form fieldset.fieldset-plain { display: flex; flex-wrap: wrap; gap: .8rem;
  align-items: flex-end; flex: 1 1 auto; }
fieldset.fieldset-plain[disabled] { opacity: .8; }

/* ================================================================
   Audit v2 additions (appended): filter bar, result meta + CSV
   export, pager, truncated detail cell, sign-in panel, footer note.
   Append-only section.
   ================================================================ */

/* anchors styled as buttons (pager, export) */
.btn-link { display: inline-block; text-decoration: none; }

/* filter bar */
.filter-bar { align-items: flex-end; }
.filter-bar .lab { display: block; font-weight: 600; color: var(--ink);
  margin-bottom: .3rem; font-size: .85rem; }
.filter-bar input[type=text] { min-width: 240px; }
.filter-actions { display: flex; align-items: center; gap: .7rem; }
.filter-clear { font-size: .88rem; }

/* result count + export row */
.result-meta { display: flex; flex-wrap: wrap; align-items: center; gap: .6rem;
  color: var(--muted); font-size: .88rem; margin: 0 0 .7rem; }
.result-meta .spacer { flex: 1 1 auto; }

/* pagination */
.pager { display: flex; flex-wrap: wrap; align-items: center; gap: .6rem;
  margin: -.4rem 0 1.2rem; }
.pager .page-of { color: var(--muted); font-size: .82rem; }

/* detail cell — one compact line, full JSON on hover */
.audit-detail { max-width: 560px; }
.audit-json { display: inline-block; max-width: 100%; white-space: nowrap;
  overflow: hidden; text-overflow: ellipsis; vertical-align: bottom; }

/* CRM sign-in events panel */
.signin-panel { margin-top: 1.6rem; }
.signin-note { color: var(--muted); font-size: .84rem; margin: .9rem 0 0; }

/* retention footer */
.audit-foot { color: var(--muted); font-size: .85rem; margin: .2rem 0 0; }

/* ================================================================
   Phase 3 additions (appended): audit key=value chips, access
   summary, recycle bin, config export & diff. Introduces muted /
   danger chip variants reused across those pages. Append-only.
   ================================================================ */

/* chip variants (muted key=value / granted-by chips, removed & error chips) */
.chip.muted { background: #eef1f5; color: var(--muted); }
.chip.danger { background: var(--danger-bg); color: var(--danger); }

/* access summary — member header card */
.summary-head .summary-id { display: flex; flex-wrap: wrap; align-items: center; gap: .6rem; }
.summary-head .summary-id h2 { margin: 0; font-size: 1.15rem; }
.callout { background: #f7f9fc; border: 1px solid var(--line-2); border-left: 3px solid var(--accent);
  border-radius: 8px; padding: .6rem .8rem; margin: .9rem 0 0; color: var(--body); font-size: .92rem; }
.note-line { color: var(--muted); font-size: .82rem; margin: .8rem 0 0; }

/* config export — count chips */
.statchips { display: flex; flex-wrap: wrap; gap: .5rem; margin: 0 0 1rem; }
.statchip { background: #f7f9fc; border: 1px solid var(--line-2); border-radius: 8px;
  padding: .3rem .7rem; font-size: .85rem; color: var(--muted); }
.statchip b { color: var(--ink); font-weight: 700; margin-right: .15rem; }

/* config export — download action, raw JSON disclosure, file input */
.config-actions { margin: 0 0 .2rem; }
.config-json { margin-top: 1rem; }
.config-json > summary { cursor: pointer; font-weight: 600; color: var(--accent-ink);
  width: fit-content; margin-bottom: .6rem; }
.file-input { font: inherit; padding: .4rem .5rem; border: 1px solid #cdd5e0; border-radius: 8px;
  background: #fff; color: var(--ink); max-width: 100%; }

/* config export — diff view */
.diff-section { margin-top: 1.2rem; }
.diff-section > h3 { margin: 0 0 .5rem; font-size: .98rem; color: var(--navy-2); }
.diff-line { display: flex; flex-wrap: wrap; align-items: baseline; gap: .3rem .6rem; margin: .35rem 0; }
.diff-lab { font-size: .72rem; font-weight: 600; text-transform: uppercase; letter-spacing: .05em;
  color: var(--muted); min-width: 4.2rem; }
.diff-from { color: var(--danger); text-decoration: line-through; }
.diff-arrow { color: var(--muted); }
.diff-to { color: var(--ok); font-weight: 600; }
.problem-list { margin: .4rem 0 0; padding-left: 1.2rem; }
.problem-list li { margin: .1rem 0; }

/* ================================================================
   Access-Insight pack (appended): member access summary, org-wide
   access review matrix, record history timeline. Append-only section.
   ================================================================ */

/* shared: wide tables scroll instead of breaking the layout */
.table-scroll { overflow-x: auto; }

/* member access summary */
.identity-head { display: flex; align-items: flex-start; flex-wrap: wrap; gap: .6rem 1rem; }
.identity-head h2 { margin: 0 0 .15rem; font-size: 1.15rem; }
.identity-head .pill { margin-left: auto; }
.grant-list { list-style: none; margin: 0; padding: 0; font-size: .92rem; }
.grant-list li { padding: .3rem 0; border-bottom: 1px solid var(--line-2); }
.grant-list li:last-child { border-bottom: 0; }
.via-chip { display: inline-block; background: #f0f3f8; color: var(--body);
  border-radius: 20px; padding: .05rem .5rem; font-size: .78rem; font-weight: 600;
  white-space: nowrap; }
.via-sep { color: var(--muted); margin: 0 .2rem; }

/* access review */
.review-head { display: flex; align-items: flex-start; flex-wrap: wrap; gap: .6rem 1rem;
  margin-bottom: .9rem; }
.review-head h2 { margin: 0 0 .2rem; font-size: 1.05rem; }
.review-head .btn { margin-left: auto; }
.review-matrix th.num { white-space: nowrap; }
.review-matrix .chips { margin: 0; }

/* record history timeline */
.timeline { list-style: none; margin: 0; padding: 0; }
.tl-item { background: var(--panel); border: 1px solid var(--line);
  border-radius: var(--radius); box-shadow: var(--shadow); padding: .9rem 1.1rem;
  margin-bottom: .7rem; }
.tl-head { display: flex; align-items: center; flex-wrap: wrap; gap: .6rem; }
.tl-at { color: var(--muted); font-size: .85rem; font-variant-numeric: tabular-nums; }
.tl-changes { margin-top: .6rem; box-shadow: none; }
.tl-changes th, .tl-changes td { padding: .35rem .7rem; }