/* ── Alerts empty state ─────────────────────────────────────────────── */
/*
 * Variant of the shared `.empty-state` (defined in base.css) used inside
 * the alerts table's single-cell empty row. The Open tab gets the
 * `.empty-state-all-clear` modifier — green-tinted icon + bulleted list
 * explaining what would put an alert here, so a clean state reads as a
 * good thing rather than a missing feature.
 */
.empty-state-alerts {
  /* Cell host stretches full table width; keep the column tight. */
  margin: 1.5rem auto 1rem;
}

.empty-state-all-clear .empty-state-icon-check {
  color: var(--ok);
  opacity: 1;
}

.empty-state-alerts .empty-state-bullets {
  list-style: none;
  margin: 0 0 1rem;
  padding: 0;
  display: flex;
  flex-direction: column;
  gap: 0.45rem;
  text-align: left;
  font-size: 0.85rem;
  color: var(--text);
  max-width: 420px;
  width: 100%;
}
.empty-state-alerts .empty-state-bullets li {
  display: flex;
  align-items: flex-start;
  gap: 0.55rem;
  line-height: 1.4;
}
.empty-state-alerts .empty-state-bullet-icon {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 18px;
  height: 18px;
  background: var(--ok-bg);
  color: var(--ok);
  border-radius: 999px;
  font-size: 0.7rem;
  font-weight: 700;
  flex-shrink: 0;
  margin-top: 0.1rem;
}
.empty-state-footnote {
  font-size: 0.75rem;
  color: var(--muted);
  line-height: 1.5;
  margin: 0;
  max-width: 420px;
  font-style: italic;
}

/* ── Topbar alert bell ──────────────────────────────────────────────── */

.topbar-icon-btn {
  position: relative;
  background: none;
  border: none;
  color: var(--muted);
  cursor: pointer;
  padding: 4px;
  width: 32px;
  height: 32px;
  display: flex;
  align-items: center;
  justify-content: center;
  border-radius: 4px;
  transition: color 0.15s, background 0.15s;
}
.topbar-icon-btn:hover { color: var(--text); background: var(--border); }
.topbar-icon-btn svg { width: 18px; height: 18px; }

.alert-badge {
  position: absolute;
  top: 2px;
  right: 2px;
  min-width: 16px;
  height: 16px;
  padding: 0 4px;
  background: var(--danger);
  color: var(--on-fill);
  font-size: 0.65rem;
  font-weight: 700;
  border-radius: 999px;
  display: flex;
  align-items: center;
  justify-content: center;
}
.alert-badge[hidden] { display: none; }

/* ── Alerts view ─────────────────────────────────────────────────────── */

#alerts-filter-bar {
  display: flex;
  gap: 0.5rem;
  margin-bottom: 1rem;
}

.filter-btn {
  background: var(--panel);
  border: 1px solid var(--border);
  color: var(--muted);
  padding: 0.35rem 0.9rem;
  border-radius: 4px;
  cursor: pointer;
  font-size: 0.85rem;
  transition: border-color 0.15s, color 0.15s;
}
.filter-btn:hover { border-color: var(--accent); color: var(--text); }
.filter-btn.active {
  border-color: var(--accent);
  color: var(--text);
  background: var(--accent-a10);
}

/* Lives inside .alerts-toolbar (a centred flex row) now — a bottom margin
   here would knock it off the baseline of the search box. */
#alerts-count {
  color: var(--muted);
  font-size: 0.85rem;
}

/* ── Status badges ───────────────────────────────────────────────────── */

.status-badge {
  display: inline-block;
  padding: 0.15rem 0.5rem;
  border-radius: 999px;
  font-size: 0.75rem;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.03em;
}
.status-pending { background: var(--warn-bg); color: var(--warn); }
.status-acknowledged { background: var(--accent-a16); color: var(--accent); }
.status-approved { background: var(--ok-bg); color: var(--ok); }
.status-dismissed { background: var(--neutral-bg); color: var(--dim); }

/* ── DSPM pills (reused from sensitivity) ────────────────────────────── */

.dspm-pill {
  display: inline-block;
  padding: 0.12rem 0.45rem;
  border-radius: 999px;
  font-size: 0.72rem;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.03em;
  margin-right: 0.3rem;
}
.dspm-pii  { background: var(--warn-bg); color: var(--warn); }
.dspm-pci  { background: var(--danger-bg); color: var(--danger); }
.dspm-phi  { background: var(--neutral-bg); color: var(--neutral); }
.dspm-secrets { background: var(--accent-a16); color: var(--accent); }

/* ── Alert actions ───────────────────────────────────────────────────── */

.alert-actions {
  display: flex;
  gap: 0.4rem;
}
.alert-actions button {
  font-size: 0.78rem;
  padding: 0.25rem 0.6rem;
}
.btn-ack { border-color: var(--accent); color: var(--accent); }
.btn-ack:hover { background: var(--accent-a10); }
.btn-approve { border-color: var(--ok); color: var(--ok); }
.btn-approve:hover { background: var(--ok-bg); }
.btn-dismiss { border-color: var(--danger); color: var(--danger); }
.btn-dismiss:hover { background: var(--danger-bg); }

/* ── Modal ───────────────────────────────────────────────────────────── */

.modal-overlay {
  position: fixed;
  inset: 0;
  background: var(--overlay);
  display: flex;
  align-items: center;
  justify-content: center;
  z-index: 100;
  padding: 1rem;
}

.modal-content {
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 1.5rem;
  max-width: 600px;
  width: 100%;
  max-height: 80vh;
  overflow-y: auto;
}
.modal-content h3 { margin-bottom: 1rem; font-size: 1.1rem; }

.alert-detail p { margin-bottom: 0.5rem; font-size: 0.9rem; }
.alert-detail h4 {
  margin: 1rem 0 0.5rem;
  font-size: 0.85rem;
  font-weight: 600;
  color: var(--muted);
  text-transform: uppercase;
  letter-spacing: 0.04em;
}

.evidence-json {
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 4px;
  padding: 0.75rem;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.78rem;
  overflow-x: auto;
  white-space: pre-wrap;
  word-break: break-word;
}

.modal-actions {
  display: flex;
  gap: 0.5rem;
  margin-top: 1.25rem;
  flex-wrap: wrap;
}
.modal-actions .btn-close {
  margin-left: auto;
  background: none;
  color: var(--muted);
}
.modal-actions .btn-close:hover { color: var(--text); }

/* ── Alert link ──────────────────────────────────────────────────────── */

.alert-link {
  color: var(--accent);
  text-decoration: none;
  font-weight: 500;
}
.alert-link:hover { text-decoration: underline; }

/* ── Alert type badge ────────────────────────────────────────────────── */

.alert-type-badge {
  display: inline-block;
  padding: 0.12rem 0.5rem;
  border-radius: 4px;
  font-size: 0.72rem;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.03em;
  border: 1px solid;
}
/* One class per alert KIND, not per alert_type — seven types collapse to the
   three things an operator actually does something about. The old pair
   (`alert-type-data-class` / `alert-type-scan-failed`) only covered two of the
   seven, so every DAM alert fell through to the "data class" badge. */
.alert-type-data     { color: var(--neutral); border-color: var(--neutral-border); }
.alert-type-scan     { color: var(--danger);  border-color: var(--danger-border); }
.alert-type-activity { color: var(--info);    border-color: var(--info-border); }
.alert-type-other    { color: var(--dim);     border-color: var(--border); }

/* ── scan_failed detail rendering ────────────────────────────────────── */

.scan-failed-kind {
  display: inline-block;
  padding: 0.12rem 0.45rem;
  border-radius: 4px;
  font-size: 0.72rem;
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.03em;
  background: var(--danger-bg);
  color: var(--danger);
}
.scan-failed-kind.kind-network { background: var(--warn-bg); color: var(--warn); }
.scan-failed-kind.kind-auth    { background: var(--danger-bg); color: var(--danger); }
.scan-failed-kind.kind-tls     { background: var(--accent-a10); color: var(--accent); }
.scan-failed-kind.kind-schema  { background: var(--warn-bg); color: var(--warn); }
.scan-failed-kind.kind-unknown { background: var(--neutral-bg); color: var(--dim); }

.scan-failed-stage {
  color: var(--muted);
  font-size: 0.78rem;
  font-style: italic;
}

.scan-failed-count {
  display: inline-block;
  padding: 0.05rem 0.4rem;
  margin-left: 0.3rem;
  border-radius: 999px;
  background: var(--danger-bg);
  color: var(--danger);
  font-size: 0.7rem;
  font-weight: 700;
}

.scan-failed-message {
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: 4px;
  padding: 0.65rem;
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.78rem;
  white-space: pre-wrap;
  word-break: break-word;
  max-height: 200px;
  overflow-y: auto;
}

/* ── Page context ────────────────────────────────────────────────────── */
/* The table said "DATA CLASS · PCI PHI PII" and nothing else — a reader had no
   way to know what an alert IS, why it fired, or what the three buttons do.
   That sentence is the cheapest fix for it. */

.page-intro {
  color: var(--muted);
  font-size: 0.85rem;
  line-height: 1.6;
  max-width: 70ch;
  margin: 0 0 1.1rem;
}
.page-intro strong { color: var(--text); font-weight: 600; }

/* ── Toolbar: search + count ─────────────────────────────────────────── */

.alerts-toolbar {
  display: flex;
  align-items: center;
  gap: 1rem;
  margin-bottom: 0.6rem;
}
.alerts-search {
  flex: 0 1 22rem;
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 4px;
  color: var(--text);
  font-size: 0.85rem;
  padding: 0.35rem 0.6rem;
}
.alerts-search::placeholder { color: var(--dim); }
.alerts-count { color: var(--muted); font-size: 0.85rem; margin-left: auto; }

.alerts-active-filters {
  font-size: 0.8rem;
  color: var(--muted);
  margin-bottom: 0.6rem;
}
.alerts-active-filters-label { color: var(--dim); text-transform: uppercase; letter-spacing: 0.04em; font-size: 0.72rem; }
.alerts-clear-filters {
  background: none;
  border: 1px solid var(--border);
  border-radius: 4px;
  color: var(--muted);
  cursor: pointer;
  font-size: 0.75rem;
  padding: 0.1rem 0.45rem;
  margin-left: 0.4rem;
}
.alerts-clear-filters:hover { border-color: var(--accent); color: var(--text); }

/* Never let a fetch cap masquerade as completeness — an operator filtering a
   truncated list would otherwise believe they were filtering the whole table. */
.alerts-truncated {
  font-size: 0.8rem;
  color: var(--warn);
  background: var(--warn-bg);
  border: 1px solid var(--warn-border);
  border-radius: 4px;
  padding: 0.4rem 0.6rem;
  margin-bottom: 0.6rem;
}

.alerts-no-match { color: var(--muted); font-style: italic; padding: 1.2rem; text-align: center; }

/* ── The context cell ────────────────────────────────────────────────── */

.alert-cell { max-width: 34rem; }
.alert-headline {
  display: flex;
  align-items: center;
  gap: 0.45rem;
  flex-wrap: wrap;
}
.alert-headline .alert-link { font-weight: 600; }
.alert-subline {
  color: var(--muted);
  font-size: 0.78rem;
  margin-top: 0.2rem;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
.alert-resource {
  font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
  font-size: 0.78rem;
  max-width: 20rem;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
.alert-dim { color: var(--dim); }

/* "14 hours ago" must not break across two lines. */
.alert-age { white-space: nowrap; }

/* "seen 3x" — the dedupe fix means a re-detected finding bumps this counter
   instead of writing another identical row. */
.alert-seen {
  display: inline-block;
  padding: 0.05rem 0.4rem;
  border-radius: 999px;
  background: var(--border);
  color: var(--muted);
  font-size: 0.7rem;
  font-weight: 600;
}

/* Severity: only the DAM rules engine assigns one, and it reuses the product's
   canonical ramp rather than a private scale. */
.alert-sev {
  display: inline-block;
  padding: 0.05rem 0.45rem;
  border-radius: 999px;
  font-size: 0.68rem;
  font-weight: 700;
  text-transform: uppercase;
  letter-spacing: 0.04em;
}
.alert-sev-critical { background: var(--sev-critical-bg); color: var(--sev-critical); }
.alert-sev-high     { background: var(--sev-high-bg);     color: var(--sev-high); }
.alert-sev-medium   { background: var(--sev-medium-bg);   color: var(--sev-medium); }
.alert-sev-low      { background: var(--sev-low-bg);      color: var(--sev-low); }

/* ── Detail modal: where the data was found ──────────────────────────── */
/* class_findings is anonymized by contract (locators + aggregate scores, never
   a sampled value), which is exactly why it can be rendered as a table here
   instead of dumped as raw JSON. */

.alert-loc-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 0.8rem;
  margin-top: 0.4rem;
}
.alert-loc-table th {
  text-align: left;
  color: var(--dim);
  font-weight: 600;
  text-transform: uppercase;
  letter-spacing: 0.04em;
  font-size: 0.68rem;
  padding: 0.25rem 0.5rem;
  border-bottom: 1px solid var(--border);
}
.alert-loc-table td {
  padding: 0.25rem 0.5rem;
  border-bottom: 1px solid var(--border);
  color: var(--text);
}
.alert-loc-table code {
  background: var(--inset);
  padding: 0.05rem 0.3rem;
  border-radius: 3px;
  font-size: 0.75rem;
}