:root {
  --bg:#0b1016; --bg-2:#0f151d; --panel:#121924; --panel-2:#161f2c;
  --border:#1e2938; --border-2:#273548;
  --text:#e6edf6; --muted:#8b9bb0; --faint:#5d6d82;
  --accent:#5eb0f7;
  --ok:#3fb950; --ok-bg:#0f2a18; --ok-bd:#1d4a2c;
  --warn:#d9a441; --warn-bg:#2c2410; --warn-bd:#4a3d17;
  --danger:#f06a6a; --danger-bg:#2e1416; --danger-bd:#4d1f22;
  --accent-bg:#122436; --accent-bd:#1d3d5c;
  --muted-bg:#151d28;
  --row-bd:#161f2b; --row-hover:#141d29;
  --border-hi:#33465e;
  --badge-bg:#0a0f15;
  --focus:var(--accent);
  --mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,monospace;
  --sans:system-ui,-apple-system,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
  --r:8px;
}
@media (prefers-color-scheme: light) {
  :root:not([data-theme="dark"]) {
    --bg:#f6f8fb; --bg-2:#eef2f7; --panel:#ffffff; --panel-2:#f2f5f9;
    --border:#dde4ee; --border-2:#c9d4e4;
    --text:#101823; --muted:#5b6b80; --faint:#8798ae;
    --accent:#1d6fd0;
    --ok:#1a7f43; --ok-bg:#e6f6ec; --ok-bd:#bfe5cd;
    --warn:#8a6410; --warn-bg:#fdf4e0; --warn-bd:#ecd9a8;
    --danger:#c02b2b; --danger-bg:#fdecec; --danger-bd:#f3c5c5;
    --accent-bg:#e3eefb; --accent-bd:#bcd7f5;
    --muted-bg:#eef2f7;
    --row-bd:#e8edf4; --row-hover:#f2f5f9;
    --border-hi:#9db6d8;
    --badge-bg:#eef2f7;
    --focus:#1d6fd0;
  }
}
:root[data-theme="light"] {
  --bg:#f6f8fb; --bg-2:#eef2f7; --panel:#ffffff; --panel-2:#f2f5f9;
  --border:#dde4ee; --border-2:#c9d4e4;
  --text:#101823; --muted:#5b6b80; --faint:#8798ae;
  --accent:#1d6fd0;
  --ok:#1a7f43; --ok-bg:#e6f6ec; --ok-bd:#bfe5cd;
  --warn:#8a6410; --warn-bg:#fdf4e0; --warn-bd:#ecd9a8;
  --danger:#c02b2b; --danger-bg:#fdecec; --danger-bd:#f3c5c5;
  --accent-bg:#e3eefb; --accent-bd:#bcd7f5;
  --muted-bg:#eef2f7;
  --row-bd:#e8edf4; --row-hover:#f2f5f9;
  --border-hi:#9db6d8;
  --badge-bg:#eef2f7;
  --focus:#1d6fd0;
}
* { box-sizing:border-box }
body { margin:0; background:var(--bg); color:var(--text); font:14px/1.45 var(--sans) }
:focus-visible{outline:2px solid var(--focus);outline-offset:2px}

/* ================= app shell ================= */
.app{height:100%;display:flex;flex-direction:column;font-size:13px}
.top{display:flex;align-items:center;gap:20px;padding:0 18px;height:52px;
     background:var(--bg-2);border-bottom:1px solid var(--border);flex:0 0 auto}
.brand{font-weight:650;letter-spacing:-.02em;font-size:15px}
.brand i{color:var(--accent);font-style:normal}
.nav{display:flex;gap:2px}
.nav a{color:var(--muted);text-decoration:none;padding:6px 11px;border-radius:6px;font-size:13px}
.nav a.on{color:var(--text);background:var(--panel-2);font-weight:520}
.nav a .n{font-family:var(--mono);font-size:10.5px;color:var(--faint);
     background:#0a0f15;border:1px solid var(--border);border-radius:999px;padding:0 5px;margin-left:5px}
.spacer{flex:1}
.live{display:flex;align-items:center;gap:6px;font-family:var(--mono);font-size:11px;
     color:var(--ok);background:var(--ok-bg);border:1px solid var(--ok-bd);padding:3px 9px;border-radius:999px}
.live i{width:6px;height:6px;border-radius:50%;background:var(--ok);display:block;
     box-shadow:0 0 0 3px rgba(63,185,80,.18)}
.user{display:flex;align-items:center;gap:8px;color:var(--muted);font-size:12.5px}
.av{width:26px;height:26px;border-radius:50%;background:linear-gradient(135deg,#2b4c73,#1b2c42);
     border:1px solid var(--border-2);display:grid;place-items:center;font-size:11px;color:var(--text)}

.body{flex:1;min-height:0;overflow:hidden;padding:16px 18px;display:flex;flex-direction:column;gap:14px}
.body.scroll{overflow:auto}
/* A page that opts into .body.scroll (/recursos today, via BodyClass): its
   .fill panels would otherwise split the viewport into equal flex slices —
   ~200 px each at 1440x900, internal scroll at ~4 rows. Sized to their
   content, the panels grow with their tables and the page carries the scroll.
   Pages without the class (Estado, Auditoría) keep the fixed body untouched. */
.body.scroll .fill{flex:0 0 auto}

/* ---- kpi strip ---- */
.kpis{display:grid;grid-template-columns:repeat(4,1fr) auto;gap:10px;flex:0 0 auto}
.kpi{background:var(--panel);border:1px solid var(--border);border-radius:var(--r);padding:11px 13px}
.kpi .l{font-size:11px;color:var(--faint);text-transform:uppercase;letter-spacing:.07em;
     display:flex;align-items:center;gap:6px}
.kpi .v{font-family:var(--mono);font-size:25px;font-weight:600;letter-spacing:-.02em;margin-top:3px}
.kpi .d{font-size:11.5px;color:var(--muted);margin-top:1px}
.kpi.warn .v{color:var(--warn)} .kpi.danger .v{color:var(--danger)}
/* .go is the shared action chip: KPI cells and card footers (.foot) use it. */
.go{display:inline-flex;align-items:center;gap:4px;padding:1px 8px;
     font-size:11.5px;line-height:16px;color:var(--accent);background:var(--accent-bg);
     border:1px solid var(--accent-bd);border-radius:6px;text-decoration:none;white-space:nowrap}
.go:hover{border-color:var(--accent);color:var(--text)}
.kpi .go{margin-top:3px}
.dotc{width:7px;height:7px;border-radius:50%;display:inline-block}

.cards2{display:grid;grid-template-columns:1fr 1fr;gap:14px;min-height:0}
/* Expanded card: app.js sets data-expanded on .cards2, which the 5 s poll never
   replaces. The hidden sibling stays in the DOM so its poll keeps refreshing. */
.cards2[data-expanded]{grid-template-columns:minmax(0,1fr)}
.cards2[data-expanded="requests"] #audit-panel,
.cards2[data-expanded="audit"] #requests-panel{display:none}
.cards2[data-expanded] tbody td{white-space:normal;overflow-wrap:anywhere}
/* A 2 KB path must not push Status/IP off the card: clipped with an ellipsis
   (full text in title) until the card is expanded. unicode-bidi:isolate keeps
   any right-to-left text from reordering the neighbouring cells. */
td.path{max-width:32ch;overflow:hidden;text-overflow:ellipsis;unicode-bidi:isolate}
.cards2[data-expanded] td.path{max-width:none;overflow:visible;text-overflow:clip}
.cards3{display:grid;grid-template-columns:1fr 1fr 1fr;gap:14px;min-height:0}
.main{display:grid;grid-template-columns:minmax(0,2.15fr) minmax(300px,1fr);gap:14px;min-height:0;flex:1}
.stack{display:flex;flex-direction:column;gap:14px;min-height:0}

.panel{background:var(--panel);border:1px solid var(--border);border-radius:var(--r);
     display:flex;flex-direction:column;min-height:0;overflow:hidden}
.ph{display:flex;align-items:center;gap:9px;padding:9px 13px;border-bottom:1px solid var(--border);
     flex:0 0 auto}
.ph h3{margin:0;font-size:12.5px;font-weight:600;letter-spacing:.01em}
.ph .cnt{font-family:var(--mono);font-size:11px;color:var(--faint)}
.ph .sp{flex:1}
.ph a{color:var(--accent);text-decoration:none;font-size:12px}
.ph .tagx{font-family:var(--mono);font-size:10.5px;color:var(--faint);
     border:1px solid var(--border);border-radius:5px;padding:1px 6px}

table{width:100%;border-collapse:collapse;font-size:12.5px}
thead th{position:sticky;top:0;background:var(--panel-2);color:var(--faint);text-align:left;
     font-size:10.5px;font-weight:600;text-transform:uppercase;letter-spacing:.07em;
     padding:7px 11px;border-bottom:1px solid var(--border);white-space:nowrap;z-index:2}
tbody td{padding:8px 11px;border-bottom:1px solid var(--row-bd);white-space:nowrap;
     vertical-align:middle}
tbody tr:last-child td{border-bottom:0}
tbody tr:hover{background:var(--row-hover)}
.mono{font-family:var(--mono);font-size:11.5px}
.faint{color:var(--faint)} .muted{color:var(--muted)}
.sub{display:block;color:var(--faint);font-size:11px;font-weight:400}
.scroll-y{overflow:auto;min-height:0}

.pill{display:inline-flex;align-items:center;gap:5px;font-family:var(--mono);font-size:10.5px;
     padding:2px 7px;border-radius:999px;border:1px solid transparent}
.pill.ok{color:var(--ok);background:var(--ok-bg);border-color:var(--ok-bd)}
.pill.hold{color:var(--warn);background:var(--warn-bg);border-color:var(--warn-bd)}
.pill.free{color:var(--muted);background:var(--muted-bg);border-color:var(--border-2)}
.pill.dang{color:var(--danger);background:var(--danger-bg);border-color:var(--danger-bd)}
.pill.acc{color:var(--accent);background:var(--accent-bg);border-color:var(--accent-bd)}

.geo{display:flex;align-items:center;gap:6px}
.geo .fl{font-size:13px;line-height:1}
.geo .asn{color:var(--faint);font-size:10.5px}

.btn{font:inherit;font-size:11.5px;color:var(--muted);background:var(--panel-2);
     border:1px solid var(--border-2);border-radius:6px;padding:3px 9px;cursor:pointer}
.btn:hover{color:var(--text);border-color:var(--border-hi)}
.btn.d{border-color:var(--danger-bd);color:var(--danger)}
.btn.p{background:var(--accent-bg);border-color:var(--accent-bd);color:var(--accent)}

.feed{overflow:auto;min-height:0;padding:4px 0}
.ev{display:flex;gap:9px;padding:7px 13px;border-bottom:1px solid var(--row-bd);align-items:flex-start}
.ev:last-child{border-bottom:0}
.ev .ic{width:18px;height:18px;border-radius:5px;flex:0 0 auto;display:grid;place-items:center;
     font-size:10px;margin-top:1px}
.ic.ok{background:var(--ok-bg);color:var(--ok)} .ic.warn{background:var(--warn-bg);color:var(--warn)}
.ic.dang{background:var(--danger-bg);color:var(--danger)} .ic.acc{background:var(--accent-bg);color:var(--accent)}
.ev .t{flex:1;min-width:0}
.ev .t .r1{font-size:12.3px}
.ev .t .r2{color:var(--faint);font-size:11px;margin-top:2px;overflow:hidden;
     text-overflow:ellipsis;white-space:nowrap}
.ev .w{font-family:var(--mono);font-size:10.5px;color:var(--faint);flex:0 0 auto}

.tabs{display:flex;gap:2px;padding:7px 9px;border-bottom:1px solid var(--border);flex:0 0 auto;
     align-items:center}
.tabs [role="tab"]{font:inherit;font-size:12px;font-weight:520;color:var(--muted);padding:4px 10px;
     border-radius:6px;cursor:pointer;background:none;border:0}
.tabs [role="tab"].on{color:var(--text);background:var(--panel-2)}
.tabs [role="tab"] .n{font-family:var(--mono);font-size:10px;color:var(--faint);margin-left:5px}

.empty{padding:22px;text-align:center;color:var(--faint);font-size:12.5px}
.foot{flex:0 0 auto;display:flex;align-items:center;gap:14px;padding:7px 13px;
     border-top:1px solid var(--border);color:var(--faint);font-family:var(--mono);font-size:10.5px}
/* Tighter line-height keeps the chip from making the footer taller than its text. */
.foot a.go{line-height:14px;font-size:10.5px}

/* auditoria: filter bar, alert line and the two full-height panels */
.fill{flex:1;min-height:0}
.toolbar{flex:0 0 auto;display:flex;align-items:flex-end;gap:10px;flex-wrap:wrap;
     background:var(--panel);border:1px solid var(--border);border-radius:var(--r);padding:9px 13px}
.fld{display:flex;flex-direction:column;gap:3px;color:var(--faint);font-size:10.5px;
     text-transform:uppercase;letter-spacing:.07em}
.toolbar select,.toolbar input{font:inherit;font-size:12px;color:var(--text);background:var(--panel-2);
     border:1px solid var(--border-2);border-radius:6px;padding:4px 8px}
.toolbar a.btn{text-decoration:none;font-size:11.5px}
.alertline{margin:0;min-height:1.2em;color:var(--danger);font-size:12px}
.alertline:empty{min-height:0}

/* estado: 24 h summary grid and severity text */
.summary{padding:10px 13px;display:grid;grid-template-columns:1fr 1fr;gap:8px 14px;font-size:12.3px}
.txt-warn{color:var(--warn)} .txt-danger{color:var(--danger)}

.fold{position:absolute;left:0;right:0;top:900px;border-top:1px dashed #3a4a60;z-index:5}
.fold span{position:absolute;right:10px;top:4px;font-family:var(--mono);font-size:10.5px;
     color:var(--faint);background:#05080c;padding:0 6px}

/* ================= login (standalone shell) ================= */
.login-body{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px}
.login-card{width:100%;max-width:360px;background:var(--panel);border:1px solid var(--border);
     border-radius:12px;padding:20px}
.login-title{font-size:18px;margin:0 0 16px;letter-spacing:-.02em;font-weight:650}
.login-title i{color:var(--accent);font-style:normal}
.login-card .field{display:block;color:var(--muted);font-size:12px;margin:0 0 10px}
.login-card input{width:100%;margin-top:4px;background:var(--panel-2);color:var(--text);
     border:1px solid var(--border-2);border-radius:8px;padding:8px 10px;font:inherit}
.login-actions{display:flex;gap:8px;margin-top:14px}
.login-actions .btn{flex:1;font-size:13px;padding:8px 10px}
#login-error{color:var(--danger);font-size:12px;min-height:1.2em;margin:10px 0 0}
.login-manual{margin:12px 0 0;font-size:12px}
.login-manual a{color:var(--muted);text-decoration:none}
.login-manual a:hover{color:var(--accent)}

/* ================= auditoria: event detail drawer ================= */
/* The row opens the drawer: it is a clickable line, not a button, so the whole
   row is the target and the keyboard can still reach it. */
tbody tr.clickable{cursor:pointer}
tbody tr.clickable:focus-within{background:var(--row-hover)}

.backdrop{position:fixed;inset:0;background:rgba(3,6,10,.55);z-index:20}
.drawer{position:fixed;top:0;right:0;bottom:0;width:min(460px,92vw);z-index:21;
     background:var(--panel);border-left:1px solid var(--border-2);display:flex;
     flex-direction:column;overflow:hidden;box-shadow:-18px 0 40px rgba(0,0,0,.35)}
.drawer[hidden],.backdrop[hidden]{display:none}
.dw-h{display:flex;align-items:center;gap:9px;padding:10px 14px;flex:0 0 auto;
     border-bottom:1px solid var(--border)}
.dw-h h3{margin:0;font-size:13px;font-weight:600}
.dw-h .sp{flex:1}
.dw-b{padding:12px 14px;overflow:auto;min-height:0}
.dw-sub{margin:16px 0 6px;font-size:11px;font-weight:600;color:var(--faint);
     text-transform:uppercase;letter-spacing:.07em}
.kv{display:grid;grid-template-columns:110px minmax(0,1fr);gap:4px 12px;margin:0;font-size:12.3px}
.kv dt{color:var(--faint);font-size:11px;text-transform:uppercase;letter-spacing:.05em;
     padding-top:2px}
.kv dd{margin:0;overflow-wrap:anywhere}
.dw-meta{width:100%;border-collapse:collapse;font-size:12px;table-layout:fixed}
.dw-meta th{position:static;text-align:left;vertical-align:top;width:38%;color:var(--muted);
     background:none;padding:5px 10px 5px 0;font-weight:520;text-transform:none;
     letter-spacing:0;white-space:normal;overflow-wrap:anywhere;border-bottom:1px solid var(--row-bd)}
.dw-meta td{padding:5px 0;vertical-align:top;white-space:normal;overflow-wrap:anywhere;
     border-bottom:1px solid var(--row-bd)}
.dw-meta tr:last-child th,.dw-meta tr:last-child td{border-bottom:0}
.hintx{font-size:11px;color:var(--faint)}

/* ================= recursos: ACL panel ================= */
/* The panel body is a form, not a table: a column stack with the checkbox, the
   one-prefix-per-line textarea and the submit in the panel's own footer. */
.acl-form{display:flex;flex-direction:column;gap:10px;padding:11px 13px;flex:0 0 auto}
.acl-form .chk{display:flex;align-items:center;gap:7px;color:var(--muted);font-size:12.5px;
     text-transform:none;letter-spacing:0}
.acl-form .fld{align-items:stretch}
.acl-form textarea{font-family:var(--mono);font-size:12px;color:var(--text);
     background:var(--panel-2);border:1px solid var(--border-2);border-radius:6px;
     padding:6px 8px;min-width:260px;resize:vertical}
.acl-form .alertline{margin:0}
.acl-form .warnline{color:var(--warn)}

/* ================= perfil: header controls ================= */
/* The three panels carry their one action in the header row (a name + register,
   a name + key + add, a revoke-others), the way the ACL checkbox sits beside
   its textarea. Inputs share the toolbar's field styling. */
.ph input{font:inherit;font-size:12px;color:var(--text);background:var(--panel-2);
     border:1px solid var(--border-2);border-radius:6px;padding:4px 8px}
.ph textarea{font-family:var(--mono);font-size:12px;color:var(--text);
     background:var(--panel-2);border:1px solid var(--border-2);border-radius:6px;
     padding:4px 8px;min-width:220px;max-width:340px;resize:vertical}
.ph label.fld-inline{display:flex;align-items:center;gap:6px;color:var(--faint);
     font-size:10.5px;text-transform:uppercase;letter-spacing:.07em;white-space:nowrap}

/* ================= maquinas: identity detail drawer ================= */
/* The drawer reuses the audit drawer's .dw-h/.dw-b shell and adds only the
   pieces specific to an identity: a titled section, the metadata dl (.meta), the
   reason field, the effect note and the actions row. Every class is scoped to
   .drawer so it cannot touch the page behind it. */
.drawer .sec-l{font-size:10.5px;text-transform:uppercase;letter-spacing:.07em;
     color:var(--faint);margin:0 0 5px}
.drawer .meta{display:grid;grid-template-columns:auto minmax(0,1fr);gap:3px 14px;
     margin:0;font-size:12px}
.drawer .meta dt{color:var(--faint)}
.drawer .meta dd{margin:0;font-family:var(--mono);font-size:11.5px;overflow-wrap:anywhere}
.drawer .reason{display:flex;flex-direction:column;gap:3px;color:var(--faint);font-size:10.5px}
.drawer .reason input{font:inherit;font-size:12px;color:var(--text);background:var(--panel-2);
     border:1px solid var(--border-2);border-radius:6px;padding:6px 8px}
.drawer .note{border:1px solid var(--warn-bd);background:var(--warn-bg);color:var(--warn);
     border-radius:6px;padding:7px 9px;font-size:11.5px}
.drawer .note.info{border-color:var(--accent-bd);background:var(--accent-bg);color:var(--accent)}
.drawer .actions{display:flex;gap:8px;flex-wrap:wrap}
.drawer .alertline{margin:0}

/* ================= salud: component cards ================= */
/* Copied from the approved mockup (docs/mockups/2026-10-09-salud.html). The
   cards reuse .kpi; only the 3-column grid and the dl/note outside a drawer
   are new. */
.kpis.cols3{grid-template-columns:repeat(3,1fr)}
.kpi .meta{display:grid;grid-template-columns:auto minmax(0,1fr);gap:3px 14px;
     margin:8px 0 0;font-size:12px}
.kpi .meta dt{color:var(--faint)}
.kpi .meta dd{margin:0;font-family:var(--mono);font-size:11.5px;overflow-wrap:anywhere}
.kpi .v .pill{font-size:12px}
.panel .note{border:1px solid var(--warn-bd);background:var(--warn-bg);color:var(--warn);
     border-radius:6px;padding:7px 9px;font-size:11.5px}
.panel .note.info{border-color:var(--accent-bd);background:var(--accent-bg);color:var(--accent)}