/* Moepipe control panel — minimal, accessible, framework-free stylesheet.
   System font stack, adequate contrast, visible focus states, responsive,
   theme-aware (respects prefers-color-scheme). */

/* Identity: the landing page's dark indigo->coral system (deploy/nginx/www/index.html).
   Dark is the default (matches the landing); light is retinted on-brand for daytime
   dashboard use. The gradient (--flow) is the primary signature; solid --accent is a
   readable-on-both-themes indigo reserved for links/focus so text always meets contrast. */
:root {
  color-scheme: light dark;

  /* neutrals carry a deliberate indigo bias, not a default grey */
  --bg: #f4f3fb;
  --surface: #ffffff;
  --surface-2: #edeaf7;
  --text: #16142a;
  --text-muted: #5c5878;
  --border: #ddd9ee;
  --accent: #6a3df0;            /* readable indigo on light (links/focus) */
  --accent-contrast: #ffffff;   /* text on a SOLID --accent (skip-link, pill--self) */
  --focus: #6a3df0;
  --danger: #c02636;

  /* brand accents — shared identity; --flow is the signature gradient */
  --indigo: #7c5cff;  --indigo-2: #6a3df0;
  --coral: #ff7a5c;   --coral-2: #e6552f;
  --good: #14875a;
  --flow: linear-gradient(100deg, #7c5cff, #ff7a5c);
  --btn-ink: #0a0713;           /* dark text that rides on the light-ish gradient */

  --ok-bg: #dcf3e6;    --ok-fg: #0f6b43;
  --warn-bg: #ffe6d9;  --warn-fg: #9a3d17;
  --err-bg: #fbdcdc;   --err-fg: #8a1f22;
  --idle-bg: #e7e4f2;  --idle-fg: #454063;

  --radius: 10px;
  --maxw: 64rem;
  --font: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, Roboto,
    Helvetica, Arial, "Apple Color Emoji", "Segoe UI Emoji", sans-serif;
  --mono: ui-monospace, "SF Mono", "JetBrains Mono", "Cascadia Code", Menlo,
    Consolas, monospace;
}

@media (prefers-color-scheme: dark) {
  :root {
    /* landing-exact grounds/ink/line */
    --bg: #0a0a12;
    --surface: #13131f;
    --surface-2: #181826;
    --text: #f3f2fb;
    --text-muted: #8a8aa6;
    --border: #242438;
    --accent: #9a82ff;
    --accent-contrast: #0a0713;
    --focus: #9a82ff;
    --danger: #ff6b6b;

    --indigo: #7c5cff;  --indigo-2: #9a82ff;
    --coral: #ff7a5c;   --coral-2: #ffa07f;
    --good: #3dd7a0;
    --flow: linear-gradient(100deg, #7c5cff, #ff7a5c);
    --btn-ink: #0a0713;

    /* active=mint, pending=coral (matches the landing's warm/cool semantics) */
    --ok-bg: color-mix(in oklab, #3dd7a0 15%, transparent);   --ok-fg: #3dd7a0;
    --warn-bg: color-mix(in oklab, #ff7a5c 15%, transparent); --warn-fg: #ffa07f;
    --err-bg: #3a1b1c;   --err-fg: #f5a7a1;
    --idle-bg: #232338;  --idle-fg: #b7b6cf;
  }
}

*, *::before, *::after { box-sizing: border-box; }

html { -webkit-text-size-adjust: 100%; }

body {
  margin: 0;
  font-family: var(--font);
  font-size: 1rem;
  line-height: 1.55;
  letter-spacing: -0.006em;
  color: var(--text);
  /* the landing's ambient glow — subtle on light, present on dark; fixed so it reads
     as a page backdrop, not a scrolling element */
  background:
    radial-gradient(1100px 600px at 88% -12%, color-mix(in oklab, var(--indigo) 13%, transparent), transparent 60%),
    radial-gradient(900px 560px at 2% 2%, color-mix(in oklab, var(--coral) 8%, transparent), transparent 55%),
    var(--bg);
  background-attachment: fixed;
  display: flex;
  flex-direction: column;
  min-height: 100vh;
}

.container {
  width: 100%;
  max-width: var(--maxw);
  margin-inline: auto;
  padding-inline: 1.25rem;
}

.main { flex: 1 0 auto; padding-block: 1.75rem 3rem; }
.main:focus { outline: none; }

/* --- Skip link --------------------------------------------------------- */
.skip-link {
  position: absolute;
  left: 0.5rem;
  top: -3rem;
  z-index: 100;
  padding: 0.5rem 0.9rem;
  background: var(--accent);
  color: var(--accent-contrast);
  border-radius: var(--radius);
  transition: top 0.15s ease;
}
.skip-link:focus { top: 0.5rem; }

/* --- Header / nav ------------------------------------------------------ */
.site-header {
  background: var(--surface);
  border-bottom: 1px solid var(--border);
}
.site-header__inner {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 1rem;
  min-height: 3.5rem;
  flex-wrap: wrap;
}
.brand {
  display: inline-flex;
  align-items: center;
  gap: 0.5rem;
  font-weight: 800;
  font-size: 1.1rem;
  letter-spacing: -0.03em;
  text-decoration: none;
  color: var(--text);
}
.brand-glyph { flex: 0 0 auto; }
.nav-list {
  display: flex;
  align-items: center;
  gap: 1rem;
  list-style: none;
  margin: 0;
  padding: 0;
}
.nav-list a { color: var(--text-muted); text-decoration: none; }
.nav-list a[aria-current="page"] { color: var(--text); font-weight: 600; }
.nav-list a:hover { color: var(--accent); }
.nav-form { margin: 0; }

/* --- Org switcher (customer plane header — ORG-DESIGN §3.4) ------------- */
.org-switcher { margin: 0; }
.org-switcher__select {
  font: inherit;
  color: var(--text);
  background: var(--surface-2);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 0.3rem 0.5rem;
  max-width: 16rem;
}
.org-switcher__select:focus-visible {
  outline: 2px solid var(--focus);
  outline-offset: 1px;
}
.org-switcher__go { margin-left: 0.4rem; }
.org-current {
  font-size: 0.9rem;
  color: var(--text-muted);
  padding: 0.2rem 0.55rem;
  border: 1px solid var(--border);
  border-radius: var(--radius);
  background: var(--surface-2);
}

/* --- Footer ------------------------------------------------------------ */
.site-footer {
  flex-shrink: 0;
  border-top: 1px solid var(--border);
  color: var(--text-muted);
  font-size: 0.85rem;
  padding-block: 1rem;
}

/* --- Typography -------------------------------------------------------- */
h1 { font-size: 1.6rem; line-height: 1.2; margin: 0 0 0.5rem; }
h2 { font-size: 1.2rem; margin: 0 0 0.75rem; }
.lede { color: var(--text-muted); margin: 0 0 1.5rem; max-width: 46rem; }
.muted { color: var(--text-muted); }
.empty { color: var(--text-muted); font-style: italic; margin-top: 0.75rem; }
code { font-family: var(--mono); font-size: 0.9em; }

/* --- Cards ------------------------------------------------------------- */
.card {
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 1.25rem;
  margin-bottom: 2rem;
}

.auth-card {
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 1.5rem;
  max-width: 24rem;
  margin: 2rem auto;
}

/* --- Tables ------------------------------------------------------------ */
.table-wrap { overflow-x: auto; border: 1px solid var(--border); border-radius: var(--radius); }
.data-table {
  width: 100%;
  border-collapse: collapse;
  font-size: 0.95rem;
  background: var(--surface);
}
.data-table caption { text-align: left; }
.data-table th, .data-table td {
  text-align: left;
  padding: 0.6rem 0.75rem;
  border-bottom: 1px solid var(--border);
  vertical-align: top;
}
.data-table thead th {
  background: var(--surface-2);
  font-weight: 600;
  white-space: nowrap;
}
.data-table tbody tr:last-child th,
.data-table tbody tr:last-child td { border-bottom: none; }
.data-table .num { text-align: right; font-variant-numeric: tabular-nums; }

.svc-list { list-style: none; margin: 0; padding: 0; display: grid; gap: 0.35rem; }
.svc-list a { color: var(--accent); }

/* Device / tag / live-status cells */
.device-name { font-weight: 600; }
.tag {
  display: inline-block;
  margin-top: 0.15rem;
  padding: 0.05rem 0.4rem;
  border-radius: 999px;
  background: var(--surface-2);
  color: var(--text-muted);
  font-family: var(--mono);
  font-size: 0.75rem;
}
.status-note { color: var(--text-muted); font-size: 0.8rem; margin-left: 0.15rem; }

/* Show-once enrollment key callout */
.enroll-row td { background: var(--warn-bg); }
.enroll-callout { display: grid; gap: 0.5rem; }
.enroll-warning { margin: 0; color: var(--warn-fg); }
.enroll-cmd {
  margin: 0;
  padding: 0.6rem 0.75rem;
  overflow-x: auto;
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
}
.enroll-cmd code { font-family: var(--mono); font-size: 0.85rem; white-space: pre; }

/* Subdomain input with a trailing ".managed.<domain>" affix */
.input-affix { display: flex; align-items: stretch; flex-wrap: wrap; gap: 0.25rem; }
.input-affix input { flex: 1 1 12rem; min-width: 0; }
.affix {
  display: inline-flex;
  align-items: center;
  padding: 0 0.5rem;
  color: var(--text-muted);
  font-family: var(--mono);
  font-size: 0.85rem;
  white-space: nowrap;
}

/* --- Badges & status dots --------------------------------------------- */
.badge {
  display: inline-block;
  padding: 0.12rem 0.55rem;
  border-radius: 999px;
  font-family: var(--mono);
  font-size: 0.72rem;
  font-weight: 600;
  letter-spacing: 0.02em;
  line-height: 1.6;
  background: var(--idle-bg);
  color: var(--idle-fg);
  text-transform: lowercase;
  border: 1px solid color-mix(in oklab, currentColor 28%, transparent);
}
.badge--active, .badge--authentik { background: var(--ok-bg); color: var(--ok-fg); }
.badge--pending, .badge--suspended, .badge--breakglass { background: var(--warn-bg); color: var(--warn-fg); }
.badge--error, .badge--expired, .badge--deleted { background: var(--err-bg); color: var(--err-fg); }
.badge--removed { background: var(--idle-bg); color: var(--idle-fg); }
/* Ephemeral is a device TYPE marker (not a lifecycle state): neutral + italic. */
.badge--ephemeral { background: var(--idle-bg); color: var(--idle-fg); font-style: italic; }

/* --- Admin status console (M-admin-console) --- */
.badge--ok { background: var(--ok-bg); color: var(--ok-fg); }
.badge--fail { background: var(--err-bg); color: var(--err-fg); }
.badge--stalled { background: var(--warn-bg); color: var(--warn-fg); }
.check-list, .callouts { list-style: none; padding: 0; margin: 0; display: grid; gap: .45rem; }
.check-list li, .callouts li { display: flex; align-items: center; gap: .6rem; }
.status-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(14rem, 1fr)); gap: 1.5rem; }
.kv { display: grid; grid-template-columns: max-content 1fr; gap: .35rem 1rem; margin: 0; }
.kv dt { color: var(--text-muted); }
.kv dd { margin: 0; }
.muted-note { color: var(--text-muted); font-size: .9rem; margin: .75rem 0 0; }
.err-text { color: var(--err-fg); word-break: break-word; }

.dot {
  display: inline-block;
  width: 0.6rem;
  height: 0.6rem;
  border-radius: 50%;
  margin-left: 0.35rem;
  vertical-align: middle;
}
.dot--online { background: var(--good); box-shadow: 0 0 0 3px color-mix(in oklab, var(--good) 26%, transparent); }
.dot--offline { background: var(--border); }

/* --- Forms ------------------------------------------------------------- */
.field { margin-bottom: 1rem; }
label {
  display: block;
  font-weight: 600;
  margin-bottom: 0.3rem;
}
input[type="text"],
input[type="email"],
input[type="password"],
input[type="number"] {
  width: 100%;
  padding: 0.55rem 0.65rem;
  font: inherit;
  color: var(--text);
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
}
input:hover { border-color: var(--text-muted); }
.field-help { margin: 0.35rem 0 0; font-size: 0.85rem; color: var(--text-muted); }
.form-error {
  margin: 0 0 1rem;
  padding: 0.6rem 0.75rem;
  border-radius: var(--radius);
  background: var(--err-bg);
  color: var(--err-fg);
  border: 1px solid color-mix(in srgb, var(--err-fg) 25%, transparent);
}
.form-ok {
  margin: 0 0 1rem;
  padding: 0.6rem 0.75rem;
  border-radius: var(--radius);
  background: var(--ok-bg);
  color: var(--ok-fg);
  border: 1px solid color-mix(in oklab, var(--ok-fg) 30%, transparent);
}

/* --- Tunnel-type selector (M-L4 create flow) --------------------------- */
.tunnel-modes {
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 0.5rem 0.9rem 0.75rem;
  margin: 0 0 1.25rem;
}
.tunnel-modes legend {
  font-weight: 600;
  padding: 0 0.35rem;
}
.mode-option {
  display: flex;
  align-items: flex-start;
  gap: 0.6rem;
  padding: 0.5rem 0;
}
.mode-option + .mode-option { border-top: 1px solid var(--border); }
.mode-option input[type="radio"] {
  margin-top: 0.3rem;
  flex: 0 0 auto;
  accent-color: var(--accent);
}
.mode-option label { font-weight: 600; margin: 0; cursor: pointer; }
.mode-option .mode-desc {
  display: block;
  margin-top: 0.15rem;
  font-weight: 400;
  font-size: 0.85rem;
  color: var(--text-muted);
}

/* Mode-conditional subdomain suffix — decorative, aria-hidden. The visible one
   tracks the checked radio via :has(); managed shows by default so a browser
   without :has support still renders a coherent (if static) suffix. */
.tunnel-suffix { display: none; }
.tunnel-suffix--managed { display: inline-flex; }
.add-tunnel-form:has(#mode-http:checked) .tunnel-suffix--tcp,
.add-tunnel-form:has(#mode-http:checked) .tunnel-suffix--l4 { display: none; }
.add-tunnel-form:has(#mode-http:checked) .tunnel-suffix--managed { display: inline-flex; }
.add-tunnel-form:has(#mode-tcp_raw:checked) .tunnel-suffix--managed,
.add-tunnel-form:has(#mode-tcp_raw:checked) .tunnel-suffix--l4 { display: none; }
.add-tunnel-form:has(#mode-tcp_raw:checked) .tunnel-suffix--tcp { display: inline-flex; }
.add-tunnel-form:has(#mode-tcp_managed:checked) .tunnel-suffix--managed,
.add-tunnel-form:has(#mode-tcp_managed:checked) .tunnel-suffix--tcp { display: none; }
.add-tunnel-form:has(#mode-tcp_managed:checked) .tunnel-suffix--l4 { display: inline-flex; }

/* Mode-conditional fields (M-L4 create flow). The custom-FQDN field is shown for
   ALL THREE BYO modes (uploaded + issued + passthrough); the cert/key textareas ONLY
   for the upload mode (issued obtains the cert via ACME, passthrough leaves it on the
   backend — neither uploads anything); the Moepipe-subdomain field is hidden for
   every BYO mode. Toggled with :has() like the suffix above — a browser without
   :has() keeps the BYO fields hidden, and the server validates every mode regardless,
   so the form always fails CLOSED, never open. */
.tunnel-field--fqdn,
.tunnel-field--cert { display: none; }
/* Custom FQDN — all three BYO modes. */
.add-tunnel-form:has(#mode-tcp_byo_uploaded:checked) .tunnel-field--fqdn,
.add-tunnel-form:has(#mode-tcp_byo_issued:checked) .tunnel-field--fqdn,
.add-tunnel-form:has(#mode-tcp_byo_passthrough:checked) .tunnel-field--fqdn {
  display: block;
}
/* Cert + key textareas — the UPLOAD mode only. */
.add-tunnel-form:has(#mode-tcp_byo_uploaded:checked) .tunnel-field--cert {
  display: block;
}
/* Moepipe subdomain — hidden for every BYO mode (they use a full FQDN). */
.add-tunnel-form:has(#mode-tcp_byo_uploaded:checked) .tunnel-field--subdomain,
.add-tunnel-form:has(#mode-tcp_byo_issued:checked) .tunnel-field--subdomain,
.add-tunnel-form:has(#mode-tcp_byo_passthrough:checked) .tunnel-field--subdomain {
  display: none;
}

/* PEM upload textareas (BYO cert + key) — monospace, vertically resizable. */
.pem-input {
  width: 100%;
  padding: 0.55rem 0.65rem;
  font-family: var(--mono);
  font-size: 0.82rem;
  line-height: 1.4;
  color: var(--text);
  background: var(--surface);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  resize: vertical;
  min-height: 6rem;
  white-space: pre;
  overflow-wrap: normal;
}
.pem-input:hover { border-color: var(--text-muted); }

/* Sticky host:port shown for an L4 service in the device list (non-clickable). */
.conn-target { font-family: var(--mono); font-size: 0.9em; word-break: break-all; }

/* Pending-until-issued note for a byo_issued service whose ACME cert is not yet live
   (the DNS-pointing reminder that gates HTTP-01 validation). Warn-toned so it reads
   as "action may be needed", distinct from the green live state. */
.issuing-note {
  margin: 0.4rem 0 0;
  padding: 0.4rem 0.6rem;
  font-size: 0.82rem;
  line-height: 1.45;
  color: var(--warn-fg);
  background: var(--warn-bg);
  border-radius: var(--radius);
}
.issuing-note code { font-family: var(--mono); word-break: break-all; }

/* Steady-state passthrough reminder (byo_passthrough, once live): the FQDN must
   A/AAAA at Moepipe and the backend presents its OWN cert. Muted/informational —
   distinct from the warn-toned .issuing-note shown while verification is pending. */
.passthrough-note {
  margin: 0.35rem 0 0;
  font-size: 0.82rem;
  line-height: 1.45;
  color: var(--text-muted);
}
.passthrough-note code { font-family: var(--mono); word-break: break-all; }

/* Provisioning callout: a pending device before its one-time enrollment key is
   minted (a couple of reconcile ticks after create). Reuses the warn-toned
   .issuing-note box; this lays the inline spinner + "Check now" button out. */
.provisioning-note {
  display: flex;
  align-items: center;
  flex-wrap: wrap;
  gap: 0.5rem;
}
.provisioning-note .btn-sm { margin-left: auto; }
.spinner {
  width: 0.9rem;
  height: 0.9rem;
  flex: 0 0 auto;
  border: 2px solid color-mix(in srgb, var(--warn-fg) 30%, transparent);
  border-top-color: var(--warn-fg);
  border-radius: 50%;
  animation: mp-spin 0.7s linear infinite;
}
@keyframes mp-spin { to { transform: rotate(360deg); } }
@media (prefers-reduced-motion: reduce) {
  .spinner { animation: none; }
}

/* --- Buttons ----------------------------------------------------------- */
button {
  font: inherit;
  cursor: pointer;
  padding: 0.5rem 1rem;
  border-radius: var(--radius);
  border: 1px solid transparent;
  background: var(--flow);
  color: var(--btn-ink);
  font-weight: 650;
  box-shadow: 0 8px 22px -12px color-mix(in oklab, var(--indigo) 65%, transparent);
  transition: filter 0.16s ease, transform 0.16s ease;
}
button:hover { filter: brightness(1.06); transform: translateY(-1px); }
button:active { transform: none; }
button:disabled {
  cursor: not-allowed;
  opacity: 0.55;
  background: var(--surface-2);
  color: var(--text-muted);
  border-color: var(--border);
  box-shadow: none;
  transform: none;
}
.linklike {
  background: none;
  border: none;
  color: var(--text-muted);
  padding: 0;
  font-weight: 500;
  box-shadow: none;
  transform: none;
}
.linklike:hover { background: none; color: var(--accent); text-decoration: underline; transform: none; }

/* Anchor styled as a button — mirrors the <button> treatment for links (downloads,
   cross-page CTAs). Composes with .btn-sm / .btn-secondary. */
.btn {
  display: inline-flex; align-items: center; justify-content: center; gap: 0.5rem;
  font: inherit; font-weight: 650; text-decoration: none; cursor: pointer;
  padding: 0.5rem 1rem; border-radius: var(--radius); border: 1px solid transparent;
  background: var(--flow); color: var(--btn-ink);
  box-shadow: 0 8px 22px -12px color-mix(in oklab, var(--indigo) 65%, transparent);
  transition: filter 0.16s ease, transform 0.16s ease;
}
.btn:hover { filter: brightness(1.06); transform: translateY(-1px); }
.btn:active { transform: none; }

/* --- moe CLI download page -------------------------------------------- */
.dl-grid {
  display: grid; gap: 0.75rem; margin: 1.1rem 0 0;
  grid-template-columns: repeat(auto-fit, minmax(190px, 1fr));
}
.dl-item {
  display: flex; flex-direction: column; gap: 0.55rem; padding: 1rem;
  border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface-2);
}
.dl-item.is-suggested { border-color: color-mix(in oklab, var(--indigo) 55%, transparent); }
.dl-os { font-weight: 650; }
.dl-arch { font-family: var(--mono); font-size: 0.8rem; color: var(--text-muted); }
.dl-suggested-tag {
  align-self: flex-start; font-family: var(--mono); font-size: 0.68rem; letter-spacing: 0.08em;
  text-transform: uppercase; padding: 0.1rem 0.4rem; border-radius: 6px;
  color: var(--accent); border: 1px solid color-mix(in oklab, var(--indigo) 35%, transparent);
}
.dl-item .btn { margin-top: auto; }
.dl-unavailable {
  margin-top: 1rem; padding: 0.9rem 1rem; font-size: 0.9rem; color: var(--text-muted);
  border: 1px dashed var(--border); border-radius: var(--radius);
}
.ref-table { width: 100%; border-collapse: collapse; font-size: 0.92rem; }
.ref-table td { padding: 0.55rem 0.5rem; border-top: 1px solid var(--border); vertical-align: top; }
.ref-table tr:first-child td { border-top: 0; }
.ref-table td:first-child { white-space: nowrap; width: 1%; padding-right: 1.25rem; }
.ref-table code { font-size: 0.82rem; }

/* --- Personal access tokens (Settings) -------------------------------- */
.token-new {
  margin: 0.5rem 0 1rem; padding: 0.9rem 1rem; border-radius: var(--radius);
  border: 1px solid color-mix(in oklab, var(--ok-fg, #3dd7a0) 45%, transparent);
  background: var(--ok-bg);
}
.token-reveal { display: flex; align-items: center; gap: 0.6rem; margin-top: 0.55rem; flex-wrap: wrap; }
.token-reveal code { font-family: var(--mono); font-size: 0.85rem; word-break: break-all; }
.token-form { display: flex; gap: 1rem; align-items: flex-end; flex-wrap: wrap; margin: 1rem 0 0.5rem; }
.token-form .field { margin: 0; }
.token-table { width: 100%; border-collapse: collapse; font-size: 0.9rem; margin-top: 1rem; }
.token-table th {
  text-align: left; font-size: 0.72rem; text-transform: uppercase; letter-spacing: 0.05em;
  font-weight: 600; color: var(--text-muted); padding: 0.4rem 0.6rem;
  border-bottom: 1px solid var(--border);
}
.token-table td { padding: 0.55rem 0.6rem; border-bottom: 1px solid var(--border); vertical-align: middle; }
.token-table td.mono { font-family: var(--mono); font-size: 0.82rem; color: var(--text-muted); }
.token-table form { margin: 0; }
.token-actions { text-align: right; }

/* Compact + variant buttons (member-management actions) */
.btn-sm { padding: 0.3rem 0.6rem; font-size: 0.85rem; }
.btn-secondary {
  background: var(--surface-2);
  color: var(--text);
  border-color: var(--border);
  box-shadow: none;
}
.btn-secondary:hover { background: color-mix(in srgb, var(--surface-2) 80%, var(--text)); filter: none; }
.btn-danger {
  background: transparent;
  color: var(--danger);
  border-color: color-mix(in srgb, var(--danger) 45%, transparent);
  box-shadow: none;
}
.btn-danger:hover {
  background: color-mix(in srgb, var(--danger) 12%, transparent);
  color: var(--danger);
}

/* Device "Remove" action + the "removing…" status while teardown converges. */
.device-remove { font-size: 0.8rem; margin-left: 0.5rem; }
.status-note.removing { color: var(--warn-fg); font-style: italic; }

/* Inline "edit port" disclosure on a service. */
.port-edit { display: block; margin-top: 0.3rem; }
.port-edit > summary {
  cursor: pointer;
  width: max-content;
  color: var(--text-muted);
  font-size: 0.8rem;
}
.port-edit > summary:hover { color: var(--accent); text-decoration: underline; }
.port-edit form {
  display: inline-flex;
  align-items: center;
  gap: 0.4rem;
  margin-top: 0.35rem;
}
.port-edit label {
  display: inline-flex;
  align-items: center;
  gap: 0.35rem;
  font-size: 0.8rem;
  color: var(--text-muted);
}
.port-edit input[type="number"] { width: 6rem; padding: 0.25rem 0.4rem; }

/* Admin customer-row actions: inline POST forms (Suspend / Kill), side by side. */
.cell-actions { white-space: nowrap; }
.admin-action { display: inline-block; margin: 0 0.3rem 0 0; }

/* --- Member management (ORG-DESIGN §2.2) ------------------------------- */
.add-member-form .field { max-width: 24rem; }
.member-email { display: block; font-size: 0.82rem; }
.member-seen { font-variant-numeric: tabular-nums; white-space: nowrap; }
.member-actions {
  display: flex;
  flex-wrap: wrap;
  gap: 0.4rem;
  align-items: center;
}
.inline-form { margin: 0; }
.member-note { margin-top: 0.75rem; max-width: 46rem; }

/* Small inline pills for member-type / self markers */
.pill {
  display: inline-block;
  padding: 0.05rem 0.45rem;
  border-radius: 999px;
  font-size: 0.72rem;
  font-weight: 600;
  line-height: 1.6;
  background: var(--surface-2);
  color: var(--text-muted);
}
.pill--self {
  margin-left: 0.35rem;
  background: var(--accent);
  color: var(--accent-contrast);
}
.pill--managed { background: var(--warn-bg); color: var(--warn-fg); }

/* --- Expose-a-service disclosure (streamlined dashboard) --------------- */
.expose-panel { margin: 0.35rem 0 1.75rem; }
.expose-toggle {
  display: inline-flex;
  align-items: center;
  gap: 0.4rem;
  width: max-content;
  cursor: pointer;
  font-weight: 650;
  font-size: 0.95rem;
  color: var(--btn-ink);
  background: var(--flow);
  padding: 0.5rem 1rem;
  border-radius: var(--radius);
  box-shadow: 0 8px 22px -12px color-mix(in oklab, var(--indigo) 65%, transparent);
  list-style: none;                 /* drop the default disclosure triangle */
  transition: filter 0.16s ease;
}
.expose-toggle::-webkit-details-marker { display: none; }
.expose-toggle:hover { filter: brightness(1.06); }
.expose-panel[open] .expose-toggle { margin-bottom: 1rem; }
.expose-body { margin: 0; }
/* "Expose another service on <device>" — the on-demand form panel + its per-row trigger */
#service-form-slot:not(:empty) { margin: 1rem 0 1.75rem; }
.expose-head { display: flex; align-items: baseline; justify-content: space-between; gap: 1rem; margin-bottom: 0.85rem; }
.add-service-row { margin: 0.6rem 0 0; }
.add-service-row .linklike { font-size: 0.9rem; padding-left: 0; }
.svc-edit-domain { margin-right: 0.75rem; font-size: 0.85rem; }

/* --- Enrollment key: copyable field, no scroll-resetting command box ---- */
.enroll-key-row {
  display: flex;
  gap: 0.5rem;
  align-items: stretch;
  flex-wrap: wrap;
  margin-top: 0.5rem;
}
.enroll-key {
  flex: 1 1 20rem;
  min-width: 0;
  font-family: var(--mono);
  font-size: 0.85rem;
  padding: 0.5rem 0.65rem;
  border-radius: var(--radius);
  border: 1px solid var(--border);
  background: var(--surface);
  color: var(--text);
}
.enroll-key-row .copy-btn { flex: 0 0 auto; }
.copy-btn.copied {
  color: var(--ok-fg);
  border-color: color-mix(in oklab, var(--ok-fg) 40%, transparent);
}
.enroll-help { margin: 0.5rem 0 0; font-size: 0.85rem; }

/* --- Focus: always visible, never removed ------------------------------ */
:focus-visible {
  outline: 3px solid var(--focus);
  outline-offset: 2px;
  border-radius: 4px;
}
/* Keep a visible ring for mouse users on interactive controls too. */
a:focus-visible, button:focus-visible, input:focus-visible {
  outline: 3px solid var(--focus);
  outline-offset: 2px;
}

/* --- Utilities --------------------------------------------------------- */
.visually-hidden {
  position: absolute !important;
  width: 1px; height: 1px;
  padding: 0; margin: -1px;
  overflow: hidden;
  clip: rect(0, 0, 0, 0);
  white-space: nowrap;
  border: 0;
}

@media (max-width: 40rem) {
  h1 { font-size: 1.4rem; }
  .nav-list { gap: 0.75rem; }
}

@media (prefers-reduced-motion: reduce) {
  * { transition: none !important; }
}

/* --- Billing / parody "Upgrade" page ---------------------------------- */
.plan-grid {
  display: grid; gap: 0.9rem; margin: 1.2rem 0 0;
  grid-template-columns: repeat(auto-fit, minmax(210px, 1fr));
}
.plan-card {
  display: flex; flex-direction: column; gap: 0.5rem; padding: 1.15rem;
  border: 1px solid var(--border); border-radius: var(--radius); background: var(--surface-2);
  position: relative;
}
.plan-card.is-current { border-color: color-mix(in oklab, var(--indigo) 55%, transparent); }
.plan-tag {
  align-self: flex-start; font-family: var(--mono); font-size: 0.66rem; letter-spacing: 0.08em;
  text-transform: uppercase; padding: 0.1rem 0.4rem; border-radius: 6px;
  color: var(--accent); border: 1px solid color-mix(in oklab, var(--indigo) 35%, transparent);
}
.plan-name { font-weight: 700; font-size: 1.15rem; }
.plan-price { font-weight: 700; font-size: 1.6rem; line-height: 1; }
.plan-cadence { font-weight: 500; font-size: 0.85rem; color: var(--text-muted); margin-left: 0.15rem; }
.plan-tagline { margin: 0.1rem 0 0.35rem; color: var(--text-muted); font-size: 0.9rem; }
.plan-features { list-style: none; margin: 0; padding: 0; display: grid; gap: 0.35rem; font-size: 0.88rem; }
.plan-features li { padding-left: 1.1rem; position: relative; }
.plan-features li::before { content: "✓"; position: absolute; left: 0; color: var(--accent); }
.plan-card .btn, .plan-card > button { margin-top: auto; }
.plan-footnotes { margin-top: 1rem; font-size: 0.8rem; color: var(--text-muted); }
.checkout { margin-top: 1.4rem; max-width: 30rem; }
.checkout-form { display: flex; flex-direction: column; gap: 0.75rem; margin-top: 0.5rem; }
.checkout-form .field { margin: 0; }
.checkout-row { display: flex; gap: 1rem; flex-wrap: wrap; }
.checkout-row .field { flex: 1 1 8rem; }
.checkout-form .linklike { align-self: flex-start; }