/* VESUV Verwaltungsoberfläche
   Palette: Asche (Seite), Basalt (Navigation/Primär), Schwefel (Fokus/Auswahl),
   Moos = erlaubt, Lava = verboten, Kaldera = MFA nötig. Keine externen Schriften (lokal betreibbar, DSGVO-freundlich). */
:root {
  --ash: #e8ebea;
  --paper: #f8f9f8;
  --line: #cfd5d3;
  --line-soft: #dde2e0;
  --basalt: #243038;
  --basalt-2: #33434c;
  --ink: #1c262c;
  --muted: #5a6a70;
  --sulfur: #b9960f;
  --sulfur-soft: #f3e9b8;
  --moss: #1f6f4a;
  --moss-soft: #d5ebdf;
  --lava: #b3361a;
  --lava-soft: #f5d9d0;
  --caldera: #5a4a9e;
  --caldera-soft: #e2dcf3;
  --amber-soft: #f4e3c2;
  --amber: #8a5a00;
  --focus: 0 0 0 3px rgba(185, 150, 15, .55);
  --sans: "Segoe UI Variable Text", "Segoe UI", system-ui, -apple-system, "Helvetica Neue", Arial, sans-serif;
  --mono: ui-monospace, "Cascadia Code", "SF Mono", Menlo, Consolas, monospace;
}
@media (prefers-color-scheme: dark) {
  :root {
    --ash: #151b1f; --paper: #1d252a; --line: #35434a; --line-soft: #2a363c; --basalt: #0f1417; --basalt-2: #26323a;
    --ink: #e4e9e8; --muted: #93a3a9; --sulfur: #d8b63a; --sulfur-soft: #4a4012;
    --moss: #5fc08f; --moss-soft: #1c3a2c; --lava: #ee7a5e; --lava-soft: #4a2219;
    --caldera: #b3a4f0; --caldera-soft: #2e2850; --amber: #e5b55c; --amber-soft: #43330f;
  }
}
* { box-sizing: border-box; }
html, body { margin: 0; height: 100%; }
body { font: 15px/1.5 var(--sans); color: var(--ink); background: var(--ash); -webkit-font-smoothing: antialiased; }
h1, h2, h3 { margin: 0; line-height: 1.2; font-weight: 650; }
h1 { font-size: 1.55rem; letter-spacing: -.01em; }
h2 { font-size: 1.15rem; }
h3 { font-size: 1rem; }
p { margin: 0 0 .6em; }
a { color: inherit; }
code, .mono { font-family: var(--mono); font-size: .86em; }
:focus-visible { outline: none; box-shadow: var(--focus); border-radius: 3px; }
.muted { color: var(--muted); }
.sr { position: absolute; width: 1px; height: 1px; overflow: hidden; clip: rect(0 0 0 0); }
.noscript { padding: 2rem; }
@media (prefers-reduced-motion: reduce) { * { animation: none !important; transition: none !important; } }

/* --- Anmeldung ---------------------------------------------------------------------------------- */
.login { min-height: 100vh; display: grid; grid-template-columns: minmax(0, 1.15fr) minmax(0, 1fr); }
.login-brand { background: var(--basalt); color: #e8ebea; padding: clamp(2rem, 6vw, 5rem); display: flex; flex-direction: column; justify-content: space-between; }
.login-brand .mark { display: flex; align-items: center; gap: .7rem; font-weight: 800; letter-spacing: .28em; font-size: 1.05rem; }
.login-brand .mark img { width: 44px; height: 44px; }
.login-brand .claim { font-size: clamp(2.2rem, 5vw, 3.9rem); line-height: 1.04; font-weight: 750; letter-spacing: -.02em; max-width: 12ch; }
.login-brand .claim span { display: block; color: #c9a21b; }
.login-brand .sub { color: #9fb0b6; max-width: 40ch; }
.login-form { display: grid; place-items: center; padding: 2rem; background: var(--paper); }
.login-form form { width: min(380px, 100%); display: grid; gap: 1rem; }
.login-form h1 { margin-bottom: .2rem; }
@media (max-width: 800px) { .login { grid-template-columns: 1fr; } .login-brand { min-height: 38vh; } .login-brand .claim { font-size: 2.2rem; } }

/* --- Gerüst ------------------------------------------------------------------------------------ */
.shell { display: grid; grid-template-columns: 232px minmax(0, 1fr); min-height: 100vh; }
.nav { background: var(--basalt); color: #dfe6e6; padding: 1rem .6rem; display: flex; flex-direction: column; gap: .15rem; position: sticky; top: 0; height: 100vh; overflow: auto; }
.nav .brand { display: flex; align-items: center; gap: .6rem; padding: .3rem .6rem 1rem; font-weight: 800; letter-spacing: .26em; font-size: .95rem; }
.nav .brand img { width: 30px; height: 30px; }
.nav a { display: flex; align-items: center; gap: .65rem; padding: .5rem .65rem; border-radius: 4px; text-decoration: none; color: #c4cfd1; border-left: 3px solid transparent; }
.nav a:hover { background: var(--basalt-2); color: #fff; }
.nav a[aria-current="page"] { background: var(--basalt-2); color: #fff; border-left-color: #c9a21b; font-weight: 600; }
.nav svg.i { width: 18px; height: 18px; flex: none; opacity: .85; }
.nav .grp { margin: 1rem .65rem .2rem; font-size: .78rem; color: #8ea0a6; }
.nav .spacer { flex: 1; }
.nav .who { padding: .6rem; border-top: 1px solid #3a4a52; font-size: .86rem; color: #aab8bc; }
.nav .who b { color: #fff; display: block; font-weight: 600; }
.main { padding: 1.6rem clamp(1rem, 3vw, 2.4rem) 4rem; min-width: 0; }
.page-head { display: flex; align-items: flex-end; justify-content: space-between; gap: 1rem; flex-wrap: wrap; margin-bottom: 1.2rem; }
.page-head p { color: var(--muted); margin: .25rem 0 0; max-width: 70ch; }
.topbar-mobile { display: none; }
@media (max-width: 860px) {
  .shell { grid-template-columns: 1fr; }
  .nav { position: static; height: auto; flex-direction: row; flex-wrap: wrap; padding: .5rem; }
  .nav .brand, .nav .grp, .nav .who { display: none; }
  .nav .spacer { display: none; }
  .nav a span.t { display: none; }
}

/* --- Bausteine --------------------------------------------------------------------------------- */
.panel { background: var(--paper); border: 1px solid var(--line); border-radius: 6px; }
.panel > .ph { padding: .8rem 1rem; border-bottom: 1px solid var(--line-soft); display: flex; justify-content: space-between; align-items: center; gap: 1rem; flex-wrap: wrap; }
.panel > .pb { padding: 1rem; }
.stack { display: grid; gap: 1rem; }
.row { display: flex; gap: .6rem; align-items: center; flex-wrap: wrap; }
.row.end { justify-content: flex-end; }
.grow { flex: 1; }
.grid2 { display: grid; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); gap: 1rem; }

button, .btn { font: inherit; border: 1px solid var(--line); background: var(--paper); color: var(--ink); padding: .42rem .85rem; border-radius: 4px; cursor: pointer; display: inline-flex; align-items: center; gap: .4rem; line-height: 1.3; }
button:hover { border-color: var(--muted); }
button.primary { background: var(--basalt); color: #fff; border-color: var(--basalt); font-weight: 600; }
button.primary:hover { background: var(--basalt-2); }
button.danger { color: var(--lava); border-color: var(--lava); }
button.danger:hover { background: var(--lava-soft); }
button.ghost { border-color: transparent; background: transparent; padding: .3rem .5rem; }
button.ghost:hover { background: var(--line-soft); }
button:disabled { opacity: .5; cursor: not-allowed; }
button.sm { padding: .2rem .55rem; font-size: .86rem; }
input, select, textarea { font: inherit; color: inherit; background: var(--paper); border: 1px solid var(--line); border-radius: 4px; padding: .45rem .6rem; width: 100%; min-width: 0; }
input:focus, select:focus, textarea:focus { outline: none; border-color: var(--sulfur); box-shadow: var(--focus); }
input[type="checkbox"], input[type="radio"] { width: auto; accent-color: var(--basalt); }
textarea { min-height: 5.5rem; font-family: var(--mono); font-size: .86rem; resize: vertical; }
label.f { display: grid; gap: .25rem; font-size: .88rem; color: var(--muted); }
label.f > span:first-child { font-weight: 600; color: var(--ink); }
label.f small { color: var(--muted); }
.toolbar { display: flex; gap: .6rem; flex-wrap: wrap; align-items: center; margin-bottom: .9rem; }
.toolbar input[type="search"], .toolbar input[type="text"] { max-width: 280px; }
.toolbar select { width: auto; }

.chip { display: inline-flex; align-items: center; gap: .3rem; padding: .08rem .55rem; border-radius: 999px; font-size: .8rem; background: var(--line-soft); color: var(--ink); white-space: nowrap; }
.chip.ok { background: var(--moss-soft); color: var(--moss); }
.chip.bad { background: var(--lava-soft); color: var(--lava); }
.chip.warn { background: var(--amber-soft); color: var(--amber); }
.chip.mfa { background: var(--caldera-soft); color: var(--caldera); }
.chip.info { background: var(--sulfur-soft); color: #6b5800; }
.chip.dim { color: var(--muted); }
.chips { display: flex; flex-wrap: wrap; gap: .25rem; }

table { width: 100%; border-collapse: collapse; font-size: .92rem; }
th { text-align: left; font-weight: 600; color: var(--muted); font-size: .84rem; padding: .5rem .7rem; border-bottom: 1px solid var(--line); white-space: nowrap; position: sticky; top: 0; background: var(--paper); }
td { padding: .55rem .7rem; border-bottom: 1px solid var(--line-soft); vertical-align: top; }
tbody tr:last-child td { border-bottom: 0; }
tr.click { cursor: pointer; }
tr.click:hover td { background: var(--ash); }
tr.click:focus-visible { outline: none; box-shadow: inset 3px 0 0 var(--sulfur); }
.tablewrap { overflow: auto; max-width: 100%; }
.empty { padding: 2.2rem 1rem; text-align: center; color: var(--muted); }
.empty b { display: block; color: var(--ink); margin-bottom: .2rem; }

.kv { display: grid; grid-template-columns: 11rem 1fr; gap: .35rem .8rem; font-size: .92rem; }
.kv dt { color: var(--muted); }
.kv dd { margin: 0; min-width: 0; overflow-wrap: anywhere; }
.tabs { display: flex; gap: .2rem; border-bottom: 1px solid var(--line); margin-bottom: 1rem; overflow-x: auto; }
.tabs button { border: 0; border-bottom: 3px solid transparent; border-radius: 0; background: none; padding: .55rem .8rem; color: var(--muted); }
.tabs button[aria-selected="true"] { border-bottom-color: var(--sulfur); color: var(--ink); font-weight: 600; }

/* --- Übersicht --------------------------------------------------------------------------------- */
.vitals { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); border: 1px solid var(--line); border-radius: 6px; background: var(--paper); }
.vitals > div { padding: .9rem 1rem; border-right: 1px solid var(--line-soft); }
.vitals > div:last-child { border-right: 0; }
.vitals .n { font-size: 1.9rem; font-weight: 700; letter-spacing: -.02em; line-height: 1.1; }
.vitals .l { color: var(--muted); font-size: .86rem; }
.vitals .n.bad { color: var(--lava); }
.bar { height: 6px; background: var(--line-soft); border-radius: 3px; margin-top: .5rem; overflow: hidden; }
.bar > i { display: block; height: 100%; background: var(--moss); }

/* --- Zugriffsentscheidung (Pipeline) ------------------------------------------------------------ */
.verdict { padding: 1rem 1.2rem; border-radius: 6px; border: 1px solid; display: flex; gap: 1rem; align-items: center; flex-wrap: wrap; }
.verdict .big { font-size: 1.6rem; font-weight: 800; letter-spacing: -.01em; }
.verdict.ALLOW { background: var(--moss-soft); border-color: var(--moss); color: var(--moss); }
.verdict.DENY { background: var(--lava-soft); border-color: var(--lava); color: var(--lava); }
.verdict.STEP_UP { background: var(--caldera-soft); border-color: var(--caldera); color: var(--caldera); }
.verdict .why { color: var(--ink); flex: 1; min-width: 14rem; }
ol.pipe { list-style: none; margin: 0; padding: 0; position: relative; }
ol.pipe li { display: grid; grid-template-columns: 2.1rem 1fr; gap: .8rem; padding: .55rem 0; position: relative; }
ol.pipe li::before { content: ""; position: absolute; left: 1.02rem; top: 2.2rem; bottom: -.3rem; width: 2px; background: var(--line); }
ol.pipe li:last-child::before { display: none; }
ol.pipe .dot { width: 2.1rem; height: 2.1rem; border-radius: 50%; display: grid; place-items: center; font-weight: 700; font-size: .85rem; border: 2px solid var(--line); background: var(--paper); color: var(--muted); z-index: 1; }
ol.pipe li.pass .dot { border-color: var(--moss); color: var(--moss); background: var(--moss-soft); }
ol.pipe li.fail .dot { border-color: var(--lava); color: var(--paper); background: var(--lava); }
ol.pipe li.skip .dot { border-style: dashed; }
ol.pipe .t { font-weight: 600; display: flex; gap: .5rem; flex-wrap: wrap; align-items: baseline; }
ol.pipe .t em { font-style: normal; font-weight: 400; color: var(--muted); font-size: .84rem; }
ol.pipe .d { color: var(--muted); font-size: .88rem; overflow-wrap: anywhere; }
ol.pipe li.fail .d { color: var(--ink); }

/* --- Matrix & Rollen-Editor ------------------------------------------------------------------- */
.matrix { border-collapse: separate; border-spacing: 0; }
.matrix th.role { writing-mode: vertical-rl; transform: rotate(180deg); height: 8.5rem; padding: .5rem .2rem; text-align: left; vertical-align: bottom; font-size: .82rem; }
.matrix th.role.crit { color: var(--lava); }
.matrix td.k { white-space: nowrap; position: sticky; left: 0; background: var(--paper); z-index: 1; border-right: 1px solid var(--line); }
.matrix td.c { text-align: center; padding: .3rem .1rem; min-width: 1.9rem; }
.matrix tr.mod td { background: var(--ash); font-weight: 600; color: var(--muted); position: sticky; left: 0; }
.cell-ALLOW { color: var(--moss); font-weight: 700; }
.cell-DENY { color: var(--lava); font-weight: 700; }
.tri { display: inline-flex; border: 1px solid var(--line); border-radius: 4px; overflow: hidden; }
.tri label { padding: .15rem .55rem; cursor: pointer; font-size: .82rem; border-right: 1px solid var(--line); user-select: none; }
.tri label:last-child { border-right: 0; }
.tri input { position: absolute; opacity: 0; width: 1px; height: 1px; }
.tri input:checked + span.o { font-weight: 700; }
.tri label:has(input:checked) { background: var(--basalt); color: #fff; }
.tri label.allow:has(input:checked) { background: var(--moss); }
.tri label.deny:has(input:checked) { background: var(--lava); }
.tri label:has(input:focus-visible) { box-shadow: inset 0 0 0 2px var(--sulfur); }
.perm-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: .5rem; padding: .35rem .2rem; border-bottom: 1px solid var(--line-soft); align-items: center; }
.perm-row .desc { color: var(--muted); font-size: .84rem; }
.perm-mod { background: var(--ash); padding: .35rem .6rem; font-weight: 600; margin-top: .6rem; border-radius: 4px; display: flex; justify-content: space-between; }
.split { display: grid; grid-template-columns: minmax(220px, 300px) minmax(0, 1fr); gap: 1rem; align-items: start; }
@media (max-width: 900px) { .split { grid-template-columns: 1fr; } }
.listnav { display: grid; }
.listnav button { text-align: left; border: 0; border-bottom: 1px solid var(--line-soft); border-radius: 0; background: none; justify-content: space-between; padding: .6rem .8rem; }
.listnav button[aria-current="true"] { background: var(--ash); box-shadow: inset 3px 0 0 var(--sulfur); font-weight: 600; }
.listnav .sub { font-size: .8rem; color: var(--muted); font-weight: 400; }

/* --- Overlays ---------------------------------------------------------------------------------- */
.scrim { position: fixed; inset: 0; background: rgba(20, 28, 33, .5); z-index: 50; display: grid; place-items: center; padding: 1rem; }
.modal { background: var(--paper); border-radius: 8px; width: min(520px, 100%); max-height: 90vh; overflow: auto; box-shadow: 0 24px 60px rgba(0, 0, 0, .35); }
.modal.wide { width: min(760px, 100%); }
.modal > header { padding: 1rem 1.2rem .4rem; }
.modal > .body { padding: .4rem 1.2rem 1rem; display: grid; gap: .9rem; }
.modal > footer { padding: .8rem 1.2rem 1.1rem; display: flex; gap: .6rem; justify-content: flex-end; border-top: 1px solid var(--line-soft); }
.drawer-scrim { position: fixed; inset: 0; background: rgba(20, 28, 33, .35); z-index: 40; }
.drawer { position: fixed; top: 0; right: 0; bottom: 0; width: min(640px, 100%); background: var(--paper); z-index: 41; overflow: auto; box-shadow: -18px 0 40px rgba(0, 0, 0, .25); animation: slidein .18s ease-out; }
@keyframes slidein { from { transform: translateX(24px); opacity: .6; } to { transform: none; opacity: 1; } }
.drawer > header { padding: 1.1rem 1.3rem .8rem; border-bottom: 1px solid var(--line-soft); display: flex; justify-content: space-between; gap: 1rem; align-items: flex-start; position: sticky; top: 0; background: var(--paper); z-index: 2; }
.drawer > .body { padding: 1.1rem 1.3rem 3rem; }
.toasts { position: fixed; right: 1rem; bottom: 1rem; display: grid; gap: .5rem; z-index: 80; width: min(380px, calc(100% - 2rem)); }
.toast { background: var(--basalt); color: #fff; padding: .7rem .9rem; border-radius: 6px; border-left: 4px solid var(--moss); box-shadow: 0 8px 24px rgba(0, 0, 0, .3); }
.toast.err { border-left-color: var(--lava); }
.secret { font-family: var(--mono); background: var(--ash); border: 1px dashed var(--muted); padding: .6rem .8rem; border-radius: 4px; overflow-wrap: anywhere; user-select: all; }
.notice { padding: .7rem .9rem; border-radius: 4px; background: var(--sulfur-soft); border-left: 4px solid var(--sulfur); }
.notice.bad { background: var(--lava-soft); border-left-color: var(--lava); }
pre.json { background: var(--ash); padding: .6rem .8rem; border-radius: 4px; overflow: auto; font-size: .8rem; margin: 0; max-height: 14rem; }
.diff { display: grid; grid-template-columns: 1fr 1fr; gap: .5rem; }
@media (max-width: 700px) { .diff { grid-template-columns: 1fr; } .kv { grid-template-columns: 1fr; } }

/* --- Weitere Anmeldewege / Einstellungen --------------------------------------------------------- */
.btn-link { display: block; text-align: center; padding: .6rem .9rem; border: 1px solid var(--line); border-radius: 6px; background: var(--paper); color: var(--ink); text-decoration: none; font-weight: 600; }
.btn-link:hover, .btn-link:focus-visible { background: var(--ash); }
.setting-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); gap: 1rem; }
.setting-check { display: flex; gap: .6rem; align-items: flex-start; }
.setting-check input { width: auto; margin-top: .25rem; }
.source { font-size: .75rem; color: var(--muted); }
.maprow { display: grid; grid-template-columns: minmax(0, 1fr) minmax(0, 12rem) auto; gap: .5rem; align-items: center; }