/* SIEM workbench (siem.html). Builds on style.css tokens and workbench.css layout. */
.siem .pad { padding: 12px 16px; }
.pill { display: inline-block; min-width: 1.5em; padding: 0 6px; border-radius: 99px; background: var(--surface-2); color: var(--muted);
  font-size: .75rem; text-align: center; }
.seg { display: inline-flex; border: 1px solid var(--border); border-radius: 6px; overflow: hidden; }
.seg button { font: 600 .78rem var(--sans); padding: 4px 10px; border: 0; background: var(--surface); color: var(--muted); cursor: pointer; }
.seg button[aria-pressed="true"] { background: var(--surface-2); color: var(--text); }
.st { display: inline-block; font: 600 .7rem var(--mono); padding: 1px 6px; border-radius: 4px; white-space: nowrap;
  background: var(--surface-2); color: var(--muted); border-left: 3px solid var(--st, var(--border)); }
:root { --st-badge: #8e44ad; --st-wifi: #16a085; --st-dhcp: #2980b9; --st-win: #c0392b; --st-vpn: #d35400; --st-proxy: #27ae60;
  --st-dns: #7f8c8d; --st-conn: #2c3e50; --st-flow: #6d4c41; --st-mail: #b7950b; --st-crm: #1abc9c; --st-alert: #e74c3c; }
@media (prefers-color-scheme: dark) { :root:not([data-theme="light"]) { --st-conn: #95a5a6; --st-flow: #a1887f; } }
:root[data-theme="dark"] { --st-conn: #95a5a6; --st-flow: #a1887f; }

/* ---------- search ---------- */
.wb-panel[data-wbpanel="search"] { display: flex; flex-direction: column; min-height: 0; }
.sq-bar { padding: 10px 16px 6px; background: var(--surface); border-bottom: 1px solid var(--border); }
.sq-line { display: flex; gap: 8px; align-items: flex-start; }
.sq-line textarea { flex: 1; font: .9rem/1.45 var(--mono); color: var(--text); background: var(--bg); border: 1px solid var(--border);
  border-radius: 6px; padding: 7px 9px; resize: vertical; min-height: 2.3em; max-height: 12em; }
.sq-line textarea:focus { outline: 2px solid var(--term-prompt); outline-offset: -1px; }
.sq-opts { display: flex; flex-wrap: wrap; gap: 6px 14px; align-items: center; margin-top: 6px; }
.sq-opts .fld { margin: 0; }
.sq-opts input[type=text] { width: 11.5em; font: .8rem var(--mono); }
.sq-opts select, .pc-bar select { font: inherit; font-size: .8rem; color: var(--text); background: var(--surface); border: 1px solid var(--border);
  border-radius: 6px; padding: 4px 6px; max-width: 16em; }
#q-msg.err { color: var(--accent); font-weight: 600; }
.sq-body { flex: 1; min-height: 0; display: grid; grid-template-columns: 230px minmax(0, 1fr); }
.sq-body.with-help { grid-template-columns: 230px minmax(0, 1fr) 360px; }
.sq-fields { overflow-y: auto; border-right: 1px solid var(--border); background: var(--surface); padding: 8px 10px 24px; font-size: .8rem; }
.sq-fields h3 { font-size: .75rem; text-transform: uppercase; letter-spacing: .05em; color: var(--muted); margin: 8px 0 4px; }
.sq-fields details { border-bottom: 1px solid var(--border); padding: 3px 0; }
.sq-fields summary { cursor: pointer; display: flex; justify-content: space-between; gap: 6px; font-family: var(--mono); }
.sq-fields summary span:first-child { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.sq-fields summary .small { color: var(--muted); flex: none; }
.sq-fields ol { list-style: none; margin: 4px 0 6px; padding: 0; }
.sq-fields li { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 6px; padding: 1px 0; cursor: pointer; }
.sq-fields li:hover { color: var(--accent); }
.sq-fields li span:first-child { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-family: var(--mono); }
.sq-fields li .bar { grid-column: 1 / -1; height: 3px; background: var(--term-prompt); opacity: .5; border-radius: 2px; }
.sq-help { overflow-y: auto; border-left: 1px solid var(--border); background: var(--surface); padding: 6px 14px 24px; font-size: .8rem; }
.sq-help h3 { font-size: .8rem; margin: 12px 0 4px; }
table.mini { border-collapse: collapse; width: 100%; }
table.mini td { border-bottom: 1px solid var(--border); padding: 3px 4px; vertical-align: top; overflow-wrap: anywhere; }
.sq-main { display: flex; flex-direction: column; min-width: 0; min-height: 0; }
.histo { height: 64px; display: flex; align-items: flex-end; gap: 1px; padding: 6px 12px 2px; border-bottom: 1px solid var(--border);
  background: var(--surface); flex: none; }
.histo .b { flex: 1; background: var(--term-prompt); opacity: .75; min-height: 1px; cursor: pointer; border-radius: 1px 1px 0 0; }
.histo .b:hover { opacity: 1; background: var(--accent); }
.histo .b.zero { background: var(--border); opacity: .5; }
.histo-axis { display: flex; justify-content: space-between; font: .68rem var(--mono); color: var(--muted); padding: 0 12px 4px; background: var(--surface); }
.sq-head { display: flex; gap: 12px; align-items: center; flex-wrap: wrap; padding: 5px 12px; border-bottom: 1px solid var(--border); }
.sq-head .xbar { margin: 0 0 0 auto; }
.results { flex: 1; overflow: auto; min-height: 0; }
.ev { display: grid; grid-template-columns: 26px 11.5em minmax(0, 1fr); gap: 0 8px; padding: 5px 12px 5px 6px; border-bottom: 1px solid var(--border);
  font-size: .8rem; align-items: start; }
.ev:hover { background: var(--surface); }
.ev .pin { border: 0; background: none; cursor: pointer; color: var(--muted); font-size: 1rem; line-height: 1; padding: 0; }
.ev .pin.on { color: var(--warn); }
.ev .t { font-family: var(--mono); color: var(--muted); font-size: .76rem; cursor: pointer; }
.ev .raw { font-family: var(--mono); white-space: pre-wrap; overflow-wrap: anywhere; cursor: pointer; }
.ev .raw mark { background: var(--accent-soft); color: inherit; padding: 0 1px; border-radius: 2px; }
.ev .meta { margin-bottom: 2px; display: flex; gap: 6px; flex-wrap: wrap; align-items: center; }
.ev .meta .small { color: var(--muted); }
.ev-fields { grid-column: 3; margin: 6px 0 4px; border-collapse: collapse; font-size: .76rem; width: 100%; max-width: 760px; }
.ev-fields td { border-top: 1px solid var(--border); padding: 2px 6px; vertical-align: top; overflow-wrap: anywhere; }
.ev-fields td:first-child { font-family: var(--mono); color: var(--muted); width: 13em; }
.ev-fields td:last-child { width: 5.5em; white-space: nowrap; }
.ev-fields button { font: .7rem var(--sans); border: 1px solid var(--border); background: var(--surface); color: var(--text); border-radius: 4px;
  cursor: pointer; padding: 0 5px; }
.more { display: block; margin: 10px auto 30px; }
table.rt { border-collapse: collapse; font-size: .8rem; width: 100%; }
table.rt th { position: sticky; top: 0; background: var(--surface-2); text-align: left; padding: 5px 8px; font-weight: 600; cursor: pointer;
  border-bottom: 1px solid var(--border); white-space: nowrap; }
table.rt th.sorted::after { content: " ▾"; }
table.rt th.sorted.asc::after { content: " ▴"; }
table.rt td { padding: 3px 8px; border-bottom: 1px solid var(--border); font-family: var(--mono); font-size: .76rem; vertical-align: top;
  overflow-wrap: break-word; max-width: 40em; }
table.rt td.nr { text-align: right; white-space: nowrap; }
table.rt tr:hover td { background: var(--surface); }
table.rt td[data-v] { cursor: pointer; }
.chart { padding: 8px 12px; }
.chart svg { width: 100%; height: 220px; display: block; }
.chart .legend { display: flex; flex-wrap: wrap; gap: 4px 12px; font-size: .75rem; }
.chart .legend i { display: inline-block; width: 10px; height: 10px; border-radius: 2px; margin-right: 4px; vertical-align: -1px; }

/* ---------- packets ---------- */
.wb-panel[data-wbpanel="pcap"] { display: flex; flex-direction: column; min-height: 0; }
.pc-bar { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; padding: 8px 16px; background: var(--surface); border-bottom: 1px solid var(--border); }
.pc-bar input[type=text] { flex: 1; min-width: 16em; font: .82rem var(--mono); color: var(--text); background: var(--bg); border: 1px solid var(--border); border-radius: 6px; padding: 5px 8px; }
.pc-bar input.invalid { border-color: var(--accent); }
.pc-body { flex: 1; min-height: 0; display: grid; grid-template-rows: minmax(120px, 38%) minmax(0, 1fr); }
.pc-list { overflow: auto; border-bottom: 2px solid var(--border); }
.pc-list table { border-collapse: collapse; width: 100%; font: .76rem var(--mono); }
.pc-list th { position: sticky; top: 0; background: var(--surface-2); text-align: left; padding: 3px 8px; font-family: var(--sans); font-weight: 600; }
.pc-list td { padding: 1px 8px; white-space: nowrap; border-bottom: 1px solid var(--border); }
.pc-list td.info { white-space: normal; overflow-wrap: anywhere; min-width: 20em; }
.pc-list tr { cursor: pointer; }
.pc-list tr:hover td { background: var(--surface); }
.pc-list tr.sel td { background: #2f5b8f; color: #fff; }
.pc-list tr.p-TLS td:nth-child(5) { color: #7b4fbf; }
.pc-list tr.p-HTTP td:nth-child(5) { color: var(--ok); font-weight: 600; }
.pc-list tr.p-DNS td:nth-child(5) { color: #2980b9; }
.pc-list tr.sel td:nth-child(5) { color: #fff; }
.pc-detail { overflow: auto; padding: 0 12px 20px; }
.pc-detail .hexwidget { margin: 10px 0; }
.pc-detail .hexwidget .hw-dump { max-height: 46vh; }
.stream { font: .78rem/1.4 var(--mono); white-space: pre-wrap; overflow-wrap: anywhere; padding: 10px 12px; background: var(--term-bg); color: var(--term-fg); border-radius: 8px; }
.stream .c { color: #ff9b94; }
.stream .s { color: #8ab4ff; }
.stream .gap { color: var(--term-dim); font-style: italic; }

/* ---------- e-mail ---------- */
.wb-panel[data-wbpanel="email"] { display: grid; grid-template-columns: 280px minmax(0, 1fr); min-height: 0; }
.em-list { overflow-y: auto; border-right: 1px solid var(--border); background: var(--surface); }
.em-list button { display: block; width: 100%; text-align: left; padding: 9px 14px; border: 0; border-bottom: 1px solid var(--border);
  background: none; color: var(--text); cursor: pointer; font: .82rem var(--sans); }
.em-list button[aria-pressed="true"] { background: var(--surface-2); box-shadow: inset 3px 0 0 var(--accent); }
.em-list button .small { display: block; color: var(--muted); }
.em-view { overflow-y: auto; padding: 4px 18px 40px; }
.em-view h2 { font-size: 1.15rem; margin: 14px 0 6px; }
.em-view h3 { font-size: .9rem; margin: 18px 0 6px; }
.hops { border-collapse: collapse; font-size: .78rem; width: 100%; }
.hops th, .hops td { border-bottom: 1px solid var(--border); padding: 4px 6px; text-align: left; vertical-align: top; overflow-wrap: anywhere; }
.hops th { background: var(--surface-2); }
.em-body { white-space: pre-wrap; font: .85rem/1.5 var(--mono); background: var(--surface); border: 1px solid var(--border); border-radius: 8px; padding: 10px 12px; }
.em-raw { max-height: 50vh; overflow: auto; }
.auth-pass { color: var(--ok); font-weight: 600; }
.auth-fail { color: var(--accent); font-weight: 600; }

/* ---------- map ---------- */
#map svg { width: 100%; max-width: 720px; height: auto; display: block; background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); }
#map .grid { stroke: var(--border); stroke-width: .5; }
#map .lbl { font: 11px var(--sans); fill: var(--text); }
#map .site { fill: var(--accent); }
#map .geo { fill: var(--term-prompt); fill-opacity: .35; stroke: var(--term-prompt); cursor: pointer; }
#map .geo:hover { fill-opacity: .6; }
#map .acc { fill: none; stroke: var(--term-prompt); stroke-dasharray: 3 3; stroke-opacity: .6; }

/* ---------- timeline ---------- */
#tl-add input[type=text] { font: .82rem var(--mono); }
#tl-time { flex: 0 0 13em; }
#tl-table td input { width: 5em; font: .78rem var(--mono); }
#tl-table td.note { min-width: 14em; }
#tl-table td [contenteditable] { outline: none; border-bottom: 1px dashed var(--border); display: block; min-height: 1.2em; }

@media (max-width: 900px) {
  body.wb { height: auto; overflow: visible; }
  .sq-body, .sq-body.with-help { grid-template-columns: 1fr; }
  .sq-fields { max-height: 30vh; border-right: 0; border-bottom: 1px solid var(--border); }
  .sq-help { border-left: 0; border-top: 1px solid var(--border); }
  .results { overflow: visible; }
  .ev { grid-template-columns: 22px minmax(0, 1fr); }
  .ev .t { grid-column: 2; }
  .ev .raw, .ev-fields { grid-column: 1 / -1; }
  .wb-panel[data-wbpanel="email"] { grid-template-columns: 1fr; }
  .em-list { max-height: 30vh; border-right: 0; }
  .pc-body { grid-template-rows: 40vh auto; }
}

/* ---------- chart series (validated categorical palette, fixed order; slot 9+ folds into "Other") ---------- */
:root { --s1: #2a78d6; --s2: #eb6834; --s3: #1baf7a; --s4: #eda100; --s5: #e87ba4; --s6: #008300; --s7: #4a3aa7; --s8: #e34948; --s-other: #8a8f98; }
@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) { --s1: #3987e5; --s2: #d95926; --s3: #199e70; --s4: #c98500; --s5: #d55181; --s6: #008300; --s7: #9085e9; --s8: #e66767; }
}
:root[data-theme="dark"] { --s1: #3987e5; --s2: #d95926; --s3: #199e70; --s4: #c98500; --s5: #d55181; --s6: #008300; --s7: #9085e9; --s8: #e66767; }
.chart .axis { stroke: var(--border); }
.chart .tick { font: 10px var(--mono); fill: var(--muted); }
.chart .hit { fill: transparent; }
.chart .hit:hover { fill: var(--text); fill-opacity: .06; }
.chart .tip { position: absolute; pointer-events: none; background: var(--surface); border: 1px solid var(--border); border-radius: 6px;
  padding: 6px 8px; font-size: .75rem; box-shadow: 0 2px 8px rgba(0,0,0,.15); white-space: nowrap; z-index: 5; }
.chart { position: relative; }
.seg[hidden] { display: none; }