/* Shell-level investigation surfaces: entity pivot chips + menu, the persistent
   investigation scope bar, and the entity attack graph.

   These render on every page, so they use only the :root variables from
   styles.css — the --card/--card-border variables the inv_* pages rely on are
   defined per-page and are not in scope here. */

/* ── entity chips ──────────────────────────────────────────────────────── */

.ent-chip {
    display: inline-flex;
    align-items: center;
    gap: 4px;
    padding: 1px 7px;
    border-radius: 5px;
    border: 1px solid transparent;
    background: rgba(148, 163, 184, 0.12);
    color: var(--text);
    font-size: inherit;
    line-height: 1.5;
    cursor: pointer;
    max-width: 100%;
    overflow: hidden;
    text-overflow: ellipsis;
    white-space: nowrap;
    vertical-align: baseline;
    transition: background 120ms ease, border-color 120ms ease;
}

.ent-chip::before {
    content: '';
    width: 6px;
    height: 6px;
    border-radius: 2px;
    flex: 0 0 auto;
    background: currentColor;
    opacity: 0.85;
}

.ent-chip:hover,
.ent-chip:focus-visible {
    background: var(--hover);
    border-color: var(--accent);
    outline: none;
}

.ent-chip.ent-device { color: #58a6ff; }
.ent-chip.ent-account { color: #d29922; }
.ent-chip.ent-ip { color: #3fb950; }
.ent-chip.ent-domain { color: #bc8cff; }
.ent-chip.ent-url { color: #a5d6ff; }
.ent-chip.ent-hash { color: #ff9e64; }
.ent-chip.ent-process { color: #79c0ff; }
.ent-chip.ent-file { color: #8b949e; }

/* ── pivot menu ────────────────────────────────────────────────────────── */

/* Above the attack graph (.eg-overlay, 4200) and the case picker: both open
   from inside the graph, and at 4000 they rendered behind it. */
.ent-menu {
    position: fixed;
    z-index: 4400;
    min-width: 262px;
    max-width: 340px;
    background: #0f172a;
    border: 1px solid var(--border);
    border-radius: 10px;
    box-shadow: 0 18px 44px rgba(0, 0, 0, 0.55);
    overflow: hidden;
    animation: ent-menu-in 110ms ease-out;
}

@keyframes ent-menu-in {
    from { opacity: 0; transform: translateY(-4px); }
    to { opacity: 1; transform: none; }
}

.ent-menu-head {
    padding: 10px 12px;
    border-bottom: 1px solid var(--border);
    display: flex;
    flex-direction: column;
    gap: 2px;
}

.ent-menu-type {
    font-size: 10px;
    font-weight: 700;
    letter-spacing: 0.06em;
    text-transform: uppercase;
}

.ent-menu-type.ent-device { color: #58a6ff; }
.ent-menu-type.ent-account { color: #d29922; }
.ent-menu-type.ent-ip { color: #3fb950; }
.ent-menu-type.ent-domain { color: #bc8cff; }
.ent-menu-type.ent-url { color: #a5d6ff; }
.ent-menu-type.ent-hash { color: #ff9e64; }
.ent-menu-type.ent-process { color: #79c0ff; }
.ent-menu-type.ent-file { color: #8b949e; }

.ent-menu-value {
    font-size: 13px;
    font-weight: 600;
    color: var(--text);
    word-break: break-all;
}

.ent-menu-group {
    padding: 5px 0;
}

.ent-menu-group + .ent-menu-group {
    border-top: 1px solid var(--border);
}

.ent-menu-item {
    display: flex;
    align-items: center;
    gap: 9px;
    width: 100%;
    padding: 7px 12px;
    background: none;
    border: none;
    color: var(--text);
    font-size: 13px;
    text-align: left;
    cursor: pointer;
}

.ent-menu-item:hover,
.ent-menu-item:focus-visible {
    background: var(--hover);
    outline: none;
}

.ent-menu-icon {
    display: inline-flex;
    width: 16px;
    height: 16px;
    flex: 0 0 16px;
    color: var(--muted);
}

.ent-menu-icon svg { width: 100%; height: 100%; }
.ent-menu-item:hover .ent-menu-icon { color: var(--accent); }
.ent-menu-label { flex: 1 1 auto; }

.ent-menu-hint {
    font-size: 11px;
    color: var(--muted);
    flex: 0 0 auto;
}

/* ── case picker ───────────────────────────────────────────────────────── */

.ent-modal-backdrop {
    position: fixed;
    inset: 0;
    z-index: 4300;
    background: rgba(2, 6, 16, 0.72);
    display: flex;
    align-items: center;
    justify-content: center;
    padding: 24px;
}

.ent-modal {
    width: min(520px, 100%);
    max-height: 80vh;
    display: flex;
    flex-direction: column;
    background: #0f172a;
    border: 1px solid var(--border);
    border-radius: 12px;
    padding: 18px;
}

.ent-modal h3 { margin: 0 0 6px; font-size: 15px; }
.ent-modal-sub { color: var(--muted); font-size: 12px; margin-bottom: 12px; }
.ent-modal-sub code { color: var(--accent); }

.ent-case-list {
    flex: 1 1 auto;
    overflow-y: auto;
    border: 1px solid var(--border);
    border-radius: 8px;
    padding: 4px;
    color: var(--muted);
    font-size: 12px;
}

.ent-case-row {
    display: flex;
    align-items: center;
    gap: 10px;
    width: 100%;
    padding: 8px 10px;
    background: none;
    border: none;
    border-radius: 6px;
    color: var(--text);
    font-size: 13px;
    text-align: left;
    cursor: pointer;
}

.ent-case-row:hover:not(:disabled) { background: var(--hover); }
.ent-case-row.is-current { box-shadow: inset 2px 0 0 var(--accent); }
.ent-case-group {
    padding: 8px 10px 4px;
    font-size: 10px;
    font-weight: 600;
    letter-spacing: 0.06em;
    text-transform: uppercase;
    color: var(--muted);
}
.ent-case-row:disabled { opacity: 0.5; cursor: default; }
.ent-case-id { font-weight: 600; color: var(--accent); flex: 0 0 auto; }
.ent-case-title { flex: 1 1 auto; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.ent-case-status { font-size: 11px; color: var(--muted); text-transform: uppercase; }
.ent-case-empty { padding: 14px; text-align: center; }

.ent-modal-actions {
    display: flex;
    justify-content: flex-end;
    gap: 8px;
    margin-top: 12px;
}

/* The picker can open from any page, and .inv-btn only exists on the
   investigation pages' stylesheet. */
.ent-modal-actions .inv-btn {
    background: var(--accent);
    color: #04121c;
    border: none;
    border-radius: 8px;
    padding: 8px 14px;
    font-size: 13px;
    cursor: pointer;
}

.ent-modal-actions .inv-btn.ghost {
    background: transparent;
    border: 1px solid var(--border);
    color: var(--text);
}

/* ── investigation scope bar ───────────────────────────────────────────── */

#investigation-scope-bar {
    display: flex;
    align-items: center;
    gap: 10px;
    flex-wrap: wrap;
    margin: 0 0 14px;
    padding: 8px 12px;
    background: rgba(56, 189, 248, 0.07);
    border: 1px solid rgba(56, 189, 248, 0.28);
    border-radius: 10px;
    font-size: 12px;
}

#investigation-scope-bar[hidden] { display: none; }

.scope-label {
    font-size: 10px;
    font-weight: 700;
    letter-spacing: 0.07em;
    text-transform: uppercase;
    color: var(--accent);
    flex: 0 0 auto;
}

.scope-items {
    display: flex;
    align-items: center;
    gap: 8px;
    flex-wrap: wrap;
    flex: 1 1 auto;
    min-width: 0;
}

.scope-item {
    display: inline-flex;
    align-items: center;
    gap: 2px;
}

.scope-apply,
.scope-drop {
    background: none;
    border: none;
    color: var(--muted);
    cursor: pointer;
    padding: 0 3px;
    font-size: 13px;
    line-height: 1;
}

.scope-apply:hover { color: var(--accent); }
.scope-drop:hover { color: var(--error-color); }

.scope-case {
    color: var(--accent);
    font-weight: 600;
    text-decoration: none;
    border: 1px solid rgba(56, 189, 248, 0.35);
    border-radius: 6px;
    padding: 2px 8px;
}

.scope-actions { display: flex; flex-wrap: wrap; gap: 6px; flex: 0 1 auto; }

.scope-btn {
    background: none;
    border: 1px solid var(--border);
    border-radius: 6px;
    color: var(--muted);
    font-size: 11px;
    padding: 3px 9px;
    cursor: pointer;
}

.scope-btn:hover { color: var(--accent); border-color: var(--accent); }
.scope-btn:disabled { opacity: 0.5; cursor: default; }
.scope-btn-primary { color: var(--accent); border-color: rgba(56, 189, 248, 0.55); font-weight: 600; }

/* ── entity attack graph ───────────────────────────────────────────────── */

.eg-root {
    display: flex;
    flex-direction: column;
    height: 100%;
    min-height: 420px;
}

.eg-toolbar {
    display: flex;
    align-items: center;
    justify-content: space-between;
    gap: 12px;
    flex-wrap: wrap;
    padding: 8px 10px;
    border-bottom: 1px solid var(--border);
}

.eg-crumbs { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }

.eg-focus-kind {
    font-size: 10px;
    font-weight: 700;
    letter-spacing: 0.06em;
    text-transform: uppercase;
    color: var(--accent);
}

.eg-focus-label { font-size: 13px; font-weight: 600; }
.eg-count { font-size: 11px; color: var(--muted); }

.eg-tools { display: flex; align-items: center; gap: 8px; }

.eg-toggle {
    display: inline-flex;
    align-items: center;
    gap: 5px;
    font-size: 12px;
    color: var(--muted);
    cursor: pointer;
}

.eg-select {
    background: #0f172a;
    border: 1px solid var(--border);
    color: var(--text);
    border-radius: 6px;
    padding: 4px 8px;
    font-size: 12px;
}

.eg-btn {
    background: var(--accent);
    color: #04121c;
    border: none;
    border-radius: 6px;
    padding: 5px 11px;
    font-size: 12px;
    font-weight: 600;
    cursor: pointer;
    text-decoration: none;
    display: inline-block;
}

.eg-btn.ghost {
    background: transparent;
    border: 1px solid var(--border);
    color: var(--text);
    font-weight: 400;
}

.eg-btn.ghost:hover { border-color: var(--accent); color: var(--accent); }

.eg-body {
    flex: 1 1 auto;
    display: grid;
    grid-template-columns: 1fr minmax(260px, 320px);
    min-height: 0;
}

.eg-canvas-wrap { position: relative; min-height: 0; min-width: 0; }
.eg-canvas-wrap canvas { width: 100%; height: 100%; display: block; cursor: grab; }

.eg-legend {
    position: absolute;
    left: 10px;
    bottom: 10px;
    display: flex;
    flex-wrap: wrap;
    gap: 4px 10px;
    max-width: 60%;
    padding: 6px 9px;
    background: rgba(4, 7, 17, 0.8);
    border: 1px solid var(--border);
    border-radius: 8px;
    font-size: 10px;
    color: var(--muted);
    pointer-events: none;
}

.eg-legend-item { display: inline-flex; align-items: center; gap: 4px; }
.eg-legend-item i { width: 8px; height: 8px; border-radius: 2px; display: inline-block; }

.eg-notice {
    position: absolute;
    top: 10px;
    left: 50%;
    transform: translateX(-50%);
    max-width: 70%;
    padding: 6px 12px;
    background: rgba(4, 7, 17, 0.9);
    border: 1px solid var(--border);
    border-radius: 8px;
    font-size: 12px;
    color: var(--muted);
}

.eg-detail {
    border-left: 1px solid var(--border);
    padding: 12px;
    overflow-y: auto;
    min-height: 0;
    font-size: 12px;
}

.eg-detail-empty { color: var(--muted); }
.eg-hint { font-size: 11px; opacity: 0.8; }

.eg-detail-head { display: flex; align-items: center; gap: 9px; margin-bottom: 10px; }
.eg-detail-title { font-size: 14px; font-weight: 600; word-break: break-all; }
.eg-detail-sub { font-size: 11px; color: var(--muted); }

.eg-dot { width: 12px; height: 12px; border-radius: 3px; flex: 0 0 auto; display: inline-block; }
.eg-dot.sm { width: 8px; height: 8px; }

.eg-message {
    background: rgba(148, 163, 184, 0.08);
    border-radius: 7px;
    padding: 8px 10px;
    margin-bottom: 10px;
    color: var(--text);
    line-height: 1.45;
}

.eg-kv > div {
    display: flex;
    justify-content: space-between;
    gap: 12px;
    padding: 4px 0;
    border-bottom: 1px solid var(--border);
}

.eg-kv span:first-child { color: var(--muted); flex: 0 0 auto; }
.eg-kv span:last-child { text-align: right; word-break: break-all; }

.eg-detail-actions { display: flex; flex-wrap: wrap; gap: 6px; margin: 12px 0; }

.eg-sub {
    margin: 14px 0 6px;
    font-size: 10px;
    font-weight: 700;
    letter-spacing: 0.06em;
    text-transform: uppercase;
    color: var(--muted);
}

.eg-neighbors { display: flex; flex-direction: column; gap: 2px; }

.eg-neighbor {
    display: flex;
    align-items: center;
    gap: 7px;
    width: 100%;
    padding: 5px 7px;
    background: none;
    border: none;
    border-radius: 6px;
    color: var(--text);
    font-size: 12px;
    text-align: left;
    cursor: pointer;
}

.eg-neighbor:hover { background: var(--hover); }
.eg-neighbor-label { flex: 1 1 auto; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
.eg-neighbor-via { font-size: 10px; color: var(--muted); flex: 0 0 auto; }

/* overlay presentation */

.eg-overlay {
    position: fixed;
    inset: 0;
    z-index: 4200;
    background: rgba(2, 6, 16, 0.78);
    display: flex;
    align-items: center;
    justify-content: center;
    padding: 24px;
}

.eg-overlay-panel {
    width: min(1400px, 100%);
    height: min(860px, 100%);
    display: flex;
    flex-direction: column;
    background: #0a0f1c;
    border: 1px solid var(--border);
    border-radius: 12px;
    overflow: hidden;
}

.eg-overlay-head {
    display: flex;
    align-items: center;
    justify-content: space-between;
    padding: 12px 16px;
    border-bottom: 1px solid var(--border);
}

.eg-overlay-head h2 { margin: 0; font-size: 15px; }

.eg-close {
    background: none;
    border: none;
    color: var(--muted);
    font-size: 24px;
    line-height: 1;
    cursor: pointer;
}

.eg-close:hover { color: var(--text); }

/* mount() applies .eg-root to the element it is given, and open() hands it
   .eg-host itself — so .eg-host IS the root and already lays itself out. A
   `.eg-host > *` rule here would instead hit the toolbar and body and force
   them to flex-column, collapsing the graph/detail split. */
.eg-host { flex: 1 1 auto; min-height: 0; }

@media (max-width: 900px) {
    .eg-body { grid-template-columns: 1fr; grid-template-rows: minmax(280px, 1fr) auto; }
    .eg-detail { border-left: none; border-top: 1px solid var(--border); max-height: 40vh; }
    .eg-legend { display: none; }
}