/* =========================================================================
   auth.wireon.ch admin — app-specific chrome over the canonical wireon
   design system (vendored at /assets/vendor/, wireon-design-system v3.4.0).

   The shell (app-shell / app-sidebar / nav-item), buttons (.btn--*),
   banners (.banner--*), badges (.badge), panels (.panel), page headers
   (.page-header), fields (.field), kv lists (.kv), empty states (.empty)
   and t-* type roles all come from wireon-components.css — nothing below
   redefines them. This file only carries auth-specific composition:
   tables, the icon/MIME/tier pickers, the hub landing, the pools
   accordion and the create-pool dialog.

   PHP-Auth's own login pages on this domain remain unaffected — the
   body.auth-admin scope wraps the admin-only selectors below.
   ========================================================================= */

@import url("https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700;800;900&display=swap");

/* ---------- App-level typography defaults ---------- */
/* Bare h3/h4 (used as panel/section headings all over the admin) get the
   display treatment. h1/h2 are NOT restyled here — the page-header and the
   topbar own their own heading sizes (v3.4 canonical). */
body.auth-admin h3,
body.auth-admin h4 {
  font-family: var(--font-display);
  margin: 0;
  color: var(--fg);
  font-weight: 800;
  letter-spacing: var(--tr-tight);
  text-transform: lowercase;
}
body.auth-admin h3 { font-size: 22px; line-height: 1.15; }
body.auth-admin h4 { font-size: 16px; line-height: 1.2;  font-weight: 700; }
body.auth-admin p  { margin: 0; }

/* Content links are inky + underlined. Scoped to .shell__main so it does
   NOT touch the inverse sidebar rail, and excludes .btn (buttons are <a>
   elements in places). */
body.auth-admin .shell__main a:not(.btn)  { color: var(--fg); text-decoration: underline; text-underline-offset: 3px; text-decoration-thickness: 1px; }
body.auth-admin .shell__main a:not(.btn):hover { text-decoration-thickness: 2px; }
body.auth-admin code,
body.auth-admin pre { font-family: var(--font-mono); }

/* Muted helper text (used inline all over the admin). */
.muted { color: var(--fg-muted); }

/* Inline SVG icons inherit color. */
.carbon-icon { flex-shrink: 0; vertical-align: middle; }

/* ---------- Panel title rows (app extension of the DS .panel) ---------- */

.panel { margin: 0 0 var(--s-6); }
.panel h3 {
  margin: 0 0 var(--s-5);
  padding-bottom: var(--s-3);
  border-bottom: var(--bw-rule) solid var(--rule-strong);
}
.panel h3.with-icon {
  display: inline-flex;
  align-items: center;
  gap: var(--s-3);
}
.panel-h3-row {
  display: flex;
  justify-content: space-between;
  align-items: center;
  gap: var(--s-3);
  margin: 0 0 var(--s-5);
  padding-bottom: var(--s-3);
  border-bottom: var(--bw-rule) solid var(--rule-strong);
}
.panel-h3-row h3 {
  margin: 0;
  padding: 0;
  border: 0;
}
.panel-h3-actions { display: inline-flex; align-items: center; gap: var(--s-3); }

/* Inline form-around-button: shrink to fit, don't push siblings. */
form.inline { display: inline; margin: 0; }

/* Buttons rendered as <a> must not pick up the global prose underline. */
body.auth-admin a.btn,
body.auth-admin a.btn:hover { text-decoration: none; }

/* ---------- Forms (label-over-input groups) ---------- */

.group {
  display: block;
  margin: 0 0 var(--s-4);
}
.group label {
  display: block;
  margin: 0 0 var(--s-2);
  font-family: var(--font-ui);
  font-size: var(--t-xs);
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  color: var(--fg-muted);
}
.group input[type="text"],
.group input[type="email"],
.group input[type="password"],
.group input[type="number"],
.group input[type="url"],
.group input:not([type]),
.group select,
.group textarea {
  width: 100%;
  font-family: var(--font-ui);
  font-size: 14px;
  font-weight: 500;
  background: var(--paper);
  color: var(--ink);
  border: var(--bw-hair) solid var(--ink);
  border-radius: 0;
  padding: 10px 12px;
}
.group input:focus,
.group select:focus,
.group textarea:focus {
  outline: var(--bw-rule) solid var(--ink);
  outline-offset: 2px;
}
.group .help {
  margin-top: var(--s-2);
  font-size: 12px;
  color: var(--fg-muted);
}
.form-actions {
  display: flex;
  gap: var(--s-2);
  align-items: center;
  margin-top: var(--s-4);
}
.form-row {
  display: flex;
  gap: var(--s-3);
  align-items: flex-end;
  flex-wrap: wrap;
}
.form-row .group { margin-bottom: 0; flex: 1; min-width: 200px; }

.advanced-config {
  margin: var(--s-4) 0 var(--s-2);
  border-top: 1px solid var(--rule-soft);
  padding-top: var(--s-3);
}
.advanced-config > summary {
  cursor: pointer;
  font-size: 12px;
  font-weight: 700;
  letter-spacing: 0.04em;
  text-transform: uppercase;
  color: var(--fg-muted);
  list-style: none;
  display: inline-flex;
  align-items: center;
  gap: var(--s-2);
}
.advanced-config > summary::-webkit-details-marker { display: none; }
.advanced-config > summary::before {
  content: '+';
  width: 14px;
  display: inline-flex;
  justify-content: center;
  font-weight: 800;
}
.advanced-config[open] > summary::before { content: '–'; }
.advanced-config[open] > summary { color: var(--fg); margin-bottom: var(--s-3); }
.advanced-config .group { margin-top: var(--s-2); }

/* ---------- Tables ---------- */

.data-table {
  width: 100%;
  table-layout: fixed;
  border-collapse: collapse;
  font-family: var(--font-ui);
  font-size: 13px;
}

/* Shared column widths so multiple per-group tables line up with each
   other (and instances ↔ apps ↔ editors ↔ users stay consistent). The
   actions column takes whatever is left. */
.data-table .col-icon    { width: 36px; }
.data-table .col-host    { width: 22%; }
.data-table .col-name    { width: 22%; }
.data-table .col-kind    { width: 64px; }
.data-table .col-accepts { width: 18%; }
.data-table .col-members { width: 80px; }
.data-table .col-manifest { width: 150px; }
.data-table .col-date    { width: 110px; }
.data-table .col-stripe  { width: 130px; } /* fits the STRIPE SUBSCRIPTION header */
.data-table .col-actions { width: auto; }

/* Long values ellipsise inside their fixed column rather than overflow. */
.data-table td.col-host,
.data-table td.col-name,
.data-table td.col-accepts {
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
.data-table th,
.data-table td {
  text-align: left;
  padding: 10px 12px;
  border-bottom: var(--bw-hair) solid var(--rule-soft);
  vertical-align: middle;
}
.data-table thead th {
  font-size: 10px;
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  color: var(--fg-muted);
  border-bottom: var(--bw-hair) solid var(--rule);
}
.data-table tbody tr:hover { background: var(--grey-10); }
.data-table td.actions {
  white-space: nowrap;
  text-align: right;
}
.data-table td.actions form { display: inline-block; margin-left: var(--s-2); }
.data-table td .muted { color: var(--fg-muted); font-size: 12px; }

/* Highlight an active row (the group whose members are shown). */
body.auth-admin .data-table tr.row-active { background: var(--grey-10); }

/* Lapsed rows read as faded. */
body.auth-admin .data-table tr.is-lapsed { opacity: .5; }
body.auth-admin .data-table tr.is-lapsed:hover { opacity: .75; }

/* Icon cells in tables / detail views. */
body.auth-admin .data-table td.row-icon {
  width: 36px;
  padding-right: 0;
  color: var(--fg);
}
body.auth-admin .data-table td.row-icon .carbon-icon { display: block; }
body.auth-admin .data-table td.row-icon .row-icon-img {
  display: block;
  object-fit: contain;
}
body.auth-admin .kv-icon .row-icon-img {
  object-fit: contain;
  vertical-align: middle;
}
body.auth-admin .kv-icon {
  display: inline-flex;
  align-items: center;
  vertical-align: middle;
}

/* ---------- Sign-in / standalone card (login.php) ---------- */

.auth-card {
  max-width: 460px;
  margin: 96px auto;
  padding: var(--s-7);
}
.auth-card h2 {
  font-family: var(--font-display);
  font-size: 48px;
  font-weight: 900;
  letter-spacing: var(--tr-display);
  text-transform: lowercase;
  margin: 0 0 var(--s-5);
  padding-bottom: var(--s-3);
  border-bottom: var(--bw-rule) solid var(--rule-strong);
}
.auth-card form { margin-top: var(--s-4); }
.auth-card .banner { margin: 0 0 var(--s-4); }

body.auth-admin .group-heading {
  font-family: var(--font-display);
  font-size: 14px;
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  color: var(--fg-muted);
  margin: var(--s-5) 0 var(--s-2);
  padding-bottom: var(--s-2);
  border-bottom: var(--bw-hair) solid var(--rule-soft);
}
body.auth-admin .group-heading:first-child { margin-top: 0; }
body.auth-admin .group-heading { display: flex; align-items: center; gap: var(--s-2); }
body.auth-admin .group-icon {
  width: 24px;
  height: 24px;
  object-fit: contain;
  vertical-align: middle;
}
body.auth-admin .group-heading .btn { margin-left: auto; }
body.auth-admin .group-inline-form {
  display: flex;
  align-items: center;
  gap: var(--s-2);
}
/* Let the text/file input shrink to its fixed-layout column rather than
   overflow it. */
body.auth-admin .group-inline-form input { flex: 1 1 auto; min-width: 0; }
body.auth-admin .group-inline-form .btn { flex: 0 0 auto; }

/* ---------- Banners with block content keep their spacing ---------- */

body.auth-admin .banner { margin: 0 0 var(--s-5); }

/* ---------- Hub home (index.php) ---------- */

.hub {
  max-width: 920px;
  margin: 0 auto;
  padding: var(--s-7) var(--s-5) var(--s-9);
}
@media (max-width: 720px) { .hub { padding: var(--s-6) var(--s-4) var(--s-7); } }

.hub-top {
  display: flex;
  align-items: baseline;
  justify-content: space-between;
  gap: var(--s-4);
  padding-bottom: var(--s-4);
  margin-bottom: var(--s-7);
  border-bottom: var(--bw-bar) solid var(--rule);
}
.hub-mark {
  font-family: var(--font-display);
  font-weight: 900;
  font-size: 28px;
  letter-spacing: var(--tr-display);
  text-transform: lowercase;
  display: flex;
  align-items: baseline;
  gap: var(--s-3);
}
.hub-mark span {
  font-family: var(--font-ui);
  font-size: 10px;
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  color: var(--fg-muted);
}

.hub-grid {
  display: grid;
  grid-template-columns: repeat(2, 1fr);
  gap: var(--s-5);
}
@media (max-width: 640px) { .hub-grid { grid-template-columns: 1fr; } }

.hub-identity { grid-column: 1 / -1; }
.hub-identity .hub-email {
  font-family: var(--font-display);
  font-weight: 800;
  font-size: 28px;
  line-height: 1.2;
  letter-spacing: var(--tr-tight);
  margin: var(--s-3) 0 var(--s-2);
  word-break: break-word;
}
.hub-identity .hub-role {
  font-family: var(--font-ui);
  font-size: 13px;
  font-weight: 600;
  color: var(--fg-muted);
}

a.hub-action {
  display: flex;
  flex-direction: column;
  text-decoration: none;
  color: var(--on-surface);
  transition: background var(--dur-x) var(--ease), color var(--dur-x) var(--ease);
}
a.hub-action h3 {
  margin: var(--s-3) 0 var(--s-2);
  padding: 0;
  border: 0;
}
a.hub-action p {
  font-size: 14px;
  color: var(--fg-muted);
  margin: 0 0 var(--s-5);
}
a.hub-action .hub-cta {
  margin-top: auto;
  font-family: var(--font-ui);
  font-size: var(--t-xs);
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
}
a.hub-action:hover {
  background: var(--on-surface);
  color: var(--surface);
  text-decoration: none;
}
a.hub-action:hover h3,
a.hub-action:hover .t-overline,
a.hub-action:hover p { color: var(--surface); }

/* ---------- Icon picker ---------- */

body.auth-admin .icon-picker {
  display: grid;
  grid-template-columns: repeat(auto-fill, minmax(76px, 1fr));
  gap: var(--s-2);
}
body.auth-admin .icon-option {
  position: relative;
  display: flex;
  flex-direction: column;
  align-items: center;
  gap: var(--s-2);
  padding: var(--s-3) var(--s-2);
  border: var(--bw-hair) solid var(--rule-muted);
  cursor: pointer;
  background: var(--paper);
  color: var(--ink);
  transition: border-color var(--dur-fast) var(--ease), background var(--dur-fast) var(--ease), color var(--dur-fast) var(--ease);
}
body.auth-admin .icon-option input { position: absolute; opacity: 0; pointer-events: none; }
body.auth-admin .icon-option:hover { border-color: var(--ink); }
body.auth-admin .icon-option:has(input:checked) {
  background: var(--ink);
  color: var(--paper);
  border-color: var(--ink);
}
body.auth-admin .icon-option .io-box {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 24px;
  height: 24px;
  font-size: 18px;
  line-height: 1;
}
body.auth-admin .icon-option .io-label {
  font-size: 10px;
  font-weight: 600;
  letter-spacing: .02em;
  color: var(--fg-muted);
  max-width: 100%;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
body.auth-admin .icon-option:has(input:checked) .io-label { color: var(--paper); opacity: .7; }
body.auth-admin .icon-option.icon-none .io-box {
  font-size: 20px;
  color: var(--fg-muted);
}

/* ---------- Overview (admin/index.php) ---------- */

body.auth-admin .overview-stats {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
  gap: var(--s-4);
  margin: 0 0 var(--s-6);
}
body.auth-admin .overview-stat {
  display: flex;
  flex-direction: column;
  gap: var(--s-2);
  padding: var(--s-5);
  border: var(--bw-hair) solid var(--rule);
  background: var(--surface);
  color: var(--on-surface);
  text-decoration: none;
  transition: background var(--dur-x) var(--ease), color var(--dur-x) var(--ease);
}
body.auth-admin a.overview-stat:hover { background: var(--on-surface); color: var(--surface); text-decoration: none; }
body.auth-admin .overview-stat .os-num {
  font-family: var(--font-display);
  font-weight: 900;
  font-size: 48px;
  line-height: 1;
  letter-spacing: var(--tr-display);
}
body.auth-admin .overview-stat .os-label {
  font-size: var(--t-xs);
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  color: var(--fg-muted);
}
body.auth-admin a.overview-stat:hover .os-label { color: var(--surface); opacity: .7; }

body.auth-admin .overview-cols {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: var(--s-6);
  align-items: start;
}
@media (max-width: 900px) { body.auth-admin .overview-cols { grid-template-columns: 1fr; } }
body.auth-admin .overview-cols .panel { margin: 0; }

body.auth-admin .overview-recent .or-group + .or-group { margin-top: var(--s-5); }

body.auth-admin .overview-list,
body.auth-admin .overview-groups {
  list-style: none;
  margin: 0;
  padding: 0;
}
body.auth-admin .overview-list li,
body.auth-admin .overview-groups li {
  border-bottom: var(--bw-hair) solid var(--rule-soft);
}
body.auth-admin .overview-list li:last-child,
body.auth-admin .overview-groups li:last-child { border-bottom: 0; }
body.auth-admin .overview-list a {
  display: flex;
  align-items: baseline;
  gap: var(--s-3);
  padding: var(--s-2) 0;
  color: var(--fg);
  text-decoration: none;
}
body.auth-admin .overview-list a:hover { text-decoration: underline; }
body.auth-admin .overview-list .ol-name {
  font-weight: 600;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
body.auth-admin .overview-list .muted {
  color: var(--fg-muted);
  font-size: 12px;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}

body.auth-admin .overview-groups a {
  display: flex;
  align-items: center;
  gap: var(--s-3);
  padding: var(--s-3) 0;
  color: var(--fg);
  text-decoration: none;
}
body.auth-admin .overview-groups a:hover { text-decoration: underline; }
body.auth-admin .overview-groups .og-icon {
  width: 28px;
  height: 28px;
  flex: 0 0 auto;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  color: var(--fg-muted);
}
body.auth-admin .overview-groups .og-icon img { object-fit: contain; }
body.auth-admin .overview-groups .og-name {
  flex: 1 1 auto;
  min-width: 0;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
}
body.auth-admin .overview-groups .og-count {
  font-weight: 700;
  font-variant-numeric: tabular-nums lining-nums;
}

/* ---------- MIME tag picker ---------- */

body.auth-admin .mime-picker .mime-chips {
  display: flex;
  flex-wrap: wrap;
  gap: var(--s-2);
  min-height: 30px;
  padding: var(--s-2);
  margin-bottom: var(--s-3);
  border: var(--bw-hair) solid var(--rule-muted);
  background: var(--paper);
}
body.auth-admin .mime-picker .mime-chips:empty::before {
  content: 'No types selected. Pick from the registry or add a custom one below.';
  color: var(--fg-muted);
  font-size: 13px;
  font-style: italic;
  padding: 4px 2px;
}
body.auth-admin .mime-chip {
  display: inline-flex;
  align-items: center;
  gap: var(--s-2);
  padding: 4px 6px 4px 10px;
  background: var(--ink);
  color: var(--paper);
  font-size: 13px;
  line-height: 1.2;
}
body.auth-admin .mime-chip code {
  background: transparent;
  color: inherit;
  font-size: inherit;
  padding: 0;
}
body.auth-admin .mime-chip-x {
  border: 0;
  background: transparent;
  color: inherit;
  cursor: pointer;
  font-size: 18px;
  line-height: 1;
  padding: 0 6px;
}
body.auth-admin .mime-chip-x:hover { background: var(--paper); color: var(--ink); }

body.auth-admin .mime-add-known,
body.auth-admin .mime-add-custom {
  font-family: var(--font-ui);
  font-size: 14px;
  background: var(--paper);
  color: var(--ink);
  border: var(--bw-hair) solid var(--ink);
  border-radius: 0;
  padding: 8px 10px;
}
body.auth-admin .mime-add-custom { flex: 1 1 auto; min-width: 0; }

/* ---------- Tier picker (catalog-driven) ---------- */
body.auth-admin .tier-picker {
  display: flex;
  flex-direction: column;
  gap: var(--s-1);
}
body.auth-admin .tier-picker .tier-picker-status {
  font-size: var(--t-xs);
  color: var(--fg-muted);
}

/* ---------- App detail identity block (instance-show.php) ---------- */
body.auth-admin .app-identity {
  display: flex;
  align-items: center;
  gap: var(--s-4);
  padding: 0 0 var(--s-5);
  margin: 0 0 var(--s-5);
  border-bottom: var(--bw-rule) solid var(--rule-strong);
}
body.auth-admin .app-identity__icon {
  flex: 0 0 auto;
  width: 56px;
  height: 56px;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  border: var(--bw-hair) solid var(--rule);
  color: var(--fg);
}
body.auth-admin .app-identity__icon img { object-fit: contain; }
body.auth-admin .app-identity__body { min-width: 0; flex: 1 1 auto; }
body.auth-admin .app-identity__name {
  font-family: var(--font-display);
  font-weight: 900;
  font-size: 32px;
  line-height: 1.05;
  letter-spacing: var(--tr-display);
  text-transform: lowercase;
  word-break: break-word;
}
body.auth-admin .app-identity__meta {
  display: flex;
  align-items: center;
  flex-wrap: wrap;
  gap: var(--s-2);
  margin-top: var(--s-2);
}

/* ---------- Tab bar (instance-show.php) ---------- */
body.auth-admin .tab-bar {
  display: flex;
  gap: var(--s-5);
  border-bottom: var(--bw-rule) solid var(--rule-strong);
  margin: 0 0 var(--s-6);
}
body.auth-admin .tab-bar__tab {
  display: inline-block;
  padding: var(--s-3) 0;
  margin-bottom: -1px;
  font-family: var(--font-ui);
  font-size: var(--t-xs);
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  color: var(--fg-muted);
  text-decoration: none;
  border-bottom: var(--bw-bar) solid transparent;
  transition: color var(--dur-fast) var(--ease), border-color var(--dur-fast) var(--ease);
}
body.auth-admin .tab-bar__tab:hover { color: var(--fg); text-decoration: none; }
body.auth-admin .tab-bar__tab.is-active {
  color: var(--fg);
  border-bottom-color: var(--rule);
}

/* ---------- Editor defaults (editors.php) ---------- */
body.auth-admin .editor-defaults {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
}
body.auth-admin .editor-default-form {
  display: inline-flex;
  align-items: center;
  gap: var(--s-2);
  margin: var(--s-1) var(--s-4) var(--s-1) 0;
}

/* ---------- Grants pre-fill note (grants.php) ---------- */
body.auth-admin .grants-prefill-note {
  font-size: 12px;
  font-style: italic;
  color: var(--fg-muted);
  margin: 0 0 var(--s-3);
}

/* ---------- Pools: owner-grouped, path-nested accordion (admin/pools.php) ---------- */
body.auth-admin .pool-owner-group { margin-bottom: var(--s-5); }
body.auth-admin .pool-owner-head {
  display: flex; align-items: center; gap: 10px;
  padding: 8px 0; margin-bottom: 4px;
  border-bottom: var(--bw-rule) solid var(--rule-strong);
  font-size: 13px;
}
body.auth-admin .pool-owner-head .muted { margin-left: auto; font-size: 11px; }

body.auth-admin .pool-row {
  display: grid;
  grid-template-columns: 20px minmax(0, 2.2fr) 1fr 1fr auto;
  align-items: center; gap: 12px;
  padding: 10px 8px;
  border-bottom: var(--bw-hair) solid var(--rule-soft);
}
body.auth-admin .pool-row--child {
  background: var(--grey-10);
  padding-left: 8px;
}
body.auth-admin .pool-row--child .pool-cell--name { padding-left: 24px; }
body.auth-admin summary.pool-row { cursor: pointer; list-style: none; }
body.auth-admin summary.pool-row::-webkit-details-marker { display: none; }
body.auth-admin .pool-tree { border-bottom: var(--bw-hair) solid var(--rule-soft); }
body.auth-admin .pool-tree > summary.pool-row { border-bottom: 0; }

body.auth-admin .pool-twisty { text-align: center; color: var(--fg); transition: transform var(--dur-fast) var(--ease); }
body.auth-admin .pool-tree[open] > summary .pool-twisty { transform: rotate(90deg); }
body.auth-admin .pool-twisty--none { visibility: hidden; }

body.auth-admin .pool-cell { min-width: 0; }
body.auth-admin .pool-cell--name { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
body.auth-admin .pool-cell--name b { overflow: hidden; text-overflow: ellipsis; }
body.auth-admin .pool-path { font-size: 10px; color: var(--fg-muted); }
body.auth-admin .pool-cell--reach { font-size: 11px; color: var(--fg-muted); }
body.auth-admin .pool-cell--actions { display: inline-flex; gap: 6px; align-items: center; justify-self: end; }

@media (max-width: 720px) {
  body.auth-admin .pool-row { grid-template-columns: 16px 1fr auto; }
  body.auth-admin .pool-cell--source, body.auth-admin .pool-cell--reach { display: none; }
}

/* ---------- Create-pool dialog (admin/pools.php) ---------- */
/* A native <dialog> (the form must survive a POST round-trip and reopen on
   a validation error), styled to match the DS modal: hard hairline frame,
   flat ink scrim, no radius. NOT named .modal — that family is reserved by
   the design system (v3.3.2). */
.pool-modal {
  width: min(680px, 92vw);
  border: var(--bw-rule) solid var(--ink);
  background: var(--paper);
  color: var(--ink);
  padding: var(--s-5);
}
.pool-modal::backdrop { background: rgba(0, 0, 0, .45); }
.pool-modal__head {
  display: flex; align-items: center; justify-content: space-between;
  gap: 12px; margin-bottom: var(--s-4);
  padding-bottom: var(--s-3); border-bottom: var(--bw-rule) solid var(--rule-strong);
}
.pool-modal__head h3 { margin: 0; }

/* ---------- Reach map (admin/access.php) ---------- */
/* Inline SVG of the access model: user → mechanism → resource, drawn above
   the canonical tables. Fixed 800-wide viewBox scales with the panel.
   Solid ink edges are direct rw reach; dashed grey edges are ro or
   group-inherited (mirroring the mode/via columns below). */
.reach-map { display: block; width: 100%; height: auto; margin: var(--s-4) 0 var(--s-5); }

.reach-map .edge {
  stroke: var(--ink);
  stroke-width: 1;
  fill: none;
  transition: stroke var(--dur-fast) var(--ease), stroke-width var(--dur-fast) var(--ease);
}
.reach-map .edge--soft { stroke: var(--grey-30); stroke-dasharray: 4 3; }
.reach-map .edge.is-hot { stroke: var(--ink); stroke-width: 2; }

.reach-map .node rect { fill: var(--paper); stroke: var(--ink); stroke-width: 1; }
.reach-map .node text { fill: var(--ink); font: 12px var(--font-mono); }
.reach-map .node--mech rect { fill: var(--grey-10); }
.reach-map .node--mech-group rect { stroke-dasharray: 4 3; }
.reach-map .edge-label { fill: var(--grey-60); font: 11px var(--font-mono); }

/* Pool nodes are links: underlined like every content link, hover-invert. */
.reach-map a:hover rect, .reach-map a:focus-visible rect { fill: var(--ink); }
.reach-map a:hover text, .reach-map a:focus-visible text { fill: var(--paper); }

/* ---------- Theme picker (sidebar foot, near account / sign-out) ----------
   The per-app-per-user "Theme" control (wireon-theme.js v3.5.0). Styled to sit
   quietly in the inverse rail alongside the sign-out link. choose() applies
   live and persists to localStorage["wireon.theme.<userKey>"]. */
.visually-hidden {
  position: absolute;
  width: 1px; height: 1px;
  margin: -1px; padding: 0; border: 0;
  clip: rect(0 0 0 0); clip-path: inset(50%);
  overflow: hidden; white-space: nowrap;
}
.app-sidebar__foot .wireon-theme-picker { display: block; margin: 0; }
.app-sidebar__foot .wireon-theme-picker select {
  width: 100%;
  appearance: none;
  -webkit-appearance: none;
  background: transparent;
  color: color-mix(in srgb, var(--fg-inverse) 55%, transparent);
  border: var(--bw-hair) solid color-mix(in srgb, var(--fg-inverse) 22%, transparent);
  border-radius: 0;
  padding: 6px var(--s-2);
  font-family: inherit;
  font-size: 10px;
  font-weight: 700;
  letter-spacing: var(--tr-wide);
  text-transform: uppercase;
  cursor: pointer;
  transition: color var(--dur-fast) var(--ease), border-color var(--dur-fast) var(--ease);
}
.app-sidebar__foot .wireon-theme-picker select:hover,
.app-sidebar__foot .wireon-theme-picker select:focus-visible {
  color: var(--fg-inverse);
  border-color: color-mix(in srgb, var(--fg-inverse) 45%, transparent);
  outline: none;
}
/* The native option list renders on the OS surface, so keep it readable. */
.app-sidebar__foot .wireon-theme-picker option { color: var(--ink); background: var(--paper); }

/* Apps list: a per-instance app expands to its workspaces inline (the
   dropdown-under-the-app view). The disclosure lives in a full-width subrow
   under the app's main row; the app list is the entry point, no click-through
   to Manage just to see who exists. */
.app-subrow > td { padding-top: 0; border-top: none; }
.app-workspaces { margin: 0 0 var(--s-3); }
.app-workspaces > summary {
  cursor: pointer;
  display: inline-flex;
  align-items: center;
  gap: var(--s-2);
  padding: var(--s-2) 0;
  color: var(--ink-2, var(--ink));
  font-size: var(--fs-sm, 0.875rem);
  user-select: none;
}
.app-workspaces > summary:hover { color: var(--ink); }
.app-workspaces__body { padding: var(--s-2) 0 var(--s-3) var(--s-4); }
.ws-list { list-style: none; margin: 0 0 var(--s-3); padding: 0; }
.ws-list__item {
  display: flex;
  align-items: center;
  gap: var(--s-3);
  padding: var(--s-2) 0;
  border-top: 1px solid var(--line, var(--border, rgba(128,128,128,0.2)));
}
.ws-list__item:first-child { border-top: none; }
.ws-list__name { font-weight: 600; margin-right: auto; }
/* Self-serve apps: the auto-provision fact is the PRIMARY line — instances
   stand up on first open; manual pre-creation is the secondary affordance. */
.ws-selfserve-note {
  margin: var(--s-2) 0;
  font-weight: 600;
  color: var(--ink);
}