/* GOcontroll Cloud dashboard — GENERATED by cloud-deployer. Static; brand token
   comes from /app-config.json (styling.brand) applied to --brand at runtime.
   Tokens mirror GOcontroll-Architecture/styling. Theme-aware (light default +
   prefers-color-scheme dark). Do not hand-edit. */

:root {
  --brand: #e94e25;
  --brand-light: #fdf2ef;
  --brand-dim: rgba(233, 78, 37, .12);
  --black: #1a1a1a;
  --bg: #f5f5f5;
  --panel: #fff;
  --white: #fff;
  --muted: #6b7280;
  --border: #e2e2e2;
  --border2: #d0d0d0;
  --danger: #dc2626;
  --warn: #d97706;
  --info: #2563eb;
  --ok: #16a34a;
  --radius: 6px;
  --font: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
  --mono: 'SF Mono', 'Fira Code', ui-monospace, monospace;
  --topbar-h: 52px;
  --tabbar-h: 40px;
  --sidebar-w: 288px;
}

@media (prefers-color-scheme: dark) {
  :root {
    --brand-light: rgba(233, 78, 37, .16);
    --black: #ececec;
    --bg: #131313;
    --panel: #1c1c1c;
    --white: #1c1c1c;
    --muted: #9aa0aa;
    --border: #2c2c2c;
    --border2: #3a3a3a;
  }
}

* { box-sizing: border-box; }
/* The `hidden` attribute must beat author `display` rules (e.g. .empty-state uses
   flex, which would otherwise override the UA [hidden]{display:none}). */
[hidden] { display: none !important; }
html, body { height: 100%; }
body {
  margin: 0;
  font-family: var(--font);
  font-size: 14px;
  color: var(--black);
  background: var(--bg);
  -webkit-font-smoothing: antialiased;
}
.spacer { flex: 1 1 auto; }

/* ---- top bar ---- */
.topbar {
  height: var(--topbar-h);
  display: flex;
  align-items: center;
  gap: 12px;
  padding: 0 16px;
  background: var(--panel);
  border-bottom: 3px solid var(--brand);
  position: sticky;
  top: 0;
  z-index: 10;
}
.logo { height: 26px; width: auto; }
/* Logo → divider → app title, per the styling guide's header order. */
.topbar-div { width: 1px; height: 20px; background: var(--border); flex: 0 0 1px; }
.app-title { font-size: 15px; font-weight: 600; letter-spacing: .01em; }

/* Connection indicator — the guide's status-dot pattern (8×8 circle), not a "●" glyph
   in monospace. Mono is for data and stat values; this is a label. */
.conn { display: inline-flex; align-items: center; gap: 6px; font-size: 12.5px; color: var(--muted); }
.conn::before {
  content: "";
  width: 8px; height: 8px; flex: 0 0 8px;
  border-radius: 50%;
  background: var(--border2);
}
.conn.ok::before { background: var(--ok); }
.conn.err::before { background: var(--danger); }

/* ---- workspace tabs (Devices | Users) ----
   The underline bar mirrored from GOcontroll-Application-Context-Manager: a tab swaps the
   whole workspace (sidebar + content). Deliberately a different visual language from the
   per-device dashboard tabs below (.tabs/.tab, filled pills) — two nav levels that must
   not read as one. Which tabs exist is decided by the role in app.js.
   It is only hidden pre-boot and behind the login gate (which hides .shell anyway), so
   .shell's height may bank on it being there. */
.tab-bar {
  height: var(--tabbar-h);
  display: flex;
  align-items: stretch;
  gap: 2px;
  padding: 0 16px;
  background: var(--panel);
  border-bottom: 1px solid var(--border);
}
.tab-item {
  display: inline-flex;
  align-items: center;
  padding: 0 18px;
  font: inherit;
  font-size: 13.5px;
  font-weight: 600;
  color: var(--muted);
  background: transparent;
  border: none;
  border-bottom: 3px solid transparent;
  cursor: pointer;
  transition: color .15s, border-color .15s, background .1s;
}
.tab-item:hover { color: var(--black); background: var(--bg); }
.tab-item.active { color: var(--brand); border-bottom-color: var(--brand); background: var(--bg); font-weight: 700; }

/* ---- shell layout ---- */
.shell {
  display: grid;
  grid-template-columns: var(--sidebar-w) 1fr;
  height: calc(100vh - var(--topbar-h) - var(--tabbar-h));
}
.sidebar {
  background: var(--panel);
  border-right: 1px solid var(--border);
  display: flex;
  flex-direction: column;
  min-height: 0;
}
.side-head {
  display: flex;
  align-items: baseline;
  gap: 8px;
  padding: 14px 16px 8px;
}
.side-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .06em; color: var(--muted); }
.side-count { font-size: 11px; color: var(--muted); font-family: var(--mono); }
.search {
  margin: 0 12px 10px;
  padding: 8px 10px;
  font: inherit;
  font-size: 13px;
  color: var(--black);
  background: var(--bg);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  outline: none;
}
.search:focus { border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-dim); }
.device-list { overflow-y: auto; padding: 0 8px 12px; }

.device {
  display: block;
  width: 100%;
  text-align: left;
  padding: 9px 11px;
  margin: 2px 0;
  border: 1px solid transparent;
  border-radius: var(--radius);
  background: transparent;
  cursor: pointer;
  font: inherit;
  color: inherit;
}
.device:hover { background: var(--bg); }
.device.sel { background: var(--brand-light); border-color: var(--brand); }
.device .dev-id { font-weight: 600; font-size: 13px; word-break: break-all; }
.device .dev-fields { margin-top: 3px; display: flex; flex-wrap: wrap; gap: 4px 10px; }
.device .dev-f { font-size: 11.5px; color: var(--muted); }
.device .dev-f b { color: var(--black); font-weight: 600; }

/* ---- content ---- */
.content { overflow-y: auto; min-height: 0; padding: 16px; }
.empty-state {
  display: flex; align-items: center; justify-content: center;
  height: 60vh; color: var(--muted); font-size: 14px;
}
/* selected-device header — makes the current device unmistakable (see app.js) */
.device-header {
  display: flex; align-items: center; gap: 12px; flex-wrap: wrap;
  padding: 10px 14px; margin-bottom: 12px;
  background: var(--panel); border: 1px solid var(--border);
  border-left: 3px solid var(--brand); border-radius: var(--radius);
}
.dh-ico { width: 10px; height: 10px; border-radius: 3px; background: var(--brand); flex: none; }
.dh-id-wrap { display: flex; flex-direction: column; line-height: 1.15; }
.dh-label { font-size: 10px; font-weight: 700; text-transform: uppercase; letter-spacing: .06em; color: var(--muted); }
.dh-id { font-size: 16px; font-weight: 700; color: var(--black); font-family: var(--mono); word-break: break-all; }
.dh-fields { display: flex; flex-wrap: wrap; gap: 4px 16px; margin-left: 6px; }
.dh-f { font-size: 12px; color: var(--muted); }
.dh-f b { color: var(--black); font-weight: 600; margin-left: 2px; }

/* per-device dashboard tabs — the second nav level, inside the Devices workspace. Which
   of these exist depends on the selected device (dashboard_access; see app.js). */
.tabs { display: flex; gap: 5px; flex-wrap: wrap; margin-bottom: 12px; }
.tab {
  padding: 8px 16px; border: 1px solid var(--border); border-radius: var(--radius);
  background: var(--panel); color: var(--muted); cursor: pointer; font: inherit; font-size: 13px; font-weight: 600;
  transition: color .12s, border-color .12s, background .12s;
}
.tab:hover { border-color: var(--border2); color: var(--black); }
.tab.sel { background: var(--brand); border-color: var(--brand); color: #fff; box-shadow: 0 1px 4px var(--brand-dim); }

.dash-toolbar { display: flex; align-items: center; gap: 10px; margin-bottom: 14px; flex-wrap: wrap; }
/* interactive time bar — viewer picks live / historical window (see app.js) */
.time-sel { display: flex; align-items: center; gap: 7px; font-size: 12.5px; color: var(--muted); flex-wrap: wrap; }
.time-ico { font-size: 14px; line-height: 1; }
.time-input {
  font: inherit; font-size: 12.5px; color: var(--black);
  background: var(--panel); border: 1px solid var(--border); border-radius: var(--radius);
  padding: 5px 8px; outline: none;
}
.time-input:focus { border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-dim); }
.time-dt { font-family: var(--mono); }
.time-lbl { white-space: nowrap; }
.dev-ctx { font-family: var(--mono); }
.time-reset {
  padding: 4px 9px; border: 1px solid var(--border); border-radius: 100px;
  background: transparent; color: var(--muted); cursor: pointer; font: inherit; font-size: 11.5px;
}
.time-reset:hover { border-color: var(--brand); color: var(--brand); }

/* graphical time control: scale presets (uur/dag/week/maand) + dual-handle range slider */
.time-scales { display: inline-flex; gap: 3px; }
.time-scale {
  padding: 5px 10px; border: 1px solid var(--border); border-radius: var(--radius);
  background: var(--panel); color: var(--muted); cursor: pointer; font: inherit; font-size: 12px; font-weight: 600;
  transition: color .12s, border-color .12s, background .12s;
}
.time-scale:hover { border-color: var(--border2); color: var(--black); }
.time-scale.sel { background: var(--brand); border-color: var(--brand); color: #fff; }
.time-track {
  position: relative; width: 220px; height: 22px; flex: none;
  background: var(--bg); border: 1px solid var(--border); border-radius: 100px;
  touch-action: none;
}
.time-band { position: absolute; top: 0; bottom: 0; background: var(--brand-dim); border-radius: 100px; }
.time-handle {
  position: absolute; top: 50%; width: 14px; height: 14px; margin: -7px 0 0 -7px;
  background: var(--brand); border: 2px solid #fff; border-radius: 50%;
  box-shadow: 0 1px 3px rgba(0, 0, 0, .3); cursor: ew-resize; touch-action: none;
}
.time-handle:hover { transform: scale(1.12); }
.time-range-lbl { font-family: var(--mono); color: var(--black); white-space: nowrap; }
/* The guide's button base. inline-flex + gap carries an icon next to the label; the
   explicit centring keeps full-width buttons (the login card's) centred, which a flex
   container would otherwise left-align. */
.btn {
  display: inline-flex; align-items: center; justify-content: center; gap: 6px;
  padding: 7px 12px; border: 1px solid var(--border); border-radius: var(--radius);
  background: var(--panel); color: var(--black); cursor: pointer; font: inherit; font-size: 13px;
  transition: color .15s, border-color .15s, background .15s;
}
.btn:hover { border-color: var(--brand); color: var(--brand); }

/* ---- widget grid (12-col, mirrors the configurator layout) ---- */
.grid {
  display: grid;
  grid-template-columns: repeat(12, 1fr);
  grid-auto-rows: 92px;
  gap: 12px;
}
.widget {
  grid-column: span 4;
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 12px 14px;
  display: flex;
  flex-direction: column;
  min-width: 0;
  overflow: hidden;
}
.w-title { font-size: 12px; font-weight: 700; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); margin-bottom: 8px; }
.w-body { flex: 1 1 auto; min-height: 0; display: flex; flex-direction: column; }
.dash-w-empty { color: var(--muted); font-size: 12.5px; display: flex; align-items: center; justify-content: center; flex: 1; text-align: center; }

/* gauge */
.gauge-wrap { display: flex; flex-direction: column; align-items: center; justify-content: center; flex: 1; }
.gauge-svg { width: 100%; max-width: 190px; height: auto; }
.gauge-val { font-size: 26px; font-weight: 700; font-family: var(--mono); margin-top: -6px; }
.gauge-range { margin-top: 2px; }

/* timeseries axis chart */
.spark-wrap { flex: 1; display: flex; flex-direction: column; min-height: 0; }
.spark-legend { display: flex; flex-wrap: wrap; gap: 4px 12px; margin-bottom: 4px; }
.spark-legend span { font-size: 11px; color: var(--muted); display: inline-flex; align-items: center; gap: 5px; }
.spark-legend i { width: 10px; height: 3px; border-radius: 2px; display: inline-block; }
/* X = active time window, Y = configured band. Gutters via a 2×2 grid. */
.ts-chart {
  flex: 1; min-height: 0;
  display: grid;
  grid-template-columns: 46px 1fr;
  grid-template-rows: 1fr 15px;
  column-gap: 4px;
}
.ts-yaxis { grid-column: 1; grid-row: 1; position: relative; }
.ts-plot  { grid-column: 2; grid-row: 1; position: relative; min-height: 0;
  border-left: 1px solid var(--border2); border-bottom: 1px solid var(--border2); }
.ts-corner { grid-column: 1; grid-row: 2; }
.ts-xaxis { grid-column: 2; grid-row: 2; position: relative; }
.ts-svg { position: absolute; inset: 0; width: 100%; height: 100%; display: block; }
.ts-grid { stroke: var(--border); stroke-width: 1; vector-effect: non-scaling-stroke; }
.ts-line { fill: none; stroke-width: 2; stroke-linejoin: round; stroke-linecap: round; vector-effect: non-scaling-stroke; }
.ts-ylab { position: absolute; right: 5px; font-size: 10px; color: var(--muted); font-family: var(--mono); white-space: nowrap; }
.ts-xlab { position: absolute; top: 2px; font-size: 10px; color: var(--muted); font-family: var(--mono); white-space: nowrap; }
.ts-nodata { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; }

/* interactive cursor: a crosshair that follows the pointer along the time axis, with a dot on
   each series and a tooltip; it drives the synced map marker below (see app.js broadcastCursor). */
.ts-plot { cursor: crosshair; }
.ts-cursor { position: absolute; inset: 0; pointer-events: none; z-index: 2; }
.ts-cursor-line { position: absolute; top: 0; bottom: 0; width: 1px; margin-left: -0.5px; background: var(--muted); opacity: .65; }
.ts-cursor-dot { position: absolute; width: 8px; height: 8px; border-radius: 50%; border: 1.5px solid var(--panel); transform: translate(-50%, -50%); box-shadow: 0 0 0 1px rgba(0, 0, 0, .15); }
.ts-cursor-tip {
  position: absolute; top: 4px; transform: translateX(8px);
  background: var(--panel); border: 1px solid var(--border); border-radius: var(--radius);
  padding: 5px 8px; font-size: 11px; line-height: 1.5; color: var(--black);
  box-shadow: 0 4px 14px rgba(0, 0, 0, .16); white-space: nowrap;
}
.ts-cursor-tip.flip { transform: translateX(calc(-100% - 8px)); }
.ts-cursor-time { display: block; font-family: var(--mono); font-size: 10.5px; color: var(--muted); margin-bottom: 2px; }
.ts-cursor-row { display: flex; align-items: center; gap: 5px; }
.ts-cursor-row i { width: 9px; height: 3px; border-radius: 2px; display: inline-block; flex: none; }
.ts-cursor-row b { font-family: var(--mono); font-weight: 600; }
/* the synced map marker — the chart-hovered position; a soft pulse so it reads as the live cursor */
path.map-cursor { animation: mapCursorPulse 1.4s ease-in-out infinite; }
@keyframes mapCursorPulse { 0%, 100% { opacity: 1; } 50% { opacity: .4; } }
/* drag-to-zoom: the brushed span highlighted while selecting a new time window. Brand-tinted;
   color-mix follows the live --brand where supported, else the static --brand-dim fallback. */
.ts-brush {
  position: absolute; top: 0; bottom: 0; z-index: 3; pointer-events: none;
  background: var(--brand-dim);
  background: color-mix(in srgb, var(--brand) 16%, transparent);
  border-left: 1px solid var(--brand); border-right: 1px solid var(--brand);
}

/* table */
.dash-table { width: 100%; border-collapse: collapse; font-size: 12px; }
.dash-table th { text-align: left; color: var(--muted); font-weight: 600; text-transform: uppercase; letter-spacing: .03em; font-size: 10.5px; padding: 4px 8px; border-bottom: 1px solid var(--border); position: sticky; top: 0; background: var(--panel); }
.dash-table td { padding: 4px 8px; border-bottom: 1px solid var(--border); font-family: var(--mono); }
.dash-table td.muted { color: var(--muted); }
.table-scroll { overflow: auto; flex: 1; min-height: 0; }

/* text */
.text-val { font-size: 30px; font-weight: 700; font-family: var(--mono); display: flex; align-items: center; justify-content: center; flex: 1; word-break: break-all; text-align: center; }

/* boolean */
.bool-wrap { display: flex; align-items: center; justify-content: center; flex: 1; }
.bool-pill { padding: 8px 20px; border-radius: 100px; font-weight: 700; font-size: 15px; }
.bool-pill.on { background: rgba(22, 163, 74, .12); color: var(--ok); }
.bool-pill.off { background: rgba(107, 114, 128, .14); color: var(--muted); }

/* map */
.map-wrap { flex: 1; display: flex; flex-direction: column; min-height: 0; }
.map-canvas { flex: 1; min-height: 120px; border-radius: 4px; overflow: hidden; background: var(--bg); }
.map-foot { margin-top: 6px; }

.small { font-size: 11.5px; }
.muted { color: var(--muted); }
.err { color: var(--danger); }
.ok { color: var(--ok); }

/* ---- responsive: collapse the grid + sidebar on narrow screens ---- */
@media (max-width: 820px) {
  .shell { grid-template-columns: 1fr; height: auto; }
  .sidebar { border-right: none; border-bottom: 1px solid var(--border); max-height: 40vh; }
  .grid { grid-template-columns: repeat(4, 1fr); }
  .widget { grid-column: span 4 !important; }
}

/* ============================================================
   Auth — login screen + header user chip + user management.
   Rendered by app.js only when auth is enabled (see /api/me).
   ============================================================ */
.overlay { position: fixed; inset: 0; z-index: 50; background: rgba(0,0,0,.45); display: flex; align-items: flex-start; justify-content: center; padding: 40px 16px; overflow-y: auto; }

.btn.primary { background: var(--brand); border-color: var(--brand); color: #fff; }
.btn.primary:hover { color: #fff; filter: brightness(1.06); }
.btn.sm { padding: 5px 10px; font-size: 12.5px; }
.btn.danger { color: var(--danger); }
.btn.danger:hover { border-color: var(--danger); color: var(--danger); }
.btn:disabled { opacity: .55; cursor: default; }

/* login card — a sign-in PAGE, not a modal over the shell: the overlay carries the
   page background and the card the brand lockup. Mirrors the confirmation-card
   pattern in GOcontroll-Architecture/styling (12px radius, 40px logo, 3px brand rule). */
.overlay.login-ov { background: var(--bg); align-items: center; padding: 24px 16px; }
.login-card {
  position: relative; width: 100%; max-width: 380px;
  background: var(--panel); border: 1px solid var(--border); border-radius: 12px;
  padding: 32px 32px 24px; box-shadow: 0 8px 32px rgba(0,0,0,.10); overflow: hidden;
}
/* the same 3px brand accent the top bar carries, here as the card's crown */
.login-card::before { content: ""; position: absolute; top: 0; left: 0; right: 0; height: 3px; background: var(--brand); }
.login-brand { margin-bottom: 22px; }
.login-logo { height: 40px; width: auto; display: block; }
.login-eyebrow { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .08em; color: var(--brand); }
.login-title { font-size: 20px; font-weight: 700; letter-spacing: .01em; margin-top: 2px; }
.login-sub { margin-top: 6px; margin-bottom: 20px; }
.login-step { display: flex; flex-direction: column; gap: 5px; margin-bottom: 12px; }
.login-step > * { flex: 0 0 auto; }
.login-label { font-size: 12px; font-weight: 500; color: var(--black); }
.login-input { flex: 1 1 auto; min-width: 0; padding: 9px 11px; font: inherit; font-size: 13.5px; color: var(--black); background: var(--bg); border: 1px solid var(--border); border-radius: var(--radius); outline: none; transition: border-color .15s, box-shadow .15s; }
.login-input:focus { border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-dim); }
.login-input.sm { padding: 6px 9px; font-size: 12.5px; }
.login-code { font-family: var(--mono); font-size: 15px; letter-spacing: .22em; }
.login-btn { margin-top: 5px; padding: 9px 16px; font-weight: 600; white-space: nowrap; }
.login-msg { margin-top: 4px; min-height: 16px; }
.login-msg.err { color: var(--danger); }
.login-msg.ok { color: var(--ok); }
.login-foot { margin-top: 20px; padding-top: 14px; border-top: 1px solid var(--border); font-size: 11px; color: var(--muted); }

/* The wordmark's "controll" is anthracite (#1a1a1a) and there is only ONE logo.svg — on a
   dark panel it would vanish. Give it its own white plate rather than filtering the file,
   which would smear the brand orange. */
@media (prefers-color-scheme: dark) {
  .login-brand { display: inline-block; background: #fff; border-radius: 8px; padding: 9px 12px; }
}

/* header chip — who you are, then what you are, then the way out */
.user-area { display: inline-flex; align-items: center; gap: 10px; }
/* Its leading divider is a pseudo-element, not a sibling span: with auth off the whole
   chip is [hidden] and a sibling rule would leave the divider dangling on its own. */
.user-area::before { content: ""; width: 1px; height: 20px; background: var(--border); margin-right: 2px; }
/* An address is identity, not data: the UI font, like every other label. It was monospace,
   which read as a terminal readout (the guide reserves mono for data + stat values). */
.user-email { font-size: 13px; color: var(--black); }
/* The guide's badge base: 2px 10px, 999px, .7rem, weight 600, letter-spacing .03em.
   Tinted rather than filled — `.badge.orange` is a solid brand fill, which next to the
   top bar's 3px brand rule is two loud oranges arguing. --brand-dim is defined for
   exactly this ("subtle brand overlays"). */
.role-badge {
  text-transform: uppercase;
  font-size: .7rem; font-weight: 600; letter-spacing: .03em;
  padding: 2px 10px; border-radius: 999px;
  background: var(--brand-dim); color: var(--brand);
  border: 1px solid rgba(233, 78, 37, .25);
}
.role-badge.role-admin { background: rgba(37,99,235,.1); color: #1d4ed8; border-color: rgba(37,99,235,.25); }
.role-badge.role-user { background: rgba(107,114,128,.1); color: #4b5563; border-color: rgba(107,114,128,.25); }

/* The guide's header-utility button (.settings-btn / .logout): muted, not full-contrast —
   signing out is an escape hatch, not the page's main action. */
.btn.ghost { color: var(--muted); gap: 6px; }
.btn.ghost:hover { color: var(--brand); border-color: var(--brand); }
.btn .ico { width: 14px; height: 14px; flex: 0 0 14px; display: block; }

/* ============================================================
   Users workspace — the roster sidebar + the grant matrix.
   Replaces the old modal "Manage" overlay: management is a workspace, not a dialog.
   ============================================================ */

/* --- sidebar: Administrators / Users --- */
.usr-scroll { flex: 1 1 auto; min-height: 0; overflow-y: auto; }
.usr-section { border-bottom: 1px solid var(--border); padding-bottom: 8px; }
.usr-section:last-child { border-bottom: none; }
.usr-section-head { display: flex; align-items: baseline; gap: 8px; padding: 14px 16px 6px; }
.usr-section-title { font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .06em; color: var(--muted); }
.usr-section-count { font-size: 11px; color: var(--muted); font-family: var(--mono); }
/* the add affordance sits in the section it adds to, so a new principal appears where it was made */
.usr-add-btn {
  margin-left: auto; width: 22px; height: 22px; line-height: 1; padding: 0;
  border: 1px solid var(--border); border-radius: var(--radius);
  background: var(--panel); color: var(--muted); cursor: pointer; font: inherit; font-size: 14px;
}
.usr-add-btn:hover { border-color: var(--brand); color: var(--brand); }
.usr-add-btn.open { border-color: var(--brand); color: var(--brand); background: var(--brand-light); }
.usr-add { display: flex; flex-direction: column; gap: 6px; padding: 6px 12px 10px; }
.usr-add-msg { min-height: 14px; }

.usr-list { padding: 0 8px; }
.usr-row {
  display: flex; align-items: center; gap: 8px;
  width: 100%; text-align: left;
  padding: 7px 11px; margin: 2px 0;
  border: 1px solid transparent; border-radius: var(--radius);
  background: transparent; cursor: pointer; font: inherit; color: inherit;
}
.usr-row:hover { background: var(--bg); }
.usr-row.sel { background: var(--brand-light); border-color: var(--brand); }
.usr-row-email { font-size: 13px; font-weight: 600; word-break: break-all; min-width: 0; }
.usr-row-meta { margin-left: auto; font-size: 11px; color: var(--muted); font-family: var(--mono); white-space: nowrap; }
.usr-none { padding: 4px 14px 8px; }

/* --- content: the selected principal's grants --- */
.usr-page-head { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin-bottom: 4px; }
.usr-page-title { font-size: 17px; font-weight: 700; word-break: break-all; }
.usr-page-sub { margin-bottom: 14px; }
.usr-actions { display: flex; align-items: center; gap: 8px; margin-top: 12px; flex-wrap: wrap; }

/* The grant matrix: one compact row per device, one column per dashboard page, a tick per
   (device, dashboard) pair. Header ticks are bulk toggles over the TICKED devices. */
.gmx-wrap { overflow-x: auto; border: 1px solid var(--border); border-radius: var(--radius); background: var(--panel); }
.gmx { width: 100%; border-collapse: collapse; font-size: 13px; --gmx-grouph: 28px; }
.gmx th, .gmx td { border-bottom: 1px solid var(--border); }
.gmx thead th {
  position: sticky; z-index: 1;
  background: var(--bg);
  padding: 8px 10px;
  font-size: 11px; font-weight: 700; text-transform: uppercase; letter-spacing: .04em;
  color: var(--muted); text-align: center; white-space: nowrap;
}
/* Two sticky header rows: the group caption pins to the very top, the page-name row pins
   right under it (offset by the caption's height) — so both survive a vertical scroll. */
.gmx thead tr.gmx-grouprow th { top: 0; z-index: 2; }
.gmx thead tr.gmx-colrow th { top: var(--gmx-grouph); }
/* the caption naming the right-hand block as the dashboard's pages — the axis label that
   was missing, so the columns no longer read as an unlabelled grid of ticks */
.gmx-pages-group {
  height: var(--gmx-grouph);
  padding-top: 5px; padding-bottom: 5px;
  font-size: 10.5px; color: var(--brand);
  background: var(--brand-dim);
}
/* the DEVICE axis gets its own band + a firm divider, so "which device" reads as clearly
   separate from "which of its dashboard pages" */
.gmx-devcol { border-right: 2px solid var(--border2); }
.gmx thead th.gmx-devcol { text-align: left; vertical-align: bottom; }
.gmx-colhead { display: flex; flex-direction: column; align-items: center; gap: 4px; }
.gmx-colname { max-width: 130px; overflow: hidden; text-overflow: ellipsis; }
.gmx tbody tr:last-child th, .gmx tbody tr:last-child td { border-bottom: none; }
.gmx tbody tr:hover { background: var(--bg); }
.gmx td { padding: 5px 10px; text-align: center; }
.gmx td.gmx-devcol { text-align: left; background: var(--bg); }
.gmx-dev { display: flex; align-items: center; gap: 8px; }
.gmx-dev-id { font-weight: 600; font-size: 12.5px; word-break: break-all; }
.gmx-dev-f { font-size: 11px; color: var(--muted); white-space: nowrap; }
.gmx input { accent-color: var(--brand); cursor: pointer; margin: 0; }
.gmx input:disabled { cursor: default; }
/* an unticked device greys its dashboard cells — a dashboard grant without its device is
   not a state the model has (see setGrants in the Function) */
.gmx tr.off td.gmx-cell { opacity: .3; }
.gmx-none { padding: 14px; text-align: center; }

@media (max-width: 820px) {
  .user-email { display: none; }
  .gmx-colname { max-width: 80px; }
}