/* Live Threat Feed - page-specific tweaks on top of cyber-terminal.css chrome.
   The base layout, panels, and topbar come from /lab/cyber-terminal/cyber-terminal.css,
   which resolves everything through the site theme tokens. This file only adds:
     - stats grid INSIDE the Indicators panel
     - table styling for the data tables
     - feed-line layout for the live Cowrie tail
     - topbar pill variants for the "generated" timestamp + reload link
     - leaflet attribution override against satellite tiles
     - error banner injected by threat-feed.js on fetch failure */

/* ── Topbar additions: meta pill + reload pill ── */
.tf-meta-pill {
  color: var(--text-2);
  border-color: var(--line-strong);
  font-family: var(--ct-mono);
  text-transform: none;
  letter-spacing: 0.04em;
}
.tf-reload-pill {
  color: var(--mint-deep);
  border-color: var(--mint-deep);
  text-decoration: none;
  cursor: pointer;
  transition: background 0.15s ease, color 0.15s ease;
}
.tf-reload-pill:hover {
  background: var(--mint-deep);
  color: var(--bg-0);
}

/* ── Indicators stat grid (inside the first left-column panel) ── */
.tf-panel-stats { flex: 0 0 auto; }
.tf-stats {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 1px;
  background: var(--line);
  flex: 1;
}
.tf-stat {
  background: var(--surface);
  padding: 0.55rem 0.8rem;
  display: flex; flex-direction: column; justify-content: center;
}
.tf-stat .lbl {
  font-size: 0.6rem; letter-spacing: 0.1em;
  text-transform: uppercase; color: var(--text-2);
}
.tf-stat .val {
  font-size: 1.35rem; font-weight: 600;
  font-family: var(--font-display);
  color: var(--text-0); line-height: 1.05;
  margin-top: 0.2rem;
}
.tf-stat .val.red    { color: var(--coral); }
.tf-stat .val.yellow { color: var(--amber); }
.tf-stat .val.blue   { color: var(--mint-deep); }
.tf-stat .sub {
  font-size: 0.62rem;
  color: var(--text-2);
  margin-top: 0.1rem;
  letter-spacing: 0.04em;
}

/* ── Data tables ── */
.tf-scroll {
  flex: 1; min-height: 0;
  overflow-y: auto;
}
.tf-table {
  width: 100%; border-collapse: collapse;
  font-size: 0.78rem; color: var(--text-1);
}
.tf-table th {
  position: sticky; top: 0; z-index: 1;
  background: var(--surface);
  text-align: left; font-weight: 500;
  font-size: 0.6rem; text-transform: uppercase; letter-spacing: 0.1em;
  color: var(--text-2);
  padding: 0.4rem 0.8rem;
  border-bottom: 1px solid var(--line);
  font-family: var(--ct-mono);
}
.tf-table td {
  padding: 0.32rem 0.8rem;
  border-bottom: 1px solid var(--line);
  font-family: var(--ct-mono);
  font-size: 0.76rem;
}
.tf-table td.r { text-align: right; color: var(--mint-deep); }
.tf-table tr:hover { background: color-mix(in srgb, var(--mint-deep) 5%, transparent); }
.tf-creds td:first-child {
  max-width: 18rem;
  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
}
.tf-commands td:first-child {
  max-width: 26rem;
  white-space: nowrap; overflow: hidden; text-overflow: ellipsis;
}

/* ── Live Cowrie tail ── */
.tf-panel-recent { flex: 0 0 38%; }
.tf-feed {
  flex: 1; min-height: 0;
  font-family: var(--ct-mono);
  font-size: 0.74rem;
  overflow-y: auto;
  color: var(--text-1);
}
.tf-feed .line {
  display: flex; gap: 0.6rem;
  padding: 0.3rem 0.8rem;
  border-bottom: 1px solid var(--line);
  align-items: baseline;
}
.tf-feed .line:hover { background: color-mix(in srgb, var(--mint-deep) 5%, transparent); }
.tf-feed .ts       { color: var(--text-3); min-width: 4.8em; font-size: 0.7rem; }
.tf-feed .ev       { min-width: 9em; color: var(--text-1); }
.tf-feed .ev.login-success { color: var(--coral); }
.tf-feed .ev.command       { color: var(--amber); }
.tf-feed .ev.file          { color: var(--mint); }
.tf-feed .ip       { color: var(--mint-deep); min-width: 8.5em; }
.tf-feed .country  { color: var(--text-2); min-width: 6em; }
.tf-feed .data {
  color: var(--text-1); flex: 1;
  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
}

/* ── Hourly chart shared with Cyber Ops so the feed page carries trend context too ── */
.tf-panel-chart { flex: 0 0 22%; min-height: 150px; }
.tf-chart {
  flex: 1; min-height: 0;
  padding: 0.45rem 0.6rem 0.3rem;
  position: relative;
  overflow: hidden;
}
.tf-chart svg {
  width: 100%; height: 100%;
  display: block;
}
.tf-chart-axis {
  position: absolute;
  left: 0.6rem; right: 0.6rem; bottom: 0.05rem;
  display: flex; justify-content: space-between;
  font-size: 0.62rem; letter-spacing: 0.06em;
  color: var(--text-3);
  pointer-events: none;
}

/* ── Left column panel sizing (stats compact, others fill) ── */
.ct-col-left > .ct-panel { flex: 1 1 0; min-height: 0; }
.ct-col-left > .tf-panel-stats { flex: 0 0 auto; }

/* ── Middle column: big map on top, recent activity, then hourly trend ── */
.ct-col-mid > .tf-panel-map { flex: 1 1 52%; min-height: 0; }
.ct-col-mid > .tf-panel-recent { flex: 1 1 26%; min-height: 0; }
.ct-col-mid > .tf-panel-chart { flex: 1 1 22%; min-height: 150px; }

/* ── Right column: four equal panels ── */
.ct-col-right > .ct-panel { flex: 1 1 0; min-height: 0; }

/* ── Error banner (injected at top of .tf-page on fetch failure) ── */
.tf-err {
  grid-column: 1 / -1;
  background: color-mix(in srgb, var(--coral) 8%, transparent);
  border: 1px solid var(--coral);
  border-radius: var(--radius);
  color: var(--coral);
  padding: 0.6rem 0.9rem;
  margin: 0 0 0.4rem;
  font-family: var(--ct-mono);
  font-size: 0.78rem;
}
.tf-err code { color: var(--amber); }

/* ── Leaflet attribution against satellite imagery ── */
.tf-panel-map .leaflet-container .leaflet-control-attribution {
  background: color-mix(in srgb, var(--bg-deep) 75%, transparent);
  color: var(--text-2);
  font-size: 9px;
}
.tf-panel-map .leaflet-container .leaflet-control-attribution a {
  color: var(--mint-deep);
}

/* ── Scrollbar styling for the data scrollers ── */
.tf-scroll::-webkit-scrollbar,
.tf-feed::-webkit-scrollbar { width: 6px; }
.tf-scroll::-webkit-scrollbar-track,
.tf-feed::-webkit-scrollbar-track { background: transparent; }
.tf-scroll::-webkit-scrollbar-thumb,
.tf-feed::-webkit-scrollbar-thumb { background: var(--line-strong); border-radius: 3px; }
.tf-scroll::-webkit-scrollbar-thumb:hover,
.tf-feed::-webkit-scrollbar-thumb:hover { background: var(--mint-deep); }

/* ── Responsive collapse: match cyber-terminal breakpoints ── */
@media (max-width: 1280px) {
  .ct-col-right { display: none; }
}
@media (max-width: 760px) {
  .ct-col-mid { display: none; }
  .tf-stats { grid-template-columns: 1fr; }
}