/* certs.css -- the Certificates admin page's OWN visuals only.
 *
 * manage.css supplies the palette (all --tokens), the chrome (.shell-*), the
 * table (.rmm-table), buttons/badges/fields (.rmm-*), and the overlay
 * (.token-*). This file adds the two things that page has no vocabulary for:
 *   1. the standalone page's section layout (no machine sidebar here), and
 *   2. the cert-chain viewer (leaf -> CA, with linkage + flagging).
 * Everything else is reused verbatim, so this page can never drift from the
 * console's look.
 */

.certs-body { overflow: auto; }

/* The content pane on this page scrolls the whole document rather than a single
   .rmm-scroll -- there is no sidebar and no fixed-height panel to clamp to. */
.certs-content {
  display: block;
  overflow-y: auto;
}

/* A titled card. Same material and hairline as .rmm-scroll, but sized to its
   content and stacked down the page. */
.cert-card {
  background: var(--panel);
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 16px 18px;
  margin: 0 0 18px;
}
.cert-card-head {
  display: flex;
  align-items: baseline;
  justify-content: space-between;
  flex-wrap: wrap;
  gap: 8px 14px;
  margin-bottom: 12px;
}
.cert-card-head h2 {
  margin: 0;
  font-size: 15px;
  font-weight: 600;
  color: var(--text);
}
.cert-card-sub {
  font-size: 12px;
  color: var(--muted);
}
.cert-card-actions { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }

/* The issue-key form: a quiet inline strip above the keys table. */
.cert-issue-form {
  display: flex;
  align-items: flex-end;
  flex-wrap: wrap;
  gap: 10px 14px;
  padding: 12px 14px;
  margin-bottom: 14px;
  background: var(--raised);
  border: 1px solid var(--border);
  border-radius: 8px;
}
.cert-field-group { display: flex; flex-direction: column; gap: 4px; min-width: 0; }
.cert-field-group label {
  font-size: 11px;
  text-transform: uppercase;
  letter-spacing: 0.05em;
  color: var(--off);
}
.cert-field-group .rmm-field { min-width: 120px; }

/* Serial / pin cells: monospace, truncated, full value on hover (title attr). */
.cert-mono {
  font-family: var(--mono);
  font-size: 11px;
  color: var(--muted);
}
.cert-trunc {
  display: inline-block;
  max-width: 150px;
  overflow: hidden;
  text-overflow: ellipsis;
  white-space: nowrap;
  vertical-align: bottom;
  cursor: help;
}

/* A DESTRUCTIVE action button -- the device-cert kill switch. Distinct from the
   neutral .rmm-btn so a revoke never reads as an ordinary action. Built from
   --err like the endpoints delete-btn, but self-contained here. */
.cert-btn-danger {
  background: transparent;
  color: var(--err);
  border: 1px solid rgba(var(--err-rgb), 0.5);
  border-radius: 6px;
  padding: 4px 12px;
  font: 12px/1.25 var(--ui);
  font-weight: 600;
  cursor: pointer;
  white-space: nowrap;
}
.cert-btn-danger:hover:not(:disabled) {
  background: rgba(var(--err-rgb), 0.14);
  border-color: var(--err);
}
.cert-btn-danger:disabled { opacity: 0.4; cursor: not-allowed; }

/* Status pills reuse .rmm-badge; these are the extra tones the cert statuses
   need. "valid"/"active" = green, "expired"/"exhausted" = amber (already in
   .rmm-badge.warn), "revoked" = red (already .rmm-badge.error). */
.rmm-badge.ok { color: #7ee2a8; background: rgba(63, 185, 80, 0.18); }

/* A row that has been revoked/expired is dimmed, same idiom as .token-inactive. */
.cert-row-dead td { opacity: 0.5; }

/* A selectable device-cert row (clicking it opens the chain viewer). */
.rmm-table tbody tr.cert-selectable { cursor: pointer; }
.rmm-table tbody tr.cert-selected {
  background: rgba(var(--accent-rgb), 0.14) !important;
  box-shadow: inset 2px 0 0 var(--accent);
}

/* ---------------------------------------------------------- chain viewer ---
   Leaf (device cert) linked up to the CA root. Two node cards joined by a
   labelled connector that states the issuer->subject relationship. */
.cert-chain {
  display: flex;
  flex-direction: column;
  align-items: stretch;
  gap: 0;
  max-width: 560px;
}

.cert-chain-empty { color: var(--muted); font-size: 13px; padding: 8px 2px; }

.cert-node {
  border: 1px solid var(--border);
  border-radius: 8px;
  padding: 12px 14px;
  background: var(--raised);
}
.cert-node.leaf { border-left: 3px solid var(--accent); }
.cert-node.root { border-left: 3px solid var(--ok); }
.cert-node.leaf.dead { border-left-color: var(--err); }

.cert-node-head {
  display: flex;
  align-items: center;
  gap: 8px;
  margin-bottom: 8px;
}
.cert-node-role {
  font-size: 10px;
  text-transform: uppercase;
  letter-spacing: 0.07em;
  font-weight: 700;
  color: var(--off);
}
.cert-node-title {
  font-family: var(--mono);
  font-size: 13px;
  color: var(--text);
  overflow-wrap: anywhere;
}

/* Compact key/value grid inside a node. */
.cert-node-kv {
  display: grid;
  grid-template-columns: max-content minmax(0, 1fr);
  gap: 4px 14px;
  align-items: baseline;
  margin: 0;
}
.cert-node-kv dt {
  color: var(--muted);
  font-size: 11px;
  white-space: nowrap;
}
.cert-node-kv dd {
  margin: 0;
  font-family: var(--mono);
  font-size: 11px;
  color: var(--text);
  overflow-wrap: anywhere;
}

/* The connector between leaf and CA: a vertical stem with an "issued by" label,
   drawn so the eye reads leaf -> CA as a signed-by chain. */
.cert-link {
  display: flex;
  align-items: center;
  gap: 8px;
  padding: 6px 0 6px 18px;
  position: relative;
}
.cert-link::before {
  content: "";
  position: absolute;
  left: 20px;
  top: 0;
  bottom: 0;
  width: 2px;
  background: var(--border);
}
.cert-link-label {
  font-size: 11px;
  color: var(--muted);
  background: var(--panel);
  padding: 2px 8px;
  border: 1px solid var(--border);
  border-radius: 999px;
  z-index: 1;
}

/* A banner flagging a leaf that is expired or revoked -- the thing an operator
   most needs to see when they open the chain. */
.cert-flag {
  display: flex;
  align-items: center;
  gap: 8px;
  margin: 0 0 12px;
  padding: 8px 12px;
  font-size: 12px;
  font-weight: 600;
  color: var(--err-text);
  background: rgba(var(--err-rgb), 0.10);
  border: 1px solid rgba(var(--err-rgb), 0.35);
  border-radius: 8px;
  background-clip: padding-box;
}
.cert-flag.warn {
  color: #e3b341;
  background: rgba(210, 153, 34, 0.12);
  border-color: rgba(210, 153, 34, 0.4);
}

/* One-time plaintext key: a prominent copyable field + a loud never-again note.
   Rendered into a .token-panel overlay from manage.css. */
.cert-onetime-warn {
  font-weight: 700;
  color: var(--warn);
  margin: 0 0 10px;
  font-size: 13px;
}
.cert-onetime-row { display: flex; gap: 8px; align-items: stretch; margin-bottom: 10px; }
.cert-onetime-key {
  flex: 1 1 auto;
  font-family: var(--mono);
  font-size: 13px;
  background: var(--sunken, #0b0e13);
  color: var(--text);
  border: 1px solid var(--accent);
  border-radius: 6px;
  padding: 10px 12px;
  cursor: text;
  overflow-wrap: anywhere;
}
.cert-onetime-meta { font-size: 12px; color: var(--muted); }
.cert-onetime-meta dl { display: grid; grid-template-columns: max-content 1fr; gap: 4px 12px; margin: 8px 0 0; }
.cert-onetime-meta dt { color: var(--off); }
.cert-onetime-meta dd { margin: 0; font-family: var(--mono); }

.cert-copy-flash { color: var(--ok); font-size: 12px; margin-left: 4px; }