/*
 * Intrusion Groups (ticket 128) - the More menu's group list and group detail
 * (js/views/intrusion_groups.js). The tables, header stats, and back link reuse the Operations
 * rules (console.css's table.data / .section / .warroom-kpi / .command-hero-kpis, operations.css's
 * .operation-header / .operation-back / .operation-header__title), the base pill shapes come from
 * investigations.css's .chip and .prov, and the form fields from console.css's .login-label and
 * .login-input. This file only adds the kind and provenance colors, the header rows, and the
 * create/manage form layout.
 */

.ig-chip--analyst {
  color: var(--gold);
  border-color: var(--border-gold);
  background: var(--gold-soft);
}

.ig-chip--crawler {
  color: var(--st-3xx);
  border-color: var(--st-3xx);
}

.ig-prov--self-reported {
  color: var(--st-4xx);
  border-color: var(--st-4xx);
}

.ig-prov--analyst {
  color: var(--gold);
  border-color: var(--border-gold);
}

/* A member the LLM relay placed from an unrecognized User-Agent (ticket 133), apart from one that
   named its crawler itself (ticket 149). The blue info hue is the one the member row does not
   already spend (amber self-reported, gold analyst, green and red verdicts, neutral unverified),
   and the dashed border reads as inferred rather than stated. */
.ig-prov--llm-inferred {
  color: var(--st-3xx);
  border-color: var(--st-3xx);
  border-style: dashed;
}

.ig-verify {
  color: var(--ink-dim);
  border-color: var(--border-strong);
}

/* Member verification verdicts (ticket 131), from console.css's --st-* verdict palette: green when
   the source IP is inside the claimed org's published ranges, red when a public IP is outside
   them. "unknown" keeps the neutral base badge above. */
.ig-verify--verified {
  color: var(--st-2xx);
  border-color: var(--st-2xx);
}

.ig-verify--mismatch {
  color: var(--st-5xx);
  border-color: var(--st-5xx);
}

.ig-chips {
  display: inline-flex;
  flex-wrap: wrap;
  gap: 0.3rem;
}

.ig-row__name,
.ig-member__id {
  font-family: var(--font-mono);
}

.ig-header__row {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.75rem;
}

.ig-header__title {
  overflow-wrap: anywhere;
}

.ig-header__description {
  margin: 0;
  max-width: 68ch;
  white-space: pre-wrap;
  overflow-wrap: anywhere;
}

.ig-header__products {
  display: flex;
  flex-wrap: wrap;
  gap: 0.5rem;
  margin: 0;
  font-size: var(--fs-sm);
  overflow-wrap: anywhere;
}

.ig-header__label {
  font: var(--type-footnote);
  color: var(--ink-muted);
}

.ig-facts {
  max-width: 44rem;
}

.ig-facts .kv-val {
  overflow-wrap: anywhere;
}

.ig-truncated {
  color: var(--st-4xx);
}

.ig-create {
  margin: 0 0 1.2rem;
}

.ig-create__summary {
  display: inline-flex;
  list-style: none;
  cursor: pointer;
}

.ig-create__summary::-webkit-details-marker {
  display: none;
}

.ig-form {
  display: flex;
  flex-wrap: wrap;
  align-items: flex-end;
  gap: 0.75rem;
  margin-top: 0.6rem;
}

.ig-form__field {
  min-width: 14rem;
}

.ig-form__description {
  min-width: 18rem;
  resize: vertical;
}

.ig-form__status {
  flex-basis: 100%;
  margin: 0.4rem 0 0;
}

.ig-form__status:empty {
  display: none;
}

.ig-actions {
  display: flex;
  gap: 0.5rem;
  margin-top: 0.75rem;
}

.ig-delete {
  color: var(--st-5xx);
}

.ig-operations {
  margin: 0;
  padding-left: 1.2rem;
  font-family: var(--font-mono);
  font-size: var(--fs-sm);
}

.ig-operations a,
.ig-member__id a {
  color: var(--gold-2);
}

/*
 * Group chips and pin controls (ticket 129, js/group_chips.js): the membership row on the session
 * and operation pages and the compact chips in the work queue and Operations list rows. Names can
 * run to 128 characters and .chip does not wrap, so each name is cut with an ellipsis.
 */
.ig-membership {
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.5rem 0.75rem;
  margin: 0 0 1rem;
}

.ig-membership .ig-pin {
  margin: 0;
}

.ig-membership .ig-pin[open] {
  flex-basis: 100%;
}

.ig-membership__none {
  margin: 0;
}

/*
 * The same-tool sources list under the membership row (ticket 424, js/group_chips.js): one linked
 * source IP per line with its request count and path similarity, and the "Add all to group" form.
 */
.ig-siblings {
  margin: 0 0 1rem;
}

.ig-siblings__list {
  display: flex;
  flex-wrap: wrap;
  gap: 0.25rem 1.25rem;
  margin: 0.35rem 0 0.5rem;
  padding: 0;
  list-style: none;
  font-size: var(--fs-sm);
}

.ig-siblings__item {
  display: flex;
  flex-wrap: wrap;
  gap: 0 0.5rem;
  overflow-wrap: anywhere;
}

.ig-siblings__item .body-note,
.ig-siblings__capped {
  margin: 0;
}

.ig-siblings .ig-pin {
  margin: 0.25rem 0 0;
}

.ig-ref {
  gap: 0.35rem;
  max-width: 100%;
}

.ig-ref__name {
  display: inline-block;
  max-width: 18rem;
  overflow: hidden;
  text-overflow: ellipsis;
  color: inherit;
  text-decoration: none;
}

.ig-ref__name:hover,
.ig-ref--compact:hover {
  text-decoration: underline;
}

.ig-ref__category {
  font-weight: 400;
  color: var(--ink-dim);
}

.ig-ref__remove {
  padding: 0 0.1rem;
  border: 0;
  background: none;
  color: inherit;
  font: inherit;
  line-height: 1;
  cursor: pointer;
}

.ig-ref__remove:hover,
.ig-ref__remove:focus-visible {
  color: var(--st-5xx);
}

.ig-ref--compact {
  display: inline-block;
  max-width: 10rem;
  overflow: hidden;
  text-overflow: ellipsis;
  text-decoration: none;
}

/* The compact chip's verdict glyph (ticket 989, js/group_chips.js): a check for a verified crawler claim,
   a warning sign for a mismatch, in the chip's own text color so the chip stays neutral. */
.ig-ref__glyph {
  width: 0.9em;
  height: 0.9em;
  margin-left: 0.25em;
  vertical-align: -0.1em;
}

.ig-ref-more {
  color: var(--ink-dim);
}

.ig-pin__note {
  flex-basis: 100%;
  margin: 0;
}

/*
 * Bulk pin (ticket 144, js/group_chips.js's bulkPinBar() and js/views/investigations.js): the work
 * queue's checkbox column for analysts and admins, and the bar under the table that pins every
 * ticked row into one group. The bar sticks to the bottom of the viewport while a long queue
 * scrolls, so it stays in reach of rows ticked far down the page.
 */
.investigations-row__select {
  width: 2.25rem;
  text-align: center;
  cursor: default;
}

.investigations-row__select input {
  cursor: pointer;
}

.investigations-row:has(.investigations-row__select input:checked) {
  background: var(--gold-soft);
}

.ig-bulk {
  position: sticky;
  bottom: 0;
  z-index: 2;
  display: flex;
  flex-wrap: wrap;
  align-items: center;
  gap: 0.5rem 1rem;
  margin-top: 0.75rem;
  padding: 0.75rem 1rem;
  border: 1px solid var(--border-gold);
  border-radius: var(--radius);
  background: var(--panel);
}

.ig-bulk__count {
  font-family: var(--font-mono);
  font-size: var(--fs-sm);
  color: var(--gold);
}

.ig-bulk .ig-form {
  margin-top: 0;
}

@media (max-width: 640px) {
  .ig-form__field,
  .ig-form__description {
    min-width: 0;
    width: 100%;
  }

  .ig-ref__name {
    max-width: 12rem;
  }
}