/* guide.uig.me. Terminal theme shared by uig.me, lab, honeypot, detections and guide: keep the tokens and the
   "shared chrome" block identical across the five sites. */


:root {
  --bg: #0a0f0b;
  --surface: #0f1712;
  --text: #cdeed6;
  --muted: #86a891;
  --dim: #6f8f79;
  --border: #20392a;
  --border-strong: #2f5a41;
  --accent: #39ff88;
  --accent-2: #4fd6ff;
  --warn: #ffb347;
  --danger: #ff5c7a;
  --ok: #39ff88;
  --chip: #12211a;
  --code-bg: #0c1a12;
  --glow: 0 0 6px rgba(57, 255, 136, 0.45);
  --radius: 2px;
  --font: ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace;
  --mono: var(--font);
  /* long-form prose (articles, READMEs) reads faster in a proportional face */
  --prose: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
  --high: #ff5c7a; --medium: #ffb347; --low: #4fd6ff;
  color-scheme: dark;
}

/* ---------------------------------------------------------------- shared chrome */

* { box-sizing: border-box; }

html { -webkit-text-size-adjust: 100%; background: var(--bg); }

body {
  margin: 0;
  min-height: 100vh;
  background:
    radial-gradient(ellipse at 50% -10%, rgba(57, 255, 136, 0.07), transparent 60%),
    var(--bg);
  color: var(--text);
  font: 15px/1.7 var(--font);
}

/* CRT scanlines: static, decorative, never intercepts clicks */
body::before {
  content: ""; position: fixed; inset: 0; z-index: 100; pointer-events: none;
  background: repeating-linear-gradient(to bottom, rgba(0, 0, 0, 0) 0, rgba(0, 0, 0, 0) 2px,
    rgba(0, 0, 0, 0.18) 3px, rgba(0, 0, 0, 0) 4px);
}

::selection { background: var(--accent); color: var(--bg); }

a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; text-underline-offset: 3px; text-shadow: var(--glow); }
:focus-visible { outline: 1px dashed var(--accent); outline-offset: 3px; }

.wrap { max-width: 860px; margin: 0 auto; padding: 0 16px; }

/* the sticky header must not cover in-page anchor targets */
[id] { scroll-margin-top: 72px; }

.site-header {
  border-bottom: 1px solid var(--border); background: rgba(10, 15, 11, 0.85);
  position: sticky; top: 0; z-index: 10; backdrop-filter: blur(6px);
}
.site-header .wrap { display: flex; align-items: center; justify-content: space-between; height: 56px; gap: 16px; }
.brand { font-weight: 700; color: var(--text); white-space: nowrap; }
.brand::before { content: "~$ "; content: "~$ " / ""; color: var(--accent); text-shadow: var(--glow); }
.brand::after {
  content: ""; display: inline-block; width: 0.55em; height: 1.05em; margin-left: 4px;
  vertical-align: -0.15em; background: var(--accent); box-shadow: var(--glow);
  animation: blink 1.1s steps(1) infinite;
}
.brand:hover { text-decoration: none; }
.site-header nav { display: flex; flex-wrap: wrap; gap: 6px 18px; }
.site-header nav a { color: var(--muted); }
.site-header nav a::before { content: "["; content: "[" / ""; color: var(--dim); margin-right: 2px; }
.site-header nav a::after { content: "]"; content: "]" / ""; color: var(--dim); margin-left: 2px; }
.site-header nav a:hover { color: var(--accent); text-decoration: none; }
.site-header nav a[aria-current="page"] { color: var(--accent); text-shadow: var(--glow); }
.site-header nav a[aria-current="page"]::before,
.site-header nav a[aria-current="page"]::after { color: var(--accent); }

.site-footer { border-top: 1px dashed var(--border); margin-top: 64px; padding: 24px 0; color: var(--dim); font-size: 13px; }
.site-footer .wrap::before { content: "// "; content: "// " / ""; color: var(--dim); }
.site-footer .credit { margin: 8px 0 0; }
.site-footer a { color: var(--muted); }
.site-footer a:hover { color: var(--accent); }

h1 { font-size: 1.75rem; line-height: 1.3; margin: 0 0 12px; letter-spacing: -0.01em; }
h1::before { content: "> "; content: "> " / ""; color: var(--accent); text-shadow: var(--glow); }
h2 { font-size: 1.15rem; margin: 40px 0 12px; }
h2::before { content: "## "; content: "## " / ""; color: var(--dim); font-weight: 400; }
h3 { font-size: 1rem; margin: 0 0 6px; }

@keyframes blink { 50% { opacity: 0; } }

@media (prefers-reduced-motion: reduce) {
  *, *::before, *::after { animation: none !important; transition: none !important; }
}

@media print {
  /* browsers drop backgrounds when printing: switch to dark ink on white paper */
  :root {
    --bg: #fff; --surface: #fff; --text: #111; --muted: #444; --dim: #555; --border: #bbb; --border-strong: #888;
    --accent: #0a6b34; --accent-2: #0b5c8a; --ok: #0a6b34; --chip: #f2f2f2; --code-bg: #f5f5f5; --glow: none;
    color-scheme: light;
  }
  body { background: #fff; }
  body::before, .brand::after { display: none; }
  * { text-shadow: none !important; box-shadow: none !important; }
  .site-header { position: static; background: #fff; backdrop-filter: none; }
}


/* ---------------------------------------------------------------- guide.uig.me */

.wrap { max-width: 960px; }
code { font-family: var(--mono); font-size: 0.92em; background: var(--code-bg); color: var(--accent-2); padding: 1px 5px; border-radius: var(--radius); }
main.wrap { padding-top: 32px; }
main.wrap.notfound { padding-top: 64px; }
.lead { color: var(--muted); max-width: 720px; margin: 0; }
.subnav { margin: 0 0 16px; font-size: 14px; }
.meta { color: var(--dim); font-size: 13px; margin: 8px 0 0; }
.muted { color: var(--muted); }

/* evidence summary: every number links to where it comes from */
.evidence { list-style: none; padding: 0; margin: 24px 0 8px; display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 12px; }
.evidence li { background: var(--surface); border: 1px solid var(--border); border-left: 2px solid var(--accent); border-radius: var(--radius);
  padding: 12px 16px; min-width: 0; display: flex; flex-direction: column; }
.evidence .num { font-size: 1.5rem; font-weight: 700; font-variant-numeric: tabular-nums; color: var(--accent); text-shadow: var(--glow); }
.evidence .label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: 0.05em; }
.evidence .src { color: var(--dim); font-size: 12.5px; margin-top: 6px; }

.items { list-style: none; padding: 0; margin: 0; display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px; }
.item { background: var(--surface); border: 1px solid var(--border); border-radius: var(--radius); padding: 14px 16px; min-width: 0; transition: border-color 0.15s, box-shadow 0.15s; }
.item:hover { border-color: var(--accent); box-shadow: 0 0 0 1px rgba(57, 255, 136, 0.15), 0 0 18px rgba(57, 255, 136, 0.12); }
.item-head { display: flex; justify-content: space-between; gap: 12px; align-items: baseline; font-weight: 600; }
.item-head a { color: var(--text); }
.item:hover .item-head a { color: var(--accent); }
.item p { color: var(--muted); font-size: 13px; margin: 6px 0 8px; }

.chip { font-family: var(--mono); font-size: 12.5px; background: var(--chip); border: 1px solid var(--border);
  border-radius: var(--radius); padding: 0 6px; color: var(--accent-2); white-space: nowrap; }
.tool { font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.04em; white-space: nowrap; color: var(--accent-2); }
.tool::before { content: "["; content: "[" / ""; } .tool::after { content: "]"; content: "]" / ""; }

/* one block per SIEM, stacked: long queries need the full width */
.siem { margin: 20px 0 0; }
.siem-head { display: flex; flex-wrap: wrap; justify-content: space-between; gap: 6px 12px; align-items: baseline; margin: 0 0 6px; }
.siem-head h3 { margin: 0; }
.badge { font-size: 12.5px; color: var(--accent); white-space: nowrap; }
.badge.agree::before { content: "✓ "; content: "✓ " / ""; }
.badge.differ { color: var(--warn); }
.badge.differ::before { content: "≠ "; content: "≠ " / ""; }
.label-sm { color: var(--dim); font-size: 12px; text-transform: uppercase; letter-spacing: 0.05em; margin: 10px 0 4px; }

pre.code { background: var(--code-bg); border: 1px solid var(--border); border-radius: var(--radius); position: relative;
  padding: 34px 14px 12px; overflow-x: auto; font-size: 13px; line-height: 1.5; margin: 0; }
pre.code::before { content: "● ● ●"; content: "● ● ●" / ""; position: absolute; top: 6px; left: 12px; font-size: 10px; letter-spacing: 2px; color: var(--border-strong); }
pre.code code, .prose pre code { background: none; padding: 0; font-size: inherit; color: var(--text); }

.prose { max-width: 760px; }
/* long-form prose in a proportional face; headings, data, tables and code stay mono */
.prose p, .prose li, .prose blockquote { font-family: var(--prose); font-size: 16px; line-height: 1.7; }
.prose h2 { font-size: 1.05rem; margin: 32px 0 8px; }
.prose h3 { margin: 20px 0 6px; }
.prose img { max-width: 100%; height: auto; border: 1px solid var(--border); }
.prose pre { background: var(--code-bg); border: 1px solid var(--border); border-radius: var(--radius); padding: 12px 14px; overflow-x: auto; font-size: 13px; line-height: 1.5; }
.prose table { border-collapse: collapse; font-size: 14px; display: block; overflow-x: auto; }
.prose th, .prose td { text-align: left; padding: 6px 12px 6px 0; border-top: 1px solid var(--border); vertical-align: top; }
.prose blockquote { margin: 0; padding: 0 0 0 14px; border-left: 2px solid var(--border-strong); color: var(--muted); }

video { width: 100%; height: auto; background: #000; border: 1px solid var(--border); border-radius: var(--radius); }
.chapters { list-style: none; padding: 0; font-size: 14px; }
.chapters .t { color: var(--accent); font-variant-numeric: tabular-nums; margin-right: 10px; }

/* hands-on calendar: one cell per day, darker = fewer searches */
.calendar { display: grid; grid-auto-flow: column; grid-template-rows: repeat(7, 11px); gap: 3px; overflow-x: auto; padding: 4px 0; }
.calendar span { width: 11px; height: 11px; border-radius: 1px; background: var(--chip); border: 1px solid var(--border); }
.calendar .l1 { background: #14532f; } .calendar .l2 { background: #1d9e55; } .calendar .l3 { background: #39ff88; }
.calendar .l4 { background: #9af5bb; }

@media (max-width: 760px) {
  .evidence { grid-template-columns: repeat(2, minmax(0, 1fr)); }
  .items { grid-template-columns: minmax(0, 1fr); }
}
@media (max-width: 640px) {
  .site-header { position: static; }
  .site-header nav { gap: 4px 14px; }
  .site-header .wrap { flex-wrap: wrap; height: auto; padding-top: 10px; padding-bottom: 10px; row-gap: 2px; }
  h1 { font-size: 1.6rem; }
  .evidence { grid-template-columns: minmax(0, 1fr); }
}