/* Shared page styles for the DFIR Guidebook */
/* IBM Plex Sans / Mono (Latin-1 subsets), SIL Open Font License 1.1 - see assets/fonts/PLEX-LICENSE.txt.
   Glyphs outside Latin-1 (arrows, key symbols) fall back to the system font. */
@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:400;font-display:swap;src:url("fonts/IBMPlexSans-Regular-Latin1.woff2") format("woff2")}
@font-face{font-family:"IBM Plex Sans";font-style:italic;font-weight:400;font-display:swap;src:url("fonts/IBMPlexSans-Italic-Latin1.woff2") format("woff2")}
@font-face{font-family:"IBM Plex Sans";font-style:normal;font-weight:600 700;font-display:swap;src:url("fonts/IBMPlexSans-SemiBold-Latin1.woff2") format("woff2")}
@font-face{font-family:"IBM Plex Mono";font-style:normal;font-weight:400;font-display:swap;src:url("fonts/IBMPlexMono-Regular-Latin1.woff2") format("woff2")}
@font-face{font-family:"IBM Plex Mono";font-style:normal;font-weight:600 700;font-display:swap;src:url("fonts/IBMPlexMono-SemiBold-Latin1.woff2") format("woff2")}
  :root{
    --bg:#0b0d10; --panel:#121519; --panel2:#171b21; --ink:#e6e8eb; --muted:#9aa3ad;
    --accent:#ff2a2a; --accent2:#35c7c4; --ok:#4ade80; --warn:#fbbf24; --bad:#ef4444;
    --code-bg:#0f1216; --border:#242a31; --link:#8ab4ff; --on-accent:#0b0d10;
  }
  *{box-sizing:border-box}
  b,strong,th,h1,h2,h3,h4,summary{font-weight:600}
  html,body{margin:0;padding:0;background:var(--bg);color:var(--ink);font:15px/1.55 "IBM Plex Sans",ui-sans-serif,system-ui,-apple-system,"SF Pro Text",Segoe UI,Roboto,Helvetica,Arial,sans-serif}
  a{color:var(--link);text-decoration:none}
  a:hover{text-decoration:underline}
  code,pre,.mono{font-family:"IBM Plex Mono",ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace;font-size:13px}
  code{background:var(--code-bg);border:1px solid var(--border);padding:1px 5px;border-radius:4px}
  pre{background:var(--code-bg);border:1px solid var(--border);padding:12px 14px;border-radius:8px;overflow:auto}
  .layout{display:grid;grid-template-columns:300px 1fr;min-height:100vh}
  nav.toc{position:sticky;top:0;align-self:start;height:100vh;overflow:auto;border-right:1px solid var(--border);background:var(--panel);padding:18px 14px}
  nav.toc h1{font-size:14px;letter-spacing:.08em;text-transform:uppercase;margin:4px 0 10px;color:var(--accent2)}
  nav.toc ul{list-style:none;padding:0;margin:0 0 14px}
  nav.toc li{margin:0}
  nav.toc a{display:block;padding:6px 8px;color:var(--ink);border-radius:6px;font-size:13.5px}
  nav.toc a:hover{background:var(--c-1b2027,#1b2027);text-decoration:none}
  nav.toc .group{color:var(--muted);font-size:11px;text-transform:uppercase;letter-spacing:.1em;margin:12px 6px 4px}
  nav.toc button.group{display:flex;align-items:center;justify-content:space-between;gap:8px;width:calc(100% - 12px);margin:12px 6px 4px;padding:4px 2px;background:none;border:0;border-radius:4px;font-family:inherit;cursor:pointer;text-align:left}
  nav.toc button.group:hover{color:var(--ink)}
  nav.toc button.group:focus-visible{outline:2px solid var(--accent2);outline-offset:2px}
  nav.toc button.group .chev{width:7px;height:7px;flex:none;margin-right:4px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(45deg) translate(-2px,-2px);transition:transform .15s ease}
  nav.toc button.group[aria-expanded="false"] .chev{transform:rotate(-45deg)}
  nav.toc ul.collapsed{display:none!important}
  @media (prefers-reduced-motion:reduce){nav.toc button.group .chev{transition:none}}
  main{padding:36px 48px 120px;max-width:1100px}
  h1.title{font-size:30px;margin:0 0 6px;color:var(--c-fff,#fff)}
  .lede{color:var(--muted);margin:0 0 24px;max-width:70ch}
  h2{font-size:22px;border-bottom:1px solid var(--border);padding-bottom:6px;margin-top:48px;scroll-margin-top:12px}
  h3{font-size:17px;margin-top:28px;color:var(--c-fff,#fff);scroll-margin-top:12px}
  h4{font-size:14.5px;margin:18px 0 6px;color:var(--accent2);letter-spacing:.02em}
  ul,ol{padding-left:22px}
  li{margin:3px 0}
  .card{background:var(--panel);border:1px solid var(--border);border-radius:10px;padding:16px 18px;margin:14px 0}
  .grid{display:grid;grid-template-columns:repeat(2,1fr);gap:14px}
  .pill{display:inline-block;padding:2px 8px;border-radius:999px;font-size:11.5px;border:1px solid var(--border);color:var(--muted);margin-right:4px}
  .pill.red{color:var(--on-accent,var(--c-fff,#fff));background:var(--c-4b1414,#4b1414);border-color:var(--c-7a1d1d,#7a1d1d)}
  .pill.amber{color:var(--c-111,#111);background:var(--c-f8c261,#f8c261);border-color:var(--c-f0a93b,#f0a93b)}
  .pill.green{color:var(--c-071,#071);background:var(--c-bbf7d0,#bbf7d0);border-color:var(--c-86efac,#86efac)}
  .pill.blue{color:var(--c-eaf3ff,#eaf3ff);background:var(--c-1b3763,#1b3763);border-color:var(--c-2c528f,#2c528f)}
  .pill.purple{color:var(--c-f6e9ff,#f6e9ff);background:var(--c-3a1f52,#3a1f52);border-color:var(--c-6a3bb0,#6a3bb0)}
  table{border-collapse:collapse;width:100%;margin:10px 0;font-size:13.5px}
  th,td{border:1px solid var(--border);padding:7px 9px;text-align:left;vertical-align:top}
  th{background:var(--panel2);color:var(--c-fff,#fff)}
  .trap{border-left:3px solid var(--bad);background:var(--c-1b1012,#1b1012);padding:10px 14px;margin:10px 0;border-radius:0 8px 8px 0}
  .trap b{color:var(--c-ff8080,#ff8080)}
  .tip{border-left:3px solid var(--ok);background:var(--c-0f1a12,#0f1a12);padding:10px 14px;margin:10px 0;border-radius:0 8px 8px 0}
  .quote{border-left:3px solid var(--accent2);background:var(--c-1a130d,#1a130d);padding:10px 14px;margin:10px 0;border-radius:0 8px 8px 0;color:var(--c-f0d4b8,#f0d4b8);font-style:italic}
  details{background:var(--panel);border:1px solid var(--border);border-radius:8px;padding:8px 14px;margin:8px 0}
  details>summary{cursor:pointer;font-weight:600}
  kbd{background:var(--c-1a1f26,#1a1f26);border:1px solid var(--border);padding:1px 6px;border-radius:4px;font-family:"IBM Plex Mono",ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px}
  abbr[data-title]{text-decoration:underline dotted var(--accent2);text-underline-offset:3px;cursor:help;text-decoration-skip-ink:none;position:relative}
  abbr[data-title]:hover,abbr[data-title]:focus{color:var(--c-ffd7bf,#b5efed);background:var(--c-a2551228912,rgba(53,199,196,.12));border-radius:3px;outline:none}
  #acr-tip{position:fixed;z-index:9999;pointer-events:none;opacity:0;transform:translate(-50%,-100%) translateY(-10px);transition:opacity .08s ease-out;background:linear-gradient(180deg,var(--c-1f242c,#1f242c),var(--c-15181d,#15181d));color:var(--c-fff,#fff);border:1px solid var(--accent2);box-shadow:0 10px 30px var(--c-a00055,rgba(0,0,0,.55)),0 0 0 1px var(--c-a2551228915,rgba(53,199,196,.15));border-radius:8px;padding:9px 12px;font-size:13px;line-height:1.4;max-width:360px;font-family:ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,sans-serif}
  #acr-tip.show{opacity:1}
  #acr-tip .acr-key{color:var(--accent2);font-weight:700;font-family:"IBM Plex Mono",ui-monospace,SFMono-Regular,Menlo,monospace;margin-right:6px}
  #acr-tip::after{content:"";position:absolute;left:50%;top:100%;transform:translateX(-50%);border:7px solid transparent;border-top-color:var(--accent2)}
  #acr-tip::before{content:"";position:absolute;left:50%;top:100%;transform:translateX(-50%) translateY(-1px);border:6px solid transparent;border-top-color:var(--c-15181d,#15181d)}
  #acr-tip.below{transform:translate(-50%,0) translateY(10px)}
  #acr-tip.below::after{top:auto;bottom:100%;border-top-color:transparent;border-bottom-color:var(--accent2)}
  #acr-tip.below::before{top:auto;bottom:100%;transform:translateX(-50%) translateY(1px);border-top-color:transparent;border-bottom-color:var(--c-15181d,#15181d)}
  .tools{color:var(--c-9fe7a4,#9fe7a4);font-size:12.5px}
  .tools b{color:var(--c-bff2c2,#bff2c2)}
  .ts{color:var(--c-fbd38d,#fbd38d);font-size:12.5px;display:block;margin-top:3px}
  .ts b{color:var(--c-fde68a,#fde68a)}
  .ts-inline{color:var(--c-fbd38d,#fbd38d);font-size:12.5px}
  .ts-inline b{color:var(--c-fde68a,#fde68a)}
  .ts-callout{border-left:3px solid var(--warn);background:var(--c-1a1608,#1a1608);padding:10px 14px;margin:10px 0;border-radius:0 8px 8px 0;font-size:13.5px}
  .ts-callout b{color:var(--c-fde68a,#fde68a)}
  .tools-row td{background:var(--c-0d1612,#0d1612)}
  .tool-callout{border-left:3px solid var(--c-4ade80,#4ade80);background:var(--c-0f1a12,#0f1a12);padding:10px 14px;margin:10px 0;border-radius:0 8px 8px 0;font-size:13.5px}
  .tool-callout b{color:var(--c-bff2c2,#bff2c2)}
  .two{display:grid;grid-template-columns:1fr 1fr;gap:16px}
  @media (max-width:1000px){.layout{grid-template-columns:1fr}.two,.grid{grid-template-columns:1fr}nav.toc{position:static;height:auto}}
  hr{border:0;border-top:1px solid var(--border);margin:28px 0}
  .actor{background:var(--panel2);border:1px solid var(--border);border-radius:10px;padding:12px 14px;margin:10px 0}
  .actor h4{margin:0 0 6px;color:var(--c-fff,#fff)}
  .actor .names{color:var(--muted);font-size:12.5px;margin-bottom:6px}
  .footer{color:var(--muted);font-size:12.5px;margin-top:60px;border-top:1px solid var(--border);padding-top:12px}
  .anchor-link{color:var(--muted);text-decoration:none;margin-left:6px;font-size:12px;opacity:0;transition:opacity .15s}
  h2:hover .anchor-link,h3:hover .anchor-link{opacity:1}
  .legend{display:flex;flex-wrap:wrap;gap:6px;margin:0 0 10px}

/* ---- multi-page navigation ---- */
nav.toc h1 a{color:inherit;text-decoration:none}
/* nullty.pe typewriter wordmark (IBM VGA 8x16 at 32px = 2x its pixel grid, so it stays crisp in every theme) */
nav.toc .brand-type{display:flex;align-items:center;justify-content:center;height:40px;margin:2px 0 6px;font:400 32px/40px "IBM VGA 8x16",ui-monospace,Menlo,monospace;color:var(--accent2);white-space:pre;-webkit-font-smoothing:none;font-synthesis:none}
/* fixed-width line (word + cursor), so the centered word doesn't shift while it types */
nav.toc .brand-line{display:flex;align-items:center;width:calc(var(--chars) * 1ch + 18px)}
nav.toc .brand-cursor{display:inline-block;width:16px;height:28px;margin-left:2px;background:currentColor;animation:brand-blink 1s steps(1) infinite}
nav.toc .brand-type.busy .brand-cursor,nav.toc .brand-type.still .brand-cursor{animation:none}
@keyframes brand-blink{50%{opacity:0}}
/* Divider under the wordmark, spaced to match the one above Contact */
nav.toc .nav-sep{border-top:1px solid var(--border);margin:27px 0 6px}
/* Contact block at the foot of the sidebar */
nav.toc .nav-contact{margin:22px 0 8px;padding-top:12px;border-top:1px solid var(--border)}
nav.toc .nav-contact .group{margin:0 6px 6px}
nav.toc .nav-contact .contact-icons{display:flex;align-items:center;gap:4px;padding:0 2px}
nav.toc .nav-contact a.contact-icon{display:inline-flex;align-items:center;justify-content:center;padding:6px;border-radius:6px;color:var(--muted)}
nav.toc .nav-contact a.contact-icon:hover{color:var(--link);background:var(--c-1b2027,#1b2027)}
/* optical correction: the round GitHub mark reads farther away than the square icons, so pull it 2px closer */
nav.toc .nav-contact a.contact-github{margin-left:-2px}
nav.toc .nav-contact a.contact-icon:focus-visible{outline:2px solid var(--accent2);outline-offset:2px}
@media (max-width:1000px){nav.toc .nav-contact{display:none}nav.toc.open .nav-contact{display:block}}
nav.toc a[aria-current="page"]{background:var(--c-1b2027,#1b2027);color:var(--accent2);font-weight:600}
nav.toc a.nav-sub{color:var(--muted)}
/* Sub-links and the pages inside a group: arrow plus a slight hanging indent. */
nav.toc a.nav-sub,nav.toc ul.grouped>li>a{display:flex;gap:.35em;padding-left:20px}
nav.toc a.nav-sub::before,nav.toc ul.grouped>li>a::before{content:"\21B3";flex:none;color:var(--muted)}
/* AI agent artifacts tables on the OS pages: give the path column room. */
table.agents tr:first-child th:nth-child(1){width:13%}
table.agents tr:first-child th:nth-child(2){width:37%}
table.agents tr:first-child th:nth-child(3){width:22%}
nav.toc a.nav-extra{color:var(--c-fbd38d,#fbd38d)}
.nav-toggle{display:none;margin:0 0 8px;padding:6px 12px;border:1px solid var(--border);border-radius:8px;background:var(--panel2);color:var(--ink);font:inherit;cursor:pointer}
@media (max-width:1000px){
  nav.toc .group, nav.toc ul{display:none}
  nav.toc button.group{display:none}
  nav.toc.open .group, nav.toc.open ul{display:block}
  nav.toc.open button.group{display:flex}
  .nav-toggle{display:inline-block}
}
.pager{display:flex;justify-content:space-between;gap:16px;margin:56px 0 0;padding-top:16px;border-top:1px solid var(--border)}
.pager a{display:flex;flex-direction:column;gap:2px;max-width:48%;padding:10px 14px;border:1px solid var(--border);border-radius:8px;background:var(--panel)}
.pager a:hover{text-decoration:none;background:var(--panel2)}
.pager a.next{margin-left:auto;text-align:right}
.pager .dir{font-size:12px;color:var(--muted)}
.pager .t{color:var(--ink);font-weight:600}
/* Host forensics artifact tables: artifact, proves, how it's generated, timestamps, tools. */
table.artifacts tr:first-child th:nth-child(1){width:18%}
table.artifacts tr:first-child th:nth-child(2){width:13%}
table.artifacts tr:first-child th:nth-child(3){width:29%}
table.artifacts tr:first-child th:nth-child(4){width:24%}
table.artifacts tr:first-child th:nth-child(5){width:16%}
/* Registry hive table: give the path column room. */
table.hives tr:first-child th:nth-child(1){width:14%}
table.hives tr:first-child th:nth-child(2){width:38%}
/* AWS adversary API-call reference: give the event column room. */
table.calls tr:first-child th:nth-child(1){width:44%}
/* Fast-travel section lists under a page in the sidebar. */
nav.toc ul.grouped>li>.nav-row>a{display:flex;gap:.35em;padding-left:20px}
nav.toc ul.grouped>li>.nav-row>a::before{content:"\21B3";flex:none;color:var(--muted)}
nav.toc .nav-row{display:flex;align-items:center;gap:2px}
nav.toc .nav-row>a{flex:1;min-width:0}
nav.toc ul.sub-list{margin:0 0 4px}
nav.toc a.nav-section{padding:4px 8px 4px 40px;font-size:12.5px;color:var(--muted)}
nav.toc a.nav-section:hover{color:var(--ink)}
nav.toc a.nav-section.active{color:var(--accent2);background:var(--c-1b2027,#1b2027);font-weight:600}
nav.toc button.sub-toggle{flex:none;display:flex;align-items:center;justify-content:center;width:26px;height:26px;margin-right:6px;padding:0;background:none;border:0;border-radius:4px;color:var(--muted);cursor:pointer}
nav.toc button.sub-toggle:hover{color:var(--ink);background:var(--c-1b2027,#1b2027)}
nav.toc button.sub-toggle:focus-visible{outline:2px solid var(--accent2);outline-offset:2px}
nav.toc button.sub-toggle .chev{width:7px;height:7px;border-right:1.5px solid currentColor;border-bottom:1.5px solid currentColor;transform:rotate(45deg) translate(-2px,-2px);transition:transform .15s ease}
nav.toc button.sub-toggle[aria-expanded="false"] .chev{transform:rotate(-45deg)}
@media (prefers-reduced-motion:reduce){nav.toc button.sub-toggle .chev{transition:none}}