/* ==========================================================================
   Malware Analysis Series — site styles
   Hand-rolled, no Jekyll theme. Light by default, dark via the OS preference
   or an explicit [data-theme] set by the header toggle.
   ========================================================================== */

/* ---------- Fonts ---------- */
/* JetBrains Mono, self-hosted variable subset (400-700 on one axis). Same
   files as the portfolio and the Detection & Response site. */
@font-face {
  font-family: "JetBrains Mono";
  font-style: normal;
  font-weight: 400 700;
  font-display: swap;
  src: url("../fonts/jetbrains-mono-latin.woff2") format("woff2");
  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC,
                 U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193,
                 U+2212, U+2215, U+FEFF, U+FFFD;
}
@font-face {
  font-family: "JetBrains Mono";
  font-style: normal;
  font-weight: 400 700;
  font-display: swap;
  src: url("../fonts/jetbrains-mono-latin-ext.woff2") format("woff2");
  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304,
                 U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB,
                 U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
}

:root {
  --bg:        #f7f9fb;
  --bg-panel:  #ffffff;
  --bg-code:   #eef2f7;
  --bg-subtle: #f1f5f9;
  --text:      #33404f;
  --text-dim:  #64748b;
  --heading:   #0f1b2d;
  --border:    #dde5ee;
  --stripe:    #f6f8fb;
  --accent:    #1d6fd4;
  --accent-ink:#ffffff;
  --link:      #1257ad;
  --code-ink:  #b3266b;
  --gold:      #b8860b;
  --gold-ink:  #ffffff;
  --shadow:    0 1px 2px rgba(15, 27, 45, .06), 0 6px 18px rgba(15, 27, 45, .06);
  --maxw:      820px;
  --radius:    12px;
  --mono: "JetBrains Mono", "SFMono-Regular", Consolas, "Liberation Mono", Menlo, monospace;
  --sans: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;

  /* Inline figure palette. Ink and rules follow the theme tokens above, so
     they track the header toggle as well as the OS. Only the fills that are
     not derivable from a token are listed again in the dark blocks. */
  --fig-ink:   var(--heading);
  --fig-ink3:  var(--text-dim);
  --fig-line:  var(--border);
  --fig-b1:    #86B6EF;
  --fig-b2:    #2A78D6;
  --fig-b3:    #104281;
  --fig-acc:   #4A3AA7;
  --fig-box:   #F1F1EE;
  --fig-plain: #E7E7E2;
  --fig-enc:   #2A78D6;
  --fig-mark:  #FAE7E7;
  --fig-key:   #ECEAF7;
  --fig-tail:  #E8F6E8;
  --sev-high:  #c0392b;
  --sev-mid:   #a16207;
  --sev-low:   #2563eb;
}

@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) {
    --bg:        #0e131a;
    --bg-panel:  #151c26;
    --bg-code:   #111823;
    --bg-subtle: #131b25;
    --text:      #c2ccd8;
    --text-dim:  #8b98a8;
    --heading:   #eef3f9;
    --border:    #263140;
    --stripe:    #131a24;
    --accent:    #4d9eff;
    --accent-ink:#04121f;
    --link:      #7cb8ff;
    --code-ink:  #f0a8c8;
    --gold:      #e8b73f;
    --gold-ink:  #1a1405;
    --shadow:    0 1px 2px rgba(0, 0, 0, .4), 0 8px 24px rgba(0, 0, 0, .35);
    --fig-b2:    #3987E5;
    --fig-b3:    #184F95;
    --fig-acc:   #9085E9;
    --fig-box:   #222220;
    --fig-plain: #2C2C2A;
    --fig-enc:   #3987E5;
    --fig-mark:  #2A1412;
    --fig-key:   #1C1930;
    --fig-tail:  #12240F;
    --sev-high:  #ff8f80;
    --sev-mid:   #e8b73f;
    --sev-low:   #7cb8ff;
  }
}

:root[data-theme="dark"] {
  --bg:        #0e131a;
  --bg-panel:  #151c26;
  --bg-code:   #111823;
  --bg-subtle: #131b25;
  --text:      #c2ccd8;
  --text-dim:  #8b98a8;
  --heading:   #eef3f9;
  --border:    #263140;
  --stripe:    #131a24;
  --accent:    #4d9eff;
  --accent-ink:#04121f;
  --link:      #7cb8ff;
  --code-ink:  #f0a8c8;
  --gold:      #e8b73f;
  --gold-ink:  #1a1405;
  --shadow:    0 1px 2px rgba(0, 0, 0, .4), 0 8px 24px rgba(0, 0, 0, .35);
  --fig-b2:    #3987E5;
  --fig-b3:    #184F95;
  --fig-acc:   #9085E9;
  --fig-box:   #222220;
  --fig-plain: #2C2C2A;
  --fig-enc:   #3987E5;
  --fig-mark:  #2A1412;
  --fig-key:   #1C1930;
  --fig-tail:  #12240F;
  --sev-high:  #ff8f80;
  --sev-mid:   #e8b73f;
  --sev-low:   #7cb8ff;
}

/* ---------- base ---------- */
*, *::before, *::after { box-sizing: border-box; }

html { -webkit-text-size-adjust: 100%; }

body {
  margin: 0;
  background: var(--bg);
  color: var(--text);
  font-family: var(--sans);
  font-size: 17px;
  line-height: 1.7;
  -webkit-font-smoothing: antialiased;
}

.wrap { max-width: var(--maxw); margin: 0 auto; padding: 0 22px; }

a { color: var(--link); text-decoration: none; overflow-wrap: break-word; }
a:hover { text-decoration: underline; }

h1, h2, h3, h4, h5, h6 {
  color: var(--heading);
  font-family: var(--mono);
  line-height: 1.3;
  letter-spacing: -0.015em;
  margin: 2em 0 .6em;
  font-weight: 700;
}
/* Monospace runs wider than the sans it replaced, so headings are a notch
   smaller than they would otherwise be. */
h1 { font-size: 1.85rem; margin-top: 1rem; letter-spacing: -0.02em; }
h2 { font-size: 1.34rem; padding-bottom: .35em; border-bottom: 1px solid var(--border); }
h3 { font-size: 1.08rem; }
h4 { font-size: .97rem; color: var(--text); }

p, ul, ol { margin: 0 0 1.1em; }
li { margin: .25em 0; }
strong { color: var(--heading); font-weight: 700; }
hr { border: 0; border-top: 1px solid var(--border); margin: 2.4em 0; }

img, video { max-width: 100%; height: auto; }

blockquote {
  margin: 1.4em 0;
  padding: .7em 1.1em;
  border-left: 3px solid var(--accent);
  background: var(--bg-subtle);
  border-radius: 0 var(--radius) var(--radius) 0;
  color: var(--text-dim);
}
blockquote p:last-child { margin-bottom: 0; }

/* ---------- code ---------- */
code, kbd, samp {
  font-family: var(--mono);
  font-size: .88em;
  background: var(--bg-code);
  color: var(--code-ink);
  padding: .12em .38em;
  border-radius: 5px;
  /* Long unbreakable tokens - hashes, keys - must not widen the page. */
  overflow-wrap: anywhere;
}

pre {
  background: var(--bg-code);
  border: 1px solid var(--border);
  border-radius: var(--radius);
  padding: 14px 16px;
  overflow-x: auto;
  font-size: .84rem;
  line-height: 1.6;
}
pre code { background: none; color: var(--text); padding: 0; font-size: inherit; }

/* ---------- tables ---------- */
/* Wide tables scroll rather than crushing their columns. */
table {
  display: block;
  width: 100%;
  max-width: 100%;
  overflow-x: auto;
  border-collapse: collapse;
  margin: 1.3em 0;
  font-size: .92rem;
  font-variant-numeric: tabular-nums;
}
th, td {
  border: 1px solid var(--border);
  padding: 8px 11px;
  text-align: left;
  vertical-align: top;
}
th { background: var(--bg-subtle); color: var(--heading); font-weight: 700; }
tbody tr:nth-child(even) { background: var(--stripe); }
td a { white-space: nowrap; }
th code, td code { white-space: nowrap; overflow-wrap: normal; }

/* ---------- header ---------- */
.site-header {
  border-bottom: 1px solid var(--border);
  background: var(--bg);
  position: sticky;
  top: 0;
  z-index: 20;
  backdrop-filter: saturate(140%) blur(8px);
}
.header-inner {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 16px;
  height: 58px;
}
.site-title {
  font-family: var(--mono);
  font-weight: 800;
  color: var(--heading);
  letter-spacing: -0.02em;
  font-size: .95rem;
  /* Give way to the nav on narrow screens rather than widening the page. */
  min-width: 0;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
}
.site-title:hover { text-decoration: none; color: var(--accent); }

.site-nav { display: flex; align-items: center; gap: 18px; flex: none; }
.site-nav a { color: var(--text-dim); font-size: .88rem; font-weight: 600; }
.site-nav a:hover { color: var(--accent); text-decoration: none; }

.theme-toggle {
  display: inline-flex;
  align-items: center;
  justify-content: center;
  width: 34px;
  height: 34px;
  padding: 0;
  cursor: pointer;
  color: var(--text-dim);
  background: transparent;
  border: 1px solid var(--border);
  border-radius: 9px;
  transition: color .15s ease, border-color .15s ease;
}
.theme-toggle:hover { color: var(--accent); border-color: var(--accent); }
.theme-toggle svg { fill: none; stroke: currentColor; stroke-width: 1.9; }

/* The button advertises where it takes you, not where you are: moon while the
   page is light, sun while it is dark. */
.icon-sun { display: none; }
.icon-moon { display: inline; }
:root[data-theme="dark"] .icon-moon { display: none; }
:root[data-theme="dark"] .icon-sun { display: inline; }
@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) .icon-moon { display: none; }
  :root:not([data-theme="light"]) .icon-sun { display: inline; }
}
:root[data-theme="light"] .icon-moon { display: inline; }
:root[data-theme="light"] .icon-sun { display: none; }

/* ---------- main / footer ---------- */
main { padding: 8px 22px 60px; }
main > :first-child { margin-top: 1.2rem; }

.site-footer {
  border-top: 1px solid var(--border);
  padding: 22px 0 34px;
  color: var(--text-dim);
  font-size: .85rem;
}
.site-footer p { margin: 0 0 .3em; }
.footer-note { color: var(--text-dim); opacity: .8; }

/* ---------- article header ---------- */
/* Hero image, then title / one-line lede / tags, matching the layout used on
   the Detection & Response posts. */
.hero-figure {
  margin: 1.4rem 0 34px;
  border: 1px solid var(--border);
  border-radius: var(--radius);
  box-shadow: var(--shadow);
  overflow: hidden;
  line-height: 0;
}
.hero-figure img { display: block; width: 100%; height: auto; }

.post-head {
  margin: 0 0 36px;
  padding-bottom: 28px;
  border-bottom: 1px solid var(--border);
}
.post-head .pmeta { color: var(--text-dim); font-size: .88rem; margin-bottom: 14px; }
.post-head h1 { margin: 0 0 12px; }
.post-head .lede {
  margin: 0;
  font-size: 1.08rem;
  line-height: 1.6;
  font-style: italic;
  color: var(--text-dim);
}
/* ---------- at-a-glance stat tiles ---------- */
/* A run of figures reads faster as tiles than as a two-column table. */
.statgrid {
  display: grid;
  grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
  gap: 10px;
  margin: 1.6em 0;
}
.stat {
  padding: 14px 16px;
  background: var(--bg-panel);
  border: 1px solid var(--border);
  border-radius: var(--radius);
}
.stat > b {
  display: block;
  font-family: var(--mono);
  font-size: 1.45rem;
  font-weight: 700;
  line-height: 1.1;
  letter-spacing: -0.03em;
  color: var(--heading);
  white-space: nowrap;
}
.stat > b .arrow { color: var(--text-dim); font-weight: 400; font-size: .8em; }
.stat > span {
  display: block;
  margin-top: 6px;
  font-size: .8rem;
  line-height: 1.35;
  color: var(--text);
}
.stat > em {
  display: block;
  margin-top: 3px;
  font-size: .72rem;
  line-height: 1.35;
  color: var(--text-dim);
  font-style: normal;
}
.stat.is-accent > b { color: var(--accent); }
.stat.is-zero   > b { color: var(--gold); }

/* ---------- accuracy callout ---------- */
.accuracy {
  display: flex;
  align-items: center;
  gap: 20px;
  margin: 1.8em 0;
  padding: 16px 20px;
  background: var(--bg-subtle);
  border: 1px solid var(--border);
  border-left: 3px solid var(--gold);
  border-radius: 0 var(--radius) var(--radius) 0;
}
.accuracy-score { flex: 0 0 auto; text-align: center; }
.accuracy-score b {
  display: block;
  font-family: var(--mono);
  font-size: 1.9rem;
  line-height: 1;
  letter-spacing: -0.04em;
  color: var(--heading);
}
.accuracy-score span {
  display: block;
  margin-top: 3px;
  font-size: .66rem;
  letter-spacing: .1em;
  text-transform: uppercase;
  color: var(--text-dim);
}
.accuracy-body { flex: 1 1 auto; min-width: 0; }
.accuracy-meter {
  height: 7px;
  border-radius: 999px;
  background: color-mix(in srgb, var(--text-dim) 20%, transparent);
  overflow: hidden;
}
.accuracy-meter i { display: block; height: 100%; background: var(--gold); }
.accuracy-body p { margin: 9px 0 0; font-size: .9rem; color: var(--text-dim); }

/* ---------- verdict pills ---------- */
.pill {
  display: inline-block;
  padding: 3px 9px;
  font-family: var(--mono);
  font-size: .64rem;
  font-weight: 700;
  letter-spacing: .05em;
  text-transform: uppercase;
  white-space: nowrap;
  border: 1px solid;
  border-radius: 999px;
}
.pill-inreach {
  color: var(--sev-high);
  background: color-mix(in srgb, var(--sev-high) 12%, transparent);
  border-color: color-mix(in srgb, var(--sev-high) 42%, transparent);
}
.pill-tracing {
  color: var(--sev-mid);
  background: color-mix(in srgb, var(--sev-mid) 12%, transparent);
  border-color: color-mix(in srgb, var(--sev-mid) 42%, transparent);
}
.pill-lab {
  color: var(--sev-low);
  background: color-mix(in srgb, var(--sev-low) 12%, transparent);
  border-color: color-mix(in srgb, var(--sev-low) 42%, transparent);
}
/* Keep the verdict column tight so the two prose columns get the width. */
.verdict-table td:nth-child(2) { width: 1%; white-space: nowrap; }
.verdict-table td a { white-space: normal; }

/* ---------- inline figures ---------- */
/* The diagrams are inlined rather than loaded through <img> so document CSS
   reaches them. An external SVG can only see prefers-color-scheme, which
   leaves it stuck on the OS setting when the reader flips the header toggle. */
.fig { margin: 1.8em 0; }
.fig figcaption {
  margin-top: 10px;
  font-size: .85rem;
  line-height: 1.5;
  color: var(--text-dim);
  text-align: center;
  font-style: italic;
}
.figure-svg { display: block; width: 100%; height: auto; }
.figure-svg .t { font-family: var(--sans); }
.figure-svg .m { font-family: var(--mono); }
.figure-svg .ink   { fill: var(--fig-ink); }
.figure-svg .ink3,
.figure-svg .lbl   { fill: var(--fig-ink3); }
.figure-svg .grid  { stroke: var(--fig-line); stroke-width: 1; }
.figure-svg .axis  { stroke: var(--fig-line); stroke-width: 1; }
.figure-svg .b1    { fill: var(--fig-b1); }
.figure-svg .b2    { fill: var(--fig-b2); }
.figure-svg .b3    { fill: var(--fig-b3); }
.figure-svg .acc   { fill: var(--fig-acc); }
.figure-svg .box   { fill: var(--fig-box); stroke: var(--fig-line); stroke-width: 1; }
.figure-svg .plain { fill: var(--fig-plain); }
.figure-svg .enc   { fill: var(--fig-enc); }
.figure-svg .mark  { fill: var(--fig-mark); }
.figure-svg .key   { fill: var(--fig-key); }
.figure-svg .tail  { fill: var(--fig-tail); }
/* Labels sitting on top of the encrypted block stay light in both themes. */
.figure-svg .onenc  { fill: #FFFFFF; }
.figure-svg .onenc2 { fill: #D9E7F8; }

.post-head .tags { margin-top: 16px; }
.post-head .tag {
  display: inline-block;
  margin: 0 6px 6px 0;
  padding: 3px 9px;
  font-size: .72rem;
  color: var(--accent);
  background: var(--bg-code);
  border: 1px solid var(--border);
  border-radius: 6px;
}

/* ---------- misc ---------- */
::selection { background: var(--accent); color: var(--accent-ink); }

@media (max-width: 560px) {
  body { font-size: 16px; }
  h1 { font-size: 1.65rem; }
  h2 { font-size: 1.3rem; }
  /* The monospace brand plus three links and the toggle will not fit on one
     phone-width line, so the header stacks and stops sticking - the same
     thing the Detection & Response header does at this breakpoint. */
  .site-header { position: static; }
  .header-inner {
    flex-direction: column;
    align-items: flex-start;
    justify-content: flex-start;
    gap: 10px;
    height: auto;
    /* Vertical only - the side padding belongs to .wrap, and a `padding`
       shorthand here would zero it and shove the header into the corner. */
    padding-top: 14px;
    padding-bottom: 14px;
  }
  .site-nav { gap: 16px; }
  .site-nav a { font-size: .82rem; }
  .hero-figure { margin-bottom: 26px; }
  .post-head { margin-bottom: 28px; padding-bottom: 22px; }
  .post-head .lede { font-size: 1rem; }
}