/* ============================================
   CyberSOC Playbook — KQL Code Block Styling
   ============================================ */

/* --- KQL Block Container --- */
.kql-block {
    background: var(--bg-secondary);
    border: 1px solid var(--border-primary);
    border-left: 3px solid var(--accent-cyan);
    border-radius: var(--border-radius);
    margin: 1.25rem 0;
    overflow: hidden;
}

.kql-block:hover {
    border-color: var(--border-secondary);
    border-left-color: var(--accent-cyan);
}

/* --- KQL Header (Title + Copy Button) --- */
.kql-header {
    display: flex;
    align-items: center;
    justify-content: space-between;
    padding: 0.75rem 1rem;
    background: var(--bg-tertiary);
    border-bottom: 1px solid var(--border-primary);
}

.kql-meta {
    display: flex;
    align-items: center;
    gap: 0.625rem;
    flex-wrap: wrap;
    flex: 1;
    min-width: 0;
}

.kql-title {
    font-family: 'JetBrains Mono', monospace;
    font-size: 0.85rem;
    font-weight: 600;
    color: var(--text-heading);
    margin: 0;
}

/* --- Copy Button --- */
.btn-copy {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 0.375rem;
    padding: 0.375rem 0.75rem;
    background: transparent;
    border: 1px solid var(--border-primary);
    border-radius: var(--border-radius-sm);
    color: var(--text-muted);
    font-family: 'JetBrains Mono', monospace;
    font-size: 0.65rem;
    cursor: pointer;
    transition: all var(--transition-fast);
    white-space: nowrap;
    flex-shrink: 0;
}

.btn-copy:hover {
    background: var(--bg-hover);
    color: var(--text-primary);
    border-color: var(--border-secondary);
}

.btn-copy.copied {
    border-color: var(--accent-green);
    color: var(--accent-green);
    background: var(--accent-green-dim);
}

.btn-copy svg {
    width: 14px;
    height: 14px;
}

/* --- KQL Description --- */
.kql-description {
    padding: 0.75rem 1rem;
    font-size: 0.85rem;
    color: var(--text-secondary);
    line-height: 1.6;
    border-bottom: 1px solid var(--border-primary);
}

.kql-description p {
    margin: 0;
}

/* --- KQL Code Area --- */
.kql-block pre {
    margin: 0;
    padding: 1rem 1.25rem;
    background: var(--bg-primary);
    overflow-x: auto;
    -webkit-overflow-scrolling: touch;
}

.kql-block pre code {
    font-family: 'JetBrains Mono', 'Fira Code', 'Cascadia Code', monospace;
    font-size: 0.825rem;
    line-height: 1.65;
    color: var(--text-primary);
    background: none;
    padding: 0;
    border-radius: 0;
    display: block;
    white-space: pre;
    tab-size: 4;
}

/* --- KQL Syntax Highlighting Colors --- */
.kql-keyword {
    color: var(--accent-cyan);
    font-weight: 600;
}

.kql-operator {
    color: var(--accent-purple);
    font-weight: 600;
}

.kql-function {
    color: var(--accent-green);
}

.kql-string {
    color: var(--accent-amber);
}

.kql-comment {
    color: var(--text-muted);
    font-style: italic;
}

.kql-table {
    color: var(--text-heading);
    font-weight: 700;
}

.kql-number {
    color: var(--accent-amber);
}

.kql-time {
    color: var(--accent-amber);
}

.kql-pipe {
    color: var(--accent-purple);
    font-weight: 700;
}

/* --- KQL Output / When to Use Sections --- */
.kql-output,
.kql-when {
    padding: 0.75rem 1rem;
    font-size: 0.825rem;
    border-top: 1px solid var(--border-primary);
}

.kql-output h5,
.kql-when h5 {
    font-family: 'JetBrains Mono', monospace;
    font-size: 0.7rem;
    font-weight: 700;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    margin-bottom: 0.375rem;
    margin-top: 0;
}

.kql-output h5 { color: var(--accent-green); }
.kql-when h5 { color: var(--accent-blue); }

.kql-output p,
.kql-when p {
    margin: 0;
    color: var(--text-secondary);
    line-height: 1.6;
}

/* --- KQL Block Responsive --- */
@media (max-width: 768px) {
    .kql-header {
        flex-direction: column;
        align-items: flex-start;
        gap: 0.5rem;
    }

    .btn-copy {
        align-self: flex-end;
    }

    .kql-block pre {
        padding: 0.75rem 1rem;
    }

    .kql-block pre code {
        font-size: 0.75rem;
    }
}