/* PORTAL — what the hosted twin hides or adds. Mail, PDF intake and Documents need Gmail/Drive,
   which the portal does not have; the Claude link is Phil's own chat. A viewer sees everything and
   can change nothing: the server refuses writes, this sheet just keeps the buttons out of the way. */
a[data-view="waiting"], a[data-view="pdf"], a[data-view="docs"], #chatlink, #mail-compose, .mailwrap, .day, #newcal, #calform, .srcq { display:none !important }
#refmenu .refm a[data-view="pdf"], #refmenu .refm a[data-view="docs"] { display:none !important }
section.card#waiting .hd .src { visibility:hidden }
#portal-bar{max-width:1480px;margin:0 auto;padding:4px 22px 6px;display:flex;align-items:center;gap:10px;font-size:12.5px;color:var(--ink-2);border-top:1px solid var(--rule)}
#portal-bar .sp{flex:1}
#portal-bar .lvl{display:inline-block;font-family:"IBM Plex Mono",ui-monospace,monospace;font-size:10.5px;letter-spacing:.05em;padding:2px 7px;border-radius:2px;margin-left:8px;background:var(--panel-2);color:var(--ink-2)}
#portal-bar .lvl.viewer{background:var(--warn-soft);color:var(--warn-ink)}
#portal-bar .lvl.editor{background:var(--ok-soft);color:var(--ok-ink)}
#portal-bar .lvl.admin{background:var(--accent-soft);color:var(--accent-ink)}
#portal-toast{position:fixed;left:50%;bottom:28px;transform:translate(-50%,20px);opacity:0;background:var(--panel);color:var(--ink);border:1px solid var(--warn);padding:10px 16px;font-size:13.5px;border-radius:4px;box-shadow:var(--lift-2);transition:.2s;z-index:50;pointer-events:none;max-width:min(90vw,520px)}
#portal-toast.show{opacity:1;transform:translate(-50%,0)}
#portal-users-panel{grid-column:span 12}
body[data-view] #portal-users-panel section.card{display:flex !important}
#portal-users-panel input,#portal-users-panel select{font:inherit;font-size:13px;padding:4px 6px;border:1px solid var(--rule);background:var(--panel);color:var(--ink);border-radius:3px;width:100%}
#portal-users-panel td,#portal-users-panel th{padding:6px 6px;border-bottom:1px solid var(--rule);font-family:"IBM Plex Mono",ui-monospace,monospace;font-size:12px}
#portal-users-panel th{color:var(--ink-3);font-weight:500;letter-spacing:.05em;text-transform:uppercase;font-size:10.5px}
/* read-only: the write affordances go, the read ones stay */
html[data-role="viewer"] .cap, html[data-role="viewer"] .btn.primary, html[data-role="viewer"] #imp-upload, html[data-role="viewer"] [data-updel], html[data-role="viewer"] [data-updrive],
html[data-role="viewer"] [data-edit], html[data-role="viewer"] [data-addrow], html[data-role="viewer"] [data-savedrive], html[data-role="viewer"] [data-vlog],
html[data-role="viewer"] .note button, html[data-role="viewer"] #refresh ~ .nothing { display:none !important }
html[data-role="viewer"] textarea, html[data-role="viewer"] [contenteditable] { pointer-events:none; opacity:.7 }
/* the mail card is Phil's Gmail; on the portal it is empty, so Today takes the row */
section.card#waiting{display:none !important}
body[data-view="today"] section.card#today{grid-column:span 12}
html:not([data-role="admin"]) #diag{display:none !important}
/* Phil-only: the morning brief, the Capture box and its filed list, and the runbook / sites notes.
   The DB refuses these tables to everyone but admin; this keeps their empty frames off the page. */
html:not([data-role="admin"]) .cap, html:not([data-role="admin"]) #captures, html:not([data-role="admin"]) #captures-v,
html:not([data-role="admin"]) #brief, html:not([data-role="admin"]) .notes-hd, html:not([data-role="admin"]) #notes-runbook,
html:not([data-role="admin"]) #notes-sites, html:not([data-role="admin"]) #note-runbook, html:not([data-role="admin"]) #note-sites,
html:not([data-role="admin"]) [data-note], html:not([data-role="admin"]) #runs, html:not([data-role="admin"]) #report { display:none !important }

/* Staffing (build 64): pay and documents are Phil-only. The database already returns nothing for anyone else;
   this keeps the empty blocks and the private form fieldsets off the screen, and the email button too
   (the portal cannot reach Gmail). */
html:not([data-role="admin"]) #field { display:none !important }
/* The Brain tab (build 74) is admin-only on BOTH surfaces — it holds Phil's reasoning on Stix,
   on leads, and the decisions log. The database already refuses opportunities/people/decisions
   to editors and viewers, and the portal_* views return empty; this removes the tab, its nav
   entry and its More-sheet entry so there is no empty frame and nothing to click. */
html:not([data-role="admin"]) #graph,
html:not([data-role="admin"]) #nav a[data-view="graph"],
html:not([data-role="admin"]) .sheetnav a[data-view="graph"] { display:none !important }
/* The Records view also carries a read-only "Decisions" tab, built from a table SPEC rather
   than a literal query — which is why a string-based rewrite missed it for so long. The spec
   now resolves to portal_decisions (empty for non-admins); this removes the tab as well, so
   there is no empty category advertising that a decisions log exists. */
html:not([data-role="admin"]) #records [data-k="DECISIONS_"] { display:none !important }
html:not([data-role="admin"]) .stc .priv, html:not([data-role="admin"]) .stform fieldset.priv, html:not([data-role="admin"]) #st-mail { display:none !important }