{#
    Shared macros for the server-rendered fragments (UI remediation
    Phase 3). Import with:

        {% import "site_shell/_macros.html" as ui %}

    Every macro renders semantic markup styled by
    /static/styles/pyc-fragment.css and the --pyc-* tokens, so the
    same badge, pagination footer, empty state, and breadcrumb look
    identical on every admin, projects, and resources page.

    Filters used here are installed by
    foundation.templating.install_template_globals:
    status_tone, enum_value, display, format_datetime.
#}

{#- status_badge(status, size="") -- one badge for every status
    vocabulary; the tone comes from the status_tone filter so a build
    that is "pending" is amber on every page, not grey on some. #}
{% macro status_badge(status, size="") -%}
{%- set label = status | state_words -%}
<span class="badge badge-{{ status | status_tone }}"{% if size %} style="font-size: {{ size }};"{% endif %}>{{ label | display }}</span>
{%- endmacro %}

{#- pagination(endpoint, page, total_pages, params={}, total=None) --
    windowed pager inside a labelled <nav>; carries every filter and
    per_page through url_for; marks the current page with
    aria-current. Renders only the summary line when there is one
    page. #}
{% macro pagination(endpoint, page, total_pages, params={}, total=None) -%}
{%- if total_pages > 1 %}
<nav class="pagination" aria-label="Pagination">
    {%- if page > 1 %}
    <a href="{{ url_for(endpoint, page=page-1, **params) }}" rel="prev">&laquo; Previous</a>
    {%- endif %}
    {%- set window_start = [1, page - 2] | max %}
    {%- set window_end = [total_pages, page + 2] | min %}
    {%- if window_start > 1 %}
    <a href="{{ url_for(endpoint, page=1, **params) }}">1</a>
    {%- if window_start > 2 %}<span class="ellipsis" aria-hidden="true">&hellip;</span>{% endif %}
    {%- endif %}
    {%- for p in range(window_start, window_end + 1) %}
    {%- if p == page %}
    <span class="active" aria-current="page">{{ p }}</span>
    {%- else %}
    <a href="{{ url_for(endpoint, page=p, **params) }}">{{ p }}</a>
    {%- endif %}
    {%- endfor %}
    {%- if window_end < total_pages %}
    {%- if window_end < total_pages - 1 %}<span class="ellipsis" aria-hidden="true">&hellip;</span>{% endif %}
    <a href="{{ url_for(endpoint, page=total_pages, **params) }}">{{ total_pages }}</a>
    {%- endif %}
    {%- if page < total_pages %}
    <a href="{{ url_for(endpoint, page=page+1, **params) }}" rel="next">Next &raquo;</a>
    {%- endif %}
</nav>
{%- endif %}
{%- if total is not none %}
<p class="muted">Page {{ page }} of {{ [total_pages, 1] | max }} &middot; {{ total }} total</p>
{%- endif %}
{%- endmacro %}

{#- empty_state(title, hint=None, action_url=None, action_label=None,
    colspan=None) -- one empty-state block. Pass colspan to render it
    as a table row inside a <tbody>. #}
{#- A page whose data nothing in this version can produce says so, in the
    words the channels and schedules pages already use (audit ORG-F14,
    PRJ-08). Use it as ``{% call ui.preview_notice() %}...{% endcall %}``. -#}
{% macro preview_notice() -%}
<div class="pyc-preview-notice" role="note" data-role="preview-notice">{{ caller() }}</div>
{%- endmacro %}

{#- With ``colspan`` this writes a complete table row (``<tr><td colspan=N>``): call it directly
    inside ``<tbody>``, never inside a ``<tr>`` of your own (ADM-44). -#}
{% macro empty_state(title, hint=None, action_url=None, action_label=None, colspan=None) -%}
{%- if colspan %}<tr><td colspan="{{ colspan }}">{% endif -%}
<div class="pyc-empty-state" role="status">
    <p class="pyc-empty-state__title">{{ title }}</p>
    {%- if hint %}<p class="pyc-empty-state__hint">{{ hint }}</p>{% endif %}
    {%- if action_url and action_label %}<a href="{{ action_url }}" class="btn btn-primary">{{ action_label }}</a>{% endif %}
</div>
{%- if colspan %}</td></tr>{% endif -%}
{%- endmacro %}

{#- breadcrumb(items) -- items is a list of (label, url) pairs; the
    last item is the current page and renders without a link. #}
{% macro breadcrumb(items) -%}
<nav aria-label="Breadcrumb">
    <ol class="breadcrumb">
        {%- for label, url in items %}
        {%- if loop.last or not url %}
        <li aria-current="page">{{ label }}</li>
        {%- else %}
        <li><a href="{{ url }}">{{ label }}</a></li>
        {%- endif %}
        {%- endfor %}
    </ol>
</nav>
{%- endmacro %}

{#- key_value(rows) -- description list for detail panes; rows is a
    list of (label, value) pairs. Values may be pre-rendered Markup. #}
{% macro key_value(rows) -%}
<dl class="pyc-key-value">
    {%- for label, value in rows %}
    <dt>{{ label }}</dt>
    <dd>{{ value | display }}</dd>
    {%- endfor %}
</dl>
{%- endmacro %}

{#- truncate_id(value, length=12) -- short identifier with the full
    value as the title, so SHAs and UUIDs stay copyable. #}
{% macro truncate_id(value, length=12) -%}
{%- if value is none or value == "" -%}
<span class="muted">&mdash;</span>
{%- elif value | length > length -%}
<code class="mono" title="{{ value }}">{{ value[:length] }}&hellip;</code>
{%- else -%}
<code class="mono">{{ value }}</code>
{%- endif -%}
{%- endmacro %}

{#- field_error(errors, name) -- inline validation message for one
    field. errors is the dict the route passes (may be undefined or
    None); the id matches the aria-describedby the input should set. #}
{% macro field_error(errors, name) -%}
{%- if errors is defined and errors and name in errors -%}
<div class="form-error" id="{{ name }}-error" role="alert">{{ errors[name] }}</div>
{%- endif -%}
{%- endmacro %}

{#- invalid_attrs(errors, name, describedby="") -- attributes to splice
    into an input that has a validation error. An input that already
    points at help text passes that id as describedby instead of
    writing its own aria-describedby, so the two are merged into one
    attribute (a second aria-describedby would be ignored). #}
{% macro invalid_attrs(errors, name, describedby="") -%}
{%- set has_error = errors is defined and errors and name in errors -%}
{%- set ids = ((describedby ~ " ") if describedby else "") ~ ((name ~ "-error") if has_error else "") -%}
{%- if has_error %} aria-invalid="true"{% endif -%}
{%- if ids | trim %} aria-describedby="{{ ids | trim }}"{% endif -%}
{%- endmacro %}

{#- error_summary(errors, labels) -- the list of problems at the top of
    a form that failed validation, each linking to its field (the
    field's id must equal its name). labels maps a field name to its
    visible label, which prefixes the message unless the message
    already starts with it. Renders nothing when there are no field
    errors. #}
{% macro error_summary(errors, labels) -%}
{%- if errors is defined and errors -%}
<div class="form-error-summary" data-role="error-summary" tabindex="-1" aria-labelledby="form-error-summary-title">
    <h2 class="form-error-summary__title" id="form-error-summary-title">
        {%- if errors | length == 1 %}Fix this problem to continue{% else %}Fix these {{ errors | length }} problems to continue{% endif -%}
    </h2>
    <ul class="form-error-summary__list">
        {%- for name, message in errors.items() %}
        {%- set label = labels[name] if (labels is defined and labels and name in labels) else "" %}
        <li><a href="#{{ name }}">{% if label and not (message | lower).startswith(label | lower) %}{{ label }}: {% endif %}{{ message }}</a></li>
        {%- endfor %}
    </ul>
</div>
{%- endif -%}
{%- endmacro %}

{#- icon(name) -- inline 24x24 currentColor SVG, hidden from
    assistive tech. Replaces the Google-hosted Material Icons
    ligatures; an unknown name renders a neutral dot. #}
{% macro icon(name) -%}
{%- set paths = {
    "add": "M12 5v14M5 12h14",
    "edit": "M4 20h4l10.5-10.5a2.1 2.1 0 0 0-3-3L5 17v3zM13.5 6.5l3 3",
    "delete": "M4 7h16M10 11v6M14 11v6M6 7l1 13h10l1-13M9 7V4h6v3",
    "save": "M5 4h11l3 3v13H5zM8 4v5h7V4M8 20v-6h8v6",
    "arrow_back": "M19 12H5M11 18l-6-6 6-6",
    "refresh": "M20 12a8 8 0 1 1-2.3-5.7M20 4v5h-5",
    "visibility": "M2 12s3.5-7 10-7 10 7 10 7-3.5 7-10 7S2 12 2 12zM12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6z",
    "visibility_off": "M3 3l18 18M10.6 10.6a2 2 0 0 0 2.8 2.8M9.9 5.1A10.4 10.4 0 0 1 12 5c6.5 0 10 7 10 7a17 17 0 0 1-3.2 3.9M6.6 6.6C3.8 8.6 2 12 2 12s3.5 7 10 7a9.7 9.7 0 0 0 3.5-.6",
    "dashboard": "M4 4h7v7H4zM13 4h7v4h-7zM13 11h7v9h-7zM4 14h7v6H4z",
    "folder": "M3 6h6l2 2h10v11H3z",
    "people": "M16 19v-1a4 4 0 0 0-8 0v1M12 11a3 3 0 1 0 0-6 3 3 0 0 0 0 6zM20 19v-1a4 4 0 0 0-3-3.9M17 5.1a3 3 0 0 1 0 5.8",
    "source": "M6 3v12M6 15a3 3 0 1 0 0 6 3 3 0 0 0 0-6zM18 9a3 3 0 1 0 0-6 3 3 0 0 0 0 6zM18 9c0 4-6 4-9 6",
    "build": "M14.7 6.3a4 4 0 0 0 5 5L14 17l-3-3 5.7-5.7zM3 21l6-6",
    "cloud": "M7 18a4 4 0 0 1-.6-8A6 6 0 0 1 18 9a3.5 3.5 0 0 1 0 9z",
    "science": "M9 3h6M10 3v6l-6 9a2 2 0 0 0 1.7 3h12.6a2 2 0 0 0 1.7-3l-6-9V3",
    "new_releases": "M12 2l2.4 2.4 3.4-.4.4 3.4L21 9.9l-1.6 3 .8 3.3-3.3.8-1 3.3L12 19l-3.9 1.3-1-3.3-3.3-.8.8-3.3L3 9.9l2.8-2.5.4-3.4 3.4.4zM9 12l2 2 4-4",
    "account_tree": "M4 4h5v5H4zM15 4h5v5h-5zM15 15h5v5h-5zM9 6.5h3v11h3M12 6.5v11",
    "rss_feed": "M5 19a1 1 0 1 0 0-2 1 1 0 0 0 0 2zM4 11a9 9 0 0 1 9 9M4 5a15 15 0 0 1 15 15",
    "schedule": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM12 6v6l4 2",
    "layers": "M12 3l9 5-9 5-9-5zM3 13l9 5 9-5",
    "calendar_today": "M4 5h16v15H4zM4 10h16M8 3v4M16 3v4",
    "filter_list": "M4 6h16M7 12h10M10 18h4",
    "article": "M5 3h14v18H5zM8 8h8M8 12h8M8 16h5",
    "play_arrow": "M7 5v14l11-7z",
    "settings": "M12 15a3 3 0 1 0 0-6 3 3 0 0 0 0 6zM19.4 15a1.7 1.7 0 0 0 .3 1.8l.1.1a2 2 0 1 1-2.8 2.8l-.1-.1a1.7 1.7 0 0 0-1.8-.3 1.7 1.7 0 0 0-1 1.5V21a2 2 0 1 1-4 0v-.1a1.7 1.7 0 0 0-1.1-1.5 1.7 1.7 0 0 0-1.8.3l-.1.1a2 2 0 1 1-2.8-2.8l.1-.1a1.7 1.7 0 0 0 .3-1.8 1.7 1.7 0 0 0-1.5-1H3a2 2 0 1 1 0-4h.1a1.7 1.7 0 0 0 1.5-1.1 1.7 1.7 0 0 0-.3-1.8l-.1-.1a2 2 0 1 1 2.8-2.8l.1.1a1.7 1.7 0 0 0 1.8.3H9a1.7 1.7 0 0 0 1-1.5V3a2 2 0 1 1 4 0v.1a1.7 1.7 0 0 0 1 1.5 1.7 1.7 0 0 0 1.8-.3l.1-.1a2 2 0 1 1 2.8 2.8l-.1.1a1.7 1.7 0 0 0-.3 1.8V9a1.7 1.7 0 0 0 1.5 1H21a2 2 0 1 1 0 4h-.1a1.7 1.7 0 0 0-1.5 1z",
    "info": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM12 16v-4M12 8h.01",
    "label": "M3 7l4-4h10l4 4v2L12 21 3 9z",
    "lan": "M4 4h6v5H4zM14 4h6v5h-6zM9 15h6v5H9zM7 9v3h10V9M12 12v3",
    "devices": "M3 6h14v9H3zM3 18h11M20 9h1v9h-1zM19 10v6",
    "assignment": "M8 4h8v3H8zM5 6h14v15H5zM8 12h8M8 16h5",
    "history": "M4 12a8 8 0 1 1 2.3 5.7M4 12V7M4 12h5M12 8v4l3 2",
    "monitoring": "M5 20V11M12 20V4M19 20v-6M3 20h18",
    "event": "M4 5h16v15H4zM4 10h16M8 3v4M16 3v4M9 14h2v2H9z",
    "monitor_heart": "M3 12h4l2-5 4 10 2-5h6",
    "wifi_tethering": "M12 12h.01M8.5 15.5a5 5 0 0 1 0-7M15.5 8.5a5 5 0 0 1 0 7M5.6 18.4a9 9 0 0 1 0-12.8M18.4 5.6a9 9 0 0 1 0 12.8M12 12v9",
    "check_circle": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM8 12l3 3 5-6",
    "search": "M11 18a7 7 0 1 0 0-14 7 7 0 0 0 0 14zM20 20l-4-4",
    "close": "M6 6l12 12M18 6L6 18",
    "warning": "M12 3l10 18H2zM12 10v4M12 18h.01",
    "content_copy": "M8 8h12v12H8zM4 16V4h12",
    "download": "M12 3v12M6 11l6 6 6-6M4 21h16",
    "lock": "M6 11h12v10H6zM8 11V7a4 4 0 0 1 8 0v4",
    "logout": "M15 4h4v16h-4M10 17l5-5-5-5M15 12H3",
    "arrow_forward": "M5 12h14M13 6l6 6-6 6",
    "cancel": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM9 9l6 6M15 9l-6 6",
    "person_add": "M15 19v-1a4 4 0 0 0-8 0v1M11 11a3 3 0 1 0 0-6 3 3 0 0 0 0 6zM19 8v6M16 11h6",
    "assignment_turned_in": "M8 4h8v3H8zM5 6h14v15H5zM9 13l2 2 4-4",
    "assignment_return": "M8 4h8v3H8zM5 6h14v15H5zM15 14H9M12 11l-3 3 3 3",
    "vpn_key": "M8 15a4 4 0 1 0 0-8 4 4 0 0 0 0 8zM11 11h10M18 11v3M21 11v2",
    "update": "M20 12a8 8 0 1 1-2.3-5.7M20 4v5h-5M12 8v4l3 2",
    "list": "M8 6h13M8 12h13M8 18h13M3 6h.01M3 12h.01M3 18h.01",
    "create_new_folder": "M3 6h6l2 2h10v11H3zM14 11v6M11 14h6",
    "chevron_right": "M9 6l6 6-6 6",
    "chevron_left": "M15 6l-6 6 6 6",
    "block": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM5 5l14 14",
    "admin_panel_settings": "M12 3l8 3v6c0 5-3.5 8-8 9-4.5-1-8-4-8-9V6zM12 12a2 2 0 1 0 0-4 2 2 0 0 0 0 4zM9 16a3 3 0 0 1 6 0",
    "add_circle": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM12 8v8M8 12h8",
    "help_outline": "M12 22a10 10 0 1 0 0-20 10 10 0 0 0 0 20zM9.5 9.5a2.5 2.5 0 1 1 3.5 2.3c-.7.4-1 .9-1 1.7M12 17h.01"
} -%}
<svg class="pyc-inline-icon" viewBox="0 0 24 24" width="18" height="18" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true" focusable="false">
    {%- if name in paths %}<path d="{{ paths[name] }}"/>{% else %}<circle cx="12" cy="12" r="3"/>{% endif -%}
</svg>
{%- endmacro %}

{#- confirm_button(label, message, class="btn btn-danger", icon_name=None)
    -- submit button whose form is confirmed by the shell's delegated
    confirm handler (form[data-confirm]); no inline onclick. Place the
    data-confirm attribute on the <form>; this macro only renders the
    button so the caller controls the form. #}
{% macro confirm_button(label, class="btn btn-danger", icon_name=None) -%}
<button type="submit" class="{{ class }}">{% if icon_name %}{{ icon(icon_name) }} {% endif %}{{ label }}</button>
{%- endmacro %}

{#- permission_picker(permissions, selected=[]) -- the permission checkboxes of a
    role form, grouped by product area with plain names and a filter box
    (audit ADM-06). The checkbox value is still the canonical key. Include
    ``site_shell/_permission_filter.html`` once after the form for the filter
    and the selected count. -#}
{% macro permission_picker(permissions, selected=[]) -%}
<div class="pyc-permissions" data-role="permission-picker">
    <div class="pyc-permissions__toolbar">
        <input type="search" class="form-control w-md" data-role="permission-filter" placeholder="Filter permissions" aria-label="Filter permissions">
        <span class="muted" data-role="permission-count" role="status" aria-live="polite"></span>
    </div>
    <div class="pyc-permissions__preview" data-role="menu-preview" role="status" aria-live="polite" hidden>
        <p class="muted" data-role="menu-shown"></p>
        <p class="muted pyc-permissions__preview-held" data-role="menu-held" hidden></p>
    </div>
    <script type="application/json" data-role="menu-preview-data">{{ menu_preview_data() | tojson }}</script>
    <div class="pyc-permissions__groups">
    {%- for group in permissions | permission_groups %}
        <fieldset class="pyc-permissions__group" data-permission-group>
            <legend>{{ group.label }}</legend>
            {%- for item in group["items"] %}
            <label class="pyc-permissions__item regular" title="{{ item.permission.name }}" data-permission-text="{{ (group.label ~ ' ' ~ item.label ~ ' ' ~ item.description ~ ' ' ~ item.permission.name) | lower }}">
                <input type="checkbox" name="permission_keys" value="{{ item.permission.id }}"{% if item.permission.id in selected %} checked{% endif %}>
                <span class="pyc-permissions__text">
                    <span class="pyc-permissions__name">{{ item.label }}</span>
                    {%- if item.description %}<span class="muted pyc-permissions__description">{{ item.description }}</span>{% endif %}
                    {%- if item.menu_hint %}<span class="muted pyc-permissions__hint" data-role="menu-hint">{{ item.menu_hint }}</span>{% endif %}
                </span>
            </label>
            {%- endfor %}
        </fieldset>
    {%- endfor %}
    </div>
    <p class="muted" data-role="permission-none" hidden>No permission matches the filter.</p>
</div>
{%- endmacro %}

{#- legacy_store_notice(what, import_url="", count=0, csrf_token="") -- the notice on the pages of the older secrets store (audit ADM-07): nothing in the
    product reads what is written there, the vault is where secrets belong, and, when there are legacy secrets and the viewer may import them, the button that
    carries them across. ``what`` is "secrets" or "secret scopes". #}
{% macro legacy_store_notice(what, import_url="", count=0, csrf_token="") -%}
<div class="pyc-preview-notice" role="note" data-role="legacy-notice">
    <p><strong>These are legacy {{ what }}.</strong> Nothing in Pychestrate reads them: repositories, webhooks and notification channels use the secrets vault under
        <a href="/secrets">System, Secrets</a>, and new secrets belong there.</p>
    {%- if import_url and count %}
    <form action="{{ import_url }}" method="post" class="actions-row" data-role="import-legacy">
        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
        <button type="submit" class="btn btn-secondary">Import {{ count }} secret{{ '' if count == 1 else 's' }} into the vault</button>
        <span class="muted">Each is stored service-wide as <code>scope/name</code>; one the vault already has is left as it is.</span>
    </form>
    {%- endif %}
</div>
{%- endmacro %}

{#- learn_more(page, anchor="", label="Learn more") -- a link from a form to the section of the user guide that explains it (DOC-20). It draws
    nothing when the guide is not installed or has no such page (``guide_link`` answers ""), so it never leads nowhere. It opens in a new tab so a
    half-filled form is not lost, and says so to a screen reader. ``page`` is the chapter's file name without ``.html``; ``anchor`` is the section's id. #}
{% macro learn_more(page, anchor="", label="Learn more") -%}
{%- set href = guide_link(page, anchor) -%}
{%- if href %}<a class="pyc-learn-more" href="{{ href }}" target="_blank" rel="noopener" data-role="learn-more">{{ label }}<span class="visually-hidden"> in the user guide (opens in a new tab)</span></a>{% endif -%}
{%- endmacro %}

{#- log_viewer(text, running=False, filename="log.txt", refresh_seconds=10, waiting=False)
    -- shared log output with a Follow toggle, Copy, Download, and
    live refresh while the job runs (chrome/log-viewer.js). Replaces
    the per-page <meta http-equiv="refresh"> that reloaded the whole
    shell. ``waiting`` marks a job nothing has started: it is not "Live" and
    it has not "Finished" either (PRJ-07). #}
{% macro log_viewer(text, running=False, filename="log.txt", refresh_seconds=10, waiting=False) -%}
<div class="pyc-log-viewer" data-log-running="{{ 'true' if running else 'false' }}" data-log-refresh-seconds="{{ refresh_seconds }}" data-log-filename="{{ filename }}">
    <div class="pyc-log-viewer__toolbar">
        <span class="muted" data-log-status role="status">{% if running %}Live: refreshing every {{ refresh_seconds }}s while the job runs{% elif waiting %}Waiting: nothing has started this job, so there is no log{% elif text %}Finished: log is complete{% else %}Finished: no log output was recorded{% endif %}</span>
        <label class="pyc-log-viewer__follow"><input type="checkbox" data-log-follow checked> Follow output</label>
        <button type="button" class="btn btn-sm btn-secondary" data-log-action="refresh">Refresh now</button>
        <button type="button" class="btn btn-sm btn-secondary" data-log-action="copy">Copy</button>
        <button type="button" class="btn btn-sm btn-secondary" data-log-action="download">Download</button>
    </div>
    <pre class="pyc-log-viewer__output" tabindex="0" aria-label="Log output">{% if text %}{{ text }}{% elif running %}No log output yet.{% elif waiting %}This job has not started, so there is nothing to show.{% else %}The job finished without producing log output.{% endif %}</pre>
</div>
{%- endmacro %}

{# A running job's progress: the bar and the pod's last message ("tick 16"), only when the pod has reported some (the guide's PYC-PROGRESS lines). #}
{% macro job_progress(progress) %}
{% if progress %}
<div class="small" data-role="job-progress">
    {% if progress.percent is not none %}<progress max="100" value="{{ progress.percent | round(0) | int }}" aria-label="Job progress">{{ progress.percent | round(0) | int }}%</progress> {{ progress.percent | round(0) | int }}%{% endif %}
    {% if progress.message %}<div class="muted">{{ progress.message }}</div>{% endif %}
</div>
{% endif %}
{% endmacro %}