.top-nav {
  background: var(--color-surface);
  border-bottom: 1px solid var(--color-border);
  overflow-x: auto;
  padding: 0 var(--space-6);
}

/* Inner wrapper centers nav items to match page content width */
.top-nav__inner {
  display: flex;
  align-items: center;
  gap: var(--space-1);
  width: 100%;
  max-width: var(--top-nav-max-width, 1800px);
  margin: 0 auto;
}

.top-nav__item {
  position: relative;
  display: flex;
  align-items: center;
  gap: var(--space-2);
  padding: var(--space-3) var(--space-4);
  font-size: var(--text-sm);
  font-weight: var(--font-medium);
  color: var(--color-text-secondary);
  white-space: nowrap;
  border-bottom: 2px solid transparent;
  margin-bottom: -1px;
  transition: color var(--transition-fast), border-color var(--transition-fast);
  cursor: pointer;
  background: none;
  border-top: none;
  border-left: none;
  border-right: none;
}
.top-nav__item:hover  { color: var(--color-text-primary); }
.top-nav__item.is-active {
  color: var(--color-accent);
  border-bottom-color: var(--color-accent);
}

/* ── Role-gated nav ───────────────────────────────────────────────────────────
   A link the role can't open must never paint, so items start hidden and are
   revealed only once the role is known: <html data-role> is set from the cached
   role before first paint, then corrected by pageGuard.js after /auth/me.
   The allowlist below mirrors navAllowed() in core/pageGuard.js — keep in sync.
   The leading `html` lifts these over .nav-admin-link.is-visible (pages/dashboard.css),
   which would otherwise tie on specificity and win on source order. */
html .top-nav [data-nav-href] { display: none; }

html[data-role="admin"]       .top-nav [data-nav-href] { display: flex; }
html[data-role="manager"]     .top-nav [data-nav-href]:not([data-nav-href="/admin"]) { display: flex; }
html[data-role="linkbuilder"] .top-nav [data-nav-href="/lb"] { display: flex; }

/* /auth/me unreachable and no cached role → show everything, matching
   pageGuard's fail-open rule (never trap a user on a transient error). */
html[data-role="unknown"]     .top-nav [data-nav-href] { display: flex; }