akv-manager 0.0.1 → 0.0.4

package/public/styles.css

@@ -0,0 +1,369 @@
+  :root{
+    --ink:#0A0D14; --ink2:#0C1019;
+    --panel:#121826; --panel2:#0E141F; --raise:#171F2E;
+    --line:#222C3E; --line2:#1A2233;
+    --text:#E6EBF2; --muted:#79859B; --faint:#4C586E;
+    --azure:#5B9DFF; --azure2:#3F86F0; --azuredim:rgba(91,157,255,.12);
+    --ok:#46D6B4; --warn:#F2B53D; --alert:#FF5C6C; --bad:#FF5C6C; --good:#46D6B4;
+    --violet:#A98BFF;
+    --r:12px; --r-sm:8px;
+    --shadow:0 18px 40px -22px rgba(0,0,0,.8);
+    --mono:'IBM Plex Mono',ui-monospace,SFMono-Regular,Menlo,monospace;
+    --sans:'IBM Plex Sans',-apple-system,BlinkMacSystemFont,sans-serif;
+  }
+  *{box-sizing:border-box}
+  html,body{margin:0}
+  body{font-family:var(--sans);font-size:14px;line-height:1.5;color:var(--text);min-height:100vh;
+       background:
+         radial-gradient(900px 500px at 88% -8%,rgba(91,157,255,.07),transparent 60%),
+         linear-gradient(180deg,var(--ink2),var(--ink));
+       -webkit-font-smoothing:antialiased}
+  ::selection{background:rgba(91,157,255,.32)}
+  a{color:var(--azure);text-decoration:none}
+  :focus-visible{outline:2px solid var(--azure);outline-offset:2px;border-radius:4px}
+  .mono{font-family:var(--mono);font-variant-numeric:tabular-nums}
+  .muted{color:var(--muted)} .faint{color:var(--faint)} .right{text-align:right}
+  .hide{display:none!important}
+  .eyebrow{font-family:var(--mono);font-size:10.5px;font-weight:500;letter-spacing:.18em;
+           text-transform:uppercase;color:var(--faint)}
+
+  /* page skeleton (.app grid, main, .topbar) now uses Tailwind utilities in index.html */
+
+  /* ---------- sidebar ---------- */
+  aside{background:linear-gradient(180deg,rgba(255,255,255,.015),transparent),var(--panel2);
+        border-right:1px solid var(--line);padding:22px 14px;display:flex;flex-direction:column;
+        position:sticky;top:0;height:100vh}
+  .brand{display:flex;align-items:center;gap:11px;padding:0 6px 20px}
+  .brand .mark{width:34px;height:34px;flex:none}
+  .brand .wm{font-family:var(--mono);font-weight:600;font-size:13px;letter-spacing:.14em;color:var(--text);line-height:1.15}
+  .brand .wm small{display:block;font-size:9.5px;letter-spacing:.22em;color:var(--faint);font-weight:400;margin-top:2px}
+  .navlabel{font-family:var(--mono);font-size:9.5px;letter-spacing:.2em;color:var(--faint);
+            text-transform:uppercase;padding:14px 10px 7px}
+  nav button{display:flex;align-items:center;gap:11px;width:100%;text-align:left;background:transparent;
+             border:0;color:var(--muted);padding:9px 11px;border-radius:var(--r-sm);cursor:pointer;
+             font-family:var(--sans);font-size:13.5px;font-weight:500;position:relative;transition:.15s}
+  nav button svg{width:17px;height:17px;flex:none;opacity:.8}
+  nav button:hover{background:rgba(255,255,255,.03);color:var(--text)}
+  nav button.active{background:var(--azuredim);color:#fff}
+  nav button.active svg{opacity:1;color:var(--azure)}
+  nav button.active::before{content:"";position:absolute;left:-14px;top:7px;bottom:7px;width:3px;
+                            background:var(--azure);border-radius:0 3px 3px 0}
+  .who{margin-top:auto;font-size:12px;color:var(--muted);border-top:1px solid var(--line2);
+       padding:14px 8px 4px;line-height:1.6}
+  .who b{color:var(--text);font-weight:600}
+  .who .mono{font-size:11px}
+  .dot{width:7px;height:7px;border-radius:50%;display:inline-block;vertical-align:middle}
+  .ver{font-size:10px;letter-spacing:.04em;padding:8px 8px 2px}
+
+  /* ---------- main ---------- */
+  h1{font-size:23px;font-weight:600;margin:4px 0 0;letter-spacing:-.01em}
+  .sub{color:var(--muted);font-size:13px;margin-top:3px;max-width:62ch}
+  .row{display:flex;gap:10px;align-items:center;flex-wrap:wrap}
+
+  .btn{font-family:var(--sans);font-weight:500;font-size:13px;border:0;border-radius:var(--r-sm);
+       padding:9px 15px;cursor:pointer;color:#06101f;background:var(--azure);transition:.15s}
+  .btn:hover{background:#75AEFF}
+  .btn:disabled{opacity:.55;cursor:default}
+  .btn.ghost{background:var(--raise);color:var(--text);border:1px solid var(--line)}
+  .btn.ghost:hover{border-color:var(--azure);background:var(--raise)}
+  .btn.sm{padding:5px 11px;font-size:12px}
+  input.search{font-family:var(--mono);background:var(--panel2);border:1px solid var(--line);color:var(--text);
+       padding:9px 13px;border-radius:var(--r-sm);min-width:320px;font-size:12.5px}
+  input.search::placeholder{color:var(--faint)}
+  input.search:focus{outline:none;border-color:var(--azure);background:var(--panel)}
+
+  /* ---------- KPI cards ---------- */
+  .cards{display:grid;grid-template-columns:repeat(auto-fill,minmax(190px,1fr));gap:13px;margin-bottom:24px}
+  .card{background:linear-gradient(180deg,var(--panel),var(--panel2));border:1px solid var(--line);
+        border-radius:var(--r);padding:15px 17px;position:relative;overflow:hidden}
+  .card::after{content:"";position:absolute;inset:0 0 auto;height:2px;background:var(--line)}
+  .card .k{font-family:var(--mono);color:var(--muted);font-size:10.5px;text-transform:uppercase;letter-spacing:.13em}
+  .card .v{font-family:var(--mono);font-size:30px;font-weight:600;margin-top:9px;line-height:1;letter-spacing:-.02em}
+  .card .v small{font-family:var(--sans);font-size:12px;font-weight:400;color:var(--muted);letter-spacing:0}
+  .card--alert::after{background:var(--alert)} .card--alert .v{color:#FF8893}
+  .card--warn::after{background:var(--warn)} .card--warn .v{color:#FBC56B}
+  .card--azure::after{background:var(--azure)} .card--azure .v{color:#8FBEFF}
+
+  /* ---------- chips ---------- */
+  .chips{display:flex;gap:8px;flex-wrap:wrap;margin-bottom:16px}
+  .chip{font-family:var(--mono);background:var(--panel2);border:1px solid var(--line);color:var(--muted);
+        padding:6px 12px;border-radius:7px;cursor:pointer;font-size:11.5px;display:flex;gap:8px;align-items:center;transition:.15s}
+  .chip:hover{color:var(--text);border-color:var(--line)}
+  .chip.active{border-color:var(--azure);color:#fff;background:var(--azuredim)}
+  .chip .n{background:var(--ink);border-radius:5px;padding:1px 7px;font-size:10.5px;color:var(--muted)}
+  .chip.active .n{color:var(--azure)}
+
+  /* ---------- panel + table ---------- */
+  .panel{background:var(--panel);border:1px solid var(--line);border-radius:var(--r);overflow:hidden;box-shadow:var(--shadow)}
+  table{width:100%;border-collapse:collapse;font-size:13px}
+  th,td{padding:11px 16px;text-align:left;border-bottom:1px solid var(--line2);white-space:nowrap}
+  thead th{position:sticky;top:0;z-index:2;background:var(--panel2);color:var(--muted);font-weight:500;
+           font-family:var(--mono);font-size:10.5px;text-transform:uppercase;letter-spacing:.1em;
+           cursor:pointer;user-select:none}
+  thead th:hover{color:var(--text)}
+  tbody tr{transition:background .12s}
+  tbody tr:hover{background:rgba(91,157,255,.05)}
+  tbody tr:last-child td{border-bottom:0}
+  td.mono,.mono{font-family:var(--mono);font-size:12.5px}
+  td b{font-weight:600}
+
+  .tag{display:inline-flex;align-items:center;font-family:var(--mono);font-size:10px;font-weight:500;
+       letter-spacing:.08em;text-transform:uppercase;padding:2px 7px;border-radius:5px;border:1px solid transparent}
+  .tag.e-dev{color:#7FE0C8;background:rgba(70,214,180,.10);border-color:rgba(70,214,180,.22)}
+  .tag.e-test{color:#7FD0E0;background:rgba(70,180,214,.10);border-color:rgba(70,180,214,.22)}
+  .tag.e-qa{color:#93C0FF;background:rgba(91,157,255,.12);border-color:rgba(91,157,255,.24)}
+  .tag.e-stage{color:#F4C977;background:rgba(242,181,61,.10);border-color:rgba(242,181,61,.22)}
+  .tag.e-prod{color:#FF9BA4;background:rgba(255,92,108,.10);border-color:rgba(255,92,108,.26)}
+  .tag.e-sandbox{color:#BCA8FF;background:rgba(169,139,255,.10);border-color:rgba(169,139,255,.22)}
+  .tag.e-other{color:var(--muted);background:rgba(255,255,255,.04);border-color:var(--line)}
+
+  .pill{font-family:var(--mono);font-size:10px;letter-spacing:.06em;color:var(--muted);
+        border:1px solid var(--line);border-radius:5px;padding:1px 7px;white-space:nowrap}
+  .pill.rbac{color:#7FE0C8;border-color:rgba(70,214,180,.3)}
+  .pill.policy{color:#F4C977;border-color:rgba(242,181,61,.3)}
+  .sev{font-family:var(--mono);font-size:10px;letter-spacing:.1em;padding:2px 8px;border-radius:5px;border:1px solid}
+  .sev.expired{color:#FF8893;background:rgba(255,92,108,.12);border-color:rgba(255,92,108,.32)}
+  .sev.urgent{color:#FBC56B;background:rgba(242,181,61,.12);border-color:rgba(242,181,61,.32)}
+  .sev.ok{color:var(--muted);border-color:var(--line);background:transparent}
+
+  .iconbtn{font-family:var(--mono);background:var(--raise);border:1px solid var(--line);color:var(--muted);
+           border-radius:6px;padding:4px 9px;cursor:pointer;font-size:11.5px;transition:.15s}
+  .iconbtn:hover{color:#fff;border-color:var(--azure)}
+  .empty{padding:48px 24px;text-align:center;color:var(--muted)}
+  .scroll{max-height:calc(100vh - 380px);overflow:auto}
+  .scroll::-webkit-scrollbar{width:10px;height:10px}
+  .scroll::-webkit-scrollbar-thumb{background:var(--line);border-radius:8px;border:2px solid var(--panel)}
+  .tablenote{font-family:var(--mono);font-size:11px;color:var(--faint);margin-top:10px}
+
+  /* ---------- signature: expiry horizon ---------- */
+  .horizon{padding:18px 20px;margin-bottom:22px}
+  .hz-head{display:flex;justify-content:space-between;align-items:baseline;margin-bottom:14px}
+  .hz-body{display:flex;gap:12px;height:104px}
+  .hz-expired{position:relative;width:118px;flex:none;border:1px solid rgba(255,92,108,.28);
+              background:linear-gradient(180deg,rgba(255,92,108,.12),rgba(255,92,108,.02));
+              border-radius:10px;display:flex;flex-direction:column;align-items:center;justify-content:center;overflow:hidden}
+  .hz-expired-n{font-family:var(--mono);font-size:30px;font-weight:600;color:#FF8893;line-height:1}
+  .hz-expired-l{font-family:var(--mono);font-size:9.5px;letter-spacing:.18em;color:#FF8893;margin-top:3px}
+  .hz-axis{position:relative;flex:1;border:1px solid var(--line);border-radius:10px;
+           background:linear-gradient(180deg,rgba(255,255,255,.015),transparent);overflow:hidden}
+  .hz-grid{position:absolute;top:0;bottom:0;border-left:1px dashed var(--line);}
+  .hz-grid:first-of-type{border-left-color:rgba(91,157,255,.35)}
+  .hz-grid span{position:absolute;bottom:7px;left:6px;font-family:var(--mono);font-size:9.5px;color:var(--faint);white-space:nowrap}
+  .hz-tick{position:absolute;top:12px;bottom:26px;width:2px;border-radius:2px;background:var(--ok);
+           transform:translateX(-1px);opacity:.9}
+  .hz-tick.warn{background:var(--warn)} .hz-tick.alert{background:var(--alert)}
+  .hz-tick:hover{opacity:1;width:3px;box-shadow:0 0 8px currentColor}
+  .hz-expired .hz-tick{top:auto;bottom:9px;height:16px;opacity:.7}
+  .hz-legend{display:flex;gap:16px;align-items:center}
+  .hz-legend span{font-family:var(--mono);font-size:10px;color:var(--muted);display:flex;align-items:center;gap:5px}
+  .hz-legend i{width:8px;height:8px;border-radius:2px;display:inline-block}
+
+  /* ---------- segmented + window ---------- */
+  .seg{display:inline-flex;gap:4px;background:var(--panel2);border:1px solid var(--line);
+       border-radius:var(--r-sm);padding:3px}
+  .seg button{font-family:var(--mono);background:transparent;border:0;color:var(--muted);padding:6px 12px;
+              border-radius:6px;cursor:pointer;font-size:12px;transition:.15s}
+  .seg button:hover{color:var(--text)}
+  .seg button.active{background:var(--raise);color:#fff;box-shadow:0 1px 0 rgba(0,0,0,.4)}
+
+  /* ---------- drawer ---------- */
+  .overlay{position:fixed;inset:0;background:rgba(5,8,14,.6);backdrop-filter:blur(2px);opacity:0;
+           pointer-events:none;transition:.25s;z-index:30}
+  .overlay.show{opacity:1;pointer-events:auto}
+  .drawer{position:fixed;top:0;right:0;height:100vh;width:100vw;max-width:100vw;background:var(--panel);
+          border-left:1px solid var(--line);box-shadow:-30px 0 80px -30px rgba(0,0,0,.9);
+          transform:translateX(100%);transition:transform .28s cubic-bezier(.2,.7,.2,1);z-index:40;
+          display:flex;flex-direction:column}
+  .drawer.open{transform:translateX(0)}
+  .drawer header{padding:20px 22px;border-bottom:1px solid var(--line);display:flex;
+                 justify-content:space-between;align-items:flex-start;gap:14px}
+  .drawer header .dt{font-family:var(--mono);font-size:16px;font-weight:600;word-break:break-all}
+  .drawer .body{padding:18px 22px;overflow:auto}
+  .kvitem{border-bottom:1px solid var(--line2)}
+  .kvitem:last-child{border-bottom:0}
+  .kvitem.sel{background:rgba(91,157,255,.06);margin:0 -22px;padding:0 22px}
+  .kvline{display:flex;align-items:center;gap:10px;padding:10px 0}
+  .kvline .nm{flex:1 1 auto;min-width:60px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-family:var(--mono);font-size:12.5px}
+  .kvline .meta{display:flex;align-items:center;gap:8px;flex:0 0 auto}
+  .kvline input[type=checkbox]{flex:0 0 auto}
+  .revealed{padding:0 0 12px;display:flex;align-items:flex-start;gap:8px}
+  .revealed code.val{display:block;flex:1;min-width:0;background:var(--ink);border:1px solid var(--line);
+                     border-radius:6px;padding:8px 10px;max-height:120px;overflow:auto}
+  .cmd{background:var(--ink);border:1px solid var(--line);border-radius:var(--r-sm);padding:10px 12px;
+       margin:8px 0;font-family:var(--mono);font-size:11.5px;color:#A9D2FF;display:flex;justify-content:space-between;gap:10px;align-items:center}
+  .secthead{font-family:var(--mono);margin:24px 0 6px;color:var(--faint);font-size:10px;text-transform:uppercase;letter-spacing:.16em}
+  .loadval{font-family:var(--mono);font-size:11px;color:var(--azure);cursor:pointer;background:none;border:0;text-decoration:underline}
+  code.val{font-family:var(--mono);user-select:all;color:#A9D2FF;font-size:11.5px;word-break:break-all}
+  /* drawer edit + batch */
+  .dtools{display:flex;align-items:center;gap:12px;margin-top:14px}
+  .dtools .search{min-width:0;flex:1;padding:8px 11px}
+  .selall{font-family:var(--mono);font-size:11px;color:var(--muted);display:flex;align-items:center;gap:6px;cursor:pointer;white-space:nowrap}
+  input[type=checkbox]{accent-color:var(--azure);width:14px;height:14px;cursor:pointer}
+  .batchbar{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:12px;padding:10px 12px;
+            background:var(--azuredim);border:1px solid rgba(91,157,255,.4);border-radius:var(--r-sm)}
+  .batchbar .bn{font-family:var(--mono);font-size:12px;color:#cfe2ff;margin-right:2px}
+  .batchbar input[type=date]{font-family:var(--mono);font-size:12px;background:var(--ink);border:1px solid var(--line);
+            color:var(--text);border-radius:6px;padding:5px 8px;color-scheme:dark}
+  .editor{margin:0 -22px;padding:14px 22px;background:var(--panel2);border-top:1px solid var(--line2)}
+  /* create panel */
+  .createp{margin-top:12px;padding:16px;background:var(--panel2);border:1px solid var(--azure);border-radius:var(--r-sm)}
+  .createp h4{margin:0 0 12px;font-family:var(--mono);font-size:12px;color:#cfe2ff;font-weight:500;letter-spacing:.04em}
+  .createp .fld{display:flex;align-items:center;gap:10px;margin-bottom:10px}
+  .createp label{font-family:var(--mono);font-size:11px;color:var(--muted);width:72px;flex:none}
+  .createp input[type=text],.createp input[type=date],.createp textarea{font-family:var(--mono);font-size:12px;
+    background:var(--ink);border:1px solid var(--line);color:var(--text);border-radius:6px;padding:8px 10px;flex:1;width:100%;color-scheme:dark}
+  .createp textarea{min-height:120px;resize:vertical;line-height:1.6}
+  .createp .actions{display:flex;gap:8px;align-items:center;margin-top:6px}
+  .newbtns{display:flex;gap:6px;margin-left:auto}
+  .editor .fld{display:flex;align-items:center;gap:10px;margin-bottom:10px}
+  .editor label{font-family:var(--mono);font-size:11px;color:var(--muted);width:78px;flex:none}
+  .editor input[type=text],.editor input[type=date]{font-family:var(--mono);font-size:12px;background:var(--ink);
+            border:1px solid var(--line);color:var(--text);border-radius:6px;padding:7px 9px;flex:1;color-scheme:dark}
+  .editor input[type=date],.createp input[type=date]{flex:0 0 auto;width:200px}
+  .editor .hint{font-family:var(--mono);font-size:10.5px;color:var(--faint)}
+  .toggle{display:flex;align-items:center;gap:7px;font-family:var(--mono);font-size:12px;color:var(--text);cursor:pointer}
+
+  /* ---------- misc ---------- */
+  .toast{position:fixed;bottom:24px;left:50%;transform:translateX(-50%) translateY(20px);
+         background:var(--raise);border:1px solid var(--azure);color:#fff;padding:10px 18px;
+         border-radius:var(--r-sm);opacity:0;transition:.25s;z-index:60;font-size:13px}
+  .toast.show{opacity:1;transform:translateX(-50%) translateY(0)}
+  .banner{background:linear-gradient(180deg,rgba(255,92,108,.14),rgba(255,92,108,.04));
+          border:1px solid rgba(255,92,108,.4);color:#FFC4C9;padding:13px 16px;border-radius:var(--r);
+          margin-bottom:18px;display:none;font-size:13px}
+  .banner.show{display:block}
+  .banner code{font-family:var(--mono);background:rgba(0,0,0,.3);padding:1px 6px;border-radius:4px;color:#fff}
+  .spin{width:18px;height:18px;border:2px solid var(--line);border-top-color:var(--azure);border-radius:50%;
+        display:inline-block;animation:spin .7s linear infinite;vertical-align:-4px}
+  @keyframes spin{to{transform:rotate(360deg)}}
+  .progress{width:64%;max-width:380px;height:6px;background:var(--ink);border:1px solid var(--line);
+            border-radius:999px;margin:16px auto 0;overflow:hidden}
+  .progress .bar{height:100%;background:linear-gradient(90deg,var(--azure),var(--ok));border-radius:999px;transition:width .4s}
+
+  /* ---------- sidebar: pinned / recent + account switcher ---------- */
+  .navpins{display:flex;flex-direction:column;gap:1px;margin:2px 0 4px}
+  .navpin{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:transparent;border:0;
+          color:var(--muted);padding:6px 11px;border-radius:var(--r-sm);cursor:pointer;font-family:var(--mono);
+          font-size:11.5px;transition:.12s;overflow:hidden}
+  .navpin:hover{background:rgba(255,255,255,.03);color:var(--text)}
+  .navpin.active{background:var(--azuredim);color:#fff}
+  .navpin .pn{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .navpin .star{color:var(--warn);font-size:10px;flex:none}
+  .navpin .env-dot{width:6px;height:6px;border-radius:50%;flex:none}
+  .navempty{font-family:var(--mono);font-size:10.5px;color:var(--faint);padding:4px 12px}
+  .acct{margin-top:auto;border-top:1px solid var(--line2);padding-top:10px}
+  .acctbtn{display:flex;align-items:center;gap:9px;width:100%;text-align:left;background:transparent;border:0;
+           color:var(--muted);padding:8px;border-radius:var(--r-sm);cursor:pointer;font-size:12px;transition:.12s;line-height:1.5}
+  .acctbtn:hover{background:rgba(255,255,255,.03)}
+  .acctbtn b{color:var(--text);font-weight:600}
+  .acctbtn .chev{margin-left:auto;color:var(--faint);flex:none}
+
+  /* ---------- command palette (⌘K) ---------- */
+  .cmdk-ov{position:fixed;inset:0;background:rgba(5,8,14,.55);backdrop-filter:blur(3px);opacity:0;
+           pointer-events:none;transition:.14s;z-index:70;display:flex;align-items:flex-start;justify-content:center;padding-top:12vh}
+  .cmdk-ov.show{opacity:1;pointer-events:auto}
+  .cmdk{width:min(640px,92vw);background:var(--panel);border:1px solid var(--line);border-radius:14px;
+        box-shadow:0 40px 90px -30px rgba(0,0,0,.85);overflow:hidden;transform:translateY(-8px);transition:.16s}
+  .cmdk-ov.show .cmdk{transform:translateY(0)}
+  .cmdk-in{display:flex;align-items:center;gap:11px;padding:15px 18px;border-bottom:1px solid var(--line)}
+  .cmdk-in svg{width:17px;height:17px;color:var(--faint);flex:none}
+  .cmdk-in input{flex:1;background:transparent;border:0;outline:0;color:var(--text);font-family:var(--sans);font-size:15px}
+  .cmdk-in input::placeholder{color:var(--faint)}
+  .cmdk-in kbd{font-family:var(--mono);font-size:10px;color:var(--faint);border:1px solid var(--line);border-radius:5px;padding:2px 6px}
+  .cmdk-list{max-height:54vh;overflow:auto;padding:7px}
+  .cmdk-sec{font-family:var(--mono);font-size:9.5px;letter-spacing:.16em;text-transform:uppercase;color:var(--faint);padding:9px 11px 5px}
+  .cmdk-it{display:flex;align-items:center;gap:11px;padding:9px 11px;border-radius:8px;cursor:pointer}
+  .cmdk-it .ico{width:16px;height:16px;color:var(--muted);flex:none}
+  .cmdk-it .lbl{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;font-size:13.5px}
+  .cmdk-it .lbl small{color:var(--faint);font-family:var(--mono);font-size:11px;margin-left:8px}
+  .cmdk-it .hint{font-family:var(--mono);font-size:10px;color:var(--faint)}
+  .cmdk-it.cur{background:var(--azuredim)}
+  .cmdk-it.cur .ico{color:var(--azure)}
+  .cmdk-empty{padding:26px;text-align:center;color:var(--muted);font-size:13px}
+
+  /* ---------- dashboard ---------- */
+  .actcards{display:grid;grid-template-columns:repeat(auto-fill,minmax(210px,1fr));gap:13px;margin-bottom:26px}
+  .actcard{display:block;text-align:left;background:linear-gradient(180deg,var(--panel),var(--panel2));
+           border:1px solid var(--line);border-radius:var(--r);padding:16px 17px;cursor:pointer;position:relative;
+           overflow:hidden;transition:.15s;font-family:inherit}
+  .actcard::after{content:"";position:absolute;inset:0 0 auto;height:2px;background:var(--line)}
+  .actcard:hover{border-color:var(--azure);transform:translateY(-1px)}
+  .actcard .k{display:flex;align-items:center;gap:8px;font-family:var(--mono);color:var(--muted);font-size:10.5px;
+              text-transform:uppercase;letter-spacing:.12em}
+  .actcard .k svg{width:14px;height:14px}
+  .actcard .v{font-family:var(--mono);font-size:32px;font-weight:600;margin-top:11px;line-height:1;letter-spacing:-.02em}
+  .actcard .sub{font-family:var(--sans);font-size:12px;color:var(--muted);margin-top:6px}
+  .actcard.sev-alert::after{background:var(--alert)} .actcard.sev-alert .v{color:#FF8893}
+  .actcard.sev-warn::after{background:var(--warn)} .actcard.sev-warn .v{color:#FBC56B}
+  .actcard.sev-azure::after{background:var(--azure)} .actcard.sev-azure .v{color:#8FBEFF}
+  .actcard.sev-ok::after{background:var(--ok)} .actcard.sev-ok .v{color:#7FE0C8}
+  .dashgrid{display:grid;grid-template-columns:1fr 1fr;gap:22px;align-items:start}
+  @media (max-width:1100px){.dashgrid{grid-template-columns:1fr}}
+  .secthead2{display:flex;align-items:center;justify-content:space-between;margin:0 0 12px}
+  .secthead2 .eyebrow{font-size:11px}
+  .vtiles{display:flex;flex-direction:column;gap:7px}
+  .vtile{display:flex;align-items:center;gap:11px;background:var(--panel);border:1px solid var(--line);
+         border-radius:10px;padding:11px 13px;cursor:pointer;transition:.13s}
+  .vtile:hover{border-color:var(--azure);background:var(--raise)}
+  .vtile .star{color:var(--warn);font-size:12px;flex:none;background:none;border:0;cursor:pointer;padding:0}
+  .vtile .star.off{color:var(--faint)}
+  .vtile .nm{flex:1;font-family:var(--mono);font-size:12.5px;font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+  .vtile .rg{font-family:var(--mono);font-size:11px;color:var(--faint);overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:40%}
+
+  /* ---------- facets (tag filtering) ---------- */
+  .facets{display:flex;gap:10px;flex-wrap:wrap;align-items:center;margin-bottom:14px}
+  .facet{display:flex;align-items:center;gap:6px}
+  .facet label{font-family:var(--mono);font-size:10px;letter-spacing:.1em;text-transform:uppercase;color:var(--faint)}
+  select.facetsel{font-family:var(--mono);font-size:12px;background:var(--panel2);border:1px solid var(--line);
+                  color:var(--text);border-radius:7px;padding:6px 9px;cursor:pointer;color-scheme:dark;max-width:200px}
+  select.facetsel:focus{outline:none;border-color:var(--azure)}
+  select.facetsel.on{border-color:var(--azure);color:#fff}
+  .facetclear{font-family:var(--mono);font-size:11px;color:var(--azure);background:none;border:0;cursor:pointer}
+
+  /* ---------- tag chips + editor ---------- */
+  .tagchips{display:flex;gap:5px;flex-wrap:wrap}
+  .tagchip{font-family:var(--mono);font-size:10px;color:var(--muted);background:rgba(255,255,255,.04);
+           border:1px solid var(--line);border-radius:5px;padding:1px 7px;white-space:nowrap}
+  .tagchip b{color:var(--text);font-weight:500}
+  .tagedit{display:flex;flex-direction:column;gap:9px;max-width:680px}
+  .tagrow{display:flex;align-items:center;gap:9px}
+  .tagrow input{font-family:var(--mono);font-size:12px;background:var(--ink);border:1px solid var(--line);
+                color:var(--text);border-radius:6px;padding:8px 10px;color-scheme:dark}
+  .tagrow .tk{width:230px;flex:none} .tagrow .tv{flex:1}
+  .tagrow .del{flex:none}
+  .tagrow.fixed input{opacity:.6}
+
+  /* ---------- routed vault page ---------- */
+  .vhead{margin-bottom:18px}
+  .crumb{display:flex;align-items:center;gap:9px;flex-wrap:wrap;margin-bottom:6px}
+  .crumb a{font-family:var(--mono);font-size:12px;color:var(--muted)}
+  .crumb a:hover{color:var(--text)}
+  .crumb .sep{color:var(--faint)}
+  .crumb .here{font-family:var(--mono);font-size:16px;font-weight:600;color:var(--text);word-break:break-all}
+  .star{background:none;border:0;cursor:pointer;color:var(--faint);font-size:16px;padding:0 2px;line-height:1}
+  .star.on{color:var(--warn)}
+  .vmeta{display:flex;align-items:center;gap:9px;flex-wrap:wrap;font-family:var(--mono);font-size:11.5px;color:var(--muted)}
+  .vmeta .mono{word-break:break-all}
+  .tabs{display:flex;gap:2px;border-bottom:1px solid var(--line);margin-bottom:16px}
+  .tabs button{font-family:var(--sans);font-size:13px;font-weight:500;background:transparent;border:0;
+               color:var(--muted);padding:10px 15px;cursor:pointer;position:relative;transition:.12s}
+  .tabs button:hover{color:var(--text)}
+  .tabs button.active{color:#fff}
+  .tabs button.active::after{content:"";position:absolute;left:0;right:0;bottom:-1px;height:2px;background:var(--azure)}
+  .tabs button .c{font-family:var(--mono);font-size:10.5px;color:var(--faint);margin-left:6px}
+  .vtools{display:flex;flex-direction:column;gap:10px;margin-bottom:6px}
+  .vtools-row{display:flex;align-items:center;gap:12px;flex-wrap:wrap}
+  .vtools-row .search{flex:1;min-width:0}
+  .vtools-actions{margin-left:auto;display:flex;gap:7px}
+  .stick{position:sticky;top:0;z-index:5}
+  .itemwrap{margin-top:8px}
+
+  @media (max-width:900px){
+    /* .app grid + main padding handled by Tailwind max-[900px]: utilities */
+    aside{position:static;height:auto;flex-direction:row;flex-wrap:wrap;align-items:center}
+    aside nav{display:flex;gap:4px;flex-wrap:wrap} .navlabel{display:none} .who{display:none}
+    .navpins,.acct{display:none}
+    input.search{min-width:180px}
+    .dashgrid{grid-template-columns:1fr}
+  }
+  @media (prefers-reduced-motion:reduce){*{animation-duration:.01ms!important;transition:none!important}}

package/server.js

@@ -31,17 +31,25 @@ const SUB_RE = /^[0-9a-fA-F-]{1,40}$|^[\w .()-]{1,80}$/; // sub id or display na
 
 function isValidName(v) { return typeof v === 'string' && NAME_RE.test(v); }
 
-/** Run az with an args array (no shell => no injection). Returns parsed JSON. */
+/** Run az with an args array. Returns parsed JSON.
+ *  az() only runs trusted, fixed commands (get-access-token / logout) — never user
+ *  input — so enabling the shell on Windows (required to launch az.cmd) is safe here. */
 function az(args, { json = true } = {}) {
   const finalArgs = json ? [...args, '--output', 'json'] : args;
+  const isWin = process.platform === 'win32';
   return new Promise((resolve, reject) => {
-    execFile(AZ, finalArgs, { timeout: AZ_TIMEOUT, maxBuffer: 64 * 1024 * 1024 },
-      (err, stdout, stderr) => {
+    execFile(AZ, finalArgs, {
+      timeout: AZ_TIMEOUT, maxBuffer: 64 * 1024 * 1024,
+      shell: isWin,          // on Windows the CLI is `az.cmd`; execFile can't run it without a shell
+      windowsHide: true,
+    }, (err, stdout, stderr) => {
         if (err) {
           const msg = (stderr || err.message || '').trim();
-          return reject(Object.assign(new Error(msg || 'az command failed'), {
-            azError: true,
-            needLogin: /AADSTS70043|refresh token|az login|InvalidAuthenticationToken|expired/i.test(msg),
+          const notFound = err.code === 'ENOENT' || /not recognized|cannot find the (path|file)|ENOENT/i.test(msg);
+          return reject(Object.assign(new Error(
+            notFound ? `Azure CLI not found (tried "${AZ}"). Install the Azure CLI, or set AZ_PATH to its full path.` : (msg || 'az command failed')), {
+            azError: true, notFound,
+            needLogin: /AADSTS70043|refresh token|please run ['"]?az login|InvalidAuthenticationToken|expired|no subscription|not logged in/i.test(msg),
             forbidden: /Forbidden|does not have secrets|AccessDenied|not authorized|403/i.test(msg),
             stderr: msg, args: finalArgs,
           }));
@@ -260,7 +268,8 @@ const VAULT_QUERY =
   "| project name, resourceGroup, subscriptionId, location, " +
   "sku=tostring(properties.sku.name), " +
   "enableRbac=tostring(properties.enableRbacAuthorization), " +
-  "uri=tostring(properties.vaultUri) | order by name asc";
+  "uri=tostring(properties.vaultUri), tags " +
+  "| order by name asc";
 
 async function listVaultsRaw(force) {
   if (!force && vaultCache.data && Date.now() - vaultCache.at < VAULT_TTL) return vaultCache.data;
@@ -284,6 +293,65 @@ app.get('/api/vaults', async (req, res) => {
   }
 });
 
+// Find a vault's management-plane coordinates (sub + rg) from the cached inventory.
+async function findVaultMeta(name) {
+  const vaults = await listVaultsRaw();
+  return vaults.find((v) => (v.name || '').toLowerCase() === name.toLowerCase());
+}
+
+// "Default" / governance tags that this tool must never edit or remove — they are
+// applied by Azure Policy / automation and are read-only here. Patterns are matched
+// case-insensitively; a trailing '*' is a prefix wildcard (e.g. "automation.*").
+// Operators can override the whole list with AZBO_PROTECTED_TAGS (comma-separated);
+// set it to an empty string to disable protection entirely.
+const PROTECTED_TAGS = (() => {
+  const def = ['env', 'environment', 'cost-center', 'costcenter', 'contact-*', 'owner',
+    'solution', 'location', 'roles', 'managed-by', 'managedby',
+    'expirationdate', 'runninginterval', 'automation.*', 'hidden-*'];
+  const raw = process.env.AZBO_PROTECTED_TAGS;
+  if (raw === undefined) return def;
+  return raw.split(',').map((s) => s.trim()).filter(Boolean);
+})();
+function tagMatch(pattern, key) {
+  const p = pattern.toLowerCase(), k = String(key).toLowerCase();
+  return p.endsWith('*') ? k.startsWith(p.slice(0, -1)) : k === p;
+}
+function isProtectedTag(key) { return PROTECTED_TAGS.some((p) => tagMatch(p, key)); }
+
+// Replace a vault's tag set (management plane). The body's `tags` object is the
+// COMPLETE desired set — Key Vault's PATCH overwrites the whole tags collection.
+// Protected/default tags are force-preserved from the current state, so they can be
+// neither edited nor removed regardless of what the client sends.
+// Requires management-plane write (e.g. Contributor / Tag Contributor) on the vault.
+app.put('/api/vaults/:name/tags', (req, res) => {
+  const { name } = req.params;
+  if (!isValidName(name)) return res.status(400).json({ ok: false, error: 'Invalid vault name' });
+  const { tags } = req.body || {};
+  if (!tags || typeof tags !== 'object' || Array.isArray(tags))
+    return res.status(400).json({ ok: false, error: 'tags must be an object of name → value' });
+  const entries = Object.entries(tags);
+  if (entries.length > 50) return res.status(400).json({ ok: false, error: 'Azure allows at most 50 tags per resource' });
+  for (const [k, v] of entries) {
+    if (typeof k !== 'string' || !k.length || k.length > 512) return res.status(400).json({ ok: false, error: `Invalid tag name: ${k}` });
+    if (typeof v !== 'string' || v.length > 256) return res.status(400).json({ ok: false, error: `Invalid value for tag "${k}" (max 256 chars)` });
+  }
+  send(res, (async () => {
+    const v = await findVaultMeta(name);
+    if (!v) throw new Error('Vault not found in inventory — try Refresh first');
+    const current = v.tags || {};
+    // Start from the client's desired set, then force every protected tag that exists
+    // today back to its original value — this blocks edit AND removal of default tags.
+    const finalTags = {};
+    for (const [k, val] of entries) { if (!isProtectedTag(k)) finalTags[k] = val; }
+    for (const [k, val] of Object.entries(current)) { if (isProtectedTag(k)) finalTags[k] = val; }
+    const url = `/subscriptions/${v.subscriptionId}/resourceGroups/${v.resourceGroup}` +
+                `/providers/Microsoft.KeyVault/vaults/${name}?api-version=2023-07-01`;
+    const out = await armFetch(url, { method: 'PATCH', body: { tags: finalTags } });
+    v.tags = (out && out.tags) || finalTags;     // reflect immediately in the cached inventory
+    return { tags: v.tags };
+  })());
+});
+
 // ---- API: expiring secrets & certificates (scans every readable vault) -----
 
 /** Run async worker over items with bounded concurrency. */
@@ -524,8 +592,10 @@ const ENV_RULES = (() => {
   try { return process.env.AZBO_ENV_RULES ? JSON.parse(process.env.AZBO_ENV_RULES) : null; }
   catch { console.warn('  AZBO_ENV_RULES is not valid JSON — ignoring.'); return null; }
 })();
+const PKG_VERSION = (() => { try { return require('./package.json').version; } catch { return null; } })();
 app.get('/api/config', (req, res) =>
-  res.json({ ok: true, data: { envRules: ENV_RULES, title: process.env.AZBO_TITLE || null } }));
+  res.json({ ok: true, data: { envRules: ENV_RULES, title: process.env.AZBO_TITLE || null,
+    version: PKG_VERSION, protectedTags: PROTECTED_TAGS } }));
 
 function openBrowser(url) {
   if (process.env.AZBO_NO_OPEN) return;