-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
4525 lines (4158 loc) · 235 KB
/
Copy pathindex.html
File metadata and controls
4525 lines (4158 loc) · 235 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Cacheboard</title>
<!-- Tailwind, vendored.
This replaces the Tailwind Play CDN script tag. That script executed
third-party JS on every load of a page holding API keys and OAuth
tokens, and could not be integrity-pinned. What follows is the
generated CSS for the ~90 utility classes this file actually uses,
plus Tailwind's preflight reset. Nothing is fetched at runtime, so the
page also styles correctly offline / opened directly from disk.
Adding a NEW utility class to the markup means adding its rule here. -->
<style>
/* --- preflight (trimmed to what this page relies on) --- */
*, ::before, ::after { box-sizing: border-box; border-width: 0; border-style: solid; border-color: #e5e7eb; }
html { line-height: 1.5; -webkit-text-size-adjust: 100%; font-family: ui-sans-serif, system-ui, sans-serif; }
body { margin: 0; line-height: inherit; }
h1, h2, h3, h4, p { margin: 0; font-size: inherit; font-weight: inherit; }
button, input, select, textarea { font-family: inherit; font-size: 100%; font-weight: inherit; line-height: inherit; color: inherit; margin: 0; padding: 0; }
button, select { text-transform: none; }
button { -webkit-appearance: button; background-color: transparent; background-image: none; cursor: pointer; }
:disabled { cursor: default; }
svg { display: block; vertical-align: middle; }
/* --- position --- */
.static { position: static; } .relative { position: relative; } .absolute { position: absolute; }
.fixed { position: fixed; } .sticky { position: sticky; }
.inset-0 { inset: 0; }
.top-0 { top: 0; } .bottom-4 { bottom: 1rem; } .right-4 { right: 1rem; }
.left-\[3px\] { left: 3px; } .top-\[3px\] { top: 3px; }
.z-20 { z-index: 20; } .z-30 { z-index: 30; } .z-40 { z-index: 40; }
/* --- display (.hidden last so it wins over .flex/.grid by source order) --- */
.block { display: block; }
.inline-flex { display: inline-flex; }
.flex { display: flex; }
.grid { display: grid; }
.hidden { display: none; }
/* --- flex & grid --- */
.flex-1 { flex: 1 1 0%; }
.flex-col { flex-direction: column; }
.flex-wrap { flex-wrap: wrap; }
.shrink-0 { flex-shrink: 0; }
.items-start { align-items: flex-start; }
.items-center { align-items: center; }
.items-end { align-items: flex-end; }
.justify-center { justify-content: center; }
.justify-between { justify-content: space-between; }
.justify-end { justify-content: flex-end; }
.grid-cols-1 { grid-template-columns: repeat(1, minmax(0, 1fr)); }
.grid-cols-2 { grid-template-columns: repeat(2, minmax(0, 1fr)); }
.col-span-2 { grid-column: span 2 / span 2; }
.items-stretch { align-items: stretch; }
.gap-1 { gap: 0.25rem; } .gap-1\.5 { gap: 0.375rem; } .gap-2 { gap: 0.5rem; }
.gap-3 { gap: 0.75rem; } .gap-5 { gap: 1.25rem; }
.space-y-3 > :not([hidden]) ~ :not([hidden]) { margin-top: 0.75rem; }
/* --- sizing --- */
.w-3\.5 { width: 0.875rem; } .w-4 { width: 1rem; } .w-8 { width: 2rem; }
.w-9 { width: 2.25rem; } .w-full { width: 100%; }
.h-2\.5 { height: 0.625rem; } .h-3\.5 { height: 0.875rem; } .h-4 { height: 1rem; }
.h-5 { height: 1.25rem; } .h-8 { height: 2rem; }
.min-h-screen { min-height: 100vh; }
.min-w-0 { min-width: 0px; }
.max-w-lg { max-width: 32rem; }
.max-w-7xl { max-width: 80rem; }
/* --- spacing --- */
.p-4 { padding: 1rem; } .p-5 { padding: 1.25rem; }
.px-2 { padding-left: .5rem; padding-right: .5rem; }
.px-3 { padding-left: .75rem; padding-right: .75rem; }
.px-4 { padding-left: 1rem; padding-right: 1rem; }
.py-1 { padding-top: .25rem; padding-bottom: .25rem; }
.py-1\.5 { padding-top: .375rem; padding-bottom: .375rem; }
.py-2 { padding-top: .5rem; padding-bottom: .5rem; }
.py-3 { padding-top: .75rem; padding-bottom: .75rem; }
.py-4 { padding-top: 1rem; padding-bottom: 1rem; }
.py-6 { padding-top: 1.5rem; padding-bottom: 1.5rem; }
.py-16 { padding-top: 4rem; padding-bottom: 4rem; }
.pb-3 { padding-bottom: .75rem; }
.mt-1 { margin-top: .25rem; } .mt-1\.5 { margin-top: .375rem; } .mt-2 { margin-top: .5rem; }
.mb-2 { margin-bottom: .5rem; } .mb-3 { margin-bottom: .75rem; } .mb-4 { margin-bottom: 1rem; }
.mx-auto { margin-left: auto; margin-right: auto; }
.my-8 { margin-top: 2rem; margin-bottom: 2rem; }
.ml-auto { margin-left: auto; }
/* --- typography --- */
.text-xs { font-size: .75rem; line-height: 1rem; }
.text-sm { font-size: .875rem; line-height: 1.25rem; }
.text-base { font-size: 1rem; line-height: 1.5rem; }
.text-lg { font-size: 1.125rem; line-height: 1.75rem; }
.text-3xl { font-size: 1.875rem; line-height: 2.25rem; }
.font-normal { font-weight: 400; } .font-medium { font-weight: 500; } .font-semibold { font-weight: 600; }
.text-center { text-align: center; }
.truncate { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
/* --- borders, background, overflow --- */
.border { border-width: 1px; }
.border-b { border-bottom-width: 1px; }
.rounded { border-radius: .25rem; }
.rounded-lg { border-radius: .5rem; }
.rounded-2xl { border-radius: 1rem; }
.rounded-full { border-radius: 9999px; }
.bg-white { background-color: #fff; }
.overflow-y-auto { overflow-y: auto; }
.overflow-x-auto { overflow-x: auto; }
.shadow-lg { box-shadow: 0 10px 15px -3px rgb(0 0 0 / 0.1), 0 4px 6px -4px rgb(0 0 0 / 0.1); }
/* --- responsive --- */
@media (min-width: 640px) {
.sm\:items-center { align-items: center; }
.sm\:grid-cols-2 { grid-template-columns: repeat(2, minmax(0, 1fr)); }
.sm\:col-span-2 { grid-column: span 2 / span 2; }
}
@media (min-width: 1280px) {
.xl\:grid-cols-3 { grid-template-columns: repeat(3, minmax(0, 1fr)); }
}
</style>
<!-- Pinned to an exact version with an integrity hash. A floating "@3" tag
cannot be hash-verified, which meant this page executed whatever the CDN
served, in a document that holds API keys and OAuth tokens.
To upgrade: change BOTH the version and the hash together. -->
<script src="https://cdn.jsdelivr.net/npm/@azure/msal-browser@3.30.0/lib/msal-browser.min.js"
integrity="sha384-YnOjsoOxSYo65h1BXWnSq24bFbqW8HfzMWSEQxYEMRmjW9Vl1J3HZI3iZxqNYvIi"
crossorigin="anonymous"
referrerpolicy="no-referrer"></script>
<style>
:root {
color-scheme: dark;
--page: #0d0d0d;
--surface-1: #1a1a19;
--surface-2: #222221;
--text-primary: #ffffff;
--text-secondary: #c3c2b7;
--text-muted: #898781;
--border: rgba(255,255,255,0.10);
--border-strong: rgba(255,255,255,0.18);
/* Saturated hues — for bars, dots and fills only. */
--status-good: #0ca30c;
--status-good-bg: rgba(12,163,12,0.14);
--status-warning: #fab219;
--status-warning-bg:rgba(250,178,25,0.14);
--status-critical: #d03b3b;
--status-critical-bg:rgba(208,59,59,0.14);
/* Text-safe variants. The saturated hues measured 4.39:1 (Active) and
3.22:1 (Exhausted) as TEXT on their own tinted badge backgrounds —
both under the 4.5:1 minimum, on the two states that matter most.
These are lifted toward white until they clear it; warning already
passed at 7.18:1 and is unchanged. Marks keep the saturated hue. */
--status-good-text: #16a716; /* 4.61:1 on its badge tint */
--status-warning-text: #fab219; /* 7.18:1 — no change needed */
--status-critical-text: #db6a6a; /* 4.63:1 on its badge tint */
/* Per-platform colours used to live here as 22 CSS variables that had
to be added alongside every new platform. They're now a single
`hue` on the PLATFORMS entry, with the badge tint derived from it. */
--accent: #9085e9;
}
body { background: var(--page); color: var(--text-primary); font-family: system-ui, -apple-system, "Segoe UI", sans-serif; }
.card { background: var(--surface-1); border: 1px solid var(--border); }
.surface-2 { background: var(--surface-2); border: 1px solid var(--border); }
.meter-track { background: var(--surface-2); }
.meter-fill { transition: width .4s ease; border-radius: 4px; }
.hero-figure { font-variant-numeric: proportional-nums; }
::placeholder { color: var(--text-muted); opacity: 1; }
input[type="text"], input[type="number"], input[type="password"], input[type="datetime-local"], select {
background: var(--surface-2); border: 1px solid var(--border-strong); color: var(--text-primary);
}
input:focus, select:focus { outline: 2px solid rgba(144,133,233,0.5); outline-offset: 1px; }
/* Nothing in this file defined a focus ring for buttons, so keyboard
users had no idea where they were. */
button:focus-visible, a:focus-visible, [tabindex]:focus-visible {
outline: 2px solid var(--accent); outline-offset: 2px; border-radius: 6px;
}
.toggle-track { background: var(--surface-2); border: 1px solid var(--border-strong); }
.toggle-track[data-on="true"] { background: var(--status-good); border-color: var(--status-good); }
.toggle-thumb { transition: transform .15s ease; }
.toggle-track[data-on="true"] .toggle-thumb { transform: translateX(16px); }
/* Selection state lives here rather than in inline styles — inline
styles won the cascade and left the active pill indistinguishable. */
.filter-pill, .summary-chip {
border-color: var(--border); color: var(--text-muted);
background: transparent; white-space: nowrap;
}
.filter-pill-count { color: var(--text-muted); }
.filter-pill:hover, .summary-chip:hover { border-color: var(--border-strong); color: var(--text-secondary); }
.filter-pill[data-active="true"], .summary-chip[data-active="true"] {
background: var(--surface-2);
border-color: var(--accent);
color: var(--text-primary);
box-shadow: inset 0 0 0 1px var(--accent);
}
.filter-pill[data-active="true"] .filter-pill-count { color: var(--text-primary); }
.summary-chip { display: inline-flex; align-items: center; gap: .375rem; }
/* 44px minimum touch target on the controls fingers actually hit. */
@media (pointer: coarse) {
.filter-pill, .summary-chip, .refresh-btn, .edit-btn { min-height: 44px; }
#addAccountBtn, #refreshAllBtn, #liveSimToggle { min-height: 44px; }
}
.spin { animation: spin 0.8s linear infinite; }
@keyframes spin { to { transform: rotate(360deg); } }
/* The dialog caps its own height and scrolls internally rather than
growing to 1,259px and pushing Save off the bottom of the page. */
.modal-panel {
background: var(--surface-1);
border: 1px solid var(--border-strong);
max-height: calc(100vh - 4rem);
overflow-y: auto;
}
@supports (height: 100dvh) {
.modal-panel { max-height: calc(100dvh - 4rem); }
}
.modal-actions {
position: sticky; bottom: 0;
background: var(--surface-1);
padding: .75rem 0; margin-top: .25rem;
border-top: 1px solid var(--border);
}
/* Keeps the page behind the modal from scrolling under it. */
body.modal-open { overflow: hidden; }
.entity-list { max-height: 46vh; overflow-y: auto; border: 1px solid var(--border); border-radius: .5rem; }
.entity-row {
display: block; width: 100%; text-align: left;
padding: .5rem .75rem; border-bottom: 1px solid var(--border);
color: var(--text-primary); font-size: .8125rem;
}
.entity-row:last-child { border-bottom: 0; }
.entity-row:hover, .entity-row:focus-visible { background: var(--surface-2); }
.entity-row .eid { color: var(--text-muted); font-size: .75rem; }
/* Added for the bulk bar and bulk-edit dialog. Vendored Tailwind has no
JIT, so every class used in markup needs a rule here or it silently
does nothing. */
.p-3 { padding: 0.75rem; }
.mb-1 { margin-bottom: 0.25rem; }
.rounded-xl { border-radius: 0.75rem; }
.max-w-md { max-width: 28rem; }
.z-50 { z-index: 50; }
/* Secondary meters: visibly subordinate to the hero so a multi-meter card
still has one headline number rather than five competing ones. */
.series-meter { height: 0.375rem; border-radius: 9999px; }
.series-row + .series-row { border-top: 1px solid var(--border); padding-top: 0.5rem; }
.tabular { font-variant-numeric: tabular-nums; }
.items-baseline { align-items: baseline; }
.pt-1 { padding-top: 0.25rem; }
.mt-0\.5 { margin-top: 0.125rem; }
.card-selected { outline: 2px solid var(--accent); outline-offset: -1px; }
.bulk-check { width: 1.15rem; height: 1.15rem; accent-color: var(--accent); cursor: pointer; }
.w-full { width: 100%; }
/* An armed button has to look unmistakably different from its resting
state — this is the only signal that a second click will commit. */
.armed {
background: var(--status-critical-text) !important;
color: #0d0d0d !important;
border-color: var(--status-critical-text) !important;
font-weight: 600;
}
.findings ul { margin: 0; padding-left: 1rem; list-style: disc; }
.findings li { margin-top: .125rem; word-break: break-word; }
.control-btn:hover:not(:disabled) { border-color: var(--accent); color: var(--text-primary); }
.control-btn:disabled { opacity: .5; }
code { background: var(--surface-2); padding: 0 .25rem; border-radius: .25rem; }
.toast { background: var(--surface-1); border: 1px solid var(--border-strong); }
</style>
</head>
<body class="min-h-screen">
<header class="sticky top-0 z-20 border-b" style="background:rgba(13,13,13,0.9); backdrop-filter: blur(6px); border-color: var(--border);">
<div class="max-w-7xl mx-auto px-4 py-4 flex flex-wrap items-center justify-between gap-3">
<div>
<h1 class="text-lg font-semibold" style="color:var(--text-primary)">Cacheboard</h1>
<p class="text-xs" style="color:var(--text-muted)" id="headerSubtitle"></p>
</div>
<div class="flex items-center gap-3 flex-wrap">
<div class="flex items-center gap-2 text-sm" style="color:var(--text-secondary)">
<span id="liveSimLabel">Live simulation</span>
<button id="liveSimToggle" type="button" class="toggle-track w-9 h-5 rounded-full relative" data-on="false" aria-pressed="false" aria-labelledby="liveSimLabel">
<span class="toggle-thumb block w-3.5 h-3.5 rounded-full bg-white absolute top-[3px] left-[3px]"></span>
</button>
</div>
<button id="refreshAllBtn" type="button" class="text-sm font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-2); color:var(--text-secondary); border:1px solid var(--border-strong);">
Refresh stale
</button>
<button id="selectModeBtn" type="button" class="text-sm font-medium px-3 py-2 rounded-lg" aria-pressed="false"
style="background:var(--surface-2); color:var(--text-secondary); border:1px solid var(--border-strong);">
Select
</button>
<button id="settingsBtn" type="button" class="text-sm font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-2); color:var(--text-secondary); border:1px solid var(--border-strong);">
Settings
</button>
<button id="addAccountBtn" type="button" class="text-sm font-medium px-3 py-2 rounded-lg" style="background:var(--accent); color:#0d0d0d;">
+ Add Account
</button>
</div>
</div>
<!-- Horizontal scroll instead of a 901px-wide bar forcing the whole page
sideways on a phone. -->
<div class="max-w-7xl mx-auto px-4 pb-3 overflow-x-auto" role="group" aria-label="Filter by platform">
<div class="flex items-center gap-2 text-xs" id="filterBar"></div>
</div>
</header>
<main class="max-w-7xl mx-auto px-4 py-6">
<div id="summaryStrip" class="mb-4 flex flex-wrap items-center gap-2 text-xs"></div>
<!-- Bulk bar. Hidden until Select mode is on; acts on the current
selection only, never on the whole filtered set by surprise. -->
<div id="bulkBar" class="hidden mb-4 p-3 rounded-xl flex flex-wrap items-center gap-2"
style="background:var(--surface-2); border:1px solid var(--border-strong);">
<span id="bulkCount" class="text-sm font-medium" style="color:var(--text-primary)">0 selected</span>
<button type="button" id="bulkSelectAllBtn" class="text-xs px-2 py-1 rounded-lg"
style="background:var(--surface-1); color:var(--text-secondary); border:1px solid var(--border-strong);">Select all shown</button>
<button type="button" id="bulkSelectNoneBtn" class="text-xs px-2 py-1 rounded-lg"
style="background:var(--surface-1); color:var(--text-secondary); border:1px solid var(--border-strong);">Clear</button>
<span class="flex-1"></span>
<button type="button" id="bulkRefreshBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-1); color:var(--text-secondary); border:1px solid var(--border-strong);">Refresh</button>
<button type="button" id="bulkEditBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-1); color:var(--text-secondary); border:1px solid var(--border-strong);">Edit…</button>
<button type="button" id="bulkDeleteBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--status-critical-bg); color:var(--status-critical-text); border:1px solid var(--border-strong);">Delete</button>
<span id="bulkStatus" class="text-xs w-full" style="color:var(--text-muted)"></span>
</div>
<!-- Bulk edit. Every field is opt-in: blank means "leave this alone",
so one dialog can change targets without touching intervals. -->
<div id="bulkOverlay" class="hidden fixed inset-0 z-50 flex items-start sm:items-center justify-center p-4 overflow-y-auto" style="background:rgba(0,0,0,0.6);">
<div class="modal-panel rounded-2xl w-full max-w-md p-5 my-8" role="dialog" aria-modal="true" aria-labelledby="bulkEditTitle">
<h2 id="bulkEditTitle" class="text-base font-semibold mb-1">Edit selected cards</h2>
<p class="text-xs mb-4" style="color:var(--text-muted)">
Leave a field blank to leave it unchanged. Applies to <span id="bulkEditCount">0</span> card(s).
</p>
<form id="bulkEditForm">
<label class="block text-sm mb-3">Total limit / target
<input type="number" id="b_totalLimit" step="any" min="0" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="unchanged">
</label>
<label class="block text-sm mb-3">Reset every (hours)
<input type="number" id="b_cycleHours" step="any" min="0.001" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="unchanged">
</label>
<label class="block text-sm mb-3">Direction
<select id="b_direction" class="w-full rounded-lg px-3 py-2 mt-1 text-sm">
<option value="">unchanged</option>
<option value="depletion">Lower is better (% left)</option>
<option value="growth">Higher is better (% of target)</option>
<option value="usage">Show % consumed (% used)</option>
</select>
</label>
<label class="block text-sm mb-3">Account / owner
<input type="text" id="b_owner" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="unchanged" maxlength="60">
</label>
<label class="block text-sm mb-4">Unit label
<input type="text" id="b_unit" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="unchanged">
</label>
<p id="bulkEditError" class="hidden text-xs mb-3" style="color:var(--status-critical-text)"></p>
<div class="flex items-center justify-end gap-2 modal-actions">
<button type="button" id="bulkEditCancelBtn" class="text-sm px-3 py-2 rounded-lg" style="color:var(--text-secondary); background:var(--surface-2);">Cancel</button>
<button type="submit" class="text-sm font-medium px-4 py-2 rounded-lg" style="background:var(--accent); color:#0d0d0d;">Apply</button>
</div>
</form>
</div>
</div>
<div id="cardGrid" class="grid grid-cols-1 sm:grid-cols-2 xl:grid-cols-3 gap-5 items-start"></div>
<div id="emptyState" class="hidden text-center py-16" style="color:var(--text-muted)">
No accounts yet — click <span style="color:var(--text-secondary)">Add Account</span> to get started.
</div>
</main>
<!-- Add / Edit modal -->
<div id="modalOverlay" class="hidden fixed inset-0 z-30 flex items-start sm:items-center justify-center p-4 overflow-y-auto" style="background:rgba(0,0,0,0.6);">
<form id="accountForm" class="modal-panel rounded-2xl w-full max-w-lg p-5 my-8"
role="dialog" aria-modal="true" aria-labelledby="modalTitle">
<div class="flex items-center justify-between mb-4">
<h2 id="modalTitle" class="text-base font-semibold">Add Account</h2>
<button type="button" id="closeModalBtn" class="text-sm px-2 py-1 rounded" style="color:var(--text-muted)">Close</button>
</div>
<input type="hidden" id="f_id">
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3 mb-3">
<label class="block col-span-2">
<span class="text-xs" style="color:var(--text-muted)">Account name</span>
<input type="text" id="f_name" required class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="e.g. Personal, Work Team">
</label>
<label class="block col-span-2">
<span class="text-xs" style="color:var(--text-muted)">Account / owner (optional)</span>
<input type="text" id="f_owner" list="ownerSuggestions" maxlength="60" autocomplete="off"
class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="e.g. personal@gmail.com">
<datalist id="ownerSuggestions"></datalist>
<span class="text-xs" style="color:var(--text-muted)">Groups cards by identity so several Gmail accounts stay untangled. Becomes a filter in the bar above.</span>
</label>
<label class="block">
<span class="text-xs" style="color:var(--text-muted)">Platform</span>
<!-- Options are generated from PLATFORMS at startup — this list
used to be a twelfth place a new platform had to be added. -->
<select id="f_platform" class="w-full rounded-lg px-3 py-2 mt-1 text-sm"></select>
</label>
<label class="block">
<span class="text-xs" style="color:var(--text-muted)">Account type</span>
<select id="f_accountType" class="w-full rounded-lg px-3 py-2 mt-1 text-sm"></select>
</label>
</div>
<!-- Collapsed by default: these notes run up to ~1,280 characters and
pushed the modal past 1,200px tall on Azure/quota. -->
<details id="f_typeNoteWrap" class="mb-3 rounded-lg" style="background:var(--surface-2);">
<summary class="text-xs px-3 py-2" style="color:var(--text-secondary); cursor:pointer">Setup notes & caveats</summary>
<p id="f_typeNote" class="text-xs px-3 pb-3" style="color:var(--text-secondary)"></p>
</details>
<div id="f_credentials" class="space-y-3 mb-3"></div>
<label class="block mb-3" id="f_directionWrap">
<span class="text-xs" style="color:var(--text-muted)">Which way is healthy?</span>
<select id="f_direction" class="w-full rounded-lg px-3 py-2 mt-1 text-sm">
<option value="">Use the default for this account type</option>
<option value="depletion">Lower is better — a quota or budget being used up</option>
<option value="growth">Higher is better — progress toward a target</option>
<option value="usage">Show % consumed — a limit filling up (9% used)</option>
</select>
<span class="text-xs" style="color:var(--text-muted)" id="f_directionHint"></span>
</label>
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3 mb-3">
<label class="block">
<span class="text-xs" style="color:var(--text-muted)" id="f_totalLimitLabel">Total limit</span>
<input type="number" id="f_totalLimit" min="0.01" step="any" required class="w-full rounded-lg px-3 py-2 mt-1 text-sm">
</label>
<label class="block">
<span class="text-xs" style="color:var(--text-muted)">Used so far</span>
<input type="number" id="f_used" min="0" step="any" required class="w-full rounded-lg px-3 py-2 mt-1 text-sm">
</label>
<label class="block">
<span class="text-xs" style="color:var(--text-muted)">Unit label</span>
<input type="text" id="f_unit" required class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="tokens, messages, seats...">
</label>
<label class="block">
<span class="text-xs" style="color:var(--text-muted)">Resets at</span>
<input type="datetime-local" id="f_resetTime" required class="w-full rounded-lg px-3 py-2 mt-1 text-sm">
</label>
</div>
<label class="block mb-4">
<span class="text-xs" style="color:var(--text-muted)">Auto-reset cycle length (hours) — used to reschedule the next reset for manual/simulated accounts once the countdown hits zero</span>
<input type="number" id="f_resetIntervalHours" min="0.017" max="1752000" step="any" required class="w-full rounded-lg px-3 py-2 mt-1 text-sm">
</label>
<p id="f_formError" class="hidden text-xs rounded-lg px-3 py-2 mb-3" role="alert"
style="background:var(--status-critical-bg); color:var(--status-critical-text);"></p>
<!-- Sticky so Save stays reachable on the taller credential forms
instead of sitting ~1,200px down the page. -->
<div class="flex items-center justify-between gap-2 modal-actions">
<button type="button" id="deleteAccountBtn" class="hidden text-sm px-3 py-2 rounded-lg" style="color:var(--status-critical-text); background:var(--status-critical-bg);">Delete</button>
<div class="flex items-center gap-2 ml-auto">
<button type="button" id="cancelModalBtn" class="text-sm px-3 py-2 rounded-lg" style="color:var(--text-secondary); background:var(--surface-2);">Cancel</button>
<button type="submit" class="text-sm font-medium px-4 py-2 rounded-lg" style="background:var(--accent); color:#0d0d0d;">Save</button>
</div>
</div>
</form>
</div>
<!-- Settings: the Home Assistant connection shared by every HA card.
Leaving it empty is fine — the rest of the dashboard doesn't care. -->
<div id="settingsOverlay" class="hidden fixed inset-0 z-30 flex items-start sm:items-center justify-center p-4 overflow-y-auto" style="background:rgba(0,0,0,0.6);">
<form id="settingsForm" class="modal-panel rounded-2xl w-full max-w-lg p-5 my-8"
role="dialog" aria-modal="true" aria-labelledby="settingsTitle">
<div class="flex items-center justify-between mb-4">
<h2 id="settingsTitle" class="text-base font-semibold">Settings</h2>
<button type="button" id="closeSettingsBtn" class="text-sm px-2 py-1 rounded" style="color:var(--text-muted)">Close</button>
</div>
<h3 class="text-sm font-medium mb-2">Home Assistant connection</h3>
<p class="text-xs mb-3" style="color:var(--text-muted)">
Shared by every Home Assistant card, so you enter it once. Everything else on this
dashboard works without it.
</p>
<label class="block mb-3">
<span class="text-xs" style="color:var(--text-muted)">Base URL</span>
<input type="text" id="s_haBaseUrl" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="http://homeassistant.local:8123">
</label>
<label class="block mb-3">
<span class="text-xs" style="color:var(--text-muted)">Long-lived access token</span>
<input type="password" id="s_haToken" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="Profile → Security → Long-lived access tokens">
</label>
<div class="flex items-center gap-2 flex-wrap mb-3">
<button type="button" id="testHaBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-2); color:var(--text-secondary); border:1px solid var(--border-strong);">Test connection</button>
<span id="haTestStatus" class="text-xs" style="color:var(--text-muted)"></span>
</div>
<p class="text-xs mb-4" style="color:var(--text-muted)">
Add this page's origin under <code>http: cors_allowed_origins</code> in
<code>configuration.yaml</code> and restart HA. Serving this file from HA's own
<code>/config/www</code> folder skips that entirely, since it's then same-origin.
</p>
<h3 class="text-sm font-medium mb-2">Backend companion <span style="color:var(--text-muted); font-weight:400">(optional)</span></h3>
<p class="text-xs mb-3" style="color:var(--text-muted)">
Only needed for things a browser can't do on its own: OpenAI API usage (which blocks
browser calls outright) and keeping OAuth tokens alive. Leave blank and everything
else works exactly as it does now. Setup is in <code>server/</code>.
</p>
<label class="block mb-3">
<span class="text-xs" style="color:var(--text-muted)">Backend URL</span>
<input type="text" id="s_backendBaseUrl" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="http://localhost:8787">
</label>
<label class="block mb-3">
<span class="text-xs" style="color:var(--text-muted)">Backend token</span>
<input type="password" id="s_backendToken" class="w-full rounded-lg px-3 py-2 mt-1 text-sm" placeholder="DASHBOARD_TOKEN from the server's .env">
</label>
<div class="flex items-center gap-2 flex-wrap mb-4">
<button type="button" id="testBackendBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-2); color:var(--text-secondary); border:1px solid var(--border-strong);">Test backend</button>
<span id="backendTestStatus" class="text-xs" style="color:var(--text-muted)"></span>
</div>
<h3 class="text-sm font-medium mb-2">Cards</h3>
<p class="text-xs mb-3" style="color:var(--text-muted)">
A fresh install ships example cards so the dashboard isn't an empty page. Clear them
once you're ready to add your own — or restore them if you want the tour back.
</p>
<div class="flex items-center gap-2 flex-wrap mb-4">
<button type="button" id="clearCardsBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--status-critical-bg); color:var(--status-critical-text); border:1px solid var(--border-strong);">Remove all cards</button>
<button type="button" id="restoreExamplesBtn" class="text-xs font-medium px-3 py-2 rounded-lg"
style="background:var(--surface-2); color:var(--text-secondary); border:1px solid var(--border-strong);">Restore examples</button>
<span id="cardsActionStatus" class="text-xs" style="color:var(--text-muted)"></span>
</div>
<div class="flex items-center justify-end gap-2 modal-actions">
<button type="button" id="cancelSettingsBtn" class="text-sm px-3 py-2 rounded-lg" style="color:var(--text-secondary); background:var(--surface-2);">Cancel</button>
<button type="submit" class="text-sm font-medium px-4 py-2 rounded-lg" style="background:var(--accent); color:#0d0d0d;">Save</button>
</div>
</form>
</div>
<!-- Entity picker: one /api/states call, searchable, so no entity ids
ever need typing. -->
<div id="entityOverlay" class="hidden fixed inset-0 z-40 flex items-start sm:items-center justify-center p-4 overflow-y-auto" style="background:rgba(0,0,0,0.6);">
<div class="modal-panel rounded-2xl w-full max-w-lg p-5 my-8" role="dialog" aria-modal="true" aria-labelledby="entityTitle">
<div class="flex items-center justify-between mb-3">
<h2 id="entityTitle" class="text-base font-semibold">Pick an entity</h2>
<button type="button" id="closeEntityBtn" class="text-sm px-2 py-1 rounded" style="color:var(--text-muted)">Close</button>
</div>
<input type="text" id="entitySearch" class="w-full rounded-lg px-3 py-2 mb-3 text-sm" placeholder="Search by name or id…" autocomplete="off">
<div id="entityList" class="entity-list"></div>
<p id="entityHint" class="text-xs mt-2" style="color:var(--text-muted)"></p>
</div>
</div>
<div id="toastContainer" class="fixed bottom-4 right-4 z-40 flex flex-col gap-2 items-end"></div>
<script>
(function () {
"use strict";
// ---------------------------------------------------------------------
// Config: platform + account-type metadata. Add a new platform here
// later (e.g. azure, website, financial) to extend the dashboard.
// ---------------------------------------------------------------------
// Every Home Assistant card needs exactly one thing from you: which
// entity. The connection itself is a global setting, and `browse: true`
// renders a picker so you never have to type an entity id.
const ENTITY_FIELD = {
key: "entityId", label: "Entity", type: "text",
placeholder: "light.kitchen", required: true, full: true, browse: true
};
const PLATFORMS = {
chatgpt: {
label: "ChatGPT",
icon: '<path d="M12 3l7 4v10l-7 4-7-4V7l7-4z" fill="none" stroke="currentColor" stroke-width="1.6"/><circle cx="12" cy="12" r="2.4" fill="currentColor"/>',
hue: "#199e70",
accountTypes: [
// Consumer plans expose no usage API at all, from any origin, so
// this one stays manual regardless of the backend.
{ value: "consumer", label: "Consumer subscription (Plus/Team)" },
{
value: "api-key", label: "OpenAI API key (via backend)", fetch: fetchOpenAiUsage,
fields: [
{ key: "openaiDays", label: "Days to total", type: "number", placeholder: "30" }
],
help: "Goes through the backend companion, because OpenAI sends no CORS headers and refuses browser calls outright. The API key lives in the server's .env, never in this page. Reports API-key spend against the budget you set as \"Total limit\"."
}
],
// OpenAI sends no Access-Control-Allow-Origin header and does not
// support direct browser calls, by design. The backend companion
// (M7) is the only way around it; without one, this stays manual.
note: "OpenAI blocks direct browser API calls (no CORS support, by design). The API-key card works through the optional backend companion, which holds the key server-side — set it up in Settings. Consumer ChatGPT Plus/Team plans expose no usage API at all and stay manual either way."
},
claude: {
label: "Claude",
icon: '<circle cx="12" cy="12" r="8" fill="none" stroke="currentColor" stroke-width="1.6"/><path d="M12 7v10M7 12h10" stroke="currentColor" stroke-width="1.6"/>',
hue: "#d95926",
accountTypes: [
{ value: "consumer", label: "Consumer subscription (Pro/Team)" },
{
value: "api-key", label: "Anthropic API key", fetch: fetchClaudeUsage, direction: "usage",
fields: [
{ key: "apiKey", label: "Anthropic API key", type: "password", placeholder: "sk-ant-...", required: true, full: true },
{ key: "anthropicMetric", label: "Metric", type: "select", options: [
["input", "Input tokens / min"], ["output", "Output tokens / min"],
["requests", "Requests / min"], ["tokens", "Combined tokens / min (legacy)"]
] }
],
help: "Stored only in this browser's local storage and sent only directly to Anthropic when you click Refresh. Anyone with access to this file/browser can read it via dev tools — treat it like a password, and prefer a low-limit or restricted key."
}
],
note: "API-key accounts refresh live via a direct browser call to Anthropic (anthropic-dangerous-direct-browser-access), reading the account's real rate-limit headers. This sends a real minimal request (max_tokens: 1) each time you click Refresh, so it may incur a tiny real cost. Consumer subscriptions have no public API and stay manual."
},
copilot: {
label: "GitHub Copilot",
icon: '<path d="M12 4l6 3.5v9L12 20l-6-3.5v-9L12 4z" fill="none" stroke="currentColor" stroke-width="1.6"/><circle cx="9" cy="12" r="1.3" fill="currentColor"/><circle cx="15" cy="12" r="1.3" fill="currentColor"/>',
hue: "#9085e9",
accountTypes: [
{
value: "individual", label: "Copilot Individual (Pro/Pro+/Max)", fetch: fetchCopilotUsage,
fields: [
{ key: "githubUsername", label: "GitHub username", type: "text", placeholder: "your-username", required: true },
{ key: "githubToken", label: "GitHub token", type: "password", placeholder: "ghp_...", required: true },
{ key: "copilotEndpoint", label: "Endpoint override (optional)", type: "text", placeholder: "defaults to /users/{username}/settings/billing/ai_credit/usage", full: true }
],
help: "Try a classic PAT with manage_billing:copilot scope first. GitHub's docs mainly describe this endpoint for org/enterprise admins — if your token gets a 403 here, that's GitHub confirming personal accounts can't self-serve this yet, and the card will just stay on manual refresh. Overrides are restricted to api.github.com."
},
{
value: "org-admin", label: "Copilot Business/Enterprise (org admin token)", fetch: fetchCopilotUsage,
fields: [
{ key: "orgLogin", label: "Org login", type: "text", placeholder: "acme-inc", required: true },
{ key: "githubToken", label: "GitHub token", type: "password", placeholder: "ghp_...", required: true },
{ key: "copilotEndpoint", label: "Endpoint override (optional)", type: "text", placeholder: "defaults to /organizations/{org}/settings/billing/ai_credit/usage", full: true }
],
help: "Token needs org admin / manage_billing:copilot scope (classic PAT). Stored only in this browser's local storage and sent only directly to GitHub when you click Refresh."
}
],
note: "Both types attempt a real refresh via GitHub's AI Credits usage API (api.github.com/.../settings/billing/ai_credit/usage), which supports direct browser calls like GitHub's other REST endpoints. This API changed in June 2026 and GitHub's docs are ambiguous about whether a personal (non-org) account can call it for itself — your token will give a definitive answer. It reports spend, not a plan limit, so \"Total limit\" here is whatever your plan's monthly AI Credit allotment is (e.g. $15 Pro / $70 Pro+ / $200 Max) — set it manually and refresh will keep \"Used\" current. If it 403s, the endpoint field lets you try an alternate path without editing code."
},
azure: {
label: "Azure",
icon: '<path d="M8 4h5l-6 12h9l-9 4 3-9H6z" fill="currentColor" stroke="none"/>',
hue: "#3987e5",
accountTypes: [
{
value: "cost", label: "Subscription cost vs. budget", fetch: fetchAzureCost, connect: "azure",
fields: [
{ key: "azureTenantId", label: "Azure AD Tenant ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true },
{ key: "azureClientId", label: "Azure AD Client ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true },
{ key: "subscriptionId", label: "Subscription ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true, full: true }
],
help: "No client secret involved — this is Microsoft's own browser-only sign-in pattern. Only works over http(s) (serve this file locally, don't just double-click it), and the exact URL you serve it from must be registered as a redirect URI on the app registration. Click Connect once before Refresh will work; a token from one Tenant/Client ID pair is reused for every account using that same pair."
},
{
value: "quota", label: "Resource quota (real limit + usage)", fetch: fetchAzureQuota, connect: "azure",
fields: [
{ key: "azureTenantId", label: "Azure AD Tenant ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true },
{ key: "azureClientId", label: "Azure AD Client ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true },
{ key: "subscriptionId", label: "Subscription ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true, full: true },
{ key: "azureResourceProvider", label: "Resource provider", type: "text", placeholder: "Microsoft.Compute" },
{ key: "azureLocation", label: "Location", type: "text", placeholder: "eastus" },
{ key: "azureQuotaItem", label: "Quota item name", type: "text", placeholder: "Total Regional vCPUs", required: true, full: true },
{ key: "azureEndpoint", label: "Endpoint override (optional)", type: "text", placeholder: "defaults to the usages API for that provider/location", full: true }
],
help: "Matches by partial, case-insensitive name against whatever the usages API returns — e.g. \"Total Regional vCPUs\" or \"cores\". This is a real limit and real usage straight from Azure, not a number you set. Different resource providers use different API versions; if the default 404s, put an alternate path in the endpoint override. Overrides are restricted to management.azure.com so your Azure token can't be sent elsewhere."
},
{
value: "health", label: "Resource health status", fetch: fetchAzureHealth, connect: "azure", display: "status",
fields: [
{ key: "azureTenantId", label: "Azure AD Tenant ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true },
{ key: "azureClientId", label: "Azure AD Client ID", type: "text", placeholder: "xxxxxxxx-xxxx-...", required: true },
{ key: "azureResourceId", label: "Resource ID", type: "text", placeholder: "/subscriptions/xxx/resourceGroups/xxx/providers/...", required: true, full: true },
{ key: "azureEndpoint", label: "Endpoint override (optional)", type: "text", placeholder: "defaults to Resource Health's availabilityStatuses/current", full: true }
],
help: "Find the Resource ID on the resource's Overview page in the portal (its JSON view, or the \"Resource ID\" field near Essentials). There's no real \"limit\" for health, just a status — Available/Degraded/Unavailable map onto the same Active/Warning/Exhausted badges as everything else on a synthetic scale, and the real state text replaces the unit label each refresh."
}
],
note: "Signs in with your real Microsoft account via Azure's own public-client OAuth pattern (MSAL.js, no backend secret involved). \"Cost\" reads month-to-date spend against a budget you set yourself (Azure doesn't enforce one). \"Quota\" reads a real limit AND real usage straight from Azure's own usages API for a resource provider/location — no manual number needed, unlike everything else in this dashboard. \"Health\" maps Available/Degraded/Unavailable onto the same Active/Warning/Exhausted badges on a synthetic 0-100 scale, since a health status isn't naturally a percentage. All three only work when the page is served over http(s) (e.g. a local static server), never when opened as a file:// path, because Microsoft's login can't redirect back to a file URL. Click \"Connect Microsoft Account\" once per browser session before Refresh will work — one sign-in (per Tenant/Client ID pair) covers all three types."
},
financial: {
label: "Financial",
icon: '<rect x="3" y="6" width="18" height="12" rx="2" fill="none" stroke="currentColor" stroke-width="1.6"/><path d="M3 10h18" stroke="currentColor" stroke-width="1.6"/><circle cx="7" cy="14.5" r="1" fill="currentColor"/>',
hue: "#008300",
accountTypes: [
{ value: "credit-card", label: "Credit card (limit vs. balance)" },
{ value: "budget", label: "Monthly bill vs. budget" }
],
note: "No bank or card API involved on purpose — real account aggregation (e.g. Plaid) requires a backend to hold a secret that can never live in a browser, and this dashboard intentionally doesn't have one. Update these by hand as statements/bills come in, same as your consumer ChatGPT/Claude cards. Credit cards track available credit (limit minus balance); a monthly bill tracks spend against a budget you set, and \"Auto-reset\" is best left off (a very long cycle length) for credit cards specifically, since a real balance doesn't zero out on its own the way an AI quota does."
},
cloudflare: {
label: "Cloudflare",
icon: '<path d="M17 15.5a3.5 3.5 0 0 0-3.4-4.5c-.3 0-.6 0-.9.1A5 5 0 0 0 4 13.2 3.2 3.2 0 0 0 4.2 19.5H17a3.2 3.2 0 0 0 0-6.4z" fill="none" stroke="currentColor" stroke-width="1.5"/>',
hue: "#d55181",
accountTypes: [
{
value: "zone-analytics", label: "Zone traffic vs. monthly budget", fetch: fetchCloudflareUsage,
fields: [
{ key: "cloudflareToken", label: "Cloudflare API token", type: "password", placeholder: "paste token", required: true },
{ key: "zoneId", label: "Zone ID", type: "text", placeholder: "32-char hex id", required: true }
],
help: "Create the token at dash.cloudflare.com → My Profile → API Tokens, scoped to Zone → Analytics → Read for this specific zone. The Zone ID is on the zone's Overview page, right sidebar. Stored only in this browser's local storage and sent only directly to Cloudflare when you click Refresh."
}
],
note: "Refreshes live via Cloudflare's GraphQL Analytics API, which supports direct browser calls with an API token (no CORS block, confirmed live during testing) — reads real month-to-date request volume for a zone. \"Total limit\" is a traffic budget you set yourself, not a Cloudflare-enforced cap (their plans don't generally have a hard request limit). SiteGround was evaluated but doesn't expose a usage-quota API for customers, so it isn't wired here."
},
investments: {
label: "Investments",
icon: '<path d="M4 18l5-6 4 3 7-9" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/>',
hue: "#c98500",
accountTypes: [
{
value: "crypto", label: "Crypto holding (live price)", fetch: fetchCryptoValue, direction: "growth",
fields: [
{ key: "investmentSymbol", label: "CoinGecko coin id", type: "text", placeholder: "bitcoin", required: true },
{ key: "investmentQuantity", label: "Quantity held", type: "number", placeholder: "0.5", required: true }
],
help: "No API key needed — CoinGecko's price endpoint is open. Use the coin's API id, not its ticker (find it on the coin's CoinGecko page URL, e.g. coingecko.com/en/coins/bitcoin)."
},
{
value: "stock", label: "Stock holding (live price)", fetch: fetchStockValue, direction: "growth",
fields: [
{ key: "investmentSymbol", label: "Ticker", type: "text", placeholder: "AAPL", required: true },
{ key: "investmentQuantity", label: "Quantity held", type: "number", placeholder: "10", required: true },
{ key: "investmentToken", label: "Finnhub API key", type: "password", placeholder: "free key from finnhub.io", required: true, full: true }
],
help: "Free key from finnhub.io/register — no credit card needed. Stored only in this browser's local storage."
}
],
note: "No brokerage login involved — real account aggregation needs a backend the same way banking does (see the Financial platform's note). Instead: you enter the quantity you hold once, and Refresh pulls a real live price (CoinGecko for crypto, confirmed CORS-open with no key needed; Finnhub for stocks, confirmed CORS-open with a free API key) to compute current value. \"Total limit\" doubles as an optional target value — set it high if you just want to watch the number, or to a real goal if you want the bar to mean something. The value itself is 100% real market data either way."
},
social: {
label: "Social / Content",
icon: '<circle cx="7" cy="12" r="2.3" fill="none" stroke="currentColor" stroke-width="1.5"/><circle cx="17" cy="6.5" r="2.3" fill="none" stroke="currentColor" stroke-width="1.5"/><circle cx="17" cy="17.5" r="2.3" fill="none" stroke="currentColor" stroke-width="1.5"/><path d="M9 10.7l6-3.2M9 13.3l6 3.2" stroke="currentColor" stroke-width="1.5"/>',
hue: "#e66767",
accountTypes: [
{
value: "youtube", label: "YouTube channel (subscribers)", fetch: fetchYoutubeStats, direction: "growth",
fields: [
{ key: "youtubeApiKey", label: "YouTube Data API key", type: "password", placeholder: "from Google Cloud Console", required: true },
{ key: "youtubeChannelId", label: "Channel ID", type: "text", placeholder: "UC...", required: true }
],
help: "Create an API key in Google Cloud Console with the YouTube Data API v3 enabled (no OAuth needed for public stats). Find the channel ID via the channel's \"Share\" → \"Copy channel ID\", not the @handle. Stored only in this browser's local storage."
},
{
value: "github-repo", label: "GitHub repo (stars)", fetch: fetchGithubRepoStars, direction: "growth",
fields: [
{ key: "githubRepo", label: "Repo (owner/repo)", type: "text", placeholder: "anthropics/claude-code", required: true },
{ key: "githubToken", label: "GitHub token (optional)", type: "password", placeholder: "raises the rate limit" }
],
help: "Star counts are public — no token required for a public repo, though GitHub limits unauthenticated requests to 60/hour vs 5,000/hour with any token."
},
{
value: "discord", label: "Discord server (online members)", fetch: fetchDiscordStats, direction: "growth",
fields: [
{ key: "discordGuildId", label: "Server (guild) ID", type: "text", placeholder: "right-click server icon → Copy Server ID", required: true, full: true }
],
help: "No token needed. Requires Server Settings → Widget → Enable Server Widget turned on first. Gives online-member count, not total members — total requires a bot with server access, a bigger setup."
},
{
value: "twitch", label: "Twitch channel (followers)", fetch: fetchTwitchFollowers, connect: "twitch", direction: "growth",
fields: [
{ key: "twitchClientId", label: "Twitch Client ID", type: "text", placeholder: "from dev.twitch.tv console", required: true },
{ key: "twitchLogin", label: "Channel login (username)", type: "text", placeholder: "your_channel_name", required: true },
{ key: "twitchToken", type: "hidden" }
],
help: "Register an app at dev.twitch.tv/console/apps with OAuth Redirect URL set to this page's exact URL, type \"Public\". No client secret is used. Save the account first, then Connect. Reading a total follower count requires signing in as that channel."
}
],
note: "YouTube reads real subscriber count via the YouTube Data API (confirmed CORS-open with just a public API key, no OAuth). GitHub reads a repo's real star count via the same REST API already proven for Copilot (public data — a token is optional, just raises your rate limit). Discord reads a server's real online-member count via its public widget API (confirmed CORS-open, no auth) — Server Settings → Widget → Enable Server Widget must be turned on first; note this gives the online count, not total members, since total member count needs a bot with server access, a heavier setup. Twitch reads your real follower count after a one-click OAuth sign-in (implicit flow — no client secret, token lives only in this browser). \"Total limit\" doubles as a growth target, same as Investments. Instagram, Facebook, and TikTok need Business verification plus a multi-week Meta/TikTok App Review — see NOTES.md for the full setup path; they're documented rather than built because the blocker is account approval, not code."
},
homeassistant: {
label: "Home Assistant",
icon: '<path d="M12 3l8 6.5V21h-5v-6H9v6H4V9.5L12 3z" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/>',
hue: "#4fb3e8",
accountTypes: [
{
value: "sensor", label: "Numeric sensor (meter)", fetch: fetchHomeAssistantSensor,
fields: [ENTITY_FIELD],
help: "For entities whose state is a number — power draw, temperature, throughput, counts. Non-numeric entities belong on a Status or Control card instead."
},
{
value: "status", label: "Read-only state (door, motion, presence)", fetch: fetchHaEntityState, display: "status",
fields: [ENTITY_FIELD],
help: "Shows the entity's state word with no controls — binary sensors, device trackers, anything you want to watch but not change."
},
{
value: "toggle", label: "Toggle (light, switch, fan, input boolean)", fetch: fetchHaEntityState, display: "control",
fields: [ENTITY_FIELD],
// turn_on/turn_off/toggle is a shared contract across many HA
// domains, so one card type covers all of them.
actions: acc => {
const d = entityDomain(acc.creds.entityId) || "homeassistant";
const id = acc.creds.entityId;
return [
{ label: "On", run: () => haCallService(d, "turn_on", { entity_id: id }) },
{ label: "Off", run: () => haCallService(d, "turn_off", { entity_id: id }) },
{ label: "Toggle", run: () => haCallService(d, "toggle", { entity_id: id }) }
];
},
help: "Works for any domain supporting turn_on/turn_off — light, switch, fan, input_boolean, siren, humidifier and more. The domain is taken from the entity id."
},
{
value: "lock", label: "Lock", fetch: fetchHaEntityState, display: "control",
fields: [ENTITY_FIELD],
actions: acc => [
{ label: "Lock", run: () => haCallService("lock", "lock", { entity_id: acc.creds.entityId }) },
{ label: "Unlock", run: () => haCallService("lock", "unlock", { entity_id: acc.creds.entityId }), confirm: "Unlock this?" }
],
help: "Unlocking asks for confirmation first — it's the one action here with a physical-security consequence."
},
{
value: "cover", label: "Cover / blind / garage", fetch: fetchHaEntityState, display: "control",
fields: [ENTITY_FIELD],
actions: acc => [
{ label: "Open", run: () => haCallService("cover", "open_cover", { entity_id: acc.creds.entityId }) },
{ label: "Close", run: () => haCallService("cover", "close_cover", { entity_id: acc.creds.entityId }) },
{ label: "Stop", run: () => haCallService("cover", "stop_cover", { entity_id: acc.creds.entityId }) }
],
help: "Covers, blinds, shades and garage doors."
},
{
value: "scene", label: "Scene / script / automation (run)", fetch: fetchHaEntityState, display: "control",
fields: [ENTITY_FIELD],
actions: acc => {
const d = entityDomain(acc.creds.entityId);
const id = acc.creds.entityId;
if (d === "script") return [{ label: "Run", run: () => haCallService("script", "turn_on", { entity_id: id }) }];
if (d === "automation") return [
{ label: "Trigger", run: () => haCallService("automation", "trigger", { entity_id: id }) },
{ label: "Enable", run: () => haCallService("automation", "turn_on", { entity_id: id }) },
{ label: "Disable", run: () => haCallService("automation", "turn_off", { entity_id: id }) }
];
return [{ label: "Activate", run: () => haCallService("scene", "turn_on", { entity_id: id }) }];
},
help: "Buttons adapt to the entity: scenes activate, scripts run, automations can be triggered or enabled/disabled."
},
{
value: "climate", label: "Climate / thermostat", fetch: fetchHaEntityState, display: "control",
fields: [ENTITY_FIELD, { key: "climateStep", label: "Adjust step (°)", type: "number", placeholder: "1" }],
actions: (acc, attrs) => {
const id = acc.creds.entityId;
const step = Number(acc.creds.climateStep) || 1;
const target = Number(attrs && attrs.temperature);
const nudge = delta => () => {
if (!Number.isFinite(target)) {
return Promise.reject(new Error("Home Assistant hasn't reported a target temperature for this entity yet — hit Refresh first."));
}
return haCallService("climate", "set_temperature",
{ entity_id: id, temperature: Math.round((target + delta) * 10) / 10 });
};
return [
{ label: `−${step}°`, run: nudge(-step) },
{ label: `+${step}°`, run: nudge(step) },
{ label: "Off", run: () => haCallService("climate", "turn_off", { entity_id: id }) }
];
},
summary: attrs => {
const cur = Number(attrs.current_temperature);
const tgt = Number(attrs.temperature);
const bits = [];
if (Number.isFinite(cur)) bits.push(`now ${cur}°`);
if (Number.isFinite(tgt)) bits.push(`target ${tgt}°`);
return bits.join(" · ");
},
help: "The hero shows the HVAC mode; current and target temperature sit underneath. Adjustment is relative to whatever HA last reported as the target."
},
{
value: "media", label: "Media player", fetch: fetchHaEntityState, display: "control",
fields: [ENTITY_FIELD],
actions: acc => {
const id = acc.creds.entityId;
return [
{ label: "Play/Pause", run: () => haCallService("media_player", "media_play_pause", { entity_id: id }) },
{ label: "Prev", run: () => haCallService("media_player", "media_previous_track", { entity_id: id }) },
{ label: "Next", run: () => haCallService("media_player", "media_next_track", { entity_id: id }) },
{ label: "Vol −", run: () => haCallService("media_player", "volume_down", { entity_id: id }) },
{ label: "Vol +", run: () => haCallService("media_player", "volume_up", { entity_id: id }) }
];
},
summary: attrs => {
const bits = [];
if (attrs.media_title) bits.push(String(attrs.media_title));
if (attrs.media_artist) bits.push(String(attrs.media_artist));
if (Number.isFinite(Number(attrs.volume_level))) bits.push(`vol ${Math.round(Number(attrs.volume_level) * 100)}%`);
return bits.join(" · ");
},
help: "Transport controls plus whatever the player reports as now-playing."
},
{
value: "camera", label: "Camera snapshot", fetch: fetchHaEntityState, display: "camera",
fields: [ENTITY_FIELD],
help: "Shows a still image, re-fetched whenever the card refreshes. A continuous stream is a much heavier lift and isn't wired here. Works with Frigate cameras, which appear as normal camera entities."
}
],
note: "Reads AND controls Home Assistant over its REST API. Connect once in Settings (base URL + long-lived token from your HA profile page), then Browse to pick entities — you never type an entity id. Requires this page's serving origin under http: cors_allowed_origins in configuration.yaml, then an HA restart; serving the dashboard from HA's own /config/www folder avoids the CORS setup entirely since it's then same-origin. Control cards call HA services directly and re-read the entity immediately afterwards, so a card never looks stale right after you act on it. Everything else in this dashboard works with no Home Assistant at all."
},
homelab: {
label: "Home Lab",
icon: '<rect x="4" y="4" width="16" height="5" rx="1" fill="none" stroke="currentColor" stroke-width="1.5"/><rect x="4" y="10.5" width="16" height="5" rx="1" fill="none" stroke="currentColor" stroke-width="1.5"/><rect x="4" y="17" width="16" height="3.5" rx="1" fill="none" stroke="currentColor" stroke-width="1.5"/><circle cx="7" cy="6.5" r="0.7" fill="currentColor"/><circle cx="7" cy="13" r="0.7" fill="currentColor"/>',
hue: "#8b8f9e",
accountTypes: [
{
value: "json-metric", label: "Generic JSON metric (any local device)", fetch: fetchHomeLabMetric,
fields: [
{ key: "homelabUrl", label: "URL", type: "text", placeholder: "http://192.168.1.x/api/...", required: true, full: true },
{ key: "homelabAuthHeader", label: "Auth header name (optional)", type: "text", placeholder: "Authorization or X-API-KEY" },
{ key: "homelabAuthValue", label: "Auth header value (optional)", type: "password", placeholder: "Bearer token or key" },
{ key: "homelabPath", label: "JSON field path", type: "text", placeholder: "dns_queries_today or cameras.front_door.fps", required: true, full: true }
],
help: "Generic by design — see the platform note for why. Works for anything that answers HTTP with JSON and sends usable CORS headers; if the device sends none at all, the request fails before this code sees a response."
}
],
note: "A generic tool rather than dedicated Pi-hole/Frigate/UniFi integrations — I can't reach devices on your LAN from here to verify their exact API shape or CORS behavior, and each has changed its API over versions (Pi-hole especially, between v5 and v6). Instead: point it at any URL that returns JSON, optionally with an auth header, and a dot-path to the numeric field you want (e.g. \"dns_queries_today\" or \"cameras.front_door.fps\"). Works for Pi-hole, Frigate, UniFi's local or cloud APIs, or literally any smart device/script that answers HTTP with JSON. If the device sends no CORS headers at all (common for admin panels never meant for third-party browser access), the request fails before this code even sees a response — that shows up as a generic network error, not a clean HTTP error."
},
security: {
label: "Security",
icon: '<path d="M12 3l7 3v5.5c0 4.2-2.9 7.9-7 8.9-4.1-1-7-4.7-7-8.9V6l7-3z" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="M9 12l2 2 4-4" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
hue: "#e34948",
accountTypes: [
{
value: "port-drift", label: "Open-port drift vs baseline", fetch: fetchPortDrift,
help: "TCP-connect scan of the hosts in SECURITY_HOSTS, compared against a saved baseline. The first run records the baseline; after that this counts ports that opened or closed. Zero is healthy — set \"Total limit\" to how many changes you'd tolerate before the card goes red. Risky services (Telnet, FTP, exposed databases, unauthenticated Ollama or Moonraker) are called out by name even when they haven't changed."
},
{
value: "tls-expiry", label: "Days until soonest cert expiry", fetch: fetchTlsExpiry, direction: "growth",
help: "Reports the fewest days remaining across every host in SECURITY_TLS_HOSTS, so one card covers the whole estate. Set \"Total limit\" to the comfort threshold you want to reach — 90 days is a common choice. Self-signed and untrusted certs are flagged in the detail rather than treated as failures, since a home lab legitimately has them."
},
{
value: "http-headers", label: "Missing security headers", fetch: fetchHttpHeaders,
help: "Checks your own services in SECURITY_HTTP_URLS for HSTS, CSP, X-Content-Type-Options, X-Frame-Options and Referrer-Policy. Counts how many are missing in total. Zero is healthy."
}
],
note: "Continuous self-assessment of your own network, run by the backend companion — a browser can't open raw sockets or complete a TLS handshake against another host. Every target is read from the server's .env, never from this page, so a card can only ever check hosts you listed yourself. All three checks are passive: a TCP connect, a TLS handshake, an HTTP GET. Nothing is exploited, nothing is written to. Tool-based checks (arp-scan for new devices, nuclei, IDS log parsing) need binaries and host networking the container doesn't have — server/README.md documents how to add them."
},
claudecode: {
label: "Claude Code",
icon: '<path d="M7 8l-3 4 3 4M17 8l3 4-3 4M13.5 6l-3 12" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/>',
hue: "#d97757",
accountTypes: [
{
value: "plan", label: "Plan limits (session + weekly, all windows)", fetch: fetchClaudePlanUsage,
direction: "usage",
fields: [
// Only a NAME travels from the browser. The credential itself
// stays in the server's .env, so a card can't be edited into
// carrying or leaking one. The list comes from the backend, so
// there is no account name to remember or mistype; if the backend
// is unreachable this degrades to a plain text box.
{ key: "claudeAccount", label: "Claude account", type: "select", full: true,
options: () => claudeAccountOptions(),
placeholder: "account name as configured in the server's .env" }
],
help: "One card, one meter per limit window — session, weekly all-models, and each per-model weekly cap — mirroring Claude Code's /usage. Needs the plan-usage seam filled in on the backend (server/README → \"Plan usage seam\"); until then it reports that plainly instead of showing a blank card."
},
{
value: "usage", label: "Local usage (tokens, cost, per model)", fetch: fetchClaudeCodeUsage,
fields: [
{ key: "ccMetric", label: "Metric", type: "select", options: [
["output", "Output tokens"], ["input", "Input tokens"],
["cacheRead", "Cache reads"], ["cacheWrite", "Cache writes"],
["totalTokens", "All tokens"], ["messages", "Messages"],
["cost", "Equivalent API cost ($)"]
] },
{ key: "ccPeriod", label: "Period", type: "select", options: [
["today", "Today"], ["week", "Last 7 days"],
["month", "Last 30 days"], ["all", "All time"]
] },
{ key: "ccModel", label: "Model", type: "select", full: true, options: [
["all", "All models"], ["claude-fable-5", "Fable 5"],
["claude-opus-5", "Opus 5"], ["claude-sonnet-5", "Sonnet 5"],
["claude-haiku-4-5", "Haiku 4.5"], ["claude-opus-4-8", "Opus 4.8"]
] },
{ key: "ccNote", type: "hidden" }
],
help: "Reads Claude Code's local session transcripts through the backend — no API calls, no spend. Set CLAUDE_PROJECTS_HOST_DIR in server/.env to your ~/.claude/projects folder; the mount is read-only and only timestamps, model names and token counts are ever parsed. \"Total limit\" is a target you pick, because Anthropic doesn't publish the 5-hour or weekly caps anywhere machine-readable."
}
],
note: "Measures your subscription LLM usage, not API spend — the two are separate systems. Add one card per view: Fable output tokens this week, all-model cost today, and so on. Covers Claude Code only; claude.ai web and mobile chat usage isn't written to these files. \"Equivalent API cost\" is what the same tokens would have cost at API rates — useful for judging what your plan is worth, not a bill you'll receive."
},
health: {
label: "Health",