From 60cee5418e15074ff84f85d4b35821107cc81d21 Mon Sep 17 00:00:00 2001
From: Simone <simone.chifari@gmail.com>
Date: Thu, 23 Jul 2026 18:36:15 +0200
Subject: [PATCH] feat(web): dark Gitea UI, systemd installer, WEB-UI docs (W7)

Restyles every template with a hand-written dark Gitea-style theme
(web/static/app.css, ~270 lines: badges, buttons, cards, focus rings,
prefers-reduced-motion) and completes the htmx polling wiring for all
four dashboard cards. Adds the repeatable setup-web-linux.sh installer
(idempotent: pip install '[web]' non-editable, render ci-web.service,
template [web]/[web.oidc] into config.toml, prompt for keyring secrets,
print Gitea OIDC registration steps, enable/restart the unit) plus
deploy/systemd/ci-web.service and docs/WEB-UI.md.
---
 deploy/systemd/ci-web.service                 |  38 +++
 docs/WEB-UI.md                                | 218 +++++++++++++++
 setup-web-linux.sh                            | 263 ++++++++++++++++++
 src/ci_orchestrator/web/static/app.css        | 263 +++++++++++++++++-
 src/ci_orchestrator/web/static/htmx.min.js    |   1 +
 src/ci_orchestrator/web/templates/base.html   |  15 +-
 .../web/templates/dashboard.html              |  10 +-
 .../web/templates/partials/audit.html         |  58 ++--
 .../web/templates/partials/cache.html         |  10 +-
 .../web/templates/partials/confirm.html       |   4 +-
 .../web/templates/partials/host.html          | 103 ++++---
 .../web/templates/partials/lock_conflict.html |   4 +-
 .../web/templates/partials/result.html        |  11 +-
 .../web/templates/partials/vms.html           |  83 +++---
 14 files changed, 953 insertions(+), 128 deletions(-)
 create mode 100644 deploy/systemd/ci-web.service
 create mode 100644 docs/WEB-UI.md
 create mode 100755 setup-web-linux.sh
 create mode 100644 src/ci_orchestrator/web/static/htmx.min.js

diff --git a/deploy/systemd/ci-web.service b/deploy/systemd/ci-web.service
new file mode 100644
index 0000000..f9676d7
--- /dev/null
+++ b/deploy/systemd/ci-web.service
@@ -0,0 +1,38 @@
+[Unit]
+Description=Local CI/CD — web dashboard (ci web serve)
+Documentation=file:///opt/ci/local-ci-cd-system/docs/WEB-UI.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ci-runner
+Group=ci-runner
+WorkingDirectory=/opt/ci/local-ci-cd-system
+# CI_CONFIG (and any other CI_* override) lives here, one KEY=VALUE per
+# line, no quoting. The "-" prefix means the unit still starts if the file
+# is absent (config.toml is then auto-discovered at /var/lib/ci/config.toml
+# — see config.py's resolution order). Rendered/edited by setup-web-linux.sh
+# — never put secrets in this file, only the config path.
+EnvironmentFile=-/etc/ci/web.env
+# The bind address below is filled in by setup-web-linux.sh at install time
+# (a LAN IP, or left as 127.0.0.1 for loopback-only) — never edit this file
+# by hand on the target host, re-run the installer instead.
+ExecStart=/opt/ci/venv/bin/python -m ci_orchestrator web serve --host __CI_WEB_BIND_HOST__ --port 8800
+Restart=on-failure
+RestartSec=10
+TimeoutStartSec=30s
+
+# Hardening. ProtectHome=read-only (NOT "yes"/true): the OIDC/session
+# secrets are read from ci-runner's headless keyring backend
+# (keyrings.alt.file.PlaintextKeyring, ~/.local/share/python_keyring/ —
+# see docs/WEB-UI.md's keyring-headless note); "yes" would hide /home
+# entirely and every login would fail with a keyring lookup error.
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=read-only
+PrivateTmp=true
+ReadWritePaths=/var/lib/ci
+
+[Install]
+WantedBy=multi-user.target
diff --git a/docs/WEB-UI.md b/docs/WEB-UI.md
new file mode 100644
index 0000000..f419687
--- /dev/null
+++ b/docs/WEB-UI.md
@@ -0,0 +1,218 @@
+# Web UI — Management Dashboard
+
+Server-rendered dashboard (`ci web serve`) for the local CI/CD system: live
+VMs, cargo cache, disk, and act_runner status, plus confirm-gated destructive
+actions (VM remove/cleanup, cache purge, template backup) with an audit
+trail. In-process only — it imports `operations/` and `backends.load_backend`
+directly and never shells out to the CLI.
+
+See `plans/web-ui-management-plan.md` (steps W0–W7) for the design history
+and `config.example.toml`'s `[web]` / `[web.oidc]` section for every
+config key referenced below.
+
+---
+
+## 1. Prerequisites
+
+- The Linux host already bootstrapped by `setup-host-linux.sh` (`ci-runner`
+  service user, `/opt/ci/venv`, `/var/lib/ci/config.toml`).
+- A reachable Gitea instance to authenticate against (OIDC/OAuth2) — only
+  required if you intend to bind the dashboard on the LAN; a loopback-only
+  install can skip Gitea entirely (see §5, "open mode").
+- Outbound network from the host to Gitea's `/.well-known/openid-configuration`
+  endpoint, if OIDC is enabled.
+
+Nothing here needs internet access — `ci_orchestrator[web]`'s dependencies
+(FastAPI, Jinja2, Authlib, uvicorn, ...) install from the same package index
+already used for the core install, and every frontend asset
+(`web/static/app.css`, `web/static/htmx.min.js`) is vendored in the repo, no
+CDN.
+
+---
+
+## 2. Running the installer
+
+```bash
+cd /opt/ci/local-ci-cd-system
+sudo bash setup-web-linux.sh --host 127.0.0.1        # loopback-only, no OIDC needed
+# or, once OIDC is registered (see §3):
+sudo bash setup-web-linux.sh --host 192.168.1.50      # LAN
+```
+
+`setup-web-linux.sh` is idempotent — every mutating step checks its own
+state first and skips (with a message) when already satisfied, so re-running
+it (e.g. after `git pull` + a code change) is always safe:
+
+1. `pip install '<repo>[web]'` into `/opt/ci/venv`, **non-editable** — per
+   `CLAUDE.md`, the production venv can't resolve editable installs when
+   `act_runner`/systemd launches Python from a transient working directory.
+2. Renders `deploy/systemd/ci-web.service` into `/etc/systemd/system/`,
+   substituting the bind IP you passed via `--host`.
+3. Appends a **commented** `[web]` / `[web.oidc]` template to
+   `/var/lib/ci/config.toml` if no such section exists yet — it never
+   overwrites an existing one, and never writes a secret value.
+4. Prompts (interactively, one at a time) to store `WebSessionSecret` and
+   `WebOidcClientSecret` in the keyring, if they aren't already set. The
+   secret is only ever typed at the terminal prompt — the installer never
+   accepts it as a command-line argument and never echoes or logs it.
+5. Prints the manual Gitea OIDC application registration steps (see §3).
+6. `systemctl daemon-reload` then enables + starts (or restarts, if already
+   running) `ci-web.service`.
+
+Run `setup-web-linux.sh --help` for the full flag list (`--skip-pip`,
+`--skip-secrets`, `--config-path`).
+
+After step 3/4, edit `/var/lib/ci/config.toml`: uncomment the appended
+`[web]` / `[web.oidc]` block, fill in `issuer`, `client_id`,
+`allowed_users`, then restart the service (`systemctl restart ci-web.service`).
+
+---
+
+## 3. Gitea OAuth2 application registration
+
+The dashboard authenticates against Gitea via OIDC (Authlib + Gitea's
+`/.well-known/openid-configuration` discovery document). Register the
+application **before** enabling `[web.oidc]`:
+
+1. In Gitea: **Settings → Applications → "Manage OAuth2 Applications" →
+   Create a new OAuth2 Application**.
+2. **Application Name**: anything recognizable, e.g. `ci-web`.
+3. **Redirect URI**: `http://<LAN-IP>:8800/auth/callback` — this **must
+   match `[web.oidc].redirect_url` exactly** (scheme, host, port, and path).
+   A mismatch is the #1 cause of a login redirect loop (see §6).
+4. Gitea shows a **Client ID** and **Client Secret** exactly once:
+   - Client ID → `[web.oidc].client_id` in `config.toml` (not a secret, plain text is fine).
+   - Client Secret → **never put it in `config.toml`**. Store it in the
+     keyring instead:
+     ```bash
+     sudo -u ci-runner /opt/ci/venv/bin/python -m ci_orchestrator creds set \
+         --target WebOidcClientSecret --user web-oidc-client
+     ```
+     `config.toml` only ever holds the keyring *key name*
+     (`client_secret_cred = "WebOidcClientSecret"`), never the value.
+5. Add the Gitea username(s) allowed to log in to `[web].allowed_users`.
+   **The allowlist is fail-closed**: an empty list denies everyone, it
+   never means "allow all".
+
+---
+
+## 4. Operating
+
+```bash
+# Start / stop / restart
+sudo systemctl start ci-web.service
+sudo systemctl stop ci-web.service
+sudo systemctl restart ci-web.service     # after a config.toml edit or a code upgrade
+
+# Status
+systemctl status ci-web.service
+
+# Logs (uvicorn access log + app stdout/stderr go to the journal)
+journalctl -u ci-web.service -f
+journalctl -u ci-web.service -n 100 --no-pager
+
+# Health check (unauthenticated, always 200)
+curl -s http://127.0.0.1:8800/healthz
+```
+
+Once code changes: `sudo bash setup-web-linux.sh --host <same-as-before>`
+reinstalls the `[web]` extra and restarts the service in one step (steps
+2–6 no-op if nothing else changed).
+
+---
+
+## 5. Firewall / security
+
+- **Bind only a specific LAN IP, never `0.0.0.0`.** Neither `ci web serve`
+  nor `setup-web-linux.sh` will ever write `0.0.0.0` — the installer prompts
+  for (or accepts via `--host`) one explicit address, defaulting to
+  `127.0.0.1`.
+- **Open mode (no `[web.oidc]` configured) is localhost-only, enforced at
+  startup.** `ci web serve` refuses to start if you bind a non-loopback
+  address while `[web.oidc]` is absent — an unauthenticated dashboard that
+  can destroy VMs and purge caches must never be reachable from the LAN.
+  Configure `[web.oidc]` first, or bind `127.0.0.1`.
+- Every mutating route (VM remove/cleanup, cache purge, template backup) is
+  behind a synchronizer-token CSRF check and a two-step confirm gate (a
+  preview/dry-run, then an explicit "Confirm" that actually executes) —
+  there is no one-click destroy.
+- Every mutating action appends exactly one entry to the audit log
+  (`[web].audit_log`, default `/var/lib/ci/logs/web-audit.jsonl`), viewable
+  at `/audit` in the dashboard.
+- If you run a host firewall (ufw/nftables/iptables), only open the chosen
+  port (default `8800`) to the specific LAN/VLAN that needs dashboard
+  access, not the whole network.
+
+---
+
+## 6. Keyring / headless note
+
+`ci-web.service` runs as `ci-runner` under systemd — there is no desktop
+session and no D-Bus, so the GNOME Secret Service backend (`secret-tool`)
+does not work here. This host uses **`keyrings.alt.file.PlaintextKeyring`**
+instead (already the credential backend used for guest/Gitea credentials —
+see `plans/archived/2026-05-23/B3-closeout.md`):
+
+- Config: `/home/ci-runner/.local/share/python_keyring/keyringrc.cfg`
+  (`[backend] default-keyring=keyrings.alt.file.PlaintextKeyring`)
+- Store: `/home/ci-runner/.local/share/python_keyring/keyring_pass.cfg` —
+  plain text, readable only by `ci-runner` (file permissions), no D-Bus
+  session required. Verified to work both from `sudo -u ci-runner ...` and
+  from inside a plain systemd service.
+- This is why `ci-web.service`'s hardening uses `ProtectHome=read-only`
+  and **not** `ProtectHome=yes`/`true`: the latter hides `/home` entirely
+  from the unit's mount namespace, which would break every OIDC/session
+  secret lookup and make login fail even though the keyring itself is
+  fine. `read-only` keeps `/home/ci-runner` readable (the app never writes
+  to the keyring at request time — secrets are set once, out-of-band, by
+  `ci creds set`) while still blocking writes.
+- `WebSessionSecret` / `WebOidcClientSecret` are keyring key *names* in
+  `config.toml` (`session_secret_cred`, `client_secret_cred`) — the actual
+  values live only in the keyring, set via `ci creds set --target <name>
+  --user <label>` (interactive prompt, `hide_input` + confirmation; never
+  a CLI argument, never logged).
+
+---
+
+## 7. Troubleshooting
+
+**Login loop (bounces back to `/login` after authenticating with Gitea)**
+: The registered Redirect URI in Gitea does not exactly match
+  `[web.oidc].redirect_url` in `config.toml` — check scheme (`http` vs
+  `https`), host/IP, port, and the `/auth/callback` path character-for-character.
+
+**403 after a successful Gitea login**
+: Your Gitea username is not in `[web].allowed_users` (or the list is
+  empty — the allowlist is fail-closed by design). Add it and restart the
+  service.
+
+**"keyring key '...' not found -- run `ci creds set ...`" in the journal /
+on `/login`**
+: The session secret or the OIDC client secret has not been stored yet
+  (or was stored for a different Unix user than `ci-runner`, or under a
+  different `_cred` name than the one in `config.toml`). Re-run:
+  ```bash
+  sudo -u ci-runner /opt/ci/venv/bin/python -m ci_orchestrator creds set \
+      --target WebSessionSecret --user web-session
+  ```
+  substituting the exact key name printed in the error. See §6 for why this
+  must run as `ci-runner`, not as your own login.
+
+**Dashboard is blank / cards show "unavailable"**
+: The VM backend (`vmrun`) or `shutil.disk_usage`/`systemctl` could not be
+  reached from the host — the dashboard degrades a card to an "unavailable"
+  notice instead of a 500. Check `vmware-host.service` is up
+  (`systemctl is-active vmware-host.service`) and that `/healthz` still
+  returns `200`.
+
+**`ci web serve` refuses to start with "refusing to bind ... without
+authentication"**
+: You passed a non-loopback `--host` (or `[web].bind_host` in
+  `config.toml`) while `[web.oidc]` is unset. This is the guard described
+  in §5 — configure `[web.oidc]` (see §3) or bind `127.0.0.1`.
+
+**Confirm/Cleanup/Purge form returns 403**
+: The CSRF token expired (the session cookie was cleared, e.g. by
+  `/logout`, or the browser tab was left open across a service restart
+  that rotated the session secret in open mode). Reload the page and retry
+  — the confirm form always mints a fresh token.
diff --git a/setup-web-linux.sh b/setup-web-linux.sh
new file mode 100755
index 0000000..72a7d41
--- /dev/null
+++ b/setup-web-linux.sh
@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+# setup-web-linux.sh — install/upgrade the ci-orchestrator web dashboard (W7b)
+#
+# Repeatable / idempotent: safe to re-run any time (e.g. after `git pull` +
+# a code change — see CLAUDE.md: the production venv must be reinstalled
+# non-editable after every change). Every mutating step checks its own
+# state first and skips (with a message) when already satisfied.
+#
+# What it does:
+#   1. pip install '<repo>[web]' into /opt/ci/venv, non-editable, as ci-runner
+#   2. Render deploy/systemd/ci-web.service into /etc/systemd/system/,
+#      substituting the LAN bind IP; write /etc/ci/web.env (CI_CONFIG) if the
+#      config path was overridden
+#   3. Ensure a commented [web]/[web.oidc] template exists in config.toml
+#      (never overwrites an existing [web] section)
+#   4. Prompt to store WebSessionSecret / WebOidcClientSecret in the keyring
+#      (interactive prompt only — never accepts a secret as a CLI argument)
+#   5. Print the manual Gitea OIDC application registration steps
+#   6. systemctl daemon-reload && enable (+ restart if already running)
+#
+# Usage: sudo bash setup-web-linux.sh [--host <lan-ip>] [options]
+# See --help for the full option list.
+
+set -euo pipefail
+
+# ── Defaults ─────────────────────────────────────────────────────────────────
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CI_USER="ci-runner"
+OPT_CI="/opt/ci"
+VENV="$OPT_CI/venv"
+REPO_DIR="$SCRIPT_DIR"
+UNIT_SRC="$REPO_DIR/deploy/systemd/ci-web.service"
+UNIT_DST="/etc/systemd/system/ci-web.service"
+ENV_FILE="/etc/ci/web.env"
+CONFIG_PATH="/var/lib/ci/config.toml"
+WEB_PORT=8800
+WEB_HOST=""            # resolved below (arg > prompt > 127.0.0.1)
+SKIP_PIP=false
+SKIP_SECRETS=false
+ASSUME_DEFAULT_HOST=false
+
+# ── Colours ──────────────────────────────────────────────────────────────────
+RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
+info()  { echo -e "${GREEN}==>${NC} $*"; }
+warn()  { echo -e "${YELLOW}  ! $*${NC}"; }
+die()   { echo -e "${RED}ERROR: $*${NC}" >&2; exit 1; }
+
+usage() {
+    cat <<EOF
+Usage: sudo bash $(basename "$0") [options]
+
+Options:
+  --host <ip>         LAN IP the dashboard binds to (written into the unit
+                       and into the config.toml template). Default: prompt,
+                       falling back to 127.0.0.1 (loopback-only) on Enter.
+  --config-path <p>    Target config.toml (default: $CONFIG_PATH).
+  --skip-pip            Skip step 1 (pip install '[web]' extra).
+  --skip-secrets         Skip step 4 (interactive keyring secret prompts).
+  -h, --help              Show this help.
+
+Never binds 0.0.0.0. Binding a non-loopback IP without [web.oidc]
+configured is refused at runtime by 'ci web serve' itself (open mode is
+localhost-only) -- see docs/WEB-UI.md.
+
+Examples:
+  sudo bash setup-web-linux.sh --host 127.0.0.1
+  sudo bash setup-web-linux.sh --host 192.168.1.50
+  sudo bash setup-web-linux.sh --skip-pip --skip-secrets   # re-render unit only
+EOF
+    exit 1
+}
+
+# ── Parse args ───────────────────────────────────────────────────────────────
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --host) WEB_HOST="$2"; shift 2 ;;
+        --config-path) CONFIG_PATH="$2"; shift 2 ;;
+        --skip-pip) SKIP_PIP=true; shift ;;
+        --skip-secrets) SKIP_SECRETS=true; shift ;;
+        -h|--help) usage ;;
+        *) echo "Unknown option: $1" >&2; usage ;;
+    esac
+done
+
+[[ $EUID -eq 0 ]] || die "run as root (sudo bash $(basename "$0") ...)"
+[[ -f "$UNIT_SRC" ]] || die "unit template not found: $UNIT_SRC (run from the repo root)"
+id "$CI_USER" &>/dev/null || die "user '$CI_USER' does not exist -- run setup-host-linux.sh first"
+[[ -x "$VENV/bin/python" ]] || die "$VENV/bin/python not found -- run setup-host-linux.sh first"
+
+if [[ -z "$WEB_HOST" ]]; then
+    read -r -p "LAN IP to bind the dashboard to [127.0.0.1]: " WEB_HOST
+    WEB_HOST="${WEB_HOST:-127.0.0.1}"
+fi
+
+echo ""
+echo "╔══════════════════════════════════════════════════════╗"
+echo "║        ci-orchestrator web dashboard — installer      ║"
+echo "╚══════════════════════════════════════════════════════╝"
+echo "  Bind        : ${WEB_HOST}:${WEB_PORT}"
+echo "  ci_user     : $CI_USER"
+echo "  venv        : $VENV"
+echo "  config.toml : $CONFIG_PATH"
+echo ""
+
+# ── Step 1: pip install '[web]' extra (non-editable, per CLAUDE.md) ─────────
+if [[ "$SKIP_PIP" == false ]]; then
+    info "[1/6] Installing ci_orchestrator[web] into $VENV (non-editable)"
+    sudo -u "$CI_USER" "$VENV/bin/pip" install -q "${REPO_DIR}[web]"
+    verify_out=$(sudo -u "$CI_USER" "$VENV/bin/python" -m ci_orchestrator web serve --help 2>&1) \
+        || die "'ci web serve --help' failed after install -- see output above"
+    echo "  Verify OK: ${verify_out%%$'\n'*}"
+else
+    info "[1/6] pip install -- SKIPPED (--skip-pip)"
+fi
+
+# ── Step 2: render the systemd unit + optional CI_CONFIG env file ───────────
+info "[2/6] Rendering ci-web.service (bind host: $WEB_HOST)"
+RENDERED="$(mktemp)"
+trap 'rm -f "$RENDERED"' EXIT
+sed "s#__CI_WEB_BIND_HOST__#${WEB_HOST}#" "$UNIT_SRC" > "$RENDERED"
+
+if [[ -f "$UNIT_DST" ]] && cmp -s "$RENDERED" "$UNIT_DST"; then
+    warn "$UNIT_DST already up to date -- skip"
+    UNIT_CHANGED=false
+else
+    install -m 644 "$RENDERED" "$UNIT_DST"
+    echo "  Wrote $UNIT_DST"
+    UNIT_CHANGED=true
+fi
+
+mkdir -p /etc/ci
+if [[ "$CONFIG_PATH" != "/var/lib/ci/config.toml" ]]; then
+    if [[ -f "$ENV_FILE" ]] && grep -q '^CI_CONFIG=' "$ENV_FILE"; then
+        warn "$ENV_FILE already sets CI_CONFIG -- skip (edit manually to change it)"
+    else
+        echo "CI_CONFIG=$CONFIG_PATH" >> "$ENV_FILE"
+        chmod 640 "$ENV_FILE"
+        chown "root:$CI_USER" "$ENV_FILE" 2>/dev/null || true
+        echo "  Wrote CI_CONFIG=$CONFIG_PATH to $ENV_FILE"
+    fi
+else
+    echo "  Using the auto-discovered default config.toml path -- no $ENV_FILE needed"
+fi
+
+# ── Step 3: ensure a [web]/[web.oidc] template exists in config.toml ────────
+info "[3/6] config.toml [web] / [web.oidc] template"
+WEB_MARKER="# --- appended by setup-web-linux.sh ---"
+if [[ -f "$CONFIG_PATH" ]] && { grep -qF "$WEB_MARKER" "$CONFIG_PATH" || grep -q '^\[web\]' "$CONFIG_PATH"; }; then
+    warn "[web] section (or a previously appended template) already present in $CONFIG_PATH -- skip, not overwriting"
+else
+    [[ -f "$CONFIG_PATH" ]] || die "$CONFIG_PATH does not exist -- run setup-host-linux.sh first (it creates the base config.toml)"
+    cat >> "$CONFIG_PATH" <<EOF
+
+$WEB_MARKER
+# Uncomment and fill in [web.oidc] once you have registered the Gitea
+# OAuth2 application (see the installer's step 5 output / docs/WEB-UI.md).
+# session_secret_cred / client_secret_cred are KEYRING KEY NAMES only --
+# the secrets themselves are never written to this file.
+#
+# [web]
+# enabled             = true
+# bind_host           = "${WEB_HOST}"   # never 0.0.0.0
+# bind_port           = ${WEB_PORT}
+# audit_log           = "/var/lib/ci/logs/web-audit.jsonl"
+# allowed_users       = ["CHANGE-ME"]     # Gitea usernames allowed to log in
+# session_secret_cred = "WebSessionSecret"
+#
+# [web.oidc]
+# issuer              = "https://CHANGE-ME.example"
+# client_id           = "CHANGE-ME"
+# redirect_url        = "http://${WEB_HOST}:${WEB_PORT}/auth/callback"
+# client_secret_cred  = "WebOidcClientSecret"
+# scopes              = ["openid", "profile"]
+EOF
+    echo "  Appended a commented [web]/[web.oidc] template to $CONFIG_PATH"
+fi
+
+# ── Step 4: keyring secrets (interactive prompt only, never argv) ───────────
+info "[4/6] Keyring secrets (WebSessionSecret, WebOidcClientSecret)"
+if [[ "$SKIP_SECRETS" == true ]]; then
+    echo "  SKIPPED (--skip-secrets)"
+else
+    _secret_present() {
+        sudo -u "$CI_USER" "$VENV/bin/python" -c "
+from ci_orchestrator.credentials import KeyringCredentialStore
+KeyringCredentialStore().get('$1')
+" &>/dev/null
+    }
+
+    _set_secret_if_needed() {
+        local name="$1" label="$2"
+        if _secret_present "$name"; then
+            warn "Keyring key '$name' already set -- skip"
+            return
+        fi
+        read -r -p "  Set keyring key '$name' now? [Y/n] " ans
+        case "$ans" in
+            [nN]*)
+                warn "Skipped -- set it later with:" \
+                     "sudo -u $CI_USER $VENV/bin/python -m ci_orchestrator creds set --target $name --user $label"
+                ;;
+            *)
+                # Delegates straight to the CLI's own interactive prompt
+                # (hide_input + confirmation) -- the secret never touches
+                # this script's variables, argv, or any log.
+                sudo -u "$CI_USER" "$VENV/bin/python" -m ci_orchestrator creds set \
+                    --target "$name" --user "$label"
+                ;;
+        esac
+    }
+
+    _set_secret_if_needed "WebSessionSecret" "web-session"
+    _set_secret_if_needed "WebOidcClientSecret" "web-oidc-client"
+fi
+
+# ── Step 5: manual Gitea OIDC app registration instructions ─────────────────
+info "[5/6] Gitea OIDC application registration (manual step)"
+cat <<EOF
+
+  In Gitea: Settings -> Applications -> "Manage OAuth2 Applications" -> Create
+    Application name : ci-web
+    Redirect URI      : http://${WEB_HOST}:${WEB_PORT}/auth/callback
+                          (must match [web.oidc].redirect_url EXACTLY --
+                          host, port and path, or login will loop)
+
+  After creating it, Gitea shows a Client ID and Client Secret ONCE:
+    1. Client ID     -> set [web.oidc].client_id in $CONFIG_PATH
+    2. Client Secret -> store in the keyring (never in config.toml):
+         sudo -u $CI_USER $VENV/bin/python -m ci_orchestrator creds set \\
+             --target WebOidcClientSecret --user web-oidc-client
+    3. Add your Gitea username(s) to [web].allowed_users in $CONFIG_PATH
+    4. Uncomment [web] and [web.oidc] in $CONFIG_PATH
+
+EOF
+
+# ── Step 6: enable + (re)start the service ───────────────────────────────────
+info "[6/6] systemctl daemon-reload + enable/restart ci-web.service"
+systemctl daemon-reload
+if systemctl is-active --quiet ci-web.service; then
+    systemctl restart ci-web.service
+    echo "  ci-web.service was already running -- restarted to pick up any changes"
+else
+    systemctl enable --now ci-web.service
+    echo "  ci-web.service enabled and started"
+fi
+
+echo ""
+echo "╔══════════════════════════════════════════════════════╗"
+echo "║                 Install complete                     ║"
+echo "╚══════════════════════════════════════════════════════╝"
+echo ""
+echo "  Status : systemctl status ci-web.service"
+echo "  Logs   : journalctl -u ci-web.service -f"
+if [[ "$WEB_HOST" == "127.0.0.1" || "$WEB_HOST" == "localhost" ]]; then
+    echo "  URL    : http://${WEB_HOST}:${WEB_PORT}/ (loopback only -- open mode works without OIDC)"
+else
+    echo "  URL    : http://${WEB_HOST}:${WEB_PORT}/"
+    echo "  NOTE   : a LAN bind refuses to start until [web.oidc] is configured"
+    echo "           and enabled in $CONFIG_PATH (see step 5 above) -- this"
+    echo "           matches the same guard 'ci web serve' enforces itself."
+fi
+echo "  Docs   : $REPO_DIR/docs/WEB-UI.md"
+echo ""
diff --git a/src/ci_orchestrator/web/static/app.css b/src/ci_orchestrator/web/static/app.css
index cabb305..3149e1c 100644
--- a/src/ci_orchestrator/web/static/app.css
+++ b/src/ci_orchestrator/web/static/app.css
@@ -1 +1,262 @@
-/* placeholder -- real dark Gitea-style design tokens land in W7 */
+/* ci-orchestrator web dashboard — dark, Gitea-style theme (W7a).
+ *
+ * Hand-written, no external framework. Design tokens per the W7 plan
+ * (plans/web-ui-management-plan.md, section W7a). Everything under this
+ * directory is served locally (`/static/app.css`) — the host LAN may be
+ * offline, so no `@import url(...)` to a CDN, no remote fonts.
+ */
+
+:root {
+  --bg: #16191d;
+  --panel: #1c2126;
+  --panel-2: #22272e;
+  --border: #30363d;
+  --text: #d1d5da;
+  --text-dim: #8b949e;
+  --accent: #3fb950;
+  --accent-hover: #46c359;
+  --danger: #f85149;
+  --warn: #d29922;
+  --link: #58a6ff;
+  --radius: 6px;
+  --font: system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+  --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
+}
+
+/* ── reset ────────────────────────────────────────────────────────────── */
+
+*, *::before, *::after { box-sizing: border-box; }
+
+html, body {
+  margin: 0;
+  padding: 0;
+  background: var(--bg);
+  color: var(--text);
+  font-family: var(--font);
+  font-size: 15px;
+  line-height: 1.5;
+}
+
+h1, h2, h3, p, dl, dd { margin: 0 0 0.75rem; }
+
+a { color: var(--link); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+code, .mono {
+  font-family: var(--mono);
+  font-size: 0.9em;
+  background: var(--panel-2);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 0.05em 0.4em;
+  color: var(--text);
+}
+
+/* ── navbar ───────────────────────────────────────────────────────────── */
+
+.navbar {
+  background: var(--panel);
+  border-bottom: 1px solid var(--border);
+}
+
+.navbar-inner {
+  max-width: 1200px;
+  margin: 0 auto;
+  padding: 0.85rem 1.5rem;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+
+.navbar-brand {
+  color: var(--text);
+  font-weight: 600;
+  font-size: 1.05rem;
+}
+.navbar-brand:hover { color: var(--accent-hover); text-decoration: none; }
+
+.navbar-links {
+  display: flex;
+  align-items: center;
+  gap: 1.25rem;
+  font-size: 0.9rem;
+}
+.navbar-links a { color: var(--text-dim); }
+.navbar-links a:hover { color: var(--link); }
+
+.navbar-user { color: var(--text); font-weight: 500; }
+.navbar-user-local { color: var(--text-dim); font-style: italic; }
+.navbar-logout { color: var(--danger) !important; }
+
+/* ── layout ───────────────────────────────────────────────────────────── */
+
+.content { max-width: 1200px; margin: 0 auto; padding: 1.5rem; }
+
+.dashboard-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(320px, 1fr));
+  gap: 1.25rem;
+  align-items: start;
+}
+
+/* A polling wrapper (htmx hx-get/hx-trigger target) that must not itself
+ * become a grid box — its children (the real .card sections) lay out
+ * directly in the parent grid. */
+.contents { display: contents; }
+
+/* ── cards ────────────────────────────────────────────────────────────── */
+
+.card {
+  background: var(--panel);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 1.25rem;
+}
+
+.card h2 {
+  font-size: 0.85rem;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--text-dim);
+  border-bottom: 1px solid var(--border);
+  padding-bottom: 0.6rem;
+  margin-bottom: 0.9rem;
+}
+
+.card h3 { font-size: 0.95rem; color: var(--text); }
+
+/* ── definition lists (status cards) ─────────────────────────────────── */
+
+dl { display: grid; grid-template-columns: auto 1fr; gap: 0.35rem 0.9rem; }
+dt { color: var(--text-dim); font-weight: 500; }
+dd { margin: 0; }
+
+/* ── tables ───────────────────────────────────────────────────────────── */
+
+.table-wrap { overflow-x: auto; }
+
+table { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
+
+th, td { text-align: left; padding: 0.5rem 0.6rem; border-bottom: 1px solid var(--border); }
+
+th {
+  color: var(--text-dim);
+  font-weight: 600;
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+}
+
+tbody tr { transition: background-color 120ms ease; }
+tbody tr:hover { background: var(--panel-2); }
+
+tr.row-orphan td { color: var(--warn); }
+tr.row-alert td { color: var(--danger); }
+
+/* ── status badges ────────────────────────────────────────────────────── */
+
+.badge {
+  display: inline-block;
+  padding: 0.15rem 0.6rem;
+  border-radius: 999px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  line-height: 1.5;
+  white-space: nowrap;
+}
+
+.badge-success { background: rgba(63, 185, 80, 0.15); color: var(--accent); border: 1px solid rgba(63, 185, 80, 0.4); }
+.badge-danger  { background: rgba(248, 81, 73, 0.15); color: var(--danger); border: 1px solid rgba(248, 81, 73, 0.4); }
+.badge-warn    { background: rgba(210, 153, 34, 0.15); color: var(--warn); border: 1px solid rgba(210, 153, 34, 0.4); }
+
+/* ── buttons ──────────────────────────────────────────────────────────── */
+
+.btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  border: 1px solid transparent;
+  border-radius: var(--radius);
+  padding: 0.45rem 0.9rem;
+  font-size: 0.875rem;
+  font-weight: 600;
+  font-family: inherit;
+  cursor: pointer;
+  background: var(--panel-2);
+  color: var(--text);
+  transition: background-color 120ms ease, border-color 120ms ease, transform 80ms ease;
+}
+.btn:hover { background: var(--border); }
+.btn:active { transform: translateY(1px); }
+
+.btn-primary { background: var(--accent); color: #04170a; border-color: var(--accent); }
+.btn-primary:hover { background: var(--accent-hover); }
+
+.btn-danger { background: transparent; color: var(--danger); border-color: var(--danger); }
+.btn-danger:hover { background: var(--danger); color: #2b0705; }
+
+/* ── forms ────────────────────────────────────────────────────────────── */
+
+form { margin-top: 1rem; display: flex; flex-wrap: wrap; align-items: center; gap: 0.75rem; }
+
+label { font-size: 0.85rem; color: var(--text-dim); display: inline-flex; align-items: center; gap: 0.4rem; }
+
+input[type="text"], input[type="number"] {
+  background: var(--panel-2);
+  border: 1px solid var(--border);
+  color: var(--text);
+  border-radius: var(--radius);
+  padding: 0.4rem 0.6rem;
+  font-size: 0.875rem;
+  font-family: inherit;
+}
+
+/* ── notices / confirm / result panels ───────────────────────────────── */
+
+.notice {
+  border-radius: var(--radius);
+  padding: 0.75rem 1rem;
+  margin: 0.75rem 0;
+  border: 1px solid var(--border);
+  font-size: 0.9rem;
+}
+.notice-warn { background: rgba(210, 153, 34, 0.08); border-color: rgba(210, 153, 34, 0.4); color: var(--warn); }
+
+.confirm-box { margin-bottom: 1.25rem; }
+
+.action-result {
+  border-radius: var(--radius);
+  padding: 0.9rem 1.1rem;
+  margin-bottom: 1.25rem;
+  border: 1px solid var(--border);
+}
+.result-ok { border-color: rgba(63, 185, 80, 0.4); background: rgba(63, 185, 80, 0.08); }
+.result-error { border-color: rgba(248, 81, 73, 0.4); background: rgba(248, 81, 73, 0.08); }
+
+/* ── accessibility ────────────────────────────────────────────────────── */
+
+:focus-visible {
+  outline: 2px solid var(--link);
+  outline-offset: 2px;
+  border-radius: 2px;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *, *::before, *::after {
+    animation-duration: 0.001ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.001ms !important;
+    scroll-behavior: auto !important;
+  }
+}
+
+/* ── responsive ───────────────────────────────────────────────────────── */
+
+@media (max-width: 640px) {
+  .navbar-inner { flex-direction: column; align-items: flex-start; gap: 0.5rem; }
+  form { flex-direction: column; align-items: flex-start; }
+  dl { grid-template-columns: 1fr; }
+}
diff --git a/src/ci_orchestrator/web/static/htmx.min.js b/src/ci_orchestrator/web/static/htmx.min.js
new file mode 100644
index 0000000..423cf01
--- /dev/null
+++ b/src/ci_orchestrator/web/static/htmx.min.js
@@ -0,0 +1 @@
+var htmx=function(){"use strict";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||"post");return n.values},remove:null,addClass:null,removeClass:null,toggleClass:null,takeClass:null,swap:null,defineExtension:null,removeExtension:null,logAll:null,logNone:null,logger:null,config:{historyEnabled:true,historyCacheSize:10,refreshOnHistoryMiss:false,defaultSwapStyle:"innerHTML",defaultSwapDelay:0,defaultSettleDelay:20,includeIndicatorStyles:true,indicatorClass:"htmx-indicator",requestClass:"htmx-request",addedClass:"htmx-added",settlingClass:"htmx-settling",swappingClass:"htmx-swapping",allowEval:true,allowScriptTags:true,inlineScriptNonce:"",inlineStyleNonce:"",attributesToSettle:["class","style","width","height"],withCredentials:false,timeout:0,wsReconnectDelay:"full-jitter",wsBinaryType:"blob",disableSelector:"[hx-disable], [data-hx-disable]",scrollBehavior:"instant",defaultFocusScroll:false,getCacheBusterParam:false,globalViewTransitions:false,methodsThatUseUrlParams:["get","delete"],selfRequestsOnly:true,ignoreTitle:false,scrollIntoViewOnBoost:true,triggerSpecsCache:null,disableInheritance:false,responseHandling:[{code:"204",swap:false},{code:"[23]..",swap:true},{code:"[45]..",swap:false,error:true}],allowNestedOobSwaps:true},parseInterval:null,_:null,version:"2.0.3"};Q.onLoad=j;Q.process=kt;Q.on=ye;Q.off=be;Q.trigger=de;Q.ajax=Rn;Q.find=r;Q.findAll=x;Q.closest=g;Q.remove=z;Q.addClass=K;Q.removeClass=G;Q.toggleClass=W;Q.takeClass=Z;Q.swap=$e;Q.defineExtension=Fn;Q.removeExtension=Bn;Q.logAll=V;Q.logNone=_;Q.parseInterval=h;Q._=e;const n={addTriggerHandler:St,bodyContains:le,canAccessLocalStorage:B,findThisElement:Se,filterValues:dn,swap:$e,hasAttribute:s,getAttributeValue:te,getClosestAttributeValue:re,getClosestMatch:i,getExpressionVars:En,getHeaders:fn,getInputValues:cn,getInternalData:ie,getSwapSpecification:gn,getTriggerSpecs:st,getTarget:Ee,makeFragment:P,mergeObjects:ce,makeSettleInfo:xn,oobSwap:He,querySelectorExt:ae,settleImmediately:Kt,shouldCancel:dt,triggerEvent:de,triggerErrorEvent:fe,withExtensions:Ft};const o=["get","post","put","delete","patch"];const R=o.map(function(e){return"[hx-"+e+"], [data-hx-"+e+"]"}).join(", ");function h(e){if(e==undefined){return undefined}let t=NaN;if(e.slice(-2)=="ms"){t=parseFloat(e.slice(0,-2))}else if(e.slice(-1)=="s"){t=parseFloat(e.slice(0,-1))*1e3}else if(e.slice(-1)=="m"){t=parseFloat(e.slice(0,-1))*1e3*60}else{t=parseFloat(e)}return isNaN(t)?undefined:t}function ee(e,t){return e instanceof Element&&e.getAttribute(t)}function s(e,t){return!!e.hasAttribute&&(e.hasAttribute(t)||e.hasAttribute("data-"+t))}function te(e,t){return ee(e,t)||ee(e,"data-"+t)}function c(e){const t=e.parentElement;if(!t&&e.parentNode instanceof ShadowRoot)return e.parentNode;return t}function ne(){return document}function m(e,t){return e.getRootNode?e.getRootNode({composed:t}):ne()}function i(e,t){while(e&&!t(e)){e=c(e)}return e||null}function H(e,t,n){const r=te(t,n);const o=te(t,"hx-disinherit");var i=te(t,"hx-inherit");if(e!==t){if(Q.config.disableInheritance){if(i&&(i==="*"||i.split(" ").indexOf(n)>=0)){return r}else{return null}}if(o&&(o==="*"||o.split(" ").indexOf(n)>=0)){return"unset"}}return r}function re(t,n){let r=null;i(t,function(e){return!!(r=H(t,ue(e),n))});if(r!=="unset"){return r}}function d(e,t){const n=e instanceof Element&&(e.matches||e.matchesSelector||e.msMatchesSelector||e.mozMatchesSelector||e.webkitMatchesSelector||e.oMatchesSelector);return!!n&&n.call(e,t)}function T(e){const t=/<([a-z][^\/\0>\x20\t\r\n\f]*)/i;const n=t.exec(e);if(n){return n[1].toLowerCase()}else{return""}}function q(e){const t=new DOMParser;return t.parseFromString(e,"text/html")}function L(e,t){while(t.childNodes.length>0){e.append(t.childNodes[0])}}function N(e){const t=ne().createElement("script");se(e.attributes,function(e){t.setAttribute(e.name,e.value)});t.textContent=e.textContent;t.async=false;if(Q.config.inlineScriptNonce){t.nonce=Q.config.inlineScriptNonce}return t}function A(e){return e.matches("script")&&(e.type==="text/javascript"||e.type==="module"||e.type==="")}function I(e){Array.from(e.querySelectorAll("script")).forEach(e=>{if(A(e)){const t=N(e);const n=e.parentNode;try{n.insertBefore(t,e)}catch(e){C(e)}finally{e.remove()}}})}function P(e){const t=e.replace(/<head(\s[^>]*)?>[\s\S]*?<\/head>/i,"");const n=T(t);let r;if(n==="html"){r=new DocumentFragment;const i=q(e);L(r,i.body);r.title=i.title}else if(n==="body"){r=new DocumentFragment;const i=q(t);L(r,i.body);r.title=i.title}else{const i=q('<body><template class="internal-htmx-wrapper">'+t+"</template></body>");r=i.querySelector("template").content;r.title=i.title;var o=r.querySelector("title");if(o&&o.parentNode===r){o.remove();r.title=o.innerText}}if(r){if(Q.config.allowScriptTags){I(r)}else{r.querySelectorAll("script").forEach(e=>e.remove())}}return r}function oe(e){if(e){e()}}function t(e,t){return Object.prototype.toString.call(e)==="[object "+t+"]"}function k(e){return typeof e==="function"}function D(e){return t(e,"Object")}function ie(e){const t="htmx-internal-data";let n=e[t];if(!n){n=e[t]={}}return n}function M(t){const n=[];if(t){for(let e=0;e<t.length;e++){n.push(t[e])}}return n}function se(t,n){if(t){for(let e=0;e<t.length;e++){n(t[e])}}}function X(e){const t=e.getBoundingClientRect();const n=t.top;const r=t.bottom;return n<window.innerHeight&&r>=0}function le(e){const t=e.getRootNode&&e.getRootNode();if(t&&t instanceof window.ShadowRoot){return ne().body.contains(t.host)}else{return ne().body.contains(e)}}function F(e){return e.trim().split(/\s+/)}function ce(e,t){for(const n in t){if(t.hasOwnProperty(n)){e[n]=t[n]}}return e}function S(e){try{return JSON.parse(e)}catch(e){C(e);return null}}function B(){const e="htmx:localStorageTest";try{localStorage.setItem(e,e);localStorage.removeItem(e);return true}catch(e){return false}}function U(t){try{const e=new URL(t);if(e){t=e.pathname+e.search}if(!/^\/$/.test(t)){t=t.replace(/\/+$/,"")}return t}catch(e){return t}}function e(e){return vn(ne().body,function(){return eval(e)})}function j(t){const e=Q.on("htmx:load",function(e){t(e.detail.elt)});return e}function V(){Q.logger=function(e,t,n){if(console){console.log(t,e,n)}}}function _(){Q.logger=null}function r(e,t){if(typeof e!=="string"){return e.querySelector(t)}else{return r(ne(),e)}}function x(e,t){if(typeof e!=="string"){return e.querySelectorAll(t)}else{return x(ne(),e)}}function E(){return window}function z(e,t){e=y(e);if(t){E().setTimeout(function(){z(e);e=null},t)}else{c(e).removeChild(e)}}function ue(e){return e instanceof Element?e:null}function $(e){return e instanceof HTMLElement?e:null}function J(e){return typeof e==="string"?e:null}function f(e){return e instanceof Element||e instanceof Document||e instanceof DocumentFragment?e:null}function K(e,t,n){e=ue(y(e));if(!e){return}if(n){E().setTimeout(function(){K(e,t);e=null},n)}else{e.classList&&e.classList.add(t)}}function G(e,t,n){let r=ue(y(e));if(!r){return}if(n){E().setTimeout(function(){G(r,t);r=null},n)}else{if(r.classList){r.classList.remove(t);if(r.classList.length===0){r.removeAttribute("class")}}}}function W(e,t){e=y(e);e.classList.toggle(t)}function Z(e,t){e=y(e);se(e.parentElement.children,function(e){G(e,t)});K(ue(e),t)}function g(e,t){e=ue(y(e));if(e&&e.closest){return e.closest(t)}else{do{if(e==null||d(e,t)){return e}}while(e=e&&ue(c(e)));return null}}function l(e,t){return e.substring(0,t.length)===t}function Y(e,t){return e.substring(e.length-t.length)===t}function ge(e){const t=e.trim();if(l(t,"<")&&Y(t,"/>")){return t.substring(1,t.length-2)}else{return t}}function p(e,t,n){e=y(e);if(t.indexOf("closest ")===0){return[g(ue(e),ge(t.substr(8)))]}else if(t.indexOf("find ")===0){return[r(f(e),ge(t.substr(5)))]}else if(t==="next"){return[ue(e).nextElementSibling]}else if(t.indexOf("next ")===0){return[pe(e,ge(t.substr(5)),!!n)]}else if(t==="previous"){return[ue(e).previousElementSibling]}else if(t.indexOf("previous ")===0){return[me(e,ge(t.substr(9)),!!n)]}else if(t==="document"){return[document]}else if(t==="window"){return[window]}else if(t==="body"){return[document.body]}else if(t==="root"){return[m(e,!!n)]}else if(t==="host"){return[e.getRootNode().host]}else if(t.indexOf("global ")===0){return p(e,t.slice(7),true)}else{return M(f(m(e,!!n)).querySelectorAll(ge(t)))}}var pe=function(t,e,n){const r=f(m(t,n)).querySelectorAll(e);for(let e=0;e<r.length;e++){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_PRECEDING){return o}}};var me=function(t,e,n){const r=f(m(t,n)).querySelectorAll(e);for(let e=r.length-1;e>=0;e--){const o=r[e];if(o.compareDocumentPosition(t)===Node.DOCUMENT_POSITION_FOLLOWING){return o}}};function ae(e,t){if(typeof e!=="string"){return p(e,t)[0]}else{return p(ne().body,e)[0]}}function y(e,t){if(typeof e==="string"){return r(f(t)||document,e)}else{return e}}function xe(e,t,n,r){if(k(t)){return{target:ne().body,event:J(e),listener:t,options:n}}else{return{target:y(e),event:J(t),listener:n,options:r}}}function ye(t,n,r,o){Vn(function(){const e=xe(t,n,r,o);e.target.addEventListener(e.event,e.listener,e.options)});const e=k(n);return e?n:r}function be(t,n,r){Vn(function(){const e=xe(t,n,r);e.target.removeEventListener(e.event,e.listener)});return k(n)?n:r}const ve=ne().createElement("output");function we(e,t){const n=re(e,t);if(n){if(n==="this"){return[Se(e,t)]}else{const r=p(e,n);if(r.length===0){C('The selector "'+n+'" on '+t+" returned no matches!");return[ve]}else{return r}}}}function Se(e,t){return ue(i(e,function(e){return te(ue(e),t)!=null}))}function Ee(e){const t=re(e,"hx-target");if(t){if(t==="this"){return Se(e,"hx-target")}else{return ae(e,t)}}else{const n=ie(e);if(n.boosted){return ne().body}else{return e}}}function Ce(t){const n=Q.config.attributesToSettle;for(let e=0;e<n.length;e++){if(t===n[e]){return true}}return false}function Oe(t,n){se(t.attributes,function(e){if(!n.hasAttribute(e.name)&&Ce(e.name)){t.removeAttribute(e.name)}});se(n.attributes,function(e){if(Ce(e.name)){t.setAttribute(e.name,e.value)}})}function Re(t,e){const n=Un(e);for(let e=0;e<n.length;e++){const r=n[e];try{if(r.isInlineSwap(t)){return true}}catch(e){C(e)}}return t==="outerHTML"}function He(e,o,i,t){t=t||ne();let n="#"+ee(o,"id");let s="outerHTML";if(e==="true"){}else if(e.indexOf(":")>0){s=e.substr(0,e.indexOf(":"));n=e.substr(e.indexOf(":")+1,e.length)}else{s=e}o.removeAttribute("hx-swap-oob");o.removeAttribute("data-hx-swap-oob");const r=p(t,n,false);if(r){se(r,function(e){let t;const n=o.cloneNode(true);t=ne().createDocumentFragment();t.appendChild(n);if(!Re(s,e)){t=f(n)}const r={shouldSwap:true,target:e,fragment:t};if(!de(e,"htmx:oobBeforeSwap",r))return;e=r.target;if(r.shouldSwap){qe(t);_e(s,e,e,t,i);Te()}se(i.elts,function(e){de(e,"htmx:oobAfterSwap",r)})});o.parentNode.removeChild(o)}else{o.parentNode.removeChild(o);fe(ne().body,"htmx:oobErrorNoTarget",{content:o})}return e}function Te(){const e=r("#--htmx-preserve-pantry--");if(e){for(const t of[...e.children]){const n=r("#"+t.id);n.parentNode.moveBefore(t,n);n.remove()}e.remove()}}function qe(e){se(x(e,"[hx-preserve], [data-hx-preserve]"),function(e){const t=te(e,"id");const n=ne().getElementById(t);if(n!=null){if(e.moveBefore){let e=r("#--htmx-preserve-pantry--");if(e==null){ne().body.insertAdjacentHTML("afterend","<div id='--htmx-preserve-pantry--'></div>");e=r("#--htmx-preserve-pantry--")}e.moveBefore(n,null)}else{e.parentNode.replaceChild(n,e)}}})}function Le(l,e,c){se(e.querySelectorAll("[id]"),function(t){const n=ee(t,"id");if(n&&n.length>0){const r=n.replace("'","\\'");const o=t.tagName.replace(":","\\:");const e=f(l);const i=e&&e.querySelector(o+"[id='"+r+"']");if(i&&i!==e){const s=t.cloneNode();Oe(t,i);c.tasks.push(function(){Oe(t,s)})}}})}function Ne(e){return function(){G(e,Q.config.addedClass);kt(ue(e));Ae(f(e));de(e,"htmx:load")}}function Ae(e){const t="[autofocus]";const n=$(d(e,t)?e:e.querySelector(t));if(n!=null){n.focus()}}function u(e,t,n,r){Le(e,n,r);while(n.childNodes.length>0){const o=n.firstChild;K(ue(o),Q.config.addedClass);e.insertBefore(o,t);if(o.nodeType!==Node.TEXT_NODE&&o.nodeType!==Node.COMMENT_NODE){r.tasks.push(Ne(o))}}}function Ie(e,t){let n=0;while(n<e.length){t=(t<<5)-t+e.charCodeAt(n++)|0}return t}function Pe(t){let n=0;if(t.attributes){for(let e=0;e<t.attributes.length;e++){const r=t.attributes[e];if(r.value){n=Ie(r.name,n);n=Ie(r.value,n)}}}return n}function ke(t){const n=ie(t);if(n.onHandlers){for(let e=0;e<n.onHandlers.length;e++){const r=n.onHandlers[e];be(t,r.event,r.listener)}delete n.onHandlers}}function De(e){const t=ie(e);if(t.timeout){clearTimeout(t.timeout)}if(t.listenerInfos){se(t.listenerInfos,function(e){if(e.on){be(e.on,e.trigger,e.listener)}})}ke(e);se(Object.keys(t),function(e){delete t[e]})}function a(e){de(e,"htmx:beforeCleanupElement");De(e);if(e.children){se(e.children,function(e){a(e)})}}function Me(t,e,n){if(t instanceof Element&&t.tagName==="BODY"){return Ve(t,e,n)}let r;const o=t.previousSibling;const i=c(t);if(!i){return}u(i,t,e,n);if(o==null){r=i.firstChild}else{r=o.nextSibling}n.elts=n.elts.filter(function(e){return e!==t});while(r&&r!==t){if(r instanceof Element){n.elts.push(r)}r=r.nextSibling}a(t);if(t instanceof Element){t.remove()}else{t.parentNode.removeChild(t)}}function Xe(e,t,n){return u(e,e.firstChild,t,n)}function Fe(e,t,n){return u(c(e),e,t,n)}function Be(e,t,n){return u(e,null,t,n)}function Ue(e,t,n){return u(c(e),e.nextSibling,t,n)}function je(e){a(e);const t=c(e);if(t){return t.removeChild(e)}}function Ve(e,t,n){const r=e.firstChild;u(e,r,t,n);if(r){while(r.nextSibling){a(r.nextSibling);e.removeChild(r.nextSibling)}a(r);e.removeChild(r)}}function _e(t,e,n,r,o){switch(t){case"none":return;case"outerHTML":Me(n,r,o);return;case"afterbegin":Xe(n,r,o);return;case"beforebegin":Fe(n,r,o);return;case"beforeend":Be(n,r,o);return;case"afterend":Ue(n,r,o);return;case"delete":je(n);return;default:var i=Un(e);for(let e=0;e<i.length;e++){const s=i[e];try{const l=s.handleSwap(t,n,r,o);if(l){if(Array.isArray(l)){for(let e=0;e<l.length;e++){const c=l[e];if(c.nodeType!==Node.TEXT_NODE&&c.nodeType!==Node.COMMENT_NODE){o.tasks.push(Ne(c))}}}return}}catch(e){C(e)}}if(t==="innerHTML"){Ve(n,r,o)}else{_e(Q.config.defaultSwapStyle,e,n,r,o)}}}function ze(e,n,r){var t=x(e,"[hx-swap-oob], [data-hx-swap-oob]");se(t,function(e){if(Q.config.allowNestedOobSwaps||e.parentElement===null){const t=te(e,"hx-swap-oob");if(t!=null){He(t,e,n,r)}}else{e.removeAttribute("hx-swap-oob");e.removeAttribute("data-hx-swap-oob")}});return t.length>0}function $e(e,t,r,o){if(!o){o={}}e=y(e);const i=o.contextElement?m(o.contextElement,false):ne();const n=document.activeElement;let s={};try{s={elt:n,start:n?n.selectionStart:null,end:n?n.selectionEnd:null}}catch(e){}const l=xn(e);if(r.swapStyle==="textContent"){e.textContent=t}else{let n=P(t);l.title=n.title;if(o.selectOOB){const u=o.selectOOB.split(",");for(let t=0;t<u.length;t++){const a=u[t].split(":",2);let e=a[0].trim();if(e.indexOf("#")===0){e=e.substring(1)}const f=a[1]||"true";const d=n.querySelector("#"+e);if(d){He(f,d,l,i)}}}ze(n,l,i);se(x(n,"template"),function(e){if(ze(e.content,l,i)){e.remove()}});if(o.select){const h=ne().createDocumentFragment();se(n.querySelectorAll(o.select),function(e){h.appendChild(e)});n=h}qe(n);_e(r.swapStyle,o.contextElement,e,n,l);Te()}if(s.elt&&!le(s.elt)&&ee(s.elt,"id")){const g=document.getElementById(ee(s.elt,"id"));const p={preventScroll:r.focusScroll!==undefined?!r.focusScroll:!Q.config.defaultFocusScroll};if(g){if(s.start&&g.setSelectionRange){try{g.setSelectionRange(s.start,s.end)}catch(e){}}g.focus(p)}}e.classList.remove(Q.config.swappingClass);se(l.elts,function(e){if(e.classList){e.classList.add(Q.config.settlingClass)}de(e,"htmx:afterSwap",o.eventInfo)});if(o.afterSwapCallback){o.afterSwapCallback()}if(!r.ignoreTitle){kn(l.title)}const c=function(){se(l.tasks,function(e){e.call()});se(l.elts,function(e){if(e.classList){e.classList.remove(Q.config.settlingClass)}de(e,"htmx:afterSettle",o.eventInfo)});if(o.anchor){const e=ue(y("#"+o.anchor));if(e){e.scrollIntoView({block:"start",behavior:"auto"})}}yn(l.elts,r);if(o.afterSettleCallback){o.afterSettleCallback()}};if(r.settleDelay>0){E().setTimeout(c,r.settleDelay)}else{c()}}function Je(e,t,n){const r=e.getResponseHeader(t);if(r.indexOf("{")===0){const o=S(r);for(const i in o){if(o.hasOwnProperty(i)){let e=o[i];if(D(e)){n=e.target!==undefined?e.target:n}else{e={value:e}}de(n,i,e)}}}else{const s=r.split(",");for(let e=0;e<s.length;e++){de(n,s[e].trim(),[])}}}const Ke=/\s/;const b=/[\s,]/;const Ge=/[_$a-zA-Z]/;const We=/[_$a-zA-Z0-9]/;const Ze=['"',"'","/"];const v=/[^\s]/;const Ye=/[{(]/;const Qe=/[})]/;function et(e){const t=[];let n=0;while(n<e.length){if(Ge.exec(e.charAt(n))){var r=n;while(We.exec(e.charAt(n+1))){n++}t.push(e.substr(r,n-r+1))}else if(Ze.indexOf(e.charAt(n))!==-1){const o=e.charAt(n);var r=n;n++;while(n<e.length&&e.charAt(n)!==o){if(e.charAt(n)==="\\"){n++}n++}t.push(e.substr(r,n-r+1))}else{const i=e.charAt(n);t.push(i)}n++}return t}function tt(e,t,n){return Ge.exec(e.charAt(0))&&e!=="true"&&e!=="false"&&e!=="this"&&e!==n&&t!=="."}function nt(r,o,i){if(o[0]==="["){o.shift();let e=1;let t=" return (function("+i+"){ return (";let n=null;while(o.length>0){const s=o[0];if(s==="]"){e--;if(e===0){if(n===null){t=t+"true"}o.shift();t+=")})";try{const l=vn(r,function(){return Function(t)()},function(){return true});l.source=t;return l}catch(e){fe(ne().body,"htmx:syntax:error",{error:e,source:t});return null}}}else if(s==="["){e++}if(tt(s,n,i)){t+="(("+i+"."+s+") ? ("+i+"."+s+") : (window."+s+"))"}else{t=t+s}n=o.shift()}}}function w(e,t){let n="";while(e.length>0&&!t.test(e[0])){n+=e.shift()}return n}function rt(e){let t;if(e.length>0&&Ye.test(e[0])){e.shift();t=w(e,Qe).trim();e.shift()}else{t=w(e,b)}return t}const ot="input, textarea, select";function it(e,t,n){const r=[];const o=et(t);do{w(o,v);const l=o.length;const c=w(o,/[,\[\s]/);if(c!==""){if(c==="every"){const u={trigger:"every"};w(o,v);u.pollInterval=h(w(o,/[,\[\s]/));w(o,v);var i=nt(e,o,"event");if(i){u.eventFilter=i}r.push(u)}else{const a={trigger:c};var i=nt(e,o,"event");if(i){a.eventFilter=i}w(o,v);while(o.length>0&&o[0]!==","){const f=o.shift();if(f==="changed"){a.changed=true}else if(f==="once"){a.once=true}else if(f==="consume"){a.consume=true}else if(f==="delay"&&o[0]===":"){o.shift();a.delay=h(w(o,b))}else if(f==="from"&&o[0]===":"){o.shift();if(Ye.test(o[0])){var s=rt(o)}else{var s=w(o,b);if(s==="closest"||s==="find"||s==="next"||s==="previous"){o.shift();const d=rt(o);if(d.length>0){s+=" "+d}}}a.from=s}else if(f==="target"&&o[0]===":"){o.shift();a.target=rt(o)}else if(f==="throttle"&&o[0]===":"){o.shift();a.throttle=h(w(o,b))}else if(f==="queue"&&o[0]===":"){o.shift();a.queue=w(o,b)}else if(f==="root"&&o[0]===":"){o.shift();a[f]=rt(o)}else if(f==="threshold"&&o[0]===":"){o.shift();a[f]=w(o,b)}else{fe(e,"htmx:syntax:error",{token:o.shift()})}w(o,v)}r.push(a)}}if(o.length===l){fe(e,"htmx:syntax:error",{token:o.shift()})}w(o,v)}while(o[0]===","&&o.shift());if(n){n[t]=r}return r}function st(e){const t=te(e,"hx-trigger");let n=[];if(t){const r=Q.config.triggerSpecsCache;n=r&&r[t]||it(e,t,r)}if(n.length>0){return n}else if(d(e,"form")){return[{trigger:"submit"}]}else if(d(e,'input[type="button"], input[type="submit"]')){return[{trigger:"click"}]}else if(d(e,ot)){return[{trigger:"change"}]}else{return[{trigger:"click"}]}}function lt(e){ie(e).cancelled=true}function ct(e,t,n){const r=ie(e);r.timeout=E().setTimeout(function(){if(le(e)&&r.cancelled!==true){if(!gt(n,e,Mt("hx:poll:trigger",{triggerSpec:n,target:e}))){t(e)}ct(e,t,n)}},n.pollInterval)}function ut(e){return location.hostname===e.hostname&&ee(e,"href")&&ee(e,"href").indexOf("#")!==0}function at(e){return g(e,Q.config.disableSelector)}function ft(t,n,e){if(t instanceof HTMLAnchorElement&&ut(t)&&(t.target===""||t.target==="_self")||t.tagName==="FORM"&&String(ee(t,"method")).toLowerCase()!=="dialog"){n.boosted=true;let r,o;if(t.tagName==="A"){r="get";o=ee(t,"href")}else{const i=ee(t,"method");r=i?i.toLowerCase():"get";o=ee(t,"action");if(r==="get"&&o.includes("?")){o=o.replace(/\?[^#]+/,"")}}e.forEach(function(e){pt(t,function(e,t){const n=ue(e);if(at(n)){a(n);return}he(r,o,n,t)},n,e,true)})}}function dt(e,t){const n=ue(t);if(!n){return false}if(e.type==="submit"||e.type==="click"){if(n.tagName==="FORM"){return true}if(d(n,'input[type="submit"], button')&&g(n,"form")!==null){return true}if(n instanceof HTMLAnchorElement&&n.href&&(n.getAttribute("href")==="#"||n.getAttribute("href").indexOf("#")!==0)){return true}}return false}function ht(e,t){return ie(e).boosted&&e instanceof HTMLAnchorElement&&t.type==="click"&&(t.ctrlKey||t.metaKey)}function gt(e,t,n){const r=e.eventFilter;if(r){try{return r.call(t,n)!==true}catch(e){const o=r.source;fe(ne().body,"htmx:eventFilter:error",{error:e,source:o});return true}}return false}function pt(l,c,e,u,a){const f=ie(l);let t;if(u.from){t=p(l,u.from)}else{t=[l]}if(u.changed){if(!("lastValue"in f)){f.lastValue=new WeakMap}t.forEach(function(e){if(!f.lastValue.has(u)){f.lastValue.set(u,new WeakMap)}f.lastValue.get(u).set(e,e.value)})}se(t,function(i){const s=function(e){if(!le(l)){i.removeEventListener(u.trigger,s);return}if(ht(l,e)){return}if(a||dt(e,l)){e.preventDefault()}if(gt(u,l,e)){return}const t=ie(e);t.triggerSpec=u;if(t.handledFor==null){t.handledFor=[]}if(t.handledFor.indexOf(l)<0){t.handledFor.push(l);if(u.consume){e.stopPropagation()}if(u.target&&e.target){if(!d(ue(e.target),u.target)){return}}if(u.once){if(f.triggeredOnce){return}else{f.triggeredOnce=true}}if(u.changed){const n=event.target;const r=n.value;const o=f.lastValue.get(u);if(o.has(n)&&o.get(n)===r){return}o.set(n,r)}if(f.delayed){clearTimeout(f.delayed)}if(f.throttle){return}if(u.throttle>0){if(!f.throttle){de(l,"htmx:trigger");c(l,e);f.throttle=E().setTimeout(function(){f.throttle=null},u.throttle)}}else if(u.delay>0){f.delayed=E().setTimeout(function(){de(l,"htmx:trigger");c(l,e)},u.delay)}else{de(l,"htmx:trigger");c(l,e)}}};if(e.listenerInfos==null){e.listenerInfos=[]}e.listenerInfos.push({trigger:u.trigger,listener:s,on:i});i.addEventListener(u.trigger,s)})}let mt=false;let xt=null;function yt(){if(!xt){xt=function(){mt=true};window.addEventListener("scroll",xt);window.addEventListener("resize",xt);setInterval(function(){if(mt){mt=false;se(ne().querySelectorAll("[hx-trigger*='revealed'],[data-hx-trigger*='revealed']"),function(e){bt(e)})}},200)}}function bt(e){if(!s(e,"data-hx-revealed")&&X(e)){e.setAttribute("data-hx-revealed","true");const t=ie(e);if(t.initHash){de(e,"revealed")}else{e.addEventListener("htmx:afterProcessNode",function(){de(e,"revealed")},{once:true})}}}function vt(e,t,n,r){const o=function(){if(!n.loaded){n.loaded=true;t(e)}};if(r>0){E().setTimeout(o,r)}else{o()}}function wt(t,n,e){let i=false;se(o,function(r){if(s(t,"hx-"+r)){const o=te(t,"hx-"+r);i=true;n.path=o;n.verb=r;e.forEach(function(e){St(t,e,n,function(e,t){const n=ue(e);if(g(n,Q.config.disableSelector)){a(n);return}he(r,o,n,t)})})}});return i}function St(r,e,t,n){if(e.trigger==="revealed"){yt();pt(r,n,t,e);bt(ue(r))}else if(e.trigger==="intersect"){const o={};if(e.root){o.root=ae(r,e.root)}if(e.threshold){o.threshold=parseFloat(e.threshold)}const i=new IntersectionObserver(function(t){for(let e=0;e<t.length;e++){const n=t[e];if(n.isIntersecting){de(r,"intersect");break}}},o);i.observe(ue(r));pt(ue(r),n,t,e)}else if(e.trigger==="load"){if(!gt(e,r,Mt("load",{elt:r}))){vt(ue(r),n,t,e.delay)}}else if(e.pollInterval>0){t.polling=true;ct(ue(r),n,e)}else{pt(r,n,t,e)}}function Et(e){const t=ue(e);if(!t){return false}const n=t.attributes;for(let e=0;e<n.length;e++){const r=n[e].name;if(l(r,"hx-on:")||l(r,"data-hx-on:")||l(r,"hx-on-")||l(r,"data-hx-on-")){return true}}return false}const Ct=(new XPathEvaluator).createExpression('.//*[@*[ starts-with(name(), "hx-on:") or starts-with(name(), "data-hx-on:") or'+' starts-with(name(), "hx-on-") or starts-with(name(), "data-hx-on-") ]]');function Ot(e,t){if(Et(e)){t.push(ue(e))}const n=Ct.evaluate(e);let r=null;while(r=n.iterateNext())t.push(ue(r))}function Rt(e){const t=[];if(e instanceof DocumentFragment){for(const n of e.childNodes){Ot(n,t)}}else{Ot(e,t)}return t}function Ht(e){if(e.querySelectorAll){const n=", [hx-boost] a, [data-hx-boost] a, a[hx-boost], a[data-hx-boost]";const r=[];for(const i in Mn){const s=Mn[i];if(s.getSelectors){var t=s.getSelectors();if(t){r.push(t)}}}const o=e.querySelectorAll(R+n+", form, [type='submit'],"+" [hx-ext], [data-hx-ext], [hx-trigger], [data-hx-trigger]"+r.flat().map(e=>", "+e).join(""));return o}else{return[]}}function Tt(e){const t=g(ue(e.target),"button, input[type='submit']");const n=Lt(e);if(n){n.lastButtonClicked=t}}function qt(e){const t=Lt(e);if(t){t.lastButtonClicked=null}}function Lt(e){const t=g(ue(e.target),"button, input[type='submit']");if(!t){return}const n=y("#"+ee(t,"form"),t.getRootNode())||g(t,"form");if(!n){return}return ie(n)}function Nt(e){e.addEventListener("click",Tt);e.addEventListener("focusin",Tt);e.addEventListener("focusout",qt)}function At(t,e,n){const r=ie(t);if(!Array.isArray(r.onHandlers)){r.onHandlers=[]}let o;const i=function(e){vn(t,function(){if(at(t)){return}if(!o){o=new Function("event",n)}o.call(t,e)})};t.addEventListener(e,i);r.onHandlers.push({event:e,listener:i})}function It(t){ke(t);for(let e=0;e<t.attributes.length;e++){const n=t.attributes[e].name;const r=t.attributes[e].value;if(l(n,"hx-on")||l(n,"data-hx-on")){const o=n.indexOf("-on")+3;const i=n.slice(o,o+1);if(i==="-"||i===":"){let e=n.slice(o+1);if(l(e,":")){e="htmx"+e}else if(l(e,"-")){e="htmx:"+e.slice(1)}else if(l(e,"htmx-")){e="htmx:"+e.slice(5)}At(t,e,r)}}}}function Pt(t){if(g(t,Q.config.disableSelector)){a(t);return}const n=ie(t);if(n.initHash!==Pe(t)){De(t);n.initHash=Pe(t);de(t,"htmx:beforeProcessNode");const e=st(t);const r=wt(t,n,e);if(!r){if(re(t,"hx-boost")==="true"){ft(t,n,e)}else if(s(t,"hx-trigger")){e.forEach(function(e){St(t,e,n,function(){})})}}if(t.tagName==="FORM"||ee(t,"type")==="submit"&&s(t,"form")){Nt(t)}de(t,"htmx:afterProcessNode")}}function kt(e){e=y(e);if(g(e,Q.config.disableSelector)){a(e);return}Pt(e);se(Ht(e),function(e){Pt(e)});se(Rt(e),It)}function Dt(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1-$2").toLowerCase()}function Mt(e,t){let n;if(window.CustomEvent&&typeof window.CustomEvent==="function"){n=new CustomEvent(e,{bubbles:true,cancelable:true,composed:true,detail:t})}else{n=ne().createEvent("CustomEvent");n.initCustomEvent(e,true,true,t)}return n}function fe(e,t,n){de(e,t,ce({error:t},n))}function Xt(e){return e==="htmx:afterProcessNode"}function Ft(e,t){se(Un(e),function(e){try{t(e)}catch(e){C(e)}})}function C(e){if(console.error){console.error(e)}else if(console.log){console.log("ERROR: ",e)}}function de(e,t,n){e=y(e);if(n==null){n={}}n.elt=e;const r=Mt(t,n);if(Q.logger&&!Xt(t)){Q.logger(e,t,n)}if(n.error){C(n.error);de(e,"htmx:error",{errorInfo:n})}let o=e.dispatchEvent(r);const i=Dt(t);if(o&&i!==t){const s=Mt(i,r.detail);o=o&&e.dispatchEvent(s)}Ft(ue(e),function(e){o=o&&(e.onEvent(t,r)!==false&&!r.defaultPrevented)});return o}let Bt=location.pathname+location.search;function Ut(){const e=ne().querySelector("[hx-history-elt],[data-hx-history-elt]");return e||ne().body}function jt(t,e){if(!B()){return}const n=_t(e);const r=ne().title;const o=window.scrollY;if(Q.config.historyCacheSize<=0){localStorage.removeItem("htmx-history-cache");return}t=U(t);const i=S(localStorage.getItem("htmx-history-cache"))||[];for(let e=0;e<i.length;e++){if(i[e].url===t){i.splice(e,1);break}}const s={url:t,content:n,title:r,scroll:o};de(ne().body,"htmx:historyItemCreated",{item:s,cache:i});i.push(s);while(i.length>Q.config.historyCacheSize){i.shift()}while(i.length>0){try{localStorage.setItem("htmx-history-cache",JSON.stringify(i));break}catch(e){fe(ne().body,"htmx:historyCacheError",{cause:e,cache:i});i.shift()}}}function Vt(t){if(!B()){return null}t=U(t);const n=S(localStorage.getItem("htmx-history-cache"))||[];for(let e=0;e<n.length;e++){if(n[e].url===t){return n[e]}}return null}function _t(e){const t=Q.config.requestClass;const n=e.cloneNode(true);se(x(n,"."+t),function(e){G(e,t)});se(x(n,"[data-disabled-by-htmx]"),function(e){e.removeAttribute("disabled")});return n.innerHTML}function zt(){const e=Ut();const t=Bt||location.pathname+location.search;let n;try{n=ne().querySelector('[hx-history="false" i],[data-hx-history="false" i]')}catch(e){n=ne().querySelector('[hx-history="false"],[data-hx-history="false"]')}if(!n){de(ne().body,"htmx:beforeHistorySave",{path:t,historyElt:e});jt(t,e)}if(Q.config.historyEnabled)history.replaceState({htmx:true},ne().title,window.location.href)}function $t(e){if(Q.config.getCacheBusterParam){e=e.replace(/org\.htmx\.cache-buster=[^&]*&?/,"");if(Y(e,"&")||Y(e,"?")){e=e.slice(0,-1)}}if(Q.config.historyEnabled){history.pushState({htmx:true},"",e)}Bt=e}function Jt(e){if(Q.config.historyEnabled)history.replaceState({htmx:true},"",e);Bt=e}function Kt(e){se(e,function(e){e.call(undefined)})}function Gt(o){const e=new XMLHttpRequest;const i={path:o,xhr:e};de(ne().body,"htmx:historyCacheMiss",i);e.open("GET",o,true);e.setRequestHeader("HX-Request","true");e.setRequestHeader("HX-History-Restore-Request","true");e.setRequestHeader("HX-Current-URL",ne().location.href);e.onload=function(){if(this.status>=200&&this.status<400){de(ne().body,"htmx:historyCacheMissLoad",i);const e=P(this.response);const t=e.querySelector("[hx-history-elt],[data-hx-history-elt]")||e;const n=Ut();const r=xn(n);kn(e.title);qe(e);Ve(n,t,r);Te();Kt(r.tasks);Bt=o;de(ne().body,"htmx:historyRestore",{path:o,cacheMiss:true,serverResponse:this.response})}else{fe(ne().body,"htmx:historyCacheMissLoadError",i)}};e.send()}function Wt(e){zt();e=e||location.pathname+location.search;const t=Vt(e);if(t){const n=P(t.content);const r=Ut();const o=xn(r);kn(t.title);qe(n);Ve(r,n,o);Te();Kt(o.tasks);E().setTimeout(function(){window.scrollTo(0,t.scroll)},0);Bt=e;de(ne().body,"htmx:historyRestore",{path:e,item:t})}else{if(Q.config.refreshOnHistoryMiss){window.location.reload(true)}else{Gt(e)}}}function Zt(e){let t=we(e,"hx-indicator");if(t==null){t=[e]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount||0)+1;e.classList.add.call(e.classList,Q.config.requestClass)});return t}function Yt(e){let t=we(e,"hx-disabled-elt");if(t==null){t=[]}se(t,function(e){const t=ie(e);t.requestCount=(t.requestCount||0)+1;e.setAttribute("disabled","");e.setAttribute("data-disabled-by-htmx","")});return t}function Qt(e,t){se(e.concat(t),function(e){const t=ie(e);t.requestCount=(t.requestCount||1)-1});se(e,function(e){const t=ie(e);if(t.requestCount===0){e.classList.remove.call(e.classList,Q.config.requestClass)}});se(t,function(e){const t=ie(e);if(t.requestCount===0){e.removeAttribute("disabled");e.removeAttribute("data-disabled-by-htmx")}})}function en(t,n){for(let e=0;e<t.length;e++){const r=t[e];if(r.isSameNode(n)){return true}}return false}function tn(e){const t=e;if(t.name===""||t.name==null||t.disabled||g(t,"fieldset[disabled]")){return false}if(t.type==="button"||t.type==="submit"||t.tagName==="image"||t.tagName==="reset"||t.tagName==="file"){return false}if(t.type==="checkbox"||t.type==="radio"){return t.checked}return true}function nn(t,e,n){if(t!=null&&e!=null){if(Array.isArray(e)){e.forEach(function(e){n.append(t,e)})}else{n.append(t,e)}}}function rn(t,n,r){if(t!=null&&n!=null){let e=r.getAll(t);if(Array.isArray(n)){e=e.filter(e=>n.indexOf(e)<0)}else{e=e.filter(e=>e!==n)}r.delete(t);se(e,e=>r.append(t,e))}}function on(t,n,r,o,i){if(o==null||en(t,o)){return}else{t.push(o)}if(tn(o)){const s=ee(o,"name");let e=o.value;if(o instanceof HTMLSelectElement&&o.multiple){e=M(o.querySelectorAll("option:checked")).map(function(e){return e.value})}if(o instanceof HTMLInputElement&&o.files){e=M(o.files)}nn(s,e,n);if(i){sn(o,r)}}if(o instanceof HTMLFormElement){se(o.elements,function(e){if(t.indexOf(e)>=0){rn(e.name,e.value,n)}else{t.push(e)}if(i){sn(e,r)}});new FormData(o).forEach(function(e,t){if(e instanceof File&&e.name===""){return}nn(t,e,n)})}}function sn(e,t){const n=e;if(n.willValidate){de(n,"htmx:validation:validate");if(!n.checkValidity()){t.push({elt:n,message:n.validationMessage,validity:n.validity});de(n,"htmx:validation:failed",{message:n.validationMessage,validity:n.validity})}}}function ln(n,e){for(const t of e.keys()){n.delete(t)}e.forEach(function(e,t){n.append(t,e)});return n}function cn(e,t){const n=[];const r=new FormData;const o=new FormData;const i=[];const s=ie(e);if(s.lastButtonClicked&&!le(s.lastButtonClicked)){s.lastButtonClicked=null}let l=e instanceof HTMLFormElement&&e.noValidate!==true||te(e,"hx-validate")==="true";if(s.lastButtonClicked){l=l&&s.lastButtonClicked.formNoValidate!==true}if(t!=="get"){on(n,o,i,g(e,"form"),l)}on(n,r,i,e,l);if(s.lastButtonClicked||e.tagName==="BUTTON"||e.tagName==="INPUT"&&ee(e,"type")==="submit"){const u=s.lastButtonClicked||e;const a=ee(u,"name");nn(a,u.value,o)}const c=we(e,"hx-include");se(c,function(e){on(n,r,i,ue(e),l);if(!d(e,"form")){se(f(e).querySelectorAll(ot),function(e){on(n,r,i,e,l)})}});ln(r,o);return{errors:i,formData:r,values:Nn(r)}}function un(e,t,n){if(e!==""){e+="&"}if(String(n)==="[object Object]"){n=JSON.stringify(n)}const r=encodeURIComponent(n);e+=encodeURIComponent(t)+"="+r;return e}function an(e){e=qn(e);let n="";e.forEach(function(e,t){n=un(n,t,e)});return n}function fn(e,t,n){const r={"HX-Request":"true","HX-Trigger":ee(e,"id"),"HX-Trigger-Name":ee(e,"name"),"HX-Target":te(t,"id"),"HX-Current-URL":ne().location.href};bn(e,"hx-headers",false,r);if(n!==undefined){r["HX-Prompt"]=n}if(ie(e).boosted){r["HX-Boosted"]="true"}return r}function dn(n,e){const t=re(e,"hx-params");if(t){if(t==="none"){return new FormData}else if(t==="*"){return n}else if(t.indexOf("not ")===0){se(t.substr(4).split(","),function(e){e=e.trim();n.delete(e)});return n}else{const r=new FormData;se(t.split(","),function(t){t=t.trim();if(n.has(t)){n.getAll(t).forEach(function(e){r.append(t,e)})}});return r}}else{return n}}function hn(e){return!!ee(e,"href")&&ee(e,"href").indexOf("#")>=0}function gn(e,t){const n=t||re(e,"hx-swap");const r={swapStyle:ie(e).boosted?"innerHTML":Q.config.defaultSwapStyle,swapDelay:Q.config.defaultSwapDelay,settleDelay:Q.config.defaultSettleDelay};if(Q.config.scrollIntoViewOnBoost&&ie(e).boosted&&!hn(e)){r.show="top"}if(n){const s=F(n);if(s.length>0){for(let e=0;e<s.length;e++){const l=s[e];if(l.indexOf("swap:")===0){r.swapDelay=h(l.substr(5))}else if(l.indexOf("settle:")===0){r.settleDelay=h(l.substr(7))}else if(l.indexOf("transition:")===0){r.transition=l.substr(11)==="true"}else if(l.indexOf("ignoreTitle:")===0){r.ignoreTitle=l.substr(12)==="true"}else if(l.indexOf("scroll:")===0){const c=l.substr(7);var o=c.split(":");const u=o.pop();var i=o.length>0?o.join(":"):null;r.scroll=u;r.scrollTarget=i}else if(l.indexOf("show:")===0){const a=l.substr(5);var o=a.split(":");const f=o.pop();var i=o.length>0?o.join(":"):null;r.show=f;r.showTarget=i}else if(l.indexOf("focus-scroll:")===0){const d=l.substr("focus-scroll:".length);r.focusScroll=d=="true"}else if(e==0){r.swapStyle=l}else{C("Unknown modifier in hx-swap: "+l)}}}}return r}function pn(e){return re(e,"hx-encoding")==="multipart/form-data"||d(e,"form")&&ee(e,"enctype")==="multipart/form-data"}function mn(t,n,r){let o=null;Ft(n,function(e){if(o==null){o=e.encodeParameters(t,r,n)}});if(o!=null){return o}else{if(pn(n)){return ln(new FormData,qn(r))}else{return an(r)}}}function xn(e){return{tasks:[],elts:[e]}}function yn(e,t){const n=e[0];const r=e[e.length-1];if(t.scroll){var o=null;if(t.scrollTarget){o=ue(ae(n,t.scrollTarget))}if(t.scroll==="top"&&(n||o)){o=o||n;o.scrollTop=0}if(t.scroll==="bottom"&&(r||o)){o=o||r;o.scrollTop=o.scrollHeight}}if(t.show){var o=null;if(t.showTarget){let e=t.showTarget;if(t.showTarget==="window"){e="body"}o=ue(ae(n,e))}if(t.show==="top"&&(n||o)){o=o||n;o.scrollIntoView({block:"start",behavior:Q.config.scrollBehavior})}if(t.show==="bottom"&&(r||o)){o=o||r;o.scrollIntoView({block:"end",behavior:Q.config.scrollBehavior})}}}function bn(r,e,o,i){if(i==null){i={}}if(r==null){return i}const s=te(r,e);if(s){let e=s.trim();let t=o;if(e==="unset"){return null}if(e.indexOf("javascript:")===0){e=e.substr(11);t=true}else if(e.indexOf("js:")===0){e=e.substr(3);t=true}if(e.indexOf("{")!==0){e="{"+e+"}"}let n;if(t){n=vn(r,function(){return Function("return ("+e+")")()},{})}else{n=S(e)}for(const l in n){if(n.hasOwnProperty(l)){if(i[l]==null){i[l]=n[l]}}}}return bn(ue(c(r)),e,o,i)}function vn(e,t,n){if(Q.config.allowEval){return t()}else{fe(e,"htmx:evalDisallowedError");return n}}function wn(e,t){return bn(e,"hx-vars",true,t)}function Sn(e,t){return bn(e,"hx-vals",false,t)}function En(e){return ce(wn(e),Sn(e))}function Cn(t,n,r){if(r!==null){try{t.setRequestHeader(n,r)}catch(e){t.setRequestHeader(n,encodeURIComponent(r));t.setRequestHeader(n+"-URI-AutoEncoded","true")}}}function On(t){if(t.responseURL&&typeof URL!=="undefined"){try{const e=new URL(t.responseURL);return e.pathname+e.search}catch(e){fe(ne().body,"htmx:badResponseUrl",{url:t.responseURL})}}}function O(e,t){return t.test(e.getAllResponseHeaders())}function Rn(t,n,r){t=t.toLowerCase();if(r){if(r instanceof Element||typeof r==="string"){return he(t,n,null,null,{targetOverride:y(r)||ve,returnPromise:true})}else{let e=y(r.target);if(r.target&&!e||!e&&!y(r.source)){e=ve}return he(t,n,y(r.source),r.event,{handler:r.handler,headers:r.headers,values:r.values,targetOverride:e,swapOverride:r.swap,select:r.select,returnPromise:true})}}else{return he(t,n,null,null,{returnPromise:true})}}function Hn(e){const t=[];while(e){t.push(e);e=e.parentElement}return t}function Tn(e,t,n){let r;let o;if(typeof URL==="function"){o=new URL(t,document.location.href);const i=document.location.origin;r=i===o.origin}else{o=t;r=l(t,document.location.origin)}if(Q.config.selfRequestsOnly){if(!r){return false}}return de(e,"htmx:validateUrl",ce({url:o,sameHost:r},n))}function qn(e){if(e instanceof FormData)return e;const t=new FormData;for(const n in e){if(e.hasOwnProperty(n)){if(e[n]&&typeof e[n].forEach==="function"){e[n].forEach(function(e){t.append(n,e)})}else if(typeof e[n]==="object"&&!(e[n]instanceof Blob)){t.append(n,JSON.stringify(e[n]))}else{t.append(n,e[n])}}}return t}function Ln(r,o,e){return new Proxy(e,{get:function(t,e){if(typeof e==="number")return t[e];if(e==="length")return t.length;if(e==="push"){return function(e){t.push(e);r.append(o,e)}}if(typeof t[e]==="function"){return function(){t[e].apply(t,arguments);r.delete(o);t.forEach(function(e){r.append(o,e)})}}if(t[e]&&t[e].length===1){return t[e][0]}else{return t[e]}},set:function(e,t,n){e[t]=n;r.delete(o);e.forEach(function(e){r.append(o,e)});return true}})}function Nn(r){return new Proxy(r,{get:function(e,t){if(typeof t==="symbol"){return Reflect.get(e,t)}if(t==="toJSON"){return()=>Object.fromEntries(r)}if(t in e){if(typeof e[t]==="function"){return function(){return r[t].apply(r,arguments)}}else{return e[t]}}const n=r.getAll(t);if(n.length===0){return undefined}else if(n.length===1){return n[0]}else{return Ln(e,t,n)}},set:function(t,n,e){if(typeof n!=="string"){return false}t.delete(n);if(e&&typeof e.forEach==="function"){e.forEach(function(e){t.append(n,e)})}else if(typeof e==="object"&&!(e instanceof Blob)){t.append(n,JSON.stringify(e))}else{t.append(n,e)}return true},deleteProperty:function(e,t){if(typeof t==="string"){e.delete(t)}return true},ownKeys:function(e){return Reflect.ownKeys(Object.fromEntries(e))},getOwnPropertyDescriptor:function(e,t){return Reflect.getOwnPropertyDescriptor(Object.fromEntries(e),t)}})}function he(t,n,r,o,i,D){let s=null;let l=null;i=i!=null?i:{};if(i.returnPromise&&typeof Promise!=="undefined"){var e=new Promise(function(e,t){s=e;l=t})}if(r==null){r=ne().body}const M=i.handler||Dn;const X=i.select||null;if(!le(r)){oe(s);return e}const c=i.targetOverride||ue(Ee(r));if(c==null||c==ve){fe(r,"htmx:targetError",{target:te(r,"hx-target")});oe(l);return e}let u=ie(r);const a=u.lastButtonClicked;if(a){const L=ee(a,"formaction");if(L!=null){n=L}const N=ee(a,"formmethod");if(N!=null){if(N.toLowerCase()!=="dialog"){t=N}}}const f=re(r,"hx-confirm");if(D===undefined){const K=function(e){return he(t,n,r,o,i,!!e)};const G={target:c,elt:r,path:n,verb:t,triggeringEvent:o,etc:i,issueRequest:K,question:f};if(de(r,"htmx:confirm",G)===false){oe(s);return e}}let d=r;let h=re(r,"hx-sync");let g=null;let F=false;if(h){const A=h.split(":");const I=A[0].trim();if(I==="this"){d=Se(r,"hx-sync")}else{d=ue(ae(r,I))}h=(A[1]||"drop").trim();u=ie(d);if(h==="drop"&&u.xhr&&u.abortable!==true){oe(s);return e}else if(h==="abort"){if(u.xhr){oe(s);return e}else{F=true}}else if(h==="replace"){de(d,"htmx:abort")}else if(h.indexOf("queue")===0){const W=h.split(" ");g=(W[1]||"last").trim()}}if(u.xhr){if(u.abortable){de(d,"htmx:abort")}else{if(g==null){if(o){const P=ie(o);if(P&&P.triggerSpec&&P.triggerSpec.queue){g=P.triggerSpec.queue}}if(g==null){g="last"}}if(u.queuedRequests==null){u.queuedRequests=[]}if(g==="first"&&u.queuedRequests.length===0){u.queuedRequests.push(function(){he(t,n,r,o,i)})}else if(g==="all"){u.queuedRequests.push(function(){he(t,n,r,o,i)})}else if(g==="last"){u.queuedRequests=[];u.queuedRequests.push(function(){he(t,n,r,o,i)})}oe(s);return e}}const p=new XMLHttpRequest;u.xhr=p;u.abortable=F;const m=function(){u.xhr=null;u.abortable=false;if(u.queuedRequests!=null&&u.queuedRequests.length>0){const e=u.queuedRequests.shift();e()}};const B=re(r,"hx-prompt");if(B){var x=prompt(B);if(x===null||!de(r,"htmx:prompt",{prompt:x,target:c})){oe(s);m();return e}}if(f&&!D){if(!confirm(f)){oe(s);m();return e}}let y=fn(r,c,x);if(t!=="get"&&!pn(r)){y["Content-Type"]="application/x-www-form-urlencoded"}if(i.headers){y=ce(y,i.headers)}const U=cn(r,t);let b=U.errors;const j=U.formData;if(i.values){ln(j,qn(i.values))}const V=qn(En(r));const v=ln(j,V);let w=dn(v,r);if(Q.config.getCacheBusterParam&&t==="get"){w.set("org.htmx.cache-buster",ee(c,"id")||"true")}if(n==null||n===""){n=ne().location.href}const S=bn(r,"hx-request");const _=ie(r).boosted;let E=Q.config.methodsThatUseUrlParams.indexOf(t)>=0;const C={boosted:_,useUrlParams:E,formData:w,parameters:Nn(w),unfilteredFormData:v,unfilteredParameters:Nn(v),headers:y,target:c,verb:t,errors:b,withCredentials:i.credentials||S.credentials||Q.config.withCredentials,timeout:i.timeout||S.timeout||Q.config.timeout,path:n,triggeringEvent:o};if(!de(r,"htmx:configRequest",C)){oe(s);m();return e}n=C.path;t=C.verb;y=C.headers;w=qn(C.parameters);b=C.errors;E=C.useUrlParams;if(b&&b.length>0){de(r,"htmx:validation:halted",C);oe(s);m();return e}const z=n.split("#");const $=z[0];const O=z[1];let R=n;if(E){R=$;const Z=!w.keys().next().done;if(Z){if(R.indexOf("?")<0){R+="?"}else{R+="&"}R+=an(w);if(O){R+="#"+O}}}if(!Tn(r,R,C)){fe(r,"htmx:invalidPath",C);oe(l);return e}p.open(t.toUpperCase(),R,true);p.overrideMimeType("text/html");p.withCredentials=C.withCredentials;p.timeout=C.timeout;if(S.noHeaders){}else{for(const k in y){if(y.hasOwnProperty(k)){const Y=y[k];Cn(p,k,Y)}}}const H={xhr:p,target:c,requestConfig:C,etc:i,boosted:_,select:X,pathInfo:{requestPath:n,finalRequestPath:R,responsePath:null,anchor:O}};p.onload=function(){try{const t=Hn(r);H.pathInfo.responsePath=On(p);M(r,H);if(H.keepIndicators!==true){Qt(T,q)}de(r,"htmx:afterRequest",H);de(r,"htmx:afterOnLoad",H);if(!le(r)){let e=null;while(t.length>0&&e==null){const n=t.shift();if(le(n)){e=n}}if(e){de(e,"htmx:afterRequest",H);de(e,"htmx:afterOnLoad",H)}}oe(s);m()}catch(e){fe(r,"htmx:onLoadError",ce({error:e},H));throw e}};p.onerror=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendError",H);oe(l);m()};p.onabort=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:sendAbort",H);oe(l);m()};p.ontimeout=function(){Qt(T,q);fe(r,"htmx:afterRequest",H);fe(r,"htmx:timeout",H);oe(l);m()};if(!de(r,"htmx:beforeRequest",H)){oe(s);m();return e}var T=Zt(r);var q=Yt(r);se(["loadstart","loadend","progress","abort"],function(t){se([p,p.upload],function(e){e.addEventListener(t,function(e){de(r,"htmx:xhr:"+t,{lengthComputable:e.lengthComputable,loaded:e.loaded,total:e.total})})})});de(r,"htmx:beforeSend",H);const J=E?null:mn(p,r,w);p.send(J);return e}function An(e,t){const n=t.xhr;let r=null;let o=null;if(O(n,/HX-Push:/i)){r=n.getResponseHeader("HX-Push");o="push"}else if(O(n,/HX-Push-Url:/i)){r=n.getResponseHeader("HX-Push-Url");o="push"}else if(O(n,/HX-Replace-Url:/i)){r=n.getResponseHeader("HX-Replace-Url");o="replace"}if(r){if(r==="false"){return{}}else{return{type:o,path:r}}}const i=t.pathInfo.finalRequestPath;const s=t.pathInfo.responsePath;const l=re(e,"hx-push-url");const c=re(e,"hx-replace-url");const u=ie(e).boosted;let a=null;let f=null;if(l){a="push";f=l}else if(c){a="replace";f=c}else if(u){a="push";f=s||i}if(f){if(f==="false"){return{}}if(f==="true"){f=s||i}if(t.pathInfo.anchor&&f.indexOf("#")===-1){f=f+"#"+t.pathInfo.anchor}return{type:a,path:f}}else{return{}}}function In(e,t){var n=new RegExp(e.code);return n.test(t.toString(10))}function Pn(e){for(var t=0;t<Q.config.responseHandling.length;t++){var n=Q.config.responseHandling[t];if(In(n,e.status)){return n}}return{swap:false}}function kn(e){if(e){const t=r("title");if(t){t.innerHTML=e}else{window.document.title=e}}}function Dn(o,i){const s=i.xhr;let l=i.target;const e=i.etc;const c=i.select;if(!de(o,"htmx:beforeOnLoad",i))return;if(O(s,/HX-Trigger:/i)){Je(s,"HX-Trigger",o)}if(O(s,/HX-Location:/i)){zt();let e=s.getResponseHeader("HX-Location");var t;if(e.indexOf("{")===0){t=S(e);e=t.path;delete t.path}Rn("get",e,t).then(function(){$t(e)});return}const n=O(s,/HX-Refresh:/i)&&s.getResponseHeader("HX-Refresh")==="true";if(O(s,/HX-Redirect:/i)){i.keepIndicators=true;location.href=s.getResponseHeader("HX-Redirect");n&&location.reload();return}if(n){i.keepIndicators=true;location.reload();return}if(O(s,/HX-Retarget:/i)){if(s.getResponseHeader("HX-Retarget")==="this"){i.target=o}else{i.target=ue(ae(o,s.getResponseHeader("HX-Retarget")))}}const u=An(o,i);const r=Pn(s);const a=r.swap;let f=!!r.error;let d=Q.config.ignoreTitle||r.ignoreTitle;let h=r.select;if(r.target){i.target=ue(ae(o,r.target))}var g=e.swapOverride;if(g==null&&r.swapOverride){g=r.swapOverride}if(O(s,/HX-Retarget:/i)){if(s.getResponseHeader("HX-Retarget")==="this"){i.target=o}else{i.target=ue(ae(o,s.getResponseHeader("HX-Retarget")))}}if(O(s,/HX-Reswap:/i)){g=s.getResponseHeader("HX-Reswap")}var p=s.response;var m=ce({shouldSwap:a,serverResponse:p,isError:f,ignoreTitle:d,selectOverride:h,swapOverride:g},i);if(r.event&&!de(l,r.event,m))return;if(!de(l,"htmx:beforeSwap",m))return;l=m.target;p=m.serverResponse;f=m.isError;d=m.ignoreTitle;h=m.selectOverride;g=m.swapOverride;i.target=l;i.failed=f;i.successful=!f;if(m.shouldSwap){if(s.status===286){lt(o)}Ft(o,function(e){p=e.transformResponse(p,s,o)});if(u.type){zt()}var x=gn(o,g);if(!x.hasOwnProperty("ignoreTitle")){x.ignoreTitle=d}l.classList.add(Q.config.swappingClass);let n=null;let r=null;if(c){h=c}if(O(s,/HX-Reselect:/i)){h=s.getResponseHeader("HX-Reselect")}const y=re(o,"hx-select-oob");const b=re(o,"hx-select");let e=function(){try{if(u.type){de(ne().body,"htmx:beforeHistoryUpdate",ce({history:u},i));if(u.type==="push"){$t(u.path);de(ne().body,"htmx:pushedIntoHistory",{path:u.path})}else{Jt(u.path);de(ne().body,"htmx:replacedInHistory",{path:u.path})}}$e(l,p,x,{select:h||b,selectOOB:y,eventInfo:i,anchor:i.pathInfo.anchor,contextElement:o,afterSwapCallback:function(){if(O(s,/HX-Trigger-After-Swap:/i)){let e=o;if(!le(o)){e=ne().body}Je(s,"HX-Trigger-After-Swap",e)}},afterSettleCallback:function(){if(O(s,/HX-Trigger-After-Settle:/i)){let e=o;if(!le(o)){e=ne().body}Je(s,"HX-Trigger-After-Settle",e)}oe(n)}})}catch(e){fe(o,"htmx:swapError",i);oe(r);throw e}};let t=Q.config.globalViewTransitions;if(x.hasOwnProperty("transition")){t=x.transition}if(t&&de(o,"htmx:beforeTransition",i)&&typeof Promise!=="undefined"&&document.startViewTransition){const v=new Promise(function(e,t){n=e;r=t});const w=e;e=function(){document.startViewTransition(function(){w();return v})}}if(x.swapDelay>0){E().setTimeout(e,x.swapDelay)}else{e()}}if(f){fe(o,"htmx:responseError",ce({error:"Response Status Error Code "+s.status+" from "+i.pathInfo.requestPath},i))}}const Mn={};function Xn(){return{init:function(e){return null},getSelectors:function(){return null},onEvent:function(e,t){return true},transformResponse:function(e,t,n){return e},isInlineSwap:function(e){return false},handleSwap:function(e,t,n,r){return false},encodeParameters:function(e,t,n){return null}}}function Fn(e,t){if(t.init){t.init(n)}Mn[e]=ce(Xn(),t)}function Bn(e){delete Mn[e]}function Un(e,n,r){if(n==undefined){n=[]}if(e==undefined){return n}if(r==undefined){r=[]}const t=te(e,"hx-ext");if(t){se(t.split(","),function(e){e=e.replace(/ /g,"");if(e.slice(0,7)=="ignore:"){r.push(e.slice(7));return}if(r.indexOf(e)<0){const t=Mn[e];if(t&&n.indexOf(t)<0){n.push(t)}}})}return Un(ue(c(e)),n,r)}var jn=false;ne().addEventListener("DOMContentLoaded",function(){jn=true});function Vn(e){if(jn||ne().readyState==="complete"){e()}else{ne().addEventListener("DOMContentLoaded",e)}}function _n(){if(Q.config.includeIndicatorStyles!==false){const e=Q.config.inlineStyleNonce?` nonce="${Q.config.inlineStyleNonce}"`:"";ne().head.insertAdjacentHTML("beforeend","<style"+e+">      ."+Q.config.indicatorClass+"{opacity:0}      ."+Q.config.requestClass+" ."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;}      ."+Q.config.requestClass+"."+Q.config.indicatorClass+"{opacity:1; transition: opacity 200ms ease-in;}      </style>")}}function zn(){const e=ne().querySelector('meta[name="htmx-config"]');if(e){return S(e.content)}else{return null}}function $n(){const e=zn();if(e){Q.config=ce(Q.config,e)}}Vn(function(){$n();_n();let e=ne().body;kt(e);const t=ne().querySelectorAll("[hx-trigger='restored'],[data-hx-trigger='restored']");e.addEventListener("htmx:abort",function(e){const t=e.target;const n=ie(t);if(n&&n.xhr){n.xhr.abort()}});const n=window.onpopstate?window.onpopstate.bind(window):null;window.onpopstate=function(e){if(e.state&&e.state.htmx){Wt();se(t,function(e){de(e,"htmx:restored",{document:ne(),triggerEvent:de})})}else{if(n){n(e)}}};E().setTimeout(function(){de(e,"htmx:load",{});e=null},0)});return Q}();
\ No newline at end of file
diff --git a/src/ci_orchestrator/web/templates/base.html b/src/ci_orchestrator/web/templates/base.html
index 7f34f44..0a496c5 100644
--- a/src/ci_orchestrator/web/templates/base.html
+++ b/src/ci_orchestrator/web/templates/base.html
@@ -8,9 +8,20 @@
   <script src="/static/htmx.min.js" defer></script>
 </head>
 <body>
+  {% set logged_in_user = request.session.get("user") %}
   <nav class="navbar">
-    <span class="navbar-brand">ci-orchestrator</span>
-    <a href="/audit">Audit log</a>
+    <div class="navbar-inner">
+      <a class="navbar-brand" href="/">ci-orchestrator</a>
+      <div class="navbar-links">
+        <a href="/audit">Audit log</a>
+        {% if logged_in_user %}
+        <span class="navbar-user" aria-label="Logged in as {{ logged_in_user }}">{{ logged_in_user }}</span>
+        <a class="navbar-logout" href="/logout" aria-label="Log out">Logout</a>
+        {% else %}
+        <span class="navbar-user navbar-user-local">local</span>
+        {% endif %}
+      </div>
+    </div>
   </nav>
   <main class="content">
     {% block content %}{% endblock %}
diff --git a/src/ci_orchestrator/web/templates/dashboard.html b/src/ci_orchestrator/web/templates/dashboard.html
index 22b899e..44cb901 100644
--- a/src/ci_orchestrator/web/templates/dashboard.html
+++ b/src/ci_orchestrator/web/templates/dashboard.html
@@ -3,13 +3,9 @@
 {% block title %}Dashboard - ci-orchestrator{% endblock %}
 
 {% block content %}
-<section class="card" id="vms-card">
+<div class="dashboard-grid">
   {% include "partials/vms.html" %}
-</section>
-
-<section class="card" id="cache-card">
   {% include "partials/cache.html" %}
-</section>
-
-{% include "partials/host.html" %}
+  {% include "partials/host.html" %}
+</div>
 {% endblock %}
diff --git a/src/ci_orchestrator/web/templates/partials/audit.html b/src/ci_orchestrator/web/templates/partials/audit.html
index 7ec26df..db3245d 100644
--- a/src/ci_orchestrator/web/templates/partials/audit.html
+++ b/src/ci_orchestrator/web/templates/partials/audit.html
@@ -6,30 +6,40 @@
 <section class="card" id="audit-card">
   <h2>Audit log</h2>
   {% if entries %}
-  <table>
-    <thead>
-      <tr>
-        <th>Time</th>
-        <th>User</th>
-        <th>Action</th>
-        <th>Target</th>
-        <th>Result</th>
-        <th>Detail</th>
-      </tr>
-    </thead>
-    <tbody>
-      {% for e in entries %}
-      <tr class="{{ 'row-alert' if e.result == 'error' else '' }}">
-        <td>{{ e.ts }}</td>
-        <td>{{ e.user }}</td>
-        <td>{{ e.action }}</td>
-        <td><code>{{ e.target }}</code></td>
-        <td>{{ e.result }}</td>
-        <td>{{ e.detail }}</td>
-      </tr>
-      {% endfor %}
-    </tbody>
-  </table>
+  <div class="table-wrap">
+    <table>
+      <thead>
+        <tr>
+          <th>Time</th>
+          <th>User</th>
+          <th>Action</th>
+          <th>Target</th>
+          <th>Result</th>
+          <th>Detail</th>
+        </tr>
+      </thead>
+      <tbody>
+        {% for e in entries %}
+        <tr class="{{ 'row-alert' if e.result == 'error' else '' }}">
+          <td>{{ e.ts }}</td>
+          <td>{{ e.user }}</td>
+          <td>{{ e.action }}</td>
+          <td><code>{{ e.target }}</code></td>
+          <td>
+            {% if e.result == "ok" %}
+            <span class="badge badge-success">ok</span>
+            {% elif e.result == "error" %}
+            <span class="badge badge-danger">error</span>
+            {% else %}
+            <span class="badge badge-warn">{{ e.result }}</span>
+            {% endif %}
+          </td>
+          <td>{{ e.detail }}</td>
+        </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+  </div>
   {% else %}
   <p>No audit entries yet.</p>
   {% endif %}
diff --git a/src/ci_orchestrator/web/templates/partials/cache.html b/src/ci_orchestrator/web/templates/partials/cache.html
index 37c8257..3fbd678 100644
--- a/src/ci_orchestrator/web/templates/partials/cache.html
+++ b/src/ci_orchestrator/web/templates/partials/cache.html
@@ -1,4 +1,4 @@
-<div id="cache-partial">
+<section class="card" id="cache-card" hx-get="/cache" hx-trigger="every 5s" hx-swap="outerHTML">
   <h2>Cargo cache</h2>
   {% if cache %}
   <dl>
@@ -10,10 +10,10 @@
     <dt>Retention</dt><dd>{{ cache.retention_days }} day(s)</dd>
   </dl>
   {% else %}
-  <p class="notice notice-warn">Cargo cache status unavailable.</p>
+  <p class="notice notice-warn" role="alert">Cargo cache status unavailable.</p>
   {% endif %}
-  <form method="post" action="/cache/purge" id="cache-purge-form">
+  <form method="post" action="/cache/purge" id="cache-purge-form" aria-label="Purge cargo cache">
     <input type="hidden" name="csrf" value="{{ csrf_token }}">
-    <button type="submit" class="btn btn-danger">Purge cache</button>
+    <button type="submit" class="btn btn-danger" aria-label="Purge cargo cache">Purge cache</button>
   </form>
-</div>
+</section>
diff --git a/src/ci_orchestrator/web/templates/partials/confirm.html b/src/ci_orchestrator/web/templates/partials/confirm.html
index b05a405..95f10a1 100644
--- a/src/ci_orchestrator/web/templates/partials/confirm.html
+++ b/src/ci_orchestrator/web/templates/partials/confirm.html
@@ -1,4 +1,4 @@
-<div class="confirm-box notice notice-warn" id="action-confirm">
+<div class="confirm-box notice notice-warn" id="action-confirm" role="alert">
   <h3>Confirm: {{ action_label }}</h3>
   <p>Target: <code>{{ target }}</code></p>
   <p>{{ summary }}</p>
@@ -8,6 +8,6 @@
     {% for key, value in extra_fields.items() %}
     <input type="hidden" name="{{ key }}" value="{{ value }}">
     {% endfor %}
-    <button type="submit" class="btn btn-danger">Confirm</button>
+    <button type="submit" class="btn btn-danger" aria-label="Confirm: {{ action_label }}">Confirm</button>
   </form>
 </div>
diff --git a/src/ci_orchestrator/web/templates/partials/host.html b/src/ci_orchestrator/web/templates/partials/host.html
index 53f01dc..e17bb19 100644
--- a/src/ci_orchestrator/web/templates/partials/host.html
+++ b/src/ci_orchestrator/web/templates/partials/host.html
@@ -1,48 +1,59 @@
-<section class="card" id="disk-card">
-  <h2>Disk</h2>
-  {% if disk %}
-  <dl>
-    <dt>Path</dt><dd><code>{{ disk.path }}</code></dd>
-    <dt>Total</dt><dd>{{ "%.1f"|format(disk.total_gb) }} GB</dd>
-    <dt>Free</dt><dd>{{ "%.1f"|format(disk.free_gb) }} GB</dd>
-    <dt>Used</dt><dd>{{ "%.1f"|format(disk.used_pct) }}%</dd>
-  </dl>
-  {% else %}
-  <p class="notice notice-warn">Disk status unavailable.</p>
-  {% endif %}
-</section>
+<div class="contents" id="host-partial" hx-get="/host" hx-trigger="every 5s" hx-swap="outerHTML">
+  <section class="card" id="disk-card">
+    <h2>Disk</h2>
+    {% if disk %}
+    <dl>
+      <dt>Path</dt><dd><code>{{ disk.path }}</code></dd>
+      <dt>Total</dt><dd>{{ "%.1f"|format(disk.total_gb) }} GB</dd>
+      <dt>Free</dt><dd>{{ "%.1f"|format(disk.free_gb) }} GB</dd>
+      <dt>Used</dt><dd>{{ "%.1f"|format(disk.used_pct) }}%</dd>
+    </dl>
+    {% else %}
+    <p class="notice notice-warn" role="alert">Disk status unavailable.</p>
+    {% endif %}
+  </section>
 
-<section class="card" id="runner-card">
-  <h2>Runners</h2>
-  {% if runners %}
-  <table>
-    <thead>
-      <tr>
-        <th>Service</th>
-        <th>Active</th>
-        <th>Sub-state</th>
-      </tr>
-    </thead>
-    <tbody>
-      {% for runner in runners %}
-      <tr class="{{ 'row-ok' if runner.active else 'row-alert' }}">
-        <td>{{ runner.name }}</td>
-        <td>{{ "yes" if runner.active else "no" }}</td>
-        <td>{{ runner.sub_state }}</td>
-      </tr>
-      {% endfor %}
-    </tbody>
-  </table>
-  {% else %}
-  <p class="notice notice-warn">Runner status unavailable.</p>
-  {% endif %}
-</section>
+  <section class="card" id="runner-card">
+    <h2>Runners</h2>
+    {% if runners %}
+    <div class="table-wrap">
+      <table>
+        <thead>
+          <tr>
+            <th>Service</th>
+            <th>Status</th>
+            <th>Sub-state</th>
+          </tr>
+        </thead>
+        <tbody>
+          {% for runner in runners %}
+          <tr class="{{ 'row-alert' if not runner.active else '' }}">
+            <td>{{ runner.name }}</td>
+            <td>
+              {% if runner.active %}
+              <span class="badge badge-success">active</span>
+              {% else %}
+              <span class="badge badge-danger">down</span>
+              {% endif %}
+            </td>
+            <td>{{ runner.sub_state }}</td>
+          </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
+    {% else %}
+    <p class="notice notice-warn" role="alert">Runner status unavailable.</p>
+    {% endif %}
+  </section>
 
-<section class="card" id="backup-card">
-  <h2>Template backup</h2>
-  <form method="post" action="/host/backup" id="host-backup-form">
-    <input type="hidden" name="csrf" value="{{ csrf_token }}">
-    <label>Template: <input type="text" name="template" required></label>
-    <button type="submit" class="btn btn-danger">Backup template</button>
-  </form>
-</section>
+  <section class="card" id="backup-card">
+    <h2>Template backup</h2>
+    <form method="post" action="/host/backup" id="host-backup-form" aria-label="Backup template">
+      <input type="hidden" name="csrf" value="{{ csrf_token }}">
+      <label for="host-backup-template">Template</label>
+      <input type="text" id="host-backup-template" name="template" required>
+      <button type="submit" class="btn btn-danger" aria-label="Backup template">Backup template</button>
+    </form>
+  </section>
+</div>
diff --git a/src/ci_orchestrator/web/templates/partials/lock_conflict.html b/src/ci_orchestrator/web/templates/partials/lock_conflict.html
index 1329d48..36ac940 100644
--- a/src/ci_orchestrator/web/templates/partials/lock_conflict.html
+++ b/src/ci_orchestrator/web/templates/partials/lock_conflict.html
@@ -1,5 +1,5 @@
-<div class="notice notice-warn" id="action-lock-conflict">
-  <h3>{{ action_label }} refused</h3>
+<div class="notice notice-warn" id="action-lock-conflict" role="alert">
+  <h3>{{ action_label }} refused <span class="badge badge-warn">locked</span></h3>
   <p>A job may be running against <code>{{ target }}</code> (a fresh
      <code>vm-start.lock</code> is present). Try again once it clears.</p>
 </div>
diff --git a/src/ci_orchestrator/web/templates/partials/result.html b/src/ci_orchestrator/web/templates/partials/result.html
index a5e3ec9..47b9e34 100644
--- a/src/ci_orchestrator/web/templates/partials/result.html
+++ b/src/ci_orchestrator/web/templates/partials/result.html
@@ -1,4 +1,11 @@
-<div class="action-result {{ 'result-ok' if ok else 'result-error' }}" id="action-result">
-  <h3>{{ action_label }} -- {{ "ok" if ok else "error" }}</h3>
+<div class="action-result {{ 'result-ok' if ok else 'result-error' }}" id="action-result" role="status" aria-live="polite">
+  <h3>
+    {{ action_label }} --
+    {% if ok %}
+    <span class="badge badge-success">ok</span>
+    {% else %}
+    <span class="badge badge-danger">error</span>
+    {% endif %}
+  </h3>
   <p>{{ detail }}</p>
 </div>
diff --git a/src/ci_orchestrator/web/templates/partials/vms.html b/src/ci_orchestrator/web/templates/partials/vms.html
index 355431a..a159c06 100644
--- a/src/ci_orchestrator/web/templates/partials/vms.html
+++ b/src/ci_orchestrator/web/templates/partials/vms.html
@@ -1,46 +1,55 @@
-<div id="vms-partial" hx-get="/vms" hx-trigger="every 5s" hx-swap="outerHTML">
+<section class="card" id="vms-card" hx-get="/vms" hx-trigger="every 5s" hx-swap="outerHTML">
   <h2>Live VMs</h2>
   {% if not backend_available %}
-  <p class="notice notice-warn">Backend unavailable (vmrun not found on this host).</p>
+  <p class="notice notice-warn" role="alert">Backend unavailable (vmrun not found on this host).</p>
   {% endif %}
   {% if vms %}
-  <table>
-    <thead>
-      <tr>
-        <th>Name</th>
-        <th>VMX</th>
-        <th>IP</th>
-        <th>Guest OS</th>
-        <th>Uptime (s)</th>
-        <th>Orphan?</th>
-        <th>Actions</th>
-      </tr>
-    </thead>
-    <tbody>
-      {% for vm in vms %}
-      <tr class="{{ 'row-orphan' if vm.is_orphan else '' }}">
-        <td>{{ vm.name }}</td>
-        <td><code>{{ vm.vmx }}</code></td>
-        <td>{{ vm.ip or "-" }}</td>
-        <td>{{ vm.guest_os or "-" }}</td>
-        <td>{{ vm.uptime_sec if vm.uptime_sec is not none else "-" }}</td>
-        <td>{{ "yes" if vm.is_orphan else "no" }}</td>
-        <td>
-          <form method="post" action="/vms/{{ vm.vmx | vmx_id }}/remove">
-            <input type="hidden" name="csrf" value="{{ csrf_token }}">
-            <button type="submit" class="btn btn-danger">Remove</button>
-          </form>
-        </td>
-      </tr>
-      {% endfor %}
-    </tbody>
-  </table>
+  <div class="table-wrap">
+    <table>
+      <thead>
+        <tr>
+          <th>Name</th>
+          <th>VMX</th>
+          <th>IP</th>
+          <th>Guest OS</th>
+          <th>Uptime (s)</th>
+          <th>Status</th>
+          <th>Actions</th>
+        </tr>
+      </thead>
+      <tbody>
+        {% for vm in vms %}
+        <tr class="{{ 'row-orphan' if vm.is_orphan else '' }}">
+          <td>{{ vm.name }}</td>
+          <td><code>{{ vm.vmx }}</code></td>
+          <td>{{ vm.ip or "-" }}</td>
+          <td>{{ vm.guest_os or "-" }}</td>
+          <td>{{ vm.uptime_sec if vm.uptime_sec is not none else "-" }}</td>
+          <td>
+            {% if vm.is_orphan %}
+            <span class="badge badge-warn">orphan</span>
+            {% else %}
+            <span class="badge badge-success">running</span>
+            {% endif %}
+          </td>
+          <td>
+            <form method="post" action="/vms/{{ vm.vmx | vmx_id }}/remove">
+              <input type="hidden" name="csrf" value="{{ csrf_token }}">
+              <button type="submit" class="btn btn-danger" aria-label="Remove VM {{ vm.name }}">Remove</button>
+            </form>
+          </td>
+        </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+  </div>
   {% else %}
   <p>No VMs currently running.</p>
   {% endif %}
-  <form method="post" action="/vms/cleanup" id="vms-cleanup-form">
+  <form method="post" action="/vms/cleanup" id="vms-cleanup-form" aria-label="Cleanup orphaned VMs">
     <input type="hidden" name="csrf" value="{{ csrf_token }}">
-    <label>Max age (h): <input type="number" name="max_age_hours" value="4" min="0"></label>
-    <button type="submit" class="btn btn-danger">Cleanup orphans</button>
+    <label for="vms-cleanup-max-age">Max age (h)</label>
+    <input type="number" id="vms-cleanup-max-age" name="max_age_hours" value="4" min="0">
+    <button type="submit" class="btn btn-danger" aria-label="Cleanup orphaned VMs older than the given age">Cleanup orphans</button>
   </form>
-</div>
+</section>