Sync from felladrin/MiniSearch@951bd60

.github/CODE_OF_CONDUCT.md

@@ -9,20 +9,18 @@ We pledge to act and interact in ways that contribute to an open, welcoming, div
 ## Our Standards
 
 Examples of behavior that contributes to a positive environment for our community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the overall community
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall community
 
 Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a professional setting
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
 
 ## Enforcement Responsibilities
 
@@ -37,7 +35,6 @@ This Code of Conduct applies within all community spaces, and also applies when
 ## Enforcement
 
 Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at:
-
 - GitHub: [@felladrin](https://github.com/felladrin)
 - Email: (private contact can be provided upon request)
 

.github/CONTRIBUTING.md

@@ -22,7 +22,6 @@ docker compose exec development-server npm run lint
 ```
 
 This runs:
-
 - Biome (formatting/linting)
 - TypeScript (type checking)
 - knip (dead code detection)

.github/ISSUE_TEMPLATE/security_vulnerability.yml

@@ -9,7 +9,7 @@ body:
     attributes:
       value: |
         # ⚠️ IMPORTANT: SECURITY VULNERABILITIES SHOULD NOT BE REPORTED PUBLICLY ⚠️
-        
+
         This template will create a public issue, but security vulnerabilities must be reported privately through GitHub's [Private Vulnerability Reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
 
         If you accidentally created a public issue, please close it and report privately instead.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,8 +1,11 @@
 ## Description
+
 <!-- What does this PR change, and why? Add ### subsections for anything that needs it. -->
 
 ## How to test
+
 <!-- Numbered steps a reviewer can follow. Say plainly what you could not test. -->
 
 ## Screenshots
+
 <!-- For UI changes. Delete this section if not applicable. -->

.github/SECURITY.md

@@ -5,9 +5,9 @@
 Only the latest version of MiniSearch receives security updates.
 
 | Version | Supported |
-|---------|------------|
-| Latest  | ✅         |
-| Older   | ❌         |
+| ------- | --------- |
+| Latest  | ✅        |
+| Older   | ❌        |
 
 ## Reporting a Vulnerability
 
@@ -88,13 +88,13 @@ A few of MiniSearch's dependencies ship native code or WebAssembly rather than a
 
 ### Inventory
 
-| Module | Type | Where it runs | Why it is trusted |
-| --- | --- | --- | --- |
-| `onnxruntime-node` | Native (Node addon) | Server-side reranker, CPU only | Microsoft-published ONNX Runtime; exact pin; its install script is **denied** (see below), so nothing is fetched at install time |
-| `@wllama/wllama` | WebAssembly | Browser inference | Published wllama project; exact pin; no install script |
-| `@huggingface/tokenizers` | Native (Node addon) | Server-side tokenization | Hugging Face-published; exact pin; no install script |
-| `hash-wasm` | WebAssembly | argon2id hashing (browser and server) | Widely-used, audited WASM hash library; exact pin; no install script |
-| `@moonshine-ai/moonshine-wasm` | WebAssembly | Browser dictation | Exact pin; no install script |
+| Module                         | Type                | Where it runs                         | Why it is trusted                                                                                                                |
+| ------------------------------ | ------------------- | ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `onnxruntime-node`             | Native (Node addon) | Server-side reranker, CPU only        | Microsoft-published ONNX Runtime; exact pin; its install script is **denied** (see below), so nothing is fetched at install time |
+| `@wllama/wllama`               | WebAssembly         | Browser inference                     | Published wllama project; exact pin; no install script                                                                           |
+| `@huggingface/tokenizers`      | Native (Node addon) | Server-side tokenization              | Hugging Face-published; exact pin; no install script                                                                             |
+| `hash-wasm`                    | WebAssembly         | argon2id hashing (browser and server) | Widely-used, audited WASM hash library; exact pin; no install script                                                             |
+| `@moonshine-ai/moonshine-wasm` | WebAssembly         | Browser dictation                     | Exact pin; no install script                                                                                                     |
 
 ### What is verified at install
 
@@ -118,7 +118,6 @@ A few of MiniSearch's dependencies ship native code or WebAssembly rather than a
 ### Approving a new install script
 
 Under `strict-allow-scripts`, any package that ships an install script without a recorded decision fails the install. To unblock it, a maintainer must:
-
 1. Read the script first (`npm view <pkg> scripts`, or the unpacked tarball) and decide whether it is acceptable.
 2. Record the decision: `npm approve-scripts <pkg>` writes a version-pinned `"<name>@<version>": true` entry to `package.json#allowScripts` (`allow-scripts-pin` is on); `npm deny-scripts <pkg>` writes `"<name>": false`, denying every version of the package.
 3. Update the decision list above in the same PR, with the reasoning.

.github/SUPPORT.md

@@ -7,7 +7,6 @@ If you need help with MiniSearch, these are the best support channels.
 ### GitHub Discussions
 
 For questions, feature requests, and general discussion, use [GitHub Discussions](https://github.com/felladrin/MiniSearch/discussions). This is the best place to:
-
 - Ask how to configure MiniSearch for your use case
 - Request new features
 - Share ideas and feedback

.github/workflows/publish-docker-image.yml

@@ -147,14 +147,14 @@ jobs:
         id: record-commit
         run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
       - name: Log in to the Container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302  # v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           # `latest` replaces the `main` tag this action emits by default. With
@@ -171,10 +171,10 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
             type=raw,value=${{ steps.validate-version.outputs.version }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069  # v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
       - name: Build and push Docker Image
         id: build-and-push
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc  # v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
         with:
           context: .
           push: true

Dockerfile

@@ -2,7 +2,7 @@ FROM node:lts-slim
 
 # Renovate keeps this pin current via the customManager in renovate.json,
 # whose regex matches this exact line: keep the quoted 40-character form.
-ARG SEARXNG_COMMIT_SHA="1c10abe2d3e4ab7ddcc4e9da1a7d07dc7ca7f8f4"
+ARG SEARXNG_COMMIT_SHA="10db664f14bc34565d4fd6ca6d846b6f932976aa"
 
 ENV PORT=7860
 EXPOSE $PORT

agents.md

@@ -17,16 +17,19 @@ This is your navigation hub. Start here, follow the links, and return when you n
 ## Repository Map
 
 ### Getting Started
+
 - **`docs/quick-start.md`** - Installation, first run, verification
 - **`docs/overview.md`** - System architecture and data flow
 - **`docs/project-structure.md`** - Directory layout and component organization
 
 ### Configuration & Setup
+
 - **`docs/configuration.md`** - Environment variables and settings reference
 - **`docs/configuration.md#tuning-the-search-engines`** - Replacing the SearXNG settings file at container start: engine selection, engines blocked from an IP, the `TMPDIR` requirement
 - **`docs/security.md`** - Access control, privacy, and security model
 
 ### Core Functionality
+
 - **`docs/api.md`** - HTTP endpoint reference: parameters, responses, and error codes
 - **`docs/ai-integration.md`** - AI inference types (Wllama, OpenAI, AI Horde, Internal)
 - **`docs/ui-components.md`** - Component architecture and PubSub patterns
@@ -37,6 +40,7 @@ This is your navigation hub. Start here, follow the links, and return when you n
 - **`docs/glossary.md`** - Codebase-specific terms and domain concepts
 
 ### Development
+
 - **`docs/development-commands.md`** - Docker, npm, and testing commands
 - **`docs/failure-injection.md`** - Graceful-degradation test matrix
 - **`docs/coding-conventions.md`** - Style guide and patterns
@@ -72,11 +76,13 @@ Need to:
 ## Key Files Reference
 
 ### Entry Points
+
 - `client/index.tsx` - React app initialization
 - `vite.config.ts` - Vite dev server with hooks
 - `Dockerfile` - Single-stage container build
 
 ### Business Logic Modules
+
 - `client/modules/search.ts` - Search orchestration and caching
 - `client/modules/textGeneration.ts` - AI response flow
 - `client/modules/pubSub.ts` - All PubSub channels
@@ -84,6 +90,7 @@ Need to:
 - `client/modules/history.ts` - Search history database
 
 ### Server-Side Modules
+
 - `server/searchEndpointServerHook.ts` - `/search` endpoints
 - `server/pageContentEndpointServerHook.ts` - `/page-content` endpoint
 - `server/internalApiEndpointServerHook.ts` - `/inference` proxy
@@ -91,6 +98,7 @@ Need to:
 - `server/rerankerService.ts` - Local result reranking
 
 ### UI Components
+
 - `client/components/DictationButton.tsx` - Microphone control shared by the search field and the chat follow-up field
 - `client/components/App/` - Application shell with error boundaries
 - `client/components/Search/Form/` - Search input and form
@@ -105,6 +113,7 @@ Need to:
 - `client/components/Settings/HistorySettings.tsx` - History configuration UI
 
 ### Client Modules
+
 - `client/modules/pubSub.ts` - All PubSub channels for state management
 - `client/modules/search.ts` - Search orchestration and IndexedDB caching
 - `client/modules/textGeneration.ts` - AI response generation and chat handling
@@ -142,6 +151,7 @@ Need to:
 - `client/modules/types.ts` - Shared TypeScript type definitions
 
 ### Server Modules
+
 - `server/searchEndpointServerHook.ts` - `/search/text` and `/search/images` endpoints
 - `server/thumbnailEndpointServerHook.ts` - `/thumbnail` endpoint: one search-result thumbnail at a time, token-gated, with an in-process LRU in front of the upstream host
 - `server/internalApiEndpointServerHook.ts` - `/inference` proxy to self-hosted API
@@ -168,6 +178,7 @@ Need to:
 - `server/downloadFileFromHuggingFaceRepository.ts` - Downloads model files from HuggingFace
 
 ### Hooks
+
 - `client/hooks/useSearchHistory.ts` - Search history management from IndexedDB
 - `client/hooks/useHistoryRestore.ts` - Restores full search state from history
 - `client/hooks/useDrawerState.ts` - Drawer open/close state with logging
@@ -176,26 +187,34 @@ Need to:
 ## Common Tasks Quick Reference
 
 ### Add a new AI model
-1. Add to `client/modules/wllama.ts`
-2. Update `docs/ai-integration.md`
-3. Update `docs/configuration.md` defaults
+
+1. Check the wasm build can run it: the architecture must exist in `node_modules/@wllama/wllama/esm/wasm/wllama.wasm` (grep the binary for the arch name), and the quant must stay under the ceilings in `docs/ai-integration.md` (shard every file under 2000 MiB; total weights under ~3.7 GB)
+2. Shard the GGUF (`llama-gguf-split --split --size`, or an equivalent) and publish to a `Felladrin/gguf-sharded-<QUANT>-<Name>` repo
+3. Add to `client/modules/wllama.ts`; thinking-by-default templates need `chatTemplateKwargs: { enable_thinking: false }`
+4. Run `node scripts/wllama-catalog-check.cjs` and `npx vitest run client/modules/wllama.test.ts`
+5. Update `docs/ai-integration.md`
+6. Update `docs/configuration.md` defaults
 
 ### Add a new setting
+
 1. Add to `client/modules/settings.ts` default object
 2. Add UI in `client/components/Pages/Main/Menu/`
 3. Update `docs/configuration.md` settings table
 
 ### Modify search behavior
+
 1. Edit `client/modules/search.ts`
 2. Update `server/webSearchService.ts` if server-side changes needed
 3. Check `server/rerankerService.ts` if reranking affected
 
 ### Fix UI state issues
+
 1. Check PubSub channels in `client/modules/pubSub.ts`
 2. Verify component subscriptions in `docs/ui-components.md`
 3. Ensure proper state updates in business logic modules
 
 ### Analyze test coverage
+
 1. Run `npm run test:coverage` to generate reports
 2. Check `coverage/coverage-summary.json` for quick metrics
 3. See `docs/development-commands.md` for full coverage analysis guide
@@ -221,11 +240,11 @@ This runs:
 
 The project is split across three TypeScript configs, and the default one covers less than its name suggests:
 
-| Config | Covers |
-| --- | --- |
-| `tsconfig.json` | `client`, `shared`, `test` |
+| Config               | Covers                                                              |
+| -------------------- | ------------------------------------------------------------------- |
+| `tsconfig.json`      | `client`, `shared`, `test`                                          |
 | `tsconfig.node.json` | `vite.config.ts`, `server`, `shared`, `e2e`, `playwright.config.ts` |
-| `tsconfig.eval.json` | `eval`, `shared` |
+| `tsconfig.eval.json` | `eval`, `shared`                                                    |
 
 So `npx tsc --noEmit` reports success while type errors sit in `server/` or `eval/`, and CI then fails on a change that looked clean locally. Only `npm run lint` runs all three configs. Never treat a bare `tsc` as a green typecheck.
 

changelog.md

@@ -3,6 +3,11 @@
 Notable changes, grouped by date, most recent first.
 
 
+## 2026-11-02
+
+- Five new browser models joined the Wllama catalog: Spark X2.6 1.7B, Granite 4.2 3B, Qwen 3.5 4B, Gemma 4 E2B and Spark X2.6 4B, each tested end to end against the shipped wasm build with the search-answer prompt. The Gemma 4 and Qwen 3.5 architectures were previously absent from the catalog, and the new entries run on the wasm engine's supported architectures (`gemma4`, `qwen35`, `spark2_5`, `granite`). Models whose chat template thinks by default ship with `chatTemplateKwargs: { enable_thinking: false }`, a new per-model field passed to wllama as `chat_template_kwargs`, because MiniSearch renders only the content channel and a thinking template would otherwise spend the whole token budget on reasoning and answer with nothing. `docs/ai-integration.md` now records the two measured ceilings a candidate must fit (shard files under 2000 MiB, since Chromium's OPFS silently truncates beyond it; total weights under ~3.7 GB, since the wasm linear memory caps at 4 GiB), and `npm run wllama-catalog-check` HEADs every shard of every catalog model on HuggingFace to verify the claimed sizes.
+
+
 ## 2026-10-10
 
 - The text-search fallback now cascades over Parallel and You.com instead of asking a single provider. On each search the configured providers are tried in a random order, one after the other, until one returns results, under the same 15-second budget, which is split across the providers still untried and not paused so a hanging one cannot starve the rest. A provider that answers HTTP 429 is paused until its `Retry-After` and skipped meanwhile, as You.com's acceptable use policy asks. A single search can now reach more than one provider; each sees the query text and this server's IP address, never the user's. `SEARCH_FALLBACK_PROVIDERS` picks the providers (all of them when empty), and `SEARCH_FALLBACK_PARALLEL_API_KEY` and `SEARCH_FALLBACK_YOUCOM_API_KEY` hold the optional keys. `SEARCH_FALLBACK_PROVIDER` and `SEARCH_FALLBACK_API_KEY` are removed: if either is still set while the fallback is enabled, the server stops at start with an error naming the replacement, and so does a provider key with a control character inside it. `/status` gained per-provider counters under `searches.fallbackProviders`.

client/components/Analytics/SearchStats.tsx

@@ -31,6 +31,29 @@ interface StatsData {
   recentActivity: SearchEntry[];
 }
 
+function MetricCard({
+  title,
+  value,
+  compact,
+}: {
+  title: string;
+  value: string | number;
+  compact: boolean;
+}) {
+  return (
+    <Card withBorder p={compact ? "sm" : "md"}>
+      <Stack gap="xs" align="flex-start">
+        <Text size="xs" tt="uppercase" fw={700} c="dimmed">
+          {title}
+        </Text>
+        <Text fw={700} size={compact ? "lg" : "xl"}>
+          {value}
+        </Text>
+      </Stack>
+    </Card>
+  );
+}
+
 export default function SearchStats({
   period = "week",
   compact = false,
@@ -175,38 +198,23 @@ export default function SearchStats({
     );
   }
 
-  function MetricCard({
-    title,
-    value,
-  }: {
-    title: string;
-    value: string | number;
-  }) {
-    return (
-      <Card withBorder p={compact ? "sm" : "md"}>
-        <Stack gap="xs" align="flex-start">
-          <Text size="xs" tt="uppercase" fw={700} c="dimmed">
-            {title}
-          </Text>
-          <Text fw={700} size={compact ? "lg" : "xl"}>
-            {value}
-          </Text>
-        </Stack>
-      </Card>
-    );
-  }
-
   return (
     <Stack gap={compact ? "sm" : "md"}>
       <SimpleGrid cols={compact ? 2 : { base: 1, sm: 2, lg: 4 }}>
         <MetricCard
           title="Total Searches"
           value={stats.totalSearches.toLocaleString()}
+          compact={compact}
+        />
+        <MetricCard
+          title="Daily Average"
+          value={stats.avgPerDay}
+          compact={compact}
         />
-        <MetricCard title="Daily Average" value={stats.avgPerDay} />
         <MetricCard
           title="Most Active Hour"
           value={formatHour(stats.mostActiveHour)}
+          compact={compact}
         />
         <MetricCard
           title="Last Search"
@@ -215,6 +223,7 @@ export default function SearchStats({
               ? formatRelativeTime(stats.recentActivity[0].timestamp)
               : "Never"
           }
+          compact={compact}
         />
       </SimpleGrid>
 

client/modules/search.ts

@@ -76,7 +76,7 @@ const cacheMetrics = {
       return maxValue;
     }
     const newValue = current + increment;
-    return newValue > maxValue ? maxValue : newValue;
+    return Math.min(newValue, maxValue);
   },
 };
 

client/modules/textGenerationWithWllama.ts

@@ -121,6 +121,9 @@ async function generateWithWllama({
       stream: true,
       abortSignal: abortController.signal,
       ...model.getSampling(),
+      ...(model.chatTemplateKwargs
+        ? { chat_template_kwargs: model.chatTemplateKwargs }
+        : {}),
     });
 
     for await (const chunk of stream) {
@@ -179,6 +182,7 @@ async function initializeWllamaInstance(progressCallback?: ProgressCallback) {
       suppressNativeLog: true,
       allowOffline: true,
     },
+    chatTemplateKwargs: model.chatTemplateKwargs,
     model: {
       n_threads: getSettings().cpuThreads,
       n_ctx: model.contextSize,

client/modules/wllama.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it, vi } from "vitest";
+import { wllamaModels } from "./wllama";
+
+vi.mock("./logEntries", () => ({ addLogEntry: vi.fn() }));
+vi.mock("./textGenerationUtilities", () => ({ defaultContextSize: 4096 }));
+
+const models = Object.entries(wllamaModels);
+
+describe("wllamaModels catalog", () => {
+  it("lists models in ascending file-size order", () => {
+    const sizes = models.map(([, model]) => model.fileSizeInMegabytes);
+    expect(sizes).toEqual([...sizes].sort((a, b) => a - b));
+  });
+
+  it("gives every model a unique label", () => {
+    const labels = models.map(([, model]) => model.label);
+    expect(new Set(labels).size).toBe(labels.length);
+  });
+
+  it("points every model at a sharded Felladrin repository", () => {
+    for (const [id, model] of models) {
+      expect(model.hfRepoId, id).toMatch(/^Felladrin\/gguf-sharded-/);
+      // Chromium's OPFS silently truncates files past 2000 MiB, so every
+      // catalog file must be a shard, never a monolithic GGUF.
+      expect(model.hfFilePath, id).toMatch(/-\d{5}-of-\d{5}\.gguf$/);
+    }
+  });
+
+  it("keeps every model inside the wasm memory ceiling", () => {
+    // The wllama wasm build caps linear memory at 4 GiB. Models at 3.5 GB
+    // and above were measured to OOM during buffer reserve (gemma4 quants),
+    // so the catalog stays clearly below that line.
+    for (const [id, model] of models) {
+      expect(model.fileSizeInMegabytes, id).toBeLessThan(3700);
+      expect(model.fileSizeInMegabytes, id).toBeGreaterThan(0);
+    }
+  });
+
+  it("switches thinking-by-default chat templates off", () => {
+    // MiniSearch renders only the content channel. A template that thinks
+    // by default spends the whole token budget on reasoning_content and the
+    // user sees an empty answer, so any model passing template kwargs must
+    // be turning thinking off.
+    for (const [id, model] of models) {
+      if (model.chatTemplateKwargs) {
+        expect(model.chatTemplateKwargs, id).toEqual({
+          enable_thinking: false,
+        });
+      }
+    }
+  });
+
+  it("uses the shared default context size for every model", () => {
+    for (const [id, model] of models) {
+      expect(model.contextSize, id).toBe(4096);
+    }
+  });
+});

client/modules/wllama.ts

@@ -12,6 +12,7 @@ import { defaultContextSize } from "./textGenerationUtilities";
 interface WllamaInitConfig {
   wllama?: WllamaConfig;
   model?: LoadModelParams & DownloadOptions;
+  chatTemplateKwargs?: Record<string, unknown>;
 }
 
 async function createWllamaInstance(config?: WllamaConfig): Promise<Wllama> {
@@ -64,6 +65,9 @@ export async function initializeWllama(
         },
       ],
       max_tokens: 1,
+      ...(config?.chatTemplateKwargs
+        ? { chat_template_kwargs: config.chatTemplateKwargs }
+        : {}),
     });
 
     const hasWarmupSucceeded = !!warmupResponse.choices[0]?.message?.content;
@@ -122,6 +126,13 @@ export interface WllamaModel {
   readonly shouldIncludeUrlsOnPrompt: boolean;
   readonly stopStrings?: string[];
   readonly flash_attn?: boolean;
+  /**
+   * Extra variables handed to the model's chat template on every completion
+   * (wllama's `chat_template_kwargs`). Used to switch off thinking-by-default
+   * templates: MiniSearch renders only the content channel, so a model that
+   * spends its whole budget on `reasoning_content` would answer with nothing.
+   */
+  readonly chatTemplateKwargs?: Record<string, unknown>;
   getSampling: () => Omit<SamplingParams, "logit_bias">;
 }
 
@@ -320,6 +331,14 @@ export const wllamaModels: Readonly<Record<string, WllamaModel>> = {
     hfFilePath: "model.shard-00001-of-00007.gguf",
     fileSizeInMegabytes: 1740,
   },
+  "spark-x2.6-1.7b": {
+    ...createDefaultModelConfig(),
+    label: "Spark X2.6 1.7B",
+    hfRepoId: "Felladrin/gguf-sharded-Q4_K_M-Spark-X2.6-1.7B",
+    hfFilePath: "Spark-X2.6-1.7B-Q4_K_M-00001-of-00004.gguf",
+    fileSizeInMegabytes: 1769,
+    chatTemplateKwargs: { enable_thinking: false },
+  },
   "smollm3-3b": {
     ...createDefaultModelConfig(),
     label: "SmolLM 3 3B",
@@ -348,6 +367,14 @@ export const wllamaModels: Readonly<Record<string, WllamaModel>> = {
     hfFilePath: "model.shard-00001-of-00007.gguf",
     fileSizeInMegabytes: 1930,
   },
+  "granite-4.2-3b": {
+    ...createDefaultModelConfig(),
+    label: "Granite 4.2 3B",
+    hfRepoId: "Felladrin/gguf-sharded-Q4_K_S-granite-4.2-3b",
+    hfFilePath: "granite-4.2-3b-Q4_K_S-00001-of-00005.gguf",
+    fileSizeInMegabytes: 2143,
+    chatTemplateKwargs: { enable_thinking: false },
+  },
   "phi-3.5-mini-3.8b": {
     ...createDefaultModelConfig(),
     label: "Phi 3.5 Mini 3.8B",
@@ -369,6 +396,22 @@ export const wllamaModels: Readonly<Record<string, WllamaModel>> = {
     hfFilePath: "model.shard-00001-of-00008.gguf",
     fileSizeInMegabytes: 2380,
   },
+  "qwen-3.5-4b": {
+    ...createDefaultModelConfig(),
+    label: "Qwen 3.5 4B",
+    hfRepoId: "Felladrin/gguf-sharded-UD-Q3_K_XL-Qwen3.5-4B",
+    hfFilePath: "Qwen3.5-4B-UD-Q3_K_XL-00001-of-00005.gguf",
+    fileSizeInMegabytes: 2436,
+    chatTemplateKwargs: { enable_thinking: false },
+  },
+  "gemma-4-e2b": {
+    ...createDefaultModelConfig(),
+    label: "Gemma 4 E2B",
+    hfRepoId: "Felladrin/gguf-sharded-Q3_K_S-gemma-4-e2b-it",
+    hfFilePath: "gemma-4-e2b-it-Q3_K_S-00001-of-00005.gguf",
+    fileSizeInMegabytes: 2446,
+    chatTemplateKwargs: { enable_thinking: false },
+  },
   "phi-4-mini-reasoning": {
     ...createDefaultModelConfig(),
     label: "Phi 4 Mini Reasoning 3.8B",
@@ -376,4 +419,12 @@ export const wllamaModels: Readonly<Record<string, WllamaModel>> = {
     hfFilePath: "model.shard-00001-of-00005.gguf",
     fileSizeInMegabytes: 2460,
   },
+  "spark-x2.6-4b": {
+    ...createDefaultModelConfig(),
+    label: "Spark X2.6 4B",
+    hfRepoId: "Felladrin/gguf-sharded-Q4_K_M-Spark-X2.6-4B",
+    hfFilePath: "Spark-X2.6-4B-Q4_K_M-00001-of-00007.gguf",
+    fileSizeInMegabytes: 3543,
+    chatTemplateKwargs: { enable_thinking: false },
+  },
 };

docs/ai-integration.md

@@ -4,12 +4,12 @@ MiniSearch supports four AI inference backends, each with different trade-offs b
 
 ## Inference Types Overview
 
-| Type | Privacy | Speed | Setup | Best For |
-|------|---------|-------|-------|----------|
-| **Browser** (Wllama) | Maximum (no data leaves device) | Fast (WebGPU) / Slow (CPU) | None | Personal use, privacy-critical scenarios |
-| **OpenAI** | Low (data sent to OpenAI) | Very Fast | API Key | Maximum quality, convenience |
-| **AI Horde** | Medium (distributed volunteers) | Variable | Anonymous | Free GPU access, no setup |
-| **Internal** | High (your infrastructure) | Depends on hardware | Self-hosted API | Teams, compliance requirements |
+| Type                 | Privacy                         | Speed                      | Setup           | Best For                                 |
+| -------------------- | ------------------------------- | -------------------------- | --------------- | ---------------------------------------- |
+| **Browser** (Wllama) | Maximum (no data leaves device) | Fast (WebGPU) / Slow (CPU) | None            | Personal use, privacy-critical scenarios |
+| **OpenAI**           | Low (data sent to OpenAI)       | Very Fast                  | API Key         | Maximum quality, convenience             |
+| **AI Horde**         | Medium (distributed volunteers) | Variable                   | Anonymous       | Free GPU access, no setup                |
+| **Internal**         | High (your infrastructure)      | Depends on hardware        | Self-hosted API | Teams, compliance requirements           |
 
 ## Browser-Based Inference
 
@@ -32,7 +32,15 @@ Uses `@wllama/wllama` for browser-based inference. Automatically uses WebGPU whe
 5. Streams tokens via the OAI-compatible `createChatCompletion` API
 
 **Pre-configured Models:**
-30+ stored at `Felladrin/gguf-sharded-*` on HuggingFace. MiniSearch currently ships 35 pre-configured models, ranging from SmolLM 2 135M (~100MB) up to Phi 4 Mini Reasoning 3.8B (~2.4GB). The full, authoritative list with HuggingFace repo IDs and sizes lives in `client/modules/wllama.ts` (`wllamaModels`) and is rendered in the Settings dropdown; refer to that file rather than a static table here, since models are added/swapped frequently.
+30+ stored at `Felladrin/gguf-sharded-*` on HuggingFace. MiniSearch currently ships 39 pre-configured models, ranging from SmolLM 2 135M (~100MB) up to Spark X2.6 4B (~3.5GB). The full, authoritative list with HuggingFace repo IDs and sizes lives in `client/modules/wllama.ts` (`wllamaModels`) and is rendered in the Settings dropdown; refer to that file rather than a static table here, since models are added/swapped frequently.
+
+Two constraints decide what can join that list, both measured against the shipped wasm build:
+- **Every model file must be a shard.** Chromium's OPFS storage silently truncates files past 2000 MiB, so a monolithic GGUF above that size arrives corrupted in the browser. Shards also keep progressive download working.
+- **The wasm linear memory ceiling is 4 GiB.** Models at ~3.5 GB and above OOM during buffer reserve, so the practical catalog ceiling is around 3.7 GB of weights.
+
+Models whose chat template thinks by default (Granite 4.2, Gemma 4, Spark X2.6, Qwen 3.5) would spend the whole token budget on the reasoning channel, which MiniSearch does not render. They are configured with `chatTemplateKwargs: { enable_thinking: false }`, passed to wllama as `chat_template_kwargs`.
+
+`node scripts/wllama-catalog-check.cjs` HEADs every shard of every catalog model on HuggingFace and verifies the claimed sizes; run it after adding or re-sharding a model.
 
 **Configuration:**
 - Settings → Inference Type: `Browser`
@@ -232,17 +240,17 @@ Save to history database
 
 `textGenerationStatePubSub` drives the AI response UI through these states:
 
-| State | Description |
-|-------|-------------|
-| `idle` | No response yet, waiting for user input |
+| State                            | Description                                                                                                 |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------- |
+| `idle`                           | No response yet, waiting for user input                                                                     |
 | `awaitingModelDownloadAllowance` | Browser inference only: waiting for user consent to download the model (when `allowAiModelDownload` is off) |
-| `loadingModel` | Downloading/loading the AI model (browser inference only) |
-| `awaitingSearchResults` | Waiting for search results before generating |
-| `preparingToGenerate` | Search results ready, request being sent to the inference backend |
-| `generating` | Streaming response tokens |
-| `interrupted` | User clicked Stop; generation aborts without overwriting the partial response |
-| `completed` | Full response received |
-| `failed` | Error occurred during generation |
+| `loadingModel`                   | Downloading/loading the AI model (browser inference only)                                                   |
+| `awaitingSearchResults`          | Waiting for search results before generating                                                                |
+| `preparingToGenerate`            | Search results ready, request being sent to the inference backend                                           |
+| `generating`                     | Streaming response tokens                                                                                   |
+| `interrupted`                    | User clicked Stop; generation aborts without overwriting the partial response                               |
+| `completed`                      | Full response received                                                                                      |
+| `failed`                         | Error occurred during generation                                                                            |
 
 For non-browser inference types (`openai`, `internal`, `horde`), the state skips `loadingModel` and `awaitingModelDownloadAllowance`, going from `awaitingSearchResults` straight to `preparingToGenerate` then `generating` or `failed`.
 
@@ -283,7 +291,6 @@ For browser inference, the system first loads the model from HuggingFace with a
 ### Rolling Summaries
 
 When conversation exceeds token budget:
-
 1. **Detect Overflow:** Current tokens > 3072
 2. **Generate Summary:** Call LLM with 800-token limit
 3. **Store Summary:** Save in conversationSummaryPubSub
@@ -300,10 +307,10 @@ and user intent. Be concise but informative.
 
 The "Listen to response" button reads the answer aloud. Two engines back it:
 
-| Engine | Setting value | Voice source | Works offline |
-| --- | --- | --- | --- |
+| Engine       | Setting value     | Voice source                                                               | Works offline                                                                                                         |
+| ------------ | ----------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
 | Local neural | `local` (default) | Piper (VITS) models run in the browser through `@diffusionstudio/vits-web` | No: only the voice model is stored in OPFS, so the voice index, the ONNX runtime and the phonemizer are fetched again |
-| System | `system` | `speechSynthesis`, whatever the OS provides | Yes |
+| System       | `system`          | `speechSynthesis`, whatever the OS provides                                | Yes                                                                                                                   |
 
 ### Flow
 
@@ -384,18 +391,22 @@ Wllama models are sharded (split into chunks):
 ## Best Practices
 
 ### For Privacy-Critical Use
+
 - Use Browser inference (Wllama)
 - Set `historyRetentionDays: 0` (no persistence)
 
 ### For Maximum Quality
+
 - Use OpenAI GPT-4 or Internal API with large model
 - Adjust temperature: 0.5-0.7 for factual, 0.8-1.0 for creative
 
 ### For Cost Efficiency
+
 - Use AI Horde (free) or Browser inference - Wllama (one-time download)
 - Limit `inferenceMaxTokens: 2048`
 
 ### For Teams/Enterprise
+
 - Deploy Internal API with vLLM
 - Set `ACCESS_KEYS` for access control
 - Enable server-side logging

docs/api.md

@@ -11,17 +11,17 @@ documented here because the owner of an instance can reach them, and because
 reading middleware should not be the only way to learn what a request has to
 carry.
 
-| Method | Path | Token | Rate limit | Purpose |
-| --- | --- | --- | --- | --- |
-| `GET` | `/search/text` | required | shared | Text results from SearXNG, reranked |
-| `GET` | `/search/images` | required | shared | Image results from SearXNG, reranked |
-| `GET` | `/page-content` | required | shared | Readable text from result pages, for answer grounding |
-| `GET` | `/thumbnail` | required | own budget | One image-result thumbnail, fetched server-side |
-| `POST` | `/inference` | required | shared | Streaming chat completion from the internal API |
-| `GET` | `/status` | none | none | Uptime, counters, and service health |
-| `GET` | `/api/config` | none | none | Runtime client configuration, including the search token |
-| `POST` | `/api/validate-access-key` | none | shared | Access key check |
-| `GET` | `/dictation-models/<version>/<file>` | none | none | Speech-to-text model files, served from the instance |
+| Method | Path                                 | Token    | Rate limit | Purpose                                                  |
+| ------ | ------------------------------------ | -------- | ---------- | -------------------------------------------------------- |
+| `GET`  | `/search/text`                       | required | shared     | Text results from SearXNG, reranked                      |
+| `GET`  | `/search/images`                     | required | shared     | Image results from SearXNG, reranked                     |
+| `GET`  | `/page-content`                      | required | shared     | Readable text from result pages, for answer grounding    |
+| `GET`  | `/thumbnail`                         | required | own budget | One image-result thumbnail, fetched server-side          |
+| `POST` | `/inference`                         | required | shared     | Streaming chat completion from the internal API          |
+| `GET`  | `/status`                            | none     | none       | Uptime, counters, and service health                     |
+| `GET`  | `/api/config`                        | none     | none       | Runtime client configuration, including the search token |
+| `POST` | `/api/validate-access-key`           | none     | shared     | Access key check                                         |
+| `GET`  | `/dictation-models/<version>/<file>` | none     | none       | Speech-to-text model files, served from the instance     |
 
 A path that matches no hook falls through to Vite's static handler, which is
 also what a method mismatch does on `/api/config` and `/api/validate-access-key`:
@@ -66,11 +66,11 @@ unauthenticated caller still costs a rate-limit point. The exception is
 those two rejections need no token and spend no rate-limit point. The failures
 below are the same on every token-gated endpoint:
 
-| Status | Body | When |
-| --- | --- | --- |
-| `429` | `{"error":"Too many requests."}` | The bucket for this client is empty |
-| `400` | `{"error":"Missing token."}` | No `token` parameter |
-| `401` | `{"error":"Invalid token."}` | The hash does not verify against this server's token |
+| Status | Body                             | When                                                 |
+| ------ | -------------------------------- | ---------------------------------------------------- |
+| `429`  | `{"error":"Too many requests."}` | The bucket for this client is empty                  |
+| `400`  | `{"error":"Missing token."}`     | No `token` parameter                                 |
+| `401`  | `{"error":"Invalid token."}`     | The hash does not verify against this server's token |
 
 A 401 that persists across reloads usually means two processes hold different
 tokens: the server logs that once, on the way out.
@@ -101,10 +101,10 @@ front of it.
 `server/verifyTokenAndRateLimit.ts` keeps two in-memory buckets, both keyed by
 client IP:
 
-| Bucket | Budget | Consumed by |
-| --- | --- | --- |
-| shared | 10 requests / 10 s | `/search/text`, `/search/images`, `/page-content`, `/inference`, `/api/validate-access-key` |
-| thumbnail | 60 requests / 10 s | `/thumbnail` |
+| Bucket    | Budget             | Consumed by                                                                                 |
+| --------- | ------------------ | ------------------------------------------------------------------------------------------- |
+| shared    | 10 requests / 10 s | `/search/text`, `/search/images`, `/page-content`, `/inference`, `/api/validate-access-key` |
+| thumbnail | 60 requests / 10 s | `/thumbnail`                                                                                |
 
 `/thumbnail` has its own budget because one image search fans out into up to 30
 tile loads, which would otherwise consume a user's whole search budget. The
@@ -122,18 +122,16 @@ identity.
 
 Query parameters:
 
-| Name | Required | Description |
-| --- | --- | --- |
-| `q` | yes | Search query, trimmed, 1 to 2000 characters |
-| `token` | yes | Search token hash |
-| `limit` | no | How many of SearXNG's results to consider, default and maximum 30; a value that is not a positive integer falls back to the default. SearXNG is not sent this number: it caps a single SearXNG response after duplicate URLs are dropped, and the score filter below can return fewer |
+| Name    | Required | Description                                                                                                                                                                                                                                                                           |
+| ------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `q`     | yes      | Search query, trimmed, 1 to 2000 characters                                                                                                                                                                                                                                           |
+| `token` | yes      | Search token hash                                                                                                                                                                                                                                                                     |
+| `limit` | no       | How many of SearXNG's results to consider, default and maximum 30; a value that is not a positive integer falls back to the default. SearXNG is not sent this number: it caps a single SearXNG response after duplicate URLs are dropped, and the score filter below can return fewer |
 
 Responds with a JSON array of tuples, in the order the client renders them:
 
 ```json
-[
-  ["Result title", "Snippet text", "https://example.com/page", 3.7]
-]
+[["Result title", "Snippet text", "https://example.com/page", 3.7]]
 ```
 
 Between SearXNG and the response the server drops duplicate URLs, keeps the
@@ -167,12 +165,12 @@ optional.
 
 Failures:
 
-| Status | Body | When |
-| --- | --- | --- |
-| `400` | `{"error":"Missing query parameter"}` | `q` missing or blank |
-| `400` | `{"error":"Query parameter must not exceed 2000 characters"}` | `q` too long |
-| `502` | `{"error":"Search service unavailable"}` | SearXNG failed and the text-search fallback was off or failed too, so an outage is distinguishable from a search with no matches |
-| `500` | `{"error":"Internal server error"}` | Anything else |
+| Status | Body                                                          | When                                                                                                                             |
+| ------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
+| `400`  | `{"error":"Missing query parameter"}`                         | `q` missing or blank                                                                                                             |
+| `400`  | `{"error":"Query parameter must not exceed 2000 characters"}` | `q` too long                                                                                                                     |
+| `502`  | `{"error":"Search service unavailable"}`                      | SearXNG failed and the text-search fallback was off or failed too, so an outage is distinguishable from a search with no matches |
+| `500`  | `{"error":"Internal server error"}`                           | Anything else                                                                                                                    |
 
 With `SEARCH_FALLBACK_ENABLED` on (see `docs/configuration.md`), a text search
 whose SearXNG attempt failed is retried against the configured fallback
@@ -236,11 +234,11 @@ is SSRF-guarded, byte-capped and timed out per page
 
 The path is matched exactly, so `/page-content/anything` falls through.
 
-| Name | Required | Description |
-| --- | --- | --- |
-| `q` | yes | Query the passages are ranked against, 1 to 2000 characters |
-| `token` | yes | Search token hash |
-| `url` | yes | Page to read, `http` or `https`, up to 2048 characters. Repeat for more; at most 6 per request, counted before duplicates are removed, so 7 URLs are refused even when two of them are the same |
+| Name    | Required | Description                                                                                                                                                                                     |
+| ------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `q`     | yes      | Query the passages are ranked against, 1 to 2000 characters                                                                                                                                     |
+| `token` | yes      | Search token hash                                                                                                                                                                               |
+| `url`   | yes      | Page to read, `http` or `https`, up to 2048 characters. Repeat for more; at most 6 per request, counted before duplicates are removed, so 7 URLs are refused even when two of them are the same |
 
 Responds with an object keyed by URL:
 
@@ -266,10 +264,10 @@ answered `Invalid URL parameter`, the same as any other unusable URL.
 Fetches one image-result thumbnail server-side, so the browser never requests a
 search-result URL directly.
 
-| Name | Required | Description |
-| --- | --- | --- |
-| `u` | yes | Thumbnail URL, up to 2048 characters |
-| `token` | yes | Search token hash |
+| Name    | Required | Description                          |
+| ------- | -------- | ------------------------------------ |
+| `u`     | yes      | Thumbnail URL, up to 2048 characters |
+| `token` | yes      | Search token hash                    |
 
 A hit responds with the image bytes and the upstream's content type, restricted
 to `image/avif`, `image/bmp`, `image/gif`, `image/jpeg`, `image/png`,
@@ -282,13 +280,13 @@ The fetch is bounded by a 3 s deadline covering DNS and every hop, at most 3
 redirects, each of them re-validated, and 500 KB of body. Successful fetches are
 held in an in-process LRU (100 entries, 50 MB); failures never are.
 
-| Status | Body | When |
-| --- | --- | --- |
-| `400` | `{"error":"Missing thumbnail URL"}` | `u` missing |
-| `400` | `{"error":"Thumbnail URL too long"}` | `u` over 2048 characters |
-| `403` | `{"error":"Refusing to fetch a thumbnail from a non-public or unresolvable address"}` | The host is in private space, does not resolve, or `u` is not a parseable `http`/`https` URL. `/page-content` answers `400` for that last case; this endpoint does not distinguish it |
-| `502` | `{"error":"Thumbnail could not be fetched"}` | Upstream failed, timed out, redirected more than 3 times, answered with a type outside the list, or sent an empty body |
-| `500` | `{"error":"Internal server error"}` | Anything the hook itself threw, caught so Vite's connect stack does not see an unhandled rejection |
+| Status | Body                                                                                  | When                                                                                                                                                                                  |
+| ------ | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `400`  | `{"error":"Missing thumbnail URL"}`                                                   | `u` missing                                                                                                                                                                           |
+| `400`  | `{"error":"Thumbnail URL too long"}`                                                  | `u` over 2048 characters                                                                                                                                                              |
+| `403`  | `{"error":"Refusing to fetch a thumbnail from a non-public or unresolvable address"}` | The host is in private space, does not resolve, or `u` is not a parseable `http`/`https` URL. `/page-content` answers `400` for that last case; this endpoint does not distinguish it |
+| `502`  | `{"error":"Thumbnail could not be fetched"}`                                          | Upstream failed, timed out, redirected more than 3 times, answered with a type outside the list, or sent an empty body                                                                |
+| `500`  | `{"error":"Internal server error"}`                                                   | Anything the hook itself threw, caught so Vite's connect stack does not see an unhandled rejection                                                                                    |
 
 Error responses carry `Cache-Control: no-store`, since neither a refusal nor an
 upstream failure is a stable property of the URL.
@@ -341,17 +339,17 @@ and `Connection: keep-alive`.
 
 Failures before the stream starts:
 
-| Status | Body | When |
-| --- | --- | --- |
-| `405` | `{"error":"Method Not Allowed"}` | Not a `POST`; the response carries `Allow: POST`. Checked before the token, so it needs no token and spends no rate-limit point |
-| `415` | `{"error":"Unsupported Media Type"}` | `Content-Type` is not JSON; also checked before the token |
-| `400` | `{"error":"Invalid request body"}` or `{"error":"Invalid request body: <field> <message>"}` | Unparseable or schema-invalid body |
-| `413` | `{"error":"Request body too large"}` | Body over 1 MiB |
-| `500` | `{"error":"OpenAI API configuration is missing"}` | `INTERNAL_OPENAI_COMPATIBLE_API_BASE_URL` or `_API_KEY` unset |
-| `500` | `{"error":"Failed to fetch available models"}` | No model configured and the provider's listing failed |
-| `500` | `{"error":"No model available"}` | The listing succeeded but was empty |
-| `503` | `{"error":"Service unavailable - all models failed","lastError":"..."}` | Every attempt failed before the first token |
-| `500` | `{"error":"Internal server error","message":"..."}` | Anything else the hook threw |
+| Status | Body                                                                                        | When                                                                                                                            |
+| ------ | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| `405`  | `{"error":"Method Not Allowed"}`                                                            | Not a `POST`; the response carries `Allow: POST`. Checked before the token, so it needs no token and spends no rate-limit point |
+| `415`  | `{"error":"Unsupported Media Type"}`                                                        | `Content-Type` is not JSON; also checked before the token                                                                       |
+| `400`  | `{"error":"Invalid request body"}` or `{"error":"Invalid request body: <field> <message>"}` | Unparseable or schema-invalid body                                                                                              |
+| `413`  | `{"error":"Request body too large"}`                                                        | Body over 1 MiB                                                                                                                 |
+| `500`  | `{"error":"OpenAI API configuration is missing"}`                                           | `INTERNAL_OPENAI_COMPATIBLE_API_BASE_URL` or `_API_KEY` unset                                                                   |
+| `500`  | `{"error":"Failed to fetch available models"}`                                              | No model configured and the provider's listing failed                                                                           |
+| `500`  | `{"error":"No model available"}`                                                            | The listing succeeded but was empty                                                                                             |
+| `503`  | `{"error":"Service unavailable - all models failed","lastError":"..."}`                     | Every attempt failed before the first token                                                                                     |
+| `500`  | `{"error":"Internal server error","message":"..."}`                                         | Anything else the hook threw                                                                                                    |
 
 ### `GET /status`
 
@@ -425,11 +423,11 @@ The body is capped at 4 KiB, which one encoded hash is nowhere near. Past that
 the answer is a `413` sent while the caller is still uploading, so it carries
 `Connection: close` and the socket is dropped once it has flushed.
 
-| Status | Body | When |
-| --- | --- | --- |
-| `429` | `{"error":"Too many requests."}` | Rate limited, kept distinct from a wrong key so the UI can say "try again" |
-| `400` | `{"valid":false,"error":"Invalid request"}` | Body is not JSON |
-| `413` | `{"error":"Request body too large"}` | Body over 4 KiB |
+| Status | Body                                        | When                                                                       |
+| ------ | ------------------------------------------- | -------------------------------------------------------------------------- |
+| `429`  | `{"error":"Too many requests."}`            | Rate limited, kept distinct from a wrong key so the UI can say "try again" |
+| `400`  | `{"valid":false,"error":"Invalid request"}` | Body is not JSON                                                           |
+| `413`  | `{"error":"Request body too large"}`        | Body over 4 KiB                                                            |
 
 ### `GET /dictation-models/<version>/<file>`
 
@@ -449,10 +447,10 @@ named after the version. Concurrent first requests share one transfer. Responses
 are streamed and carry `Cache-Control: public, max-age=31536000, immutable`,
 which the version segment makes safe.
 
-| Status | Body | When |
-| --- | --- | --- |
-| `404` | `Unknown dictation model file` | The filename is not one of the seven |
-| `502` | `Could not serve <file>: <reason>` | The upstream failed, sent no body, exceeded the 64 MiB cap, or the bytes did not match the pinned digest |
+| Status | Body                               | When                                                                                                     |
+| ------ | ---------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| `404`  | `Unknown dictation model file`     | The filename is not one of the seven                                                                     |
+| `502`  | `Could not serve <file>: <reason>` | The upstream failed, sent no body, exceeded the 64 MiB cap, or the bytes did not match the pinned digest |
 
 A failure once the body has started cannot be reported, because the headers are
 already gone; the response is ended rather than having an error appended to a

docs/coding-conventions.md

@@ -3,7 +3,6 @@
 ## Tech Stack
 
 React 19 + TypeScript + Mantine UI v9 (`@mantine/core`, `@mantine/hooks`, `@mantine/form`, `@mantine/notifications`, `@mantine/code-highlight`, `@mantine/carousel`)
-
 - **Build Tool**: Vite 8
 - **Linting/Formatting**: Biome 2
 - **Testing**: Vitest 5 + Testing Library

docs/configuration.md

@@ -6,10 +6,10 @@ All configuration is done via environment variables. Create a `.env` file in the
 
 ### Access Control
 
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `ACCESS_KEYS` | `''` | Comma-separated list of valid access keys (e.g., `'key1,key2,key3'`) |
-| `ACCESS_KEY_TIMEOUT_HOURS` | `24` | Hours to cache validated keys in browser. Set to `0` to require validation on every request |
+| Variable                   | Default | Description                                                                                 |
+| -------------------------- | ------- | ------------------------------------------------------------------------------------------- |
+| `ACCESS_KEYS`              | `''`    | Comma-separated list of valid access keys (e.g., `'key1,key2,key3'`)                        |
+| `ACCESS_KEY_TIMEOUT_HOURS` | `24`    | Hours to cache validated keys in browser. Set to `0` to require validation on every request |
 
 **Example:**
 ```bash
@@ -21,8 +21,8 @@ ACCESS_KEY_TIMEOUT_HOURS="24"
 
 Configure default models for different inference types:
 
-| Variable | Default | Description |
-|----------|---------|-------------|
+| Variable                  | Default           | Description                                                                  |
+| ------------------------- | ----------------- | ---------------------------------------------------------------------------- |
 | `WLLAMA_DEFAULT_MODEL_ID` | `littlelamb-290m` | Default Wllama model ID (used for both WebGPU-accelerated and CPU inference) |
 
 ### Server Model Request Configuration
@@ -32,27 +32,27 @@ optional environment variables. Integer values are parsed as decimal numbers,
 and temperature and top-p values are parsed as floating-point numbers. An empty
 value uses the corresponding default.
 
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `MODEL_MAX_RETRIES` | `5` | Maximum number of retries for a model request |
-| `MODEL_BASE_BACKOFF_MS` | `100` | Initial retry backoff in milliseconds |
-| `MODEL_MAX_BACKOFF_MS` | `5000` | Maximum retry backoff in milliseconds |
-| `MODEL_REQUEST_TIMEOUT_MS` | `30000` | Model request timeout in milliseconds |
-| `MODEL_MAX_CONCURRENT_REQUESTS` | `10` | Maximum number of simultaneous model requests |
-| `MODEL_DEFAULT_MAX_TOKENS` | `2048` | Default maximum number of generated tokens |
-| `MODEL_TEMPERATURE` | `0.7` | Model sampling temperature |
-| `MODEL_TOP_P` | `0.9` | Model nucleus-sampling probability |
+| Variable                        | Default | Description                                   |
+| ------------------------------- | ------- | --------------------------------------------- |
+| `MODEL_MAX_RETRIES`             | `5`     | Maximum number of retries for a model request |
+| `MODEL_BASE_BACKOFF_MS`         | `100`   | Initial retry backoff in milliseconds         |
+| `MODEL_MAX_BACKOFF_MS`          | `5000`  | Maximum retry backoff in milliseconds         |
+| `MODEL_REQUEST_TIMEOUT_MS`      | `30000` | Model request timeout in milliseconds         |
+| `MODEL_MAX_CONCURRENT_REQUESTS` | `10`    | Maximum number of simultaneous model requests |
+| `MODEL_DEFAULT_MAX_TOKENS`      | `2048`  | Default maximum number of generated tokens    |
+| `MODEL_TEMPERATURE`             | `0.7`   | Model sampling temperature                    |
+| `MODEL_TOP_P`                   | `0.9`   | Model nucleus-sampling probability            |
 
 ### Internal API Configuration
 
 For self-hosted OpenAI-compatible APIs:
 
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `INTERNAL_OPENAI_COMPATIBLE_API_BASE_URL` | `''` | Base URL of your API (e.g., `https://api.internal.company.com/v1`) |
-| `INTERNAL_OPENAI_COMPATIBLE_API_KEY` | `''` | API key for authentication |
-| `INTERNAL_OPENAI_COMPATIBLE_API_MODEL` | `''` | Model ID to use (auto-detected if empty) |
-| `INTERNAL_OPENAI_COMPATIBLE_API_NAME` | `Internal API` | Display name shown in UI |
+| Variable                                  | Default        | Description                                                        |
+| ----------------------------------------- | -------------- | ------------------------------------------------------------------ |
+| `INTERNAL_OPENAI_COMPATIBLE_API_BASE_URL` | `''`           | Base URL of your API (e.g., `https://api.internal.company.com/v1`) |
+| `INTERNAL_OPENAI_COMPATIBLE_API_KEY`      | `''`           | API key for authentication                                         |
+| `INTERNAL_OPENAI_COMPATIBLE_API_MODEL`    | `''`           | Model ID to use (auto-detected if empty)                           |
+| `INTERNAL_OPENAI_COMPATIBLE_API_NAME`     | `Internal API` | Display name shown in UI                                           |
 
 **Example:**
 ```bash
@@ -64,46 +64,45 @@ INTERNAL_OPENAI_COMPATIBLE_API_NAME="Company LLM"
 
 ### Default Behavior
 
-| Variable | Default | Description |
-|----------|---------|-------------|
+| Variable                 | Default   | Description                                                          |
+| ------------------------ | --------- | -------------------------------------------------------------------- |
 | `DEFAULT_INFERENCE_TYPE` | `browser` | Default AI inference type (`browser`, `openai`, `horde`, `internal`) |
 
 ### Server Configuration
 
 These variables control the Vite development/preview server behavior:
 
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `HOST` | `0.0.0.0` | Host address for the Vite server to bind to |
-| `PORT` | `7860` | Port number for the main server |
-| `HMR_PORT` | `7861` | Port for Hot Module Replacement during development |
-| `ALLOWED_HOSTS` | `true` | Comma-separated list of allowed hostnames for the preview server |
-| `BASIC_SSL` | `false` | Enable basic SSL for HTTPS support during development |
-| `TRUST_PROXY` | `false` | Trust `X-Forwarded-For`/`X-Real-IP` for the per-client rate-limit key. Enable **only** behind a reverse proxy that sets the rightmost `X-Forwarded-For` entry. Leave off when the instance is exposed directly - otherwise clients could forge the header to evade rate limiting. |
+| Variable        | Default   | Description                                                                                                                                                                                                                                                                       |
+| --------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `HOST`          | `0.0.0.0` | Host address for the Vite server to bind to                                                                                                                                                                                                                                       |
+| `PORT`          | `7860`    | Port number for the main server                                                                                                                                                                                                                                                   |
+| `HMR_PORT`      | `7861`    | Port for Hot Module Replacement during development                                                                                                                                                                                                                                |
+| `ALLOWED_HOSTS` | `true`    | Comma-separated list of allowed hostnames for the preview server                                                                                                                                                                                                                  |
+| `BASIC_SSL`     | `false`   | Enable basic SSL for HTTPS support during development                                                                                                                                                                                                                             |
+| `TRUST_PROXY`   | `false`   | Trust `X-Forwarded-For`/`X-Real-IP` for the per-client rate-limit key. Enable **only** behind a reverse proxy that sets the rightmost `X-Forwarded-For` entry. Leave off when the instance is exposed directly - otherwise clients could forge the header to evade rate limiting. |
 
 These defaults are provided by `docker-compose.yml`/`docker-compose.production.yml` (e.g. `PORT=${PORT:-7860}`), not by the application itself - `vite.config.ts` reads these variables with no fallback, so when running directly via `npm run dev`/`vite preview` without Docker, unset variables fall through to Vite's own built-in defaults.
 
 ### Dictation
 
-| Variable | Default | Description |
-|----------|---------|-------------|
+| Variable               | Default                                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| ---------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `DICTATION_MODELS_DIR` | `<system temp>/minisearch-dictation-models` | Directory where the server caches the speech-to-text model files it serves under `/dictation-models/`. The files are fetched once from the pinned upstream URL on the first request, verified against a pinned SHA-256, and reused after that. They land in a subdirectory named after the model release, so a later release cannot be served from an older cache. The default lives under the system temp directory, so a container re-downloads ~51 MB after a restart unless this points at a volume |
 
 ### Search Fallback
 
 When SearXNG fails on a text search, the server can retry that search against second providers: `search.parallel.ai` (Parallel) and You.com's MCP endpoint (`https://api.you.com/mcp`). Every configured provider takes part. On each search they are put in a random order, and each is tried in turn until one returns results; a provider that answers with nothing usable, or fails, hands the search to the next one. The whole cascade shares one 15-second budget, and each attempt gets the remaining budget divided by the number of providers still untried and not paused, so a provider that hangs cannot use up the time the others need. A single search can therefore reach more than one provider, one after the other. `docker-compose.yml` passes only `HOST`, `PORT`, `BASIC_SSL` and `HMR_PORT` into the development container, so these variables are not carried by the compose `environment` list; set them in `.env`, which `vite.config.ts` loads, inside the container as well as outside it. `vite.config.ts` reads `.env.example` after `.env`, so anything still set there acts as a default: the real API keys belong in `.env`, never in `.env.example`, which is committed.
 
-| Variable | Default | Description |
-|----------|---------|-------------|
-| `SEARCH_FALLBACK_ENABLED` | `false` | Serve text results from the fallback providers when SearXNG has failed (an HTTP error, a network error, every engine unresponsive, or an open circuit), under one 15-second budget for the whole cascade. Only `true` or `1` turns it on, and changing it takes a restart, since a process keeps the environment it was started with. Image searches never use it, and a fallback that returns nothing usable is still an HTTP 200 with no results rather than an outage |
-| `SEARCH_FALLBACK_PROVIDERS` | `''` (all providers) | Comma-separated list of the providers to try: `parallel`, `youcom`, or both. Names are trimmed and lowercased, and empty items are ignored. Unset or empty means every built-in provider. With `SEARCH_FALLBACK_ENABLED` on, an unknown name, or a list with no names at all (such as `,`), stops the server at start with an error that names the valid values |
-| `SEARCH_FALLBACK_PARALLEL_API_KEY` | `''` | Optional API key for Parallel, sent as a Bearer token. Without it the fallback calls Parallel's keyless tier. With `SEARCH_FALLBACK_ENABLED` on, a key with a control character inside it (such as a pasted line break) stops the server at start, since the HTTP client would quote it in its error |
-| `SEARCH_FALLBACK_YOUCOM_API_KEY` | `''` | Optional API key for You.com, sent as a Bearer token. Without it the fallback calls the keyless `https://api.you.com/mcp?profile=free` endpoint. A key with a control character inside it stops the server at start, like the Parallel key |
+| Variable                           | Default              | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| ---------------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `SEARCH_FALLBACK_ENABLED`          | `false`              | Serve text results from the fallback providers when SearXNG has failed (an HTTP error, a network error, every engine unresponsive, or an open circuit), under one 15-second budget for the whole cascade. Only `true` or `1` turns it on, and changing it takes a restart, since a process keeps the environment it was started with. Image searches never use it, and a fallback that returns nothing usable is still an HTTP 200 with no results rather than an outage |
+| `SEARCH_FALLBACK_PROVIDERS`        | `''` (all providers) | Comma-separated list of the providers to try: `parallel`, `youcom`, or both. Names are trimmed and lowercased, and empty items are ignored. Unset or empty means every built-in provider. With `SEARCH_FALLBACK_ENABLED` on, an unknown name, or a list with no names at all (such as `,`), stops the server at start with an error that names the valid values                                                                                                          |
+| `SEARCH_FALLBACK_PARALLEL_API_KEY` | `''`                 | Optional API key for Parallel, sent as a Bearer token. Without it the fallback calls Parallel's keyless tier. With `SEARCH_FALLBACK_ENABLED` on, a key with a control character inside it (such as a pasted line break) stops the server at start, since the HTTP client would quote it in its error                                                                                                                                                                     |
+| `SEARCH_FALLBACK_YOUCOM_API_KEY`   | `''`                 | Optional API key for You.com, sent as a Bearer token. Without it the fallback calls the keyless `https://api.you.com/mcp?profile=free` endpoint. A key with a control character inside it stops the server at start, like the Parallel key                                                                                                                                                                                                                               |
 
 `SEARCH_FALLBACK_PROVIDER` and `SEARCH_FALLBACK_API_KEY` are gone. If either is still set to a non-empty value while `SEARCH_FALLBACK_ENABLED` is on, the server stops at start with an error that names the variable to use instead, so an upgrade cannot silently drop a key: move the key to `SEARCH_FALLBACK_PARALLEL_API_KEY` or `SEARCH_FALLBACK_YOUCOM_API_KEY`, and the provider choice to `SEARCH_FALLBACK_PROVIDERS`.
 
 Each provider has its own terms, and each operator is responsible for following them:
-
 - **Parallel**: Parallel describes its keyless tier as for exploration and light use, and asks for an account and an API key for production use ([docs.parallel.ai](https://docs.parallel.ai/integrations/mcp/search-mcp)).
 - **You.com**: the keyless `profile=free` endpoint allows 100 queries per day ([you.com](https://you.com/docs/build-with-agents/mcp-server)). Its API acceptable use policy asks integrations to honor 429 responses ([you.com](https://you.com/acceptable-use-policy-may-2026)).
 
@@ -115,41 +114,41 @@ Settings are stored in browser localStorage and can be changed via the Settings
 
 ### Core Settings
 
-| Setting | Type | Default | Description |
-|---------|------|---------|-------------|
-| `enableAiResponse` | boolean | `false` | Enable AI-generated responses for searches |
-| `showEnableAiResponsePrompt` | boolean | `true` | Show prompt to enable AI response on first use |
-| `enableImageSearch` | boolean | `true` | Include image results in searches |
-| `enableTextSearch` | boolean | `true` | Include text results in searches |
-| `searchResultsLimit` | number | `15` | Maximum search results to fetch |
-| `systemPrompt` | string | (template) | Custom system prompt template for AI |
-| `enterToSubmit` | boolean | `true` | Press Enter to submit query (vs Shift+Enter for new line) |
-| `enableAiResponseScrolling` | boolean | `true` | Auto-scroll AI response as it generates |
-| `enableNotificationOnAiComplete` | boolean | `false` | Show a browser notification when AI response generation finishes |
-| `enablePageContentFetch` | boolean | `true` | Read the pages behind the top results and ground the answer on their text instead of on snippets alone. |
+| Setting                          | Type    | Default    | Description                                                                                             |
+| -------------------------------- | ------- | ---------- | ------------------------------------------------------------------------------------------------------- |
+| `enableAiResponse`               | boolean | `false`    | Enable AI-generated responses for searches                                                              |
+| `showEnableAiResponsePrompt`     | boolean | `true`     | Show prompt to enable AI response on first use                                                          |
+| `enableImageSearch`              | boolean | `true`     | Include image results in searches                                                                       |
+| `enableTextSearch`               | boolean | `true`     | Include text results in searches                                                                        |
+| `searchResultsLimit`             | number  | `15`       | Maximum search results to fetch                                                                         |
+| `systemPrompt`                   | string  | (template) | Custom system prompt template for AI                                                                    |
+| `enterToSubmit`                  | boolean | `true`     | Press Enter to submit query (vs Shift+Enter for new line)                                               |
+| `enableAiResponseScrolling`      | boolean | `true`     | Auto-scroll AI response as it generates                                                                 |
+| `enableNotificationOnAiComplete` | boolean | `false`    | Show a browser notification when AI response generation finishes                                        |
+| `enablePageContentFetch`         | boolean | `true`     | Read the pages behind the top results and ground the answer on their text instead of on snippets alone. |
 
 ### Inference Settings
 
-| Setting | Type | Default | Description |
-|---------|------|---------|-------------|
-| `inferenceType` | enum | `'browser'` | AI provider: `browser`, `openai`, `horde`, `internal` |
-| `cpuThreads` | number | (auto) | Number of CPU threads for inference (Wllama), defaults to half the logical processors (`navigator.hardwareConcurrency / 2`), minimum 1 |
-| `allowAiModelDownload` | boolean | `false` | Allow automatic AI model downloads |
-| `wllamaModelId` | string | `WLLAMA_DEFAULT_MODEL_ID` env var | Default Wllama model ID |
-| `hordeApiKey` | string | `'0000000000'` | AI Horde API key (default is anonymous) |
-| `hordeModel` | string | `''` | Specific AI Horde model to request |
-| `openAiApiBaseUrl` | string | `''` | Base URL for the OpenAI-compatible API |
-| `openAiApiKey` | string | `''` | API key for the OpenAI-compatible API |
-| `openAiApiModel` | string | `''` | Model identifier for the OpenAI-compatible API |
-| `openAiContextLength` | number | `4096` | Context window size for OpenAI-compatible models, sent as `max_tokens` |
+| Setting                | Type    | Default                           | Description                                                                                                                            |
+| ---------------------- | ------- | --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `inferenceType`        | enum    | `'browser'`                       | AI provider: `browser`, `openai`, `horde`, `internal`                                                                                  |
+| `cpuThreads`           | number  | (auto)                            | Number of CPU threads for inference (Wllama), defaults to half the logical processors (`navigator.hardwareConcurrency / 2`), minimum 1 |
+| `allowAiModelDownload` | boolean | `false`                           | Allow automatic AI model downloads                                                                                                     |
+| `wllamaModelId`        | string  | `WLLAMA_DEFAULT_MODEL_ID` env var | Default Wllama model ID                                                                                                                |
+| `hordeApiKey`          | string  | `'0000000000'`                    | AI Horde API key (default is anonymous)                                                                                                |
+| `hordeModel`           | string  | `''`                              | Specific AI Horde model to request                                                                                                     |
+| `openAiApiBaseUrl`     | string  | `''`                              | Base URL for the OpenAI-compatible API                                                                                                 |
+| `openAiApiKey`         | string  | `''`                              | API key for the OpenAI-compatible API                                                                                                  |
+| `openAiApiModel`       | string  | `''`                              | Model identifier for the OpenAI-compatible API                                                                                         |
+| `openAiContextLength`  | number  | `4096`                            | Context window size for OpenAI-compatible models, sent as `max_tokens`                                                                 |
 
 ### Model Selection
 
 **Wllama Models:**
-- 30+ pre-configured models
+- 39 pre-configured models
 - Range from 135M to 4B parameters
-- All quantized to Q4_K_S or UD-Q4_K_XL
-- Stored at: `Felladrin/gguf-sharded-*` on HuggingFace
+- All quantized to a Q3/Q4-class quant (Q4_K_S, Q4_K_M, Q3_K_S, UD-Q3_K_XL or UD-Q4_K_XL)
+- Stored at: `Felladrin/gguf-sharded-*` on HuggingFace, always as sharded GGUFs
 
 **OpenAI/Internal:**
 - Any OpenAI-compatible API
@@ -163,13 +162,13 @@ Settings are stored in browser localStorage and can be changed via the Settings
 
 ### History Settings
 
-| Setting | Type | Default | Description |
-|---------|------|---------|-------------|
-| `enableHistory` | boolean | `true` | Enable search history persistence |
-| `historyRetentionDays` | number | `30` | Days to keep search history |
-| `historyMaxEntries` | number | `1000` | Maximum history entries before cleanup |
-| `historyAutoCleanup` | boolean | `true` | Automatically clean old history entries |
-| `historyGroupByDate` | boolean | `true` | Group history entries by date in UI |
+| Setting                | Type    | Default | Description                             |
+| ---------------------- | ------- | ------- | --------------------------------------- |
+| `enableHistory`        | boolean | `true`  | Enable search history persistence       |
+| `historyRetentionDays` | number  | `30`    | Days to keep search history             |
+| `historyMaxEntries`    | number  | `1000`  | Maximum history entries before cleanup  |
+| `historyAutoCleanup`   | boolean | `true`  | Automatically clean old history entries |
+| `historyGroupByDate`   | boolean | `true`  | Group history entries by date in UI     |
 
 ### System Prompt Configuration
 
@@ -204,14 +203,14 @@ Search results:
 
 ### Privacy Settings
 
-| Setting | Type | Default | Description |
-|---------|------|---------|-------------|
-| `selectedVoiceId` | string | `""` | Voice for reading answers aloud. `piper:<voice>` picks a local neural voice, `system:<voiceURI>` an OS voice, and `""` picks one automatically for the browser language. The Voice settings panel lists only the voices of the selected engine, and switching that engine resets this to `""`. A bare value stored by an earlier version is read as an OS voice whenever the system engine runs; with the local engine it is ignored in favor of a language match |
-| `textToSpeechEngine` | `"local" \| "system"` | `"local"` | Which engine reads answers aloud, and which set of voices the Voice settings panel lists. `"system"` also overrides a local voice picked above, and stops the voice list from being fetched, so it never contacts a third-party host. A profile that had picked an OS voice before this setting existed starts on `"system"`, so the upgrade does not replace that choice with a model download |
-| `enableDictation` | boolean | `true` | Shows the microphone button inside the search field and the chat follow-up field, which fills whichever one it sits in while the user speaks. Turning this off hides the button and loads nothing. The button is also hidden outside a secure context, so an instance served over plain HTTP on a LAN will not show it: no browser grants microphone access there |
-| `enableLocalDictationModel` | boolean | `true` only when the browser's primary language is English | Whether the dictation button prefers the on-device Moonshine model, which understands English only. With it off, the button uses the browser's built-in `SpeechRecognition`, which handles other languages but may send the audio to the browser vendor. The preference reorders the two engines and never removes one: on browsers without `SpeechRecognition` the on-device model is used regardless. The default is derived from `navigator.language` at first load, so a non-English browser starts on the built-in recognizer with no model download; the Voice settings panel can flip it either way |
-| `reasoningStartMarker` | string | `"<think>"` | Marker for start of reasoning content |
-| `reasoningEndMarker` | string | `"</think>"` | Marker for end of reasoning content |
+| Setting                     | Type                  | Default                                                    | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| --------------------------- | --------------------- | ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `selectedVoiceId`           | string                | `""`                                                       | Voice for reading answers aloud. `piper:<voice>` picks a local neural voice, `system:<voiceURI>` an OS voice, and `""` picks one automatically for the browser language. The Voice settings panel lists only the voices of the selected engine, and switching that engine resets this to `""`. A bare value stored by an earlier version is read as an OS voice whenever the system engine runs; with the local engine it is ignored in favor of a language match                                                                                                                                          |
+| `textToSpeechEngine`        | `"local" \| "system"` | `"local"`                                                  | Which engine reads answers aloud, and which set of voices the Voice settings panel lists. `"system"` also overrides a local voice picked above, and stops the voice list from being fetched, so it never contacts a third-party host. A profile that had picked an OS voice before this setting existed starts on `"system"`, so the upgrade does not replace that choice with a model download                                                                                                                                                                                                            |
+| `enableDictation`           | boolean               | `true`                                                     | Shows the microphone button inside the search field and the chat follow-up field, which fills whichever one it sits in while the user speaks. Turning this off hides the button and loads nothing. The button is also hidden outside a secure context, so an instance served over plain HTTP on a LAN will not show it: no browser grants microphone access there                                                                                                                                                                                                                                          |
+| `enableLocalDictationModel` | boolean               | `true` only when the browser's primary language is English | Whether the dictation button prefers the on-device Moonshine model, which understands English only. With it off, the button uses the browser's built-in `SpeechRecognition`, which handles other languages but may send the audio to the browser vendor. The preference reorders the two engines and never removes one: on browsers without `SpeechRecognition` the on-device model is used regardless. The default is derived from `navigator.language` at first load, so a non-English browser starts on the built-in recognizer with no model download; the Voice settings panel can flip it either way |
+| `reasoningStartMarker`      | string                | `"<think>"`                                                | Marker for start of reasoning content                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `reasoningEndMarker`        | string                | `"</think>"`                                               | Marker for end of reasoning content                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 
 ## Docker Configuration
 
@@ -232,7 +231,7 @@ services:
       dockerfile: Dockerfile
       context: .
     volumes:
-      - .:/home/node/app/  # Live code mounting
+      - .:/home/node/app/ # Live code mounting
     command:
       [
         "(cd /usr/local/searxng/searxng-src && /usr/local/searxng/searxng-venv/bin/python -m searx.webapp > /tmp/searxng.log 2>&1) & (npm install && npm run dev)",
@@ -246,8 +245,8 @@ Same structure but without volume mounts and with pre-built assets.
 ### Dockerfile Environment
 
 The Dockerfile sets up a single runtime stage:
-   - Node.js LTS
-   - Python 3 + SearXNG
+- Node.js LTS
+- Python 3 + SearXNG
 
 The app runs under the `node` user, with the app directory at `/home/node/app`. The production image starts the app with `npm start -- --host` (i.e. `vite preview`), not `npm run dev`.
 
@@ -343,7 +342,6 @@ services:
 ```
 
 Two things about that command are required, not optional:
-
 - **The file must be readable by uid 1000.** The container runs as `node`, and a file readable only by its owner on the host is invisible to it.
 - **`secret_key` must be set to your own random value.** SearXNG refuses to start on the `ultrasecretkey` placeholder and logs `server.secret_key is not changed. Please use something else instead of ultrasecretkey.` The image's own file never carries the placeholder, because the Dockerfile replaces it at build time, but a file you write has to carry a real key.
 
@@ -391,16 +389,16 @@ Client-facing configuration (access keys, inference type, internal API settings)
 
 ### Build-Time vs Runtime Configuration
 
-| Value | Resolved At | Notes |
-|-------|-------------|-------|
-| `VITE_BUILD_DATE_TIME` | Build time | Epoch milliseconds when the build occurred |
-| `VITE_COMMIT_SHORT_HASH` | Build time | Git commit hash at build time (if available) |
-| `ACCESS_KEYS` | Runtime | Read from `/api/config` |
-| `ACCESS_KEY_TIMEOUT_HOURS` | Runtime | Read from `/api/config` |
-| `WLLAMA_DEFAULT_MODEL_ID` | Runtime | Read from `/api/config` |
-| `INTERNAL_OPENAI_COMPATIBLE_API_*` | Runtime | Read from `/api/config` (except `API_KEY` which is server-only) |
-| `DEFAULT_INFERENCE_TYPE` | Runtime | Read from `/api/config` |
-| Search token | Runtime | Read from `/api/config`, so a reload picks up the token of whichever server answers |
+| Value                              | Resolved At | Notes                                                                               |
+| ---------------------------------- | ----------- | ----------------------------------------------------------------------------------- |
+| `VITE_BUILD_DATE_TIME`             | Build time  | Epoch milliseconds when the build occurred                                          |
+| `VITE_COMMIT_SHORT_HASH`           | Build time  | Git commit hash at build time (if available)                                        |
+| `ACCESS_KEYS`                      | Runtime     | Read from `/api/config`                                                             |
+| `ACCESS_KEY_TIMEOUT_HOURS`         | Runtime     | Read from `/api/config`                                                             |
+| `WLLAMA_DEFAULT_MODEL_ID`          | Runtime     | Read from `/api/config`                                                             |
+| `INTERNAL_OPENAI_COMPATIBLE_API_*` | Runtime     | Read from `/api/config` (except `API_KEY` which is server-only)                     |
+| `DEFAULT_INFERENCE_TYPE`           | Runtime     | Read from `/api/config`                                                             |
+| Search token                       | Runtime     | Read from `/api/config`, so a reload picks up the token of whichever server answers |
 
 ### Security Considerations
 
@@ -447,8 +445,8 @@ MiniSearch logs internal events to an in-app log panel (see the Logs section of
 Check effective configuration:
 ```typescript
 // In browser console
-console.log('Settings:', JSON.parse(localStorage.getItem('settings') || '{}'));
-console.log('Server config:', await fetch('/api/config').then(r => r.json()));
+console.log("Settings:", JSON.parse(localStorage.getItem("settings") || "{}"));
+console.log("Server config:", await fetch("/api/config").then((r) => r.json()));
 ```
 
 ## Related Topics

docs/conversation-memory.md

@@ -1,15 +1,18 @@
 # Conversation Memory System
 
 ## Purpose
+
 Long-running chats can easily exceed the model context window. MiniSearch addresses this by keeping a rolling, extractive summary of prior turns and only feeding the freshest messages into the model alongside that summary. All context handling happens locally in the browser to preserve privacy.
 
 ## Components
+
 1. **Token Budgeting** – `generateChatResponse` measures the system prompt and a stub "Ok!" assistant reply, then caps the rest of the user/assistant turns at 75% of the default 4096-token window (≈3072 tokens) to leave headroom for the response. A GPT tokenizer keeps count per message before inclusion.
 2. **Rolling Summary Storage** – The latest summary plus a conversation identifier live in a lightweight pub/sub store (`client/modules/pubSub.ts`) so any component can read/write without prop drilling.
 3. **Summarization Engine** – When older turns must be dropped, `createLlmSummary` asks the configured inference backend (OpenAI, AI Horde, internal API, or Wllama) to condense the removed messages under an 800-token limit. If the LLM call fails, the system falls back to an extractive tokenizer-based summarizer to guarantee progress.
 4. **Persistence Hooks** – After a search run completes, `saveLlmResponseForQuery` stores the assistant reply in IndexedDB so history restores can reload it. The conversation summary itself stays in-memory and resets whenever a new search run begins.
 
 ## Flow
+
 1. User sends a chat message.
 2. System prompt is regenerated by `getSystemPrompt` and augmented with any stored summary (`Conversation context: ...`).
 3. Recent turns are appended until the budget is exhausted; older ones become "dropped messages".
@@ -17,15 +20,18 @@ Long-running chats can easily exceed the model context window. MiniSearch addres
 5. The final prompt sent to the model always starts with the refreshed system prompt, followed by the stub assistant reply and the kept turn list to encourage immediate streaming.
 
 ## Settings & Extensibility
+
 - All inference types share the same summarization contract—no provider-specific logic beyond selecting the backend module at runtime.
 - The 75%-of-4096 conversation-memory budget in `generateChatResponse` is hardcoded against `defaultContextSize` (4096) and does not currently scale with the user-configurable `openAiContextLength` setting; that setting only caps the `max_tokens` of the outgoing API request, a separate concern from how many prior chat turns are kept in memory.
 - Future settings (e.g., toggling memory or adjusting the 75% ratio) should hook into the same budgeting helpers to keep behavior predictable.
 
 ## Failure Modes & Logging
+
 - Every summarization attempt is wrapped in try/catch; failures emit `addLogEntry` notifications and fall back to extractive summaries so the chat loop never stalls.
 - If generation is interrupted (user stop), a custom `ChatGenerationError` ensures the loop exits gracefully without corrupting the stored summary.
 
 ## Reset Rules
+
 - Starting a new top-level search clears the summary, chat history, and cached results to avoid context leakage across unrelated conversations.
 - Restoring a run from history repopulates chat state from IndexedDB; the memory system will rebuild summaries on demand once the user resumes chatting.
 

docs/design.md

@@ -11,6 +11,7 @@
 ## Design Principles
 
 ### User Interface
+
 - Minimal visual clutter with Mantine v9 components
 - Clear hierarchy and information architecture
 - Keyboard-first navigation with comprehensive shortcuts
@@ -19,6 +20,7 @@
 - Dark mode by default (via Mantine's `MantineProvider`)
 
 ### Performance
+
 - Lazy loading for routes and components with React.lazy()
 - Optimized bundle size using Vite 8 build optimizations
 - Efficient state management with create-pubsub
@@ -27,6 +29,7 @@
 - Bundle analysis with rollup-plugin-visualizer
 
 ### Accessibility
+
 - WCAG-aligned where implemented
 - Screen reader support
 - Keyboard navigation
@@ -47,12 +50,14 @@
 ## Technology Integration
 
 ### AI & Search
+
 - Multiple inference engines: Wllama (WebGPU or CPU), OpenAI-compatible APIs
 - Privacy-first local processing when possible
 - SearXNG integration for web search
 - Graceful fallbacks for unsupported browsers
 
 ### Development Experience
+
 - Hot Module Replacement with Vite
 - Biome for consistent formatting and linting
 - Comprehensive testing with Vitest and Testing Library

docs/development-commands.md

@@ -26,7 +26,6 @@ Failure-injection cases (dependency down, empty results, aborted stream) are cat
 `eval/` is an offline eval that gives a regression signal for changes to the
 reranker, the system prompt, the search-results formatting, or the model. See
 `eval/README.md` for details and the LLM-judge environment variables.
-
 - **`npm run eval`**: Run the full eval (retrieval + answer)
 - **`npm run eval:retrieval`**: Retrieval eval (real ONNX reranker; local only, needs the model in `server/models/`)
 - **`npm run eval:answer`**: Answer eval (LLM judge; gated on `EVAL_LLM_API_KEY`, skips without one)
@@ -34,8 +33,8 @@ reranker, the system prompt, the search-results formatting, or the model. See
 ### Coverage Reports for AI Analysis
 
 After running `test:coverage`, AI agents can analyze these JSON files:
-
 - **`coverage/coverage-summary.json`**: Quick metrics view - overall percentages per file
+
   ```json
   {
     "total": {
@@ -64,22 +63,21 @@ The repository uses nine GitHub Actions workflows for continuous integration, de
 
 ### Workflow Files
 
-| Workflow | Trigger | Purpose |
-|---|---|---|
-| `ci.yml` | Push/PR to `main` or `master` | Full lint (`npm run lint`), format check (`npm run format`), and Vitest test suite |
-| `security.yml` | Push/PR to `main` or `master` | Secret scanning (Gitleaks) and license compliance check (`npm run license-check`) with artifact upload |
-| `on-push-to-main.yml` | Push to `main` | Delegates to `reusable-check-docker.yml` |
-| `on-pull-request-to-main.yml` | PR opened/synced/reopened to `main` | Delegates to `reusable-check-docker.yml`; skippable via `skip-check-docker` label |
-| `publish-docker-image.yml` | Manual (`workflow_dispatch`), `main` only | Cuts a CalVer release: validates the optional `version` input (empty auto-computes today's date in UTC plus the next free same-day sequence), builds the multi-platform Docker image (linux/amd64, linux/arm64) and pushes it to `ghcr.io` as that version plus `latest` (build job, `contents: read` + `packages: write`), then a second job holding `contents: write` pushes the git tag and publishes the GitHub Release. The release job is idempotent: when a run pushed the tag but failed before publishing the Release, re-running that job alone finishes it without rebuilding |
-| `scan-docker-image.yml` | Weekly (Monday 06:00 UTC) or manual | Trivy scan of the published image, reporting fixable HIGH/CRITICAL findings to code scanning |
-| `deploy-to-hugging-face.yml` | Manual (`workflow_dispatch`) | Syncs the repository to a Hugging Face Space with the `hf` CLI over OIDC Trusted Publishers |
-| `stale.yml` | Daily (01:30 UTC) or manual | Marks and closes inactive issues and labels stale pull requests |
-| `reusable-check-docker.yml` | Called by other workflows | Docker compose production build + health check via `curl localhost:7860` (lint/format/test are covered by `ci.yml`) |
+| Workflow                      | Trigger                                   | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| ----------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `ci.yml`                      | Push/PR to `main` or `master`             | Full lint (`npm run lint`), format check (`npm run format`), and Vitest test suite                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `security.yml`                | Push/PR to `main` or `master`             | Secret scanning (Gitleaks) and license compliance check (`npm run license-check`) with artifact upload                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `on-push-to-main.yml`         | Push to `main`                            | Delegates to `reusable-check-docker.yml`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `on-pull-request-to-main.yml` | PR opened/synced/reopened to `main`       | Delegates to `reusable-check-docker.yml`; skippable via `skip-check-docker` label                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `publish-docker-image.yml`    | Manual (`workflow_dispatch`), `main` only | Cuts a CalVer release: validates the optional `version` input (empty auto-computes today's date in UTC plus the next free same-day sequence), builds the multi-platform Docker image (linux/amd64, linux/arm64) and pushes it to `ghcr.io` as that version plus `latest` (build job, `contents: read` + `packages: write`), then a second job holding `contents: write` pushes the git tag and publishes the GitHub Release. The release job is idempotent: when a run pushed the tag but failed before publishing the Release, re-running that job alone finishes it without rebuilding |
+| `scan-docker-image.yml`       | Weekly (Monday 06:00 UTC) or manual       | Trivy scan of the published image, reporting fixable HIGH/CRITICAL findings to code scanning                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `deploy-to-hugging-face.yml`  | Manual (`workflow_dispatch`)              | Syncs the repository to a Hugging Face Space with the `hf` CLI over OIDC Trusted Publishers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `stale.yml`                   | Daily (01:30 UTC) or manual               | Marks and closes inactive issues and labels stale pull requests                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `reusable-check-docker.yml`   | Called by other workflows                 | Docker compose production build + health check via `curl localhost:7860` (lint/format/test are covered by `ci.yml`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 
 ### Reusable Workflow (`reusable-check-docker.yml`)
 
 Used by both `on-push-to-main` and `on-pull-request-to-main` to run the production container smoke test:
-
 1. **check-docker-container** - Builds and starts the production container with `docker compose -f docker-compose.production.yml up -d`, then verifies the main page returns HTTP 200 within 60 seconds
 
 ### Docker Image Builds

docs/failure-injection.md

@@ -8,94 +8,94 @@ needed.
 
 ## Degradation Matrix
 
-| Failure injected | Expected degradation | Where it is pinned |
-| --- | --- | --- |
-| SearXNG answers 500 once, then recovers | Retried with exponential backoff, results returned | `server/webSearchService.test.ts` › retry logic |
-| SearXNG answers 500 on every attempt | Retry cycle exhausts (4 requests) and costs a single circuit-breaker failure | `server/webSearchService.test.ts` › graceful degradation |
-| SearXNG answers 200 with no results and a transiently unresponsive engine (e.g. a timeout) once, then recovers | Retried with the same backoff, results returned, not counted as a failure | `server/webSearchService.test.ts` › retry logic |
-| SearXNG answers 200 with no results and a non-suspending engine error (e.g. server API error) on every attempt | Retry cycle exhausts (4 requests), counts one failure, and `fetchSearXNG` throws with the engine reasons rather than an empty set, so the case takes the provider-down path below | `server/webSearchService.test.ts` › retry logic, graceful degradation |
-| SearXNG answers 200 with no results and every unresponsive engine under a long suspension (CAPTCHA, rate limit) | Fails fast on the first attempt (1 request, no backoff), counts one failure, and throws the same error: a suspension outlasts the whole backoff by hours to a day | `server/webSearchService.test.ts` › retry logic |
-| SearXNG fails five cycles in a row | Circuit opens; further searches short-circuit without calling the upstream | `server/webSearchService.test.ts` › graceful degradation |
-| SearXNG recovers after the reset timeout | One healthy response closes the circuit again | `server/webSearchService.test.ts` › graceful degradation |
-| SearXNG's circuit is open while `/healthz` still answers OK | `webSearchServiceStatus` reports `unhealthy`: every search is failing, so the liveness probe alone must not report health | `server/webSearchService.test.ts` › getWebSearchServiceStatus |
-| A search is lost to unresponsive engines, then SearXNG answers the next one of that type | `webSearchServiceStatus` reports `degraded`, then `healthy` again; the per-engine failure counts stay | `server/webSearchService.test.ts` › getWebSearchServiceStatus |
-| A text search is lost to unresponsive engines and the image search the client fires next answers | Still `degraded`, and `searches.degradedSearchTypes` names the pool: the two go out to different engine pools, so answering one says nothing about the other | `server/webSearchService.test.ts` › getWebSearchServiceStatus |
-| The circuit reaches its reset timeout with no search since | `degraded`, not `healthy`: half-open is a timer, not a proven recovery | `server/webSearchService.test.ts` › getWebSearchServiceStatus |
-| SearXNG answers 200 with a non-JSON body | `fetchSearXNG` throws and the endpoint answers HTTP 502 | `server/webSearchService.test.ts` › graceful degradation |
-| SearXNG returns results that are all unusable | Empty result set, no throw | `server/webSearchService.test.ts` › graceful degradation |
-| Provider down vs. genuinely zero results | Provider down: `fetchSearXNG` throws, the endpoint answers HTTP 502, and the client search state becomes `failed`; genuinely zero results: HTTP 200 with `[]`, state stays `completed` and the no-results alert renders | `server/webSearchService.test.ts` and `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| SearXNG is down | `/search/text` and `/search/images` answer HTTP 502 with a JSON error | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| Reranker is not ready | Results served in SearXNG order, HTTP 200 | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| Reranking throws mid-request | Results served in SearXNG order, HTTP 200 | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| Reranker is not ready on an image search | Images still served, with the thumbnail URLs as SearXNG sent them | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| Reranking throws on an image search | Images still served, with the thumbnail URLs as SearXNG sent them | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| Reranker returns a URL absent from the result set | That image is dropped | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| SearXNG is down and the text-search fallback answers | The fallback's results are ranked and served as HTTP 200 on the normal text path, `searchesServedByFallback` is incremented, and no search duration is recorded | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| SearXNG is down and the fallback answers with nothing usable | HTTP 200 with `[]`, so the client shows the no-results alert instead of the unavailable one, and `searchesServedByFallback` is still incremented | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| SearXNG is down and the fallback fails too | HTTP 502 with a JSON error, `searchesFailedOnFallback` is incremented, and the log line carries the fallback's status code but never the query | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| SearXNG fails with too little of the search deadline left | The fallback is never consulted, `searchesFailedOnFallback` is incremented, and `/search/text` answers HTTP 502 rather than a result the client would never receive | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| SearXNG is down while the fallback is switched off | HTTP 502; the fallback is never consulted and neither fallback counter moves | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| SearXNG is down on an image search while the fallback is on | HTTP 502; the fallback is text-only, so it is never consulted and neither fallback counter moves | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| SearXNG answers while the fallback is on | HTTP 200 from SearXNG's results; the fallback is never consulted and neither fallback counter moves | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
-| The first fallback provider fails and the next one answers | The cascade moves on to the next provider within what is left of the shared budget, and that provider's results are served; the failure is logged with the provider name and a status code, never the query | `server/fallbackSearchService.test.ts` › the cascade |
-| A fallback provider answers HTTP 429 | That provider is paused until its `Retry-After` (60 s when missing or invalid, at most an hour), the next provider serves the search, and later searches skip the paused one without a request until the pause ends | `server/fallbackSearchService.test.ts` › pausing a rate-limited provider |
-| Every fallback provider is paused | No provider is called, the cascade throws, and `/search/text` answers HTTP 502 as for a fallback that failed | `server/fallbackSearchService.test.ts` › pausing a rate-limited provider |
-| Thumbnail host never answers | Request aborted after the timeout, `/thumbnail` answers HTTP 502 and the tile shows the host name | `server/thumbnailEndpointServerHook.test.ts` |
-| DNS lookup for a thumbnail never settles | Bounded by the same deadline as the fetch, `/thumbnail` answers HTTP 502 | `server/thumbnailEndpointServerHook.test.ts` |
-| Thumbnail URL resolves into a private range | Refused before any request, `/thumbnail` answers HTTP 403 | `server/thumbnailEndpointServerHook.test.ts` |
-| Thumbnail redirects into a private range | Redirect not followed, HTTP 403 | `server/thumbnailEndpointServerHook.test.ts` |
-| Thumbnail redirect carries a malformed Location | Not followed, HTTP 502, no unhandled rejection | `server/thumbnailEndpointServerHook.test.ts` |
-| Thumbnail upstream answers with a non-raster or an empty body (SVG included) | `/thumbnail` answers HTTP 502, the tile shows the host name | `server/thumbnailEndpointServerHook.test.ts` |
-| Thumbnail body exceeds the byte cap | Body truncated at the cap and served | `server/thumbnailEndpointServerHook.test.ts` |
-| Thumbnail upstream refuses once, then recovers | The failure is not cached; the next tile load fetches again and serves | `server/thumbnailEndpointServerHook.test.ts` |
-| `/thumbnail` budget is spent | HTTP 429 for the tiles only; the search budget is a separate limiter | `server/handleTokenVerification.test.ts`, `server/thumbnailEndpointServerHook.test.ts` |
-| A tile's `/thumbnail` request fails in the browser | That tile shows the host name, the rest of the grid is untouched | `client/components/Search/Results/Graphical/ImageResultsList.test.tsx` |
-| SearXNG returns an image result with no thumbnail URL | The result is dropped, so the grid never shows a host-name tile for it | `server/webSearchService.test.ts` › graceful degradation |
-| Search returns nothing to the endpoint | HTTP 200 with `[]`, not an error | `server/searchEndpointServerHook.test.ts` › graceful degradation |
-| Text search returns nothing to the client | Keyword-only query retried as a fallback | `client/modules/textGeneration.degradation.test.ts` |
-| Keyword fallback also returns nothing | Text search state stays `completed` with the no-results alert | `client/modules/textGeneration.degradation.test.ts` |
-| SearXNG is down on the client | Text search state becomes `failed`, keyword fallback does not fire | `client/modules/textGeneration.degradation.test.ts` |
-| Client search fails after a previous search populated the LLM channel | The grounding channel is cleared, so the AI can't ground on the previous query's results; when image search is on and it answers, the channel is repopulated with the (image)-tagged titles and URLs instead | `client/modules/textGeneration.degradation.test.ts` |
-| Text search fails and the image search answers | The answer waits for the image results and grounds on their (image)-tagged titles and URLs, and the failed-state alert says so | `client/modules/textGeneration.degradation.test.ts` › search degradation |
-| Live search fails but a stale cached result exists for the same query | The cached result is served flagged stale and the UI shows the "Showing cached results" banner | `client/modules/search.test.ts` › Stale Result Fallback |
-| Result page host resolves into a private range | Page skipped, no request is made | `server/pageContentService.test.ts` › fetchPageContents |
-| Result page redirects into a private range | Redirect not followed, page skipped | `server/pageContentService.test.ts` › fetchPageContents |
-| Result page errors, is not a document, or yields no text | That page is skipped, the others still return | `server/pageContentService.test.ts` › fetchPageContents |
-| Result host refuses three reads in a row | The host is skipped without a request for the cooling window, and the skip is counted as `skippedByBreaker` | `server/pageContentService.test.ts` › host circuit breaker |
-| The window passes on a skipped host | One read probes the host; a success reopens it, a refusal boxes it again | `server/pageContentService.test.ts` › host circuit breaker |
-| A skipped host appears twice in one batch after the window | One probe is sent, the other read is skipped | `server/pageContentService.test.ts` › host circuit breaker |
-| Result page body never ends | Reading stops at the byte cap | `server/pageContentService.test.ts` › fetchPageContents |
-| `/page-content` errors or never answers | Answer falls back to snippets, search still completes | `client/modules/pageContent.test.ts`, `client/modules/textGeneration.degradation.test.ts` › page content grounding |
-| `/inference` upstream is not configured | HTTP 500 with a JSON error | `server/internalApiEndpointServerHook.test.ts` › environment configuration |
-| `/inference` cannot list upstream models | HTTP 500 with a JSON error | `server/internalApiEndpointServerHook.test.ts` › streaming path |
-| Upstream model fails but another one is available | Retried on the next model, answer still streams | `server/internalApiEndpointServerHook.test.ts` › streaming path |
-| Every model fails before a single token is sent | HTTP 503 with a JSON error | `server/internalApiEndpointServerHook.test.ts` › streaming path |
-| Upstream stream ends without a finish part | Treated as a failure: retried, then `Stream ended unexpectedly` as the last error | `server/internalApiEndpointServerHook.test.ts` › streaming path |
-| Upstream fails after content was already sent | No retry, SSE error frame, the partial answer stands | `server/internalApiEndpointServerHook.test.ts` › streaming path |
-| Response is already unwritable when streaming would start | No headers set, the upstream is never called | `server/internalApiEndpointServerHook.test.ts` › streaming path |
-| `/inference` answers 503 | Generation state becomes `failed`, nothing persisted | `client/modules/textGeneration.degradation.test.ts` |
-| Generation interrupted mid-stream | Partial answer preserved, state stays `interrupted` | `client/modules/textGeneration.degradation.test.ts` |
-| The local voice catalogue cannot be fetched | The local engine is skipped and the answer is read by an OS voice | `client/modules/textToSpeech.test.ts` › falls back when the voice catalogue cannot be reached |
-| No local voice matches the language | Same, with a log entry naming the reason | `client/modules/textToSpeech.test.ts` › falls back when no local voice matches the language |
-| The synthesis worker fails before anything is audible | The answer is read by an OS voice instead | `client/modules/textToSpeech.test.ts` › falls back to the system voice when the local engine cannot load, falls back when the worker fails and no chunk was ever audible |
-| Every synthesized chunk fails to play (blocked autoplay) | Treated as a local-engine failure, so an OS voice reads the answer rather than the user getting silence | `client/modules/textToSpeech.test.ts` › falls back when every synthesized chunk fails to play |
-| The browser provides no `speechSynthesis` at all and the local engine failed | Playback resolves and returns to idle with a log entry, instead of an unhandled rejection | `client/modules/textToSpeech.test.ts` › resolves and logs when the local engine failed and there are no OS voices |
-| A caller streams an oversized body to `/api/validate-access-key` | Refused with `413` mid-upload and the socket dropped; the answer carries `Connection: close`, so the caller's next request opens a fresh connection instead of a dead one | `server/validateAccessKeyServerHook.socket.test.ts` › refuses an oversized body with 413 without breaking the next request |
-| Two follow-up question generations overlap | The older completion writes nothing, so the flag stays on until the newest finishes and the input keeps the newest question | `client/components/AiResponse/ChatInterface.test.tsx` › keeps the follow-up question flag on until the newest call finishes |
-| `ChatInterface` unmounts while a follow-up question is in flight | Both generation flags are cleared and the orphaned completion writes nothing into the next mount | `client/components/AiResponse/ChatInterface.test.tsx` › leaves both generation flags off after unmounting mid-generation |
-| A follow-up question generation rejects after a newer one started | The failed call blanks nothing, so the newer question still lands and the flag stays on until it does | `client/components/AiResponse/ChatInterface.test.tsx` › blanks nothing when an orphaned call rejects after a newer one started |
-| `ChatInterface` unmounts while a regenerate is still awaiting its response | The orphaned regenerate leaves the next mount's response flag alone | `client/components/AiResponse/ChatInterface.test.tsx` › leaves the next mount's response flag alone when an orphaned regenerate settles |
-| `ChatInterface` unmounts while a send is still awaiting its response | The orphaned send asks for no follow-up question and leaves the next mount's response flag alone | `client/components/AiResponse/ChatInterface.test.tsx` › starts no follow-up question for a send that settles after unmount, leaves the next mount's response flag alone when an orphaned send settles |
-| The dictation model cannot load in the browser | While the on-device model is preferred, the local engine is abandoned for the browser's `SpeechRecognition`, and the button hides when that is missing too | `client/modules/speechToText.test.ts` › falls back to the browser recognizer when the local engine fails |
-| The browser recognizer fails while the on-device model is off | The session fails outright; there is no reverse fallback, so the disabled model is never downloaded behind the user's back | `client/modules/speechToText.test.ts` › does not fall back to the wasm engine when the recognizer fails |
-| Microphone permission is denied | A notification says so instead of the press failing quietly, and no fallback asks again | `client/components/DictationButton.test.tsx` › shows a notification when microphone permission is denied, `client/modules/speechToText.test.ts` › reports a denied microphone instead of falling back |
-| The dictation engine fails while the microphone permission prompt is open | The load fails rather than resolving into a dead transcriber, so the browser recognizer takes over | `client/modules/speechToText.test.ts` › fails the load when the engine dies while permission is pending, fails the load when the worker dies uncaught while permission is pending |
-| The browser recognizer is denied after the session started | Reported through the error callback, since the promise it would have rejected has already resolved | `client/modules/speechToText.test.ts` › reports a denial that arrives after the session resolved |
-| The browser recognizer ends on its own after silence | The session ends and the button leaves its recording state, with no notification, because nothing failed | `client/modules/speechToText.test.ts` › ends the session quietly when the recognizer stops on its own, `client/components/DictationButton.test.tsx` › leaves the recording state quietly when the engine ends on its own |
-| The dictation engine fails after it loaded | A notification says so and the session stops, instead of the UI listening forever with the microphone open | `client/modules/speechToText.test.ts` › reports a worker failure that happens after the engine loaded, `client/components/DictationButton.test.tsx` › notifies and stops when the engine fails after it loaded |
-| The search form unmounts while dictation is recording | The microphone track, the AudioContext and the worker are all released | `client/components/DictationButton.test.tsx` › releases the microphone when the button unmounts mid-recording |
-| A chat response starts generating while dictation is recording in the follow-up box | The session is stopped instead of splicing its transcript into a field that has gone read-only and is about to be cleared | `client/components/AiResponse/ChatInputArea.test.tsx` › stops a running session when a response starts generating |
-| An upstream dictation model file is unavailable | `/dictation-models/` answers a 502 rather than caching a partial file | `server/dictationModelServerHook.test.ts` › returns a 502 when the upstream download fails |
+| Failure injected                                                                                                | Expected degradation                                                                                                                                                                                                    | Where it is pinned                                                                                                                                                                                                       |
+| --------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| SearXNG answers 500 once, then recovers                                                                         | Retried with exponential backoff, results returned                                                                                                                                                                      | `server/webSearchService.test.ts` › retry logic                                                                                                                                                                          |
+| SearXNG answers 500 on every attempt                                                                            | Retry cycle exhausts (4 requests) and costs a single circuit-breaker failure                                                                                                                                            | `server/webSearchService.test.ts` › graceful degradation                                                                                                                                                                 |
+| SearXNG answers 200 with no results and a transiently unresponsive engine (e.g. a timeout) once, then recovers  | Retried with the same backoff, results returned, not counted as a failure                                                                                                                                               | `server/webSearchService.test.ts` › retry logic                                                                                                                                                                          |
+| SearXNG answers 200 with no results and a non-suspending engine error (e.g. server API error) on every attempt  | Retry cycle exhausts (4 requests), counts one failure, and `fetchSearXNG` throws with the engine reasons rather than an empty set, so the case takes the provider-down path below                                       | `server/webSearchService.test.ts` › retry logic, graceful degradation                                                                                                                                                    |
+| SearXNG answers 200 with no results and every unresponsive engine under a long suspension (CAPTCHA, rate limit) | Fails fast on the first attempt (1 request, no backoff), counts one failure, and throws the same error: a suspension outlasts the whole backoff by hours to a day                                                       | `server/webSearchService.test.ts` › retry logic                                                                                                                                                                          |
+| SearXNG fails five cycles in a row                                                                              | Circuit opens; further searches short-circuit without calling the upstream                                                                                                                                              | `server/webSearchService.test.ts` › graceful degradation                                                                                                                                                                 |
+| SearXNG recovers after the reset timeout                                                                        | One healthy response closes the circuit again                                                                                                                                                                           | `server/webSearchService.test.ts` › graceful degradation                                                                                                                                                                 |
+| SearXNG's circuit is open while `/healthz` still answers OK                                                     | `webSearchServiceStatus` reports `unhealthy`: every search is failing, so the liveness probe alone must not report health                                                                                               | `server/webSearchService.test.ts` › getWebSearchServiceStatus                                                                                                                                                            |
+| A search is lost to unresponsive engines, then SearXNG answers the next one of that type                        | `webSearchServiceStatus` reports `degraded`, then `healthy` again; the per-engine failure counts stay                                                                                                                   | `server/webSearchService.test.ts` › getWebSearchServiceStatus                                                                                                                                                            |
+| A text search is lost to unresponsive engines and the image search the client fires next answers                | Still `degraded`, and `searches.degradedSearchTypes` names the pool: the two go out to different engine pools, so answering one says nothing about the other                                                            | `server/webSearchService.test.ts` › getWebSearchServiceStatus                                                                                                                                                            |
+| The circuit reaches its reset timeout with no search since                                                      | `degraded`, not `healthy`: half-open is a timer, not a proven recovery                                                                                                                                                  | `server/webSearchService.test.ts` › getWebSearchServiceStatus                                                                                                                                                            |
+| SearXNG answers 200 with a non-JSON body                                                                        | `fetchSearXNG` throws and the endpoint answers HTTP 502                                                                                                                                                                 | `server/webSearchService.test.ts` › graceful degradation                                                                                                                                                                 |
+| SearXNG returns results that are all unusable                                                                   | Empty result set, no throw                                                                                                                                                                                              | `server/webSearchService.test.ts` › graceful degradation                                                                                                                                                                 |
+| Provider down vs. genuinely zero results                                                                        | Provider down: `fetchSearXNG` throws, the endpoint answers HTTP 502, and the client search state becomes `failed`; genuinely zero results: HTTP 200 with `[]`, state stays `completed` and the no-results alert renders | `server/webSearchService.test.ts` and `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                   |
+| SearXNG is down                                                                                                 | `/search/text` and `/search/images` answer HTTP 502 with a JSON error                                                                                                                                                   | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| Reranker is not ready                                                                                           | Results served in SearXNG order, HTTP 200                                                                                                                                                                               | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| Reranking throws mid-request                                                                                    | Results served in SearXNG order, HTTP 200                                                                                                                                                                               | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| Reranker is not ready on an image search                                                                        | Images still served, with the thumbnail URLs as SearXNG sent them                                                                                                                                                       | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| Reranking throws on an image search                                                                             | Images still served, with the thumbnail URLs as SearXNG sent them                                                                                                                                                       | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| Reranker returns a URL absent from the result set                                                               | That image is dropped                                                                                                                                                                                                   | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| SearXNG is down and the text-search fallback answers                                                            | The fallback's results are ranked and served as HTTP 200 on the normal text path, `searchesServedByFallback` is incremented, and no search duration is recorded                                                         | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| SearXNG is down and the fallback answers with nothing usable                                                    | HTTP 200 with `[]`, so the client shows the no-results alert instead of the unavailable one, and `searchesServedByFallback` is still incremented                                                                        | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| SearXNG is down and the fallback fails too                                                                      | HTTP 502 with a JSON error, `searchesFailedOnFallback` is incremented, and the log line carries the fallback's status code but never the query                                                                          | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| SearXNG fails with too little of the search deadline left                                                       | The fallback is never consulted, `searchesFailedOnFallback` is incremented, and `/search/text` answers HTTP 502 rather than a result the client would never receive                                                     | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| SearXNG is down while the fallback is switched off                                                              | HTTP 502; the fallback is never consulted and neither fallback counter moves                                                                                                                                            | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| SearXNG is down on an image search while the fallback is on                                                     | HTTP 502; the fallback is text-only, so it is never consulted and neither fallback counter moves                                                                                                                        | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| SearXNG answers while the fallback is on                                                                        | HTTP 200 from SearXNG's results; the fallback is never consulted and neither fallback counter moves                                                                                                                     | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback                                                                                                                                  |
+| The first fallback provider fails and the next one answers                                                      | The cascade moves on to the next provider within what is left of the shared budget, and that provider's results are served; the failure is logged with the provider name and a status code, never the query             | `server/fallbackSearchService.test.ts` › the cascade                                                                                                                                                                     |
+| A fallback provider answers HTTP 429                                                                            | That provider is paused until its `Retry-After` (60 s when missing or invalid, at most an hour), the next provider serves the search, and later searches skip the paused one without a request until the pause ends     | `server/fallbackSearchService.test.ts` › pausing a rate-limited provider                                                                                                                                                 |
+| Every fallback provider is paused                                                                               | No provider is called, the cascade throws, and `/search/text` answers HTTP 502 as for a fallback that failed                                                                                                            | `server/fallbackSearchService.test.ts` › pausing a rate-limited provider                                                                                                                                                 |
+| Thumbnail host never answers                                                                                    | Request aborted after the timeout, `/thumbnail` answers HTTP 502 and the tile shows the host name                                                                                                                       | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| DNS lookup for a thumbnail never settles                                                                        | Bounded by the same deadline as the fetch, `/thumbnail` answers HTTP 502                                                                                                                                                | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| Thumbnail URL resolves into a private range                                                                     | Refused before any request, `/thumbnail` answers HTTP 403                                                                                                                                                               | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| Thumbnail redirects into a private range                                                                        | Redirect not followed, HTTP 403                                                                                                                                                                                         | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| Thumbnail redirect carries a malformed Location                                                                 | Not followed, HTTP 502, no unhandled rejection                                                                                                                                                                          | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| Thumbnail upstream answers with a non-raster or an empty body (SVG included)                                    | `/thumbnail` answers HTTP 502, the tile shows the host name                                                                                                                                                             | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| Thumbnail body exceeds the byte cap                                                                             | Body truncated at the cap and served                                                                                                                                                                                    | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| Thumbnail upstream refuses once, then recovers                                                                  | The failure is not cached; the next tile load fetches again and serves                                                                                                                                                  | `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                                                             |
+| `/thumbnail` budget is spent                                                                                    | HTTP 429 for the tiles only; the search budget is a separate limiter                                                                                                                                                    | `server/handleTokenVerification.test.ts`, `server/thumbnailEndpointServerHook.test.ts`                                                                                                                                   |
+| A tile's `/thumbnail` request fails in the browser                                                              | That tile shows the host name, the rest of the grid is untouched                                                                                                                                                        | `client/components/Search/Results/Graphical/ImageResultsList.test.tsx`                                                                                                                                                   |
+| SearXNG returns an image result with no thumbnail URL                                                           | The result is dropped, so the grid never shows a host-name tile for it                                                                                                                                                  | `server/webSearchService.test.ts` › graceful degradation                                                                                                                                                                 |
+| Search returns nothing to the endpoint                                                                          | HTTP 200 with `[]`, not an error                                                                                                                                                                                        | `server/searchEndpointServerHook.test.ts` › graceful degradation                                                                                                                                                         |
+| Text search returns nothing to the client                                                                       | Keyword-only query retried as a fallback                                                                                                                                                                                | `client/modules/textGeneration.degradation.test.ts`                                                                                                                                                                      |
+| Keyword fallback also returns nothing                                                                           | Text search state stays `completed` with the no-results alert                                                                                                                                                           | `client/modules/textGeneration.degradation.test.ts`                                                                                                                                                                      |
+| SearXNG is down on the client                                                                                   | Text search state becomes `failed`, keyword fallback does not fire                                                                                                                                                      | `client/modules/textGeneration.degradation.test.ts`                                                                                                                                                                      |
+| Client search fails after a previous search populated the LLM channel                                           | The grounding channel is cleared, so the AI can't ground on the previous query's results; when image search is on and it answers, the channel is repopulated with the (image)-tagged titles and URLs instead            | `client/modules/textGeneration.degradation.test.ts`                                                                                                                                                                      |
+| Text search fails and the image search answers                                                                  | The answer waits for the image results and grounds on their (image)-tagged titles and URLs, and the failed-state alert says so                                                                                          | `client/modules/textGeneration.degradation.test.ts` › search degradation                                                                                                                                                 |
+| Live search fails but a stale cached result exists for the same query                                           | The cached result is served flagged stale and the UI shows the "Showing cached results" banner                                                                                                                          | `client/modules/search.test.ts` › Stale Result Fallback                                                                                                                                                                  |
+| Result page host resolves into a private range                                                                  | Page skipped, no request is made                                                                                                                                                                                        | `server/pageContentService.test.ts` › fetchPageContents                                                                                                                                                                  |
+| Result page redirects into a private range                                                                      | Redirect not followed, page skipped                                                                                                                                                                                     | `server/pageContentService.test.ts` › fetchPageContents                                                                                                                                                                  |
+| Result page errors, is not a document, or yields no text                                                        | That page is skipped, the others still return                                                                                                                                                                           | `server/pageContentService.test.ts` › fetchPageContents                                                                                                                                                                  |
+| Result host refuses three reads in a row                                                                        | The host is skipped without a request for the cooling window, and the skip is counted as `skippedByBreaker`                                                                                                             | `server/pageContentService.test.ts` › host circuit breaker                                                                                                                                                               |
+| The window passes on a skipped host                                                                             | One read probes the host; a success reopens it, a refusal boxes it again                                                                                                                                                | `server/pageContentService.test.ts` › host circuit breaker                                                                                                                                                               |
+| A skipped host appears twice in one batch after the window                                                      | One probe is sent, the other read is skipped                                                                                                                                                                            | `server/pageContentService.test.ts` › host circuit breaker                                                                                                                                                               |
+| Result page body never ends                                                                                     | Reading stops at the byte cap                                                                                                                                                                                           | `server/pageContentService.test.ts` › fetchPageContents                                                                                                                                                                  |
+| `/page-content` errors or never answers                                                                         | Answer falls back to snippets, search still completes                                                                                                                                                                   | `client/modules/pageContent.test.ts`, `client/modules/textGeneration.degradation.test.ts` › page content grounding                                                                                                       |
+| `/inference` upstream is not configured                                                                         | HTTP 500 with a JSON error                                                                                                                                                                                              | `server/internalApiEndpointServerHook.test.ts` › environment configuration                                                                                                                                               |
+| `/inference` cannot list upstream models                                                                        | HTTP 500 with a JSON error                                                                                                                                                                                              | `server/internalApiEndpointServerHook.test.ts` › streaming path                                                                                                                                                          |
+| Upstream model fails but another one is available                                                               | Retried on the next model, answer still streams                                                                                                                                                                         | `server/internalApiEndpointServerHook.test.ts` › streaming path                                                                                                                                                          |
+| Every model fails before a single token is sent                                                                 | HTTP 503 with a JSON error                                                                                                                                                                                              | `server/internalApiEndpointServerHook.test.ts` › streaming path                                                                                                                                                          |
+| Upstream stream ends without a finish part                                                                      | Treated as a failure: retried, then `Stream ended unexpectedly` as the last error                                                                                                                                       | `server/internalApiEndpointServerHook.test.ts` › streaming path                                                                                                                                                          |
+| Upstream fails after content was already sent                                                                   | No retry, SSE error frame, the partial answer stands                                                                                                                                                                    | `server/internalApiEndpointServerHook.test.ts` › streaming path                                                                                                                                                          |
+| Response is already unwritable when streaming would start                                                       | No headers set, the upstream is never called                                                                                                                                                                            | `server/internalApiEndpointServerHook.test.ts` › streaming path                                                                                                                                                          |
+| `/inference` answers 503                                                                                        | Generation state becomes `failed`, nothing persisted                                                                                                                                                                    | `client/modules/textGeneration.degradation.test.ts`                                                                                                                                                                      |
+| Generation interrupted mid-stream                                                                               | Partial answer preserved, state stays `interrupted`                                                                                                                                                                     | `client/modules/textGeneration.degradation.test.ts`                                                                                                                                                                      |
+| The local voice catalogue cannot be fetched                                                                     | The local engine is skipped and the answer is read by an OS voice                                                                                                                                                       | `client/modules/textToSpeech.test.ts` › falls back when the voice catalogue cannot be reached                                                                                                                            |
+| No local voice matches the language                                                                             | Same, with a log entry naming the reason                                                                                                                                                                                | `client/modules/textToSpeech.test.ts` › falls back when no local voice matches the language                                                                                                                              |
+| The synthesis worker fails before anything is audible                                                           | The answer is read by an OS voice instead                                                                                                                                                                               | `client/modules/textToSpeech.test.ts` › falls back to the system voice when the local engine cannot load, falls back when the worker fails and no chunk was ever audible                                                 |
+| Every synthesized chunk fails to play (blocked autoplay)                                                        | Treated as a local-engine failure, so an OS voice reads the answer rather than the user getting silence                                                                                                                 | `client/modules/textToSpeech.test.ts` › falls back when every synthesized chunk fails to play                                                                                                                            |
+| The browser provides no `speechSynthesis` at all and the local engine failed                                    | Playback resolves and returns to idle with a log entry, instead of an unhandled rejection                                                                                                                               | `client/modules/textToSpeech.test.ts` › resolves and logs when the local engine failed and there are no OS voices                                                                                                        |
+| A caller streams an oversized body to `/api/validate-access-key`                                                | Refused with `413` mid-upload and the socket dropped; the answer carries `Connection: close`, so the caller's next request opens a fresh connection instead of a dead one                                               | `server/validateAccessKeyServerHook.socket.test.ts` › refuses an oversized body with 413 without breaking the next request                                                                                               |
+| Two follow-up question generations overlap                                                                      | The older completion writes nothing, so the flag stays on until the newest finishes and the input keeps the newest question                                                                                             | `client/components/AiResponse/ChatInterface.test.tsx` › keeps the follow-up question flag on until the newest call finishes                                                                                              |
+| `ChatInterface` unmounts while a follow-up question is in flight                                                | Both generation flags are cleared and the orphaned completion writes nothing into the next mount                                                                                                                        | `client/components/AiResponse/ChatInterface.test.tsx` › leaves both generation flags off after unmounting mid-generation                                                                                                 |
+| A follow-up question generation rejects after a newer one started                                               | The failed call blanks nothing, so the newer question still lands and the flag stays on until it does                                                                                                                   | `client/components/AiResponse/ChatInterface.test.tsx` › blanks nothing when an orphaned call rejects after a newer one started                                                                                           |
+| `ChatInterface` unmounts while a regenerate is still awaiting its response                                      | The orphaned regenerate leaves the next mount's response flag alone                                                                                                                                                     | `client/components/AiResponse/ChatInterface.test.tsx` › leaves the next mount's response flag alone when an orphaned regenerate settles                                                                                  |
+| `ChatInterface` unmounts while a send is still awaiting its response                                            | The orphaned send asks for no follow-up question and leaves the next mount's response flag alone                                                                                                                        | `client/components/AiResponse/ChatInterface.test.tsx` › starts no follow-up question for a send that settles after unmount, leaves the next mount's response flag alone when an orphaned send settles                    |
+| The dictation model cannot load in the browser                                                                  | While the on-device model is preferred, the local engine is abandoned for the browser's `SpeechRecognition`, and the button hides when that is missing too                                                              | `client/modules/speechToText.test.ts` › falls back to the browser recognizer when the local engine fails                                                                                                                 |
+| The browser recognizer fails while the on-device model is off                                                   | The session fails outright; there is no reverse fallback, so the disabled model is never downloaded behind the user's back                                                                                              | `client/modules/speechToText.test.ts` › does not fall back to the wasm engine when the recognizer fails                                                                                                                  |
+| Microphone permission is denied                                                                                 | A notification says so instead of the press failing quietly, and no fallback asks again                                                                                                                                 | `client/components/DictationButton.test.tsx` › shows a notification when microphone permission is denied, `client/modules/speechToText.test.ts` › reports a denied microphone instead of falling back                    |
+| The dictation engine fails while the microphone permission prompt is open                                       | The load fails rather than resolving into a dead transcriber, so the browser recognizer takes over                                                                                                                      | `client/modules/speechToText.test.ts` › fails the load when the engine dies while permission is pending, fails the load when the worker dies uncaught while permission is pending                                        |
+| The browser recognizer is denied after the session started                                                      | Reported through the error callback, since the promise it would have rejected has already resolved                                                                                                                      | `client/modules/speechToText.test.ts` › reports a denial that arrives after the session resolved                                                                                                                         |
+| The browser recognizer ends on its own after silence                                                            | The session ends and the button leaves its recording state, with no notification, because nothing failed                                                                                                                | `client/modules/speechToText.test.ts` › ends the session quietly when the recognizer stops on its own, `client/components/DictationButton.test.tsx` › leaves the recording state quietly when the engine ends on its own |
+| The dictation engine fails after it loaded                                                                      | A notification says so and the session stops, instead of the UI listening forever with the microphone open                                                                                                              | `client/modules/speechToText.test.ts` › reports a worker failure that happens after the engine loaded, `client/components/DictationButton.test.tsx` › notifies and stops when the engine fails after it loaded           |
+| The search form unmounts while dictation is recording                                                           | The microphone track, the AudioContext and the worker are all released                                                                                                                                                  | `client/components/DictationButton.test.tsx` › releases the microphone when the button unmounts mid-recording                                                                                                            |
+| A chat response starts generating while dictation is recording in the follow-up box                             | The session is stopped instead of splicing its transcript into a field that has gone read-only and is about to be cleared                                                                                               | `client/components/AiResponse/ChatInputArea.test.tsx` › stops a running session when a response starts generating                                                                                                        |
+| An upstream dictation model file is unavailable                                                                 | `/dictation-models/` answers a 502 rather than caching a partial file                                                                                                                                                   | `server/dictationModelServerHook.test.ts` › returns a 502 when the upstream download fails                                                                                                                               |
 
 ## Adding a Row
 

docs/glossary.md

@@ -7,7 +7,6 @@ Codebase-specific terms, jargon, and domain concepts used in MiniSearch.
 ### Search Token & Hash
 
 A security mechanism used to authorize communication between the client and the internal search/AI endpoints.
-
 - **Search Token**: A random string held by the running server, served to the client at runtime through `/api/config`. Used to verify that requests to the server come from a client that server handed the token to.
 - **Search Token Hash**: To avoid exposing the raw token in all requests, the client generates a hash of the token. Managed via the `lastSearchTokenHashPubSub` channel.
 - **Verification**: The server verifies these tokens to prevent unauthorized access to the search API. Stored in `server/verifiedTokens.ts` as an in-memory `Set<string>`.
@@ -16,17 +15,16 @@ A security mechanism used to authorize communication between the client and the
 
 MiniSearch supports multiple backends for Large Language Model (LLM) inference, configured via `inferenceType` in the application settings.
 
-| Type | Description | Implementation |
-|------|-------------|----------------|
-| `browser` | Local inference using WASM (Wllama) | Client-side, privacy-preserving |
-| `openai` | Connection to any OpenAI-compatible external API | Requires API key |
-| `horde` | Crowdsourced inference via the AI Horde network | Distributed, anonymous or authenticated |
-| `internal` | Server-side proxy using pre-configured credentials | API key hidden from client |
+| Type       | Description                                        | Implementation                          |
+| ---------- | -------------------------------------------------- | --------------------------------------- |
+| `browser`  | Local inference using WASM (Wllama)                | Client-side, privacy-preserving         |
+| `openai`   | Connection to any OpenAI-compatible external API   | Requires API key                        |
+| `horde`    | Crowdsourced inference via the AI Horde network    | Distributed, anonymous or authenticated |
+| `internal` | Server-side proxy using pre-configured credentials | API key hidden from client              |
 
 ### PubSub (State Management)
 
 Instead of a heavy state management library like Redux, MiniSearch uses a minimalist Publish-Subscribe pattern powered by the `create-pubsub` library.
-
 - **Data Flow**: Components subscribe to "channels" (e.g., `queryPubSub`, `responsePubSub`)
 - **Tuple Pattern**: Each channel is a 3-element tuple: `[update, subscribe, get]`
 - **Persistence**: Some channels use `createLocalStoragePubSub` to automatically sync state with `localStorage`
@@ -35,7 +33,6 @@ Instead of a heavy state management library like Redux, MiniSearch uses a minima
 ### Reranker
 
 A secondary search stage that takes initial results from SearXNG and re-orders them based on relevance to the query using a multilingual cross-encoder model (`mmarco-mMiniLMv2-L12-H384-v1`) running in-process via ONNX Runtime.
-
 - **Implementation**: Loads the model's ONNX export with `onnxruntime-node`; no child process
 - **Health Check**: Polls `/health` endpoint via `getRerankerStatus`
 - **Scoring**: Results filtered using standard deviation thresholds (`kStandardDeviationFactor = 0.3`)
@@ -44,7 +41,6 @@ A secondary search stage that takes initial results from SearXNG and re-orders t
 ### Wllama
 
 A WebAssembly (WASM) based integration of `llama.cpp` for running LLMs on the CPU in the browser.
-
 - **Initialization**: Loads models from HuggingFace using `initializeWllama`
 - **Warmup**: Includes a warmup phase with a single token completion using `n_threads: 1`
 - **OPFS**: Uses the Origin Private File System via Wllama's cache manager to store model shards locally
@@ -53,7 +49,6 @@ A WebAssembly (WASM) based integration of `llama.cpp` for running LLMs on the CP
 ### AI Horde
 
 A crowdsourced distributed cluster of workers providing AI inference. MiniSearch integrates with it using a polling strategy against the `/generate/text/status` endpoint.
-
 - **Kudos**: Virtual currency used by the Horde. Default anonymous key is `0000000000`
 - **Polling**: Requests sent to async API, status checked periodically until completion
 - **Cancellation**: Can abort generation via `DELETE` on the status endpoint
@@ -61,7 +56,6 @@ A crowdsourced distributed cluster of workers providing AI inference. MiniSearch
 ### Conversation Memory & Rolling Summary
 
 A mechanism to handle long chats that exceed the LLM context window.
-
 - **Summarization**: When older messages are dropped, `createLlmSummary` asks the LLM to condense them under a limit of 800 tokens
 - **Extractive Fallback**: If LLM summarization fails, `summarizeDroppedMessages` uses a token-counting extractive approach
 - **Token Budget**: Computed based on `openAiContextLength` setting and current message count
@@ -88,16 +82,16 @@ Note the version mismatch trap: Dexie registers its schema at the declared versi
 
 Middleware registered via Vite plugin hooks (`configureServer`, `configurePreviewServer`). All server-side logic in MiniSearch is implemented as hooks:
 
-| Hook | Purpose |
-|------|---------|
-| `compressionServerHook` | gzip/brotli compression |
-| `crossOriginServerHook` | COOP/COEP headers for SharedArrayBuffer |
-| `searchEndpointServerHook` | `/search/text` and `/search/images` endpoints |
-| `statusEndpointServerHook` | `/status` health check |
-| `cacheServerHook` | Cache-Control headers |
-| `validateAccessKeyServerHook` | Access key validation |
-| `internalApiEndpointServerHook` | `/inference` proxy |
-| `rerankerServiceHook` | Reranker model lifecycle management |
+| Hook                            | Purpose                                       |
+| ------------------------------- | --------------------------------------------- |
+| `compressionServerHook`         | gzip/brotli compression                       |
+| `crossOriginServerHook`         | COOP/COEP headers for SharedArrayBuffer       |
+| `searchEndpointServerHook`      | `/search/text` and `/search/images` endpoints |
+| `statusEndpointServerHook`      | `/status` health check                        |
+| `cacheServerHook`               | Cache-Control headers                         |
+| `validateAccessKeyServerHook`   | Access key validation                         |
+| `internalApiEndpointServerHook` | `/inference` proxy                            |
+| `rerankerServiceHook`           | Reranker model lifecycle management           |
 
 ### Circuit Breaker
 
@@ -115,30 +109,30 @@ A password hashing algorithm used for access key validation. Client hashes the a
 
 ### SearchCacheDatabase Schema
 
-| Store | Primary Key | Indexed Field | Entry Type |
-|-------|-------------|---------------|------------|
-| `textSearchHistory` | key (hash) | timestamp | TextSearchCache |
-| `imageSearchHistory` | key (hash) | timestamp | ImageSearchCache |
+| Store                | Primary Key | Indexed Field | Entry Type       |
+| -------------------- | ----------- | ------------- | ---------------- |
+| `textSearchHistory`  | key (hash)  | timestamp     | TextSearchCache  |
+| `imageSearchHistory` | key (hash)  | timestamp     | ImageSearchCache |
 
 ### HistoryDatabase Schema
 
-| Table | Purpose |
-|-------|---------|
-| `searches` | Canonical log of each query with hydrated results payloads |
-| `llmResponses` | AI answers tied to their originating search run |
-| `chatHistory` | Chronological chat turns scoped by `conversationId` |
+| Table          | Purpose                                                    |
+| -------------- | ---------------------------------------------------------- |
+| `searches`     | Canonical log of each query with hydrated results payloads |
+| `llmResponses` | AI answers tied to their originating search run            |
+| `chatHistory`  | Chronological chat turns scoped by `conversationId`        |
 
 ### PubSub Channel Types
 
-| Channel | Data Type | Persistence |
-|---------|-----------|-------------|
-| `queryPubSub` | `string` | Memory |
-| `responsePubSub` | `string` | Memory (throttled) |
-| `settingsPubSub` | `Settings` | localStorage |
-| `textSearchResultsPubSub` | `TextSearchResults` | Memory |
-| `textGenerationStatePubSub` | `TextGenerationState` | Memory |
-| `chatMessagesPubSub` | `ChatMessage[]` | Memory |
-| `conversationSummaryPubSub` | `{id, summary}` | Memory |
+| Channel                     | Data Type             | Persistence        |
+| --------------------------- | --------------------- | ------------------ |
+| `queryPubSub`               | `string`              | Memory             |
+| `responsePubSub`            | `string`              | Memory (throttled) |
+| `settingsPubSub`            | `Settings`            | localStorage       |
+| `textSearchResultsPubSub`   | `TextSearchResults`   | Memory             |
+| `textGenerationStatePubSub` | `TextGenerationState` | Memory             |
+| `chatMessagesPubSub`        | `ChatMessage[]`       | Memory             |
+| `conversationSummaryPubSub` | `{id, summary}`       | Memory             |
 
 ## Related Topics
 

docs/overview.md

@@ -33,7 +33,6 @@ MiniSearch integrates multiple technology stacks within a unified deployment con
 ## Application Entry Points
 
 The application has three primary entry points:
-
 1. **Browser Entry**: `client/index.tsx` initializes the React application, mounting the root component and setting up error boundaries.
 
 2. **Server Entry**: `vite.config.ts` configures the Vite development and preview servers, registering server hooks for search and inference endpoints.
@@ -43,7 +42,6 @@ The application has three primary entry points:
 ## Multi-Service Container Architecture
 
 The Docker container runs three services concurrently:
-
 - **SearXNG** - Privacy-focused metasearch engine
 - **ONNX Runtime** - In-process inference for result reranking
 - **Node.js application** - Main application server
@@ -59,7 +57,6 @@ PubSub channels are created using the create-pubsub package and provide type-saf
 ## Data Persistence Strategy
 
 MiniSearch employs a dual-layer persistence approach:
-
 - **IndexedDB** - Local storage for search history, settings, cached results, and saved AI transcripts
 - **TTL-based caching** - 15-minute freshness cache for search results to minimize API calls, with a 24-hour stale retention as a fallback when the live search fails
 
@@ -114,7 +111,6 @@ The `textGeneration` module orchestrates the entire search-to-response flow, man
 ### Web Search Service Reliability
 
 `server/webSearchService.ts` implements resilience patterns for SearXNG integration:
-
 - **Circuit Breaker**: Opens after 5 consecutive failures, blocking requests for 60 seconds before attempting reset
 - **Retry Logic**: Exponential backoff for HTTP 500 errors, up to 3 retries
 - **Fail-Fast on Suspending Engines**: An empty response in which every unresponsive engine is under a long suspension (CAPTCHA, rate limit, access denied; SearXNG suspends them for an hour to a day) throws on the first attempt instead of spending the retry budget, which it could not possibly outlast. Transient engine errors (timeouts, server API errors) keep the full retry budget.
@@ -126,7 +122,6 @@ None of this changes which engines answer. That is decided inside SearXNG, and w
 ### Search Token Lifecycle
 
 CSRF protection uses a token the server owns for its lifetime:
-
 1. **Generation**: `regenerateSearchToken()` draws 32 random bytes on first use in a process and writes them to the token file; the file is a record, never read back as a source of truth
 2. **Storage**: The token is held in memory for the life of the process, and recorded at `{os.tempdir()}/minisearch-token` with `0600` permissions
 3. **Distribution**: Server serves the token to the client at runtime through `/api/config`, so a client always holds the token of the server answering it
@@ -144,7 +139,6 @@ MiniSearch uses a PubSub-based architecture where state flows through independen
 ### State Machine Transitions
 
 **Text Generation States:**
-
 - `idle` - No active generation
 - `awaitingModelDownloadAllowance` - Waiting for user consent to download a browser model
 - `loadingModel` - Downloading or initializing the browser (Wllama) model
@@ -156,7 +150,6 @@ MiniSearch uses a PubSub-based architecture where state flows through independen
 - `failed` - Error occurred
 
 **Search States:**
-
 - `idle` - No active search
 - `running` - Search in progress
 - `completed` - Results received
@@ -174,10 +167,10 @@ MiniSearch uses a PubSub-based architecture where state flows through independen
 
 Streaming LLM output produces token-by-token state changes that would overwhelm React's rendering pipeline. Two channels apply throttling via `throttleit`:
 
-| Channel | Throttle Interval | Purpose |
-|---------|-------------------|---------|
-| `responsePubSub` | ~83ms (12/sec) | AI response text streaming |
-| `reasoningContentPubSub` | ~83ms (12/sec) | Reasoning/thinking content streaming |
+| Channel                  | Throttle Interval | Purpose                              |
+| ------------------------ | ----------------- | ------------------------------------ |
+| `responsePubSub`         | ~83ms (12/sec)    | AI response text streaming           |
+| `reasoningContentPubSub` | ~83ms (12/sec)    | Reasoning/thinking content streaming |
 
 Callers write tokens directly to `updateResponse` or `updateReasoningContent` without awareness of internal throttling.
 
@@ -185,11 +178,11 @@ Callers write tokens directly to `updateResponse` or `updateReasoningContent` wi
 
 Three channels register built-in side-effect subscribers at module load time for automatic logging:
 
-| Channel | Side Effect |
-| --------- | ------------- |
+| Channel                     | Side Effect                              |
+| --------------------------- | ---------------------------------------- |
 | `textGenerationStatePubSub` | Logs state transitions via `addLogEntry` |
-| `textSearchStatePubSub` | Logs state transitions via `addLogEntry` |
-| `imageSearchStatePubSub` | Logs state transitions via `addLogEntry` |
+| `textSearchStatePubSub`     | Logs state transitions via `addLogEntry` |
+| `imageSearchStatePubSub`    | Logs state transitions via `addLogEntry` |
 
 ## Build and Deployment Pipeline
 
@@ -199,20 +192,19 @@ The build pipeline uses Biome for linting and formatting, TypeScript for type ch
 
 MiniSearch implements all server-side logic as Vite plugin hooks. Each hook registers middleware on Vite's HTTP server, working identically in both dev (`vite`) and production preview (`vite preview`) modes. Hooks are declared in `vite.config.ts` and registered via `configureServer`/`configurePreviewServer` callbacks.
 
-| Hook | File | Purpose |
-| ------ | ------ | --------- |
-| `compressionServerHook` | `server/compressionServerHook.ts` | gzip/brotli compression for all responses |
-| `crossOriginServerHook` | `server/crossOriginServerHook.ts` | COOP/COEP headers for SharedArrayBuffer |
-| `searchEndpointServerHook` | `server/searchEndpointServerHook.ts` | `/search/text` and `/search/images` endpoints proxied to SearXNG |
+| Hook                            | File                                      | Purpose                                                               |
+| ------------------------------- | ----------------------------------------- | --------------------------------------------------------------------- |
+| `compressionServerHook`         | `server/compressionServerHook.ts`         | gzip/brotli compression for all responses                             |
+| `crossOriginServerHook`         | `server/crossOriginServerHook.ts`         | COOP/COEP headers for SharedArrayBuffer                               |
+| `searchEndpointServerHook`      | `server/searchEndpointServerHook.ts`      | `/search/text` and `/search/images` endpoints proxied to SearXNG      |
 | `pageContentEndpointServerHook` | `server/pageContentEndpointServerHook.ts` | `/page-content` endpoint that reads result pages for answer grounding |
-| `statusEndpointServerHook` | `server/statusEndpointServerHook.ts` | `/status` health check endpoint |
-| `cacheServerHook` | `server/cacheServerHook.ts` | Cache-Control headers (preview only) |
-| `validateAccessKeyServerHook` | `server/validateAccessKeyServerHook.ts` | Access key validation endpoint |
-| `internalApiEndpointServerHook` | `server/internalApiEndpointServerHook.ts` | `/inference` proxy to self-hosted API |
-| `rerankerServiceHook` | `server/rerankerServiceHook.ts` | Reranker model lifecycle management for result reranking |
+| `statusEndpointServerHook`      | `server/statusEndpointServerHook.ts`      | `/status` health check endpoint                                       |
+| `cacheServerHook`               | `server/cacheServerHook.ts`               | Cache-Control headers (preview only)                                  |
+| `validateAccessKeyServerHook`   | `server/validateAccessKeyServerHook.ts`   | Access key validation endpoint                                        |
+| `internalApiEndpointServerHook` | `server/internalApiEndpointServerHook.ts` | `/inference` proxy to self-hosted API                                 |
+| `rerankerServiceHook`           | `server/rerankerServiceHook.ts`           | Reranker model lifecycle management for result reranking              |
 
 Key server-side modules:
-
 - **`server/webSearchService.ts`**: Integrates with SearXNG at `http://127.0.0.1:8888`. Implements a circuit breaker (opens after 5 failures, resets after 60s) and retry logic (up to 3 retries with exponential backoff, for 500s and for empty responses naming transiently unresponsive engines; an all-suspended set fails fast on the first attempt, since SearXNG suspensions last an hour to a day).
 - **`server/pageContentService.ts`**: Reads result pages for answer grounding: SSRF-guarded fetches with a byte cap, readable-text extraction, and query-relevant passage selection. Reads run under a per-host circuit breaker (`server/pageReadHostBreaker.ts`) that skips a host for 5 minutes after 3 refusals in a row, then probes it with one read.
 - **`server/searchToken.ts`**: Manages a token at `{os.tempdir()}/minisearch-token` used for CSRF protection on search requests.
@@ -224,42 +216,42 @@ Key server-side modules:
 
 The `cacheServerHook` sets Cache-Control headers on every response:
 
-| Path Pattern | Cache-Control Header | Rationale |
-| --- | --- | --- |
-| `/assets/*` | `public, max-age=31536000, immutable` | Content-hashed filenames never change |
-| `/` or `*.html` | `no-cache` | HTML must always check for updates |
-| Everything else | `public, max-age=86400, must-revalidate` | 24-hour cache with revalidation |
+| Path Pattern    | Cache-Control Header                     | Rationale                             |
+| --------------- | ---------------------------------------- | ------------------------------------- |
+| `/assets/*`     | `public, max-age=31536000, immutable`    | Content-hashed filenames never change |
+| `/` or `*.html` | `no-cache`                               | HTML must always check for updates    |
+| Everything else | `public, max-age=86400, must-revalidate` | 24-hour cache with revalidation       |
 
 ### Status Endpoint
 
 The `/status` endpoint returns a JSON object:
 
-| Field | Type | Description |
-| --- | --- | --- |
-| `uptime` | string | Human-readable server uptime, measured from `startedAt` |
-| `startedAt` | string | ISO timestamp of the server start; all the "since last restart" counters below are measured from this moment |
-| `sessions` | number | Distinct verified sessions since last restart, which the two per-session averages below divide by |
-| `activeSessions` | number | Sessions still in the cache, dropped after 30 idle minutes |
-| `textualSearches` | number | Text search count since last restart |
-| `graphicalSearches` | number | Image search count since last restart |
-| `averageTextualSearchesPerSession` | number | Text searches / sessions ratio |
-| `averageGraphicalSearchesPerSession` | number | Image searches / sessions ratio |
-| `searchesWithoutResults` | number | Searches, text and image together, that SearXNG answered with zero results and no unresponsive engines |
-| `searchesWithUnresponsiveEngines` | number | Searches, text and image together, that came back with zero results and unresponsive engines, whether the retries were spent or an all-suspended set failed fast; one per search, not per attempt |
-| `searchesWithAllResultsDiscarded` | number | Text searches whose results were all dropped during processing |
-| `searchesServedByFallback` | number | Text searches answered by the fallback source after SearXNG failed |
-| `searchesFailedOnFallback` | number | Fallback searches that failed, plus searches where SearXNG's own retries had left too little of the search deadline for the fallback to be asked at all. A rising count is therefore not by itself a sign that the fallback providers are failing |
-| `biEncoderServiceStatus` | string | `"healthy"` or `"unhealthy"` |
-| `rerankerServiceStatus` | string | `"healthy"` or `"unhealthy"` |
-| `webSearchServiceStatus` | string | `"healthy"`, `"degraded"` or `"unhealthy"`, see below |
-| `pageReads` | object | Page-reading counters since last restart, see below |
-| `authorization` | object | Token and rate-limit outcomes since last restart, see below |
-| `inference` | object | AI answer counters since last restart, see below |
-| `searches` | object | Search timing, circuit state and per-engine failures, see below |
-| `reranker` | object | Reranking cost and effect, see below |
-| `thumbnails` | object | `/thumbnail` request outcomes, see below |
-| `build.timestamp` | string | ISO 8601 build time |
-| `build.gitCommit` | string | Short Git commit hash |
+| Field                                | Type   | Description                                                                                                                                                                                                                                       |
+| ------------------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `uptime`                             | string | Human-readable server uptime, measured from `startedAt`                                                                                                                                                                                           |
+| `startedAt`                          | string | ISO timestamp of the server start; all the "since last restart" counters below are measured from this moment                                                                                                                                      |
+| `sessions`                           | number | Distinct verified sessions since last restart, which the two per-session averages below divide by                                                                                                                                                 |
+| `activeSessions`                     | number | Sessions still in the cache, dropped after 30 idle minutes                                                                                                                                                                                        |
+| `textualSearches`                    | number | Text search count since last restart                                                                                                                                                                                                              |
+| `graphicalSearches`                  | number | Image search count since last restart                                                                                                                                                                                                             |
+| `averageTextualSearchesPerSession`   | number | Text searches / sessions ratio                                                                                                                                                                                                                    |
+| `averageGraphicalSearchesPerSession` | number | Image searches / sessions ratio                                                                                                                                                                                                                   |
+| `searchesWithoutResults`             | number | Searches, text and image together, that SearXNG answered with zero results and no unresponsive engines                                                                                                                                            |
+| `searchesWithUnresponsiveEngines`    | number | Searches, text and image together, that came back with zero results and unresponsive engines, whether the retries were spent or an all-suspended set failed fast; one per search, not per attempt                                                 |
+| `searchesWithAllResultsDiscarded`    | number | Text searches whose results were all dropped during processing                                                                                                                                                                                    |
+| `searchesServedByFallback`           | number | Text searches answered by the fallback source after SearXNG failed                                                                                                                                                                                |
+| `searchesFailedOnFallback`           | number | Fallback searches that failed, plus searches where SearXNG's own retries had left too little of the search deadline for the fallback to be asked at all. A rising count is therefore not by itself a sign that the fallback providers are failing |
+| `biEncoderServiceStatus`             | string | `"healthy"` or `"unhealthy"`                                                                                                                                                                                                                      |
+| `rerankerServiceStatus`              | string | `"healthy"` or `"unhealthy"`                                                                                                                                                                                                                      |
+| `webSearchServiceStatus`             | string | `"healthy"`, `"degraded"` or `"unhealthy"`, see below                                                                                                                                                                                             |
+| `pageReads`                          | object | Page-reading counters since last restart, see below                                                                                                                                                                                               |
+| `authorization`                      | object | Token and rate-limit outcomes since last restart, see below                                                                                                                                                                                       |
+| `inference`                          | object | AI answer counters since last restart, see below                                                                                                                                                                                                  |
+| `searches`                           | object | Search timing, circuit state and per-engine failures, see below                                                                                                                                                                                   |
+| `reranker`                           | object | Reranking cost and effect, see below                                                                                                                                                                                                              |
+| `thumbnails`                         | object | `/thumbnail` request outcomes, see below                                                                                                                                                                                                          |
+| `build.timestamp`                    | string | ISO 8601 build time                                                                                                                                                                                                                               |
+| `build.gitCommit`                    | string | Short Git commit hash                                                                                                                                                                                                                             |
 
 `webSearchServiceStatus` answers whether searches can be served, which
 SearXNG's `/healthz` alone does not: an open circuit fails every search without
@@ -301,27 +293,27 @@ loaded is a later, per-tile failure, handled when the client fetches it from
 is attached to a constant that someone will want to move, which is the reason it
 is counted at all (see `docs/page-content.md`):
 
-| Field | Type | Tunes |
-| --- | --- | --- |
-| `requested` | number | Nothing; the denominator for the rest |
-| `read` | number | Nothing; how often the feature contributed anything |
-| `readRate` | number | Nothing; `read` as a percentage of `requested` |
-| `averageReadMs` | number | `REQUEST_TIMEOUT_MS`, including the reads that hit it |
-| `bodiesTruncated` | number | `MAX_RESPONSE_BYTES` |
-| `excerptKeptRate` | number | `MAX_PAGE_CHARS` and the 0.9 dedup threshold, as the share of pooled passages that survive |
-| `circuitOpens` | number | `failureThreshold` on the page-read host breaker: how often a host was boxed, summed over every host, since no host is named |
-| `skipped.blocked` | number | The SSRF guard, and how often callers aim at private space |
-| `skipped.skippedByBreaker` | number | `resetTimeout` on the host breaker: reads refused on the server because the host had refused the last three, which is what the box saved |
-| `skipped.notADocument` | number | `READABLE_CONTENT_TYPES` |
-| `skipped.httpForbidden` | number | Bot walls and rate limits (401, 403, 429) |
-| `skipped.httpNotFound` | number | Dead links (404, 410) |
-| `skipped.httpOtherError` | number | Other non-ok HTTP statuses |
-| `skipped.redirectLimit` | number | `MAX_REDIRECTS` |
-| `skipped.timedOut` | number | `REQUEST_TIMEOUT_MS` |
-| `skipped.tooLittleText` | number | `MIN_USEFUL_CHARS`, and the extractor's selectors |
-| `skipped.failed` | number | Nothing; the residue worth watching for a pattern |
-| `grounding.requests` | number | Nothing; the denominator for the two below |
-| `grounding.withContent` | number | Nothing; requests where at least one page yielded text |
+| Field                      | Type   | Tunes                                                                                                                                                            |
+| -------------------------- | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `requested`                | number | Nothing; the denominator for the rest                                                                                                                            |
+| `read`                     | number | Nothing; how often the feature contributed anything                                                                                                              |
+| `readRate`                 | number | Nothing; `read` as a percentage of `requested`                                                                                                                   |
+| `averageReadMs`            | number | `REQUEST_TIMEOUT_MS`, including the reads that hit it                                                                                                            |
+| `bodiesTruncated`          | number | `MAX_RESPONSE_BYTES`                                                                                                                                             |
+| `excerptKeptRate`          | number | `MAX_PAGE_CHARS` and the 0.9 dedup threshold, as the share of pooled passages that survive                                                                       |
+| `circuitOpens`             | number | `failureThreshold` on the page-read host breaker: how often a host was boxed, summed over every host, since no host is named                                     |
+| `skipped.blocked`          | number | The SSRF guard, and how often callers aim at private space                                                                                                       |
+| `skipped.skippedByBreaker` | number | `resetTimeout` on the host breaker: reads refused on the server because the host had refused the last three, which is what the box saved                         |
+| `skipped.notADocument`     | number | `READABLE_CONTENT_TYPES`                                                                                                                                         |
+| `skipped.httpForbidden`    | number | Bot walls and rate limits (401, 403, 429)                                                                                                                        |
+| `skipped.httpNotFound`     | number | Dead links (404, 410)                                                                                                                                            |
+| `skipped.httpOtherError`   | number | Other non-ok HTTP statuses                                                                                                                                       |
+| `skipped.redirectLimit`    | number | `MAX_REDIRECTS`                                                                                                                                                  |
+| `skipped.timedOut`         | number | `REQUEST_TIMEOUT_MS`                                                                                                                                             |
+| `skipped.tooLittleText`    | number | `MIN_USEFUL_CHARS`, and the extractor's selectors                                                                                                                |
+| `skipped.failed`           | number | Nothing; the residue worth watching for a pattern                                                                                                                |
+| `grounding.requests`       | number | Nothing; the denominator for the two below                                                                                                                       |
+| `grounding.withContent`    | number | Nothing; requests where at least one page yielded text                                                                                                           |
 | `grounding.withoutContent` | number | The budgets and timeouts above, read per request instead of per page: six pages at a 50% read rate can be three fully grounded answers or six half-grounded ones |
 
 `read` plus every `skipped` entry sums to `requested`, so a page that goes
@@ -337,18 +329,18 @@ nobody asked for an answer, not that nothing could be read.
 verification, the funnel `/search/text`, `/search/images`, `/page-content` and
 `/inference` all pass through:
 
-| Field | Type | Says |
-| --- | --- | --- |
-| `requests` | number | Requests that reached verification; the denominator for the rest |
-| `authorized` | number | Requests that passed it |
-| `rejectedRate` | number | Rejections as a percentage of `requests` |
-| `reasons.rateLimited` | number | Refused by the limiter before anything else ran |
-| `reasons.missingToken` | number | No token on the request, which is what an outdated client looks like |
-| `reasons.invalidToken` | number | A token that failed verification, which is what probing looks like |
-| `bySurface` | object | `authorized` and `rejected` per endpoint family: `search`, `pageContent`, `thumbnail`, `inference`, `other` |
-| `rejectedTokenCacheHits` | number | Rejections served from the rejected-token cache without a second argon2 verification |
+| Field                    | Type   | Says                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ------------------------ | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `requests`               | number | Requests that reached verification; the denominator for the rest                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `authorized`             | number | Requests that passed it                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `rejectedRate`           | number | Rejections as a percentage of `requests`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `reasons.rateLimited`    | number | Refused by the limiter before anything else ran                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `reasons.missingToken`   | number | No token on the request, which is what an outdated client looks like                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `reasons.invalidToken`   | number | A token that failed verification, which is what probing looks like                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `bySurface`              | object | `authorized` and `rejected` per endpoint family: `search`, `pageContent`, `thumbnail`, `inference`, `other`                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `rejectedTokenCacheHits` | number | Rejections served from the rejected-token cache without a second argon2 verification                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | `distinctRejectedTokens` | number | Distinct tokens the rejected-token cache holds, at most 1024. Only well-formed tokens that failed argon2 verification enter it; a token without the expected hash prefix is refused before that and never counted. A high `reasons.invalidToken` with a value of 1 here is one client replaying one dead token. A value that keeps growing is either many stale links or one caller sending fresh junk hashes, which the limiter caps per IP. The set only empties on a restart and evicts its oldest entry when full, so a value of 1024 means 1024 or more |
-| `limiter` | object | The shared limiter's `points` and `durationSeconds`, plus the separate `thumbnail` budget behind `/thumbnail`, without which a rejection count says nothing |
+| `limiter`                | object | The shared limiter's `points` and `durationSeconds`, plus the separate `thumbnail` budget behind `/thumbnail`, without which a rejection count says nothing                                                                                                                                                                                                                                                                                                                                                                                                  |
 
 `authorized` plus every entry of `reasons` sums to `requests`, and each half of
 `bySurface` sums to its side of that, on the same principle as `pageReads`.
@@ -368,27 +360,27 @@ pays for it running out.
 `/inference`. Nothing about the conversation is kept, so the questions it can
 answer are about the upstream and about the wait, not about what was asked:
 
-| Field | Type | Says |
-| --- | --- | --- |
-| `requests` | number | Requests that passed token verification; the denominator for the rest |
-| `streamed` | number | Answers that finished normally |
-| `streamedRate` | number | `streamed` as a percentage of `requests` |
-| `averageTimeToFirstTokenMs` | number | The wait the user actually feels, over the answers that produced a token |
-| `averageDurationMs` | number | Whole-request duration over every outcome, so a 2 ms rejected body and a 25 s answer land in the same average |
-| `averageAttempts` | number | Models tried, over the requests that reached the model loop; above 1 means the pool is carrying failures |
-| `modelFallbacks` | number | Times a retry moved to another model |
-| `modelsRefetched` | number | Times the model pool was re-listed mid-retry |
-| `streamsEndedWithoutFinish` | number | Attempts whose stream closed with no finish part, counted per attempt because the retry can still succeed |
-| `failed.failedBeforeFirstToken` | number | Every model failed before a token was sent, answered 503 |
-| `failed.failedMidStream` | number | The answer broke after content was already sent, so no retry was possible |
-| `failed.abandoned` | number | The client was gone before or during the answer; the only outcome with no response to observe it by |
-| `failed.badRequest` | number | Body too large, unparsable, or failing the schema |
-| `failed.notConfigured` | number | `INTERNAL_OPENAI_COMPATIBLE_API_BASE_URL` or its key is missing |
-| `failed.modelListUnavailable` | number | The upstream's model list could not be fetched |
-| `failed.noModelAvailable` | number | The list was fetched and held nothing usable |
-| `failed.internalError` | number | Anything the handler did not expect |
-| `failed.unclassified` | number | Should always be zero; a non-zero value means a path stopped reporting its outcome |
-| `byModel` | object | `attempted`, `streamed`, `failed` and `abandoned` per model id, which is how a dead member of the pool becomes visible. `attempted` equals the other three added up |
+| Field                           | Type   | Says                                                                                                                                                                |
+| ------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `requests`                      | number | Requests that passed token verification; the denominator for the rest                                                                                               |
+| `streamed`                      | number | Answers that finished normally                                                                                                                                      |
+| `streamedRate`                  | number | `streamed` as a percentage of `requests`                                                                                                                            |
+| `averageTimeToFirstTokenMs`     | number | The wait the user actually feels, over the answers that produced a token                                                                                            |
+| `averageDurationMs`             | number | Whole-request duration over every outcome, so a 2 ms rejected body and a 25 s answer land in the same average                                                       |
+| `averageAttempts`               | number | Models tried, over the requests that reached the model loop; above 1 means the pool is carrying failures                                                            |
+| `modelFallbacks`                | number | Times a retry moved to another model                                                                                                                                |
+| `modelsRefetched`               | number | Times the model pool was re-listed mid-retry                                                                                                                        |
+| `streamsEndedWithoutFinish`     | number | Attempts whose stream closed with no finish part, counted per attempt because the retry can still succeed                                                           |
+| `failed.failedBeforeFirstToken` | number | Every model failed before a token was sent, answered 503                                                                                                            |
+| `failed.failedMidStream`        | number | The answer broke after content was already sent, so no retry was possible                                                                                           |
+| `failed.abandoned`              | number | The client was gone before or during the answer; the only outcome with no response to observe it by                                                                 |
+| `failed.badRequest`             | number | Body too large, unparsable, or failing the schema                                                                                                                   |
+| `failed.notConfigured`          | number | `INTERNAL_OPENAI_COMPATIBLE_API_BASE_URL` or its key is missing                                                                                                     |
+| `failed.modelListUnavailable`   | number | The upstream's model list could not be fetched                                                                                                                      |
+| `failed.noModelAvailable`       | number | The list was fetched and held nothing usable                                                                                                                        |
+| `failed.internalError`          | number | Anything the handler did not expect                                                                                                                                 |
+| `failed.unclassified`           | number | Should always be zero; a non-zero value means a path stopped reporting its outcome                                                                                  |
+| `byModel`                       | object | `attempted`, `streamed`, `failed` and `abandoned` per model id, which is how a dead member of the pool becomes visible. `attempted` equals the other three added up |
 
 `streamed` plus every `failed` entry sums to `requests`. A request refused at
 token verification is not counted here, since `authorization` above already
@@ -412,27 +404,27 @@ nothing new.
 in the search path. Each row names the constant it is there to move, the same
 way `pageReads` does:
 
-| Field | Type | Tunes |
-| --- | --- | --- |
-| `searches.averageTextualMs` | number | The 30 s client timeout in `client/modules/search.ts`. Over the text searches SearXNG answered, so a failed or short-circuited one is not in it, and up to 7 s of retry backoff is |
-| `searches.averageGraphicalMs` | number | The same, for image searches |
-| `reranker.considered` | number | Nothing; results handed to the score filter, the denominator for `keptRate` |
-| `reranker.kept` | number | Nothing; results that survived it |
-| `searches.circuitState` | string | Nothing; whether searches are being short-circuited right now |
-| `searches.degradedSearchTypes` | array | Nothing; which of `text` and `images` is currently flagged, so a `degraded` verdict says which engine pool it is about. Empty when the half-open circuit is what triggered the verdict, which `circuitState` in the same object names |
-| `searches.circuitOpens` | number | `failureThreshold` and `resetTimeout` on the SearXNG breaker: each opening is a minute of serving no searches at all |
-| `searches.unresponsiveEngines` | object | Nothing; `failures` and `lastFailure` per engine name, which is how one engine timing out is told apart from every engine being CAPTCHA-blocked. `lastFailure` is `blocked` (a CAPTCHA, a rate limit or an access denial), `timeout` or `other`, never SearXNG's own wording, which is free-form text from an upstream engine and does not belong on an endpoint that needs no token. Counted on the searches `searchesWithUnresponsiveEngines` counts, so a search that recovered on a retry is not in it |
-| `searches.fallbackProviders` | object | Whether each fallback provider earns its place, and whether one needs an API key: per provider name, `served`, `empty`, `failed`, `rateLimited` (answered `429`, and also counted in `failed`) and `skippedWhilePaused` counts, plus `pausedForMs`, the time left on its current `429` pause (`0` when not paused). A steady `rateLimited` count on a keyless provider is the cue to set its key (see `docs/configuration.md`). Provider names are configured infrastructure, not user input |
-| `reranker.reranks` | number | Nothing; the denominator for the rest |
-| `reranker.averageMs` | number | Whether reranking or SearXNG is what users wait for, and so whether to rerank a shortlist instead of all 30 results. Over `reranks`, covering the filtering and sorting as well as the model |
-| `reranker.keptRate` | number | `kStandardDeviationFactor`: near 100% means the filter is not filtering. Text and image reranks are pooled, and the two run through different paths, so this moves with the traffic mix as well as with the threshold |
-| `reranker.byType.text`, `reranker.byType.images` | object | Each reports `reranks`, `averageMs`, `considered`, `kept` and `keptRate` for its search type; see `docs/reranking.md`. The existing top-level values remain combined totals |
-| `reranker.fallbackApplied` | number | `minPercentageFallback`: a large share means the deviation threshold is emptying batches the fallback then has to rescue |
-| `reranker.skippedUnhealthy` | number | Nothing; searches served in SearXNG's own order because the model was not loaded |
-| `reranker.failed` | number | Nothing; the same, because reranking threw |
-| `thumbnails.requested` | number | Nothing; the denominator for the two below; every verified `/thumbnail` request, cache hits included. Before the endpoint existed this counted image results in a search response, so the served share cannot be trended across that deploy |
-| `thumbnails.dropped` | number | Every request that did not serve a tile: timeout, a non-raster or empty answer, or an address the guard refused (`MAX_THUMBNAIL_BYTES` is not one of these, a capped body is truncated and served): each is a tile the user saw as a placeholder |
-| `thumbnails.blocked` | number | The SSRF guard, as the share of thumbnails whose host is in private space or does not resolve |
+| Field                                            | Type   | Tunes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| ------------------------------------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `searches.averageTextualMs`                      | number | The 30 s client timeout in `client/modules/search.ts`. Over the text searches SearXNG answered, so a failed or short-circuited one is not in it, and up to 7 s of retry backoff is                                                                                                                                                                                                                                                                                                                         |
+| `searches.averageGraphicalMs`                    | number | The same, for image searches                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `reranker.considered`                            | number | Nothing; results handed to the score filter, the denominator for `keptRate`                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `reranker.kept`                                  | number | Nothing; results that survived it                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `searches.circuitState`                          | string | Nothing; whether searches are being short-circuited right now                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `searches.degradedSearchTypes`                   | array  | Nothing; which of `text` and `images` is currently flagged, so a `degraded` verdict says which engine pool it is about. Empty when the half-open circuit is what triggered the verdict, which `circuitState` in the same object names                                                                                                                                                                                                                                                                      |
+| `searches.circuitOpens`                          | number | `failureThreshold` and `resetTimeout` on the SearXNG breaker: each opening is a minute of serving no searches at all                                                                                                                                                                                                                                                                                                                                                                                       |
+| `searches.unresponsiveEngines`                   | object | Nothing; `failures` and `lastFailure` per engine name, which is how one engine timing out is told apart from every engine being CAPTCHA-blocked. `lastFailure` is `blocked` (a CAPTCHA, a rate limit or an access denial), `timeout` or `other`, never SearXNG's own wording, which is free-form text from an upstream engine and does not belong on an endpoint that needs no token. Counted on the searches `searchesWithUnresponsiveEngines` counts, so a search that recovered on a retry is not in it |
+| `searches.fallbackProviders`                     | object | Whether each fallback provider earns its place, and whether one needs an API key: per provider name, `served`, `empty`, `failed`, `rateLimited` (answered `429`, and also counted in `failed`) and `skippedWhilePaused` counts, plus `pausedForMs`, the time left on its current `429` pause (`0` when not paused). A steady `rateLimited` count on a keyless provider is the cue to set its key (see `docs/configuration.md`). Provider names are configured infrastructure, not user input               |
+| `reranker.reranks`                               | number | Nothing; the denominator for the rest                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `reranker.averageMs`                             | number | Whether reranking or SearXNG is what users wait for, and so whether to rerank a shortlist instead of all 30 results. Over `reranks`, covering the filtering and sorting as well as the model                                                                                                                                                                                                                                                                                                               |
+| `reranker.keptRate`                              | number | `kStandardDeviationFactor`: near 100% means the filter is not filtering. Text and image reranks are pooled, and the two run through different paths, so this moves with the traffic mix as well as with the threshold                                                                                                                                                                                                                                                                                      |
+| `reranker.byType.text`, `reranker.byType.images` | object | Each reports `reranks`, `averageMs`, `considered`, `kept` and `keptRate` for its search type; see `docs/reranking.md`. The existing top-level values remain combined totals                                                                                                                                                                                                                                                                                                                                |
+| `reranker.fallbackApplied`                       | number | `minPercentageFallback`: a large share means the deviation threshold is emptying batches the fallback then has to rescue                                                                                                                                                                                                                                                                                                                                                                                   |
+| `reranker.skippedUnhealthy`                      | number | Nothing; searches served in SearXNG's own order because the model was not loaded                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `reranker.failed`                                | number | Nothing; the same, because reranking threw                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `thumbnails.requested`                           | number | Nothing; the denominator for the two below; every verified `/thumbnail` request, cache hits included. Before the endpoint existed this counted image results in a search response, so the served share cannot be trended across that deploy                                                                                                                                                                                                                                                                |
+| `thumbnails.dropped`                             | number | Every request that did not serve a tile: timeout, a non-raster or empty answer, or an address the guard refused (`MAX_THUMBNAIL_BYTES` is not one of these, a capped body is truncated and served): each is a tile the user saw as a placeholder                                                                                                                                                                                                                                                           |
+| `thumbnails.blocked`                             | number | The SSRF guard, as the share of thumbnails whose host is in private space or does not resolve                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 `thumbnails.dropped` includes the blocked ones, so `requested` minus `dropped`
 is what reached the client.
@@ -444,22 +436,20 @@ MiniSearch uses a multi-layered client-side persistence strategy:
 ### IndexedDB Databases
 
 Two separate Dexie databases handle different persistence needs:
-
 1. **SearchCacheDatabase** (`client/modules/search.ts`): Temporary cache for search results with TTL-based expiration. Table schema:
    - `textSearchHistory`: Keyed by hashed query, indexed by timestamp
    - `imageSearchHistory`: Keyed by hashed query, indexed by timestamp
    - Cache config:
 
-| Constant | Value | Description |
-| ---------- | ------- | ------------- |
-| TTL | 15 minutes | Freshness window: a hit inside it skips the network |
-| MAX_STALE_RETENTION | 24 hours | How long an expired entry is kept, so a failed live search can still serve it flagged stale |
-| MAX_ENTRIES | 100 | Maximum cached queries per store |
-| ENABLED | true | Global cache toggle |
-| PRUNE_INTERVAL | 10 | Cache writes between LRU prune passes |
-| METRICS_LOG_INTERVAL | 10 | Operations between hit-rate log entries |
-| REQUEST_TIMEOUT | 30,000 ms | Fetch timeout |
-
+| Constant             | Value      | Description                                                                                 |
+| -------------------- | ---------- | ------------------------------------------------------------------------------------------- |
+| TTL                  | 15 minutes | Freshness window: a hit inside it skips the network                                         |
+| MAX_STALE_RETENTION  | 24 hours   | How long an expired entry is kept, so a failed live search can still serve it flagged stale |
+| MAX_ENTRIES          | 100        | Maximum cached queries per store                                                            |
+| ENABLED              | true       | Global cache toggle                                                                         |
+| PRUNE_INTERVAL       | 10         | Cache writes between LRU prune passes                                                       |
+| METRICS_LOG_INTERVAL | 10         | Operations between hit-rate log entries                                                     |
+| REQUEST_TIMEOUT      | 30,000 ms  | Fetch timeout                                                                               |
 - Query hashing: djb2 XOR Murmur algorithm for cache key generation
 - Management operations: `cleanExpiredCache`, `pruneCache`, `ensureIntegrity`
 - Performance monitoring: `cacheMetrics` tracks hit/miss rates for text and image searches
@@ -473,7 +463,6 @@ Two separate Dexie databases handle different persistence needs:
 ### localStorage Persistence
 
 Lightweight state persisted across sessions via `createLocalStoragePubSub` pattern:
-
 - `settings`: Application preferences (inference type, model, UI options)
 - `querySuggestions`: Shuffled search suggestion pool
 - `lastSearchTokenHash`: Cached security token hash

docs/page-content.md

@@ -10,8 +10,8 @@ passages that match the query into the prompt.
 
 One switch controls the feature, and it is on by default:
 
-| Switch | Who sets it | What it does |
-|---|---|---|
+| Switch                | Who sets it                 | What it does                                            |
+| --------------------- | --------------------------- | ------------------------------------------------------- |
 | **Read Page Content** | The user, under AI Settings | Whether this browser reads the pages behind its results |
 
 The endpoint is always available; the user toggle decides whether each browser
@@ -145,12 +145,12 @@ the passage about how long cats sleep.
 The interface is in English; the searches are not. Ranking therefore avoids
 anything written for one language:
 
-| Concern | How it is handled | Why not the obvious thing |
-| --- | --- | --- |
-| Word boundaries | `Intl.Segmenter`, word granularity | `[^\p{L}\p{N}]+` cut Brahmic scripts and Thai at every combining vowel mark and dropped the marks, and it finds no boundary at all in Chinese, Japanese or Thai, which write none: a whole sentence arrived as one token that matched nothing, scoring fell through to document order, and the page's own navigation won |
-| Sentence boundaries | `Intl.Segmenter`, sentence granularity | `[.!?]` never matches `。`, `！`, `？` or `।`, so long CJK and Indic blocks were cut at an arbitrary character mid-sentence |
-| Uninformative words | Inverse document frequency over the pooled passages of all pages read for the search | A stop-word list only covers the language it was written in. A term found in most passages of a pool cannot say which passage to quote, in any language, and this needs no word list and no language detection |
-| Inflection | A query term and a page word match when one is a prefix of the other, from 3 characters and within 3 | Stripping `-ing`, `-es`, `-s` is English morphology applied to every language: it turned the Portuguese `mães` into `mã` and never matched `mãe` |
+| Concern             | How it is handled                                                                                    | Why not the obvious thing                                                                                                                                                                                                                                                                                                |
+| ------------------- | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Word boundaries     | `Intl.Segmenter`, word granularity                                                                   | `[^\p{L}\p{N}]+` cut Brahmic scripts and Thai at every combining vowel mark and dropped the marks, and it finds no boundary at all in Chinese, Japanese or Thai, which write none: a whole sentence arrived as one token that matched nothing, scoring fell through to document order, and the page's own navigation won |
+| Sentence boundaries | `Intl.Segmenter`, sentence granularity                                                               | `[.!?]` never matches `。`, `！`, `？` or `।`, so long CJK and Indic blocks were cut at an arbitrary character mid-sentence                                                                                                                                                                                              |
+| Uninformative words | Inverse document frequency over the pooled passages of all pages read for the search                 | A stop-word list only covers the language it was written in. A term found in most passages of a pool cannot say which passage to quote, in any language, and this needs no word list and no language detection                                                                                                           |
+| Inflection          | A query term and a page word match when one is a prefix of the other, from 3 characters and within 3 | Stripping `-ing`, `-es`, `-s` is English morphology applied to every language: it turned the Portuguese `mães` into `mã` and never matched `mãe`                                                                                                                                                                         |
 
 Both segmenters are script-driven, so the locale is left unset and the result
 is the same on every host.
@@ -188,22 +188,22 @@ anything.
 
 ## Budgets and Limits
 
-| Limit | Value | Where |
-| --- | --- | --- |
-| Pages read per search | 6 | `searchResultsToConsider`, mirrored by `MAX_URLS` in the endpoint |
-| Per-page deadline, redirects included | 6 s | `REQUEST_TIMEOUT_MS` |
-| Redirects followed | 3, each re-validated | `MAX_REDIRECTS` |
-| Refusals before a host is skipped | 3 in a row | `failureThreshold` in `server/pageReadHostBreaker.ts` |
-| How long a skipped host stays skipped | 5 minutes, then one probe read | `resetTimeout` in `server/pageReadHostBreaker.ts` |
-| Body read per page | 1.5 MB | `MAX_RESPONSE_BYTES` |
-| Excerpt cap per URL | 6,000 characters | `MAX_PAGE_CHARS`, `selectPassagesAcrossPages` |
-| Global excerpt budget | `MAX_PAGE_CHARS × pages` | `fetchPageContents` |
-| Near-duplicate threshold | 0.9 Jaccard | `JACCARD_THRESHOLD` |
-| Minimum usable text | 200 characters | `MIN_USEFUL_CHARS` |
-| Passage size | 180-1,200 characters | `MIN_PASSAGE_CHARS`, `MAX_PASSAGE_CHARS` |
-| Excerpt share of the context | 35% | `pageContentTokenBudgetRatio` |
-| Context assumed | `openAiContextLength` on the OpenAI-compatible backend, 4,096 elsewhere | `getPageContentTokenBudget` |
-| Whole-request timeout (client) | 20 s | `REQUEST_TIMEOUT` in `client/modules/pageContent.ts` |
+| Limit                                 | Value                                                                   | Where                                                             |
+| ------------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| Pages read per search                 | 6                                                                       | `searchResultsToConsider`, mirrored by `MAX_URLS` in the endpoint |
+| Per-page deadline, redirects included | 6 s                                                                     | `REQUEST_TIMEOUT_MS`                                              |
+| Redirects followed                    | 3, each re-validated                                                    | `MAX_REDIRECTS`                                                   |
+| Refusals before a host is skipped     | 3 in a row                                                              | `failureThreshold` in `server/pageReadHostBreaker.ts`             |
+| How long a skipped host stays skipped | 5 minutes, then one probe read                                          | `resetTimeout` in `server/pageReadHostBreaker.ts`                 |
+| Body read per page                    | 1.5 MB                                                                  | `MAX_RESPONSE_BYTES`                                              |
+| Excerpt cap per URL                   | 6,000 characters                                                        | `MAX_PAGE_CHARS`, `selectPassagesAcrossPages`                     |
+| Global excerpt budget                 | `MAX_PAGE_CHARS × pages`                                                | `fetchPageContents`                                               |
+| Near-duplicate threshold              | 0.9 Jaccard                                                             | `JACCARD_THRESHOLD`                                               |
+| Minimum usable text                   | 200 characters                                                          | `MIN_USEFUL_CHARS`                                                |
+| Passage size                          | 180-1,200 characters                                                    | `MIN_PASSAGE_CHARS`, `MAX_PASSAGE_CHARS`                          |
+| Excerpt share of the context          | 35%                                                                     | `pageContentTokenBudgetRatio`                                     |
+| Context assumed                       | `openAiContextLength` on the OpenAI-compatible backend, 4,096 elsewhere | `getPageContentTokenBudget`                                       |
+| Whole-request timeout (client)        | 20 s                                                                    | `REQUEST_TIMEOUT` in `client/modules/pageContent.ts`              |
 
 The token budget is shared across pages, served shortest-first: a page that
 needs less than its share leaves the rest to the others, and only pages that
@@ -327,21 +327,21 @@ under `pageReads` on `/status` and reset by a restart. Every one of them is
 attached to a constant in the table above, so the question they answer is "is
 this limit set where it should be", not "who read what":
 
-| Counter | The question it settles |
-| --- | --- |
-| `readRate` | Is the feature worth its latency at all |
-| `averageReadMs` | Is a 6 s deadline generous or stingy |
-| `skipped.timedOut` | How much is being lost to that deadline |
-| `skipped.tooLittleText` | Is the 200-character floor discarding real pages, or is the extractor missing their text |
-| `skipped.notADocument` | Are useful content types being turned away |
-| `skipped.blocked` | Are callers aiming at private space, deliberately or otherwise |
-| `skipped.httpForbidden` | How often bot walls or rate limits turn the instance away (401, 403, 429) |
-| `skipped.httpNotFound` | How often results point to dead links (404, 410) |
-| `skipped.httpOtherError` | How often hosts return other non-ok HTTP statuses |
-| `skipped.skippedByBreaker` | How many reads the host breaker saved, which is what its five-minute window is worth |
-| `circuitOpens` | How often a host was boxed, across every host: thirty skips can be one host boxed for a window or thirty hosts boxed once, and those move the threshold in different directions |
-| `bodiesTruncated` | Is the 1.5 MB body cap biting |
-| `excerptKeptRate` | How much of a page the per-URL cap and dedup keep |
+| Counter                    | The question it settles                                                                                                                                                         |
+| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `readRate`                 | Is the feature worth its latency at all                                                                                                                                         |
+| `averageReadMs`            | Is a 6 s deadline generous or stingy                                                                                                                                            |
+| `skipped.timedOut`         | How much is being lost to that deadline                                                                                                                                         |
+| `skipped.tooLittleText`    | Is the 200-character floor discarding real pages, or is the extractor missing their text                                                                                        |
+| `skipped.notADocument`     | Are useful content types being turned away                                                                                                                                      |
+| `skipped.blocked`          | Are callers aiming at private space, deliberately or otherwise                                                                                                                  |
+| `skipped.httpForbidden`    | How often bot walls or rate limits turn the instance away (401, 403, 429)                                                                                                       |
+| `skipped.httpNotFound`     | How often results point to dead links (404, 410)                                                                                                                                |
+| `skipped.httpOtherError`   | How often hosts return other non-ok HTTP statuses                                                                                                                               |
+| `skipped.skippedByBreaker` | How many reads the host breaker saved, which is what its five-minute window is worth                                                                                            |
+| `circuitOpens`             | How often a host was boxed, across every host: thirty skips can be one host boxed for a window or thirty hosts boxed once, and those move the threshold in different directions |
+| `bodiesTruncated`          | Is the 1.5 MB body cap biting                                                                                                                                                   |
+| `excerptKeptRate`          | How much of a page the per-URL cap and dedup keep                                                                                                                               |
 
 A counter can only be read in aggregate, so a single search cannot be recovered
 from it. The weakest point is an instance nobody else is using, where one search
@@ -353,21 +353,21 @@ failed, never which pages or what was asked.
 Every failure degrades to the snippet-only prompt, which is what the answer was
 grounded on before:
 
-| Failure | Result |
-| --- | --- |
-| Host resolves privately, or the scheme is not HTTP | That page is skipped, no request is made (`blocked`) |
-| Page times out or redirects fail | That page is skipped (`timedOut`, `redirectLimit`, `failed`) |
-| Page is not an HTML/PDF document | That page is skipped (`notADocument`) |
-| Bot wall, rate limit, or auth required (401, 403, 429) | That page is skipped (`httpForbidden`) |
-| Dead link (404, 410) | That page is skipped (`httpNotFound`) |
-| Other HTTP error (5xx, other non-ok status) | That page is skipped (`httpOtherError`) |
-| Host refused the last three reads | That page is skipped without a request for five minutes, then one read probes the host (`skippedByBreaker`) |
-| Page yields less than 200 characters | That page is skipped (`tooLittleText`) |
-| `/page-content` fails or times out | Answer falls back to snippets |
-| Setting turned off, or AI responses off | No page is ever read |
-| A newer search starts while pages are still being read | The late result is dropped instead of grounding the new answer |
-| Every passage on a page duplicates passages that ranked higher in the pooled order | That page keeps its snippet-only line; no empty excerpt block is emitted |
-| | The pooled ranking uses a per-passage position prior, so a later result can keep a paragraph the higher-ranked one carries further down its page. |
+| Failure                                                                            | Result                                                                                                                                            |
+| ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Host resolves privately, or the scheme is not HTTP                                 | That page is skipped, no request is made (`blocked`)                                                                                              |
+| Page times out or redirects fail                                                   | That page is skipped (`timedOut`, `redirectLimit`, `failed`)                                                                                      |
+| Page is not an HTML/PDF document                                                   | That page is skipped (`notADocument`)                                                                                                             |
+| Bot wall, rate limit, or auth required (401, 403, 429)                             | That page is skipped (`httpForbidden`)                                                                                                            |
+| Dead link (404, 410)                                                               | That page is skipped (`httpNotFound`)                                                                                                             |
+| Other HTTP error (5xx, other non-ok status)                                        | That page is skipped (`httpOtherError`)                                                                                                           |
+| Host refused the last three reads                                                  | That page is skipped without a request for five minutes, then one read probes the host (`skippedByBreaker`)                                       |
+| Page yields less than 200 characters                                               | That page is skipped (`tooLittleText`)                                                                                                            |
+| `/page-content` fails or times out                                                 | Answer falls back to snippets                                                                                                                     |
+| Setting turned off, or AI responses off                                            | No page is ever read                                                                                                                              |
+| A newer search starts while pages are still being read                             | The late result is dropped instead of grounding the new answer                                                                                    |
+| Every passage on a page duplicates passages that ranked higher in the pooled order | That page keeps its snippet-only line; no empty excerpt block is emitted                                                                          |
+|                                                                                    | The pooled ranking uses a per-passage position prior, so a later result can keep a paragraph the higher-ranked one carries further down its page. |
 
 ## Related Topics
 

docs/performance-profile-2571.md

@@ -22,10 +22,10 @@ once the full answer has rendered.
 
 ## Result
 
-| Build | Long tasks in the streaming window | Total main-thread time blocked | Longest single task |
-| --- | --- | --- | --- |
-| `main` (before) | 30, 31, 31, 32, 32 | 2008, 2050, 2143, 2149, 2207 ms | 108–186 ms |
-| All seven fixes merged (after) | 0, 0, 1, 1, 1 | 0, 0, 51, 52, 52 ms | ≤ 52 ms |
+| Build                          | Long tasks in the streaming window | Total main-thread time blocked  | Longest single task |
+| ------------------------------ | ---------------------------------- | ------------------------------- | ------------------- |
+| `main` (before)                | 30, 31, 31, 32, 32                 | 2008, 2050, 2143, 2149, 2207 ms | 108–186 ms          |
+| All seven fixes merged (after) | 0, 0, 1, 1, 1                      | 0, 0, 51, 52, 52 ms             | ≤ 52 ms             |
 
 Roughly **2.1 seconds of blocking main-thread work per streamed answer is gone**, and the worst
 single task drops from ~160–190 ms to at or below the 50 ms long-task reporting threshold — i.e.
@@ -33,13 +33,13 @@ after the change there is effectively nothing left to report.
 
 ## What removed what
 
-| Long task on `main` | Removed by |
-| --- | --- |
-| Full-markdown re-parse on every throttled frame (12 Hz), growing with the answer | `perf/memoized-markdown-blocks` — top-level blocks are memoized, so a frame that only extends the last block re-renders that block |
-| Shiki loading from `shiki/bundle/full` for the first code block | `perf/shiki-lazy-language-subset` — web subset, and a language outside it degrades without a load attempt |
+| Long task on `main`                                                                        | Removed by                                                                                                                                   |
+| ------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- |
+| Full-markdown re-parse on every throttled frame (12 Hz), growing with the answer           | `perf/memoized-markdown-blocks` — top-level blocks are memoized, so a frame that only extends the last block re-renders that block           |
+| Shiki loading from `shiki/bundle/full` for the first code block                            | `perf/shiki-lazy-language-subset` — web subset, and a language outside it degrades without a load attempt                                    |
 | One `resize` listener per citation link, each reading `scrollWidth` and calling `setState` | `perf/shared-resize-observer-citation-links` — one shared `ResizeObserver`, and the expand animates `transform`/`opacity` instead of `width` |
-| `gptTokenizer.encode()` over every full page body at the search-to-generation handoff | `perf/page-excerpt-tokenization-worker` — the tokenization runs in a worker, with a synchronous fallback |
-| Re-encoding the whole joined candidate per iteration in the rolling summary | `perf/incremental-rolling-summary-tokens` — each part encoded once, running count kept |
+| `gptTokenizer.encode()` over every full page body at the search-to-generation handoff      | `perf/page-excerpt-tokenization-worker` — the tokenization runs in a worker, with a synchronous fallback                                     |
+| Re-encoding the whole joined candidate per iteration in the rolling summary                | `perf/incremental-rolling-summary-tokens` — each part encoded once, running count kept                                                       |
 
 ## Reproducing
 

docs/project-structure.md

@@ -10,11 +10,10 @@
     - **`Logs/`**: Application logging and debug modal components
     - **`Pages/`**: Route-level page components
       - **`Main/`**: Main search interface with menu and settings
-    - **`Search/`**: Search functionality components
-      - **`Form/`**: Search input and form components
-      - **`History/`**: Search history and saved searches
-      - **`Results/`**: Search results display (textual and graphical)
-    - **`Settings/`**: Application settings and configuration
+        - **`Search/`**: Search functionality components
+          - **`Form/`**: Search input and form components
+          - **`History/`**: Search history and saved searches
+          - **`Results/`**: Search results display (textual and graphical) - **`Settings/`**: Application settings and configuration
   - **`hooks/`**: Custom React hooks
   - **`modules/`**: Core business logic (PubSub stores, search services, database layers)
   - **`public/`**: Static assets
@@ -37,37 +36,37 @@ This self-contained structure makes it easy for agents to understand and modify
 
 The `client/modules/` directory contains core business logic organized by domain:
 
-| Module | Purpose |
-|--------|---------|
-| `pubSub.ts` | All PubSub channels for state management |
-| `search.ts` | Search orchestration, caching, and reranking |
-| `textGeneration.ts` | AI response generation and chat handling |
-| `textGenerationWith*.ts` | Provider-specific inference implementations (Wllama, OpenAI, Horde, Internal API) |
-| `history.ts` | IndexedDB persistence for searches and chat |
-| `settings.ts` | Default settings and inference type definitions |
-| `followUpQuestions.ts` | Generates contextual follow-up questions |
-| `relatedSearchQuery.ts` | Creates related search queries from conversation |
-| `querySuggestions.ts` | Query suggestion UI data management |
-| `webGpu.ts` | WebGPU availability detection |
-| `wllama.ts` | Wllama model configuration and management |
-| `accessKey.ts` | Access key validation and storage |
-| `searchTokenHash.ts` | CSRF protection token generation |
-| `parentWindow.ts` | PostMessage API for parent window embedding |
-| `logEntries.ts` | Application logging with unique IDs |
-| `appInfo.ts` | Application metadata and version info |
-| `textToSpeech.ts` | Reads answers aloud: engine selection, fallback, and the playback queue |
-| `textToSpeechWorker.ts` | Synthesizes sentences off the main thread |
-| `textToSpeechWorkerProtocol.ts` | Message types shared by both sides of the worker |
-| `piper.ts` | The only module that imports `@diffusionstudio/vits-web` |
-| `speechToText.ts` | Dictation: microphone capture, the worker's lifecycle, and engine selection between the on-device model and `SpeechRecognition` |
-| `speechToTextWorker.ts` | Runs the Moonshine transcriber off the main thread |
-| `speechToTextWorkerProtocol.ts` | Message types shared by both sides of the dictation worker |
-| `moonshine.ts` | The only module that imports `@moonshine-ai/moonshine-wasm` |
-| `keyboard.ts` | Keyboard shortcut handling |
-| `pageContent.ts` | Requests extracted result-page text used to ground answers |
-| `systemPrompt.ts` | System prompt templates |
-| `stringFormatters.ts` | Text formatting utilities |
-| `types.ts` | Shared TypeScript type definitions |
+| Module                          | Purpose                                                                                                                         |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| `pubSub.ts`                     | All PubSub channels for state management                                                                                        |
+| `search.ts`                     | Search orchestration, caching, and reranking                                                                                    |
+| `textGeneration.ts`             | AI response generation and chat handling                                                                                        |
+| `textGenerationWith*.ts`        | Provider-specific inference implementations (Wllama, OpenAI, Horde, Internal API)                                               |
+| `history.ts`                    | IndexedDB persistence for searches and chat                                                                                     |
+| `settings.ts`                   | Default settings and inference type definitions                                                                                 |
+| `followUpQuestions.ts`          | Generates contextual follow-up questions                                                                                        |
+| `relatedSearchQuery.ts`         | Creates related search queries from conversation                                                                                |
+| `querySuggestions.ts`           | Query suggestion UI data management                                                                                             |
+| `webGpu.ts`                     | WebGPU availability detection                                                                                                   |
+| `wllama.ts`                     | Wllama model configuration and management                                                                                       |
+| `accessKey.ts`                  | Access key validation and storage                                                                                               |
+| `searchTokenHash.ts`            | CSRF protection token generation                                                                                                |
+| `parentWindow.ts`               | PostMessage API for parent window embedding                                                                                     |
+| `logEntries.ts`                 | Application logging with unique IDs                                                                                             |
+| `appInfo.ts`                    | Application metadata and version info                                                                                           |
+| `textToSpeech.ts`               | Reads answers aloud: engine selection, fallback, and the playback queue                                                         |
+| `textToSpeechWorker.ts`         | Synthesizes sentences off the main thread                                                                                       |
+| `textToSpeechWorkerProtocol.ts` | Message types shared by both sides of the worker                                                                                |
+| `piper.ts`                      | The only module that imports `@diffusionstudio/vits-web`                                                                        |
+| `speechToText.ts`               | Dictation: microphone capture, the worker's lifecycle, and engine selection between the on-device model and `SpeechRecognition` |
+| `speechToTextWorker.ts`         | Runs the Moonshine transcriber off the main thread                                                                              |
+| `speechToTextWorkerProtocol.ts` | Message types shared by both sides of the dictation worker                                                                      |
+| `moonshine.ts`                  | The only module that imports `@moonshine-ai/moonshine-wasm`                                                                     |
+| `keyboard.ts`                   | Keyboard shortcut handling                                                                                                      |
+| `pageContent.ts`                | Requests extracted result-page text used to ground answers                                                                      |
+| `systemPrompt.ts`               | System prompt templates                                                                                                         |
+| `stringFormatters.ts`           | Text formatting utilities                                                                                                       |
+| `types.ts`                      | Shared TypeScript type definitions                                                                                              |
 
 ## Related Topics
 

docs/pull-requests.md

@@ -40,14 +40,12 @@ This comprehensive check includes:
 The GitHub Release body is built from `changelog.md`, not from GitHub's generated notes: the publish workflow takes every changelog line that was not there at the previous release tag, under its `## YYYY-MM-DD` heading. A change with no entry therefore ships with no mention in the Release.
 
 The `changelog-guard` job on every PR to `main` fails when the PR changes a user-facing path and does not touch `changelog.md`. The trigger paths are:
-
 - anything under `client/`, `server/`, or `shared/`
 - `Dockerfile`, `docker-compose.yml`, `docker-compose.production.yml`, `searxng-settings.yml`
 
 Add your entry to `changelog.md` under a `## YYYY-MM-DD` heading for today's date in UTC, most recent date first.
 
 Two ways out:
-
 - Add the `skip-changelog` label when the change touches a trigger path but is not notable for users - an internal refactor, a rename, a CI-only edit inside a trigger path.
 - Renovate and Dependabot PRs pass automatically. Renovate bumps the pinned SearXNG commit in the `Dockerfile` and cannot write an entry.
 

docs/quick-start.md

@@ -59,11 +59,11 @@ Development mode overrides the container command to run `npm install && npm run
 
 ### Port Configuration
 
-| Port | Service | Variable | Notes |
-|------|---------|----------|-------|
-| 7860 | Node.js (Vite) | `PORT` | Main application (both dev and production) |
-| 7861 | HMR | `HMR_PORT` | Vite HMR server (development only) |
-| 8888 | SearXNG | - | Internal metasearch engine (not exposed) |
+| Port | Service        | Variable   | Notes                                      |
+| ---- | -------------- | ---------- | ------------------------------------------ |
+| 7860 | Node.js (Vite) | `PORT`     | Main application (both dev and production) |
+| 7861 | HMR            | `HMR_PORT` | Vite HMR server (development only)         |
+| 8888 | SearXNG        | -          | Internal metasearch engine (not exposed)   |
 
 ## First Configuration
 
@@ -117,16 +117,19 @@ Access at `http://localhost:7860`
 ## Verification
 
 ### Test Search
+
 1. Enter any query in the search box
 2. Press Enter or click Search
 3. Results should appear within 2-5 seconds
 
 ### Test AI Response
+
 1. Toggle "Enable AI Response" in Settings
 2. Search for "What is quantum computing?"
 3. After search results load, an AI-generated response should appear with citations
 
 ### Test Chat
+
 1. After getting an AI response
 2. Type a follow-up question like "Tell me more"
 3. The AI should respond using conversation context
@@ -134,12 +137,14 @@ Access at `http://localhost:7860`
 ## Common Issues
 
 ### Issue: Search returns no results
+
 **Solution**: Verify SearXNG is running. Check container logs:
 ```bash
 docker compose logs searxng
 ```
 
 ### Issue: AI response never loads
+
 **Solution**: Check browser console for errors. Common causes:
 - WebGPU not supported (app will automatically fall back to Wllama)
 - Model download blocked by firewall or CORS
@@ -148,13 +153,15 @@ docker compose logs searxng
 - Try switching inference types in Settings
 
 ### Issue: Access key not working
+
 **Solution**: Ensure `ACCESS_KEYS` is set in `.env` file and containers were rebuilt with `--build` flag.
 
 ### Issue: Port already in use
+
 **Solution**: Change ports in `docker-compose.yml`:
 ```yaml
 ports:
-  - "7862:7861"  # Use 7862 instead of 7860 (HMR port)
+  - "7862:7861" # Use 7862 instead of 7860 (HMR port)
 ```
 
 ## Next Steps

docs/reranking.md

@@ -6,19 +6,18 @@ MiniSearch optionally reranks search results using a cross-encoder model running
 
 The reranking subsystem consists of four components:
 
-| Component | File | Responsibility |
-|-----------|------|----------------|
-| Service Manager | `server/rerankerService.ts` | Readiness state, reranking inference |
-| Model Loading | `server/utils/onnxModelLoader.ts` | Shared model download, tokenizer loading, and session creation (used by both the reranker and the bi-encoder) |
-| Ranking Logic | `server/rankSearchResults.ts` | Score-based filtering and result reordering |
-| Server Hook | `server/rerankerServiceHook.ts` | Startup/shutdown coordination with Vite server |
+| Component       | File                              | Responsibility                                                                                                |
+| --------------- | --------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| Service Manager | `server/rerankerService.ts`       | Readiness state, reranking inference                                                                          |
+| Model Loading   | `server/utils/onnxModelLoader.ts` | Shared model download, tokenizer loading, and session creation (used by both the reranker and the bi-encoder) |
+| Ranking Logic   | `server/rankSearchResults.ts`     | Score-based filtering and result reordering                                                                   |
+| Server Hook     | `server/rerankerServiceHook.ts`   | Startup/shutdown coordination with Vite server                                                                |
 
 ## Service Lifecycle
 
 ### Startup
 
 The `rerankerServiceHook` starts the reranker during server initialization:
-
 1. Downloads the model and tokenizer from HuggingFace if not present (`cross-encoder/mmarco-mMiniLMv2-L12-H384-v1`)
 2. Creates an ONNX Runtime inference session
 3. Performs a warmup inference (`query: "test"`, `documents: ["test document"]`) to ensure the graph is initialized
@@ -40,12 +39,12 @@ The session is created with `["cpu"]`, with no configuration to set, and there i
 
 The reranker ships as a dynamically quantized graph, and the WebGPU provider has no kernels for its integer matmuls. It registers happily and then hands every one of them back to the CPU, paying a round trip each time: 812ms against 172ms of the same work, with scores drifting by as much as 1.15 and reordering results. The bi-encoder is fp32 and was not benchmarked on accelerators, but inherits the CPU-only choice.
 
-| Provider | Availability in the Node binding | Notes |
-|----------|----------------------------------|-------|
-| `cpu` | Everywhere | The only provider used |
-| `webgpu` | Windows, Linux x64, macOS | Not used: no integer-matmul kernels, so a quantized graph runs ~4.7x slower than on CPU and its scores drift |
-| `cuda` | Linux x64 (CUDA v12) | Not used: the binaries are not bundled, and would need `npm install onnxruntime-node --onnxruntime-node-install=cuda12` |
-| `coreml` | macOS | Not used: slower than CPU for this model's dynamic shapes |
+| Provider | Availability in the Node binding | Notes                                                                                                                   |
+| -------- | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
+| `cpu`    | Everywhere                       | The only provider used                                                                                                  |
+| `webgpu` | Windows, Linux x64, macOS        | Not used: no integer-matmul kernels, so a quantized graph runs ~4.7x slower than on CPU and its scores drift            |
+| `cuda`   | Linux x64 (CUDA v12)             | Not used: the binaries are not bundled, and would need `npm install onnxruntime-node --onnxruntime-node-install=cuda12` |
+| `coreml` | macOS                            | Not used: slower than CPU for this model's dynamic shapes                                                               |
 
 ### One Document per Call
 
@@ -80,7 +79,6 @@ Documents are sent to the reranker whole. Truncation happens by tokens inside th
 ### Scoring and Filtering
 
 The reranker returns the classifier's raw relevance logit for each document. Scores are deliberately not passed through a sigmoid, because the filter below is calibrated against the raw scale. Results are then filtered using a two-stage statistical approach:
-
 1. **Score Normalization**: Scores are shifted to positive range by adding the absolute value of the minimum score
 2. **Standard Deviation Filter**: Results below `mean - kStandardDeviationFactor * standardDeviation` are filtered out
    - `kStandardDeviationFactor = 0.3`
@@ -92,7 +90,6 @@ This filter is invariant to linear rescaling of the scores, since both the score
 ### Preserve Top Results Mode
 
 When `preserveTopResults = true`, the ranking algorithm:
-
 1. Keeps the original top result (first from SearXNG) at position 1
 2. Filters remaining results by score
 3. Takes up to 9 next-best results, sorted by reranker score
@@ -116,15 +113,15 @@ Reranking is applied to both text and image search results. For image results, t
 
 ## Model Details
 
-| Property | Value |
-|----------|-------|
-| Model | mmarco-mMiniLMv2-L12-H384-v1 |
-| Format | ONNX, dynamically quantized (`onnx/model_quint8_avx2.onnx`, 119MB) |
-| HuggingFace Repo | cross-encoder/mmarco-mMiniLMv2-L12-H384-v1 |
-| Type | Cross-encoder reranker (XLM-RoBERTa, one relevance logit) |
-| Size | 12 layers, 118M parameters, of which 96M are the 250k-token vocabulary |
-| Max sequence length | 512 tokens, the model's own limit, enforced via `MAX_SEQUENCE_LENGTH` |
-| Storage | `server/models/cross-encoder/mmarco-mMiniLMv2-L12-H384-v1/` |
+| Property            | Value                                                                  |
+| ------------------- | ---------------------------------------------------------------------- |
+| Model               | mmarco-mMiniLMv2-L12-H384-v1                                           |
+| Format              | ONNX, dynamically quantized (`onnx/model_quint8_avx2.onnx`, 119MB)     |
+| HuggingFace Repo    | cross-encoder/mmarco-mMiniLMv2-L12-H384-v1                             |
+| Type                | Cross-encoder reranker (XLM-RoBERTa, one relevance logit)              |
+| Size                | 12 layers, 118M parameters, of which 96M are the 250k-token vocabulary |
+| Max sequence length | 512 tokens, the model's own limit, enforced via `MAX_SEQUENCE_LENGTH`  |
+| Storage             | `server/models/cross-encoder/mmarco-mMiniLMv2-L12-H384-v1/`            |
 
 It is trained on mMARCO, the machine-translated multilingual MS MARCO, and is genuinely multilingual: a 250k-token sentencepiece vocabulary shared across languages, which is also where most of the parameter count goes.
 
@@ -150,15 +147,15 @@ npx vitest run --config vitest.integration.config.ts
 
 ## Error Handling
 
-| Scenario | Behavior |
-|----------|----------|
-| Reranker not ready | Falls back to unranked SearXNG results |
-| Model fails to load | Logged by the hook; reranker stays unready and search returns unranked results |
-| Cached file of the wrong size | Logged, then downloaded again before the session is created |
-| Download shorter than the reported size | Throws before anything is written, so the cache keeps no partial file |
-| HuggingFace unreachable with a warm cache | Metadata failure is logged and the cached files are used unchanged |
-| Empty documents array | Returns empty array without running inference |
-| Unicode sanitization needed | Logs warning, continues with sanitized input |
+| Scenario                                  | Behavior                                                                       |
+| ----------------------------------------- | ------------------------------------------------------------------------------ |
+| Reranker not ready                        | Falls back to unranked SearXNG results                                         |
+| Model fails to load                       | Logged by the hook; reranker stays unready and search returns unranked results |
+| Cached file of the wrong size             | Logged, then downloaded again before the session is created                    |
+| Download shorter than the reported size   | Throws before anything is written, so the cache keeps no partial file          |
+| HuggingFace unreachable with a warm cache | Metadata failure is logged and the cached files are used unchanged             |
+| Empty documents array                     | Returns empty array without running inference                                  |
+| Unicode sanitization needed               | Logs warning, continues with sanitized input                                   |
 
 ## Observability
 
@@ -184,8 +181,20 @@ taking 20 ms produce:
     "skippedUnhealthy": 0,
     "failed": 0,
     "byType": {
-      "text": { "reranks": 2, "averageMs": 200, "considered": 20, "kept": 5, "keptRate": 25 },
-      "images": { "reranks": 1, "averageMs": 20, "considered": 2, "kept": 2, "keptRate": 100 }
+      "text": {
+        "reranks": 2,
+        "averageMs": 200,
+        "considered": 20,
+        "kept": 5,
+        "keptRate": 25
+      },
+      "images": {
+        "reranks": 1,
+        "averageMs": 20,
+        "considered": 2,
+        "kept": 2,
+        "keptRate": 100
+      }
     }
   }
 }

docs/search-history.md

@@ -1,11 +1,12 @@
 # Search History System
 
 ## Overview
+
 MiniSearch keeps a local-first record of every search so agents can resurface text results, image results, and generated responses without hitting remote services again. All persistence lives inside the browser via Dexie/IndexedDB and is never synced to external servers, preserving the privacy posture of the app.
 
 ## Data Model and Storage
-The `HistoryDatabase` Dexie instance stores three related tables:
 
+The `HistoryDatabase` Dexie instance stores three related tables:
 1. `searches` – canonical log of each query plus hydrated results payloads (text, image, run metadata, source, pin state).
 2. `llmResponses` – snapshot of every AI answer tied to its originating search run, enabling restoration of the assistant output.
 3. `chatHistory` – chronological record of chat turns (user/assistant roles) scoped by `conversationId` (the `searchRunId`).
@@ -13,8 +14,8 @@ The `HistoryDatabase` Dexie instance stores three related tables:
 All three tables share a `searchRunId` foreign key so restoring a specific run can bring back the search results, saved AI response, and chat transcript atomically.
 
 ## Cleanup Guarantees
-To keep IndexedDB lean, inserts trigger `performCleanup()`, which enforces:
 
+To keep IndexedDB lean, inserts trigger `performCleanup()`, which enforces:
 - **Retention window** – non-pinned entries older than `historyRetentionDays` are deleted in batches of 100.
 - **Max entries** – if the total exceeds `historyMaxEntries`, the oldest unpinned rows past the limit are removed.
 - **Pin protection** – pinned entries are skipped by both retention and max-entry sweeps.
@@ -22,8 +23,8 @@ To keep IndexedDB lean, inserts trigger `performCleanup()`, which enforces:
 Cleanup is gated by `historyAutoCleanup`, so advanced users can opt out. These knobs come from the settings store and can be updated at runtime.
 
 ## Hook API
-`useSearchHistory` exposes the canonical API surface for components:
 
+`useSearchHistory` exposes the canonical API surface for components:
 - Fetches recent searches (optionally paginated) and exposes filtered/grouped views.
 - Provides fuzzy search, pin toggling, delete/clear operations, and error retry helpers.
 - Keeps derived state such as grouped sections (Today/Yesterday/etc.) in sync with the settings flag `historyGroupByDate`.
@@ -32,14 +33,17 @@ Cleanup is gated by `historyAutoCleanup`, so advanced users can opt out. These k
 Because the hook writes via Dexie directly, any component can call `addSearchToHistory` to persist new runs immediately after text or image searches resolve.
 
 ## UI Surfaces
+
 - **History Drawer** – wraps the hook data in a drawer with filtering, pin/delete affordances, grouped stacks, and an Analytics tab powered by `SearchStats` in compact mode. The drawer guards against disabled history settings and mirrors the hook filtered list in real time.
 - **History Button** – lazy-loads the drawer and logs open/close events for observability.
 - **History Restore** – the `useHistoryRestore` hook recreates full search state (query string, search results, AI response, and chat transcript) when a user replays an entry.
 
 ## Settings Surface
+
 `HistorySettings` wires Mantine form controls to the settings pub/sub so users can toggle history, adjust retention/max entries, and clear all rows (with confirmation + toast feedback). It relies on the same hook to know when the table is empty before enabling destructive actions.
 
 ## Analytics Integration
+
 The History Drawer Analytics tab renders the compact `SearchStats` cards scoped to `period="all"`, giving total searches, daily averages, and most active hours pulled from the same IndexedDB data. Keeping analytics co-located ensures the metrics share the hook filtering and cleanup guarantees.
 
 ## Search Cache System
@@ -47,19 +51,19 @@ The History Drawer Analytics tab renders the compact `SearchStats` cards scoped
 Alongside the history database, MiniSearch uses a separate `SearchCacheDatabase` for temporary result caching:
 
 **Schema:**
-| Store | Key | Index | Entry Type |
-|-------|-----|-------|------------|
-| `textSearchHistory` | hashed query | timestamp | `TextSearchCache` |
+| Store                | Key          | Index     | Entry Type         |
+| -------------------- | ------------ | --------- | ------------------ |
+| `textSearchHistory`  | hashed query | timestamp | `TextSearchCache`  |
 | `imageSearchHistory` | hashed query | timestamp | `ImageSearchCache` |
 
 **Configuration:**
-| Parameter | Value | Description |
-|-----------|-------|-------------|
-| TTL | 15 minutes | Freshness window: a hit inside it skips the network |
-| MAX_STALE_RETENTION | 24 hours | How long an expired entry is kept, so a failed live search can serve it flagged stale |
-| MAX_ENTRIES | 100 | Maximum cached queries per store |
-| PRUNE_INTERVAL | 10 writes | Cache writes between LRU prune passes |
-| REQUEST_TIMEOUT | 30,000 ms | Search request timeout |
+| Parameter           | Value      | Description                                                                           |
+| ------------------- | ---------- | ------------------------------------------------------------------------------------- |
+| TTL                 | 15 minutes | Freshness window: a hit inside it skips the network                                   |
+| MAX_STALE_RETENTION | 24 hours   | How long an expired entry is kept, so a failed live search can serve it flagged stale |
+| MAX_ENTRIES         | 100        | Maximum cached queries per store                                                      |
+| PRUNE_INTERVAL      | 10 writes  | Cache writes between LRU prune passes                                                 |
+| REQUEST_TIMEOUT     | 30,000 ms  | Search request timeout                                                                |
 
 **Performance Metrics:** The `cacheMetrics` object tracks hits/misses per search type and logs hit rates every 10 operations. Query hashing produces deterministic cache keys for reliable lookups.
 
@@ -67,12 +71,12 @@ Alongside the history database, MiniSearch uses a separate `SearchCacheDatabase`
 
 Lightweight state persisted via `createLocalStoragePubSub`:
 
-| Key | Type | Default | Purpose |
-|-----|------|---------|---------|
-| `settings` | `Settings` | `defaultSettings` | App configuration |
-| `querySuggestions` | `string[]` | `[]` | Search suggestion pool |
-| `lastSearchTokenHash` | `string` | `""` | Cached security token hash |
-| `menuExpandedAccordions` | `string[]` | `[]` | Menu UI state |
+| Key                      | Type       | Default           | Purpose                    |
+| ------------------------ | ---------- | ----------------- | -------------------------- |
+| `settings`               | `Settings` | `defaultSettings` | App configuration          |
+| `querySuggestions`       | `string[]` | `[]`              | Search suggestion pool     |
+| `lastSearchTokenHash`    | `string`   | `""`              | Cached security token hash |
+| `menuExpandedAccordions` | `string[]` | `[]`              | Menu UI state              |
 
 ## Performance Measurement
 

docs/security.md

@@ -32,7 +32,6 @@ can reach the instance, so keep secrets out of that interface.
 ### Search Token Lifecycle
 
 Every HTTP request from client to backend carries a `token` query parameter for CSRF protection:
-
 1. **Token Generation**: On first use in a process, `regenerateSearchToken()` draws 32 random bytes and writes them to `{os.tempdir()}/minisearch-token` with `0600`. The file is never read back as a source of truth: a token that survives into a published image is one every container of that build shares, and anyone who pulls the image can read it out of the layer
 2. **Client Distribution**: The server holds the token it generated for the life of the process and serves it as `searchToken` in `/api/config`. Each process generates its own, so a restart or a second instance means a new token, which is why a bookmarked or shared search URL stops working and lands on the expired-link page
 3. **Per-Request Auth**: Client includes token as `?token=` parameter on all `/search/text`, `/search/images`, `/page-content`, `/thumbnail` and `/inference` requests
@@ -66,7 +65,6 @@ Every HTTP request from client to backend carries a `token` query parameter for
 ## Supply Chain: Native & WebAssembly Modules
 
 The full trust model lives in [`.github/SECURITY.md`](../.github/SECURITY.md) ("Native & WebAssembly Module Trust Model"); the operational parts are mirrored here.
-
 - **Exact pins**: the native/WASM dependencies — `onnxruntime-node@1.29.0`, `@wllama/wllama@3.6.1`, `@huggingface/tokenizers@0.2.0`, `hash-wasm@4.12.0` and `@moonshine-ai/moonshine-wasm@0.1.5` — are declared with single exact versions in `package.json` (no caret ranges), and `package-lock.json` pins each tarball's SHA-512 integrity hash
 - **Install-script policy**: `package.json#allowScripts` carries an explicit decision for every package in the tree that ships an install script — `onnxruntime-node` **denied** (its postinstall downloads CUDA 12 nupkgs unpacked by symlink-following `adm-zip`, GHSA-vwc7-r8mq-g2x9; both inference services run `executionProviders: ["cpu"]` and the CPU runtime ships in the tarball), `protobufjs` **denied** (its postinstall only prints a version-scheme advisory), `fsevents@2.3.3` **allowed** (the optional macOS file watcher must compile at install)
 - **Strict mode**: `.npmrc` sets `strict-allow-scripts = true`, so an install script with no recorded decision fails `npm ci` instead of warning; the `.npmrc` layer itself can only allow, never deny, which is why the policy lives in `package.json`
@@ -87,23 +85,23 @@ The full trust model lives in [`.github/SECURITY.md`](../.github/SECURITY.md) ("
 
 ## Server-Side Security Modules
 
-| Module | Purpose |
-|--------|---------|
-| `server/searchToken.ts` | Generates the CSRF token per process and records it in `{tempdir}/minisearch-token` |
-| `server/verifiedTokens.ts` | In-memory `Set<string>` of verified session tokens |
-| `server/rejectedTokens.ts` | Bounded in-memory set of tokens that already failed a completed verification, so a replay skips the second argon2 check |
-| `server/searchesSinceLastRestart.ts` | In-memory counters for aggregate search outcomes (text/image search totals, and how often searches came back empty or were fully discarded), plus per-engine failure counts, reported on `/status`; records no query, URL, host, or per-search timestamp, and stores a failure kind classified by `server/webSearchService.ts` rather than SearXNG's reason string |
-| `server/pageReadsSinceLastRestart.ts` | In-memory aggregate counters for pages read for grounding (outcomes, durations, passage ratios), reported on `/status`; records no query, URL, host, or per-read timestamp |
-| `server/pageReadHostBreaker.ts` | Per-host circuit breaker for page reads: a host that refused the last three reads is skipped for five minutes, then probed with one read; holds host names in memory only, reset on restart, and reports counts alone |
-| `server/searchEndpointServerHook.ts` | Proxies text/image search to SearXNG after token verification (via `handleTokenVerification`), and serves fallback text results when SearXNG has failed and `SEARCH_FALLBACK_ENABLED` is on |
-| `server/fallbackSearchService.ts` | Second text-search source, consulted only after SearXNG has failed: reads `SEARCH_FALLBACK_ENABLED`, `SEARCH_FALLBACK_PROVIDERS` and the per-provider keys at call time, and refuses to start on an unknown provider name or a removed variable; runs the JSON-RPC exchange against `search.parallel.ai` and You.com's MCP endpoint in a random order per search, one after the other until one returns results, under one shared 15-second budget; pauses a provider that answered 429 until its `Retry-After`; and maps the reply into the tuples the SearXNG path produces; records no query |
-| `server/verifyTokenAndRateLimit.ts` | Verifies the Argon2 token hash and enforces rate limiting (10 requests per 10 seconds, shared by the search, page-content and inference endpoints; a separate 60-per-10-seconds budget for `/thumbnail`) |
-| `server/handleTokenVerification.ts` | Middleware bridge that calls `verifyTokenAndRateLimit` and writes 400/401/429 error responses for the search, page-content, thumbnail and inference endpoints |
-| `server/configEndpointServerHook.ts` | Serves the non-secret runtime config at `/api/config`, including whether access keys are enabled |
-| `server/utils/publicUrl.ts` | Rejects non-HTTP schemes and hosts resolving into private, loopback, link-local or reserved ranges before the server fetches a client-supplied URL; `resolvePublicUrlAndAddress` also hands back the vetted IP so the caller can pin the connection to it |
-| `server/utils/pinnedFetch.ts` | Fetches a vetted URL over a socket pinned to the vetted IP, with the original hostname preserved for TLS SNI, certificate verification and the `Host` header, so the address checked is the address reached (closes the DNS-rebinding window between check and connect) |
-| `server/pageContentEndpointServerHook.ts` | Reads result pages at `/page-content` after token verification, capped at 6 URLs per request |
-| `server/thumbnailEndpointServerHook.ts` | Serves one search-result thumbnail at a time at `/thumbnail` after token verification, connecting only to the vetted pinned address, with an in-process LRU in front of the upstream host |
+| Module                                    | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| ----------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `server/searchToken.ts`                   | Generates the CSRF token per process and records it in `{tempdir}/minisearch-token`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `server/verifiedTokens.ts`                | In-memory `Set<string>` of verified session tokens                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `server/rejectedTokens.ts`                | Bounded in-memory set of tokens that already failed a completed verification, so a replay skips the second argon2 check                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `server/searchesSinceLastRestart.ts`      | In-memory counters for aggregate search outcomes (text/image search totals, and how often searches came back empty or were fully discarded), plus per-engine failure counts, reported on `/status`; records no query, URL, host, or per-search timestamp, and stores a failure kind classified by `server/webSearchService.ts` rather than SearXNG's reason string                                                                                                                                                                                                                              |
+| `server/pageReadsSinceLastRestart.ts`     | In-memory aggregate counters for pages read for grounding (outcomes, durations, passage ratios), reported on `/status`; records no query, URL, host, or per-read timestamp                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `server/pageReadHostBreaker.ts`           | Per-host circuit breaker for page reads: a host that refused the last three reads is skipped for five minutes, then probed with one read; holds host names in memory only, reset on restart, and reports counts alone                                                                                                                                                                                                                                                                                                                                                                           |
+| `server/searchEndpointServerHook.ts`      | Proxies text/image search to SearXNG after token verification (via `handleTokenVerification`), and serves fallback text results when SearXNG has failed and `SEARCH_FALLBACK_ENABLED` is on                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `server/fallbackSearchService.ts`         | Second text-search source, consulted only after SearXNG has failed: reads `SEARCH_FALLBACK_ENABLED`, `SEARCH_FALLBACK_PROVIDERS` and the per-provider keys at call time, and refuses to start on an unknown provider name or a removed variable; runs the JSON-RPC exchange against `search.parallel.ai` and You.com's MCP endpoint in a random order per search, one after the other until one returns results, under one shared 15-second budget; pauses a provider that answered 429 until its `Retry-After`; and maps the reply into the tuples the SearXNG path produces; records no query |
+| `server/verifyTokenAndRateLimit.ts`       | Verifies the Argon2 token hash and enforces rate limiting (10 requests per 10 seconds, shared by the search, page-content and inference endpoints; a separate 60-per-10-seconds budget for `/thumbnail`)                                                                                                                                                                                                                                                                                                                                                                                        |
+| `server/handleTokenVerification.ts`       | Middleware bridge that calls `verifyTokenAndRateLimit` and writes 400/401/429 error responses for the search, page-content, thumbnail and inference endpoints                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `server/configEndpointServerHook.ts`      | Serves the non-secret runtime config at `/api/config`, including whether access keys are enabled                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `server/utils/publicUrl.ts`               | Rejects non-HTTP schemes and hosts resolving into private, loopback, link-local or reserved ranges before the server fetches a client-supplied URL; `resolvePublicUrlAndAddress` also hands back the vetted IP so the caller can pin the connection to it                                                                                                                                                                                                                                                                                                                                       |
+| `server/utils/pinnedFetch.ts`             | Fetches a vetted URL over a socket pinned to the vetted IP, with the original hostname preserved for TLS SNI, certificate verification and the `Host` header, so the address checked is the address reached (closes the DNS-rebinding window between check and connect)                                                                                                                                                                                                                                                                                                                         |
+| `server/pageContentEndpointServerHook.ts` | Reads result pages at `/page-content` after token verification, capped at 6 URLs per request                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `server/thumbnailEndpointServerHook.ts`   | Serves one search-result thumbnail at a time at `/thumbnail` after token verification, connecting only to the vetted pinned address, with an in-process LRU in front of the upstream host                                                                                                                                                                                                                                                                                                                                                                                                       |
 
 ### Server-Side Fetching of Client-Supplied URLs
 
@@ -144,22 +142,22 @@ the server's memory.
 Audited 2026-09-17 on branch `security/thumbnail-ssrf-audit`. Each item of
 the issue's checklist, answered from the code:
 
-| Checklist item | Status | Where |
-|---|---|---|
-| Blocks private ranges (10/8, 172.16/12, 192.168/16) | Yes | `BLOCKED_CIDRS` / `isBlockedAddress`, `server/utils/publicUrl.ts` |
-| Blocks link-local (169.254.0.0/16) | Yes | same table |
-| Blocks loopback (127/8, `::1`) | Yes | same table |
-| Blocks cloud metadata (169.254.169.254) | Yes | covered by the link-local block |
-| Blocks IPv4-mapped IPv4-compatible IPv6 spellings | Yes | IPv4 blocks are matched in mapped form; the IPv4-compatible `::/96` is refused wholesale, as are NAT64/6to4/Teredo, whose embedded IPv4 cannot be vetted |
-| Blocks DNS rebinding | Yes — this was the gap this issue closed | validate-then-pin: `resolvePublicUrlAndAddress` returns the vetted IP and `requestPinnedToVettedAddress` (`server/utils/pinnedFetch.ts`) connects to it without re-resolving; hostname is kept for SNI, certificate verification and `Host` |
-| URL length limited | Yes | `MAX_THUMBNAIL_URL_LENGTH` (2048), refused before any work |
-| Only HTTP/HTTPS schemes | Yes | `resolvePublicUrlAndAddress` |
-| Redirects safe (no redirect to a private IP) | Yes | followed by hand in `fetchThumbnail`; every hop re-validated under one shared deadline |
-| Content-Type checked to be an image | Yes | raster-only allowlist in `thumbnailEndpointServerHook.ts`; SVG is excluded because served same-origin it is a script-carrying document |
-| Response size limited | Yes | `MAX_THUMBNAIL_BYTES` (500 KB) via `readCappedStream` |
-| Timeout configured | Yes | `THUMBNAIL_TIMEOUT_MS` (3 s), shared across DNS and every hop |
-| Rate limited per client | Yes | `thumbnailRateLimiter`, a dedicated 60-per-10-seconds budget keyed on client IP |
-| Global rate limit | No, by design | the per-client limiter plus the shared token gate bound the total; a global cap would let one caller's grid starve every other user's tiles |
+| Checklist item                                      | Status                                   | Where                                                                                                                                                                                                                                       |
+| --------------------------------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Blocks private ranges (10/8, 172.16/12, 192.168/16) | Yes                                      | `BLOCKED_CIDRS` / `isBlockedAddress`, `server/utils/publicUrl.ts`                                                                                                                                                                           |
+| Blocks link-local (169.254.0.0/16)                  | Yes                                      | same table                                                                                                                                                                                                                                  |
+| Blocks loopback (127/8, `::1`)                      | Yes                                      | same table                                                                                                                                                                                                                                  |
+| Blocks cloud metadata (169.254.169.254)             | Yes                                      | covered by the link-local block                                                                                                                                                                                                             |
+| Blocks IPv4-mapped IPv4-compatible IPv6 spellings   | Yes                                      | IPv4 blocks are matched in mapped form; the IPv4-compatible `::/96` is refused wholesale, as are NAT64/6to4/Teredo, whose embedded IPv4 cannot be vetted                                                                                    |
+| Blocks DNS rebinding                                | Yes — this was the gap this issue closed | validate-then-pin: `resolvePublicUrlAndAddress` returns the vetted IP and `requestPinnedToVettedAddress` (`server/utils/pinnedFetch.ts`) connects to it without re-resolving; hostname is kept for SNI, certificate verification and `Host` |
+| URL length limited                                  | Yes                                      | `MAX_THUMBNAIL_URL_LENGTH` (2048), refused before any work                                                                                                                                                                                  |
+| Only HTTP/HTTPS schemes                             | Yes                                      | `resolvePublicUrlAndAddress`                                                                                                                                                                                                                |
+| Redirects safe (no redirect to a private IP)        | Yes                                      | followed by hand in `fetchThumbnail`; every hop re-validated under one shared deadline                                                                                                                                                      |
+| Content-Type checked to be an image                 | Yes                                      | raster-only allowlist in `thumbnailEndpointServerHook.ts`; SVG is excluded because served same-origin it is a script-carrying document                                                                                                      |
+| Response size limited                               | Yes                                      | `MAX_THUMBNAIL_BYTES` (500 KB) via `readCappedStream`                                                                                                                                                                                       |
+| Timeout configured                                  | Yes                                      | `THUMBNAIL_TIMEOUT_MS` (3 s), shared across DNS and every hop                                                                                                                                                                               |
+| Rate limited per client                             | Yes                                      | `thumbnailRateLimiter`, a dedicated 60-per-10-seconds budget keyed on client IP                                                                                                                                                             |
+| Global rate limit                                   | No, by design                            | the per-client limiter plus the shared token gate bound the total; a global cap would let one caller's grid starve every other user's tiles                                                                                                 |
 
 Residual risk after the change: the endpoint still fetches arbitrary public
 URLs, so a caller can use it to GET any public host — bounded by the rate

docs/ui-components.md

@@ -8,11 +8,11 @@ MiniSearch uses a **PubSub-based reactive architecture**. Components subscribe t
 
 Each PubSub channel is a three-element tuple returned by `createPubSub`:
 
-| Index | Name | Role |
-|-------|------|------|
-| `[0]` | `update*` | Setter — publishes a new value to all subscribers |
+| Index | Name                                       | Role                                                    |
+| ----- | ------------------------------------------ | ------------------------------------------------------- |
+| `[0]` | `update*`                                  | Setter — publishes a new value to all subscribers       |
 | `[1]` | `onValueChange` / `subscribe*` / `listen*` | Subscription registration — receives every future value |
-| `[2]` | `get*` | Getter — reads the current value synchronously |
+| `[2]` | `get*`                                     | Getter — reads the current value synchronously          |
 
 These are destructured at module level in `pubSub.ts` and exported under descriptive names (e.g., `updateTextGenerationState`, `listenToSettingsChanges`, `getQuery`).
 
@@ -21,7 +21,7 @@ These are destructured at module level in `pubSub.ts` and exported under descrip
 const query = usePubSub(queryPubSub);
 
 // Any module can update state
-updateQuery('new query');
+updateQuery("new query");
 
 // All subscribers automatically re-render
 ```
@@ -35,7 +35,6 @@ updateQuery('new query');
 ### localStorage Persistence
 
 Some state must survive page reloads. The `createLocalStoragePubSub` helper wraps `createPubSub` with two behaviors:
-
 1. **Hydration** — On first call, reads existing value from `localStorage` via `localStorage.getItem(key)`. If a stored JSON string is found, it is parsed and used as the initial value; otherwise the default value is used
 2. **Persistence** — A subscriber is immediately registered on the inner PubSub that calls `localStorage.setItem` with the JSON-serialized new value on every state change
 
@@ -45,10 +44,10 @@ Channels using this pattern: `settingsPubSub`, `querySuggestionsPubSub`, `lastSe
 
 Streaming LLM output produces token-by-token state changes that would overwhelm React's rendering pipeline. Two channels apply `throttle` from `throttleit` to cap subscriber notification rate to ~12 updates/sec (83.3ms interval):
 
-| Export | Raw Updater | Throttle Interval |
-|--------|-------------|-------------------|
-| `updateResponse` | `responsePubSub[0]` | 1000 / 12 ms |
-| `updateReasoningContent` | `reasoningContentPubSub[0]` | 1000 / 12 ms |
+| Export                   | Raw Updater                 | Throttle Interval |
+| ------------------------ | --------------------------- | ----------------- |
+| `updateResponse`         | `responsePubSub[0]`         | 1000 / 12 ms      |
+| `updateReasoningContent` | `reasoningContentPubSub[0]` | 1000 / 12 ms      |
 
 Callers write streaming token output directly to these exports without awareness of internal throttling.
 
@@ -56,43 +55,43 @@ Callers write streaming token output directly to these exports without awareness
 
 Three channels register built-in side-effect subscribers at module load time, independently of any React component lifecycle, for automatic logging via `addLogEntry`:
 
-| Channel | Side Effect |
-|---------|-------------|
+| Channel                     | Side Effect            |
+| --------------------------- | ---------------------- |
 | `textGenerationStatePubSub` | Logs state transitions |
-| `textSearchStatePubSub` | Logs state transitions |
-| `imageSearchStatePubSub` | Logs state transitions |
+| `textSearchStatePubSub`     | Logs state transitions |
+| `imageSearchStatePubSub`    | Logs state transitions |
 
 ## PubSub Channel Reference
 
 All state channels are defined in `client/modules/pubSub.ts`:
 
-| Channel | Type | Description | Primary Consumers |
-|---------|------|-------------|-------------------|
-| `queryPubSub` | `string` | Current search query | SearchForm, SearchButton |
-| `responsePubSub` | `string` | AI response content (throttled: 12/sec) | AiResponseSection |
-| `textToSpeechStatePubSub` | `TextToSpeechState` | Whether an answer is being read aloud: `"idle" \| "speaking"` | AiResponseContent |
-| `reasoningContentPubSub` | `string` | AI reasoning/thinking content (throttled: 12/sec) | AiResponseSection |
-| `settingsPubSub` | `Settings` | Application settings | SettingsForm, various components |
-| `textSearchResultsPubSub` | `TextSearchResults` | Text search results | SearchResultsSection |
-| `llmTextSearchResultsPubSub` | `TextSearchResults` | LLM-reranked text results | Internal use |
-| `imageSearchResultsPubSub` | `ImageSearchResults` | Image search results | ImageResultsSection |
-| `textSearchStatePubSub` | `SearchState` | Text search state: `"idle" \| "running" \| "failed" \| "completed"` | SearchResultsSection, LoadingIndicators |
-| `textSearchStalePubSub` | `boolean` | Whether the text results on screen came from the cache because the live search failed | TextSearchResults |
-| `imageSearchStatePubSub` | `SearchState` | Image search state: `"idle" \| "running" \| "failed" \| "completed"` | ImageResultsSection |
-| `textGenerationStatePubSub` | `TextGenerationState` | AI generation state | AiResponseSection, StatusIndicators |
-| `modelLoadingProgressPubSub` | `number` | Model download progress (0-100) | AiResponseSection |
-| `modelSizeInMegabytesPubSub` | `number` | Model size in MB for progress calc | AiResponseSection |
-| `chatMessagesPubSub` | `ChatMessage[]` | Chat conversation | ChatInterface |
-| `chatInputPubSub` | `string` | Current chat input content | ChatInputArea |
-| `chatGenerationStatePubSub` | `{isGeneratingResponse, isGeneratingFollowUpQuestion}` | Chat generation states. Each flag has one owner: the send and regenerate handlers write `isGeneratingResponse`, `regenerateFollowUpQuestion` writes `isGeneratingFollowUpQuestion`, and every writer merges `getChatGenerationState()` so a concurrent flow is not clobbered. A boolean cannot represent two follow-up calls at once, so each carries an invocation token, and a completion that is no longer the current one writes nothing. Unmounting is the exception to the merge: it replaces both flags outright, bumps the token, and stops the response writers touching the channel at all, so an orphaned flow cannot write into the instance that replaced it | ChatInterface |
-| `conversationSummaryPubSub` | `{id, summary}` | Rolling conversation summary | TextGeneration module |
-| `followUpQuestionPubSub` | `string` | Generated follow-up question | AiResponseSection |
-| `suppressNextFollowUpPubSub` | `boolean` | Flag to skip next follow-up | FollowUpQuestions module |
-| `isRestoringFromHistoryPubSub` | `boolean` | History restoration in progress | SearchForm, components |
-| `menuExpandedAccordionsPubSub` | `string[]` | Expanded menu accordion IDs | MenuDrawer |
-| `querySuggestionsPubSub` | `string[]` | Query suggestions history | SearchForm |
-| `lastSearchTokenHashPubSub` | `string` | Hash of last search token | Security/validation |
-| `logEntriesPubSub` | `LogEntry[]` | Application log entries | LogsModal, ShowLogsButton |
+| Channel                        | Type                                                   | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Primary Consumers                       |
+| ------------------------------ | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- |
+| `queryPubSub`                  | `string`                                               | Current search query                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | SearchForm, SearchButton                |
+| `responsePubSub`               | `string`                                               | AI response content (throttled: 12/sec)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | AiResponseSection                       |
+| `textToSpeechStatePubSub`      | `TextToSpeechState`                                    | Whether an answer is being read aloud: `"idle" \| "speaking"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | AiResponseContent                       |
+| `reasoningContentPubSub`       | `string`                                               | AI reasoning/thinking content (throttled: 12/sec)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | AiResponseSection                       |
+| `settingsPubSub`               | `Settings`                                             | Application settings                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | SettingsForm, various components        |
+| `textSearchResultsPubSub`      | `TextSearchResults`                                    | Text search results                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | SearchResultsSection                    |
+| `llmTextSearchResultsPubSub`   | `TextSearchResults`                                    | LLM-reranked text results                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Internal use                            |
+| `imageSearchResultsPubSub`     | `ImageSearchResults`                                   | Image search results                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | ImageResultsSection                     |
+| `textSearchStatePubSub`        | `SearchState`                                          | Text search state: `"idle" \| "running" \| "failed" \| "completed"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | SearchResultsSection, LoadingIndicators |
+| `textSearchStalePubSub`        | `boolean`                                              | Whether the text results on screen came from the cache because the live search failed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | TextSearchResults                       |
+| `imageSearchStatePubSub`       | `SearchState`                                          | Image search state: `"idle" \| "running" \| "failed" \| "completed"`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | ImageResultsSection                     |
+| `textGenerationStatePubSub`    | `TextGenerationState`                                  | AI generation state                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | AiResponseSection, StatusIndicators     |
+| `modelLoadingProgressPubSub`   | `number`                                               | Model download progress (0-100)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | AiResponseSection                       |
+| `modelSizeInMegabytesPubSub`   | `number`                                               | Model size in MB for progress calc                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | AiResponseSection                       |
+| `chatMessagesPubSub`           | `ChatMessage[]`                                        | Chat conversation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | ChatInterface                           |
+| `chatInputPubSub`              | `string`                                               | Current chat input content                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | ChatInputArea                           |
+| `chatGenerationStatePubSub`    | `{isGeneratingResponse, isGeneratingFollowUpQuestion}` | Chat generation states. Each flag has one owner: the send and regenerate handlers write `isGeneratingResponse`, `regenerateFollowUpQuestion` writes `isGeneratingFollowUpQuestion`, and every writer merges `getChatGenerationState()` so a concurrent flow is not clobbered. A boolean cannot represent two follow-up calls at once, so each carries an invocation token, and a completion that is no longer the current one writes nothing. Unmounting is the exception to the merge: it replaces both flags outright, bumps the token, and stops the response writers touching the channel at all, so an orphaned flow cannot write into the instance that replaced it | ChatInterface                           |
+| `conversationSummaryPubSub`    | `{id, summary}`                                        | Rolling conversation summary                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | TextGeneration module                   |
+| `followUpQuestionPubSub`       | `string`                                               | Generated follow-up question                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | AiResponseSection                       |
+| `suppressNextFollowUpPubSub`   | `boolean`                                              | Flag to skip next follow-up                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | FollowUpQuestions module                |
+| `isRestoringFromHistoryPubSub` | `boolean`                                              | History restoration in progress                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | SearchForm, components                  |
+| `menuExpandedAccordionsPubSub` | `string[]`                                             | Expanded menu accordion IDs                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | MenuDrawer                              |
+| `querySuggestionsPubSub`       | `string[]`                                             | Query suggestions history                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | SearchForm                              |
+| `lastSearchTokenHashPubSub`    | `string`                                               | Hash of last search token                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Security/validation                     |
+| `logEntriesPubSub`             | `LogEntry[]`                                           | Application log entries                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   | LogsModal, ShowLogsButton               |
 
 ## Component Hierarchy
 
@@ -190,12 +189,12 @@ that appends each transcript without clobbering what the user typed meanwhile.
 
 **Props:**
 
-| Prop | Role |
-|---|---|
-| `getValue` / `setValue` | Reads and replaces the field's content. The caller owns the field, so the button never touches the DOM itself |
-| `labelScope` | Names the field in the accessible labels, as the object of "Dictate" and "Stop dictating": `"the search query"`, `"a follow-up question"` |
-| `rightOffset` | Distance from the right edge of the positioned ancestor, for a field that already has a button at its edge |
-| `disabled` | Blocks a new session and stops one already running, for a field that has gone read-only |
+| Prop                    | Role                                                                                                                                      |
+| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
+| `getValue` / `setValue` | Reads and replaces the field's content. The caller owns the field, so the button never touches the DOM itself                             |
+| `labelScope`            | Names the field in the accessible labels, as the object of "Dictate" and "Stop dictating": `"the search query"`, `"a follow-up question"` |
+| `rightOffset`           | Distance from the right edge of the positioned ancestor, for a field that already has a button at its edge                                |
+| `disabled`              | Blocks a new session and stops one already running, for a field that has gone read-only                                                   |
 
 The button renders itself absolutely positioned, so each caller wraps its field
 in a `position: relative` element and reserves `dictationButtonWidth` of right
@@ -239,17 +238,17 @@ function SearchResultsSection() {
 
 **State Machine (`textGenerationStatePubSub`):**
 
-| State | Description | UI Display |
-|-------|-------------|------------|
-| `idle` | No active generation | Hidden or empty |
+| State                            | Description                                | UI Display                                            |
+| -------------------------------- | ------------------------------------------ | ----------------------------------------------------- |
+| `idle`                           | No active generation                       | Hidden or empty                                       |
 | `awaitingModelDownloadAllowance` | Waiting for user to confirm model download | `AiModelDownloadAllowanceContent` confirmation prompt |
-| `loadingModel` | Downloading or initializing AI model | `LoadingModelContent` with progress |
-| `awaitingSearchResults` | Waiting for search to complete | `PreparingContent` indicator |
-| `preparingToGenerate` | Search done, response not yet started | `PreparingContent` indicator |
-| `generating` | Streaming response tokens | Active response with streaming text |
-| `interrupted` | Generation manually stopped by user | Response retained, with a yellow "Interrupted" badge |
-| `completed` | Full response received | Complete response with chat interface |
-| `failed` | Error occurred | Error message with retry option |
+| `loadingModel`                   | Downloading or initializing AI model       | `LoadingModelContent` with progress                   |
+| `awaitingSearchResults`          | Waiting for search to complete             | `PreparingContent` indicator                          |
+| `preparingToGenerate`            | Search done, response not yet started      | `PreparingContent` indicator                          |
+| `generating`                     | Streaming response tokens                  | Active response with streaming text                   |
+| `interrupted`                    | Generation manually stopped by user        | Response retained, with a yellow "Interrupted" badge  |
+| `completed`                      | Full response received                     | Complete response with chat interface                 |
+| `failed`                         | Error occurred                             | Error message with retry option                       |
 
 **Reasoning Content Extraction:**
 
@@ -303,7 +302,10 @@ function AiResponseSection() {
 **Persistence:**
 ```typescript
 // client/modules/pubSub.ts
-export const settingsPubSub = createLocalStoragePubSub('settings', defaultSettings);
+export const settingsPubSub = createLocalStoragePubSub(
+  "settings",
+  defaultSettings,
+);
 ```
 
 `createLocalStoragePubSub` registers the localStorage-writing subscriber internally, so components just read and write `settingsPubSub` like any other channel.
@@ -425,7 +427,8 @@ const [value, setValue] = usePubSub(channel);
 
 Manages search history from IndexedDB:
 ```typescript
-const { searchHistory, groupedSearches, deleteEntry, togglePin } = useSearchHistory();
+const { searchHistory, groupedSearches, deleteEntry, togglePin } =
+  useSearchHistory();
 ```
 
 ### useDrawerState

eval/README.md

@@ -6,7 +6,6 @@ has two parts, both driven by a single fixed golden set (`goldenSet.ts`).
 
 Some of it runs in the default `npm test` suite (and so in CI); the rest is a
 local signal:
-
 - `metrics.test.ts`, `goldenSet.test.ts`, `promptConstruction.test.ts` run in
   the default suite: pure math, golden-set structure, and prompt construction.
   No model, no API key.
@@ -20,7 +19,6 @@ change, not an absolute quality score.
 ## The golden set
 
 `goldenSet.ts` is a fixed, hand-curated list of queries. Each entry has:
-
 - `query`: the search query.
 - `results`: realistic candidate results (title, snippet, url), mixed
   relevant and irrelevant, the way a real search engine returns them.

package-lock.json

@@ -39,7 +39,7 @@
         "http-compression": "^1.0.20",
         "keyword-extractor": "^0.3.0",
         "node-emoji": "^2.1.3",
-        "onnxruntime-node": "1.30.0",
+        "onnxruntime-node": "1.31.1",
         "pdf-parse": "^2.0.0",
         "postcss": "^8.5.25",
         "postcss-preset-mantine": "^1.17.0",
@@ -69,7 +69,7 @@
         "@testing-library/react": "^16.0.0",
         "@testing-library/user-event": "^14.5.0",
         "@types/html-to-text": "^9.0.4",
-        "@types/node": "^24.0.0",
+        "@types/node": "^26.0.0",
         "@types/react": "^19.0.0",
         "@types/react-dom": "^19.0.0",
         "@vitest/coverage-v8": "^5.0.0",
@@ -95,13 +95,13 @@
       "license": "MIT"
     },
     "node_modules/@ai-sdk/gateway": {
-      "version": "4.0.115",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-4.0.115.tgz",
-      "integrity": "sha512-Xn+gDWM4Ti2FzYmxhlZtjEuGBGZlOYaQMpwcVRSN4c9qCMUszD5F5TAbkxgLV/tHKeMfEX+WEuTCl6Kkj2r73A==",
+      "version": "4.0.132",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-4.0.132.tgz",
+      "integrity": "sha512-ppStDEz96g+JEuxGiVTP29OKBjPyYZXRxs38wnq3427U2QbZtxe6TukrgSAAq0n4yaHvSvVAWJY9kBlW8XudYg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.28",
-        "@ai-sdk/provider-utils": "5.0.61",
+        "@ai-sdk/provider": "4.0.35",
+        "@ai-sdk/provider-utils": "5.0.72",
         "@vercel/oidc": "3.2.0"
       },
       "engines": {
@@ -111,26 +111,14 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/@ai-sdk/gateway/node_modules/@ai-sdk/provider": {
-      "version": "4.0.28",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.28.tgz",
-      "integrity": "sha512-6ThcmkJQXSMlBrf6mirIjUUS04Q5/kApbYTOzd5lZfYXLa1XPpnDLxP/G96/DKc00fDIUOW9S2ls0mSzb0+l9w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "json-schema": "^0.4.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
     "node_modules/@ai-sdk/openai-compatible": {
-      "version": "3.0.70",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/openai-compatible/-/openai-compatible-3.0.70.tgz",
-      "integrity": "sha512-0TefLzj+V7aMLrIIKdk3CKRji+hOu3oOSHeLKJVzr0+q/7rsH4Q56w6RK7GX7csmAd9Urtt097XBTkBwJbpDjA==",
+      "version": "3.0.82",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/openai-compatible/-/openai-compatible-3.0.82.tgz",
+      "integrity": "sha512-wey0CbujWRkZbbrJjw/GJHyjXpt0v44PQKaTGTVGmigqnM057G7GQHDyZQQj9O0lICY5qJxzpn4wCSftT8BSQg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.28",
-        "@ai-sdk/provider-utils": "5.0.61"
+        "@ai-sdk/provider": "4.0.35",
+        "@ai-sdk/provider-utils": "5.0.72"
       },
       "engines": {
         "node": ">=22"
@@ -139,22 +127,10 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/@ai-sdk/openai-compatible/node_modules/@ai-sdk/provider": {
-      "version": "4.0.28",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.28.tgz",
-      "integrity": "sha512-6ThcmkJQXSMlBrf6mirIjUUS04Q5/kApbYTOzd5lZfYXLa1XPpnDLxP/G96/DKc00fDIUOW9S2ls0mSzb0+l9w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "json-schema": "^0.4.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
     "node_modules/@ai-sdk/provider": {
-      "version": "4.0.27",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.27.tgz",
-      "integrity": "sha512-TtWwm6SxFiPomlMIbTQa+yhJte+w4/oCsW+wJrJzMC3MqHpAY9e5dJF1Y4HxyKt3W2Csac0KiI76Ckio11TFYw==",
+      "version": "4.0.35",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.35.tgz",
+      "integrity": "sha512-yBz6fmLS8MSCIzy7NiHEUAq56ZLD4ZA1GR6bpXBxgbwUacP1La7LuwAr/xy9jSzthem4F8Xu2OrhvU/JrE9fYA==",
       "license": "Apache-2.0",
       "dependencies": {
         "json-schema": "^0.4.0"
@@ -164,12 +140,12 @@
       }
     },
     "node_modules/@ai-sdk/provider-utils": {
-      "version": "5.0.61",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.61.tgz",
-      "integrity": "sha512-Y+Z3539UXw0ctFDNepTtG23VqBQHr2A6yI2qUxvQcg75DJYgJoD2F9U2Vp5OgQjX7lxto1BLgFtKuOhzrr52vQ==",
+      "version": "5.0.72",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.72.tgz",
+      "integrity": "sha512-M6QAztI84jWumQSvKcGOL91DxhChsWxn3D3gYtV0/7E1TPQg9BmLdIerOolUC/jghQbMlQrHyzp0hqdIhUZ2Rw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.28",
+        "@ai-sdk/provider": "4.0.35",
         "@standard-schema/spec": "^1.1.0",
         "@workflow/serde": "4.1.0",
         "eventsource-parser": "^3.0.8",
@@ -182,18 +158,6 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/@ai-sdk/provider-utils/node_modules/@ai-sdk/provider": {
-      "version": "4.0.28",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.28.tgz",
-      "integrity": "sha512-6ThcmkJQXSMlBrf6mirIjUUS04Q5/kApbYTOzd5lZfYXLa1XPpnDLxP/G96/DKc00fDIUOW9S2ls0mSzb0+l9w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "json-schema": "^0.4.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
     "node_modules/@ai-sdk/provider-utils/node_modules/undici": {
       "version": "7.30.1",
       "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.1.tgz",
@@ -321,9 +285,9 @@
       }
     },
     "node_modules/@biomejs/biome": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.5.15.tgz",
-      "integrity": "sha512-WZTW4slm/pdkh92K6t/3aEN++44JD1PQ7squ7RCMLI1flHGl43DVOIGXvCjHiZgBMO1V4uYxoFNtqrIA4qGuIQ==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-2.6.4.tgz",
+      "integrity": "sha512-8sKKwaNW4ot22awZ3lBjwWLHnUFXgXnrBPYS2gNlBAXRbDC++7kqjK2H7dR/FgCDtPvO1xfKpgEhJkGxAKYkxA==",
       "dev": true,
       "license": "MIT OR Apache-2.0",
       "bin": {
@@ -337,20 +301,56 @@
         "url": "https://opencollective.com/biome"
       },
       "optionalDependencies": {
-        "@biomejs/cli-darwin-arm64": "2.5.15",
-        "@biomejs/cli-darwin-x64": "2.5.15",
-        "@biomejs/cli-linux-arm64": "2.5.15",
-        "@biomejs/cli-linux-arm64-musl": "2.5.15",
-        "@biomejs/cli-linux-x64": "2.5.15",
-        "@biomejs/cli-linux-x64-musl": "2.5.15",
-        "@biomejs/cli-win32-arm64": "2.5.15",
-        "@biomejs/cli-win32-x64": "2.5.15"
+        "@biomejs/cli-android-arm64": "2.6.4",
+        "@biomejs/cli-android-x64": "2.6.4",
+        "@biomejs/cli-darwin-arm64": "2.6.4",
+        "@biomejs/cli-darwin-x64": "2.6.4",
+        "@biomejs/cli-linux-arm64": "2.6.4",
+        "@biomejs/cli-linux-arm64-musl": "2.6.4",
+        "@biomejs/cli-linux-x64": "2.6.4",
+        "@biomejs/cli-linux-x64-musl": "2.6.4",
+        "@biomejs/cli-win32-arm64": "2.6.4",
+        "@biomejs/cli-win32-x64": "2.6.4"
+      }
+    },
+    "node_modules/@biomejs/cli-android-arm64": {
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-android-arm64/-/cli-android-arm64-2.6.4.tgz",
+      "integrity": "sha512-jwrwigP4tBcHxzuV8izioX/BOUhJL/4e2rNSOE5nCjBkVC018LQAQUGiH+CNkFYvLtQ1dcZo5/xXERmaAGc7JQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
+      }
+    },
+    "node_modules/@biomejs/cli-android-x64": {
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-android-x64/-/cli-android-x64-2.6.4.tgz",
+      "integrity": "sha512-HdGInPJ4nZFwHxzvEtcp2nmSBtUyJrurmtIK43upFckuS3+ZqVM05HtsxQWnqGsuy/pxckIAjyKWlEKRlBXUyA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT OR Apache-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=14.21.3"
       }
     },
     "node_modules/@biomejs/cli-darwin-arm64": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.5.15.tgz",
-      "integrity": "sha512-BZVzFhJ/mUvTLMYbc9x6el0o2Uv5zP7bACYyhFb6fSc1giroXm7PL0a5KqMJ9F+/BnkYRjagD/ROSDVOZ6eapg==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.6.4.tgz",
+      "integrity": "sha512-0VvcUz46wbg59Q4TZ59KkIjDJrxEyu4Eoe79+F4SChxoWe+W7AEyIp6F5r72C9+p6MsB6dIovnZt1D30lGM3XA==",
       "cpu": [
         "arm64"
       ],
@@ -365,9 +365,9 @@
       }
     },
     "node_modules/@biomejs/cli-darwin-x64": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.5.15.tgz",
-      "integrity": "sha512-V5Kw63V+fVGNFhFrizDxMbGXAzZCh8kYzJpy3GI6gTapWDg7bZK9oYC9CbVgQSEdTnupz0U5Efz8Ev+5vdBBXw==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.6.4.tgz",
+      "integrity": "sha512-fxmvkF81srlS3DiMyfm+aG3J0eG+6/BjaxRyjy57KbLSafnq0PO+hHfVWmtH2ty0S7nm6yDXBRwySfFeaRJKRQ==",
       "cpu": [
         "x64"
       ],
@@ -382,9 +382,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-arm64": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.5.15.tgz",
-      "integrity": "sha512-XaG7P7eeSLYETD3K9grfB0mQmpLQZjygdbsxekWBJAg4am79fGAtRpfRyNnTvXB2fZFNnJZG3nXm7HBat0+VUw==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.6.4.tgz",
+      "integrity": "sha512-6+bK1Y/evmIUiJr7auertuMbiaYVicJhqA1bZyL47lCMWugv8l0gFQCqvR/gN1vZMHYm+HwoTKgeMxdNFCoQTg==",
       "cpu": [
         "arm64"
       ],
@@ -402,9 +402,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-arm64-musl": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.5.15.tgz",
-      "integrity": "sha512-tGzZUTcJCV7tj5Adh/Gn6nR4MycqA3iohq2LEcrarAgRBkU0h0OKd2UzCRkOsOYOuUGaUJb4YmqRqyy2feGGSw==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.6.4.tgz",
+      "integrity": "sha512-31ZaH/MHqPX+O+evRwRrCHQ8W5/9adY+/eMytGGWZnRx1T41QsWIF09+/WujynLBhWZUxNGS5CtsWLwgOFTAyg==",
       "cpu": [
         "arm64"
       ],
@@ -422,9 +422,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-x64": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.5.15.tgz",
-      "integrity": "sha512-xE4iEW/3LqlYj9GFgGrFsFSH51dEEpUbYWBfeOv0q87WkUDxK2o/HhreSb7qMJqck70RVM6Lg96hgedcAYcOkA==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.6.4.tgz",
+      "integrity": "sha512-tbFZMdL6dP/ws4edXxYG9WhvaVa1ZDzL4G5DzahnWW7Psib9H+VTdyU4XXVxpJk5j/nYZroSbvSNyYlpW3yCIw==",
       "cpu": [
         "x64"
       ],
@@ -442,9 +442,9 @@
       }
     },
     "node_modules/@biomejs/cli-linux-x64-musl": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.5.15.tgz",
-      "integrity": "sha512-IlxUcyxilVGPsE008x13pWdkTbU3nQpP2i9b5UrbOYj6goBkKsRX1XB7yJLcV+O1H9LBchIIm4adOaVLZBX0ZQ==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.6.4.tgz",
+      "integrity": "sha512-bomSa2XdQAGGj6Cwdm4M13qE+lN9+AOlW8KtI4hdyVyRRF/Z71qPAi95T4wtdZK0QpBbkTW8hgbZZCwPi4xzIw==",
       "cpu": [
         "x64"
       ],
@@ -462,9 +462,9 @@
       }
     },
     "node_modules/@biomejs/cli-win32-arm64": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.5.15.tgz",
-      "integrity": "sha512-2kPKzhNlm8C+Ru3GcO0Me2ODkCBLrVOUNuyi84RJyWDVKAA4+Kjj3jMjL938lF6BRfvltC4vB2nPY9SvN51Ovg==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.6.4.tgz",
+      "integrity": "sha512-eCsqt8Ma3eVap+oyJCDnJZH60SIU464B66n3y38EUTJdM1T/HfZol1FJC9vb+sHToX0ix8XzqPcwJnOzyAJz0g==",
       "cpu": [
         "arm64"
       ],
@@ -479,9 +479,9 @@
       }
     },
     "node_modules/@biomejs/cli-win32-x64": {
-      "version": "2.5.15",
-      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.5.15.tgz",
-      "integrity": "sha512-yAzh4UqEImV6Hcy0zjUqNfJAsUhoD64FBQCdTG8Md/Z2wQeVP/ZmJ3XRYAs1g8J9fjTFyl2fCtc5FB5til47+g==",
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.6.4.tgz",
+      "integrity": "sha512-pYsMy5AThiHFOZAsngg8qN4PurM6nInKBhVX7sbj3eNpRQqo1Hb0MgCwPL7VqVMrmcEEMj9Ks3qbkallR65e8g==",
       "cpu": [
         "x64"
       ],
@@ -746,12 +746,12 @@
       "license": "MIT"
     },
     "node_modules/@huggingface/hub": {
-      "version": "2.17.8",
-      "resolved": "https://registry.npmjs.org/@huggingface/hub/-/hub-2.17.8.tgz",
-      "integrity": "sha512-FzZaxzt0f2pkFQxFB7hxicCRsB3KFDXM8l6VOjisFbJboE7nSAMcCKxxxO3ARoZMFXDFDigFWbYNaVvzB8w2mg==",
+      "version": "2.17.10",
+      "resolved": "https://registry.npmjs.org/@huggingface/hub/-/hub-2.17.10.tgz",
+      "integrity": "sha512-+2W2KKBMEMmfgFEgaWknCytsCQlyQ9Xpghv9BN5qOqkjb0l5f6mVhXBNyAVOmt/Gjny4I3Cb1ZKaUv28+0+17A==",
       "license": "MIT",
       "dependencies": {
-        "@huggingface/tasks": "^0.21.61",
+        "@huggingface/tasks": "^0.22.1",
         "@huggingface/xetchunk-wasm": "^0.2.0"
       },
       "bin": {
@@ -765,9 +765,9 @@
       }
     },
     "node_modules/@huggingface/tasks": {
-      "version": "0.21.61",
-      "resolved": "https://registry.npmjs.org/@huggingface/tasks/-/tasks-0.21.61.tgz",
-      "integrity": "sha512-bAki2SyAkxYbzYCAcOmPYq++CzCHI1CkxeVQnF2jkXAh60wnIuR+jZJ+Eha1aaI049bB1aO8H+icr4C/kvLnuw==",
+      "version": "0.22.1",
+      "resolved": "https://registry.npmjs.org/@huggingface/tasks/-/tasks-0.22.1.tgz",
+      "integrity": "sha512-/lf63T90+kAEWFnIOVsBaMsd9A3hMRaJYNaNeVeD8LD0//lJu+KFG4Q50p3pkjdXU0e+gPwvgfN2yxFdNLJ0dg==",
       "license": "MIT"
     },
     "node_modules/@huggingface/tokenizers": {
@@ -821,13 +821,13 @@
       "license": "MIT"
     },
     "node_modules/@mantine/carousel": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/carousel/-/carousel-9.7.2.tgz",
-      "integrity": "sha512-qjBcEh2Hd1EenToNIc+vE5+C3/HFpKoAEcG0CP68QbsKyJA/R43NtXEoR+sodkz33E9FlZk7O8YJz6GvuLYrbQ==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/carousel/-/carousel-9.7.4.tgz",
+      "integrity": "sha512-UAEaIl5sQvqRB30nzPXgNFsCu8m+4I5wCZKemUBEtPxFECF03HEvekBWO8yMUFp6jyjJSEguqr/y5tJm2wgpUw==",
       "license": "MIT",
       "peerDependencies": {
-        "@mantine/core": "9.7.2",
-        "@mantine/hooks": "9.7.2",
+        "@mantine/core": "9.7.4",
+        "@mantine/hooks": "9.7.4",
         "embla-carousel": ">=8.0.0",
         "embla-carousel-react": ">=8.0.0",
         "react": "^19.2.0",
@@ -835,24 +835,24 @@
       }
     },
     "node_modules/@mantine/code-highlight": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/code-highlight/-/code-highlight-9.7.2.tgz",
-      "integrity": "sha512-Vf1CGJw8QOT+roLOapSMnh/x4cdH/Qmd1kXLgkggbYuSIs5Io/6th5AbW7hFd1PXyBeZjvDos/rO+Ae85Aw6NQ==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/code-highlight/-/code-highlight-9.7.4.tgz",
+      "integrity": "sha512-YGmJI4IwR54z5MXTaRiw/BKpF2FJno2bRnYkelbrSB+ZFerqy2625AyOFv5Ey8LbT0ggr4aft7R/+SqWvcvE2w==",
       "license": "MIT",
       "dependencies": {
         "clsx": "^2.1.1"
       },
       "peerDependencies": {
-        "@mantine/core": "9.7.2",
-        "@mantine/hooks": "9.7.2",
+        "@mantine/core": "9.7.4",
+        "@mantine/hooks": "9.7.4",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
       }
     },
     "node_modules/@mantine/core": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/core/-/core-9.7.2.tgz",
-      "integrity": "sha512-+cggJDD0PO057SwZU/dKlWPjp0LaAn1nEM9W1m/Ia4Cjb/Hy9DjZ4I7R7xirp/eZ6xnV7OqeGmPFSJ8zeGa5kQ==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/core/-/core-9.7.4.tgz",
+      "integrity": "sha512-c7aTGELNn74CxG9i5/tq9BHGh0lKdKmGGz+9iDF+gR7Ipt4U1TMM286lAmLpRrKL2bR+UEaN4blZ8UJmOuGJ4Q==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/react": "^0.27.20",
@@ -862,15 +862,15 @@
         "type-fest": "^5.10.0"
       },
       "peerDependencies": {
-        "@mantine/hooks": "9.7.2",
+        "@mantine/hooks": "9.7.4",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
       }
     },
     "node_modules/@mantine/form": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/form/-/form-9.7.2.tgz",
-      "integrity": "sha512-+EskrnXLI0tzLzYh634pD3gcwZsaos5PjfxNW0Kpg7O15gugescdJnFcm4CCrNX57Saw/6fZn9IEqPx8/AcvRQ==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/form/-/form-9.7.4.tgz",
+      "integrity": "sha512-p8cImC+VgKKKRc6HJGlFtGAKNbKyHtKyDIgNJeoqUBQ1beUfQlEh0I6lmTmWCzGlijVUE+GdNJWveNr0PQKRIw==",
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
@@ -882,34 +882,34 @@
       }
     },
     "node_modules/@mantine/hooks": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/hooks/-/hooks-9.7.2.tgz",
-      "integrity": "sha512-11emsRp/Mg+vfaKVyoMwiMdCHmO/15XOL6JG9fACkclVZnLPBVvRIaDdRBudsR3ALGZ5iTzrArPJDjjoeO6X4w==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/hooks/-/hooks-9.7.4.tgz",
+      "integrity": "sha512-j6Xf9Sc1fhhGEKXg6BZA2geyP/Czqvo6Rsi0IduOCWgwl/MAAJbKRjRc7xe2+9vePLdfqLZqRIAOY5rta88uNA==",
       "license": "MIT",
       "peerDependencies": {
         "react": "^19.2.0"
       }
     },
     "node_modules/@mantine/notifications": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/notifications/-/notifications-9.7.2.tgz",
-      "integrity": "sha512-Lf/oS2bpWgalgJ7Uy2Gh2V/kqnIIM3zkeWYy+GZKunfbiQGyuDBasOGd/4RYu5ga7b8vxJzC/zINi/UdpFuxoQ==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/notifications/-/notifications-9.7.4.tgz",
+      "integrity": "sha512-LabOPnE/YtdpXHn49ZJjiJJBYnYXUMi6SFuzxje7XxpoxImZ+wdGh4R/+l89NnWTxKwGoQL51iUTL8PSgu2A1Q==",
       "license": "MIT",
       "dependencies": {
-        "@mantine/store": "9.7.2",
+        "@mantine/store": "9.7.4",
         "react-transition-group": "4.4.5"
       },
       "peerDependencies": {
-        "@mantine/core": "9.7.2",
-        "@mantine/hooks": "9.7.2",
+        "@mantine/core": "9.7.4",
+        "@mantine/hooks": "9.7.4",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
       }
     },
     "node_modules/@mantine/store": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@mantine/store/-/store-9.7.2.tgz",
-      "integrity": "sha512-ERjk46CbQeSqytWTq5cAzT4o9MBAzzvVXpPlD36B5NwB5hmbjQfdUKcr0PlZfG04a/PDPdLPvAiVp7Eeh0tk8A==",
+      "version": "9.7.4",
+      "resolved": "https://registry.npmjs.org/@mantine/store/-/store-9.7.4.tgz",
+      "integrity": "sha512-tICEOzsaV2eiV4QAegdErRLtfd0da02DKqsEIzJLa+8T5dWDnBMCqlWxHfBMnaL7HBAmpx41koad0zUZPGw7pg==",
       "license": "MIT",
       "peerDependencies": {
         "react": "^19.2.0"
@@ -1146,9 +1146,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-android-arm-eabi": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-android-arm-eabi/-/binding-android-arm-eabi-0.153.0.tgz",
-      "integrity": "sha512-BcWu25dMwMjHpaDCEidmpAi7rGg1qZoihJeUUH9bD55pVZ0z4Wa5CQgqSTo0R41H81oozisQKW3WqvAN2m77IQ==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-android-arm-eabi/-/binding-android-arm-eabi-0.155.0.tgz",
+      "integrity": "sha512-A6xv7hDtnTm+xlZ7utn6rRQpRMJHRhVr3gjRGqlx0RUX84mNk0pAsy6YN/wWhuOTkaZhRrrzaLxf0NfbH77j2w==",
       "cpu": [
         "arm"
       ],
@@ -1163,9 +1163,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-android-arm64": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-android-arm64/-/binding-android-arm64-0.153.0.tgz",
-      "integrity": "sha512-9l5rdp2DhRqVriBHsNpu5cEf+hizZ4B58rt93HzyQEBUgZiC6qe2oFpaAAnXGCxHGnQExI1s7S2G0QhFacUZ6w==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-android-arm64/-/binding-android-arm64-0.155.0.tgz",
+      "integrity": "sha512-T1wWwH9/JI5g7Z4kEQwDOwhToxdDhRyOTklH+uuNpJ16m3MZFmGl+l2rKc0NHQdbVRG2LTOBsNjpW3h1BWytPA==",
       "cpu": [
         "arm64"
       ],
@@ -1180,9 +1180,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-darwin-arm64": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-darwin-arm64/-/binding-darwin-arm64-0.153.0.tgz",
-      "integrity": "sha512-EcpsyRXHhENDpekpG4QNaSZj2F/BAz4Gh4o89zZwNss86R8KyRSQ6sXbAj74Xyeb4z3j/yBZZ6joQZhraIWyfw==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-darwin-arm64/-/binding-darwin-arm64-0.155.0.tgz",
+      "integrity": "sha512-ZoRB3qJxJ8DWA41jHja+YeB0lLfjBy4T+Kr15vnN1k65X3zbJt3rPZftEwN4Ju4tmA4K/T9dWWD7Z8ewQLnrVA==",
       "cpu": [
         "arm64"
       ],
@@ -1197,9 +1197,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-darwin-x64": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-darwin-x64/-/binding-darwin-x64-0.153.0.tgz",
-      "integrity": "sha512-hlj80HUQy07/2lYp6rmxH+3u+H2ik3rjLR52CUdPApxmZCNxASDUf/+ykTzAHS/fehftmVMATKvPaWmuLHuasg==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-darwin-x64/-/binding-darwin-x64-0.155.0.tgz",
+      "integrity": "sha512-vxtL86BtM+IgrpejA86nbTk5j0HKTIMeuaJ1fQciw6p9RfavPtIPjI7gN34owap0yG9txXBaAWpGdxokNwdqIw==",
       "cpu": [
         "x64"
       ],
@@ -1214,9 +1214,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-freebsd-x64": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-freebsd-x64/-/binding-freebsd-x64-0.153.0.tgz",
-      "integrity": "sha512-fWRcv2pMSh1qtez46MOu8vuUJ5fiaQZPHSphbWulbL7SHBMKfRgZl2PzjXZYQJbq7NEXyXbgIuIuUm+/Rmkv8w==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-freebsd-x64/-/binding-freebsd-x64-0.155.0.tgz",
+      "integrity": "sha512-tN6Ru5e0UVnWaIuiH8jEwnvxuxg7FvhWwSd3oe5oDhOD4ObsSr9/N6WfHLjilUWlPPj65ptwrSDH0Y7lzwTzmw==",
       "cpu": [
         "x64"
       ],
@@ -1231,9 +1231,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-arm-gnueabihf": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.153.0.tgz",
-      "integrity": "sha512-paZeUK1GXShl/bOJQET1/8AQxayFeuN4SIWAkgTRxE7ZQwv9uYSB2n0648smygP22N7jcI3zxAm0Z+ALNiIKxg==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-0.155.0.tgz",
+      "integrity": "sha512-h4ozA5n6L6lwolsz9iwunEhKWnIVbmFRots5QxEix0H6nJ5ICpuDa7PuShuhfpIDFe3+Qvyscioyiv+9g+4Syg==",
       "cpu": [
         "arm"
       ],
@@ -1248,9 +1248,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-arm-musleabihf": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.153.0.tgz",
-      "integrity": "sha512-qFPp5NwMf4K1C0O+DCVGmcbOaYyYAq98Rvv9p4VSfb777iUwlJCqMUxf6QG9N5f5ls4TEX6LitOZHi+6GL6rYQ==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm-musleabihf/-/binding-linux-arm-musleabihf-0.155.0.tgz",
+      "integrity": "sha512-058/+LardpfuUlsKIvBGk/CYoakEVcMgqYx8GgyUZeOxFWTojYLlCc1Gb60/y21v3esDhHidgiY/Zbq9LpBhaQ==",
       "cpu": [
         "arm"
       ],
@@ -1265,9 +1265,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-arm64-gnu": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.153.0.tgz",
-      "integrity": "sha512-oufEhZCX7saeo27Logra8cvBR1jQ/yw2zUI2hHmWw3qA/XYqEW31FOvLQBv7DWN32NjVdlcaP11WBBZTJo4k9g==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-0.155.0.tgz",
+      "integrity": "sha512-nrOt2Y3xIAzu+lSPzH0864ieO+iCCXgoo9qFlGANE8Xh0cQ+RP8Wstfp+/wXN2YCyb98cAGzX0VruKYw7it/jw==",
       "cpu": [
         "arm64"
       ],
@@ -1285,9 +1285,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-arm64-musl": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.153.0.tgz",
-      "integrity": "sha512-zXYzuAqng85h6+LI3iRm0zeMLX1/K2z41ZAMWxVRgt0D10VvZUaV5q+TEB46KDhoKBpdexoTLC6QoB/EiP2oqQ==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-arm64-musl/-/binding-linux-arm64-musl-0.155.0.tgz",
+      "integrity": "sha512-KYAayyN5hQbJPtGKtRxlyc8XYmyntOplyXSQzTDrmbz7l/GCrzQbSswvyJFBTH1LGtsZrbXOAfN52i/Kz6kLKg==",
       "cpu": [
         "arm64"
       ],
@@ -1305,9 +1305,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-ppc64-gnu": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.153.0.tgz",
-      "integrity": "sha512-J7+NLwLEzdkKM9cKyPHH/AjXXstWOs98KYgLrPPnO4N9MO8EZRBfPNnBcS3S67uMOBkRpUmCl2FhRnWdQ5CbBA==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-0.155.0.tgz",
+      "integrity": "sha512-CSuSY5hfjtsBnHXydOj8jiNfS1qHbdPZuPz1YL1cSgK7VmNYP+QlZIbG0BBYYBgX/vYEgZwbG9mBdW4YairZ5w==",
       "cpu": [
         "ppc64"
       ],
@@ -1325,9 +1325,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-riscv64-gnu": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.153.0.tgz",
-      "integrity": "sha512-sD0K11GQTLWylln54nPMMTtgmBbQrR5It/vMpZpy/fogiw8O2AvIE+9LuWUXddrWk9zvFIHGRcSgFn4IHOfoYg==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-0.155.0.tgz",
+      "integrity": "sha512-7KCfOQm+Nz2N8trAXbQkal4TQ5756WVEmhm35y816YHvyFnEfVsICsiV5k0pEszNf/fRm4cm2i6i18SJ6/iCWg==",
       "cpu": [
         "riscv64"
       ],
@@ -1345,9 +1345,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-riscv64-musl": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.153.0.tgz",
-      "integrity": "sha512-7L66uql2BhvSz51LwfExjOdn6et/ydTiQxl23VApdKzJhTc3TczA1Qt6VR/UcvlQrL2ZbytIJb447vh7p5wmUw==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-0.155.0.tgz",
+      "integrity": "sha512-JSlhgoK+/g1TGJI5NuADx2+6syhxnQNLCWLXyO5QLFyetomcr/vIxSdiNlmyAv963YXUzCuwAwRG6npZ5xyJ1A==",
       "cpu": [
         "riscv64"
       ],
@@ -1365,9 +1365,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-s390x-gnu": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.153.0.tgz",
-      "integrity": "sha512-hXV3T7mNyrPR19rbPYkglkQJtoM/UNo/xwbZeeqdAxEg8PXgb4LXXuxPpGgI4bzRRCWwLUxdDSS58xIyC2u1TA==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-0.155.0.tgz",
+      "integrity": "sha512-WFIX+dPokWp64mi434Md3U3lJaTwNxAphvGjpltoyQjGUsdXavOIRrnp9dOS34Hd75HOAwDxAI+YwWOwqmJbtg==",
       "cpu": [
         "s390x"
       ],
@@ -1385,9 +1385,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-x64-gnu": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.153.0.tgz",
-      "integrity": "sha512-Da8Vqs1xdtoDYtEjmozD7wGgJeLBQkMbR0WUBECOSxodyX5DXy8ySlvJWbukyO2Q0+TM9EK+4LT6tbq0jCg4hQ==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-x64-gnu/-/binding-linux-x64-gnu-0.155.0.tgz",
+      "integrity": "sha512-g6xSDC/JpbnVOz5uafMGyK3txBVRFMQTx8opv/yHXGxqV3ZMVl3bf7W8XrSnF68dmy3gM4dgReNryuE53+WkeQ==",
       "cpu": [
         "x64"
       ],
@@ -1405,9 +1405,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-linux-x64-musl": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-x64-musl/-/binding-linux-x64-musl-0.153.0.tgz",
-      "integrity": "sha512-zGAPxNTIIw6X5WyTRscIFE/oDjpdNtrrl32ing6NOXdGjzRucadnxBilexLdeYQ9YxixF93GujpXyQ0jw7ddSg==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-linux-x64-musl/-/binding-linux-x64-musl-0.155.0.tgz",
+      "integrity": "sha512-6/4xlxKlZJWrQ0uwDFPc0H9+xLu7068CKhX3vIDW3SbvP/lVgnVuT5v6dyugeWskWpuxqF/WJ4WKwhxjU3pG2w==",
       "cpu": [
         "x64"
       ],
@@ -1425,9 +1425,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-openharmony-arm64": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-openharmony-arm64/-/binding-openharmony-arm64-0.153.0.tgz",
-      "integrity": "sha512-GoHzpqP5XyPIp9DHokoEdCp+K4UPl/h1neFj1uXnUB3pJYyOQ7NOhFVOttNUgCGcj2eywAvu5cRivTOSq4S10g==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-openharmony-arm64/-/binding-openharmony-arm64-0.155.0.tgz",
+      "integrity": "sha512-tltklL0J0XjDxIRTBXWOBhvc2mitcmES45pIxhwDWfxRyqz7Vkeu0NekTZEIxGE4f/lXgq3vZcjjffteQOVorg==",
       "cpu": [
         "arm64"
       ],
@@ -1442,9 +1442,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-win32-arm64-msvc": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.153.0.tgz",
-      "integrity": "sha512-xGcy12tO9k7zFbeyQzEuilfWfQpyRq23/fLPfN3wjSWuWv58k46fQT1hsO1KFNykZuVGW9xSJE/z592TmAoSDA==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-0.155.0.tgz",
+      "integrity": "sha512-alAb9TzjatUEsOeoncAziUnfdTDxfyswhalFZ9sC6plUgATIUx2NIZ0+bMn6aJ28AduS1OpG/OAisr/YISn4Ig==",
       "cpu": [
         "arm64"
       ],
@@ -1459,9 +1459,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-win32-ia32-msvc": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.153.0.tgz",
-      "integrity": "sha512-o1ykUjWncvXX6N5a4KebgLjtD8zRui+f1llMhSGoSC9oP2KOqapRpdwmZ3NcNG0axFouwVKmhGBjd+IhA8BksA==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-0.155.0.tgz",
+      "integrity": "sha512-yc5cbSfcGmRv/KpxDFuyk8adEBaWd/9HilWvBbQ4bFbus1V2PUh2mGB2Cfq9rqZTqLeiMT8x0skV+LKp9hOMgQ==",
       "cpu": [
         "ia32"
       ],
@@ -1476,9 +1476,9 @@
       }
     },
     "node_modules/@oxc-parser/binding-win32-x64-msvc": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.153.0.tgz",
-      "integrity": "sha512-gxQz7G96Up136fd+2zWrP+o6FYGs9NO4Dyv55IoeJFJUDwLFHcLYY11hhA5wQKs0HoM57Q8esQ3nEVhnCdsjAQ==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-parser/binding-win32-x64-msvc/-/binding-win32-x64-msvc-0.155.0.tgz",
+      "integrity": "sha512-8heq6jGq+rfpTDRDjoQiBHw0maQZf3IXkS99pdHQZPoTL5kyF5qyPS0RidUlSdnWDIqxXb5nux7GBD9cT+imUw==",
       "cpu": [
         "x64"
       ],
@@ -1493,9 +1493,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.152.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.152.0.tgz",
-      "integrity": "sha512-oM/5rLBm2tPkg0iBgkH/FOeR3PCDpY19GTgAZjMFM8h9WI9VW7cLgzp6nwtarYKmovavIQZ+Fe/RKX/8C8O/Rw==",
+      "version": "0.154.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz",
+      "integrity": "sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/oxc-project"
@@ -1869,9 +1869,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@rolldown/binding-android-arm-eabi": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.12.tgz",
-      "integrity": "sha512-dB/a1214qKfHMXCpgqR4OZT+jS4kTyEXbQGJPqzobt5EwH5rX080pxE37alt3RzvR1bf1Yz/yGqRfrYAxuPw0A==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.14.tgz",
+      "integrity": "sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==",
       "cpu": [
         "arm"
       ],
@@ -1885,9 +1885,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.12.tgz",
-      "integrity": "sha512-7KHFgQ5VJxIHcLlrwrc3Xbds7oTNQT7Pgi9gQCJKrd2VGab/UksIOYp6VD8MzCstGxOKMgNamPwUCfxPdP1OHg==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.14.tgz",
+      "integrity": "sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==",
       "cpu": [
         "arm64"
       ],
@@ -1901,9 +1901,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.12.tgz",
-      "integrity": "sha512-3YIhqHD96nA5SaYNRBR16HnGv4oavZvXfD/ayHM+oYZ0WD/8lBAtf6zQua4kEyAvpqrluKXl0lnOBoiNby7x9w==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.14.tgz",
+      "integrity": "sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==",
       "cpu": [
         "arm64"
       ],
@@ -1917,9 +1917,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.12.tgz",
-      "integrity": "sha512-UuuJ35MFw4gmFOrE9pEqIV+K3syIKveph+Qc1/ljHZVdoDW4pz/JHR/eMVom+TZGl/5OOvGJOWaOCVt3ZfqhxA==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.14.tgz",
+      "integrity": "sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==",
       "cpu": [
         "x64"
       ],
@@ -1933,9 +1933,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.12.tgz",
-      "integrity": "sha512-uMvssit0a4W+/7D8CbHUvG719mH3R2jwXAlh/XcPvuHTE0g++LymF88DCGNX0HM2rBOn0xrzgXktIB6fLSJBTQ==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.14.tgz",
+      "integrity": "sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==",
       "cpu": [
         "x64"
       ],
@@ -1949,9 +1949,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.12.tgz",
-      "integrity": "sha512-XcFu0R0xWnwzSf4IQgFH1rJIckPN1pLy2R+4r9IDB7Yfu/ys9cVqfa4pBrMHj7a3gl8mIR4nRNPg0e5IvEVs6g==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.14.tgz",
+      "integrity": "sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==",
       "cpu": [
         "arm"
       ],
@@ -1965,9 +1965,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.12.tgz",
-      "integrity": "sha512-260UrKgn8tz39ak+SMDOirKzr7V04M9dWPw5llW00SwBivCZoWcRBKV1d8cXnRkUmSZA3BdiUmBHWk7734Ulpw==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.14.tgz",
+      "integrity": "sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==",
       "cpu": [
         "arm64"
       ],
@@ -1984,9 +1984,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.12.tgz",
-      "integrity": "sha512-5YK1I9SqDkbPgc1IA8BgDl34suqUS2q0KWnBrirm0E51YjOs6eo6dV6jbQfNE/argHRSvd0QUGgtpIoYx+WWpw==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.14.tgz",
+      "integrity": "sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==",
       "cpu": [
         "arm64"
       ],
@@ -2003,9 +2003,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.12.tgz",
-      "integrity": "sha512-Rkcrmp7eFRg74yL5fXEU91JEWbdEPLevWwGtXpmhbjlD1StScbWTmO94Bhly+Mo+ketKYkdmM1vNUKeWSlx8cQ==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.14.tgz",
+      "integrity": "sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==",
       "cpu": [
         "ppc64"
       ],
@@ -2022,9 +2022,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.12.tgz",
-      "integrity": "sha512-qvK4DuAsQc2BSjlx+Xr+IzOIvvxbGZqxFwdWfG6F518Erj0GGISyQbJ6pIappnOxlNPzNHvo/L0BwB30GZ+zVw==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.14.tgz",
+      "integrity": "sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==",
       "cpu": [
         "s390x"
       ],
@@ -2041,9 +2041,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.12.tgz",
-      "integrity": "sha512-Q9uLBO53Xd4QIq1WOycVQyPP1O4HhraEV2qqb3uTrnVw6QZih9duY4vNXOivL1xoUS1/z+W8eF4NMfl2a8Sdjw==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.14.tgz",
+      "integrity": "sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==",
       "cpu": [
         "x64"
       ],
@@ -2060,9 +2060,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.12.tgz",
-      "integrity": "sha512-3IBxWFMjbOZskDPKv8Lf9BCnahlKuHthWkYnyIxOH/QcJrFcS4EmcenthApkwr/5+nEqZlLzeYbxeMaX7A5u4g==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.14.tgz",
+      "integrity": "sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==",
       "cpu": [
         "x64"
       ],
@@ -2079,9 +2079,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.12.tgz",
-      "integrity": "sha512-xtX61xg4LKPkPWilZU1ynKClz5Gj4bf74LML4r3eVLWumKnGjoEr1OSHQhMdbBDoYTi+yjrujvpZe2pUnqCrrA==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.14.tgz",
+      "integrity": "sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==",
       "cpu": [
         "arm64"
       ],
@@ -2095,9 +2095,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.12.tgz",
-      "integrity": "sha512-At7fPB6PCaIjzgIhEZFxuT+BBFqiQibJDT4d3PhiR3f4E7bbMZF4aKblbFfEM3sETRDd1YiQx/+U/g/B/ou5Ew==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.14.tgz",
+      "integrity": "sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==",
       "cpu": [
         "arm64"
       ],
@@ -2111,9 +2111,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.12.tgz",
-      "integrity": "sha512-WIw2haVKwjuYdXkHaoC0mF8Le71TuCBxjrdKqLbJGctbBABj+ClfmNvtbOnzpq3RokNo5+V1qhtSzJyXorsklQ==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.14.tgz",
+      "integrity": "sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==",
       "cpu": [
         "x64"
       ],
@@ -2267,9 +2267,9 @@
       "license": "MIT"
     },
     "node_modules/@tabler/icons": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.49.0.tgz",
-      "integrity": "sha512-l+GnSkFETx0U26icxv1VUFnxxiTqXfCcVRiRAnyMwibupM2S2L/hSaZ9gmSgz01rkrsH/93NvLsxykqdanc6lw==",
+      "version": "3.50.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons/-/icons-3.50.0.tgz",
+      "integrity": "sha512-HflLxyrH1cqC7s7jzQGSjpsTAVIoaf7+/yHjbdM59rJQBMjliibp+LYhDPFxOMcwa1M8DNpOk6ENzQiWn9a1Dg==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -2277,12 +2277,12 @@
       }
     },
     "node_modules/@tabler/icons-react": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.49.0.tgz",
-      "integrity": "sha512-Um59pm5RVNUaQjFUtG0r4oYJbZuBS3tGugAA2tgBg0WufMk34Eio3nsO30RUkLuL2giYPQUNdY9HvqltLLYyNA==",
+      "version": "3.50.0",
+      "resolved": "https://registry.npmjs.org/@tabler/icons-react/-/icons-react-3.50.0.tgz",
+      "integrity": "sha512-X9XhFbxAmSNimQ71VAd7opfd4z84x1pLrEbBT33VCIEsFs8zWVqdhh5r/Jyi/3iJjQ861kE5Wm9ixiJfS2nwBA==",
       "license": "MIT",
       "dependencies": {
-        "@tabler/icons": "3.49.0"
+        "@tabler/icons": "3.50.0"
       },
       "funding": {
         "type": "github",
@@ -2482,12 +2482,12 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "24.19.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.19.2.tgz",
-      "integrity": "sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ==",
+      "version": "26.6.6",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.6.tgz",
+      "integrity": "sha512-MzQj+8Kx3XI40OmUAE6Qoh58ZMNstNNMwn2nfd3qWsfe7nDNSqJNzes4njhz6AHwrSHOffSLwXU6yb474Q4aog==",
       "license": "MIT",
       "dependencies": {
-        "undici-types": ">=7.24.0 <7.24.7"
+        "undici-types": "~8.9.0"
       }
     },
     "node_modules/@types/react": {
@@ -3024,14 +3024,14 @@
       }
     },
     "node_modules/ai": {
-      "version": "7.0.142",
-      "resolved": "https://registry.npmjs.org/ai/-/ai-7.0.142.tgz",
-      "integrity": "sha512-Tifni6/6nNhCu4GnFEeYYR7CGmJ3Yhm44SGxYrOupqP2aaZwmGGiiB5Zx4hiauJR0AWimcXULejDT+Qsj+SHOQ==",
+      "version": "7.0.159",
+      "resolved": "https://registry.npmjs.org/ai/-/ai-7.0.159.tgz",
+      "integrity": "sha512-4e/BwDoKJlMNYZaqERcTbGte+4TwroN9qKnCprog/XVfD9InzVPlhCviDhN452JIRrRsYg9BT0WsQ2C3Ds2mVQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/gateway": "4.0.115",
-        "@ai-sdk/provider": "4.0.28",
-        "@ai-sdk/provider-utils": "5.0.61"
+        "@ai-sdk/gateway": "4.0.132",
+        "@ai-sdk/provider": "4.0.35",
+        "@ai-sdk/provider-utils": "5.0.72"
       },
       "engines": {
         "node": ">=22"
@@ -3040,18 +3040,6 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/ai/node_modules/@ai-sdk/provider": {
-      "version": "4.0.28",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.28.tgz",
-      "integrity": "sha512-6ThcmkJQXSMlBrf6mirIjUUS04Q5/kApbYTOzd5lZfYXLa1XPpnDLxP/G96/DKc00fDIUOW9S2ls0mSzb0+l9w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "json-schema": "^0.4.0"
-      },
-      "engines": {
-        "node": ">=22"
-      }
-    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -3587,9 +3575,9 @@
       }
     },
     "node_modules/dexie": {
-      "version": "4.4.6",
-      "resolved": "https://registry.npmjs.org/dexie/-/dexie-4.4.6.tgz",
-      "integrity": "sha512-hJP/BO6mjB+tX6hToIO1kmxYLNmun90wYbfcoAoLpKEyDYal/k33dg0TAfoUe2TDsbbLoVIzljJ3BN2UbR5EOg==",
+      "version": "4.4.7",
+      "resolved": "https://registry.npmjs.org/dexie/-/dexie-4.4.7.tgz",
+      "integrity": "sha512-wemFiCl3DTCnfzyqepUTX1ugbYbkTrw3aEZOG7YjAOUoEQB5g5PrEywPzk5JpbX/SxqQ9IvjUpxCDIEjoOWEfA==",
       "license": "Apache-2.0"
     },
     "node_modules/dom-accessibility-api": {
@@ -3665,9 +3653,9 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "18.0.8",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.8.tgz",
-      "integrity": "sha512-2KDeoFoK/zRtcnbunCDlLG5VWVMcyqeQc6iK65o231nfNAcuGrKoqUQfJFUtBI+QlShk5HKIHxwebBtUl3rEfA==",
+      "version": "18.0.9",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.9.tgz",
+      "integrity": "sha512-3fVOW4cB02R066PUSwn8O4TJyz9NckQl7F81blIbaq9jKBm2tSmOKky7ZHIXzGvkVPXCSn6jkpziBPZdGFs8Tw==",
       "license": "BSD-2-Clause",
       "bin": {
         "dotenv": "dist/index.cjs"
@@ -3838,9 +3826,9 @@
       "license": "MIT"
     },
     "node_modules/fake-indexeddb": {
-      "version": "6.2.5",
-      "resolved": "https://registry.npmjs.org/fake-indexeddb/-/fake-indexeddb-6.2.5.tgz",
-      "integrity": "sha512-CGnyrvbhPlWYMngksqrSSUT1BAVP49dZocrHuK0SvtR0D5TMs5wP0o3j7jexDJW01KSadjBp1M/71o/KR3nD1w==",
+      "version": "6.2.7",
+      "resolved": "https://registry.npmjs.org/fake-indexeddb/-/fake-indexeddb-6.2.7.tgz",
+      "integrity": "sha512-g0ghQ+BmU3CSZaHup5FigEAAtCmtNyxkrmID7OAeK2qONHghw1aQ2l2T1RxmfhP1H1tEXVRWArUTGVCk5832ww==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -4023,9 +4011,9 @@
       }
     },
     "node_modules/gpt-tokenizer": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/gpt-tokenizer/-/gpt-tokenizer-4.0.3.tgz",
-      "integrity": "sha512-GrrPDreSy2c3ZgM/u+5JN+lnHTLrJKm7QAFfTD5J+vgcSP69C+fFIUaJWiey/QQ8lS5u79OvluKuEmGBAbOS4A==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/gpt-tokenizer/-/gpt-tokenizer-4.1.0.tgz",
+      "integrity": "sha512-r7Op7S3iPy9vGpcfHmfIlLN/+/mNL2kXDy3N/ppp2xC2pm57pyYTt3fqsncMZ/yfIT+d3mTGhd7H6fcF/qiqWg==",
       "license": "MIT"
     },
     "node_modules/graceful-fs": {
@@ -4458,9 +4446,9 @@
       "license": "MIT"
     },
     "node_modules/jscpd": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.4.1.tgz",
-      "integrity": "sha512-afUt+LSQMmzSPYrWZlNGTwj8X4tmwVJbMNmr92qxPf4uUF/naLwG7SQyMPEZtrHqGgzGxmAzNjiwlVdjls2MyQ==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd/-/jscpd-5.4.2.tgz",
+      "integrity": "sha512-bxZ1ObA4NyWBcM7Zh+QoGrdcMovbCxrDofFaLo2Lwgk/Axe/e45VYu8EM+mpPx2CpU/QGCoktONRnaRZl8Yq2w==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -4473,20 +4461,20 @@
         "url": "https://opencollective.com/jscpd"
       },
       "optionalDependencies": {
-        "jscpd-darwin-arm64": "5.4.1",
-        "jscpd-darwin-x64": "5.4.1",
-        "jscpd-linux-arm64-gnu": "5.4.1",
-        "jscpd-linux-arm64-musl": "5.4.1",
-        "jscpd-linux-x64-gnu": "5.4.1",
-        "jscpd-linux-x64-musl": "5.4.1",
-        "jscpd-windows-arm64-msvc": "5.4.1",
-        "jscpd-windows-x64-msvc": "5.4.1"
+        "jscpd-darwin-arm64": "5.4.2",
+        "jscpd-darwin-x64": "5.4.2",
+        "jscpd-linux-arm64-gnu": "5.4.2",
+        "jscpd-linux-arm64-musl": "5.4.2",
+        "jscpd-linux-x64-gnu": "5.4.2",
+        "jscpd-linux-x64-musl": "5.4.2",
+        "jscpd-windows-arm64-msvc": "5.4.2",
+        "jscpd-windows-x64-msvc": "5.4.2"
       }
     },
     "node_modules/jscpd-darwin-arm64": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.4.1.tgz",
-      "integrity": "sha512-LXHVeH60C9BsozcVIMPmXWvj97KqFKbCJYmYG4hDwfwIwS1kz+uF7yiObckP6h2xo12pD88nI4XjWTB5frjZUw==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-darwin-arm64/-/jscpd-darwin-arm64-5.4.2.tgz",
+      "integrity": "sha512-EGoPYQZqESW2kJfxKZrUYsYWhzq2Irk6sBQQWZ7VPAGj2wwk3n8HtDP2FnJOiHWZtSz55I8zQWldzIrD55B5Vw==",
       "cpu": [
         "arm64"
       ],
@@ -4498,9 +4486,9 @@
       ]
     },
     "node_modules/jscpd-darwin-x64": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.4.1.tgz",
-      "integrity": "sha512-Gqck4tcMZjv4IvYHU2Vcikb885zTADo5T/YfEqeu1i5W5tfFpLdViiTYrh5wbrW+uxBqC33gHpG1hy0xbGYknQ==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-darwin-x64/-/jscpd-darwin-x64-5.4.2.tgz",
+      "integrity": "sha512-/bz/rgoahqeK0p5r+KjeTTS59d7bZpMxD7hQ4CaQ0qKZWBZIyu7hRdExzJ7/KrCEJ5cmRogvXX1jhFqldYLNXw==",
       "cpu": [
         "x64"
       ],
@@ -4512,9 +4500,9 @@
       ]
     },
     "node_modules/jscpd-linux-arm64-gnu": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.4.1.tgz",
-      "integrity": "sha512-XUYZJZVxSY7JIBEoyOOMTgvJwmymkns4wG55tu6I/vRKXnS5QtaTESQfRLt6xj1+62aflAvr01FAhPAy+du6tA==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-gnu/-/jscpd-linux-arm64-gnu-5.4.2.tgz",
+      "integrity": "sha512-YW/eX+mOYZmT/A3QEARYmJQoVQNV/cfecKCobNXZcD3mE57drpKHmJnvuL9uS85z0cUKWGCM57JVkVz6Y9oxxw==",
       "cpu": [
         "arm64"
       ],
@@ -4529,9 +4517,9 @@
       ]
     },
     "node_modules/jscpd-linux-arm64-musl": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.4.1.tgz",
-      "integrity": "sha512-h2sH8Bk++yBxWqq2QAy4fvPzXkw1vecDSyOmzLwPfnRQoQ2Q/EWxCNOrgJSb+SNMLWoHLLzfqx8m9wt2GG6a8w==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-linux-arm64-musl/-/jscpd-linux-arm64-musl-5.4.2.tgz",
+      "integrity": "sha512-jOLTO8YVRz65NaeYNeXoIf13yOPWhbM61xKXpv51DXQ2BXce6XfgPaJVeDCOM5s+8mt6aDtq0BZ8zptNeqGuIw==",
       "cpu": [
         "arm64"
       ],
@@ -4546,9 +4534,9 @@
       ]
     },
     "node_modules/jscpd-linux-x64-gnu": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.4.1.tgz",
-      "integrity": "sha512-UiC4YoGAVVLy6hPVz8A6cndo7W5br4FAO2hADnFeinhBPnXPu0QFh1q/s/8B3ldeQHQkpYd/l5cjqNBMrbm78w==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-linux-x64-gnu/-/jscpd-linux-x64-gnu-5.4.2.tgz",
+      "integrity": "sha512-eAmKLxx+pIOEX4lZ342CCCjL5bvf+a3gdmaaVHXiGIx2Zr3zKkF32YkfuN2sCvCui5I/wnely80XsRvVVFO47Q==",
       "cpu": [
         "x64"
       ],
@@ -4563,9 +4551,9 @@
       ]
     },
     "node_modules/jscpd-linux-x64-musl": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.4.1.tgz",
-      "integrity": "sha512-toAafl5roqfFotPrDJNMY9noNVZ9dReBqcO/nT5pJ8+7aq+opbscaLUcV4+8jxTq5btUD6CiO72+Fu+TyUZv3Q==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-linux-x64-musl/-/jscpd-linux-x64-musl-5.4.2.tgz",
+      "integrity": "sha512-ers9YFscD6DrmhyjBDXo/L+yBKcclHdWTFLMulYVGLcoGRKfBFhmK08MI3ajN/GMmCpJu7rkDYKL3egdfE8OIw==",
       "cpu": [
         "x64"
       ],
@@ -4580,9 +4568,9 @@
       ]
     },
     "node_modules/jscpd-windows-arm64-msvc": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.4.1.tgz",
-      "integrity": "sha512-JLMga/NIwv/OPurPsXA2/d5OdWfdwrsBk2D4NhyKnrV/uNjo1BIi2zXztzDyTQVKMK/TEK6GPgLD143GG1fZ0A==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-windows-arm64-msvc/-/jscpd-windows-arm64-msvc-5.4.2.tgz",
+      "integrity": "sha512-kOhVw4cVhN8T9jr3OVThB3pPpbff0ITHTwpJ/+4EGzMkbf0y6QtPpHDzRgiHJj7u1FSTBXTI6VhPhDUhT/os1g==",
       "cpu": [
         "arm64"
       ],
@@ -4594,9 +4582,9 @@
       ]
     },
     "node_modules/jscpd-windows-x64-msvc": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.4.1.tgz",
-      "integrity": "sha512-sN57Y9YP3ijrqc1IsWDceOFHUwbukg9/mU2NSDHTryKKc5CUvWz+o9GId8uKTiJIhkKfR/Ce5GKkCepTwB6kaw==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/jscpd-windows-x64-msvc/-/jscpd-windows-x64-msvc-5.4.2.tgz",
+      "integrity": "sha512-BuR5DCV7F/G5ukMEIzCrz43ea5C0t0ALcP7v+opOWefoi4aiQYCEmtoRwfXMM/zjOmNYmvJBDDfeH05U9uuzEg==",
       "cpu": [
         "x64"
       ],
@@ -4671,9 +4659,9 @@
       }
     },
     "node_modules/knip": {
-      "version": "6.41.0",
-      "resolved": "https://registry.npmjs.org/knip/-/knip-6.41.0.tgz",
-      "integrity": "sha512-DrhQlIuV6xScd5Q+WTF1znd1w41QzxFGCtAHXCajsH/ndGMotHoNYbdXbuFtzW3mIOmniHtZ7zCtvnQkUmJtQQ==",
+      "version": "6.44.0",
+      "resolved": "https://registry.npmjs.org/knip/-/knip-6.44.0.tgz",
+      "integrity": "sha512-mT0fl71Mqrko91azUO2Jw/uhYKwldORKT4liRq6yV0ZAtt6G2eYusdnvx8eBSQJDjvhRGKkpKUUx+vUG6syV4w==",
       "dev": true,
       "funding": [
         {
@@ -4690,13 +4678,13 @@
         "formatly": "^0.11.4",
         "get-tsconfig": "4.14.3",
         "jiti": "^2.7.0",
-        "oxc-parser": "^0.153.0",
+        "oxc-parser": "^0.155.0",
         "oxc-resolver": "11.24.2",
         "picomatch": "^4.0.7",
         "smol-toml": "^1.9.0",
         "strip-json-comments": "5.0.3",
         "tinyglobby": "^0.2.17",
-        "unbash": "^5.0.0",
+        "unbash": "^6.0.1",
         "yaml": "^2.9.1",
         "zod": "^4.6.5"
       },
@@ -6092,15 +6080,15 @@
       }
     },
     "node_modules/onnxruntime-common": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.30.0.tgz",
-      "integrity": "sha512-7fdVWjAID1dVhH/G8qK3APARunV4VkBFoCQAP7qp4Wkab0mrorvmc+sqiT+mKXOzDqdjN5j+/Z9nb4gzNPWcyA==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/onnxruntime-common/-/onnxruntime-common-1.31.1.tgz",
+      "integrity": "sha512-F+nnYNiQtmNJ95V6R/isBJqiVpdANCrsMEg1OaF+Bkbl3GAtzWLR7Ng17Ld0QtYtYJyotOHPJzOQn1Y6PLZjpg==",
       "license": "MIT"
     },
     "node_modules/onnxruntime-node": {
-      "version": "1.30.0",
-      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.30.0.tgz",
-      "integrity": "sha512-twhs1C2C/BFkz1yc5OY0KIU2GUq6DURO7hD4bx5Q2Qy3nAMJwRXW8xU3NVczE29VA9lolLOYepoD8fjTGOfIqw==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.31.1.tgz",
+      "integrity": "sha512-ijnSghbDHVWaQ2nDPmVccPlCHI8kH1Mx1aJ4a/qzRP16bBcVs4E3EqZQKZCkhWnbqN1tuQWxagimFtDpbPYYQw==",
       "hasInstallScript": true,
       "license": "MIT",
       "os": [
@@ -6111,7 +6099,7 @@
       "dependencies": {
         "adm-zip": "^0.6.0",
         "global-agent": "^4.1.3",
-        "onnxruntime-common": "1.30.0"
+        "onnxruntime-common": "1.31.1"
       }
     },
     "node_modules/onnxruntime-web": {
@@ -6155,13 +6143,13 @@
       }
     },
     "node_modules/oxc-parser": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/oxc-parser/-/oxc-parser-0.153.0.tgz",
-      "integrity": "sha512-cEnpyyV1OJRXv++SFNw0z8i+2o/cr88rVLaOYJafELDoHM5yHvCAbwGRLvxuany6SNLcbblSMUyZaGzH+quSYg==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/oxc-parser/-/oxc-parser-0.155.0.tgz",
+      "integrity": "sha512-C/ReSf1JUFukK/zvk6jhcNibSssvas5+ktIzK7fbKVd3CedWe59C3QwHEOrEZj/4Rt9+xg0Jeis/Jv1F/KM1mw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "^0.153.0"
+        "@oxc-project/types": "^0.155.0"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
@@ -6170,31 +6158,31 @@
         "url": "https://github.com/sponsors/oxc-project"
       },
       "optionalDependencies": {
-        "@oxc-parser/binding-android-arm-eabi": "0.153.0",
-        "@oxc-parser/binding-android-arm64": "0.153.0",
-        "@oxc-parser/binding-darwin-arm64": "0.153.0",
-        "@oxc-parser/binding-darwin-x64": "0.153.0",
-        "@oxc-parser/binding-freebsd-x64": "0.153.0",
-        "@oxc-parser/binding-linux-arm-gnueabihf": "0.153.0",
-        "@oxc-parser/binding-linux-arm-musleabihf": "0.153.0",
-        "@oxc-parser/binding-linux-arm64-gnu": "0.153.0",
-        "@oxc-parser/binding-linux-arm64-musl": "0.153.0",
-        "@oxc-parser/binding-linux-ppc64-gnu": "0.153.0",
-        "@oxc-parser/binding-linux-riscv64-gnu": "0.153.0",
-        "@oxc-parser/binding-linux-riscv64-musl": "0.153.0",
-        "@oxc-parser/binding-linux-s390x-gnu": "0.153.0",
-        "@oxc-parser/binding-linux-x64-gnu": "0.153.0",
-        "@oxc-parser/binding-linux-x64-musl": "0.153.0",
-        "@oxc-parser/binding-openharmony-arm64": "0.153.0",
-        "@oxc-parser/binding-win32-arm64-msvc": "0.153.0",
-        "@oxc-parser/binding-win32-ia32-msvc": "0.153.0",
-        "@oxc-parser/binding-win32-x64-msvc": "0.153.0"
+        "@oxc-parser/binding-android-arm-eabi": "0.155.0",
+        "@oxc-parser/binding-android-arm64": "0.155.0",
+        "@oxc-parser/binding-darwin-arm64": "0.155.0",
+        "@oxc-parser/binding-darwin-x64": "0.155.0",
+        "@oxc-parser/binding-freebsd-x64": "0.155.0",
+        "@oxc-parser/binding-linux-arm-gnueabihf": "0.155.0",
+        "@oxc-parser/binding-linux-arm-musleabihf": "0.155.0",
+        "@oxc-parser/binding-linux-arm64-gnu": "0.155.0",
+        "@oxc-parser/binding-linux-arm64-musl": "0.155.0",
+        "@oxc-parser/binding-linux-ppc64-gnu": "0.155.0",
+        "@oxc-parser/binding-linux-riscv64-gnu": "0.155.0",
+        "@oxc-parser/binding-linux-riscv64-musl": "0.155.0",
+        "@oxc-parser/binding-linux-s390x-gnu": "0.155.0",
+        "@oxc-parser/binding-linux-x64-gnu": "0.155.0",
+        "@oxc-parser/binding-linux-x64-musl": "0.155.0",
+        "@oxc-parser/binding-openharmony-arm64": "0.155.0",
+        "@oxc-parser/binding-win32-arm64-msvc": "0.155.0",
+        "@oxc-parser/binding-win32-ia32-msvc": "0.155.0",
+        "@oxc-parser/binding-win32-x64-msvc": "0.155.0"
       }
     },
     "node_modules/oxc-parser/node_modules/@oxc-project/types": {
-      "version": "0.153.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.153.0.tgz",
-      "integrity": "sha512-jSNrRIyvPVLL5E1z/tS5zLAprosGz/FuI1PWwEOz59j3E4TTTzSpqKb/RDGqJhhW0QHYISGXxq582wGx6T11Tw==",
+      "version": "0.155.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.155.0.tgz",
+      "integrity": "sha512-SeE8JPwW1xs1tHeNycjUtUBdhorRa8o4jlvjwk49R7/Z291i+4DQa7JJIgOm/TaYQZx+QrPQbVJ/9c8dMIZN8Q==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -6408,9 +6396,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.30",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.30.tgz",
-      "integrity": "sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA==",
+      "version": "8.5.32",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.32.tgz",
+      "integrity": "sha512-LJlKCCAUFKOuZxipUdYw1NzIITEsPcgyOG9LkvRJvuKj/bRzbuRY0ARXvL0pWGpsZvn8jku+LMep2eU0seHp8g==",
       "funding": [
         {
           "type": "opencollective",
@@ -6730,9 +6718,9 @@
       }
     },
     "node_modules/rate-limiter-flexible": {
-      "version": "11.2.2",
-      "resolved": "https://registry.npmjs.org/rate-limiter-flexible/-/rate-limiter-flexible-11.2.2.tgz",
-      "integrity": "sha512-n6M+msT0OWdril3PgkAjatDME2BEDhf8nBx4lJj9pMFQVcN6ldXtZvTX3nZdFqqX5utQ7kCUzq7LfyfmA2wglw==",
+      "version": "11.2.3",
+      "resolved": "https://registry.npmjs.org/rate-limiter-flexible/-/rate-limiter-flexible-11.2.3.tgz",
+      "integrity": "sha512-w4HX4toAsEbu1VksOauZwI9d6URb6/4WqJJ5Hg1bESihMt2KJfQ2iTwvDkhIg+y2HetLh65DGu/8xIkUz/xNPA==",
       "license": "ISC"
     },
     "node_modules/react": {
@@ -7052,12 +7040,12 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.12.tgz",
-      "integrity": "sha512-8wafseiaG80xmXSfqidUNqZcylTlhmPZZt+za2m+js2sFZ8dTNlhIOV2WcbIPx2hgwPBJpEUGFAMZ9bgBBLTSQ==",
+      "version": "1.2.14",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.14.tgz",
+      "integrity": "sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==",
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.152.0",
+        "@oxc-project/types": "=0.154.0",
         "@rolldown/pluginutils": "^1.0.0"
       },
       "bin": {
@@ -7067,21 +7055,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm-eabi": "1.2.12",
-        "@rolldown/binding-android-arm64": "1.2.12",
-        "@rolldown/binding-darwin-arm64": "1.2.12",
-        "@rolldown/binding-darwin-x64": "1.2.12",
-        "@rolldown/binding-freebsd-x64": "1.2.12",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.2.12",
-        "@rolldown/binding-linux-arm64-gnu": "1.2.12",
-        "@rolldown/binding-linux-arm64-musl": "1.2.12",
-        "@rolldown/binding-linux-ppc64-gnu": "1.2.12",
-        "@rolldown/binding-linux-s390x-gnu": "1.2.12",
-        "@rolldown/binding-linux-x64-gnu": "1.2.12",
-        "@rolldown/binding-linux-x64-musl": "1.2.12",
-        "@rolldown/binding-openharmony-arm64": "1.2.12",
-        "@rolldown/binding-win32-arm64-msvc": "1.2.12",
-        "@rolldown/binding-win32-x64-msvc": "1.2.12"
+        "@rolldown/binding-android-arm-eabi": "1.2.14",
+        "@rolldown/binding-android-arm64": "1.2.14",
+        "@rolldown/binding-darwin-arm64": "1.2.14",
+        "@rolldown/binding-darwin-x64": "1.2.14",
+        "@rolldown/binding-freebsd-x64": "1.2.14",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.14",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.14",
+        "@rolldown/binding-linux-arm64-musl": "1.2.14",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.14",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.14",
+        "@rolldown/binding-linux-x64-gnu": "1.2.14",
+        "@rolldown/binding-linux-x64-musl": "1.2.14",
+        "@rolldown/binding-openharmony-arm64": "1.2.14",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.14",
+        "@rolldown/binding-win32-x64-msvc": "1.2.14"
       }
     },
     "node_modules/rollup-plugin-visualizer": {
@@ -7651,9 +7639,9 @@
       }
     },
     "node_modules/unbash": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unbash/-/unbash-5.0.0.tgz",
-      "integrity": "sha512-RYNm/ISFtflWpIcXTPHHLJZ0mqzInav+L9ke9PcL+hHsSf9+Fd/syPb614Mlqs/O3AYgjnvxDOFl0a+zVqi1/w==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/unbash/-/unbash-6.0.1.tgz",
+      "integrity": "sha512-0db9eS5iqybux41zLkX69nk90KTci7F7eZ+gXzEG/Q7E0tAqEBhRh5fkZvk1N7jT7QkGWqq34i8SFGPFEe1V8A==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -7661,9 +7649,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "8.12.1",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.1.tgz",
-      "integrity": "sha512-usz3OVQBeh1LxNn0DzU0voLXMgn5CU/WUdpBsY6Ti5afNao+vTkmn4H/NxoXolc10cOqe2+YIG0Hspq2rsl64w==",
+      "version": "8.12.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+      "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7671,9 +7659,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "7.24.6",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
-      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz",
+      "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==",
       "license": "MIT"
     },
     "node_modules/unicode-emoji-modifier-base": {
@@ -7859,15 +7847,15 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz",
-      "integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==",
+      "version": "8.3.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.5.tgz",
+      "integrity": "sha512-z1YpjieJ9g0ebTmQpLBv/oq9E3F9EIlOe+7LahW8SrE3LTiG3udBRUXQOlYXP9b+IC2q2phHeVxj9xGlw34OEQ==",
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.33.0",
         "picomatch": "^4.0.7",
-        "postcss": "^8.5.29",
-        "rolldown": "~1.2.12",
+        "postcss": "^8.5.30",
+        "rolldown": "~1.2.14",
         "tinyglobby": "^0.2.17"
       },
       "bin": {
@@ -7884,7 +7872,7 @@
       },
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
-        "@vitejs/devtools": "^0.7.1",
+        "@vitejs/devtools": "^0.7.1 || ^0.8.0",
         "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
@@ -8309,9 +8297,9 @@
       }
     },
     "node_modules/yet-another-react-lightbox": {
-      "version": "3.32.2",
-      "resolved": "https://registry.npmjs.org/yet-another-react-lightbox/-/yet-another-react-lightbox-3.32.2.tgz",
-      "integrity": "sha512-F4HtHQfUNpvkj+AmECgWM4XRdCqMY5gXpKgOUx39+T+FyxLe8II4SK/pwMyYj2X54KH9lFSQeHYY1/GfYf3SdA==",
+      "version": "3.33.0",
+      "resolved": "https://registry.npmjs.org/yet-another-react-lightbox/-/yet-another-react-lightbox-3.33.0.tgz",
+      "integrity": "sha512-RxN9wjx6W8mgNf7scD1XBnieXqp8EUHZUPZf+DiALNcQb2JcVkVBH7l03e7jPmTx0xiMcf4N1qh/QBbQAG2kRg==",
       "license": "MIT",
       "engines": {
         "node": ">=14"

package.json

@@ -32,7 +32,8 @@
     "eval:answer": "vitest run --config vitest.eval.config.ts answer",
     "changelog-guard": "node scripts/changelog-guard.cjs",
     "license-check": "node scripts/license-check.cjs",
-    "native-module-check": "node scripts/native-module-integrity.cjs"
+    "native-module-check": "node scripts/native-module-integrity.cjs",
+    "wllama-catalog-check": "node scripts/wllama-catalog-check.cjs"
   },
   "allowScripts": {
     "onnxruntime-node": false,
@@ -70,7 +71,7 @@
     "http-compression": "^1.0.20",
     "keyword-extractor": "^0.3.0",
     "node-emoji": "^2.1.3",
-    "onnxruntime-node": "1.30.0",
+    "onnxruntime-node": "1.31.1",
     "pdf-parse": "^2.0.0",
     "postcss": "^8.5.25",
     "postcss-preset-mantine": "^1.17.0",
@@ -100,7 +101,7 @@
     "@testing-library/react": "^16.0.0",
     "@testing-library/user-event": "^14.5.0",
     "@types/html-to-text": "^9.0.4",
-    "@types/node": "^24.0.0",
+    "@types/node": "^26.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitest/coverage-v8": "^5.0.0",