Sync from felladrin/MiniSearch@fd8be33

.env.example

@@ -26,8 +26,14 @@ INTERNAL_OPENAI_COMPATIBLE_API_NAME="Internal API"
 # "internal" -> $INTERNAL_OPENAI_COMPATIBLE_API_NAME
 DEFAULT_INFERENCE_TYPE="browser"
 
-# Whether a text search that failed on SearXNG is retried against a second search provider (`search.parallel.ai`). Only "true" or "1" turn it on.
+# Whether a text search that failed on SearXNG is retried against the second search providers (search.parallel.ai and You.com, tried one after the other in random order until one returns results). Only "true" or "1" turn it on.
 SEARCH_FALLBACK_ENABLED="false"
 
-# The API key for that second search provider. Optional; sending one raises its free-tier rate limits.
-SEARCH_FALLBACK_API_KEY=""
+# Comma-separated list of the second search providers to try: "parallel", "youcom", or both. Empty means all of them. With the fallback enabled, an unknown name stops the server at start.
+SEARCH_FALLBACK_PROVIDERS=""
+
+# The API key for Parallel (search.parallel.ai). Optional; without it the keyless tier is used, which Parallel describes as for exploration and light use.
+SEARCH_FALLBACK_PARALLEL_API_KEY=""
+
+# The API key for You.com. Optional; without it the keyless "profile=free" endpoint is used, which allows 100 queries per day.
+SEARCH_FALLBACK_YOUCOM_API_KEY=""

agents.md

@@ -154,7 +154,7 @@ Need to:
 - `server/dictationModelServerHook.ts` - `/dictation-models/` endpoint: serves the pinned speech-to-text model files from the instance
 - `server/cacheServerHook.ts` - Cache-Control headers (preview server only)
 - `server/webSearchService.ts` - SearXNG integration with circuit breaker and retry logic
-- `server/fallbackSearchService.ts` - Second text-search source for when SearXNG fails and `SEARCH_FALLBACK_ENABLED` is on
+- `server/fallbackSearchService.ts` - Fallback text-search cascade over Parallel and You.com for when SearXNG fails and `SEARCH_FALLBACK_ENABLED` is on, with a per-provider pause after a 429
 - `server/pageContentService.ts` - Reads result pages and extracts query-relevant passages
 - `server/pageReadHostBreaker.ts` - Per-host circuit breaker for page reads: skips a host that refused the last three reads, then probes it once
 - `server/utils/publicUrl.ts` - Blocks private and reserved addresses before a server-side fetch

changelog.md

@@ -3,6 +3,11 @@
 Notable changes, grouped by date, most recent first.
 
 
+## 2026-10-10
+
+- The text-search fallback now cascades over Parallel and You.com instead of asking a single provider. On each search the configured providers are tried in a random order, one after the other, until one returns results, under the same 15-second budget, which is split across the providers still untried and not paused so a hanging one cannot starve the rest. A provider that answers HTTP 429 is paused until its `Retry-After` and skipped meanwhile, as You.com's acceptable use policy asks. A single search can now reach more than one provider; each sees the query text and this server's IP address, never the user's. `SEARCH_FALLBACK_PROVIDERS` picks the providers (all of them when empty), and `SEARCH_FALLBACK_PARALLEL_API_KEY` and `SEARCH_FALLBACK_YOUCOM_API_KEY` hold the optional keys. `SEARCH_FALLBACK_PROVIDER` and `SEARCH_FALLBACK_API_KEY` are removed: if either is still set while the fallback is enabled, the server stops at start with an error naming the replacement, and so does a provider key with a control character inside it. `/status` gained per-provider counters under `searches.fallbackProviders`.
+
+
 ## 2026-10-08
 
 - `/status` now reports `authorization.distinctRejectedTokens`, the number of distinct dead tokens the server has cached and keeps refusing. A steady stream of invalid-token rejections with a value of 1 there is one client replaying one stale token, not many old search links, which the existing counters could not tell apart.

docs/api.md

@@ -175,16 +175,23 @@ Failures:
 | `500` | `{"error":"Internal server error"}` | Anything else |
 
 With `SEARCH_FALLBACK_ENABLED` on (see `docs/configuration.md`), a text search
-whose SearXNG attempt failed is retried against a second provider before this
-endpoint gives up. That attempt covers the whole exchange under one 15-second
-budget, and it is made only after SearXNG has failed: never while SearXNG
-answers, and never on an image search. It is skipped when less than two seconds
-of the search's own 25-second deadline remain, since an answer that late cannot
-reach the client before its 30-second timeout, and that skip answers the `502`
-above and counts as a fallback that failed. If the fallback answers with nothing
-usable, this endpoint responds `200` with `[]`, so the client shows the
-"No results found" alert rather than the "Text search unavailable" one; only a
-fallback that fails itself falls through to the same `502`.
+whose SearXNG attempt failed is retried against the configured fallback
+providers before this endpoint gives up. They are tried one after the other, in
+a random order on every search, until one returns results; a provider that
+answers with nothing usable or fails hands the search to the next. The whole
+cascade runs under one 15-second budget, or what is left of the search's own
+deadline when that is shorter, and each attempt gets the remaining budget
+divided by the number of providers still untried and not paused. A provider
+paused after a `429` is skipped without a request. The cascade runs only after SearXNG has
+failed: never while SearXNG answers, and never on an image search. It is
+skipped when less than two seconds of the search's own 25-second deadline
+remain, since an answer that late cannot reach the client before its 30-second
+timeout, and that skip answers the `502` above and counts as a fallback that
+failed. If at least one provider answers with nothing usable and none returns
+results, this endpoint responds `200` with `[]`, so the client shows the
+"No results found" alert rather than the "Text search unavailable" one; only
+when every provider tried fails, or none could be tried at all, does the
+search fall through to the same `502`.
 
 ### `GET /search/images`
 
@@ -360,9 +367,18 @@ counts searches answered with fallback results, and `searchesFailedOnFallback`
 counts the other attempts: those the fallback itself failed, and those where
 SearXNG's retries had left so little of the 25-second search deadline that the
 fallback was never asked. A rising `searchesFailedOnFallback` is therefore not
-by itself a sign that the fallback provider is failing. Both are plain counts,
+by itself a sign that the fallback providers are failing. Both are plain counts,
 and neither carries a query.
 
+`searches.fallbackProviders` breaks the cascade down per provider name. Each
+entry counts the attempts that provider `served` with results, answered
+`empty`, or `failed`, the subset of those failures that were a `429`
+(`rateLimited`, also counted in `failed`), and the searches that skipped it
+while it was paused (`skippedWhilePaused`); `pausedForMs` is
+the time left on its current pause, or `0` when it is not paused. The names are
+configured infrastructure, not anything a user typed, and no field carries a
+query or a provider's error text.
+
 Nothing in the response is per-user: queries, URLs and client addresses are
 never recorded, only aggregate outcomes
 (see the privacy section of `docs/security.md`).

docs/configuration.md

@@ -91,12 +91,23 @@ These defaults are provided by `docker-compose.yml`/`docker-compose.production.y
 
 ### Search Fallback
 
-When SearXNG fails on a text search, the server can retry that search against a second provider, sending the query to `search.parallel.ai`. That provider documents the keyless tier as free for light use with lower rate limits, and recommends an API key for production use. `docker-compose.yml` passes only `HOST`, `PORT`, `BASIC_SSL` and `HMR_PORT` into the development container, so these two variables are not carried by the compose `environment` list; set them in `.env`, which `vite.config.ts` loads, inside the container as well as outside it. `vite.config.ts` reads `.env.example` after `.env`, so anything still set there acts as a default: the real `SEARCH_FALLBACK_API_KEY` belongs in `.env`, never in `.env.example`, which is committed.
+When SearXNG fails on a text search, the server can retry that search against second providers: `search.parallel.ai` (Parallel) and You.com's MCP endpoint (`https://api.you.com/mcp`). Every configured provider takes part. On each search they are put in a random order, and each is tried in turn until one returns results; a provider that answers with nothing usable, or fails, hands the search to the next one. The whole cascade shares one 15-second budget, and each attempt gets the remaining budget divided by the number of providers still untried and not paused, so a provider that hangs cannot use up the time the others need. A single search can therefore reach more than one provider, one after the other. `docker-compose.yml` passes only `HOST`, `PORT`, `BASIC_SSL` and `HMR_PORT` into the development container, so these variables are not carried by the compose `environment` list; set them in `.env`, which `vite.config.ts` loads, inside the container as well as outside it. `vite.config.ts` reads `.env.example` after `.env`, so anything still set there acts as a default: the real API keys belong in `.env`, never in `.env.example`, which is committed.
 
 | Variable | Default | Description |
 |----------|---------|-------------|
-| `SEARCH_FALLBACK_ENABLED` | `false` | Serve text results from the fallback when SearXNG has failed (an HTTP error, a network error, every engine unresponsive, or an open circuit), under one 15-second budget for the whole exchange. Only `true` or `1` turns it on, and changing it takes a restart, since a process keeps the environment it was started with. Image searches never use it, and a fallback that returns nothing usable is still an HTTP 200 with no results rather than an outage |
-| `SEARCH_FALLBACK_API_KEY` | `''` | Optional API key for that provider, sent as a Bearer token. It raises the provider's free-tier rate limits; without it the fallback still works |
+| `SEARCH_FALLBACK_ENABLED` | `false` | Serve text results from the fallback providers when SearXNG has failed (an HTTP error, a network error, every engine unresponsive, or an open circuit), under one 15-second budget for the whole cascade. Only `true` or `1` turns it on, and changing it takes a restart, since a process keeps the environment it was started with. Image searches never use it, and a fallback that returns nothing usable is still an HTTP 200 with no results rather than an outage |
+| `SEARCH_FALLBACK_PROVIDERS` | `''` (all providers) | Comma-separated list of the providers to try: `parallel`, `youcom`, or both. Names are trimmed and lowercased, and empty items are ignored. Unset or empty means every built-in provider. With `SEARCH_FALLBACK_ENABLED` on, an unknown name, or a list with no names at all (such as `,`), stops the server at start with an error that names the valid values |
+| `SEARCH_FALLBACK_PARALLEL_API_KEY` | `''` | Optional API key for Parallel, sent as a Bearer token. Without it the fallback calls Parallel's keyless tier. With `SEARCH_FALLBACK_ENABLED` on, a key with a control character inside it (such as a pasted line break) stops the server at start, since the HTTP client would quote it in its error |
+| `SEARCH_FALLBACK_YOUCOM_API_KEY` | `''` | Optional API key for You.com, sent as a Bearer token. Without it the fallback calls the keyless `https://api.you.com/mcp?profile=free` endpoint. A key with a control character inside it stops the server at start, like the Parallel key |
+
+`SEARCH_FALLBACK_PROVIDER` and `SEARCH_FALLBACK_API_KEY` are gone. If either is still set to a non-empty value while `SEARCH_FALLBACK_ENABLED` is on, the server stops at start with an error that names the variable to use instead, so an upgrade cannot silently drop a key: move the key to `SEARCH_FALLBACK_PARALLEL_API_KEY` or `SEARCH_FALLBACK_YOUCOM_API_KEY`, and the provider choice to `SEARCH_FALLBACK_PROVIDERS`.
+
+Each provider has its own terms, and each operator is responsible for following them:
+
+- **Parallel**: Parallel describes its keyless tier as for exploration and light use, and asks for an account and an API key for production use ([docs.parallel.ai](https://docs.parallel.ai/integrations/mcp/search-mcp)).
+- **You.com**: the keyless `profile=free` endpoint allows 100 queries per day ([you.com](https://you.com/docs/build-with-agents/mcp-server)). Its API acceptable use policy asks integrations to honor 429 responses ([you.com](https://you.com/acceptable-use-policy-may-2026)).
+
+That is why a provider that answers HTTP 429 is paused: the cascade skips it, without a network call, until its `Retry-After` has passed (60 seconds when the header is missing or invalid, and never more than an hour or less than a second). A public instance should set a key for each provider.
 
 ## Application Settings
 

docs/failure-injection.md

@@ -37,6 +37,9 @@ needed.
 | SearXNG is down while the fallback is switched off | HTTP 502; the fallback is never consulted and neither fallback counter moves | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
 | SearXNG is down on an image search while the fallback is on | HTTP 502; the fallback is text-only, so it is never consulted and neither fallback counter moves | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
 | SearXNG answers while the fallback is on | HTTP 200 from SearXNG's results; the fallback is never consulted and neither fallback counter moves | `server/searchEndpointServerHook.test.ts` › graceful degradation › text search fallback |
+| The first fallback provider fails and the next one answers | The cascade moves on to the next provider within what is left of the shared budget, and that provider's results are served; the failure is logged with the provider name and a status code, never the query | `server/fallbackSearchService.test.ts` › the cascade |
+| A fallback provider answers HTTP 429 | That provider is paused until its `Retry-After` (60 s when missing or invalid, at most an hour), the next provider serves the search, and later searches skip the paused one without a request until the pause ends | `server/fallbackSearchService.test.ts` › pausing a rate-limited provider |
+| Every fallback provider is paused | No provider is called, the cascade throws, and `/search/text` answers HTTP 502 as for a fallback that failed | `server/fallbackSearchService.test.ts` › pausing a rate-limited provider |
 | Thumbnail host never answers | Request aborted after the timeout, `/thumbnail` answers HTTP 502 and the tile shows the host name | `server/thumbnailEndpointServerHook.test.ts` |
 | DNS lookup for a thumbnail never settles | Bounded by the same deadline as the fetch, `/thumbnail` answers HTTP 502 | `server/thumbnailEndpointServerHook.test.ts` |
 | Thumbnail URL resolves into a private range | Refused before any request, `/thumbnail` answers HTTP 403 | `server/thumbnailEndpointServerHook.test.ts` |

docs/overview.md

@@ -248,7 +248,7 @@ The `/status` endpoint returns a JSON object:
 | `searchesWithUnresponsiveEngines` | number | Searches, text and image together, that came back with zero results and unresponsive engines, whether the retries were spent or an all-suspended set failed fast; one per search, not per attempt |
 | `searchesWithAllResultsDiscarded` | number | Text searches whose results were all dropped during processing |
 | `searchesServedByFallback` | number | Text searches answered by the fallback source after SearXNG failed |
-| `searchesFailedOnFallback` | number | Fallback searches that failed, plus searches where SearXNG's own retries had left too little of the search deadline for the fallback to be asked at all. A rising count is therefore not by itself a sign that the fallback provider is failing |
+| `searchesFailedOnFallback` | number | Fallback searches that failed, plus searches where SearXNG's own retries had left too little of the search deadline for the fallback to be asked at all. A rising count is therefore not by itself a sign that the fallback providers are failing |
 | `biEncoderServiceStatus` | string | `"healthy"` or `"unhealthy"` |
 | `rerankerServiceStatus` | string | `"healthy"` or `"unhealthy"` |
 | `webSearchServiceStatus` | string | `"healthy"`, `"degraded"` or `"unhealthy"`, see below |
@@ -422,6 +422,7 @@ way `pageReads` does:
 | `searches.degradedSearchTypes` | array | Nothing; which of `text` and `images` is currently flagged, so a `degraded` verdict says which engine pool it is about. Empty when the half-open circuit is what triggered the verdict, which `circuitState` in the same object names |
 | `searches.circuitOpens` | number | `failureThreshold` and `resetTimeout` on the SearXNG breaker: each opening is a minute of serving no searches at all |
 | `searches.unresponsiveEngines` | object | Nothing; `failures` and `lastFailure` per engine name, which is how one engine timing out is told apart from every engine being CAPTCHA-blocked. `lastFailure` is `blocked` (a CAPTCHA, a rate limit or an access denial), `timeout` or `other`, never SearXNG's own wording, which is free-form text from an upstream engine and does not belong on an endpoint that needs no token. Counted on the searches `searchesWithUnresponsiveEngines` counts, so a search that recovered on a retry is not in it |
+| `searches.fallbackProviders` | object | Whether each fallback provider earns its place, and whether one needs an API key: per provider name, `served`, `empty`, `failed`, `rateLimited` (answered `429`, and also counted in `failed`) and `skippedWhilePaused` counts, plus `pausedForMs`, the time left on its current `429` pause (`0` when not paused). A steady `rateLimited` count on a keyless provider is the cue to set its key (see `docs/configuration.md`). Provider names are configured infrastructure, not user input |
 | `reranker.reranks` | number | Nothing; the denominator for the rest |
 | `reranker.averageMs` | number | Whether reranking or SearXNG is what users wait for, and so whether to rerank a shortlist instead of all 30 results. Over `reranks`, covering the filtering and sorting as well as the model |
 | `reranker.keptRate` | number | `kStandardDeviationFactor`: near 100% means the filter is not filtering. Text and image reranks are pooled, and the two run through different paths, so this moves with the traffic mix as well as with the threshold |

docs/security.md

@@ -44,8 +44,8 @@ Every HTTP request from client to backend carries a `token` query parameter for
 
 - **Local-First Storage**: All data stored in IndexedDB, no cloud sync
 - **No Tracking**: No telemetry, analytics, or user tracking
-- **SearXNG Integration**: All web searches routed through privacy-focused metasearch, which holds for every search as long as `SEARCH_FALLBACK_ENABLED` is off (the default); with it on, a text search that found SearXNG failed goes to the fallback provider instead, and an image search never does
-- **The Fallback Sends The Query To A Third Party When It Is On**: With `SEARCH_FALLBACK_ENABLED` on (off by default), a text query whose SearXNG search failed is sent to `search.parallel.ai` (Parallel), which sees the query text and the server's IP address. The user's IP address is never sent, because the request leaves from the server rather than from the browser. The query is still never written to the server log; what `/status` publishes for this feature is the two counts `searchesServedByFallback` and `searchesFailedOnFallback`, neither of which carries a query
+- **SearXNG Integration**: All web searches routed through privacy-focused metasearch, which holds for every search as long as `SEARCH_FALLBACK_ENABLED` is off (the default); with it on, a text search that found SearXNG failed goes to the fallback providers instead, and an image search never does
+- **The Fallback Sends The Query To A Third Party When It Is On**: With `SEARCH_FALLBACK_ENABLED` on (off by default), a text query whose SearXNG search failed is sent to the providers `SEARCH_FALLBACK_PROVIDERS` lists (all of them when it is empty): `search.parallel.ai` (Parallel) and You.com's MCP endpoint (`https://api.you.com/mcp`). They are tried one after the other, in a random order, until one returns results, so a single search can reach more than one provider. Each provider that is tried sees the query text and the server's IP address. The user's IP address is never sent, because the request leaves from the server rather than from the browser. The query is still never written to the server log, and neither is any provider's error text; what `/status` publishes for this feature is the two counts `searchesServedByFallback` and `searchesFailedOnFallback` and the per-provider counters under `searches.fallbackProviders`, none of which carries a query. The provider names there are configured infrastructure, not anything a user typed
 - **Browser-Only Mode Still Downloads Models From HuggingFace**: The instance sends no telemetry and no analytics. But browser-only mode is not fully offline: both wllama and the local text-to-speech engine fetch their models from `huggingface.co` (served from `us.aws.cdn.hf.co`), so that host sees the user's IP. The text-to-speech engine's full host list is in the Reading Answers Aloud bullet below.
 - **Page Reading Is On By Default, And Reversible**: `enablePageContentFetch` ships on and the user can turn it off under AI Settings; nothing is read until AI responses are enabled, and the server (never the browser) requests the top result pages, so those sites see the instance and no user cookies or IP
 - **Search And Page Reading Leave No Query In The Log**: The search query is never written to the server log, and neither is the URL of a page read for grounding; how often searches come back empty, fail on unresponsive engines, are fully discarded, are served by the fallback or lose the fallback too, and how page reads ended, are counted instead and reported on `/status` (`searchesWithoutResults`, `searchesWithUnresponsiveEngines`, `searchesWithAllResultsDiscarded`, `searchesServedByFallback`, `searchesFailedOnFallback`, `pageReads`). `searches.unresponsiveEngines` names the engines behind those failures, which is configured infrastructure rather than anything a user typed, the same basis on which `inference.byModel` names model ids. What each failed with is published as one of `blocked`, `timeout` or `other`, never SearXNG's own wording: `/status` needs no token, and an upstream engine is free to build its error text out of the request URL, and so out of the query. The raw string stays in the server log and in the thrown error the search endpoint catches; the 502 it answers with carries a fixed message, so the string never leaves the server. The page reader's per-host circuit breaker (`server/pageReadHostBreaker.ts`) holds the hosts it has boxed in memory, since it needs them to know which host to skip; a page-read host comes from the search results, downstream of the query, so unlike an engine name it is never published: `/status` reports how many reads were skipped and how often a host was boxed, as counts only. Anything in front of the instance keeps its own access log, where `?q=` appears in full
@@ -96,7 +96,7 @@ The full trust model lives in [`.github/SECURITY.md`](../.github/SECURITY.md) ("
 | `server/pageReadsSinceLastRestart.ts` | In-memory aggregate counters for pages read for grounding (outcomes, durations, passage ratios), reported on `/status`; records no query, URL, host, or per-read timestamp |
 | `server/pageReadHostBreaker.ts` | Per-host circuit breaker for page reads: a host that refused the last three reads is skipped for five minutes, then probed with one read; holds host names in memory only, reset on restart, and reports counts alone |
 | `server/searchEndpointServerHook.ts` | Proxies text/image search to SearXNG after token verification (via `handleTokenVerification`), and serves fallback text results when SearXNG has failed and `SEARCH_FALLBACK_ENABLED` is on |
-| `server/fallbackSearchService.ts` | Second text-search source, consulted only after SearXNG has failed: reads `SEARCH_FALLBACK_ENABLED` and `SEARCH_FALLBACK_API_KEY` at call time, runs the JSON-RPC exchange against `search.parallel.ai` under one 15-second budget, and maps the reply into the tuples the SearXNG path produces; records no query |
+| `server/fallbackSearchService.ts` | Second text-search source, consulted only after SearXNG has failed: reads `SEARCH_FALLBACK_ENABLED`, `SEARCH_FALLBACK_PROVIDERS` and the per-provider keys at call time, and refuses to start on an unknown provider name or a removed variable; runs the JSON-RPC exchange against `search.parallel.ai` and You.com's MCP endpoint in a random order per search, one after the other until one returns results, under one shared 15-second budget; pauses a provider that answered 429 until its `Retry-After`; and maps the reply into the tuples the SearXNG path produces; records no query |
 | `server/verifyTokenAndRateLimit.ts` | Verifies the Argon2 token hash and enforces rate limiting (10 requests per 10 seconds, shared by the search, page-content and inference endpoints; a separate 60-per-10-seconds budget for `/thumbnail`) |
 | `server/handleTokenVerification.ts` | Middleware bridge that calls `verifyTokenAndRateLimit` and writes 400/401/429 error responses for the search, page-content, thumbnail and inference endpoints |
 | `server/configEndpointServerHook.ts` | Serves the non-secret runtime config at `/api/config`, including whether access keys are enabled |
@@ -171,7 +171,7 @@ pin and keeps the old rebinding residual.
 ## Threat Model
 
 - **Local Environment**: Assumes trusted local execution
-- **Network Requests**: All external requests go through SearXNG proxy, except a text search whose SearXNG search failed, which goes to `search.parallel.ai`, and only when `SEARCH_FALLBACK_ENABLED` is on (off by default)
+- **Network Requests**: All external requests go through SearXNG proxy, except a text search whose SearXNG search failed, which goes to the fallback providers `SEARCH_FALLBACK_PROVIDERS` lists (`search.parallel.ai` and You.com's MCP endpoint, one after the other until one returns results, so possibly more than one per search), and only when `SEARCH_FALLBACK_ENABLED` is on (off by default)
 - **AI Models**: Models run locally or through trusted providers
 - **Data Exfiltration**: Prevented by local-first architecture
 

package-lock.json

@@ -95,13 +95,13 @@
       "license": "MIT"
     },
     "node_modules/@ai-sdk/gateway": {
-      "version": "4.0.103",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-4.0.103.tgz",
-      "integrity": "sha512-nnGTUHzPRQ14jhv9CL4OQrzcRBIFTBMIPKGIi9Z9u/4GtwSRxa/nxUX6np2Iwp5phOzO0a0njj/j9Jolf5AEaA==",
+      "version": "4.0.106",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/gateway/-/gateway-4.0.106.tgz",
+      "integrity": "sha512-NprSdFzyVnbEp2SDWtIgsCFIUHFCehOD9S6FQkF/dLrCmnke8w4SOK3KcmUUiEbwtVzlUF8prkaELp+ohcQaQw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.21",
-        "@ai-sdk/provider-utils": "5.0.53",
+        "@ai-sdk/provider": "4.0.24",
+        "@ai-sdk/provider-utils": "5.0.56",
         "@vercel/oidc": "3.2.0"
       },
       "engines": {
@@ -111,14 +111,54 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
+    "node_modules/@ai-sdk/gateway/node_modules/@ai-sdk/provider": {
+      "version": "4.0.24",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.24.tgz",
+      "integrity": "sha512-iztFqJTdxNN0ZzqZAAnVPMhRMaL1bfQFa3GIPAffWQ0+dP2FXIkyMD8kHeEI7EpB/C6TR45cqOkrS7YZZ1sATA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "json-schema": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
+    "node_modules/@ai-sdk/gateway/node_modules/@ai-sdk/provider-utils": {
+      "version": "5.0.56",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.56.tgz",
+      "integrity": "sha512-F7/U1YpVXEfSxRHbxScm0PVdr9lN6GaUWHnt8ws2UjuGeuxWHqCkV25dGpHAkpDHkuIXoC+aak/OqSylKSJmHw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ai-sdk/provider": "4.0.24",
+        "@standard-schema/spec": "^1.1.0",
+        "@workflow/serde": "4.1.0",
+        "eventsource-parser": "^3.0.8",
+        "undici": "^7.29.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "peerDependencies": {
+        "zod": "^3.25.76 || ^4.1.8"
+      }
+    },
+    "node_modules/@ai-sdk/gateway/node_modules/undici": {
+      "version": "7.30.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.0.tgz",
+      "integrity": "sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/@ai-sdk/openai-compatible": {
-      "version": "3.0.62",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/openai-compatible/-/openai-compatible-3.0.62.tgz",
-      "integrity": "sha512-IAz1xv8zot4KLGa8kN7UfAA6H5+ARzAgAKLsoKxHPBzZuOc2E3ohaELg0x/JR9HVTbMbiftb0dPyCb8cT2KBRg==",
+      "version": "3.0.65",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/openai-compatible/-/openai-compatible-3.0.65.tgz",
+      "integrity": "sha512-TBfQk1hf9hOioOwdeDvuXdbmFDp+uLvYf5lfu/gCKVFy6rzjpEqTekEln2ebYonrnq2lIglsuj9S9IovaGhDZA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.21",
-        "@ai-sdk/provider-utils": "5.0.53"
+        "@ai-sdk/provider": "4.0.24",
+        "@ai-sdk/provider-utils": "5.0.56"
       },
       "engines": {
         "node": ">=22"
@@ -127,10 +167,10 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/@ai-sdk/provider": {
-      "version": "4.0.21",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.21.tgz",
-      "integrity": "sha512-UpbC9C1oht8dhfKPbVXSLRZS3DI8uk8n5v2uMjBPNIYGsC2kL045ywq7D8Hh9KgnH9rP5W/GxQdYtWScRouqlA==",
+    "node_modules/@ai-sdk/openai-compatible/node_modules/@ai-sdk/provider": {
+      "version": "4.0.24",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.24.tgz",
+      "integrity": "sha512-iztFqJTdxNN0ZzqZAAnVPMhRMaL1bfQFa3GIPAffWQ0+dP2FXIkyMD8kHeEI7EpB/C6TR45cqOkrS7YZZ1sATA==",
       "license": "Apache-2.0",
       "dependencies": {
         "json-schema": "^0.4.0"
@@ -139,13 +179,13 @@
         "node": ">=22"
       }
     },
-    "node_modules/@ai-sdk/provider-utils": {
-      "version": "5.0.53",
-      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.53.tgz",
-      "integrity": "sha512-VVe6UDd0y0/B4TfauuKKzcppqvhTmSluwwUVT4WG2/8h7gFbyFm7PM4UGM+ZXe3/RI6bv+Vl1cw/7aiBoQqdxg==",
+    "node_modules/@ai-sdk/openai-compatible/node_modules/@ai-sdk/provider-utils": {
+      "version": "5.0.56",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.56.tgz",
+      "integrity": "sha512-F7/U1YpVXEfSxRHbxScm0PVdr9lN6GaUWHnt8ws2UjuGeuxWHqCkV25dGpHAkpDHkuIXoC+aak/OqSylKSJmHw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/provider": "4.0.21",
+        "@ai-sdk/provider": "4.0.24",
         "@standard-schema/spec": "^1.1.0",
         "@workflow/serde": "4.1.0",
         "eventsource-parser": "^3.0.8",
@@ -158,7 +198,7 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/@ai-sdk/provider-utils/node_modules/undici": {
+    "node_modules/@ai-sdk/openai-compatible/node_modules/undici": {
       "version": "7.30.0",
       "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.0.tgz",
       "integrity": "sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==",
@@ -785,13 +825,13 @@
       "license": "MIT"
     },
     "node_modules/@mantine/carousel": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/carousel/-/carousel-9.7.0.tgz",
-      "integrity": "sha512-L/6IPhltQrDj+TXJUzse73O5rMrHETVciIfDeMnpe3Kl65TrsfbI304wl7SjqnPumwIRHjimfJaY7EIMer6pZg==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/carousel/-/carousel-9.7.1.tgz",
+      "integrity": "sha512-lEa4BjqsrCUp4xJ4pJyaOCvcXGyqRfSYUumUvY/Q1KHrkqTdReiZCdURcsX+OHjqrju1KruddWH/0qNzAYJ9Ew==",
       "license": "MIT",
       "peerDependencies": {
-        "@mantine/core": "9.7.0",
-        "@mantine/hooks": "9.7.0",
+        "@mantine/core": "9.7.1",
+        "@mantine/hooks": "9.7.1",
         "embla-carousel": ">=8.0.0",
         "embla-carousel-react": ">=8.0.0",
         "react": "^19.2.0",
@@ -799,24 +839,24 @@
       }
     },
     "node_modules/@mantine/code-highlight": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/code-highlight/-/code-highlight-9.7.0.tgz",
-      "integrity": "sha512-zVSe6MkNW2pkhXsZdja/klNWNfXJXG0Re5O7Bd9z/ubLkK3e0xa4daMH2AwOuyZSf3btSFqv1hY1dJPIGC2BMA==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/code-highlight/-/code-highlight-9.7.1.tgz",
+      "integrity": "sha512-iKr+gUauwvW5yrdB6rSNAeKCZqwuzXpb5pwopgymCB9JJs/UI7mfR5vyRkR5NkDgZOUHJU4O1QqzzG3bkroWPA==",
       "license": "MIT",
       "dependencies": {
         "clsx": "^2.1.1"
       },
       "peerDependencies": {
-        "@mantine/core": "9.7.0",
-        "@mantine/hooks": "9.7.0",
+        "@mantine/core": "9.7.1",
+        "@mantine/hooks": "9.7.1",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
       }
     },
     "node_modules/@mantine/core": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/core/-/core-9.7.0.tgz",
-      "integrity": "sha512-WhCvfXXpYMKV6py05wt0Vlxthtxe4YOzQiVhrrCvWKYDmvhKXgOTDzRdjkGHNji4r+7f7d3nz2XpwbzaZ47R/w==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/core/-/core-9.7.1.tgz",
+      "integrity": "sha512-SU1xklOfdEDzpPhw35ti9rF4QRE9HUongCe37C+xCO2Ea8MLJkAzreCrMxb8qcCij+gnF7SQbtTCBa1r+pKxYA==",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/react": "^0.27.20",
@@ -826,15 +866,15 @@
         "type-fest": "^5.10.0"
       },
       "peerDependencies": {
-        "@mantine/hooks": "9.7.0",
+        "@mantine/hooks": "9.7.1",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
       }
     },
     "node_modules/@mantine/form": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/form/-/form-9.7.0.tgz",
-      "integrity": "sha512-v7GuFaKzM5TRpxh0LmlwM3S59yB2PXQjmn7IdbKQpvW+72tKJZwKnbEFJbYfTehBS73MKxqO+MGctHLUc1Yz2g==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/form/-/form-9.7.1.tgz",
+      "integrity": "sha512-fVjWYdiMBw21z/bqUkFghyV1MsANHoqCZaXji0k4KJaRCHh7cD3qhBuLIVhc2hUCKXQ3cHiJTHLz3ayoE/mRZg==",
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.1.0",
@@ -846,34 +886,34 @@
       }
     },
     "node_modules/@mantine/hooks": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/hooks/-/hooks-9.7.0.tgz",
-      "integrity": "sha512-3a1w90f1OliaClGRlnPiviJtKxyMiKdVyM8Pd2h6se+LOm9/bgGI+pgoGw/tgv++BSQ4frqv+X7NBlqcY/S7KQ==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/hooks/-/hooks-9.7.1.tgz",
+      "integrity": "sha512-C1xD4A3bfB87nUsLHr42WqOabnK4G+fCyEf8FN14EEiZAcKjdcWJbK63qxhIXFKuHCc3acLbpm2ts9UqmLASTw==",
       "license": "MIT",
       "peerDependencies": {
         "react": "^19.2.0"
       }
     },
     "node_modules/@mantine/notifications": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/notifications/-/notifications-9.7.0.tgz",
-      "integrity": "sha512-0WUBbZpgDOO86YsGjV3zBYge+jkjIC9VLojSah4g0ZaYzKnh1cANRc0RF1OwSosABKaDZKZ1FAvlAhP8hq2ApQ==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/notifications/-/notifications-9.7.1.tgz",
+      "integrity": "sha512-gmN+rTrjwYFJqaIqDQtQfoTJ/OR0wSxqxIihOHD5/S/sYUycVi9wDqK4tub5y8x0HeQH4kNkehPMN4l1Uk0A6A==",
       "license": "MIT",
       "dependencies": {
-        "@mantine/store": "9.7.0",
+        "@mantine/store": "9.7.1",
         "react-transition-group": "4.4.5"
       },
       "peerDependencies": {
-        "@mantine/core": "9.7.0",
-        "@mantine/hooks": "9.7.0",
+        "@mantine/core": "9.7.1",
+        "@mantine/hooks": "9.7.1",
         "react": "^19.2.0",
         "react-dom": "^19.2.0"
       }
     },
     "node_modules/@mantine/store": {
-      "version": "9.7.0",
-      "resolved": "https://registry.npmjs.org/@mantine/store/-/store-9.7.0.tgz",
-      "integrity": "sha512-r1eCDANMSITib3NvYU82JBXVivT7wEDvHeTyRJdO+slqH+K9PY5PIIeasGIocQNXyi9HQph6rz+e3eou5abRMw==",
+      "version": "9.7.1",
+      "resolved": "https://registry.npmjs.org/@mantine/store/-/store-9.7.1.tgz",
+      "integrity": "sha512-CYCQHWt7zFrUe2kVQmFAWnQaZbiDUoN2VeMJBI/vf1XybGj+itTEB6cnvoX4C8yOrln3sXe4BIoIf46pUhnEhA==",
       "license": "MIT",
       "peerDependencies": {
         "react": "^19.2.0"
@@ -2988,14 +3028,14 @@
       }
     },
     "node_modules/ai": {
-      "version": "7.0.127",
-      "resolved": "https://registry.npmjs.org/ai/-/ai-7.0.127.tgz",
-      "integrity": "sha512-JNsNPk4ZvRGEJuqdVo2lYFkm7uAuf3p/RwKFWn1Wh/+IK3U1RyFWw2GXoFnhzqNfxEuj7XJB4WpIUhl1sHToWg==",
+      "version": "7.0.130",
+      "resolved": "https://registry.npmjs.org/ai/-/ai-7.0.130.tgz",
+      "integrity": "sha512-QkBkCogl46jXUg0SrSsdqQlOI2ZVMCjfnbBQS8t3gE21U/SO17oNMVFyjmcC9z20wOoYUA+2O2vsso0maoS7dw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@ai-sdk/gateway": "4.0.103",
-        "@ai-sdk/provider": "4.0.21",
-        "@ai-sdk/provider-utils": "5.0.53"
+        "@ai-sdk/gateway": "4.0.106",
+        "@ai-sdk/provider": "4.0.24",
+        "@ai-sdk/provider-utils": "5.0.56"
       },
       "engines": {
         "node": ">=22"
@@ -3004,6 +3044,46 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
+    "node_modules/ai/node_modules/@ai-sdk/provider": {
+      "version": "4.0.24",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider/-/provider-4.0.24.tgz",
+      "integrity": "sha512-iztFqJTdxNN0ZzqZAAnVPMhRMaL1bfQFa3GIPAffWQ0+dP2FXIkyMD8kHeEI7EpB/C6TR45cqOkrS7YZZ1sATA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "json-schema": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=22"
+      }
+    },
+    "node_modules/ai/node_modules/@ai-sdk/provider-utils": {
+      "version": "5.0.56",
+      "resolved": "https://registry.npmjs.org/@ai-sdk/provider-utils/-/provider-utils-5.0.56.tgz",
+      "integrity": "sha512-F7/U1YpVXEfSxRHbxScm0PVdr9lN6GaUWHnt8ws2UjuGeuxWHqCkV25dGpHAkpDHkuIXoC+aak/OqSylKSJmHw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@ai-sdk/provider": "4.0.24",
+        "@standard-schema/spec": "^1.1.0",
+        "@workflow/serde": "4.1.0",
+        "eventsource-parser": "^3.0.8",
+        "undici": "^7.29.0"
+      },
+      "engines": {
+        "node": ">=22"
+      },
+      "peerDependencies": {
+        "zod": "^3.25.76 || ^4.1.8"
+      }
+    },
+    "node_modules/ai/node_modules/undici": {
+      "version": "7.30.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.30.0.tgz",
+      "integrity": "sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -3617,9 +3697,9 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "18.0.5",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.5.tgz",
-      "integrity": "sha512-aBrGvt6KhjxbEnatqMWOMidftwsrCiCvqh1yNIGB9QyF0J+VcWkKDMsvYOEm7ZS82oiV+BT1sTOtIlAmUlTpwQ==",
+      "version": "18.0.6",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-18.0.6.tgz",
+      "integrity": "sha512-ZMVmohV6CvAJtj++pZNyggluUt6hbRdQAxc2+Z635RL6/AG/ruXv5lHnybUFoxMPL/yrTL/tsF4paZu2l7RA6Q==",
       "license": "BSD-2-Clause",
       "bin": {
         "dotenv": "dist/index.cjs"
@@ -4623,9 +4703,9 @@
       }
     },
     "node_modules/knip": {
-      "version": "6.39.0",
-      "resolved": "https://registry.npmjs.org/knip/-/knip-6.39.0.tgz",
-      "integrity": "sha512-Y7g6Ve1ATMox1u1v+gx3z9LTlvzVLTJISm/LVn9TgBU4qc7OoC63AWGO8qCFPVDDdaqlYdXkDDvvO1METBfTRw==",
+      "version": "6.40.0",
+      "resolved": "https://registry.npmjs.org/knip/-/knip-6.40.0.tgz",
+      "integrity": "sha512-5Lp/ANJu3AkW5f+J+2QG14z7xKZGi/ybb5MU1EWjeGdt6MpuIaLpLFiyBi0ZKryTiuTHiJqo/WKJRaWYimvavw==",
       "dev": true,
       "funding": [
         {
@@ -7827,9 +7907,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.2.tgz",
-      "integrity": "sha512-SQr1x6W5vVSbROg7vsyXIaxK9b0G7zsT68acdWWRmnBUsgDieLCRG+Rep9WdZgcposvv/GSnr4GUUBqB3vXq6w==",
+      "version": "8.3.3",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.3.3.tgz",
+      "integrity": "sha512-cTAldKPImjg6c+gk48U19POPn3GCBzZwpdsN8ZMEEcbpes+6/wvfqUd0C2y3qYY4wsj8PwgFwrZ/1jBPVttMSg==",
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.33.0",