Deploy gateway e062ef52b65ba61a8a7a891b6b583130528f3164

.env.example

@@ -23,3 +23,10 @@ LOG_RETENTION_DAYS=30
 PRIVATE_UPSTREAM_HOSTS=[]
 STATIC_DIR=frontend/out
 PORT=7860
+
+# Server-only administrator provisioning by deploy/start.py.
+# With durable storage, remove bootstrap secrets after activation.
+# A fresh database requires an explicit Argon2id password-hash seed.
+# ADMIN_BOOTSTRAP_EMAIL=owner@example.com
+
+# ADMIN_BOOTSTRAP_PASSWORD_HASH=

.gitattributes

@@ -0,0 +1 @@
+universal-ai-gateway-v1.zip filter=lfs diff=lfs merge=lfs -text

README.md

@@ -9,6 +9,17 @@ pinned: false
 license: mit
 ---
 
+---
+title: Nexus Universal AI Gateway
+emoji: 🔗
+colorFrom: purple
+colorTo: indigo
+sdk: docker
+app_port: 7860
+pinned: false
+license: mit
+---
+
 # Nexus — Universal AI Gateway
 
 A self-hosted, bring-your-own-key AI gateway with a Next.js dashboard and an async FastAPI backend. Connect provider accounts, generate a `gw_` key, and give your applications one OpenAI-compatible base URL.
@@ -266,11 +277,15 @@ scripts/                 Secret setup and credential rotation
 deploy/                  Rootless supervisor, hosting templates, Caddy
 ```
 
+## Restricted administration and community models
+
+The `/#admin` panel manages branding, Playground defaults, registration and request limits, user suspension, and explicitly published chat models. Roles require server access; public signup cannot create an administrator. See [Administration guide](docs/administration.md) for activation, deployment, publishing your own model, and revocation.
+
 ## Scope and operational limits
 
-This v1 implements the requested core and selected providers. Favorites, pins, model search and usage export are included. Automated paid benchmarks, public leaderboards, webhooks, an admin UI, saved prompt templates and prompt replay are **not included**. Prompt replay would require an explicit opt-in content-retention design; this version never logs prompts or completions.
+This v1 implements the requested core and selected providers. Favorites, pins, model search and usage export are included. Automated paid benchmarks, public leaderboards, webhooks, saved prompt templates and prompt replay are **not included**. Prompt replay would require an explicit opt-in content-retention design; this version never logs prompts or completions.
 
-Prices/capabilities depend on provider metadata and manual configuration. Catalog-listed does not guarantee your account has quota or access. Free-tier usage is still subject to each provider’s rules, credits and rate limits. No shared provider credentials or free quota bypass is provided. Usage costs are partial estimates, not billing records.
+Prices/capabilities depend on provider metadata and manual configuration. Catalog-listed does not guarantee your account has quota or access. Free-tier usage is still subject to each provider’s rules, credits and rate limits. Administrators can explicitly publish selected chat models for community use. Credentials remain encrypted on the server; the administrator covers upstream charges. No provider quota bypass is provided. Usage costs are partial estimates, not billing records.
 
 This is a production-oriented initial implementation, not an assertion of independent security audit, live-provider certification, load-tested capacity or high availability. The included single-container database topology is a single node. Use external database services and backups for stronger availability requirements.
 

backend/alembic/versions/a481c6e724df_admin_and_shared_models.py

@@ -0,0 +1,45 @@
+"""Restricted administration and explicitly published community models."""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "a481c6e724df"
+down_revision = "36bb49c6546c"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column(
+        "users", sa.Column("is_admin", sa.Boolean(), server_default=sa.false(), nullable=False)
+    )
+    op.add_column(
+        "users", sa.Column("disabled", sa.Boolean(), server_default=sa.false(), nullable=False)
+    )
+    op.add_column("request_logs", sa.Column("sponsored_cost", sa.Float(), nullable=True))
+    op.create_table(
+        "site_configuration",
+        sa.Column("id", sa.String(16), primary_key=True),
+        sa.Column("settings", sa.JSON(), nullable=False),
+    )
+    op.create_table(
+        "published_models",
+        sa.Column(
+            "model_id",
+            sa.String(36),
+            sa.ForeignKey("registry_models.id", ondelete="CASCADE"),
+            primary_key=True,
+        ),
+        sa.Column("enabled", sa.Boolean(), nullable=False),
+        sa.Column("requests_per_minute", sa.Integer(), nullable=False),
+        sa.Column("max_output_tokens", sa.Integer(), nullable=False),
+        sa.Column("created_at", sa.Float(), nullable=False),
+    )
+
+
+def downgrade():
+    op.drop_table("published_models")
+    op.drop_table("site_configuration")
+    op.drop_column("request_logs", "sponsored_cost")
+    op.drop_column("users", "disabled")
+    op.drop_column("users", "is_admin")

backend/app/admin.py

@@ -0,0 +1,203 @@
+"""Restricted management. Roles are granted using the server CLI, never public signup."""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query, Request
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import delete, func, select
+
+from .auth import DB, CurrentUser, user_view
+from .errors import fail
+from .models import (
+    AuditLog,
+    Provider,
+    PublishedModel,
+    RegistryModel,
+    RequestLog,
+    Session,
+    SiteConfiguration,
+    User,
+)
+from .site_config import SiteOptions, site_options
+
+router = APIRouter(prefix="/api", tags=["Administration"])
+
+
+async def administrator(user: CurrentUser) -> User:
+    if not user.is_admin:
+        raise fail(403, "Administrator access is required.", "admin_required")
+    return user
+
+
+AdminUser = Annotated[User, Depends(administrator)]
+
+
+@router.get("/site")
+async def public_settings(request: Request, db: DB) -> dict:
+    options = await site_options(db, request.app.state.settings)
+    return options.model_dump(
+        include={
+            "site_name",
+            "tagline",
+            "welcome_text",
+            "accent",
+            "default_mode",
+            "default_stream",
+            "default_retries",
+            "shared_models_enabled",
+        }
+    )
+
+
+@router.get("/admin/settings")
+async def get_settings(request: Request, db: DB, user: AdminUser) -> dict:
+    options = await site_options(db, request.app.state.settings)
+    return {
+        "settings": options.model_dump(),
+        "limits": {
+            "requests_per_minute": request.app.state.settings.requests_per_minute,
+            "max_retries": request.app.state.settings.max_retries,
+            "registration_allowed": request.app.state.settings.allow_registration,
+        },
+    }
+
+
+@router.put("/admin/settings")
+async def save_settings(body: SiteOptions, request: Request, db: DB, user: AdminUser) -> dict:
+    config = request.app.state.settings
+    if (
+        body.requests_per_minute > config.requests_per_minute
+        or body.default_retries > config.max_retries
+    ):
+        raise fail(422, "Keep rate and retry limits within the server's configured maximums.")
+    if body.registration_open and not config.allow_registration:
+        raise fail(422, "Registration is disabled in the server configuration.")
+    row = await db.get(SiteConfiguration, "global")
+    if not row:
+        row = SiteConfiguration(id="global")
+        db.add(row)
+    row.settings = body.model_dump()
+    db.add(AuditLog(user_id=user.id, action="admin.settings.updated", target_id="global"))
+    await db.commit()
+    return body.model_dump()
+
+
+@router.get("/admin/summary")
+async def summary(db: DB, user: AdminUser) -> dict:
+    return {
+        "users": await db.scalar(select(func.count(User.id))),
+        "suspended_users": await db.scalar(
+            select(func.count(User.id)).where(User.disabled.is_(True))
+        ),
+        "requests": await db.scalar(select(func.count(RequestLog.id))),
+        "published_models": await db.scalar(
+            select(func.count(PublishedModel.model_id)).where(PublishedModel.enabled.is_(True))
+        ),
+        "sponsored_cost": await db.scalar(select(func.sum(RequestLog.sponsored_cost))),
+    }
+
+
+@router.get("/admin/users")
+async def users(db: DB, user: AdminUser, search: str = "", offset: int = Query(0, ge=0)) -> dict:
+    query = select(User)
+    if search:
+        query = query.where(User.email.icontains(search[:120], autoescape=True))
+    total = await db.scalar(select(func.count()).select_from(query.subquery()))
+    rows = (
+        await db.scalars(query.order_by(User.created_at, User.id).limit(50).offset(offset))
+    ).all()
+    return {
+        "data": [user_view(u) | {"disabled": u.disabled, "created_at": u.created_at} for u in rows],
+        "total": total,
+    }
+
+
+class AccountStatus(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    disabled: bool
+
+
+@router.patch("/admin/users/{uid}")
+async def account_status(uid: str, body: AccountStatus, db: DB, user: AdminUser) -> dict:
+    target = await db.get(User, uid)
+    if not target:
+        raise fail(404, "Account not found.")
+    if target.id == user.id or target.is_admin:
+        raise fail(
+            403, "Administrator accounts can only be changed using the server admin command."
+        )
+    target.disabled = body.disabled
+    if body.disabled:
+        await db.execute(delete(Session).where(Session.user_id == target.id))
+    db.add(
+        AuditLog(
+            user_id=user.id,
+            action="admin.user.suspended" if body.disabled else "admin.user.restored",
+            target_id=uid,
+        )
+    )
+    await db.commit()
+    return {"id": uid, "disabled": target.disabled}
+
+
+class PublishOptions(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    enabled: bool = True
+    requests_per_minute: int = Field(default=5, ge=1, le=120)
+    max_output_tokens: int = Field(default=1024, ge=128, le=8192)
+
+
+@router.get("/admin/shared-models")
+async def shared_models(db: DB, user: AdminUser) -> list[dict]:
+    rows = (
+        await db.execute(
+            select(PublishedModel, RegistryModel, Provider)
+            .join(RegistryModel, RegistryModel.id == PublishedModel.model_id)
+            .join(Provider, Provider.id == RegistryModel.provider_id)
+            .order_by(RegistryModel.name)
+        )
+    ).all()
+    return [
+        {
+            "id": m.id,
+            "name": m.name,
+            "model_id": m.model_id,
+            "provider_name": p.name,
+            "enabled": shared.enabled,
+            "requests_per_minute": shared.requests_per_minute,
+            "max_output_tokens": shared.max_output_tokens,
+            "owned": p.user_id == user.id,
+        }
+        for shared, m, p in rows
+    ]
+
+
+@router.put("/admin/shared-models/{mid}")
+async def publish(mid: str, body: PublishOptions, db: DB, user: AdminUser) -> dict:
+    model = await db.scalar(
+        select(RegistryModel)
+        .join(Provider)
+        .where(
+            RegistryModel.id == mid,
+            Provider.user_id == user.id,
+        )
+    )
+    if not model:
+        raise fail(404, "Select a model from a provider you own.")
+    if model.capabilities.get("chat") is not True:
+        raise fail(422, "Shared models must have confirmed chat capability.")
+    row = await db.get(PublishedModel, mid)
+    if not row:
+        row = PublishedModel(model_id=mid)
+        db.add(row)
+    for key, value in body.model_dump().items():
+        setattr(row, key, value)
+    db.add(
+        AuditLog(
+            user_id=user.id,
+            action="admin.model.published" if body.enabled else "admin.model.unpublished",
+            target_id=mid,
+        )
+    )
+    await db.commit()
+    return {"id": mid, **body.model_dump()}

backend/app/admin_bootstrap.py

@@ -0,0 +1,57 @@
+"""Server-only role provisioning, including a password-hash seed for a fresh database."""
+
+from typing import Literal
+
+from argon2 import Type, extract_parameters
+from pydantic import EmailStr, TypeAdapter
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from .models import AuditLog, User
+
+
+async def provision_admin(
+    db: AsyncSession,
+    email: str,
+    action: Literal["grant", "revoke", "bootstrap"],
+    password_hash: str | None = None,
+) -> User:
+    email = str(TypeAdapter(EmailStr).validate_python(email.strip())).lower()
+    user = await db.scalar(select(User).where(User.email == email))
+    created = False
+    if not user:
+        if action != "bootstrap" or not password_hash:
+            raise ValueError("Account not found. No account was created.")
+        try:
+            params = extract_parameters(password_hash)
+            valid = (
+                params.type == Type.ID
+                and params.version == 19
+                and params.time_cost >= 2
+                and params.memory_cost >= 19456
+                and params.salt_len >= 16
+                and params.hash_len >= 16
+            )
+        except (ValueError, TypeError):
+            valid = False
+        if not valid:
+            raise ValueError(
+                "ADMIN_BOOTSTRAP_PASSWORD_HASH must be a valid Argon2id password hash."
+            )
+        user = User(email=email, name="Gateway administrator", password_hash=password_hash)
+        db.add(user)
+        await db.flush()
+        created = True
+    if user.disabled and action != "revoke":
+        raise ValueError("Restore this account before granting administrator access.")
+    # Existing accounts keep their password, identity and data, even when a seed is set.
+    user.is_admin = action != "revoke"
+    db.add(
+        AuditLog(
+            user_id=user.id,
+            action="admin.account.bootstrapped" if created else f"admin.role.{action}",
+            target_id=user.id,
+        )
+    )
+    await db.commit()
+    return user

backend/app/auth.py

@@ -13,6 +13,7 @@ from .errors import fail
 from .models import AuditLog, GatewayKey, Session, User
 from .schemas import Credentials, NewGatewayKey, Register
 from .security import DUMMY_HASH, hash_password, new_key, token_hash, verify_password
+from .site_config import site_options
 
 router = APIRouter(prefix="/api/auth", tags=["Accounts"])
 DB = Annotated[AsyncSession, Depends(get_db)]
@@ -30,6 +31,10 @@ async def current_user(request: Request, db: DB) -> User:
     user = await db.get(User, session.user_id)
     if not user:
         raise fail(401, "Please sign in.", "authentication_required")
+    if user.disabled:
+        raise fail(
+            403, "This account is suspended. Contact the administrator.", "account_suspended"
+        )
     return user
 
 
@@ -56,8 +61,13 @@ async def gateway_auth(request: Request, db: DB) -> Principal:
     )
     if not key or (key.expires_at and key.expires_at < time.time()):
         raise fail(401, "Invalid or expired Gateway API key.", "invalid_api_key")
+    user = await db.get(User, key.user_id)
+    if not user or user.disabled:
+        raise fail(403, "This account is suspended.", "account_suspended")
+    options = await site_options(db, request.app.state.settings)
     await request.app.state.shared.rate_limit(
-        "user:" + key.user_id, request.app.state.settings.requests_per_minute
+        "user:" + key.user_id,
+        min(options.requests_per_minute, request.app.state.settings.requests_per_minute),
     )
     key.last_used_at = time.time()
     await db.commit()
@@ -98,8 +108,8 @@ async def establish_session(
         )
 
 
-def user_view(user: User) -> dict[str, str]:
-    return {"id": user.id, "name": user.name, "email": user.email}
+def user_view(user: User) -> dict[str, str | bool]:
+    return {"id": user.id, "name": user.name, "email": user.email, "is_admin": user.is_admin}
 
 
 async def issue_key(db: AsyncSession, user_id: str, body: NewGatewayKey) -> tuple[GatewayKey, str]:
@@ -120,7 +130,8 @@ async def issue_key(db: AsyncSession, user_id: str, body: NewGatewayKey) -> tupl
 @router.post("/register", status_code=201)
 async def register(body: Register, request: Request, response: Response, db: DB) -> dict:
     settings = request.app.state.settings
-    if not settings.allow_registration:
+    options = await site_options(db, settings)
+    if not settings.allow_registration or not options.registration_open:
         raise fail(403, "Registration is currently closed.", "registration_closed")
     if settings.registration_code and not secrets.compare_digest(
         body.registration_code, settings.registration_code
@@ -151,6 +162,10 @@ async def login(body: Credentials, request: Request, response: Response, db: DB)
     valid = await verify_password(user.password_hash if user else DUMMY_HASH, body.password)
     if not user or not valid:
         raise fail(401, "Incorrect email or password.", "invalid_credentials")
+    if user.disabled:
+        raise fail(
+            403, "This account is suspended. Contact the administrator.", "account_suspended"
+        )
     db.add(AuditLog(user_id=user.id, action="account.login"))
     await establish_session(request, response, db, user)
     return {"user": user_view(user)}

backend/app/dashboard.py

@@ -5,7 +5,7 @@ from typing import Any
 
 from fastapi import APIRouter, Query, Request
 from fastapi.responses import StreamingResponse
-from sqlalchemy import Integer, case, cast, func, select
+from sqlalchemy import Integer, case, cast, func, or_, select
 from sqlalchemy.exc import IntegrityError
 
 from .auth import DB, CurrentUser, issue_key
@@ -15,6 +15,7 @@ from .models import AuditLog, GatewayKey, Provider, RegistryModel, RequestLog
 from .providers import ADAPTERS
 from .schemas import ModelInput, NewGatewayKey, ProviderInput, ProviderPatch
 from .security import validate_base_url, validate_headers
+from .site_config import published_ids, site_options
 
 router = APIRouter(prefix="/api", tags=["Dashboard"])
 
@@ -166,13 +167,32 @@ async def models(
     search: str = "",
     capability: str = "",
     provider: str = "",
+    free_only: bool = False,
+    owned_only: bool = False,
     limit: int = Query(200, ge=1, le=1000),
     offset: int = Query(0, ge=0),
 ) -> dict:
-    query = select(RegistryModel, Provider).join(Provider).where(Provider.user_id == user.id)
+    options = await site_options(db, request.app.state.settings)
+    shared = set(await db.scalars(published_ids())) if options.shared_models_enabled else set()
+    visible = Provider.user_id == user.id
+    if not owned_only:
+        visible = or_(visible, RegistryModel.id.in_(shared))
+    query = select(RegistryModel, Provider).join(Provider).where(visible)
     if search:
+        term = search[:120]
         query = query.where(
-            RegistryModel.model_id.ilike("%" + search.replace("%", "").replace("_", "")[:120] + "%")
+            or_(
+                RegistryModel.model_id.icontains(term, autoescape=True),
+                RegistryModel.name.icontains(term, autoescape=True),
+                Provider.name.icontains(term, autoescape=True),
+            )
+        )
+    if free_only:
+        query = query.where(
+            or_(
+                (RegistryModel.input_price == 0) & (RegistryModel.output_price == 0),
+                RegistryModel.id.in_(shared) & (Provider.user_id != user.id),
+            )
         )
     if provider:
         query = query.where(Provider.id == provider)
@@ -197,7 +217,7 @@ async def models(
     total = await db.scalar(select(func.count()).select_from(query.subquery()))
     rows = (
         await db.execute(
-            query.order_by(RegistryModel.favorite.desc(), RegistryModel.model_id)
+            query.order_by(RegistryModel.favorite.desc(), RegistryModel.model_id, RegistryModel.id)
             .limit(limit)
             .offset(offset)
         )
@@ -215,7 +235,11 @@ async def models(
             enabled=p.enabled,
             route_id=p.id + "::" + m.model_id,
             health=await request.app.state.shared.health(p.id + ":" + m.id),
+            shared=m.id in shared and p.user_id != user.id,
+            owned=p.user_id == user.id,
         )
+        if p.user_id != user.id:
+            item.update(input_price=0, output_price=0, provider_name="Community", favorite=False)
         result.append(item)
     return {"data": result, "total": total, "offset": offset, "limit": limit}
 

backend/app/main.py

@@ -12,12 +12,12 @@ from fastapi.exceptions import RequestValidationError
 from fastapi.openapi.utils import get_openapi
 from fastapi.responses import FileResponse, JSONResponse, Response
 from redis.exceptions import RedisError
-from sqlalchemy import select, text
+from sqlalchemy import or_, select, text
 from starlette.datastructures import UploadFile
 from starlette.exceptions import HTTPException
 from starlette.types import ASGIApp, Receive, Scope, Send
 
-from . import anthropic, auth, dashboard
+from . import admin, anthropic, auth, dashboard
 from .auth import CurrentUser, GatewayPrincipal, Principal
 from .config import Settings
 from .db import Base, create_database
@@ -34,6 +34,7 @@ from .schemas import (
     SpeechRequest,
 )
 from .security import Vault, secure_transport, token_hash
+from .site_config import published_ids, site_options
 from .state import SharedState
 
 logger = logging.getLogger("gateway")
@@ -217,6 +218,7 @@ def create_app(
 
     app.include_router(auth.router)
     app.include_router(dashboard.router)
+    app.include_router(admin.router)
     app.include_router(anthropic.router)
 
     @app.get("/health/live", tags=["Health"])
@@ -237,12 +239,16 @@ def create_app(
     @app.get("/v1/models", tags=["OpenAI compatible"])
     async def list_models(request: Request, principal: GatewayPrincipal) -> dict:
         async with request.app.state.db() as db:
+            options = await site_options(db, request.app.state.settings)
+            shared = (
+                set(await db.scalars(published_ids())) if options.shared_models_enabled else set()
+            )
             rows = (
                 await db.execute(
                     select(Provider, RegistryModel)
                     .join(RegistryModel)
                     .where(
-                        Provider.user_id == principal.user_id,
+                        or_(Provider.user_id == principal.user_id, RegistryModel.id.in_(shared)),
                         Provider.enabled.is_(True),
                         RegistryModel.available.is_(True),
                     )
@@ -260,6 +266,7 @@ def create_app(
                     "provider": p.kind,
                     "capabilities": m.capabilities,
                     "context_window": m.context_window,
+                    "shared": m.id in shared,
                 }
                 for p, m in rows
             ],
@@ -313,8 +320,11 @@ def create_app(
 
     @app.post("/api/playground", tags=["Dashboard"])
     async def playground(body: ChatRequest, request: Request, user: CurrentUser) -> Response:
+        async with request.app.state.db() as db:
+            options = await site_options(db, request.app.state.settings)
         await request.app.state.shared.rate_limit(
-            "user:" + user.id, request.app.state.settings.requests_per_minute
+            "user:" + user.id,
+            min(options.requests_per_minute, request.app.state.settings.requests_per_minute),
         )
         return await Execution(request, Principal(user.id), body, "chat/completions").run()
 
@@ -352,6 +362,7 @@ def create_app(
                 elif path.startswith("/api/") and path not in (
                     "/api/auth/login",
                     "/api/auth/register",
+                    "/api/site",
                 ):
                     operation["security"] = [{"DashboardSession": []}]
                     if method != "get":

backend/app/models.py

@@ -2,7 +2,17 @@ import time
 import uuid
 from typing import Any
 
-from sqlalchemy import JSON, Boolean, Float, ForeignKey, Integer, String, Text, UniqueConstraint
+from sqlalchemy import (
+    JSON,
+    Boolean,
+    Float,
+    ForeignKey,
+    Integer,
+    String,
+    Text,
+    UniqueConstraint,
+    false,
+)
 from sqlalchemy.orm import Mapped, mapped_column
 
 from .db import Base
@@ -19,6 +29,25 @@ class User(Base):
     password_hash: Mapped[str] = mapped_column(Text)
     name: Mapped[str] = mapped_column(String(80))
     created_at: Mapped[float] = mapped_column(Float, default=time.time)
+    is_admin: Mapped[bool] = mapped_column(Boolean, default=False, server_default=false())
+    disabled: Mapped[bool] = mapped_column(Boolean, default=False, server_default=false())
+
+
+class SiteConfiguration(Base):
+    __tablename__ = "site_configuration"
+    id: Mapped[str] = mapped_column(String(16), primary_key=True, default="global")
+    settings: Mapped[dict[str, Any]] = mapped_column(JSON, default=dict)
+
+
+class PublishedModel(Base):
+    __tablename__ = "published_models"
+    model_id: Mapped[str] = mapped_column(
+        ForeignKey("registry_models.id", ondelete="CASCADE"), primary_key=True
+    )
+    enabled: Mapped[bool] = mapped_column(Boolean, default=True)
+    requests_per_minute: Mapped[int] = mapped_column(Integer, default=5)
+    max_output_tokens: Mapped[int] = mapped_column(Integer, default=1024)
+    created_at: Mapped[float] = mapped_column(Float, default=time.time)
 
 
 class Session(Base):
@@ -94,6 +123,7 @@ class RequestLog(Base):
     input_tokens: Mapped[int | None] = mapped_column(Integer)
     output_tokens: Mapped[int | None] = mapped_column(Integer)
     estimated_cost: Mapped[float | None] = mapped_column(Float)
+    sponsored_cost: Mapped[float | None] = mapped_column(Float)
     attempts: Mapped[list[dict[str, Any]]] = mapped_column(JSON, default=list)
     error_code: Mapped[str | None] = mapped_column(String(80))
     created_at: Mapped[float] = mapped_column(Float, default=time.time, index=True)

backend/app/routing.py

@@ -8,15 +8,16 @@ from typing import Any
 from urllib.parse import quote
 
 import httpx
-from fastapi import Request
+from fastapi import HTTPException, Request
 from fastapi.responses import JSONResponse, Response, StreamingResponse
-from sqlalchemy import select
+from sqlalchemy import or_, select
 
 from .auth import Principal
 from .discovery import adapter_for
 from .errors import UpstreamError, fail
-from .models import Provider, RegistryModel, RequestLog
+from .models import Provider, PublishedModel, RegistryModel, RequestLog
 from .schemas import GatewayRequest
+from .site_config import published_ids, site_options
 
 RETRYABLE = {401, 403, 404, 429, 500, 502, 503, 504}
 ENDPOINT_CAPABILITY = {
@@ -120,12 +121,14 @@ async def candidates(
             ) from None
     required = requirements(endpoint, body.model_dump(), mode)
     async with state.db() as db:
+        options = await site_options(db, state.settings)
+        shared = set(await db.scalars(published_ids())) if options.shared_models_enabled else set()
         rows = (
             await db.execute(
                 select(Provider, RegistryModel)
                 .join(RegistryModel, Provider.id == RegistryModel.provider_id)
                 .where(
-                    Provider.user_id == principal.user_id,
+                    or_(Provider.user_id == principal.user_id, RegistryModel.id.in_(shared)),
                     Provider.enabled.is_(True),
                     RegistryModel.available.is_(True),
                 )
@@ -133,6 +136,8 @@ async def candidates(
         ).all()
     matches: list[tuple[int, Candidate]] = []
     for provider, model in rows:
+        if provider.user_id != principal.user_id and endpoint != "chat/completions":
+            continue
         if pin and pin not in (provider.kind, provider.id):
             continue
         if endpoint not in adapter_for(state, provider).endpoints:
@@ -163,6 +168,8 @@ async def candidates(
             if c.model.input_price is not None and c.model.output_price is not None
             else float("inf")
         )
+        if c.provider.user_id != principal.user_id:
+            price = 0
         base = (exact, not c.provider.pinned)
         if mode == "fastest":
             return base + (c.latency, c.provider.priority, c.model.model_id)
@@ -269,7 +276,13 @@ class Execution:
                     user_id=self.principal.user_id,
                     key_id=self.principal.key_id,
                     provider_id=c.provider.id if c else None,
-                    provider_name=c.provider.name if c else None,
+                    provider_name=(
+                        "Community"
+                        if c.provider.user_id != self.principal.user_id
+                        else c.provider.name
+                    )
+                    if c
+                    else None,
                     requested_model=self.body.model,
                     resolved_model=c.model.model_id if c else None,
                     endpoint=self.endpoint,
@@ -277,7 +290,12 @@ class Execution:
                     latency_ms=(time.monotonic() - self.started) * 1000,
                     input_tokens=self.input_tokens,
                     output_tokens=self.output_tokens,
-                    estimated_cost=estimated,
+                    estimated_cost=0
+                    if c and c.provider.user_id != self.principal.user_id
+                    else estimated,
+                    sponsored_cost=estimated
+                    if c and c.provider.user_id != self.principal.user_id
+                    else None,
                     attempts=self.attempts,
                     error_code=error,
                 )
@@ -337,13 +355,80 @@ class Execution:
             if (await self.state.shared.health(c.provider.id)).get("status") == "cooldown":
                 continue
             self.current = c
+            if c.provider.user_id != self.principal.user_id:
+                # Re-check publication immediately before a shared upstream attempt.
+                async with self.state.db() as db:
+                    options = await site_options(db, self.state.settings)
+                    publication = await db.get(PublishedModel, c.model.id)
+                    active = await db.scalar(
+                        published_ids().where(PublishedModel.model_id == c.model.id)
+                    )
+                if not options.shared_models_enabled or not publication or not active:
+                    continue
+                if len(json.dumps(payload)) > 64000:
+                    await self.record(413, "shared_input_limit")
+                    raise fail(
+                        413,
+                        "Community model requests are limited to 64,000 characters.",
+                        "shared_input_limit",
+                    )
+                try:
+                    await self.state.shared.rate_limit(
+                        "community:" + self.principal.user_id + ":" + c.model.id,
+                        publication.requests_per_minute,
+                    )
+                    await self.state.shared.rate_limit(
+                        "community:global", options.shared_requests_per_minute
+                    )
+                except HTTPException:
+                    await self.record(429, "shared_rate_limit")
+                    raise
+                # Provider-specific extensions may override generation limits or
+                # request billable audio/storage. Shared routes accept standard chat fields.
+                shared_fields = {
+                    "messages",
+                    "stream",
+                    "stream_options",
+                    "temperature",
+                    "top_p",
+                    "frequency_penalty",
+                    "presence_penalty",
+                    "seed",
+                    "stop",
+                    "tools",
+                    "tool_choice",
+                    "parallel_tool_calls",
+                    "response_format",
+                    "functions",
+                    "function_call",
+                    "max_tokens",
+                    "max_completion_tokens",
+                    "n",
+                    "reasoning_effort",
+                    "logprobs",
+                    "top_logprobs",
+                    "logit_bias",
+                }
+                payload = {key: value for key, value in payload.items() if key in shared_fields}
+                payload["n"] = 1
+                token_field = (
+                    "max_completion_tokens" if "max_completion_tokens" in payload else "max_tokens"
+                )
+                payload[token_field] = min(
+                    payload.get(token_field) or publication.max_output_tokens,
+                    publication.max_output_tokens,
+                )
+                if token_field == "max_completion_tokens":
+                    payload.pop("max_tokens", None)
             adapter = adapter_for(self.state, c.provider)
             payload["model"] = c.model.model_id
             started = time.monotonic()
             response: httpx.Response | None = None
             attempt: dict[str, Any] = {
                 "provider": c.provider.kind,
-                "provider_name": c.provider.name,
+                "provider_name": "Community"
+                if c.provider.user_id != self.principal.user_id
+                else c.provider.name,
                 "model": c.model.model_id,
                 "status": 0,
                 "latency_ms": 0.0,
@@ -448,9 +533,19 @@ class Execution:
             else (last_error.status if last_error.status in (400, 404, 422, 504) else 502)
         )
         await self.record(status, last_error.code)
+        guidance = {
+            401: "The provider rejected its credential (HTTP 401). Update the provider connection.",
+            403: "The provider denied this model (HTTP 403). Check model access and permissions.",
+            402: "The provider requires credit or payment (HTTP 402). Check billing and model access.",
+            429: "The provider rate limit was reached (HTTP 429). Wait or select another model.",
+            504: "The provider timed out. Retry later or select a faster model.",
+        }.get(last_error.status)
+        if guidance and self.current and self.current.provider.user_id != self.principal.user_id:
+            guidance += " For a community model, contact the gateway administrator."
         raise fail(
             status,
-            "Upstream request failed. Inspect the request ID in your dashboard; provider response details are redacted.",
+            guidance
+            or "Upstream request failed. Open request details to inspect the provider attempts.",
             last_error.code,
         )
 

backend/app/site_config.py

@@ -0,0 +1,56 @@
+from typing import Any, Literal
+
+from pydantic import BaseModel, ConfigDict, Field
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from .config import Settings
+from .models import Provider, PublishedModel, RegistryModel, SiteConfiguration, User
+
+
+class SiteOptions(BaseModel):
+    model_config = ConfigDict(extra="forbid", str_strip_whitespace=True)
+    site_name: str = Field(default="Nexus", min_length=1, max_length=40)
+    tagline: str = Field(default="Universal AI Gateway", min_length=1, max_length=160)
+    welcome_text: str = Field(
+        default="Your models. Your keys. One connection.", min_length=1, max_length=180
+    )
+    accent: Literal["purple", "blue", "green"] = "purple"
+    registration_open: bool = True
+    requests_per_minute: int = Field(default=60, ge=1, le=10000)
+    shared_models_enabled: bool = True
+    shared_requests_per_minute: int = Field(default=30, ge=1, le=10000)
+    default_mode: Literal["auto", "fastest", "cheapest", "reasoning", "coding", "vision"] = "auto"
+    default_stream: bool = True
+    default_retries: int = Field(default=2, ge=0, le=5)
+
+
+async def site_options(db: AsyncSession, config: Settings) -> SiteOptions:
+    row = await db.get(SiteConfiguration, "global")
+    defaults: dict[str, Any] = {
+        "registration_open": config.allow_registration,
+        "requests_per_minute": min(config.requests_per_minute, 10000),
+        "default_retries": config.max_retries,
+    }
+    options = SiteOptions.model_validate(defaults | (row.settings if row else {}))
+    options.registration_open = options.registration_open and config.allow_registration
+    options.requests_per_minute = min(options.requests_per_minute, config.requests_per_minute)
+    options.default_retries = min(options.default_retries, config.max_retries)
+    return options
+
+
+def published_ids() -> Any:
+    """Only explicitly published models belonging to active administrators are shared."""
+    return (
+        select(PublishedModel.model_id)
+        .join(RegistryModel, RegistryModel.id == PublishedModel.model_id)
+        .join(Provider, Provider.id == RegistryModel.provider_id)
+        .join(User, User.id == Provider.user_id)
+        .where(
+            PublishedModel.enabled.is_(True),
+            Provider.enabled.is_(True),
+            RegistryModel.available.is_(True),
+            User.is_admin.is_(True),
+            User.disabled.is_(False),
+        )
+    )

backend/tests/test_admin.py

@@ -0,0 +1,276 @@
+import json
+from contextlib import aclosing
+
+import httpx
+import pytest
+from conftest import connect, register
+from sqlalchemy import select
+
+from app.models import RegistryModel, RequestLog, User
+
+
+async def promote(app, uid):
+    async with app.state.db() as db:
+        user = await db.get(User, uid)
+        user.is_admin = True
+        await db.commit()
+
+
+async def community_setup(environment, quota=5):
+    app, client, upstream = environment
+    _, admin_id = await register(client)
+    await promote(app, admin_id)
+    pid = await connect(
+        client,
+        models=[
+            {
+                "model_id": "private-only",
+                "capabilities": {"chat": True},
+            }
+        ],
+    )
+    catalog = (await client.get("/api/models")).json()["data"]
+    model = next(m for m in catalog if m["model_id"] == "model-a")
+    async with app.state.db() as db:
+        row = await db.get(RegistryModel, model["id"])
+        row.input_price = 1
+        row.output_price = 2
+        await db.commit()
+    response = await client.put(
+        f"/api/admin/shared-models/{model['id']}",
+        json={
+            "requests_per_minute": quota,
+            "max_output_tokens": 256,
+        },
+    )
+    assert response.status_code == 200, response.text
+    member = httpx.AsyncClient(
+        transport=httpx.ASGITransport(app=app),
+        base_url="http://test",
+        headers={"Origin": "http://test"},
+    )
+    key, member_id = await register(member, "member@example.com")
+    return client, member, key, member_id, model, pid
+
+
+async def test_admin_requires_role_session_and_csrf(environment):
+    app, client, _ = environment
+    assert (await client.get("/api/admin/settings")).status_code == 401
+    response = await client.post(
+        "/api/auth/register",
+        json={
+            "email": "member@example.com",
+            "name": "Member",
+            "password": "correct-horse-battery-123",
+            "is_admin": True,
+        },
+    )
+    uid = response.json()["user"]["id"]
+    assert response.json()["user"]["is_admin"] is False
+    client.headers["X-CSRF-Token"] = client.cookies.get("gw_csrf", "")
+    for path in ("settings", "summary", "users", "shared-models"):
+        assert (await client.get(f"/api/admin/{path}")).status_code == 403
+    assert (await client.put("/api/admin/settings", json={})).status_code == 403
+    assert (
+        await client.patch(f"/api/admin/users/{uid}", json={"disabled": True})
+    ).status_code == 403
+    assert (await client.put("/api/admin/shared-models/fake", json={})).status_code == 403
+    await promote(app, uid)
+    config = (await client.get("/api/admin/settings")).json()["settings"]
+    assert (
+        await client.put("/api/admin/settings", json=config, headers={"X-CSRF-Token": "wrong"})
+    ).status_code == 403
+    assert (
+        await client.put(
+            "/api/admin/settings", json=config, headers={"Origin": "https://attacker.example"}
+        )
+    ).status_code == 403
+    assert (
+        await client.patch(f"/api/admin/users/{uid}", json={"disabled": True})
+    ).status_code == 403
+
+
+async def test_settings_are_persistent_and_public_subset_only(environment):
+    app, client, _ = environment
+    _, uid = await register(client)
+    await promote(app, uid)
+    settings = (await client.get("/api/admin/settings")).json()["settings"]
+    settings.update(
+        site_name="My Gateway", accent="blue", registration_open=False, default_mode="cheapest"
+    )
+    assert (await client.put("/api/admin/settings", json=settings)).status_code == 200
+    public = (await client.get("/api/site")).json()
+    assert public["site_name"] == "My Gateway"
+    assert public["accent"] == "blue"
+    assert set(public) == {
+        "site_name",
+        "tagline",
+        "welcome_text",
+        "accent",
+        "default_mode",
+        "default_stream",
+        "default_retries",
+        "shared_models_enabled",
+    }
+    assert (
+        await client.post(
+            "/api/auth/register",
+            json={
+                "email": "new@example.com",
+                "name": "New",
+                "password": "correct-horse-battery-123",
+            },
+        )
+    ).status_code == 403
+    assert (
+        await client.put("/api/admin/settings", json=settings | {"requests_per_minute": 1001})
+    ).status_code == 422
+    assert (
+        await client.put("/api/admin/settings", json=settings | {"extra": "unsafe"})
+    ).status_code == 422
+
+
+async def test_published_model_is_free_isolated_and_token_limited(environment):
+    app, _, upstream = environment
+    admin, member, key, _, model, pid = await community_setup(environment)
+    async with aclosing(member):
+        assert (await member.get("/api/providers")).json() == []
+        catalog = (await member.get("/api/models?free_only=true")).json()
+        assert catalog["total"] == 1
+        public = catalog["data"][0]
+        assert public["owned"] is False and public["shared"] is True
+        assert public["input_price"] == public["output_price"] == 0
+        assert public["provider_name"] == "Community"
+        assert "upstream-provider-key" not in json.dumps(public)
+        assert (await member.get("/api/models?owned_only=true")).json()["total"] == 0
+        assert (
+            await member.put(f"/api/providers/{pid}/models", json={"model_id": "model-a"})
+        ).status_code == 404
+        assert (
+            await member.put(f"/api/admin/shared-models/{model['id']}", json={})
+        ).status_code == 403
+        headers = {"Authorization": f"Bearer {key}"}
+        listed = (await member.get("/v1/models", headers=headers)).json()["data"]
+        assert [m["native_id"] for m in listed] == ["model-a"]
+        payload = {
+            "model": public["route_id"],
+            "messages": [{"role": "user", "content": "Hello"}],
+            "n": 16,
+            "max_completion_tokens": 100000,
+            "max_tokens": 9999,
+        }
+        response = await member.post("/v1/chat/completions", headers=headers, json=payload)
+        assert response.status_code == 200, response.text
+        sent = json.loads(upstream.calls[-1].content)
+        assert sent["max_completion_tokens"] == 256 and sent["n"] == 1
+        assert "max_tokens" not in sent
+        assert upstream.calls[-1].headers["authorization"] == "Bearer upstream-provider-key"
+        log = (await member.get("/api/logs")).json()["data"][0]
+        assert log["estimated_cost"] == 0 and log["provider_name"] == "Community"
+        async with app.state.db() as db:
+            record = await db.scalar(select(RequestLog).where(RequestLog.id == log["id"]))
+            assert record.sponsored_cost == pytest.approx(0.000014)
+        for endpoint, body in [
+            ("embeddings", {"input": "hello"}),
+            ("responses", {"input": "hello"}),
+        ]:
+            assert (
+                await member.post(
+                    f"/v1/{endpoint}", headers=headers, json={"model": public["route_id"], **body}
+                )
+            ).status_code == 404
+        assert (
+            await member.post("/api/playground", json=payload | {"model": f"{pid}::private-only"})
+        ).status_code == 404
+        await admin.put(f"/api/admin/shared-models/{model['id']}", json={"enabled": False})
+        assert (await member.get("/api/models")).json()["total"] == 0
+        assert (await member.post("/api/playground", json=payload)).status_code == 404
+
+
+async def test_community_limits_and_site_switch(environment):
+    _, _, upstream = environment
+    admin, member, _, _, model, _ = await community_setup(environment, quota=1)
+    async with aclosing(member):
+        payload = {"model": model["route_id"], "messages": [{"role": "user", "content": "Hi"}]}
+        assert (
+            await member.post(
+                "/api/playground",
+                json=payload | {"messages": [{"role": "user", "content": "x" * 64001}]},
+            )
+        ).status_code == 413
+        assert not upstream.calls
+        assert (await member.post("/api/playground", json=payload)).status_code == 200
+        assert (await member.post("/api/playground", json=payload)).status_code == 429
+        assert len(upstream.calls) == 1
+        settings = (await admin.get("/api/admin/settings")).json()["settings"]
+        await admin.put("/api/admin/settings", json=settings | {"shared_models_enabled": False})
+        assert (await member.get("/api/models")).json()["total"] == 0
+        assert (await member.post("/api/playground", json=payload)).status_code == 404
+
+
+async def test_suspension_ends_sessions_and_blocks_keys(environment):
+    admin, member, key, uid, _, _ = await community_setup(environment)
+    async with aclosing(member):
+        response = await admin.patch(f"/api/admin/users/{uid}", json={"disabled": True})
+        assert response.status_code == 200
+        assert (await member.get("/api/auth/me")).status_code == 401
+        assert (
+            await member.get("/v1/models", headers={"Authorization": f"Bearer {key}"})
+        ).status_code == 403
+        assert (
+            await member.post(
+                "/api/auth/login",
+                json={"email": "member@example.com", "password": "correct-horse-battery-123"},
+            )
+        ).status_code == 403
+        assert (
+            await admin.patch(f"/api/admin/users/{uid}", json={"disabled": False, "is_admin": True})
+        ).status_code == 422
+        await admin.patch(f"/api/admin/users/{uid}", json={"disabled": False})
+        assert (
+            await member.get("/v1/models", headers={"Authorization": f"Bearer {key}"})
+        ).status_code == 200
+
+
+async def test_full_catalog_search_includes_last_page_and_free_models(environment):
+    app, client, _ = environment
+    await register(client)
+    pid = await connect(client)
+    async with app.state.db() as db:
+        db.add_all(
+            [
+                RegistryModel(
+                    provider_id=pid,
+                    model_id=f"catalog-{i:04d}",
+                    name=f"Model {i}",
+                    capabilities={"chat": True},
+                    available=True,
+                    input_price=0 if i == 1204 else 1,
+                    output_price=0 if i == 1204 else 2,
+                )
+                for i in range(1205)
+            ]
+        )
+        await db.commit()
+    first = (await client.get("/api/models?limit=1000")).json()
+    last = (await client.get("/api/models?limit=1000&offset=1000")).json()
+    assert first["total"] == 1206 and len(first["data"]) == 1000
+    assert len(last["data"]) == 206
+    assert len({m["id"] for m in first["data"] + last["data"]}) == 1206
+    result = (await client.get("/api/models?search=Model%201204&free_only=true")).json()
+    assert result["total"] == 1 and result["data"][0]["model_id"] == "catalog-1204"
+
+
+async def test_upstream_credit_error_is_actionable_without_leaking_details(environment):
+    _, client, upstream = environment
+    await register(client)
+    await connect(client)
+    upstream.statuses["first.example.com"] = 402
+    response = await client.post(
+        "/api/playground",
+        json={"model": "model-a", "messages": [{"role": "user", "content": "hello"}]},
+    )
+    assert response.status_code == 502
+    assert "HTTP 402" in response.json()["error"]["message"]
+    assert "billing" in response.json()["error"]["message"]
+    assert "LEAK" not in response.text and "upstream-provider-key" not in response.text

backend/tests/test_admin_bootstrap.py

@@ -0,0 +1,53 @@
+import pytest
+from sqlalchemy import select
+
+from app.admin_bootstrap import provision_admin
+from app.models import User
+from app.security import hash_password
+
+
+async def test_bootstrap_requires_explicit_valid_seed(environment):
+    app, _, _ = environment
+    async with app.state.db() as db:
+        for action, seed in [("grant", None), ("bootstrap", None), ("bootstrap", "not-a-hash")]:
+            with pytest.raises(ValueError):
+                await provision_admin(db, "owner@example.com", action, seed)
+        assert await db.scalar(select(User)) is None
+
+
+async def test_fresh_owner_can_sign_in_and_restarts_preserve_password(environment):
+    app, client, _ = environment
+    seed = await hash_password("bootstrap-owner-password-123")
+    async with app.state.db() as db:
+        owner = await provision_admin(db, "owner@example.com", "bootstrap", seed)
+        uid = owner.id
+        assert owner.is_admin
+    login = await client.post(
+        "/api/auth/login",
+        json={"email": "owner@example.com", "password": "bootstrap-owner-password-123"},
+    )
+    assert login.status_code == 200 and login.json()["user"]["is_admin"]
+    assert (await client.get("/api/admin/settings")).status_code == 200
+    async with app.state.db() as db:
+        owner = await provision_admin(
+            db, "owner@example.com", "bootstrap", await hash_password("a-different-password-123")
+        )
+        assert owner.id == uid and owner.password_hash == seed
+        await provision_admin(db, "owner@example.com", "revoke")
+    assert (await client.get("/api/admin/settings")).status_code == 403
+
+
+async def test_bootstrap_does_not_unsuspend_accounts(environment):
+    app, _, _ = environment
+    async with app.state.db() as db:
+        owner = await provision_admin(
+            db,
+            "owner@example.com",
+            "bootstrap",
+            await hash_password("bootstrap-owner-password-123"),
+        )
+        owner.disabled = True
+        await db.commit()
+        with pytest.raises(ValueError, match="Restore"):
+            await provision_admin(db, "owner@example.com", "bootstrap")
+        assert owner.disabled

deploy/start.py

@@ -163,6 +163,22 @@ try:
         ],
         check=True,
     )
+    # Server-only provisioning runs before the public application accepts requests.
+    # A password-hash seed can recreate the owner after an explicitly accepted data reset.
+    if os.environ.get("ADMIN_BOOTSTRAP_EMAIL"):
+        subprocess.run(
+            [
+                sys.executable,
+                "scripts/admin.py",
+                "bootstrap",
+                "--email",
+                os.environ["ADMIN_BOOTSTRAP_EMAIL"],
+            ],
+            check=True,
+        )
+    # The web worker does not need access to the operator's provisioning secrets.
+    os.environ.pop("ADMIN_BOOTSTRAP_PASSWORD_HASH", None)
+    os.environ.pop("ADMIN_BOOTSTRAP_EMAIL", None)
     api = subprocess.Popen(
         [
             sys.executable,

docs/administration.md

@@ -0,0 +1,75 @@
+# Administration and community models
+
+Open `https://YOUR-GATEWAY/#admin` and sign in with an existing administrator account. There is no separate admin password, default account, or public role-grant endpoint. Ordinary members receive HTTP 403 from every administration API, even if they open the URL directly. Session mutations also require the same-origin CSRF token.
+
+## Activate an administrator
+
+Deploy this version first. The container runs the database migration automatically before starting the application. Keep the existing encryption keys and database; changing encryption keys without rotation makes existing provider credentials unreadable.
+
+From the running gateway container:
+
+```sh
+docker exec YOUR_CONTAINER python scripts/admin.py grant --email owner@example.com
+docker exec YOUR_CONTAINER python scripts/admin.py list
+```
+
+For a non-container installation, run `python scripts/admin.py grant --email owner@example.com` from the repository root using the application's Python environment and database configuration, after `python -m alembic -c backend/alembic.ini upgrade head`.
+
+For Hugging Face Spaces without a container terminal, add a Space **Secret** named `ADMIN_BOOTSTRAP_EMAIL` containing the exact email of an **already registered** account, then restart the updated Space. The startup supervisor grants that account's role after migrating. With persistent database storage, remove this secret after the first successful activation; the role persists in the database. Leaving it set would grant the role again on later restarts. A suspended account is never restored automatically. An unknown account requires the explicit password-hash seed described below; otherwise startup stops without creating it. Remove the secret to recover from a typo.
+
+### Fresh database after an approved reset
+
+Set two private Space secrets before starting the updated application:
+
+- `ADMIN_BOOTSTRAP_EMAIL`: the exact administrator email.
+- `ADMIN_BOOTSTRAP_PASSWORD_HASH`: an Argon2id hash of your chosen password, generated locally. No plaintext password or default password is placed in the repository.
+
+Generate a hash in your gateway Python environment with:
+
+```sh
+python -c "from argon2 import PasswordHasher; from getpass import getpass; print(PasswordHasher(time_cost=3, memory_cost=65536, parallelism=2).hash(getpass('Admin password: ')))"
+```
+
+Copy only the generated hash into the private secret. On an empty database, startup creates that one administrator before accepting public requests. On an existing database, it keeps the account's password and data. The web worker does not inherit these bootstrap secrets. The equivalent server command is `python scripts/admin.py bootstrap --email owner@example.com` with the hash environment variable set.
+
+On ephemeral storage, keep both secrets if you want this admin login recreated after later resets. This does **not** preserve provider connections, other users, site settings, published models, or request history. Use durable PostgreSQL to retain those. Once durable storage is configured, remove both bootstrap secrets so later role revocation cannot be undone by a restart.
+
+Refresh the gateway after activation. **Administration** appears in the sidebar. Use the account's existing password. Public signup ignores client-supplied role fields and never promotes users.
+
+To revoke access, first remove any bootstrap secret, then run:
+
+```sh
+docker exec YOUR_CONTAINER python scripts/admin.py revoke --email owner@example.com
+```
+
+Role checks read the database on every request. Revoking an administrator also makes their published models unavailable to other users. Restore another administrator through the server command if needed; administrator accounts cannot be suspended from the web panel.
+
+## What the panel controls
+
+- Site name, tagline, welcome text and purple/blue/green accent.
+- Default Playground routing, streaming and retry budget. Existing Playground sessions retain their settings; reopening Playground uses updated defaults.
+- New registrations, account request rate, community request rate across the site, and a community-model enable switch. Server environment limits remain the upper bounds.
+- Search accounts, suspend members and restore access. Suspension deletes active sessions and blocks existing API keys. Restoring an account re-enables unexpired, unrevoked keys.
+- Publish selected models from the administrator's own provider connections; enable or disable each publication. Change its quota by selecting that model, entering new limits, and publishing again.
+
+Private provider credentials, other users' keys, password hashes, prompts and responses are not exposed in the administration panel. Changes create audit records. This is service administration, not arbitrary server command execution or a source-code editor.
+
+## Publish your own free model
+
+1. Open **Administration → Community models → Connect provider**.
+2. Select a compatible provider or **Custom OpenAI-compatible** and enter the model server's API base URL (usually ending in `/v1`) and credential. For Ollama/LM Studio on a private network, the server operator must explicitly allow its exact hostname with `PRIVATE_UPSTREAM_HOSTS`; public users cannot change this setting.
+3. Let discovery finish. If your server does not list models, choose **Register your model**, select the new connection, enter the exact model ID, and confirm Chat capability plus any capabilities the server actually supports. Configure real input/output prices when known so sponsored cost estimates can be calculated.
+4. Choose that model in the admin picker, set requests per minute per member and the maximum output tokens, then **Publish free model**.
+5. Members can find it under **Playground → Select model → Free only** or **Model explorer → Free only**. The catalog includes every page and supports model name, ID and provider search. Published models also appear in each member's authenticated `/v1/models` list and can be used with their own Gateway API key.
+
+The gateway keeps the provider credential encrypted on the server and injects it only when contacting that provider. Publishing one model does not publish the provider's other models or grant members permission to edit that connection. Members' published-model requests show zero estimated cost; the actual estimated upstream cost is recorded as sponsored usage for administrators. The model sponsor remains responsible for provider charges and server capacity.
+
+Community access requires a gateway account. It supports chat completions and chat streaming, including the chat-compatible messages adapter. It does not expose shared embeddings, images, audio or stateful Responses routes. Shared requests enforce the configured per-user/per-model and site-wide rates, one completion per request, output token limits, and a 64,000-character serialized request limit. Provider rate limits still apply. Disabling the publication, its provider, the community switch, or the owner's admin role blocks new shared requests; in-flight requests may finish.
+
+## Deployment and verification
+
+Deploy the complete repository, including `backend/alembic`, `scripts`, `deploy` and the frontend. The Dockerfile builds the static frontend; `deploy/start.py` applies migration `a481c6e724df` and starts the app. Do not copy only the frontend because admin authorization and community routing depend on the backend changes.
+
+Use persistent storage or managed PostgreSQL for account and role durability. After rebuilding, verify `/health/ready`, sign in, open `/#admin`, save one setting, and check a published model using a separate member account. Never store provider keys or passwords in GitHub source files.
+
+A manual GitHub workflow, **Deploy gateway Space**, can upload the full application while preserving the Hugging Face README metadata. Configure a Space trusted publisher for GitHub repository `ArnavSingh76533/gateway`, branch `main`, workflow `deploy-space.yml`; the workflow uses short-lived credentials restricted to that Space. It runs only when explicitly dispatched with the storage acknowledgement checked. Review CI first. The current free Space had no mounted storage or external database at implementation time, so do not rebuild it until its existing data has been backed up or you have explicitly accepted resetting it. See [Hugging Face storage](https://huggingface.co/docs/hub/spaces-storage) and [trusted publishers](https://huggingface.co/docs/hub/trusted-publishers).

docs/openapi.json

@@ -481,6 +481,26 @@
               "title": "Provider"
             }
           },
+          {
+            "name": "free_only",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "boolean",
+              "default": false,
+              "title": "Free Only"
+            }
+          },
+          {
+            "name": "owned_only",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "boolean",
+              "default": false,
+              "title": "Owned Only"
+            }
+          },
           {
             "name": "limit",
             "in": "query",
@@ -1003,6 +1023,370 @@
         ]
       }
     },
+    "/api/site": {
+      "get": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Public Settings",
+        "operationId": "public_settings_api_site_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": true,
+                  "type": "object",
+                  "title": "Response Public Settings Api Site Get"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/admin/settings": {
+      "get": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Get Settings",
+        "operationId": "get_settings_api_admin_settings_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": true,
+                  "type": "object",
+                  "title": "Response Get Settings Api Admin Settings Get"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ]
+      },
+      "put": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Save Settings",
+        "operationId": "save_settings_api_admin_settings_put",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SiteOptions"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": true,
+                  "type": "object",
+                  "title": "Response Save Settings Api Admin Settings Put"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Validation Error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ],
+        "parameters": [
+          {
+            "name": "X-CSRF-Token",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Value of the gw_csrf cookie. Same-origin dashboard mutations only."
+          }
+        ]
+      }
+    },
+    "/api/admin/summary": {
+      "get": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Summary",
+        "operationId": "summary_api_admin_summary_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "additionalProperties": true,
+                  "type": "object",
+                  "title": "Response Summary Api Admin Summary Get"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ]
+      }
+    },
+    "/api/admin/users": {
+      "get": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Users",
+        "operationId": "users_api_admin_users_get",
+        "parameters": [
+          {
+            "name": "search",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "default": "",
+              "title": "Search"
+            }
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "minimum": 0,
+              "default": 0,
+              "title": "Offset"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "additionalProperties": true,
+                  "title": "Response Users Api Admin Users Get"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Validation Error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ]
+      }
+    },
+    "/api/admin/users/{uid}": {
+      "patch": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Account Status",
+        "operationId": "account_status_api_admin_users__uid__patch",
+        "parameters": [
+          {
+            "name": "uid",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "title": "Uid"
+            }
+          },
+          {
+            "name": "X-CSRF-Token",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Value of the gw_csrf cookie. Same-origin dashboard mutations only."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AccountStatus"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "additionalProperties": true,
+                  "title": "Response Account Status Api Admin Users  Uid  Patch"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Validation Error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ]
+      }
+    },
+    "/api/admin/shared-models": {
+      "get": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Shared Models",
+        "operationId": "shared_models_api_admin_shared_models_get",
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "items": {
+                    "additionalProperties": true,
+                    "type": "object"
+                  },
+                  "type": "array",
+                  "title": "Response Shared Models Api Admin Shared Models Get"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ]
+      }
+    },
+    "/api/admin/shared-models/{mid}": {
+      "put": {
+        "tags": [
+          "Administration"
+        ],
+        "summary": "Publish",
+        "operationId": "publish_api_admin_shared_models__mid__put",
+        "parameters": [
+          {
+            "name": "mid",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string",
+              "title": "Mid"
+            }
+          },
+          {
+            "name": "X-CSRF-Token",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Value of the gw_csrf cookie. Same-origin dashboard mutations only."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PublishOptions"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Successful Response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "additionalProperties": true,
+                  "title": "Response Publish Api Admin Shared Models  Mid  Put"
+                }
+              }
+            }
+          },
+          "422": {
+            "description": "Validation Error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/HTTPValidationError"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "DashboardSession": []
+          }
+        ]
+      }
+    },
     "/v1/messages": {
       "post": {
         "tags": [
@@ -1471,6 +1855,20 @@
   },
   "components": {
     "schemas": {
+      "AccountStatus": {
+        "properties": {
+          "disabled": {
+            "type": "boolean",
+            "title": "Disabled"
+          }
+        },
+        "additionalProperties": false,
+        "type": "object",
+        "required": [
+          "disabled"
+        ],
+        "title": "AccountStatus"
+      },
       "Capabilities": {
         "properties": {
           "chat": {
@@ -2359,6 +2757,32 @@
         "type": "object",
         "title": "ProviderPatch"
       },
+      "PublishOptions": {
+        "properties": {
+          "enabled": {
+            "type": "boolean",
+            "title": "Enabled",
+            "default": true
+          },
+          "requests_per_minute": {
+            "type": "integer",
+            "maximum": 120.0,
+            "minimum": 1.0,
+            "title": "Requests Per Minute",
+            "default": 5
+          },
+          "max_output_tokens": {
+            "type": "integer",
+            "maximum": 8192.0,
+            "minimum": 128.0,
+            "title": "Max Output Tokens",
+            "default": 1024
+          }
+        },
+        "additionalProperties": false,
+        "type": "object",
+        "title": "PublishOptions"
+      },
       "Register": {
         "properties": {
           "email": {
@@ -2475,6 +2899,93 @@
         ],
         "title": "ResponseRequest"
       },
+      "SiteOptions": {
+        "properties": {
+          "site_name": {
+            "type": "string",
+            "maxLength": 40,
+            "minLength": 1,
+            "title": "Site Name",
+            "default": "Nexus"
+          },
+          "tagline": {
+            "type": "string",
+            "maxLength": 160,
+            "minLength": 1,
+            "title": "Tagline",
+            "default": "Universal AI Gateway"
+          },
+          "welcome_text": {
+            "type": "string",
+            "maxLength": 180,
+            "minLength": 1,
+            "title": "Welcome Text",
+            "default": "Your models. Your keys. One connection."
+          },
+          "accent": {
+            "type": "string",
+            "enum": [
+              "purple",
+              "blue",
+              "green"
+            ],
+            "title": "Accent",
+            "default": "purple"
+          },
+          "registration_open": {
+            "type": "boolean",
+            "title": "Registration Open",
+            "default": true
+          },
+          "requests_per_minute": {
+            "type": "integer",
+            "maximum": 10000.0,
+            "minimum": 1.0,
+            "title": "Requests Per Minute",
+            "default": 60
+          },
+          "shared_models_enabled": {
+            "type": "boolean",
+            "title": "Shared Models Enabled",
+            "default": true
+          },
+          "shared_requests_per_minute": {
+            "type": "integer",
+            "maximum": 10000.0,
+            "minimum": 1.0,
+            "title": "Shared Requests Per Minute",
+            "default": 30
+          },
+          "default_mode": {
+            "type": "string",
+            "enum": [
+              "auto",
+              "fastest",
+              "cheapest",
+              "reasoning",
+              "coding",
+              "vision"
+            ],
+            "title": "Default Mode",
+            "default": "auto"
+          },
+          "default_stream": {
+            "type": "boolean",
+            "title": "Default Stream",
+            "default": true
+          },
+          "default_retries": {
+            "type": "integer",
+            "maximum": 5.0,
+            "minimum": 0.0,
+            "title": "Default Retries",
+            "default": 2
+          }
+        },
+        "additionalProperties": false,
+        "type": "object",
+        "title": "SiteOptions"
+      },
       "SpeechRequest": {
         "properties": {
           "model": {
@@ -2613,4 +3124,4 @@
       }
     }
   }
-}
+}

frontend/app/admin-panel.tsx

@@ -0,0 +1,620 @@
+"use client";
+import { FormEvent, useCallback, useEffect, useState } from "react";
+import {
+  ShieldCheck,
+  RefreshCw,
+  Plus,
+  Users,
+  Globe,
+  Settings2,
+} from "lucide-react";
+import { api, loadAllModels, Model, money, User } from "@/lib/api";
+import { SiteOptions } from "@/lib/site";
+import { Badge, Banner, Modal, PageHeading } from "./ui";
+import ModelPicker from "./model-picker";
+
+type AdminSettings = SiteOptions & {
+  registration_open: boolean;
+  requests_per_minute: number;
+  shared_requests_per_minute: number;
+};
+type Published = {
+  id: string;
+  name: string;
+  model_id: string;
+  provider_name: string;
+  enabled: boolean;
+  requests_per_minute: number;
+  max_output_tokens: number;
+  owned: boolean;
+};
+type Account = User & { disabled: boolean; created_at: number };
+type Summary = {
+  users: number;
+  suspended_users: number;
+  requests: number;
+  published_models: number;
+  sponsored_cost: number | null;
+};
+
+export default function AdminPanel({
+  user,
+  onSettings,
+  onConnect,
+  onRegisterModel,
+  notify,
+  revision = 0,
+}: {
+  user: User;
+  onSettings: (settings: SiteOptions) => void;
+  onConnect: () => void;
+  onRegisterModel: () => void;
+  notify: (message: string) => void;
+  revision?: number;
+}) {
+  const [settings, setSettings] = useState<AdminSettings | null>(null);
+  const [limits, setLimits] = useState({
+    requests_per_minute: 60,
+    max_retries: 2,
+    registration_allowed: true,
+  });
+  const [summary, setSummary] = useState<Summary | null>(null);
+  const [models, setModels] = useState<Model[]>([]);
+  const [published, setPublished] = useState<Published[]>([]);
+  const [selected, setSelected] = useState<Model | null>(null);
+  const [quota, setQuota] = useState(5);
+  const [maxTokens, setMaxTokens] = useState(1024);
+  const [loading, setLoading] = useState(true);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState("");
+  const [users, setUsers] = useState<Account[]>([]);
+  const [totalUsers, setTotalUsers] = useState(0);
+  const [search, setSearch] = useState("");
+  const [offset, setOffset] = useState(0);
+  const [userRevision, setUserRevision] = useState(0);
+  const [target, setTarget] = useState<Account | null>(null);
+  const [confirmError, setConfirmError] = useState("");
+  const load = useCallback(async () => {
+    setLoading(true);
+    setError("");
+    try {
+      const [config, stats, shared, catalog] = await Promise.all([
+        api<{ settings: AdminSettings; limits: typeof limits }>(
+          "/admin/settings",
+        ),
+        api<Summary>("/admin/summary"),
+        api<Published[]>("/admin/shared-models"),
+        loadAllModels(undefined, true),
+      ]);
+      setSettings(config.settings);
+      setLimits(config.limits);
+      setSummary(stats);
+      setPublished(shared);
+      setModels(catalog);
+    } catch (e) {
+      setError((e as Error).message);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+  useEffect(() => {
+    void load();
+  }, [load, revision]);
+  useEffect(() => {
+    const pending = new AbortController();
+    const timer = setTimeout(() => {
+      void api<{ data: Account[]; total: number }>(
+        `/admin/users?search=${encodeURIComponent(search)}&offset=${offset}`,
+        { signal: pending.signal },
+      )
+        .then((page) => {
+          if (!pending.signal.aborted) {
+            setUsers(page.data);
+            setTotalUsers(page.total);
+          }
+        })
+        .catch((e: Error) => {
+          if (!pending.signal.aborted) setError(e.message);
+        });
+    }, 200);
+    return () => {
+      clearTimeout(timer);
+      pending.abort();
+    };
+  }, [search, offset, userRevision]);
+  async function saveSettings(e: FormEvent) {
+    e.preventDefault();
+    if (!settings) return;
+    setBusy(true);
+    setError("");
+    try {
+      const saved = await api<AdminSettings>("/admin/settings", {
+        method: "PUT",
+        body: JSON.stringify(settings),
+      });
+      onSettings(saved);
+      notify("Site settings saved");
+    } catch (e) {
+      setError((e as Error).message);
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function publish(
+    id: string,
+    enabled: boolean,
+    rpm = quota,
+    tokens = maxTokens,
+  ) {
+    setBusy(true);
+    setError("");
+    try {
+      await api(`/admin/shared-models/${id}`, {
+        method: "PUT",
+        body: JSON.stringify({
+          enabled,
+          requests_per_minute: rpm,
+          max_output_tokens: tokens,
+        }),
+      });
+      notify(
+        enabled
+          ? "Model published for all signed-in users"
+          : "Community model disabled",
+      );
+      await load();
+    } catch (e) {
+      setError((e as Error).message);
+    } finally {
+      setBusy(false);
+    }
+  }
+  async function changeAccount() {
+    if (!target) return;
+    setBusy(true);
+    setConfirmError("");
+    try {
+      await api(`/admin/users/${target.id}`, {
+        method: "PATCH",
+        body: JSON.stringify({ disabled: !target.disabled }),
+      });
+      setTarget(null);
+      setUserRevision((v) => v + 1);
+      notify(target.disabled ? "Account restored" : "Account suspended");
+      setSummary(await api<Summary>("/admin/summary"));
+    } catch (e) {
+      setConfirmError((e as Error).message);
+    } finally {
+      setBusy(false);
+    }
+  }
+  function update<K extends keyof AdminSettings>(
+    key: K,
+    value: AdminSettings[K],
+  ) {
+    setSettings((current) =>
+      current ? { ...current, [key]: value } : current,
+    );
+  }
+  return (
+    <>
+      <PageHeading
+        title="Administration"
+        subtitle="Manage your site, users, and community models."
+        action={
+          <Badge tone="purple">
+            <ShieldCheck size={14} />
+            Administrator
+          </Badge>
+        }
+      />
+      <div className="admin-access-note">
+        <ShieldCheck size={17} />
+        <span>
+          Signed in as {user.email}. Administrator roles are managed on the
+          server.
+        </span>
+      </div>
+      {error && <Banner tone="error">{error}</Banner>}
+      {loading && <p aria-live="polite">Loading administration…</p>}
+      {summary && (
+        <div className="admin-stats">
+          <div className="panel">
+            <span>Accounts</span>
+            <strong>{summary.users}</strong>
+            <small>{summary.suspended_users} suspended</small>
+          </div>
+          <div className="panel">
+            <span>Gateway requests</span>
+            <strong>{summary.requests}</strong>
+            <small>Across all accounts</small>
+          </div>
+          <div className="panel">
+            <span>Published models</span>
+            <strong>{summary.published_models}</strong>
+            <small>Only enabled publications</small>
+          </div>
+          <div className="panel">
+            <span>Sponsored usage</span>
+            <strong>{money(summary.sponsored_cost)}</strong>
+            <small>Estimated upstream token cost</small>
+          </div>
+        </div>
+      )}
+      <div className="admin-grid">
+        {settings && (
+          <section className="panel admin-section">
+            <div className="panel-heading">
+              <h2>
+                <Settings2 size={18} />
+                Site and service settings
+              </h2>
+            </div>
+            <form className="form admin-form" onSubmit={saveSettings}>
+              <label>
+                Site name
+                <input
+                  maxLength={40}
+                  required
+                  value={settings.site_name}
+                  onChange={(e) => update("site_name", e.target.value)}
+                />
+              </label>
+              <label>
+                Tagline
+                <input
+                  maxLength={160}
+                  required
+                  value={settings.tagline}
+                  onChange={(e) => update("tagline", e.target.value)}
+                />
+              </label>
+              <label>
+                Welcome text
+                <textarea
+                  maxLength={180}
+                  required
+                  value={settings.welcome_text}
+                  onChange={(e) => update("welcome_text", e.target.value)}
+                />
+              </label>
+              <label>
+                Accent color
+                <select
+                  value={settings.accent}
+                  onChange={(e) =>
+                    update("accent", e.target.value as SiteOptions["accent"])
+                  }
+                >
+                  <option value="purple">Purple</option>
+                  <option value="blue">Blue</option>
+                  <option value="green">Green</option>
+                </select>
+              </label>
+              <label>
+                Default routing
+                <select
+                  value={settings.default_mode}
+                  onChange={(e) => update("default_mode", e.target.value)}
+                >
+                  {[
+                    "auto",
+                    "fastest",
+                    "cheapest",
+                    "reasoning",
+                    "coding",
+                    "vision",
+                  ].map((mode) => (
+                    <option key={mode} value={mode}>
+                      {mode}
+                    </option>
+                  ))}
+                </select>
+              </label>
+              <label>
+                Default retry budget
+                <input
+                  type="number"
+                  min={0}
+                  max={limits.max_retries}
+                  required
+                  value={settings.default_retries}
+                  onChange={(e) =>
+                    update("default_retries", Number(e.target.value))
+                  }
+                />
+              </label>
+              <label className="check-label">
+                <input
+                  type="checkbox"
+                  checked={settings.default_stream}
+                  onChange={(e) => update("default_stream", e.target.checked)}
+                />
+                Stream responses by default
+              </label>
+              <label>
+                Requests per minute per account
+                <input
+                  type="number"
+                  min={1}
+                  max={limits.requests_per_minute}
+                  required
+                  value={settings.requests_per_minute}
+                  onChange={(e) =>
+                    update("requests_per_minute", Number(e.target.value))
+                  }
+                />
+              </label>
+              <small className="form-note">
+                Server maximum: {limits.requests_per_minute} requests/minute and{" "}
+                {limits.max_retries} retries.
+              </small>
+              <label className="check-label">
+                <input
+                  type="checkbox"
+                  disabled={!limits.registration_allowed}
+                  checked={settings.registration_open}
+                  onChange={(e) =>
+                    update("registration_open", e.target.checked)
+                  }
+                />
+                Allow new registrations
+              </label>
+              {!limits.registration_allowed && (
+                <small>
+                  Registration is closed in the server configuration.
+                </small>
+              )}
+              <label className="check-label">
+                <input
+                  type="checkbox"
+                  checked={settings.shared_models_enabled}
+                  onChange={(e) =>
+                    update("shared_models_enabled", e.target.checked)
+                  }
+                />
+                Enable community models
+              </label>
+              <label>
+                Community requests per minute across the whole site
+                <input
+                  type="number"
+                  min={1}
+                  max={10000}
+                  required
+                  value={settings.shared_requests_per_minute}
+                  onChange={(e) =>
+                    update("shared_requests_per_minute", Number(e.target.value))
+                  }
+                />
+              </label>
+              <button className="button primary" disabled={busy || loading}>
+                Save site settings
+              </button>
+            </form>
+          </section>
+        )}
+        <section className="panel admin-section">
+          <div className="panel-heading">
+            <h2>
+              <Globe size={18} />
+              Community models
+            </h2>
+          </div>
+          <div className="form admin-form">
+            <p>
+              Publish a model from your own provider connection. Every signed-in
+              user can use it free of charge through the Playground or their
+              Gateway API key. You cover the upstream provider cost.
+            </p>
+            <div className="admin-setup-actions">
+              <button className="button" onClick={onConnect}>
+                <Plus size={15} />
+                Connect provider
+              </button>
+              <button className="button" onClick={onRegisterModel}>
+                Register your model
+              </button>
+            </div>
+            <ModelPicker
+              label="Community model"
+              models={models}
+              selected={selected}
+              onSelect={setSelected}
+              allowAuto={false}
+              loading={loading}
+              onRefresh={() => void load()}
+              disabled={busy}
+            />
+            <label>
+              Requests per minute per user
+              <input
+                type="number"
+                min={1}
+                max={120}
+                value={quota}
+                onChange={(e) => setQuota(Number(e.target.value))}
+              />
+            </label>
+            <label>
+              Maximum output tokens per request
+              <input
+                type="number"
+                min={128}
+                max={8192}
+                value={maxTokens}
+                onChange={(e) => setMaxTokens(Number(e.target.value))}
+              />
+            </label>
+            <button
+              className="button primary"
+              disabled={
+                !selected ||
+                busy ||
+                quota < 1 ||
+                quota > 120 ||
+                maxTokens < 128 ||
+                maxTokens > 8192
+              }
+              onClick={() => selected && void publish(selected.id, true)}
+            >
+              Publish free model
+            </button>
+            <p className="form-note">
+              Only the selected model is shared. Provider credentials remain
+              encrypted. Community routes support chat, enforce token and
+              request limits, and stop accepting new requests when disabled.
+            </p>
+            <div className="published-models">
+              {published.map((model) => (
+                <div className="published-model" key={model.id}>
+                  <div>
+                    <strong>{model.name}</strong>
+                    <small className="mono">{model.model_id}</small>
+                    <small>
+                      {model.requests_per_minute} requests/min/user ·{" "}
+                      {model.max_output_tokens} output tokens
+                    </small>
+                  </div>
+                  <Badge tone={model.enabled ? "green" : "neutral"}>
+                    {model.enabled ? "Published" : "Disabled"}
+                  </Badge>
+                  <button
+                    className="button"
+                    disabled={busy || !model.owned}
+                    onClick={() =>
+                      void publish(
+                        model.id,
+                        !model.enabled,
+                        model.requests_per_minute,
+                        model.max_output_tokens,
+                      )
+                    }
+                  >
+                    {model.enabled ? "Disable" : "Enable"}
+                  </button>
+                </div>
+              ))}
+            </div>
+            {!published.length && <p>No community models published yet.</p>}
+          </div>
+        </section>
+      </div>
+      <section className="panel admin-section admin-users">
+        <div className="panel-heading">
+          <h2>
+            <Users size={18} />
+            Accounts
+          </h2>
+          <button
+            className="text-button"
+            onClick={() => setUserRevision((v) => v + 1)}
+          >
+            <RefreshCw size={14} />
+            Refresh accounts
+          </button>
+        </div>
+        <div className="admin-form">
+          <label className="search-field">
+            <input
+              aria-label="Search accounts by email"
+              placeholder="Search accounts by email…"
+              value={search}
+              onChange={(e) => {
+                setSearch(e.target.value);
+                setOffset(0);
+              }}
+            />
+          </label>
+        </div>
+        <div className="table-scroll">
+          <table>
+            <thead>
+              <tr>
+                <th>Account</th>
+                <th>Role</th>
+                <th>Status</th>
+                <th>Access</th>
+              </tr>
+            </thead>
+            <tbody>
+              {users.map((account) => (
+                <tr key={account.id}>
+                  <td>
+                    <strong>{account.name}</strong>
+                    <br />
+                    <small>{account.email}</small>
+                  </td>
+                  <td>{account.is_admin ? "Administrator" : "Member"}</td>
+                  <td>{account.disabled ? "Suspended" : "Active"}</td>
+                  <td>
+                    {account.is_admin || account.id === user.id ? (
+                      <span className="muted">Managed on server</span>
+                    ) : (
+                      <button
+                        className="text-button"
+                        disabled={busy}
+                        onClick={() => {
+                          setTarget(account);
+                          setConfirmError("");
+                        }}
+                      >
+                        {account.disabled
+                          ? "Restore access"
+                          : "Suspend account"}
+                      </button>
+                    )}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+        <div className="table-footer">
+          <span>{totalUsers} accounts</span>
+          <button
+            className="button"
+            disabled={offset === 0}
+            onClick={() => setOffset((v) => Math.max(0, v - 50))}
+          >
+            Previous
+          </button>
+          <button
+            className="button"
+            disabled={offset + 50 >= totalUsers}
+            onClick={() => setOffset((v) => v + 50)}
+          >
+            Next
+          </button>
+        </div>
+      </section>
+      {target && (
+        <Modal
+          title={
+            target.disabled ? "Restore account access?" : "Suspend account?"
+          }
+          onClose={() => {
+            if (!busy) setTarget(null);
+          }}
+        >
+          <div className="modal-body form">
+            <p>{target.email}</p>
+            <p>
+              {target.disabled
+                ? "This member will be able to sign in and use their existing API keys again."
+                : "This ends the member's sessions and blocks new requests from their API keys. Their data is retained."}
+            </p>
+            {confirmError && <Banner tone="error">{confirmError}</Banner>}
+            <button
+              className="button primary"
+              disabled={busy}
+              onClick={() => void changeAccount()}
+            >
+              {target.disabled ? "Restore account" : "Confirm suspension"}
+            </button>
+          </div>
+        </Modal>
+      )}
+    </>
+  );
+}

frontend/app/forms.tsx

@@ -9,13 +9,16 @@ import {
 } from "lucide-react";
 import { api, User, Provider, Model, providerInfo } from "@/lib/api";
 import { Banner, CheckRow, Modal } from "./ui";
+import { defaultSite, SiteOptions } from "@/lib/site";
 
 export function AuthForm({
   onClose,
   onSuccess,
+  site = defaultSite,
 }: {
   onClose: () => void;
   onSuccess: (user: User, key?: string) => void;
+  site?: SiteOptions;
 }) {
   const [register, setRegister] = useState(false),
     [busy, setBusy] = useState(false),
@@ -46,14 +49,10 @@ export function AuthForm({
     >
       <div className="auth-layout">
         <div className="auth-aside">
-          <div className="brand-mark large">N</div>
-          <h2>
-            Your models.
-            <br />
-            Your keys.
-            <br />
-            <span>One connection.</span>
-          </h2>
+          <div className="brand-mark large">
+            {site.site_name.slice(0, 1).toUpperCase()}
+          </div>
+          <h2>{site.welcome_text}</h2>
           <p>Bring your providers together in a workspace you control.</p>
           <div className="auth-checks">
             <CheckRow>Encrypted provider credentials</CheckRow>

frontend/app/globals.css

@@ -2,6 +2,23 @@
 @import "./tokens.css";
 @source not "../tests";
 
+.app-shell[data-accent="blue"] {
+  --accent: #89baff;
+  --accent-hover: #b6d4ff;
+  --accent-pressed: #77a9ef;
+  --accent-tint: rgb(137 186 255 / 12%);
+  --accent-border: rgb(137 186 255 / 28%);
+  --ring: 0 0 0 3px rgb(137 186 255 / 30%);
+}
+.app-shell[data-accent="green"] {
+  --accent: #76dbb0;
+  --accent-hover: #a0edcc;
+  --accent-pressed: #62c99d;
+  --accent-tint: rgb(118 219 176 / 12%);
+  --accent-border: rgb(118 219 176 / 28%);
+  --ring: 0 0 0 3px rgb(118 219 176 / 30%);
+}
+
 /* Foundations */
 * {
   box-sizing: border-box;
@@ -2742,3 +2759,453 @@ tbody tr:hover {
     scroll-behavior: auto !important;
   }
 }
+
+/* Full catalog, readable responses, and restricted administration. */
+.initial-loading {
+  max-width: 900px;
+  margin: 12vh auto;
+  padding: 24px;
+}
+.workspace-notice,
+.onboarding {
+  display: flex;
+  align-items: center;
+  gap: 16px;
+  padding: 18px 22px;
+  margin-bottom: 24px;
+  flex-wrap: wrap;
+}
+.workspace-notice {
+  background: var(--accent-tint);
+  border: 1px solid var(--accent-border);
+  border-radius: 12px;
+  color: var(--text-2);
+}
+.workspace-notice > span,
+.onboarding > div {
+  flex: 1;
+  min-width: 200px;
+}
+.onboarding h2 {
+  font-size: 17px;
+  margin: 0 0 4px;
+}
+.onboarding p {
+  margin: 0;
+  color: var(--text-2);
+}
+.health-explanation {
+  color: var(--text-2);
+  margin: 12px 0 20px;
+  font-size: 13px;
+}
+.model-picker {
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 7px;
+}
+.field-label {
+  font-weight: 500;
+  font-size: 13px;
+}
+.model-picker-trigger {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  text-align: left;
+  width: 100%;
+  padding: 12px;
+  border: 1px solid var(--control-border);
+  border-radius: 8px;
+  background: var(--bg);
+}
+.model-picker-trigger > span {
+  min-width: 0;
+}
+.model-picker-trigger strong,
+.model-picker-trigger small {
+  display: block;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.model-picker-trigger small,
+.selected-route {
+  color: var(--text-2);
+  font-size: 11px;
+  overflow-wrap: anywhere;
+}
+.model-picker-trigger:hover {
+  border-color: var(--accent);
+}
+.model-picker-body {
+  padding: 20px 24px;
+}
+.model-picker-body .search-field {
+  width: 100%;
+}
+.model-picker-toolbar {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 12px;
+  padding: 14px 0 6px;
+}
+.check-label {
+  display: flex !important;
+  flex-direction: row !important;
+  align-items: center;
+  gap: 9px !important;
+  font-size: 13px;
+}
+.check-label input {
+  width: 16px;
+  height: 16px;
+  min-height: 16px;
+  padding: 0;
+  accent-color: var(--accent);
+  flex: none;
+}
+.model-picker-results {
+  max-height: min(52dvh, 480px);
+  overflow-y: auto;
+  overscroll-behavior: contain;
+  border: 1px solid var(--border-strong);
+  border-radius: 10px;
+  margin-top: 14px;
+}
+.model-option {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  padding: 14px 16px;
+  text-align: left;
+  border-bottom: 1px solid var(--border);
+}
+.model-option:last-child {
+  border-bottom: 0;
+}
+.model-option > span:first-child {
+  min-width: 0;
+}
+.model-option strong,
+.model-option small {
+  display: block;
+  overflow-wrap: anywhere;
+}
+.model-option small {
+  color: var(--text-2);
+  font-size: 11px;
+  margin-top: 3px;
+}
+.model-option strong {
+  font-size: 14px;
+}
+.model-option:hover,
+.model-option.selected {
+  background: var(--accent-tint);
+}
+.model-option.selected {
+  box-shadow: inset 3px 0 var(--accent);
+}
+.model-option-price {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  text-align: right;
+  flex: none;
+}
+.model-option-price .badge {
+  white-space: nowrap;
+}
+.empty-catalog {
+  padding: 24px;
+  color: var(--text-2);
+}
+.response-format {
+  display: flex;
+  gap: 4px;
+  border: 1px solid var(--border);
+  padding: 3px;
+  border-radius: 7px;
+  margin-left: auto;
+}
+.response-format button {
+  padding: 3px 9px;
+  font-size: 12px;
+  color: var(--text-2);
+  border-radius: 4px;
+}
+.response-format button[aria-pressed="true"] {
+  color: var(--accent);
+  background: var(--accent-tint);
+}
+.markdown-output {
+  padding: 22px;
+  font-size: 14px;
+  line-height: 1.8;
+  overflow-wrap: anywhere;
+}
+.markdown-output > :first-child {
+  margin-top: 0;
+}
+.markdown-output > :last-child {
+  margin-bottom: 0;
+}
+.markdown-output h1,
+.markdown-output h2,
+.markdown-output h3 {
+  margin: 1.2em 0 0.5em;
+  font-weight: 650;
+  line-height: 1.4;
+}
+.markdown-output h1 {
+  font-size: 23px;
+}
+.markdown-output h2 {
+  font-size: 20px;
+}
+.markdown-output h3 {
+  font-size: 17px;
+}
+.markdown-output p {
+  margin: 0.75em 0;
+}
+.markdown-output ul,
+.markdown-output ol {
+  padding-left: 24px;
+  list-style: revert;
+  margin: 0.75em 0;
+}
+.markdown-output li {
+  margin: 0.3em 0;
+}
+.markdown-output a {
+  color: var(--accent);
+  text-decoration: underline;
+}
+.markdown-output blockquote {
+  margin: 16px 0;
+  padding: 2px 16px;
+  border-left: 3px solid var(--accent);
+  color: var(--text-2);
+}
+.markdown-output :not(pre) > code {
+  font-family: var(--font-mono);
+  background: var(--raised);
+  padding: 2px 5px;
+  border-radius: 4px;
+  font-size: 0.9em;
+}
+.markdown-output table {
+  display: block;
+  max-width: 100%;
+  overflow: auto;
+  border: 1px solid var(--border);
+}
+.markdown-output th,
+.markdown-output td {
+  padding: 10px 14px;
+}
+.code-block {
+  border: 1px solid var(--border-strong);
+  border-radius: 10px;
+  overflow: hidden;
+  margin: 16px 0;
+}
+.code-toolbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 7px 12px;
+  background: var(--raised);
+  color: var(--text-2);
+  font-size: 12px;
+}
+.code-block pre {
+  margin: 0;
+  padding: 16px;
+  white-space: pre;
+  overflow: auto;
+  background: var(--bg);
+  font: 12px/1.7 var(--font-mono);
+}
+.raw-output {
+  font-family: var(--font-mono) !important;
+}
+.hljs-keyword,
+.hljs-selector-tag,
+.hljs-literal {
+  color: #c4b5fd;
+}
+.hljs-string,
+.hljs-attr {
+  color: #8eddbc;
+}
+.hljs-title,
+.hljs-number {
+  color: #f0bc80;
+}
+.hljs-comment {
+  color: #a0a7bc;
+}
+.admin-access-note {
+  display: flex;
+  gap: 10px;
+  color: var(--text-2);
+  margin: -8px 0 24px;
+}
+.admin-stats {
+  display: grid;
+  grid-template-columns: repeat(4, minmax(0, 1fr));
+  gap: 16px;
+  margin: 24px 0;
+}
+.admin-stats .panel {
+  padding: 20px;
+  display: flex;
+  flex-direction: column;
+  gap: 7px;
+}
+.admin-stats strong {
+  font-size: 26px;
+}
+.admin-stats span,
+.admin-stats small {
+  color: var(--text-2);
+}
+.admin-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  align-items: start;
+  gap: 24px;
+}
+.admin-section {
+  min-width: 0;
+}
+.admin-section .panel-heading h2 {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+.admin-form {
+  padding: 22px;
+}
+.admin-form p {
+  margin: 0;
+  color: var(--text-2);
+}
+.admin-form label {
+  min-width: 0;
+}
+.admin-setup-actions {
+  display: flex;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+.admin-users {
+  margin-top: 24px;
+}
+.admin-users .table-footer {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 16px 22px;
+}
+.admin-users .table-footer > span {
+  margin-right: auto;
+  color: var(--text-2);
+}
+.published-models {
+  display: grid;
+  gap: 10px;
+}
+.published-model {
+  padding: 14px 0;
+  border-top: 1px solid var(--border);
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 10px;
+}
+.published-model > div {
+  flex: 1;
+  min-width: 140px;
+}
+.published-model small {
+  display: block;
+  overflow-wrap: anywhere;
+  font-size: 11px;
+  color: var(--text-2);
+}
+@media (min-width: 1024px) {
+  .icon-button.menu-toggle,
+  .icon-button.drawer-close {
+    display: none;
+  }
+}
+@media (max-width: 1100px) {
+  .admin-grid {
+    grid-template-columns: 1fr;
+  }
+}
+@media (max-width: 600px) {
+  .admin-stats {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+    gap: 10px;
+  }
+  .admin-stats .panel,
+  .admin-form {
+    padding: 16px;
+  }
+  .model-picker-body {
+    padding: 16px;
+  }
+  .model-option {
+    gap: 8px;
+    padding: 12px;
+  }
+  .model-option-price {
+    max-width: 110px;
+  }
+  .model-option-price .badge {
+    white-space: normal;
+    text-align: center;
+  }
+  .model-picker-results {
+    max-height: 45dvh;
+  }
+  .response-heading {
+    flex-wrap: wrap;
+    gap: 10px;
+  }
+  .markdown-output {
+    padding: 16px;
+  }
+  .admin-users .table-footer {
+    flex-wrap: wrap;
+  }
+}
+.response-actions {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+.model-picker-body .search-field {
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+  gap: 10px;
+}
+.model-picker-body .search-field input {
+  min-width: 0;
+  flex: 1;
+}
+.markdown-output {
+  padding: 0;
+}

frontend/app/markdown-output.tsx

@@ -0,0 +1,57 @@
+"use client";
+import { Children, isValidElement, ReactNode } from "react";
+import Markdown from "react-markdown";
+import remarkGfm from "remark-gfm";
+import rehypeHighlight from "rehype-highlight";
+import { CopyButton } from "./ui";
+
+function plainText(children: ReactNode): string {
+  return Children.toArray(children)
+    .map((child): string =>
+      typeof child === "string" || typeof child === "number"
+        ? String(child)
+        : isValidElement<{ children?: ReactNode }>(child)
+          ? plainText(child.props.children)
+          : "",
+    )
+    .join("");
+}
+
+export default function MarkdownOutput({
+  text,
+  notify,
+}: {
+  text: string;
+  notify: (message: string) => void;
+}) {
+  return (
+    <div className="markdown-output">
+      <Markdown
+        remarkPlugins={[remarkGfm]}
+        rehypePlugins={[rehypeHighlight]}
+        skipHtml
+        disallowedElements={["img"]}
+        components={{
+          a: ({ node, ...props }) => (
+            <a {...props} target="_blank" rel="noopener noreferrer" />
+          ),
+          pre: ({ children }) => (
+            <div className="code-block">
+              <div className="code-toolbar">
+                <span>Code</span>
+                <CopyButton
+                  value={plainText(children).replace(/\n$/, "")}
+                  label="Copy code"
+                  onCopy={notify}
+                />
+              </div>
+              <pre>{children}</pre>
+            </div>
+          ),
+        }}
+      >
+        {text}
+      </Markdown>
+    </div>
+  );
+}

frontend/app/model-picker.tsx

@@ -0,0 +1,191 @@
+"use client";
+import { useState } from "react";
+import { ChevronDown, Search, RefreshCw, Check } from "lucide-react";
+import { Model, money, num } from "@/lib/api";
+import { Banner, Badge, Modal } from "./ui";
+
+export default function ModelPicker({
+  models,
+  selected,
+  onSelect,
+  provider = "",
+  manual = false,
+  loading = false,
+  error = "",
+  onRefresh,
+  disabled = false,
+  label = "Model",
+  allowAuto = true,
+}: {
+  models: Model[];
+  selected: Model | null;
+  onSelect: (model: Model | null) => void;
+  provider?: string;
+  manual?: boolean;
+  loading?: boolean;
+  error?: string;
+  onRefresh?: () => void;
+  disabled?: boolean;
+  label?: string;
+  allowAuto?: boolean;
+}) {
+  const [open, setOpen] = useState(false);
+  const [search, setSearch] = useState("");
+  const [free, setFree] = useState(false);
+  const eligible = models.filter(
+    (m) => !provider || m.provider_id === provider,
+  );
+  const results = eligible.filter(
+    (m) =>
+      (!free || m.shared || (m.input_price === 0 && m.output_price === 0)) &&
+      `${m.name} ${m.model_id} ${m.provider_name}`
+        .toLowerCase()
+        .includes(search.trim().toLowerCase()),
+  );
+  function choose(model: Model | null) {
+    onSelect(model);
+    setOpen(false);
+  }
+  return (
+    <div className="model-picker">
+      <span className="field-label">{label}</span>
+      <button
+        type="button"
+        className="model-picker-trigger"
+        aria-label={`Select ${label.toLowerCase()}`}
+        aria-haspopup="dialog"
+        aria-expanded={open}
+        disabled={disabled}
+        onClick={() => setOpen(true)}
+      >
+        <span>
+          <strong>
+            {selected?.name ||
+              (manual || !allowAuto ? "Choose a model" : "Auto-select a model")}
+          </strong>
+          <small>
+            {selected
+              ? selected.model_id
+              : loading
+                ? "Loading the full catalog…"
+                : "Search the full catalog · find free models"}
+          </small>
+        </span>
+        <ChevronDown size={16} />
+      </button>
+      {selected && (
+        <small className="selected-route">
+          {selected.shared ? "Community · free to use" : selected.provider_name}{" "}
+          · {num(selected.context_window)} context
+        </small>
+      )}
+      {open && (
+        <Modal title="Choose a model" onClose={() => setOpen(false)} wide>
+          <div className="modal-body model-picker-body">
+            <label className="search-field">
+              <Search size={17} />
+              <input
+                autoFocus
+                aria-label="Search all models"
+                placeholder="Search by name, ID, or provider…"
+                value={search}
+                onChange={(e) => setSearch(e.target.value)}
+              />
+            </label>
+            <div className="model-picker-toolbar">
+              <label className="check-label">
+                <input
+                  type="checkbox"
+                  checked={free}
+                  onChange={(e) => setFree(e.target.checked)}
+                />
+                Free only
+              </label>
+              {onRefresh && (
+                <button
+                  type="button"
+                  className="text-button"
+                  disabled={loading}
+                  onClick={onRefresh}
+                >
+                  <RefreshCw size={14} />
+                  Refresh models
+                </button>
+              )}
+            </div>
+            <p className="form-note" aria-live="polite">
+              {loading
+                ? "Loading every page of the model catalog…"
+                : `${results.length} matching models · ${eligible.length} in this catalog`}
+            </p>
+            {error && <Banner tone="error">{error}</Banner>}
+            <div className="model-picker-results">
+              {allowAuto && !manual && !search && !free && (
+                <button className="model-option" onClick={() => choose(null)}>
+                  <span>
+                    <strong>Auto-select a model</strong>
+                    <small>Let the routing strategy choose</small>
+                  </span>
+                  {!selected && <Check size={17} />}
+                </button>
+              )}
+              {results.map((model) => {
+                const unavailable =
+                  !model.enabled ||
+                  !model.available ||
+                  model.capabilities.chat === false;
+                return (
+                  <button
+                    type="button"
+                    className={`model-option ${selected?.id === model.id ? "selected" : ""}`}
+                    key={model.id}
+                    aria-label={`Choose ${model.name} · ${model.provider_name}`}
+                    disabled={unavailable}
+                    onClick={() => choose(model)}
+                  >
+                    <span>
+                      <strong>{model.name}</strong>
+                      <small className="mono">{model.model_id}</small>
+                      <small>
+                        {model.provider_name} · {num(model.context_window)}{" "}
+                        context
+                      </small>
+                      {unavailable && (
+                        <small>
+                          {model.capabilities.chat === false
+                            ? "Available in the catalog; this model does not support chat"
+                            : "Currently unavailable"}
+                        </small>
+                      )}
+                    </span>
+                    <span className="model-option-price">
+                      {model.shared ? (
+                        <Badge tone="green">Community · Free</Badge>
+                      ) : model.input_price === 0 &&
+                        model.output_price === 0 ? (
+                        <Badge tone="green">Free</Badge>
+                      ) : (
+                        <small>
+                          {money(model.input_price)} /{" "}
+                          {money(model.output_price)}
+                          <br />
+                          per 1M tokens
+                        </small>
+                      )}
+                      {selected?.id === model.id && <Check size={17} />}
+                    </span>
+                  </button>
+                );
+              })}
+              {!results.length && !loading && (
+                <p className="empty-catalog">
+                  No matching models. Try another search or refresh the catalog.
+                </p>
+              )}
+            </div>
+          </div>
+        </Modal>
+      )}
+    </div>
+  );
+}

frontend/app/playground.tsx

@@ -1,5 +1,5 @@
 "use client";
-import { useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import {
   Terminal,
   Settings2,
@@ -11,7 +11,11 @@ import {
   LoaderCircle,
   RefreshCw,
 } from "lucide-react";
-import { ApiError, csrf, Model, Provider } from "@/lib/api";
+import { ApiError, csrf, loadAllModels, Model, Provider } from "@/lib/api";
+import { SiteOptions, defaultSite } from "@/lib/site";
+import { errorGuidance } from "@/lib/errors";
+import ModelPicker from "./model-picker";
+import MarkdownOutput from "./markdown-output";
 import { Badge, Banner, CopyButton, PageHeading, Toggle } from "./ui";
 const modes = [
   "auto",
@@ -29,6 +33,9 @@ export default function Playground({
   requireAccount,
   notify,
   onFinish,
+  initialModel = null,
+  defaults = defaultSite,
+  loadCatalog = loadAllModels,
 }: {
   demo: boolean;
   providers: Provider[];
@@ -36,6 +43,9 @@ export default function Playground({
   requireAccount: (fn: () => void) => void;
   notify: (s: string) => void;
   onFinish: () => Promise<void>;
+  initialModel?: Model | null;
+  defaults?: SiteOptions;
+  loadCatalog?: (signal?: AbortSignal) => Promise<Model[]>;
 }) {
   const [prompt, setPrompt] = useState(
       "Explain how an AI gateway routes a request in three clear steps.",
@@ -43,19 +53,76 @@ export default function Playground({
     [system, setSystem] = useState(
       "You are a helpful assistant. Be concise and accurate.",
     ),
-    [mode, setMode] = useState("auto"),
+    [mode, setMode] = useState(initialModel ? "manual" : defaults.default_mode),
     [provider, setProvider] = useState(""),
-    [model, setModel] = useState("auto"),
-    [stream, setStream] = useState(true),
+    [selectedModel, setSelectedModel] = useState<Model | null>(initialModel),
+    [stream, setStream] = useState(defaults.default_stream),
     [output, setOutput] = useState(""),
     [running, setRunning] = useState(false),
     [info, setInfo] = useState(""),
     [alternatives, setAlternatives] = useState(false),
-    [retries, setRetries] = useState(2);
+    [retries, setRetries] = useState(defaults.default_retries);
+  const model = selectedModel?.route_id || "auto";
+  const [catalog, setCatalog] = useState(models);
+  const [catalogLoading, setCatalogLoading] = useState(!demo);
+  const [catalogError, setCatalogError] = useState("");
+  const [rawView, setRawView] = useState(false);
+  const [elapsed, setElapsed] = useState(0);
+  const [firstToken, setFirstToken] = useState<number | null>(null);
+  const startedAt = useRef(0);
+  const seedModels = useRef(models);
+  seedModels.current = models;
+  const catalogController = useRef<AbortController | null>(null);
+  const reloadCatalog = useCallback(() => {
+    catalogController.current?.abort();
+    if (demo) {
+      setCatalog(seedModels.current);
+      setCatalogLoading(false);
+      return;
+    }
+    const pending = new AbortController();
+    catalogController.current = pending;
+    setCatalogLoading(true);
+    setCatalogError("");
+    void loadCatalog(pending.signal)
+      .then((all) => {
+        if (!pending.signal.aborted) setCatalog(all);
+      })
+      .catch((error: Error) => {
+        if (!pending.signal.aborted) setCatalogError(error.message);
+      })
+      .finally(() => {
+        if (!pending.signal.aborted) setCatalogLoading(false);
+      });
+  }, [demo, loadCatalog]);
+  useEffect(() => {
+    reloadCatalog();
+    return () => catalogController.current?.abort();
+  }, [reloadCatalog]);
+  const missingManualModel = mode === "manual" && !selectedModel;
+  const currentSelection = catalog.find((m) => m.id === selectedModel?.id);
+  const unavailableSelection =
+    !!selectedModel &&
+    !catalogLoading &&
+    (!currentSelection ||
+      !currentSelection.enabled ||
+      !currentSelection.available ||
+      currentSelection.capabilities.chat === false);
+  const canSend =
+    !!prompt.trim() && !missingManualModel && !unavailableSelection;
+  useEffect(() => {
+    if (!running) return;
+    const timer = setInterval(
+      () => setElapsed((performance.now() - startedAt.current) / 1000),
+      250,
+    );
+    return () => clearInterval(timer);
+  }, [running]);
   const [settingsOpen, setSettingsOpen] = useState(false);
   const [requestError, setRequestError] = useState<{
     message: string;
     status?: number;
+    code?: string;
   } | null>(null);
   const controller = useRef<AbortController | null>(null);
   useEffect(() => {
@@ -67,12 +134,16 @@ export default function Playground({
   }, []);
   useEffect(() => () => controller.current?.abort(), []);
   async function run() {
+    if (!canSend || running) return;
     setRunning(true);
     setOutput("");
     setRequestError(null);
     setInfo("Connecting to your gateway…");
     controller.current = new AbortController();
     const started = performance.now();
+    startedAt.current = started;
+    setElapsed(0);
+    setFirstToken(null);
     try {
       const body = {
         model:
@@ -103,6 +174,7 @@ export default function Playground({
         throw new ApiError(
           e?.error?.message || "The gateway could not complete this request.",
           response.status,
+          e?.error?.code,
         );
       }
       setInfo(
@@ -133,7 +205,12 @@ export default function Playground({
             const data = JSON.parse(raw);
             if (data.error) throw new Error(data.error.message);
             const delta = data.choices?.[0]?.delta;
-            if (delta?.content) setOutput((prev) => prev + delta.content);
+            if (delta?.content) {
+              setFirstToken(
+                (prev) => prev ?? (performance.now() - started) / 1000,
+              );
+              setOutput((prev) => prev + delta.content);
+            }
             if (delta?.tool_calls)
               setOutput(
                 (prev) =>
@@ -159,10 +236,12 @@ export default function Playground({
         setRequestError({
           message: (err as Error).message,
           status: err instanceof ApiError ? err.status : undefined,
+          code: err instanceof ApiError ? err.code : undefined,
         });
       }
     } finally {
       setRunning(false);
+      setElapsed((performance.now() - started) / 1000);
       void onFinish();
     }
   }
@@ -209,7 +288,11 @@ export default function Playground({
           >
             <label>
               Routing strategy
-              <select value={mode} onChange={(e) => setMode(e.target.value)}>
+              <select
+                disabled={running}
+                value={mode}
+                onChange={(e) => setMode(e.target.value)}
+              >
                 {modes
                   .filter((x) => !["image", "embedding"].includes(x))
                   .map((x) => (
@@ -222,10 +305,11 @@ export default function Playground({
             <label>
               Provider
               <select
+                disabled={running}
                 value={provider}
                 onChange={(e) => {
                   setProvider(e.target.value);
-                  setModel("auto");
+                  setSelectedModel(null);
                 }}
               >
                 <option value="">All enabled providers</option>
@@ -238,29 +322,30 @@ export default function Playground({
                   ))}
               </select>
             </label>
-            <label>
-              Model
-              <select value={model} onChange={(e) => setModel(e.target.value)}>
-                <option value="auto">Auto-select a model</option>
-                {models
-                  .filter(
-                    (m) =>
-                      (!provider || m.provider_id === provider) &&
-                      m.capabilities.chat !== false,
-                  )
-                  .map((m) => (
-                    <option
-                      key={m.id}
-                      value={provider ? m.model_id : m.route_id}
-                    >
-                      {m.name} · {m.provider_name}
-                    </option>
-                  ))}
-              </select>
-            </label>
+            <ModelPicker
+              models={catalog}
+              selected={selectedModel}
+              onSelect={setSelectedModel}
+              provider={provider}
+              manual={mode === "manual"}
+              loading={catalogLoading}
+              error={catalogError}
+              onRefresh={reloadCatalog}
+              disabled={running}
+            />
+            {missingManualModel && (
+              <p className="field-error">Choose a model for manual routing.</p>
+            )}
+            {unavailableSelection && (
+              <p className="field-error">
+                The selected model is no longer available. Choose another model
+                or refresh the catalog.
+              </p>
+            )}
             <label>
               Retry budget
               <select
+                disabled={running}
                 value={retries}
                 onChange={(e) => setRetries(Number(e.target.value))}
               >
@@ -274,16 +359,20 @@ export default function Playground({
             <Toggle
               label="Stream response"
               checked={stream}
-              onChange={setStream}
+              onChange={(value) => {
+                if (!running) setStream(value);
+              }}
             />
             <Toggle
               label="Allow alternative models"
               checked={alternatives}
-              onChange={setAlternatives}
+              onChange={(value) => {
+                if (!running) setAlternatives(value);
+              }}
             />
             <p className="form-note">
-              Your server’s retry limit is the upper bound. Provider selection
-              stays pinned. Alternatives require confirmed capabilities.
+              Retry failed attempts up to this limit. Enable alternatives to
+              allow a compatible model when your first choice fails.
             </p>
           </div>
         </section>
@@ -300,6 +389,7 @@ export default function Playground({
               <label>
                 <span className="sr-only">System instruction</span>
                 <textarea
+                  disabled={running}
                   rows={2}
                   value={system}
                   onChange={(e) => setSystem(e.target.value)}
@@ -309,6 +399,7 @@ export default function Playground({
             <label>
               Your message
               <textarea
+                disabled={running}
                 rows={5}
                 value={prompt}
                 onChange={(e) => setPrompt(e.target.value)}
@@ -316,7 +407,7 @@ export default function Playground({
                   if (
                     (e.ctrlKey || e.metaKey) &&
                     e.key === "Enter" &&
-                    prompt.trim() &&
+                    canSend &&
                     !running
                   ) {
                     e.preventDefault();
@@ -345,7 +436,7 @@ export default function Playground({
               ) : (
                 <button
                   className="button primary"
-                  disabled={!prompt.trim()}
+                  disabled={!canSend}
                   onClick={() => requireAccount(() => void run())}
                 >
                   <ArrowUp size={17} />
@@ -359,18 +450,42 @@ export default function Playground({
               <Sparkles size={16} />
               <h3>Response</h3>
             </div>
-            {output && <CopyButton value={output} onCopy={notify} />}
+            {output && (
+              <div className="response-actions">
+                <div className="response-format" aria-label="Response format">
+                  <button
+                    aria-pressed={!rawView}
+                    className={!rawView ? "active" : ""}
+                    onClick={() => setRawView(false)}
+                  >
+                    Formatted
+                  </button>
+                  <button
+                    aria-pressed={rawView}
+                    className={rawView ? "active" : ""}
+                    onClick={() => setRawView(true)}
+                  >
+                    Raw
+                  </button>
+                </div>
+                <CopyButton value={output} onCopy={notify} />
+              </div>
+            )}
           </div>
           <div
             className={`response-output ${!output ? "no-output" : ""}`}
             aria-busy={running}
           >
             {output ? (
-              <pre className={running ? "streaming" : ""}>{output}</pre>
+              rawView ? (
+                <pre className="raw-output">{output}</pre>
+              ) : (
+                <MarkdownOutput text={output} notify={notify} />
+              )
             ) : running ? (
               <span>
                 <LoaderCircle size={18} className="spin" />
-                Waiting for the provider…
+                Waiting for the first token… {elapsed.toFixed(1)} s
               </span>
             ) : (
               <span>
@@ -397,14 +512,21 @@ export default function Playground({
                     : "Request error"}
                 </strong>
                 <span>{requestError.message}</span>
-                <button
-                  className="text-button"
-                  disabled={running}
-                  onClick={() => requireAccount(() => void run())}
-                >
-                  <RefreshCw size={14} />
-                  Retry request
-                </button>
+                <span>
+                  {errorGuidance(requestError.status, requestError.code)}
+                </span>
+                {(!requestError.status ||
+                  requestError.status >= 500 ||
+                  requestError.status === 429) && (
+                  <button
+                    className="text-button"
+                    disabled={running}
+                    onClick={() => requireAccount(() => void run())}
+                  >
+                    <RefreshCw size={14} />
+                    Retry request
+                  </button>
+                )}
                 <button
                   className="text-button"
                   onClick={() => setSettingsOpen(true)}
@@ -418,6 +540,16 @@ export default function Playground({
             <div className="response-info mono" role="status">
               {running && <LoaderCircle className="spin" size={14} />}
               {info}
+              {running && (
+                <span>
+                  {" "}
+                  · {output ? "Receiving response" : "Waiting"} ·{" "}
+                  {elapsed.toFixed(1)} s
+                </span>
+              )}
+              {firstToken !== null && (
+                <span> · First token {firstToken.toFixed(1)} s</span>
+              )}
             </div>
           )}
         </section>

frontend/app/request-table.tsx

@@ -1,6 +1,6 @@
 "use client";
 import { Check, TriangleAlert, ChevronRight } from "lucide-react";
-import { Log, num, stamp } from "@/lib/api";
+import { Log, num, stamp, duration } from "@/lib/api";
 import { Badge, Empty, Price } from "./ui";
 export default function RequestTable({
   logs,
@@ -63,7 +63,7 @@ export default function RequestTable({
                 </Badge>
               </td>
               <td className="mono" data-label="Latency" role="cell">
-                {Math.round(log.latency_ms)} <span className="muted">ms</span>
+                {duration(log.latency_ms)}
               </td>
               {!compact && (
                 <>

frontend/app/ui.tsx

@@ -220,9 +220,11 @@ export function CheckRow({ children }: { children: ReactNode }) {
 export function Topology({
   providers,
   demo,
+  siteName = "Nexus",
 }: {
   providers: Provider[];
   demo: boolean;
+  siteName?: string;
 }) {
   const active = providers.filter((p) => p.enabled).slice(0, 3);
   return (
@@ -237,9 +239,11 @@ export function Topology({
       </div>
       <div className="route-line" />
       <div className="gateway-node">
-        <span className="brand-mark mini">N</span>
+        <span className="brand-mark mini">
+          {siteName.slice(0, 1).toUpperCase()}
+        </span>
         <div>
-          <strong>Nexus gateway</strong>
+          <strong>{siteName} gateway</strong>
           <small>One endpoint · your keys</small>
         </div>
         <span className="node-tag">/v1</span>
@@ -267,7 +271,7 @@ export function Topology({
         <span className="dot" />
         {demo
           ? "Example routing topology"
-          : `${providers.filter((p) => p.enabled).length} enabled connections`}
+          : `${providers.filter((p) => p.enabled).length} enabled ${providers.filter((p) => p.enabled).length === 1 ? "connection" : "connections"}`}
       </div>
     </div>
   );

frontend/app/workspace.tsx

@@ -48,7 +48,10 @@ import {
   num,
   money,
   stamp,
+  duration,
 } from "@/lib/api";
+import { defaultSite, SiteOptions } from "@/lib/site";
+import { errorGuidance } from "@/lib/errors";
 import {
   demoProviders,
   demoModels,
@@ -58,6 +61,7 @@ import {
 } from "@/lib/demo";
 import { AuthForm, ProviderForm, ModelForm } from "./forms";
 import Playground from "./playground";
+import AdminPanel from "./admin-panel";
 import Documentation from "./documentation";
 import RequestTable from "./request-table";
 import {
@@ -85,7 +89,8 @@ type View =
   | "keys"
   | "requests"
   | "usage"
-  | "docs";
+  | "docs"
+  | "admin";
 const nav: { id: View; name: string; icon: typeof Activity }[] = [
   { id: "overview", name: "Overview", icon: LayoutDashboard },
   { id: "providers", name: "Providers", icon: Waypoints },
@@ -95,6 +100,7 @@ const nav: { id: View; name: string; icon: typeof Activity }[] = [
   { id: "requests", name: "Request logs", icon: Activity },
   { id: "usage", name: "Usage & analytics", icon: ChartNoAxesCombined },
   { id: "docs", name: "Documentation", icon: BookOpen },
+  { id: "admin", name: "Administration", icon: ShieldCheck },
 ];
 const blankUsage: Usage = {
   days: 7,
@@ -112,6 +118,14 @@ const blankUsage: Usage = {
 };
 
 export default function Dashboard() {
+  const [site, setSite] = useState<SiteOptions>(defaultSite);
+  const [revision, setRevision] = useState(0);
+  const [playgroundModel, setPlaygroundModel] = useState<Model | null>(null);
+  const [explorerModels, setExplorerModels] = useState<Model[]>([]);
+  const [explorerTotal, setExplorerTotal] = useState(0);
+  const [requestLogs, setRequestLogs] = useState<Log[]>([]);
+  const [requestTotal, setRequestTotal] = useState(0);
+  const [freeOnly, setFreeOnly] = useState(false);
   const [view, setView] = useState<View>("overview"),
     [user, setUser] = useState<User | null>(null),
     [demo, setDemo] = useState(true),
@@ -176,22 +190,30 @@ export default function Dashboard() {
     };
     syncHash();
     window.addEventListener("hashchange", syncHash);
-    api<User>("/auth/me")
-      .then((u) => {
+    Promise.all([
+      api<User>("/auth/me").catch(() => null),
+      api<SiteOptions>("/site").catch(() => defaultSite),
+    ])
+      .then(([u, options]) => {
         setUser(u);
-        setDemo(false);
-      })
-      .catch(() => {
-        setDemo(true);
+        setDemo(!u);
+        setSite(options);
       })
       .finally(() => setReady(true));
     return () => window.removeEventListener("hashchange", syncHash);
   }, []);
   useEffect(() => {
-    document.title = `${nav.find((n) => n.id === view)?.name || "Overview"} · Nexus AI Gateway`;
+    document.title = `${nav.find((n) => n.id === view)?.name || "Overview"} · ${site.site_name} AI Gateway`;
+  }, [view, site.site_name]);
+  useEffect(() => {
+    window.scrollTo(0, 0);
   }, [view]);
   useEffect(() => {
     if (!mobile) return;
+    if (window.matchMedia("(min-width: 1024px)").matches) {
+      setMobile(false);
+      return;
+    }
     const drawer = sidebarRef.current;
     const previous = document.activeElement as HTMLElement | null;
     const overflow = document.body.style.overflow;
@@ -257,6 +279,7 @@ export default function Dashboard() {
       setTotalLogs(l.total);
       setUsage(u);
       setConnectionError("");
+      setRevision((value) => value + 1);
     } catch (err) {
       if (err instanceof ApiError && err.status === 401) {
         setUser(null);
@@ -276,12 +299,12 @@ export default function Dashboard() {
     let active = true;
     const timer = setTimeout(() => {
       api<Page<Model>>(
-        `/models?limit=100&offset=${modelPage * 100}&search=${encodeURIComponent(search)}&capability=${capability}&provider=${filterProvider}`,
+        `/models?limit=100&offset=${modelPage * 100}&search=${encodeURIComponent(search)}&capability=${capability}&provider=${filterProvider}&free_only=${freeOnly}`,
       )
         .then((r) => {
           if (active) {
-            setModels(r.data);
-            setTotalModels(r.total);
+            setExplorerModels(r.data);
+            setExplorerTotal(r.total);
           }
         })
         .catch((e) => notify(e.message, "error"));
@@ -290,38 +313,56 @@ export default function Dashboard() {
       active = false;
       clearTimeout(timer);
     };
-  }, [view, demo, search, capability, filterProvider, modelPage, notify]);
+  }, [
+    view,
+    demo,
+    search,
+    capability,
+    filterProvider,
+    freeOnly,
+    modelPage,
+    notify,
+    revision,
+  ]);
   useEffect(() => {
     if (demo || view !== "requests") return;
     let active = true;
     api<Page<Log>>(`/logs?offset=${logPage * 25}&errors_only=${errorsOnly}`)
       .then((r) => {
         if (active) {
-          setLogs(r.data);
-          setTotalLogs(r.total);
+          setRequestLogs(r.data);
+          setRequestTotal(r.total);
         }
       })
       .catch((e) => notify(e.message, "error"));
     return () => {
       active = false;
     };
-  }, [view, demo, logPage, errorsOnly, notify]);
+  }, [view, demo, logPage, errorsOnly, notify, revision]);
   const p = demo ? demoProviders : providers,
     m = demo ? demoModels : models,
     k = demo ? demoKeys : keys,
     l = demo ? demoLogs : logs,
     u = demo ? demoUsage : usage;
   const displayedModels = demo
-    ? m.filter(
-        (x) =>
-          (!search ||
-            [x.name, x.model_id].some((v) =>
-              v.toLowerCase().includes(search.toLowerCase()),
-            )) &&
-          (!capability || x.capabilities[capability]) &&
-          (!filterProvider || x.provider_id === filterProvider),
-      )
-    : m;
+    ? m
+        .filter(
+          (x) =>
+            (!search ||
+              [x.name, x.model_id].some((v) =>
+                v.toLowerCase().includes(search.toLowerCase()),
+              )) &&
+            (!capability || x.capabilities[capability]) &&
+            (!filterProvider || x.provider_id === filterProvider),
+          // Sample filtering follows the same free-price rule as the live catalog.
+        )
+        .filter(
+          (x) =>
+            !freeOnly ||
+            x.shared ||
+            (x.input_price === 0 && x.output_price === 0),
+        )
+    : explorerModels;
   const s = u.summary,
     successRate = s.requests
       ? (((s.successes || 0) / s.requests) * 100).toFixed(1)
@@ -381,8 +422,7 @@ export default function Dashboard() {
       />
       <Metric
         label="Average latency"
-        value={s.avg_latency_ms ? Math.round(s.avg_latency_ms).toString() : "—"}
-        suffix="ms"
+        value={duration(s.avg_latency_ms)}
         icon={Zap}
         detail="End-to-end request duration"
         loading={!ready || busy}
@@ -404,8 +444,15 @@ export default function Dashboard() {
       />
     </div>
   );
+  if (!ready)
+    return (
+      <main className="initial-loading" aria-busy="true">
+        <h1>Loading your workspace…</h1>
+        <Skeleton className="skeleton-chart" />
+      </main>
+    );
   return (
-    <div className="app-shell">
+    <div className="app-shell" data-accent={site.accent}>
       <a href="#main-content" className="skip-link">
         Skip to content
       </a>
@@ -436,9 +483,12 @@ export default function Dashboard() {
           className="brand"
           onClick={() => navigate("overview")}
         >
-          <span className="brand-mark">N</span>
+          <span className="brand-mark">
+            {site.site_name.slice(0, 1).toUpperCase()}
+          </span>
           <span>
-            nexus<span className="brand-period">.</span>
+            {site.site_name.toLowerCase()}
+            <span className="brand-period">.</span>
           </span>
           <Badge>GATEWAY</Badge>
         </a>
@@ -472,6 +522,17 @@ export default function Dashboard() {
             </a>
           ))}
         </nav>
+        {user?.is_admin && (
+          <a
+            href="#admin"
+            onClick={() => setMobile(false)}
+            className={`nav-link ${view === "admin" ? "selected" : ""}`}
+            aria-current={view === "admin" ? "page" : undefined}
+          >
+            <ShieldCheck size={18} />
+            Administration
+          </a>
+        )}
         <div className="sidebar-bottom">
           <a
             className={`nav-link ${view === "docs" ? "selected" : ""}`}
@@ -503,6 +564,7 @@ export default function Dashboard() {
                         setUser(null);
                         setDemo(true);
                         setSecret("");
+                        setPlaygroundModel(null);
                         notify("Signed out");
                       })
                       .catch((e) => notify(e.message, "error"));
@@ -522,7 +584,10 @@ export default function Dashboard() {
               className="icon-button menu-toggle"
               aria-controls="workspace-navigation"
               aria-expanded={mobile}
-              onClick={() => setMobile(true)}
+              onClick={() => {
+                if (!window.matchMedia("(min-width: 1024px)").matches)
+                  setMobile(true);
+              }}
               aria-label="Open navigation"
             >
               <Menu size={22} />
@@ -610,10 +675,47 @@ export default function Dashboard() {
                   </button>
                 </div>
               </div>
+              {demo && (
+                <div className="workspace-notice">
+                  <span>
+                    You're exploring sample data. Sign in to connect providers
+                    or try community models.
+                  </span>
+                  <button
+                    className="text-button"
+                    onClick={() => setAuthOpen(true)}
+                  >
+                    Open your workspace <ArrowRight size={15} />
+                  </button>
+                </div>
+              )}
+              {!demo && !busy && !s.requests && (
+                <div className="onboarding panel">
+                  <div>
+                    <h2>Make your first request</h2>
+                    <p>
+                      Choose a community model in the Playground, or connect
+                      your own provider.
+                    </p>
+                  </div>
+                  <button
+                    className="button primary"
+                    onClick={() => navigate("playground")}
+                  >
+                    Open Playground <ArrowRight size={15} />
+                  </button>
+                  <button className="button" onClick={() => navigate("keys")}>
+                    View your API keys
+                  </button>
+                </div>
+              )}
               <div className="operational-strip">
                 <span>
                   <span className="dot" />
-                  {p.filter((x) => x.enabled).length} enabled connections
+                  {p.filter((x) => x.enabled).length} enabled{" "}
+                  {p.filter((x) => x.enabled).length === 1
+                    ? "connection"
+                    : "connections"}
                 </span>
                 <span>
                   <ShieldCheck size={14} />
@@ -670,7 +772,11 @@ export default function Dashboard() {
                     </div>
                     <Network size={18} className="muted" />
                   </div>
-                  <Topology providers={p} demo={demo} />
+                  <Topology
+                    providers={p}
+                    demo={demo}
+                    siteName={site.site_name}
+                  />
                 </section>
               </div>
               <section className="panel providers-overview">
@@ -854,6 +960,10 @@ export default function Dashboard() {
                     {provider.discovery_error && (
                       <Banner tone="error">{provider.discovery_error}</Banner>
                     )}
+                    <p className="form-note provider-health-note">
+                      Connection health reflects recent routing state;
+                      individual models may have different access or limits.
+                    </p>
                     <div className="provider-card-refreshed">
                       Catalog refreshed {stamp(provider.discovered_at)}
                     </div>
@@ -983,7 +1093,7 @@ export default function Dashboard() {
                   <Search size={17} />
                   <input
                     aria-label="Search models"
-                    placeholder="Search models by name or ID…"
+                    placeholder="Search models…"
                     value={search}
                     onChange={(e) => {
                       setSearch(e.target.value);
@@ -1004,6 +1114,17 @@ export default function Dashboard() {
                   )}
                 </button>
                 <div className="filter-controls" id="model-filter-controls">
+                  <label className="check-label">
+                    <input
+                      type="checkbox"
+                      checked={freeOnly}
+                      onChange={(e) => {
+                        setFreeOnly(e.target.checked);
+                        setModelPage(0);
+                      }}
+                    />
+                    Free only
+                  </label>
                   <select
                     aria-label="Filter capability"
                     value={capability}
@@ -1048,7 +1169,7 @@ export default function Dashboard() {
               </div>
               <div className="table-note">
                 <span>
-                  {demo ? displayedModels.length : totalModels} models{" "}
+                  {demo ? displayedModels.length : explorerTotal} models{" "}
                   <span className="mid-dot">·</span> Prices in USD per million
                   tokens
                 </span>
@@ -1081,6 +1202,9 @@ export default function Dashboard() {
                                   {model.model_id}
                                 </small>
                                 <span>{model.provider_name}</span>
+                                {model.shared && (
+                                  <Badge tone="green">Community · Free</Badge>
+                                )}
                               </div>
                             </div>
                           </td>
@@ -1120,10 +1244,27 @@ export default function Dashboard() {
                             role="cell"
                           >
                             <div className="row-actions">
+                              <button
+                                className="icon-button"
+                                aria-label={`Try ${model.name} in Playground`}
+                                title="Try in Playground"
+                                disabled={
+                                  !model.enabled ||
+                                  !model.available ||
+                                  model.capabilities.chat === false
+                                }
+                                onClick={() => {
+                                  setPlaygroundModel(model);
+                                  navigate("playground");
+                                }}
+                              >
+                                <Terminal size={16} />
+                              </button>
                               <button
                                 className={`icon-button ${model.favorite ? "accent" : ""}`}
                                 aria-label={`Favorite ${model.name}`}
                                 aria-pressed={model.favorite}
+                                disabled={model.owned === false}
                                 onClick={() =>
                                   requireAccount(
                                     () =>
@@ -1144,6 +1285,7 @@ export default function Dashboard() {
                               <button
                                 className="icon-button"
                                 aria-label={`Configure ${model.name}`}
+                                disabled={model.owned === false}
                                 onClick={() =>
                                   requireAccount(() => setModelModal(model))
                                 }
@@ -1181,7 +1323,7 @@ export default function Dashboard() {
                   <Pagination
                     page={modelPage}
                     size={100}
-                    total={demo ? displayedModels.length : totalModels}
+                    total={demo ? displayedModels.length : explorerTotal}
                     setPage={setModelPage}
                   />
                 </div>
@@ -1190,12 +1332,15 @@ export default function Dashboard() {
           )}
           {view === "playground" && (
             <Playground
+              key={user?.id || "demo"}
               demo={demo}
               providers={p}
               models={m}
               requireAccount={requireAccount}
               notify={notify}
               onFinish={load}
+              initialModel={playgroundModel}
+              defaults={site}
             />
           )}
           {view === "keys" && (
@@ -1218,7 +1363,12 @@ export default function Dashboard() {
                 <span>
                   Keys are shown only once. Save each new key before closing.
                 </span>
-                <Badge>{k.filter((key) => !key.revoked).length} keys</Badge>
+                <Badge>
+                  {k.filter((key) => !key.revoked).length}{" "}
+                  {k.filter((key) => !key.revoked).length === 1
+                    ? "key"
+                    : "keys"}
+                </Badge>
               </div>
               <section className="panel table-panel">
                 <div className="table-scroll">
@@ -1360,16 +1510,20 @@ export default function Dashboard() {
               <section className="panel">
                 <RequestTable
                   logs={
-                    errorsOnly && demo ? l.filter((x) => x.status >= 400) : l
+                    demo
+                      ? errorsOnly
+                        ? l.filter((x) => x.status >= 400)
+                        : l
+                      : requestLogs
                   }
                   onSelect={setSelectedLog}
                 />
                 <div className="table-footer">
-                  <span>{demo ? l.length : totalLogs} requests</span>
+                  <span>{demo ? l.length : requestTotal} requests</span>
                   <Pagination
                     page={logPage}
                     size={25}
-                    total={demo ? l.length : totalLogs}
+                    total={demo ? l.length : requestTotal}
                     setPage={setLogPage}
                   />
                 </div>
@@ -1462,10 +1616,41 @@ export default function Dashboard() {
           {view === "docs" && (
             <Documentation endpoint={endpoint} notify={notify} />
           )}
+          {view === "admin" &&
+            (user?.is_admin ? (
+              <AdminPanel
+                user={user}
+                onSettings={setSite}
+                notify={notify}
+                onConnect={() => setProviderModal("new")}
+                onRegisterModel={() => setModelModal("new")}
+                revision={revision}
+              />
+            ) : (
+              <>
+                <PageHeading
+                  title="Administration"
+                  subtitle="Restricted to administrator accounts."
+                />
+                <Empty
+                  title="Administrator access required"
+                  headingLevel={2}
+                  text={
+                    demo
+                      ? "Sign in with your administrator account to manage the site."
+                      : "Your account does not have an administrator role. Roles are granted on the gateway server."
+                  }
+                  action={demo ? "Sign in" : undefined}
+                  onAction={() => setAuthOpen(true)}
+                />
+              </>
+            ))}
           <footer className="page-footer">
             <span>
-              <span className="brand-mark tiny">N</span>Nexus · Universal AI
-              Gateway
+              <span className="brand-mark tiny">
+                {site.site_name.slice(0, 1).toUpperCase()}
+              </span>
+              {site.site_name} · {site.tagline}
             </span>
             <span>
               {demo
@@ -1499,9 +1684,11 @@ export default function Dashboard() {
       )}
       {authOpen && (
         <AuthForm
+          site={site}
           onClose={() => setAuthOpen(false)}
           onSuccess={(newUser, key) => {
             setUser(newUser);
+            setPlaygroundModel(null);
             setDemo(false);
             setAuthOpen(false);
             if (key) setSecret(key);
@@ -1616,7 +1803,7 @@ export default function Dashboard() {
           <div className="modal-body form">
             <div className="detail-summary">
               <Badge tone={selectedLog.status < 400 ? "green" : "amber"}>
-                HTTP {selectedLog.status}
+                Gateway HTTP {selectedLog.status}
               </Badge>
               <code>{selectedLog.id}</code>
               <CopyButton value={selectedLog.id} onCopy={notify} />
@@ -1632,7 +1819,7 @@ export default function Dashboard() {
               </div>
               <div>
                 <dt>Latency</dt>
-                <dd>{Math.round(selectedLog.latency_ms)} ms</dd>
+                <dd>{duration(selectedLog.latency_ms)}</dd>
               </div>
               <div>
                 <dt>Tokens · input / output</dt>
@@ -1661,9 +1848,9 @@ export default function Dashboard() {
                     <small>{a.model}</small>
                   </div>
                   <Badge tone={a.status < 400 ? "green" : "amber"}>
-                    {a.status}
+                    Provider HTTP {a.status}
                   </Badge>
-                  <span className="mono">{Math.round(a.latency_ms)} ms</span>
+                  <span className="mono">{duration(a.latency_ms)}</span>
                 </div>
               ))}
               {!selectedLog.attempts.length && (
@@ -1671,7 +1858,18 @@ export default function Dashboard() {
               )}
             </div>
             {selectedLog.error_code && (
-              <Banner tone="error">{selectedLog.error_code}</Banner>
+              <Banner tone="error">
+                <span>
+                  {errorGuidance(
+                    selectedLog.attempts.at(-1)?.status || selectedLog.status,
+                    selectedLog.error_code,
+                  )}
+                </span>
+                <details>
+                  <summary>Technical details</summary>
+                  <code>{selectedLog.error_code}</code>
+                </details>
+              </Banner>
             )}
           </div>
         </Modal>

frontend/lib/api.ts

@@ -1,4 +1,9 @@
-export type User = { id: string; name: string; email: string };
+export type User = {
+  id: string;
+  name: string;
+  email: string;
+  is_admin?: boolean;
+};
 export type Health = {
   status?: string;
   latency_ms?: number;
@@ -19,6 +24,8 @@ export type Provider = {
   health: Health;
 };
 export type Model = {
+  shared?: boolean;
+  owned?: boolean;
   id: string;
   model_id: string;
   name: string;
@@ -141,6 +148,7 @@ export class ApiError extends Error {
   constructor(
     message: string,
     public status: number,
+    public code?: string,
   ) {
     super(message);
   }
@@ -161,6 +169,7 @@ export async function api<T>(path: string, init: RequestInit = {}): Promise<T> {
     throw new ApiError(
       error?.error?.message || `Request failed (${response.status})`,
       response.status,
+      error?.error?.code,
     );
   }
   return response.status === 204
@@ -176,7 +185,42 @@ export function num(value: number | null | undefined): string {
       }).format(value);
 }
 export function money(value: number | null | undefined): string {
-  return value == null ? "Unknown" : `$${value.toFixed(value < 0.01 ? 5 : 2)}`;
+  return value == null
+    ? "Unknown"
+    : `$${value.toFixed(value > 0 && value < 0.01 ? 5 : 2)}`;
+}
+export function duration(value: number | null | undefined): string {
+  if (value == null) return "—";
+  return value >= 1000
+    ? `${(value / 1000).toFixed(value >= 10000 ? 1 : 2)} s`
+    : `${Math.round(value)} ms`;
+}
+
+export async function loadAllModels(
+  signal?: AbortSignal,
+  ownedOnly = false,
+): Promise<Model[]> {
+  const models = new Map<string, Model>();
+  let offset = 0;
+  while (true) {
+    const page = await api<Page<Model>>(
+      `/models?limit=1000&offset=${offset}${ownedOnly ? "&owned_only=true" : ""}`,
+      { signal },
+    );
+    page.data.forEach((model) => models.set(model.id, model));
+    offset += page.data.length;
+    if (offset >= page.total) {
+      if (models.size < page.total)
+        throw new Error(
+          "The catalog changed while loading. Refresh models to try again.",
+        );
+      return [...models.values()];
+    }
+    if (!page.data.length)
+      throw new Error(
+        "The complete catalog could not be loaded. Refresh models to try again.",
+      );
+  }
 }
 export function stamp(value: number | null | undefined): string {
   return value

frontend/lib/demo.ts

@@ -116,9 +116,10 @@ export const demoUsage: Usage = {
 };
 export const demoLogs: Log[] = Array.from({ length: 8 }, (_, i) => ({
   id: `req_demo_${i + 1}`,
-  provider_name: demoProviders[i % 4].name,
+  provider_name: i === 2 ? "OpenRouter" : demoModels[i % 6].provider_name,
   requested_model: i % 3 === 0 ? "auto/coding" : "auto",
-  resolved_model: demoModels[i % 6].model_id,
+  resolved_model:
+    i === 2 ? "deepseek/deepseek-chat-v3.1" : demoModels[i % 6].model_id,
   endpoint: "chat/completions",
   status: i === 5 ? 429 : 200,
   latency_ms: [182, 634, 820, 241, 508, 1240, 312, 466][i],
@@ -145,8 +146,9 @@ export const demoLogs: Log[] = Array.from({ length: 8 }, (_, i) => ({
         ]
       : [
           {
-            provider: demoProviders[i % 4].kind,
-            provider_name: demoProviders[i % 4].name,
+            provider: demoModels[i % 6].provider,
+            provider_name:
+              i === 2 ? "OpenRouter" : demoModels[i % 6].provider_name,
             model: demoModels[i % 6].model_id,
             status: i === 5 ? 429 : 200,
             latency_ms: 182,

frontend/lib/errors.ts

@@ -0,0 +1,18 @@
+export function errorGuidance(status?: number, code?: string): string {
+  if (code === "account_suspended")
+    return "Contact the gateway administrator to restore your account.";
+  if (code === "admin_required")
+    return "Use an account with an administrator role granted on the server.";
+  if (status === 402)
+    return "The provider requires payment or available credit. Check the provider account's billing and model access.";
+  if (status === 401 || status === 403)
+    return "Check the selected provider's credentials and access permissions. For a session error, sign in again.";
+  if (status === 429)
+    return "Wait for the rate-limit window to reset, or choose another available model.";
+  if (status === 404 || code === "no_matching_model")
+    return "Choose an available model or refresh the provider catalog. Check the required capabilities.";
+  if (status === 400 || status === 422)
+    return "Review the selected model and request settings before sending again.";
+  if (status === 413) return "Shorten the prompt or reduce the request size.";
+  return "The request could not complete. Retry later or choose another model; request details show the provider attempts.";
+}

frontend/lib/site.ts

@@ -0,0 +1,20 @@
+export type SiteOptions = {
+  site_name: string;
+  tagline: string;
+  welcome_text: string;
+  accent: "purple" | "blue" | "green";
+  default_mode: string;
+  default_stream: boolean;
+  default_retries: number;
+  shared_models_enabled: boolean;
+};
+export const defaultSite: SiteOptions = {
+  site_name: "Nexus",
+  tagline: "Universal AI Gateway",
+  welcome_text: "Your models. Your keys. One connection.",
+  accent: "purple",
+  default_mode: "auto",
+  default_stream: true,
+  default_retries: 2,
+  shared_models_enabled: true,
+};

frontend/package-lock.json

@@ -12,7 +12,10 @@
         "next": "16.3.5",
         "react": "19.3.0",
         "react-dom": "19.3.0",
-        "recharts": "^3.8.0"
+        "react-markdown": "^10.1.0",
+        "recharts": "^3.8.0",
+        "rehype-highlight": "^7.0.2",
+        "remark-gfm": "^4.0.1"
       },
       "devDependencies": {
         "@tailwindcss/postcss": "4.3.3",
@@ -1773,6 +1776,14 @@
       "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
       "license": "MIT"
     },
+    "node_modules/@types/debug": {
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
+      "dependencies": {
+        "@types/ms": "*"
+      }
+    },
     "node_modules/@types/deep-eql": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
@@ -1784,9 +1795,37 @@
       "version": "1.0.9",
       "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
       "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
-      "dev": true,
       "license": "MIT"
     },
+    "node_modules/@types/estree-jsx": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree-jsx/-/estree-jsx-1.0.5.tgz",
+      "integrity": "sha512-52CcUVNFyfb1A2ALocQw/Dd1BQFNmSdkuC3BkZ6iqhdMfQz7JWOFRuJFloOzjk+6WijU56m9oKXFAXc7o3Towg==",
+      "dependencies": {
+        "@types/estree": "*"
+      }
+    },
+    "node_modules/@types/hast": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/mdast": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz",
+      "integrity": "sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==",
+      "dependencies": {
+        "@types/unist": "*"
+      }
+    },
+    "node_modules/@types/ms": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz",
+      "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="
+    },
     "node_modules/@types/node": {
       "version": "24.13.4",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.4.tgz",
@@ -1801,7 +1840,6 @@
       "version": "19.3.0",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.3.0.tgz",
       "integrity": "sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==",
-      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.2.2"
@@ -1817,12 +1855,22 @@
         "@types/react": "^19.3.0"
       }
     },
+    "node_modules/@types/unist": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
+      "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q=="
+    },
     "node_modules/@types/use-sync-external-store": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/@types/use-sync-external-store/-/use-sync-external-store-0.0.6.tgz",
       "integrity": "sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==",
       "license": "MIT"
     },
+    "node_modules/@ungap/structured-clone": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ=="
+    },
     "node_modules/@vitest/mocker": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.0.tgz",
@@ -1926,6 +1974,15 @@
         "node": ">=4"
       }
     },
+    "node_modules/bail": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/bail/-/bail-2.0.2.tgz",
+      "integrity": "sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/baseline-browser-mapping": {
       "version": "2.11.22",
       "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.22.tgz",
@@ -1968,6 +2025,15 @@
       ],
       "license": "CC-BY-4.0"
     },
+    "node_modules/ccount": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ccount/-/ccount-2.0.1.tgz",
+      "integrity": "sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/chai": {
       "version": "6.2.2",
       "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
@@ -1978,6 +2044,42 @@
         "node": ">=18"
       }
     },
+    "node_modules/character-entities": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/character-entities/-/character-entities-2.0.2.tgz",
+      "integrity": "sha512-shx7oQ0Awen/BRIdkjkvz54PnEEI/EjwXDSIZp86/KKdbafHh1Df/RYGBhn4hbe2+uKC9FnT5UCEdyPz3ai9hQ==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-html4": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/character-entities-html4/-/character-entities-html4-2.1.0.tgz",
+      "integrity": "sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-entities-legacy": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/character-entities-legacy/-/character-entities-legacy-3.0.0.tgz",
+      "integrity": "sha512-RpPp0asT/6ufRm//AJVwpViZbGM/MkjQFxJccQRHmISF/22NBtsHqAWmL+/pmkPWoIUJdWyeVleTl1wydHATVQ==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/character-reference-invalid": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/character-reference-invalid/-/character-reference-invalid-2.0.1.tgz",
+      "integrity": "sha512-iBZ4F4wRbyORVsu0jPV7gXkOsGYjGHPmAyv+HiHG8gi5PtC9KI2j1+v8/tlibRvjoWX027ypmG/n0HtO5t7unw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/client-only": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/client-only/-/client-only-0.0.1.tgz",
@@ -1993,6 +2095,15 @@
         "node": ">=6"
       }
     },
+    "node_modules/comma-separated-tokens": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/comma-separated-tokens/-/comma-separated-tokens-2.0.3.tgz",
+      "integrity": "sha512-Fu4hJdvzeylCfQPp9SGWidpzrMs7tTrlu6Vb8XGaRGck8QSNZJJp538Wrb60Lax4fPwR64ViY468OIUTbRlGZg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/css-tree": {
       "version": "3.2.1",
       "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-3.2.1.tgz",
@@ -2018,7 +2129,6 @@
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
       "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/d3-array": {
@@ -2171,6 +2281,22 @@
         "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
       }
     },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/decimal.js": {
       "version": "10.6.0",
       "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
@@ -2184,11 +2310,22 @@
       "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
       "license": "MIT"
     },
+    "node_modules/decode-named-character-reference": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.3.0.tgz",
+      "integrity": "sha512-GtpQYB283KrPp6nRw50q3U9/VfOutZOe103qlN7BPP6Ad27xYnOIWv4lPzo8HCAL+mMZofJ9KEy30fq6MfaK6Q==",
+      "dependencies": {
+        "character-entities": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/dequal": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
       "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
-      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -2204,6 +2341,18 @@
         "node": ">=8"
       }
     },
+    "node_modules/devlop": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/devlop/-/devlop-1.1.0.tgz",
+      "integrity": "sha512-RWmIqhcFf1lRYBvNmr7qTNuyCt/7/ns2jbpp1+PalgE/rDQcBT0fioSMUpJ93irlUhC5hrg4cYqe6U+0ImW0rA==",
+      "dependencies": {
+        "dequal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/dom-accessibility-api": {
       "version": "0.5.16",
       "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
@@ -2258,6 +2407,26 @@
         "tests/browser-compat"
       ]
     },
+    "node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/estree-util-is-identifier-name": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/estree-util-is-identifier-name/-/estree-util-is-identifier-name-3.0.0.tgz",
+      "integrity": "sha512-hFtqIDZTIUZ9BXLb8y4pYGyk6+wekIivNVTcmvk8NoOh+VeRn5y6cEHzbURrWbfp1fIqdVipilzj+lfaadNZmg==",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/estree-walker": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
@@ -2284,6 +2453,11 @@
         "node": ">=12.0.0"
       }
     },
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g=="
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -2325,6 +2499,79 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/hast-util-is-element": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/hast-util-is-element/-/hast-util-is-element-3.0.0.tgz",
+      "integrity": "sha512-Val9mnv2IWpLbNPqc/pUem+a7Ipj2aHacCwgNfTiK0vJKl0LF+4Ba4+v1oPHFpf3bLYmreq0/l3Gud9S5OH42g==",
+      "dependencies": {
+        "@types/hast": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-to-jsx-runtime": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/hast-util-to-jsx-runtime/-/hast-util-to-jsx-runtime-2.3.6.tgz",
+      "integrity": "sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==",
+      "dependencies": {
+        "@types/estree": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/unist": "^3.0.0",
+        "comma-separated-tokens": "^2.0.0",
+        "devlop": "^1.0.0",
+        "estree-util-is-identifier-name": "^3.0.0",
+        "hast-util-whitespace": "^3.0.0",
+        "mdast-util-mdx-expression": "^2.0.0",
+        "mdast-util-mdx-jsx": "^3.0.0",
+        "mdast-util-mdxjs-esm": "^2.0.0",
+        "property-information": "^7.0.0",
+        "space-separated-tokens": "^2.0.0",
+        "style-to-js": "^1.0.0",
+        "unist-util-position": "^5.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-to-text": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/hast-util-to-text/-/hast-util-to-text-4.0.2.tgz",
+      "integrity": "sha512-KK6y/BN8lbaq654j7JgBydev7wuNMcID54lkRav1P0CaE1e47P72AWWPiGKXTJU271ooYzcvTAn/Zt0REnvc7A==",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/unist": "^3.0.0",
+        "hast-util-is-element": "^3.0.0",
+        "unist-util-find-after": "^5.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/hast-util-whitespace": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/hast-util-whitespace/-/hast-util-whitespace-3.0.0.tgz",
+      "integrity": "sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==",
+      "dependencies": {
+        "@types/hast": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/highlight.js": {
+      "version": "11.11.2",
+      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-11.11.2.tgz",
+      "integrity": "sha512-oaXMACAU0kzOMXBjWpNcX+vlwSBCIAiZ9BHa7gA15NOTtT2L/l8OSZDuqS2XppOhZBPJ7hm4o8ep2kyuip2uEQ==",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/html-encoding-sniffer": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-6.0.0.tgz",
@@ -2338,6 +2585,15 @@
         "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
       }
     },
+    "node_modules/html-url-attributes": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/html-url-attributes/-/html-url-attributes-3.0.1.tgz",
+      "integrity": "sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/immer": {
       "version": "11.1.18",
       "resolved": "https://registry.npmjs.org/immer/-/immer-11.1.18.tgz",
@@ -2358,6 +2614,11 @@
         "node": ">=8"
       }
     },
+    "node_modules/inline-style-parser": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.2.7.tgz",
+      "integrity": "sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA=="
+    },
     "node_modules/internmap": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
@@ -2367,6 +2628,57 @@
         "node": ">=12"
       }
     },
+    "node_modules/is-alphabetical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphabetical/-/is-alphabetical-2.0.1.tgz",
+      "integrity": "sha512-FWyyY60MeTNyeSRpkM2Iry0G9hpr7/9kD40mD/cGQEuilcZYS4okz8SN2Q6rLCJ8gbCt6fN+rC+6tMGS99LaxQ==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-alphanumerical": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-alphanumerical/-/is-alphanumerical-2.0.1.tgz",
+      "integrity": "sha512-hmbYhX/9MUMF5uh7tOXyK/n0ZvWpad5caBA17GsC6vyuCqaWliRG5K1qS9inmUhEMaOBIW7/whAnSwveW/LtZw==",
+      "dependencies": {
+        "is-alphabetical": "^2.0.0",
+        "is-decimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-decimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-decimal/-/is-decimal-2.0.1.tgz",
+      "integrity": "sha512-AAB9hiomQs5DXWcRB1rqsxGUstbRroFOPPVAomNk/3XHR5JyEZChOyTWe2oayKnsSsr/kcGqF+z6yuH6HHpN0A==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-hexadecimal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-hexadecimal/-/is-hexadecimal-2.0.1.tgz",
+      "integrity": "sha512-DgZQp241c8oO6cA1SbTEWiXeoxV42vlcJxgH+B3hi1AiqqKruZR3ZGF8In3fj4+/y/7rHvlOZLZtgJ/4ttYGZg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/is-plain-obj": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
+      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/is-potential-custom-element-name": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
@@ -2673,73 +2985,895 @@
         "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
-      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/longest-streak": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz",
+      "integrity": "sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/lowlight": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/lowlight/-/lowlight-3.3.0.tgz",
+      "integrity": "sha512-0JNhgFoPvP6U6lE/UdVsSq99tn6DhjjpAj5MxG49ewd2mOBVtwWYIT8ClyABhq198aXXODMU6Ox8DrGy/CpTZQ==",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "devlop": "^1.0.0",
+        "highlight.js": "~11.11.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/lucide-react": {
+      "version": "0.577.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.577.0.tgz",
+      "integrity": "sha512-4LjoFv2eEPwYDPg/CUdBJQSDfPyzXCRrVW1X7jrx/trgxnxkHFjnVZINbzvzxjN70dxychOfg+FTYwBiS3pQ5A==",
+      "license": "ISC",
+      "peerDependencies": {
+        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/lz-string": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/lz-string/-/lz-string-1.5.0.tgz",
+      "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "bin": {
+        "lz-string": "bin/bin.js"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/markdown-table": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-3.0.4.tgz",
+      "integrity": "sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/mdast-util-find-and-replace": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.2.tgz",
+      "integrity": "sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
+        "unist-util-is": "^6.0.0",
+        "unist-util-visit-parents": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-from-markdown": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.3.tgz",
+      "integrity": "sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark": "^4.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm/-/mdast-util-gfm-3.1.0.tgz",
+      "integrity": "sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ==",
+      "dependencies": {
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-gfm-autolink-literal": "^2.0.0",
+        "mdast-util-gfm-footnote": "^2.0.0",
+        "mdast-util-gfm-strikethrough": "^2.0.0",
+        "mdast-util-gfm-table": "^2.0.0",
+        "mdast-util-gfm-task-list-item": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-autolink-literal": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.1.tgz",
+      "integrity": "sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "ccount": "^2.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-find-and-replace": "^3.0.0",
+        "micromark-util-character": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-footnote/-/mdast-util-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.1.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-strikethrough": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-strikethrough/-/mdast-util-gfm-strikethrough-2.0.0.tgz",
+      "integrity": "sha512-mKKb915TF+OC5ptj5bJ7WFRPdYtuHv0yTRxK2tJvi+BDqbkiG7h7u/9SI89nRAYcmap2xHQL9D+QG/6wSrTtXg==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-table": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-table/-/mdast-util-gfm-table-2.0.0.tgz",
+      "integrity": "sha512-78UEvebzz/rJIxLvE7ZtDd/vIQ0RHv+3Mh5DR96p7cS7HsBhYIICDBCu8csTNWNO6tBWfqXPWekRuj2FNOGOZg==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "markdown-table": "^3.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-gfm-task-list-item": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-2.0.0.tgz",
+      "integrity": "sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdx-expression": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdx-expression/-/mdast-util-mdx-expression-2.0.1.tgz",
+      "integrity": "sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdx-jsx": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdx-jsx/-/mdast-util-mdx-jsx-3.2.0.tgz",
+      "integrity": "sha512-lj/z8v0r6ZtsN/cGNNtemmmfoLAFZnjMbNyLzBafjzikOM+glrjNHPlf6lQDOTccj9n5b0PPihEBbhneMyGs1Q==",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "ccount": "^2.0.0",
+        "devlop": "^1.1.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "parse-entities": "^4.0.0",
+        "stringify-entities": "^4.0.0",
+        "unist-util-stringify-position": "^4.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-mdxjs-esm": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-mdxjs-esm/-/mdast-util-mdxjs-esm-2.0.1.tgz",
+      "integrity": "sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==",
+      "dependencies": {
+        "@types/estree-jsx": "^1.0.0",
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "mdast-util-to-markdown": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-phrasing": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.1.0.tgz",
+      "integrity": "sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-to-hast": {
+      "version": "13.2.1",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.1.tgz",
+      "integrity": "sha512-cctsq2wp5vTsLIcaymblUriiTcZd0CwWtCbLvrOzYCDZoWyMNV8sZ7krj09FSnsiJi3WVsHLM4k6Dq/yaPyCXA==",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "@ungap/structured-clone": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "trim-lines": "^3.0.0",
+        "unist-util-position": "^5.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-to-markdown": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.2.tgz",
+      "integrity": "sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "@types/unist": "^3.0.0",
+        "longest-streak": "^3.0.0",
+        "mdast-util-phrasing": "^4.0.0",
+        "mdast-util-to-string": "^4.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-decode-string": "^2.0.0",
+        "unist-util-visit": "^5.0.0",
+        "zwitch": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdast-util-to-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/mdast-util-to-string/-/mdast-util-to-string-4.0.0.tgz",
+      "integrity": "sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/mdn-data": {
+      "version": "2.27.1",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
+      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/micromark": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/micromark/-/micromark-4.0.2.tgz",
+      "integrity": "sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "@types/debug": "^4.0.0",
+        "debug": "^4.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-core-commonmark": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.3.tgz",
+      "integrity": "sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "devlop": "^1.0.0",
+        "micromark-factory-destination": "^2.0.0",
+        "micromark-factory-label": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-factory-title": "^2.0.0",
+        "micromark-factory-whitespace": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-html-tag-name": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-subtokenize": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-extension-gfm": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm/-/micromark-extension-gfm-3.0.0.tgz",
+      "integrity": "sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==",
+      "dependencies": {
+        "micromark-extension-gfm-autolink-literal": "^2.0.0",
+        "micromark-extension-gfm-footnote": "^2.0.0",
+        "micromark-extension-gfm-strikethrough": "^2.0.0",
+        "micromark-extension-gfm-table": "^2.0.0",
+        "micromark-extension-gfm-tagfilter": "^2.0.0",
+        "micromark-extension-gfm-task-list-item": "^2.0.0",
+        "micromark-util-combine-extensions": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-autolink-literal": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-2.1.0.tgz",
+      "integrity": "sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==",
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-footnote": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-2.1.0.tgz",
+      "integrity": "sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-core-commonmark": "^2.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-normalize-identifier": "^2.0.0",
+        "micromark-util-sanitize-uri": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-strikethrough": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-strikethrough/-/micromark-extension-gfm-strikethrough-2.1.0.tgz",
+      "integrity": "sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw==",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-classify-character": "^2.0.0",
+        "micromark-util-resolve-all": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-table": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.2.tgz",
+      "integrity": "sha512-pRzm4kDTu0MjlmBkxmS9yYhw60nncfcEwu9NNdPFSQEFXS95ZKyIIyTSHu/o3ReBUrLKYEq+7YaXCRn/bPB4MA==",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-tagfilter": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-tagfilter/-/micromark-extension-gfm-tagfilter-2.0.0.tgz",
+      "integrity": "sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg==",
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-extension-gfm-task-list-item": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-extension-gfm-task-list-item/-/micromark-extension-gfm-task-list-item-2.1.0.tgz",
+      "integrity": "sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw==",
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/micromark-factory-destination": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz",
+      "integrity": "sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-label": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz",
+      "integrity": "sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "devlop": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-space": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.0.1.tgz",
+      "integrity": "sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-title": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz",
+      "integrity": "sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-factory-whitespace": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz",
+      "integrity": "sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-factory-space": "^2.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-character": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz",
+      "integrity": "sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-chunked": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz",
+      "integrity": "sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-classify-character": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz",
+      "integrity": "sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-combine-extensions": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz",
+      "integrity": "sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-numeric-character-reference": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz",
+      "integrity": "sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
+      }
+    },
+    "node_modules/micromark-util-decode-string": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz",
+      "integrity": "sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
       ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+      "dependencies": {
+        "decode-named-character-reference": "^1.0.0",
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-decode-numeric-character-reference": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
       }
     },
-    "node_modules/lru-cache": {
-      "version": "11.5.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": "20 || >=22"
+    "node_modules/micromark-util-encode": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz",
+      "integrity": "sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ]
+    },
+    "node_modules/micromark-util-html-tag-name": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz",
+      "integrity": "sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ]
+    },
+    "node_modules/micromark-util-normalize-identifier": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz",
+      "integrity": "sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-symbol": "^2.0.0"
       }
     },
-    "node_modules/lucide-react": {
-      "version": "0.577.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-0.577.0.tgz",
-      "integrity": "sha512-4LjoFv2eEPwYDPg/CUdBJQSDfPyzXCRrVW1X7jrx/trgxnxkHFjnVZINbzvzxjN70dxychOfg+FTYwBiS3pQ5A==",
-      "license": "ISC",
-      "peerDependencies": {
-        "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
+    "node_modules/micromark-util-resolve-all": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz",
+      "integrity": "sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-types": "^2.0.0"
       }
     },
-    "node_modules/lz-string": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/lz-string/-/lz-string-1.5.0.tgz",
-      "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
-      "dev": true,
-      "license": "MIT",
-      "peer": true,
-      "bin": {
-        "lz-string": "bin/bin.js"
+    "node_modules/micromark-util-sanitize-uri": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz",
+      "integrity": "sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
+      "dependencies": {
+        "micromark-util-character": "^2.0.0",
+        "micromark-util-encode": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0"
       }
     },
-    "node_modules/magic-string": {
-      "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/micromark-util-subtokenize": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz",
+      "integrity": "sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ],
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.5"
+        "devlop": "^1.0.0",
+        "micromark-util-chunked": "^2.0.0",
+        "micromark-util-symbol": "^2.0.0",
+        "micromark-util-types": "^2.0.0"
       }
     },
-    "node_modules/mdn-data": {
-      "version": "2.27.1",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.27.1.tgz",
-      "integrity": "sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==",
-      "dev": true,
-      "license": "CC0-1.0"
+    "node_modules/micromark-util-symbol": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz",
+      "integrity": "sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ]
+    },
+    "node_modules/micromark-util-types": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz",
+      "integrity": "sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==",
+      "funding": [
+        {
+          "type": "GitHub Sponsors",
+          "url": "https://github.com/sponsors/unifiedjs"
+        },
+        {
+          "type": "OpenCollective",
+          "url": "https://opencollective.com/unified"
+        }
+      ]
     },
     "node_modules/min-indent": {
       "version": "1.0.1",
@@ -2751,6 +3885,11 @@
         "node": ">=4"
       }
     },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+    },
     "node_modules/nanoid": {
       "version": "3.3.19",
       "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.19.tgz",
@@ -2864,6 +4003,29 @@
         "node": ">=12.20.0"
       }
     },
+    "node_modules/parse-entities": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/parse-entities/-/parse-entities-4.0.2.tgz",
+      "integrity": "sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==",
+      "dependencies": {
+        "@types/unist": "^2.0.0",
+        "character-entities-legacy": "^3.0.0",
+        "character-reference-invalid": "^2.0.0",
+        "decode-named-character-reference": "^1.0.0",
+        "is-alphanumerical": "^2.0.0",
+        "is-decimal": "^2.0.0",
+        "is-hexadecimal": "^2.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/parse-entities/node_modules/@types/unist": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz",
+      "integrity": "sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA=="
+    },
     "node_modules/parse5": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/parse5/-/parse5-8.0.1.tgz",
@@ -2949,6 +4111,15 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/property-information": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/property-information/-/property-information-7.2.0.tgz",
+      "integrity": "sha512-IAtzIB6sUiWaJYrX9smp3V46pBGbBeLFRGdh25kg1334VcBlD8HzhPeNIWQH9zhGmo2itIe25EHt9dQP7G5hmg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/punycode": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
@@ -2987,6 +4158,32 @@
       "license": "MIT",
       "peer": true
     },
+    "node_modules/react-markdown": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/react-markdown/-/react-markdown-10.1.0.tgz",
+      "integrity": "sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "devlop": "^1.0.0",
+        "hast-util-to-jsx-runtime": "^2.0.0",
+        "html-url-attributes": "^3.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "remark-parse": "^11.0.0",
+        "remark-rehype": "^11.0.0",
+        "unified": "^11.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      },
+      "peerDependencies": {
+        "@types/react": ">=18",
+        "react": ">=18"
+      }
+    },
     "node_modules/react-redux": {
       "version": "9.3.0",
       "resolved": "https://registry.npmjs.org/react-redux/-/react-redux-9.3.0.tgz",
@@ -3069,6 +4266,84 @@
         "redux": "^5.0.0"
       }
     },
+    "node_modules/rehype-highlight": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/rehype-highlight/-/rehype-highlight-7.0.2.tgz",
+      "integrity": "sha512-k158pK7wdC2qL3M5NcZROZ2tR/l7zOzjxXd5VGdcfIyoijjQqpHd3JKtYSBDpDZ38UI2WJWuFAtkMDxmx5kstA==",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "hast-util-to-text": "^4.0.0",
+        "lowlight": "^3.0.0",
+        "unist-util-visit": "^5.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-gfm": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/remark-gfm/-/remark-gfm-4.0.1.tgz",
+      "integrity": "sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-gfm": "^3.0.0",
+        "micromark-extension-gfm": "^3.0.0",
+        "remark-parse": "^11.0.0",
+        "remark-stringify": "^11.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-parse": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/remark-parse/-/remark-parse-11.0.0.tgz",
+      "integrity": "sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-from-markdown": "^2.0.0",
+        "micromark-util-types": "^2.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-rehype": {
+      "version": "11.1.2",
+      "resolved": "https://registry.npmjs.org/remark-rehype/-/remark-rehype-11.1.2.tgz",
+      "integrity": "sha512-Dh7l57ianaEoIpzbp0PC9UKAdCSVklD8E5Rpw7ETfbTl3FqcOOgq5q2LVDhgGCkaBv7p24JXikPdvhhmHvKMsw==",
+      "dependencies": {
+        "@types/hast": "^3.0.0",
+        "@types/mdast": "^4.0.0",
+        "mdast-util-to-hast": "^13.0.0",
+        "unified": "^11.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/remark-stringify": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/remark-stringify/-/remark-stringify-11.0.0.tgz",
+      "integrity": "sha512-1OSmLd3awB/t8qdoEOMazZkNsfVTeY4fTsgzcQFdXNq8ToTN4ZGwrMnlda4K6smTFKD+GRV6O48i6Z4iKgPPpw==",
+      "dependencies": {
+        "@types/mdast": "^4.0.0",
+        "mdast-util-to-markdown": "^2.0.0",
+        "unified": "^11.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/require-from-string": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@ -3218,6 +4493,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/space-separated-tokens": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/space-separated-tokens/-/space-separated-tokens-2.0.2.tgz",
+      "integrity": "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/stackback": {
       "version": "0.0.2",
       "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
@@ -3232,6 +4516,19 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/stringify-entities": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/stringify-entities/-/stringify-entities-4.0.4.tgz",
+      "integrity": "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==",
+      "dependencies": {
+        "character-entities-html4": "^2.0.0",
+        "character-entities-legacy": "^3.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/strip-indent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-3.0.0.tgz",
@@ -3245,6 +4542,22 @@
         "node": ">=8"
       }
     },
+    "node_modules/style-to-js": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/style-to-js/-/style-to-js-1.1.21.tgz",
+      "integrity": "sha512-RjQetxJrrUJLQPHbLku6U/ocGtzyjbJMP9lCNK7Ag0CNh690nSH8woqWH9u16nMjYBAok+i7JO1NP2pOy8IsPQ==",
+      "dependencies": {
+        "style-to-object": "1.0.14"
+      }
+    },
+    "node_modules/style-to-object": {
+      "version": "1.0.14",
+      "resolved": "https://registry.npmjs.org/style-to-object/-/style-to-object-1.0.14.tgz",
+      "integrity": "sha512-LIN7rULI0jBscWQYaSswptyderlarFkjQ+t79nzty8tcIAceVomEVlLzH5VP4Cmsv6MtKhs7qaAiwlcp+Mgaxw==",
+      "dependencies": {
+        "inline-style-parser": "0.2.7"
+      }
+    },
     "node_modules/styled-jsx": {
       "version": "5.1.6",
       "resolved": "https://registry.npmjs.org/styled-jsx/-/styled-jsx-5.1.6.tgz",
@@ -3385,6 +4698,24 @@
         "node": ">=20"
       }
     },
+    "node_modules/trim-lines": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz",
+      "integrity": "sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
+    "node_modules/trough": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/trough/-/trough-2.2.0.tgz",
+      "integrity": "sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -3422,6 +4753,100 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/unified": {
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/unified/-/unified-11.0.5.tgz",
+      "integrity": "sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "bail": "^2.0.0",
+        "devlop": "^1.0.0",
+        "extend": "^3.0.0",
+        "is-plain-obj": "^4.0.0",
+        "trough": "^2.0.0",
+        "vfile": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-find-after": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-find-after/-/unist-util-find-after-5.0.0.tgz",
+      "integrity": "sha512-amQa0Ep2m6hE2g72AugUItjbuM8X8cGQnFoHk0pGfrFeT9GZhzN5SW8nRsiGKK7Aif4CrACPENkA6P/Lw6fHGQ==",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-is": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
+      "integrity": "sha512-LsiILbtBETkDz8I9p1dQ0uyRUWuaQzd/cuEeS1hoRSyW5E5XGmTzlwY1OrNzzakGowI9Dr/I8HVaw4hTtnxy8g==",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-position": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-position/-/unist-util-position-5.0.0.tgz",
+      "integrity": "sha512-fucsC7HjXvkB5R3kTCO7kUjRdrS0BJt3M/FPxmHMBOm8JQi2BsHAHFsy27E0EolP8rp0NzXsJ+jNPyDWvOJZPA==",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-stringify-position": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/unist-util-stringify-position/-/unist-util-stringify-position-4.0.0.tgz",
+      "integrity": "sha512-0ASV06AAoKCDkS2+xw5RXJywruurpbC4JZSm7nr7MOt1ojAzvyyaO+UxZf18j8FCF6kmzCZKcAgN/yu2gm2XgQ==",
+      "dependencies": {
+        "@types/unist": "^3.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-visit": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/unist-util-visit/-/unist-util-visit-5.1.0.tgz",
+      "integrity": "sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0",
+        "unist-util-visit-parents": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/unist-util-visit-parents": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/unist-util-visit-parents/-/unist-util-visit-parents-6.0.2.tgz",
+      "integrity": "sha512-goh1s1TBrqSqukSc8wrjwWhL0hiJxgA8m4kFxGlQ+8FYQ3C/m11FcTs4YYem7V664AhHVvgoQLk890Ssdsr2IQ==",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-is": "^6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/use-sync-external-store": {
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.7.0.tgz",
@@ -3431,6 +4856,32 @@
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
+    "node_modules/vfile": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/vfile/-/vfile-6.0.3.tgz",
+      "integrity": "sha512-KzIbH/9tXat2u30jf+smMwFCsno4wHVdNmzFyL+T/L3UGqqk6JKfVqOFOZEpZSHADH1k40ab6NUIXZq422ov3Q==",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "vfile-message": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
+    "node_modules/vfile-message": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/vfile-message/-/vfile-message-4.0.3.tgz",
+      "integrity": "sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==",
+      "dependencies": {
+        "@types/unist": "^3.0.0",
+        "unist-util-stringify-position": "^4.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/unified"
+      }
+    },
     "node_modules/victory-vendor": {
       "version": "37.3.6",
       "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-37.3.6.tgz",
@@ -3979,6 +5430,15 @@
       "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
       "dev": true,
       "license": "MIT"
+    },
+    "node_modules/zwitch": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
+      "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
     }
   }
 }

frontend/package.json

@@ -13,7 +13,10 @@
     "next": "16.3.5",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "recharts": "^3.8.0"
+    "react-markdown": "^10.1.0",
+    "recharts": "^3.8.0",
+    "rehype-highlight": "^7.0.2",
+    "remark-gfm": "^4.0.1"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "4.3.3",

frontend/tests/catalog.test.tsx

@@ -0,0 +1,147 @@
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+import { loadAllModels, Model } from "@/lib/api";
+import { demoModels, demoProviders } from "@/lib/demo";
+import Playground from "@/app/playground";
+import MarkdownOutput from "@/app/markdown-output";
+
+const catalog: Model[] = Array.from({ length: 1205 }, (_, i) => ({
+  ...demoModels[0],
+  id: `model-${i}`,
+  name: `Catalog model ${i}`,
+  model_id: `catalog/${i}`,
+  route_id: `provider::catalog/${i}`,
+  input_price: i === 1204 ? 0 : 1,
+  output_price: i === 1204 ? 0 : 2,
+}));
+
+describe("Complete model catalog", () => {
+  it("loads every page, including free models beyond the first thousand", async () => {
+    const fetcher = vi.fn(async (url: string) => {
+      const offset = Number(
+        new URL(url, "http://test").searchParams.get("offset"),
+      );
+      return new Response(
+        JSON.stringify({
+          data: catalog.slice(offset, offset + 1000),
+          total: catalog.length,
+        }),
+      );
+    });
+    vi.stubGlobal("fetch", fetcher);
+    const all = await loadAllModels();
+    expect(all).toHaveLength(1205);
+    expect(all.at(-1)?.input_price).toBe(0);
+    expect(fetcher.mock.calls.map(([url]) => url)).toEqual([
+      "/api/models?limit=1000&offset=0",
+      "/api/models?limit=1000&offset=1000",
+    ]);
+  });
+  it("reports incomplete catalogs instead of silently hiding models", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValue(
+          new Response(JSON.stringify({ data: [], total: 1205 })),
+        ),
+    );
+    await expect(loadAllModels()).rejects.toThrow("complete catalog");
+  });
+  it("searches the full catalog and keeps selection when the workspace refreshes", async () => {
+    const loadCatalog = vi.fn().mockResolvedValue(catalog);
+    const props = {
+      demo: false,
+      providers: demoProviders,
+      models: catalog.slice(0, 100),
+      loadCatalog,
+      requireAccount: (fn: () => void) => fn(),
+      notify: vi.fn(),
+      onFinish: vi.fn().mockResolvedValue(undefined),
+    };
+    const fetcher = vi
+      .fn()
+      .mockImplementation(
+        async () =>
+          new Response(
+            'data: {"choices":[{"delta":{"content":"Selected model worked"}}]}\n\ndata: [DONE]\n\n',
+          ),
+      );
+    vi.stubGlobal("fetch", fetcher);
+    const { rerender } = render(<Playground {...props} />);
+    const user = userEvent.setup();
+    await user.click(screen.getByRole("button", { name: "Select model" }));
+    expect(
+      await screen.findByText("1205 matching models · 1205 in this catalog"),
+    ).toBeVisible();
+    await user.click(screen.getByRole("checkbox", { name: "Free only" }));
+    fireEvent.change(
+      screen.getByRole("textbox", { name: "Search all models" }),
+      { target: { value: "catalog/1204" } },
+    );
+    await user.click(
+      screen.getByRole("button", { name: /Choose Catalog model 1204/ }),
+    );
+    await user.click(screen.getByRole("button", { name: "Send request" }));
+    expect(await screen.findByText("Selected model worked")).toBeVisible();
+    rerender(<Playground {...props} models={[]} />);
+    expect(
+      screen.getByRole("button", { name: "Select model" }),
+    ).toHaveTextContent("Catalog model 1204");
+    await user.click(screen.getByRole("button", { name: "Send request" }));
+    await waitFor(() => expect(fetcher).toHaveBeenCalledTimes(2));
+    expect(
+      fetcher.mock.calls.map((call) => JSON.parse(call[1].body).model),
+    ).toEqual(["provider::catalog/1204", "provider::catalog/1204"]);
+    expect(loadCatalog).toHaveBeenCalledOnce();
+  });
+  it("blocks manual auto-routing and supports a model selected in explorer", async () => {
+    const fetcher = vi.fn();
+    vi.stubGlobal("fetch", fetcher);
+    const props = {
+      demo: false,
+      providers: demoProviders,
+      models: catalog,
+      loadCatalog: vi.fn().mockResolvedValue(catalog),
+      requireAccount: (fn: () => void) => fn(),
+      notify: vi.fn(),
+      onFinish: vi.fn().mockResolvedValue(undefined),
+    };
+    const { unmount } = render(<Playground {...props} />);
+    const user = userEvent.setup();
+    await user.selectOptions(
+      screen.getByLabelText("Routing strategy"),
+      "manual",
+    );
+    expect(screen.getByRole("button", { name: "Send request" })).toBeDisabled();
+    fireEvent.keyDown(screen.getByLabelText("Your message"), {
+      key: "Enter",
+      ctrlKey: true,
+    });
+    expect(fetcher).not.toHaveBeenCalled();
+    unmount();
+    render(<Playground {...props} initialModel={catalog[1204]} />);
+    expect(
+      screen.getByRole("button", { name: "Select model" }),
+    ).toHaveTextContent("Catalog model 1204");
+    expect(screen.getByLabelText("Routing strategy")).toHaveValue("manual");
+  });
+  it("renders Markdown and code without loading images or executing HTML", () => {
+    const { container } = render(
+      <MarkdownOutput
+        text={
+          "## Result\n\n**Useful** output\n\n```js\nconst answer = 42;\n```\n\n![tracker](https://evil.example/track)\n\n<script>alert(1)</script>\n\n[bad](javascript:alert(1))"
+        }
+        notify={vi.fn()}
+      />,
+    );
+    expect(screen.getByRole("heading", { name: "Result" })).toBeVisible();
+    expect(screen.getByRole("button", { name: "Copy code" })).toBeEnabled();
+    expect(container.querySelector("pre code")).toHaveTextContent(
+      "const answer = 42;",
+    );
+    expect(container.querySelector("img,script")).toBeNull();
+    expect(container.querySelector('a[href^="javascript:"]')).toBeNull();
+  });
+});

frontend/tests/playground.test.tsx

@@ -10,6 +10,7 @@ function mount(demo = false) {
     demo,
     providers: demoProviders,
     models: demoModels,
+    loadCatalog: vi.fn().mockResolvedValue(demoModels),
     requireAccount: vi.fn((fn: () => void) => {
       if (!demo) fn();
     }),

frontend/tests/setup.ts

@@ -40,6 +40,7 @@ export function setViewport(width: number) {
   });
 }
 beforeEach(() => {
+  window.scrollTo = vi.fn();
   setViewport(1440);
   window.history.replaceState(null, "", "/");
   document.documentElement.lang = "en";

frontend/tests/workspace.test.tsx

@@ -370,7 +370,9 @@ describe("Authenticated workspace actions", () => {
     const { user, fetcher } = await mounted(true);
     await go("models");
     await user.click(
-      screen.getByRole("button", { name: `Favorite ${demoModels[0].name}` }),
+      await screen.findByRole("button", {
+        name: `Favorite ${demoModels[0].name}`,
+      }),
     );
     await waitFor(() =>
       expect(fetcher).toHaveBeenCalledWith(

scripts/admin.py

@@ -0,0 +1,67 @@
+"""Manage administrator roles using access to the gateway server."""
+
+import argparse
+import asyncio
+import os
+from pathlib import Path
+
+from app.admin_bootstrap import provision_admin
+from app.config import Settings
+from app.db import create_database
+from app.models import User
+from sqlalchemy import select
+
+
+async def run() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("action", choices=["grant", "revoke", "list", "bootstrap"])
+    parser.add_argument(
+        "--email",
+        help="Exact account email; only bootstrap with a server seed can create it",
+    )
+    args = parser.parse_args()
+    if args.action != "list" and not args.email:
+        parser.error("--email is required for grant/revoke/bootstrap")
+    # docker exec does not inherit variables set inside deploy/start.py.
+    root = Path(os.environ.get("DATA_DIR", "/data"))
+    if (
+        not os.environ.get("DATABASE_URL")
+        and (root / "postgres" / "PG_VERSION").exists()
+    ):
+        os.environ["DATABASE_URL"] = (
+            f"postgresql+asyncpg://gateway@/gateway?host={root / 'run'}"
+        )
+    if not os.environ.get("REDIS_URL") and (root / "redis.sock").exists():
+        os.environ["REDIS_URL"] = f"unix://{root / 'redis.sock'}?db=0"
+    db_factory = create_database(Settings().database_url)
+    try:
+        async with db_factory() as db:
+            if args.action == "list":
+                for user in await db.scalars(
+                    select(User).where(User.is_admin.is_(True))
+                ):
+                    print(f"{user.email} — administrator")
+                return
+            try:
+                user = await provision_admin(
+                    db,
+                    args.email,
+                    args.action,
+                    os.environ.get("ADMIN_BOOTSTRAP_PASSWORD_HASH"),
+                )
+            except ValueError:
+                raise SystemExit(
+                    "Admin provisioning failed: check the existing account, suspension status, and bootstrap hash configuration. No password was changed."
+                ) from None
+            print(
+                f"Administrator role {'granted to' if user.is_admin else 'revoked from'} {user.email}."
+            )
+            print(
+                "Sign in at /#admin with the account password. Existing passwords are never changed."
+            )
+    finally:
+        await db_factory.kw["bind"].dispose()
+
+
+if __name__ == "__main__":
+    asyncio.run(run())

universal-ai-gateway-v1.zip

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2776619003b565b68b158f134718a33c0a5a95b0a6ed07d6a5f5c754e82b26f5
+size 650506