diff --git a/.agents/skills/bump-version/SKILL.md b/.agents/skills/bump-version/SKILL.md
index 4473605..063ecf0 100644
--- a/.agents/skills/bump-version/SKILL.md
+++ b/.agents/skills/bump-version/SKILL.md
@@ -14,6 +14,12 @@ part of it -- see the end of this file.
 uv run scripts/bump_version.py <version>
 ```
 
+There is exactly one place a version lives: `[workspace.package]` in
+`Cargo.toml`. `frontend/package.json` deliberately has no `version` field -- the
+dashboard reports the binary's, read from the configuration the listener injects --
+so nothing there needs bumping, and adding a version to it would create a second
+thing to forget.
+
 It sets the version under `[workspace.package]` in `Cargo.toml`, renames
 `## Development` in CHANGES.md to `## <version> -- <date>`, and opens a fresh
 empty Development section above it. It prints what it changed and what to do
diff --git a/.agents/skills/check-docs/SKILL.md b/.agents/skills/check-docs/SKILL.md
index fbdc767..203b61e 100644
--- a/.agents/skills/check-docs/SKILL.md
+++ b/.agents/skills/check-docs/SKILL.md
@@ -88,6 +88,43 @@ grep -rn 'env::var\|env = "DOPPEL' crates/
 statuses, must match the table in the docs. A code added without a doc row is
 invisible to whoever has to handle it.
 
+**The parameter reference.** `docs/usage/parameters.md` is generated from
+`doppel-config.schema.json` by `scripts/parameters_doc.py`. Never edit it by hand
+-- regenerate it and read the diff:
+
+```bash
+uv run scripts/config_schema.py && uv run scripts/parameters_doc.py
+```
+
+What the generator cannot judge is whether a field's *description* still says
+something true, or whether its example is still the example worth showing. Those
+come from doc comments and `examples(...)` in `crates/doppel-core/src/config/`, so
+read them there when the behaviour changed.
+
+**The links the dashboard builds.** The (i) beside a field links into that page,
+and the link is assembled at runtime from the field's path and the running version
+-- so mkdocs cannot see it and `--strict` cannot check it. A wrong fragment is
+silent: the browser opens the page at the top and nobody notices.
+
+```bash
+uv run scripts/check_docs_links.py
+```
+
+It holds three things, and each has a failure it exists for:
+
+- every `info="..."` path in `frontend/src` has a section under the anchor
+  `frontend/src/services/docs.ts` derives from it -- a renamed field is the way
+  this breaks;
+- every documentation URL in the frontend is built through `docsUrl()`, so it
+  carries the version. A hand-written link to the site root shows whoever follows
+  it the rules of whatever has been released since;
+- every relative link and fragment inside the generated page resolves.
+
+Both checks are in `make gate` and in CI, so what is left for a human is the
+half a script cannot see: follow two or three of the (i) links in a running
+dashboard and read the sections they land on. An anchor that exists but explains
+a different field passes every check here.
+
 **`main.example.yaml`.** It is the schema made concrete and is asserted against
 by tests, so it cannot be stale -- but it can be *misleading*, which tests do
 not catch. Read it as a newcomer copying it: does the ordering of its mocks
@@ -120,3 +157,34 @@ Say what you compared, not just that you checked. "Every config field has a
 reference entry; the rule-map tests pass; two `usage/` pages named crates and
 were reworded; `mkdocs build --strict` is clean" is a useful report. "Docs look
 fine" is not.
+
+## The dashboard and the frontend
+
+`docs/usage/dashboard.md` is the operator-facing page: the two configuration
+fields, who may use it, what each screen does, the theme, and what a 503 at the
+root means. `docs/development/architecture.md` carries the developer-facing half.
+
+Check these together, because they go stale as a set:
+
+- `admin.dashboard` and `admin.title` in `docs/usage/configuration.md` and in
+  `main.example.yaml`.
+- `GET /api/v1/access` and the routes in `docs/usage/admin-api.md`, plus
+  `DASHBOARD_NOT_BUILT` in its error table. The endpoint table is the one thing
+  there that is checked by a test -- `openapi.rs` refuses a document describing a
+  route that is not served -- so a path that changed shows up in `cargo test`
+  before it shows up here. What does not is prose quoting a path, and every
+  healthcheck: the compose file, the Docker Hub overview, `observability.md`.
+- The build order in `README.md`: assets first, then the binary. A reader who
+  follows a stale version of that gets a 503 and no idea why.
+- `make help`. Every target carries its own description, so the list cannot go
+  stale on its own -- but a documented command that no longer matches a target is
+  worth catching here.
+- The four pages a reader reaches for before the dashboard's own: `docs/index.md`
+  (the feature list and the reading order), `usage/getting-started.md` (a first run
+  ends by opening it), `usage/troubleshooting.md` (the 503, disabled controls, the
+  refresh timer) and `DOCKERHUB.md` (the image serves it too). A feature documented
+  only on its own page is a feature nobody finds.
+
+The icons live in `assets/` at the repository root and are staged into
+`docs/assets/` by `scripts/mkdocs_assets.py` on every build. `docs/assets/` is
+git-ignored: a link that points there is fine, a file committed there is not.
diff --git a/.agents/skills/check-licenses/SKILL.md b/.agents/skills/check-licenses/SKILL.md
index f03b6f5..bf2755e 100644
--- a/.agents/skills/check-licenses/SKILL.md
+++ b/.agents/skills/check-licenses/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: check-licenses
-description: Use after editing any Cargo.toml, adding or removing a dependency, or before cutting a release. Verifies every direct dependency's licence against the project policy and updates LICENSE.
+description: Use after editing any Cargo.toml or frontend/package.json, adding or removing a dependency, or before cutting a release. Verifies every direct dependency's licence against the project policy and updates LICENSE and THIRD-PARTY.md.
 ---
 
 # Check licences
@@ -21,6 +21,20 @@ so the dynamic-linking exception does not apply.
 
 ## How to check
 
+Both halves are generated, so start by running the generator and reading what it
+says:
+
+```bash
+uv run scripts/third_party.py           # rewrites THIRD-PARTY.md
+uv run scripts/third_party.py --check   # what CI runs
+```
+
+It exits non-zero and prints `SOME LICENCES ARE NOT COVERED BY THE POLICY` with
+the offending packages named. That is the check; the rest of this skill is for
+deciding what to do about a new dependency.
+
+### The cargo half
+
 Read the licence from the registry rather than from memory:
 
 ```bash
@@ -33,6 +47,30 @@ Transitive crates come in under their parents' justification; if one of them
 carries a forbidden licence that is a real problem, but it is found by auditing
 the tree, not by this skill.
 
+### The npm half
+
+The direct set is `dependencies` and `devDependencies` in
+`frontend/package.json`. The two are not equivalent, and the difference decides
+whether a licence matters at all:
+
+- `dependencies` is compiled into `frontend/dist` and embedded in the binary, so
+  it is **redistributed**. Its licences bind, and it belongs in `LICENSE` and
+  `THIRD-PARTY.md`.
+- `devDependencies` -- vite, jest, eslint, tailwind's compiler, the tooling
+  underneath them -- runs on a developer's machine and ships nowhere. It is
+  deliberately absent from both files.
+
+A build tool in `dependencies` is therefore a real mistake and not a matter of
+taste: it drags the policy over licences the project never distributes.
+Tailwind sat there once, and the tooling closure it pulled in carried Blue Oak
+and CC-BY -- which would have meant widening the permitted set for code nobody
+ships.
+
+```bash
+npm view <package> license                 # one package
+npm ls --omit=dev --all --prefix frontend  # exactly what ships
+```
+
 ## Ask the question the policy is actually for
 
 For each dependency that is new since the last check, answer in one line: what
@@ -51,8 +89,17 @@ sweep late in phase 1, each declared and referenced by no source file.
 grep -rn "<crate_name>" crates --include='*.rs' | head
 ```
 
-## Update LICENSE
+## Update LICENSE and THIRD-PARTY.md
+
+`LICENSE` carries the Apache 2.0 text plus a table of the *direct* set, from both
+ecosystems. `THIRD-PARTY.md` carries the whole closure and is generated -- never
+edit it by hand.
+
+```bash
+uv run scripts/third_party.py
+```
 
-`LICENSE` carries the Apache 2.0 text plus the third-party notices. When the
-direct set changes, update the notices to match. Report what you changed and
+Both modes need `frontend/node_modules` present and refuse to run without it,
+rather than writing a cargo-only file that looks complete or reporting a stale one
+that is not. Report what you changed and
 what you found -- including "nothing changed", which is a useful result.
diff --git a/.agents/skills/pre-release-check/SKILL.md b/.agents/skills/pre-release-check/SKILL.md
index dd3a004..3fe5282 100644
--- a/.agents/skills/pre-release-check/SKILL.md
+++ b/.agents/skills/pre-release-check/SKILL.md
@@ -27,6 +27,28 @@ changes things. `regenerate-config-schema` is the one exception, and only
 because the thing it writes is generated: if it produces a diff, that diff is a
 commit of its own before the release, not part of the release commit.
 
+## Then check the dashboard
+
+`run-tests-and-linters` covers the frontend gate, but a release has two questions
+of its own, because the dashboard is embedded at compile time and a binary without
+it still builds:
+
+```bash
+make e2e          # the browser suite, which the frontend gate leaves out
+```
+
+Then confirm the release will not ship a page-less binary. The workflow greps each
+archive's binary for the configuration element before publishing -- read that step
+and check it is still there, since it is the only thing standing between a missing
+artifact and a release whose root answers 503:
+
+```bash
+grep -n "carries the dashboard" .github/workflows/release.yml
+```
+
+The dashboard's own version is not bumped and must not be: `frontend/package.json`
+has no `version` field, and the page reports the binary's.
+
 ## Then check the version
 
 ```bash
diff --git a/.agents/skills/run-tests-and-linters/SKILL.md b/.agents/skills/run-tests-and-linters/SKILL.md
index 00db585..8545edc 100644
--- a/.agents/skills/run-tests-and-linters/SKILL.md
+++ b/.agents/skills/run-tests-and-linters/SKILL.md
@@ -5,7 +5,18 @@ description: Use before marking any task done, before opening a pull request, or
 
 # Run tests and linters
 
-The gate is three commands, in this order, all of which must pass:
+The whole gate, in one command:
+
+```bash
+make gate
+```
+
+That is `fmt-check`, `lint`, `test`, `test-frontend`, `size`, `docs`, `schema`
+and `licences`. It deliberately leaves out the browser suite -- `make e2e`
+downloads Chromium on first run -- so run that too whenever the change touches
+`frontend/` or the dashboard routes.
+
+The Rust half by hand, in this order, all of which must pass:
 
 ```bash
 cargo fmt --check
@@ -13,6 +24,35 @@ cargo clippy --all-targets -- -D warnings
 cargo test
 ```
 
+## The frontend half
+
+The dashboard has its own gate, and one ordering that matters: the assets are
+embedded into the binary at compile time, so they are built before anything that
+reads them.
+
+```bash
+npm --prefix frontend ci
+npm --prefix frontend run lint          # eslint
+npm --prefix frontend run typecheck     # tsc, the application
+(cd frontend && npx tsc --noEmit -p tsconfig.e2e.json)   # tsc, the specs
+npm --prefix frontend run build         # writes frontend/dist
+npm --prefix frontend test              # jest, including the bundle-size budgets
+cargo build -p doppel-cli               # re-embeds what the build just wrote
+npm --prefix frontend run e2e           # Playwright, against that binary
+```
+
+Two traps this order exists to avoid:
+
+- `npm run build` alone changes nothing about a running binary. Rebuilding the
+  frontend without rebuilding the binary is how half an hour goes into chasing a
+  fixed bug that is still in the embedded bundle.
+- The bundle-size suite measures `frontend/dist`. Running jest before the build
+  measures the previous one, or fails because there is nothing to measure.
+
+`DOPPEL_REQUIRE_DASHBOARD_ASSETS=1` on `cargo test` turns a skipped
+asset-delivery suite into a failure, exactly as `DOPPEL_REQUIRE_DATABASE` does
+for the store. `make test` sets it.
+
 ## Capture the output, do not recall it
 
 Run the gate so its output lands in a file, and quote the file:
diff --git a/.dockerignore b/.dockerignore
index 394d0ee..4b04f04 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,9 +1,45 @@
-# The image copies one already-built binary in; nothing else in the repository
-# belongs in the build context. Keeping it small matters more than usual here:
-# `target/` alone is tens of gigabytes on a working checkout, and every byte of
-# the context is sent to the daemon before the first instruction runs.
+# The image prefers an already-built binary and only compiles one when none was
+# staged, so the context is what those two paths need and nothing else. Keeping it
+# small matters more than usual here: `target/` alone is tens of gigabytes on a
+# working checkout, and every byte of the context is sent to the daemon before the
+# first instruction runs.
 *
 
-# The staged binary, which the `docker` release job puts here and the local
-# build instructions in the Dockerfile copy here too.
+# This file itself, because the Dockerfile copies it. That is not decoration:
+# `COPY .dockerignore dist/<platform>/doppel* /staged/` is how "copy the binary if
+# it is there" is expressed, and it needs one source that always matches or the
+# COPY fails when no binary was staged.
+!.dockerignore
+
+# The staged binary, which the `docker` release job puts here and the local build
+# instructions in the Dockerfile copy here too. When it is present nothing below
+# is compiled.
 !dist/
+
+# What the fallback build needs: the workspace, and the dashboard it embeds.
+!Cargo.toml
+!Cargo.lock
+!rust-toolchain.toml
+!crates/
+
+# The dashboard, either already built or buildable. `frontend/dist` is generated, so
+# it is listed explicitly; the sources beside it are what the image builds from when
+# it is not there, which is why this list is exactly what `vite build` reads and not
+# the whole directory -- `node_modules` is bigger than everything else here together.
+#
+# `assets/favicon.ico` is in the list because the build's `prebuild` step copies it
+# into `public/`: one icon, one source of truth, and the copy is git-ignored.
+!frontend/dist/
+!frontend/package.json
+!frontend/package-lock.json
+!frontend/index.html
+!frontend/vite.config.ts
+!frontend/tsconfig.json
+!frontend/src/
+!frontend/scripts/
+!assets/favicon.ico
+
+# Nothing inside the workspace that the build does not read. `target/` is the one
+# that matters; the rest keeps the context honest.
+crates/**/target/
+**/*.rs.bk
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..7279f89
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,34 @@
+# Line endings are normalised on commit, so a checkout on Windows does not turn
+# every file into a diff, and the ASCII-only rule in AGENTS.md is not quietly
+# broken by a stray CR.
+* text=auto eol=lf
+
+# The icons are binary. git-lfs keeps them out of the packfile, and the `-text`
+# marker stops git from ever trying to reconcile two versions line by line.
+#
+# Any workflow that reads these files must check out with `lfs: true`. Without
+# it the working tree holds a pointer file, and the documentation build then
+# ships a few lines of text where an image was expected -- which fails as a
+# broken image rather than as a missing file, so it is worth stating here.
+*.png filter=lfs diff=lfs merge=lfs -text
+*.ico filter=lfs diff=lfs merge=lfs -text
+
+# One exemption, and it is not a matter of taste. DOCKERHUB.md points Docker
+# Hub's overview image at
+# raw.githubusercontent.com/lorem-dev/doppel/main/assets/icon-128.png, and that
+# endpoint serves the LFS *pointer* rather than the bytes -- verified on
+# 2026-08-11, 130 bytes of ASCII beginning "version
+# https://git-lfs.github.com/spec/v1". Tracked through LFS, the overview would
+# render a broken image, and nothing in this repository would fail to say so.
+# This file is small enough that a plain blob costs nothing.
+assets/icon-128.png -filter -diff -merge text=auto
+
+# The documentation's screenshots, for the same reason as the icons: a new
+# screenshot is a new whole file rather than a diff, and every UI change brings
+# one. `docs/screenshots/` is read only by the mkdocs build, whose workflow
+# checks out with `lfs: true` -- without that it would ship the pointer file as
+# a broken image.
+*.webp filter=lfs diff=lfs merge=lfs -text
+
+# An SVG is XML, and a readable diff is worth more than treating it as opaque.
+*.svg text
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df46591..e29c4d5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -64,10 +64,33 @@ jobs:
       # supposed to exercise the store and silently did not is worse than one
       # that failed.
       DOPPEL_REQUIRE_DATABASE: "1"
+      # Same idea as DOPPEL_REQUIRE_DATABASE, for the dashboard: the suites that
+      # exercise real asset delivery skip themselves when the binary was built
+      # without `frontend/dist`, which is right on a laptop and wrong here.
+      DOPPEL_REQUIRE_DASHBOARD_ASSETS: "1"
 
     steps:
+      # `lfs: true` because the icons are tracked through git-lfs and the frontend
+      # build copies the favicon out of `assets/`. Without it the checkout holds a
+      # pointer file and the copy lands a few lines of text where an image goes.
       - name: Checkout repository
         uses: actions/checkout@v7
+        with:
+          lfs: true
+
+      - name: Install Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      # Built here rather than pulled from the frontend job as an artifact: this
+      # keeps the two jobs independent and parallel, and twenty seconds of npm is
+      # cheaper than serialising the graph. The admin crate's build script embeds
+      # whatever is in `frontend/dist`, so this has to happen before `cargo test`.
+      - name: Build the dashboard for the admin crate to embed
+        run: npm --prefix frontend ci && npm --prefix frontend run build
 
       # No toolchain is named here. `rust-toolchain.toml` pins the channel and
       # the components, and rustup honours it; naming a version in the workflow
@@ -110,14 +133,22 @@ jobs:
       - name: Configuration schema is up to date
         run: uv run scripts/config_schema.py --check
 
+      # The parameter reference is generated from that schema, so it goes stale the
+      # same way and for the same reason: nobody regenerates a file by hand twice.
+      - name: Parameter reference is up to date
+        run: uv run scripts/parameters_doc.py --check
+
   docs:
     name: Documentation builds
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
+      # `lfs: true` for the icons the documentation shows; see the rust job.
       - name: Checkout repository
         uses: actions/checkout@v7
+        with:
+          lfs: true
 
       # Pinned to an exact release, unlike every other action here. astral-sh
       # publishes `v9.0.0` but stopped publishing the sliding major tag after
@@ -131,3 +162,111 @@ jobs:
       # moved.
       - name: Build the site (strict)
         run: uv run --with-requirements docs/requirements.txt mkdocs build --strict
+
+      # `--strict` catches a broken link between pages; this catches the links the
+      # dashboard builds at runtime, which mkdocs cannot see. A wrong fragment is
+      # silent in a browser -- the page opens at the top and nobody notices.
+      - name: Dashboard documentation links resolve
+        run: uv run scripts/check_docs_links.py
+
+  frontend:
+    name: Frontend lint, types, tests, size
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          lfs: true
+
+      - name: Install Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: frontend
+
+      - name: Lint
+        run: npm run lint
+        working-directory: frontend
+
+      # Two projects: the application and the Playwright suite. They have
+      # different globals -- jest's and Playwright's `expect` collide -- so a
+      # single project would have to pick one and leave the other unchecked.
+      - name: Types
+        run: npm run typecheck && npx tsc --noEmit -p tsconfig.e2e.json
+        working-directory: frontend
+
+      # Before the tests, because the bundle-size suite measures what this
+      # produces. A test that silently skipped when `dist` was missing would make
+      # the budget a preference again.
+      - name: Build
+        run: npm run build
+        working-directory: frontend
+
+      - name: Tests, including the bundle-size budgets
+        run: npm test
+        working-directory: frontend
+
+  e2e:
+    name: Dashboard end to end
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          lfs: true
+
+      - name: Install the toolchain pinned in rust-toolchain.toml
+        run: rustup show active-toolchain
+
+      - name: Cache cargo registry and target
+        uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      - name: Install Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: frontend
+
+      # The dashboard is embedded at compile time, so the order matters: build the
+      # assets, then the binary. Building the binary first embeds nothing and every
+      # scenario then fails against a 503.
+      - name: Build the dashboard
+        run: npm run build
+        working-directory: frontend
+
+      - name: Build the binary the specs drive
+        run: cargo build -p doppel-cli
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+        working-directory: frontend
+
+      - name: Run the scenarios
+        run: npm run e2e
+        working-directory: frontend
+
+      # Only on a failure, and only the report: a trace for a green run is an
+      # upload nobody opens.
+      - name: Upload the report
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report
+          path: frontend/playwright-report
+          retention-days: 7
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d4a0028..7b4c983 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -63,6 +63,11 @@ jobs:
           # mike reads and rewrites the gh-pages branch, so it needs history
           # rather than the default shallow clone of one ref.
           fetch-depth: 0
+          # The icons are tracked through git-lfs, and the build hook copies them
+          # into the docs tree. Without this the published site would carry a
+          # pointer file where the logo goes -- which renders as a broken image
+          # rather than failing the build.
+          lfs: true
 
       # Pinned to an exact release, unlike every other action here. astral-sh
       # publishes `v9.0.0` but stopped publishing the sliding major tag after
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index afe9811..1c0d2c3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,10 +30,47 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  frontend:
+    name: Build the dashboard
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      # `lfs: true` for the favicon the build copies out of `assets/`.
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+          lfs: true
+
+      - name: Install Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Build
+        run: npm ci && npm run build
+        working-directory: frontend
+
+      # Built once and handed to every build job. The opposite choice from CI,
+      # and for a reason: there are five of them here, so five npm builds would
+      # cost more than the artifact round trip -- and every binary published
+      # under one tag has to carry the same bytes.
+      - name: Upload the built dashboard
+        uses: actions/upload-artifact@v7
+        with:
+          name: dashboard
+          path: frontend/dist
+          retention-days: 1
+          if-no-files-found: error
+
   build:
     name: Build ${{ matrix.target }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
+    needs: frontend
 
     strategy:
       # One target failing should not throw away the others: they take
@@ -62,6 +99,16 @@ jobs:
 
       # `rust-toolchain.toml` pins the channel; only the target has to be added
       # on top of it, and `rustup target add` uses that same pinned toolchain.
+      # The admin crate's build script embeds whatever is in `frontend/dist`, so
+      # this has to land before `cargo build`. Without it the binary compiles and
+      # answers 503 at `/`, which is a release nobody would notice was broken
+      # until they opened it.
+      - name: Restore the built dashboard
+        uses: actions/download-artifact@v8
+        with:
+          name: dashboard
+          path: frontend/dist
+
       - name: Install the toolchain pinned in rust-toolchain.toml
         run: |
           rustup show active-toolchain
@@ -98,6 +145,7 @@ jobs:
 
   musl:
     name: Build ${{ matrix.target }} (for the image)
+    needs: frontend
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
 
@@ -135,6 +183,16 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             -o DPkg::Lock::Timeout=300 musl-tools
 
+      # The admin crate's build script embeds whatever is in `frontend/dist`, so
+      # this has to land before `cargo build`. Without it the binary compiles and
+      # answers 503 at `/`, which is a release nobody would notice was broken
+      # until they opened it.
+      - name: Restore the built dashboard
+        uses: actions/download-artifact@v8
+        with:
+          name: dashboard
+          path: frontend/dist
+
       - name: Install the toolchain pinned in rust-toolchain.toml
         run: |
           rustup show active-toolchain
@@ -237,6 +295,12 @@ jobs:
         with:
           context: .
           platforms: linux/amd64,linux/arm64
+          # The Dockerfile compiles a binary when none is staged, and this job
+          # always stages one -- so it points the builder stage at a base with no
+          # toolchain in it. Without this the build pulls a Rust image, for both
+          # platforms, to run a `cp`.
+          build-args: |
+            BUILDER=alpine:3.24
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -326,6 +390,37 @@ jobs:
           # flatten them into one directory.
           merge-multiple: true
 
+      # The one thing that cannot be checked before the archives exist: that the
+      # binaries about to be published actually carry the dashboard. The build
+      # script embeds `frontend/dist` silently -- a missing artifact yields a
+      # binary that compiles, passes nothing that would notice, and answers 503 at
+      # `/` for whoever downloads it. Grepping for the configuration element is
+      # enough: it comes from `index.html`, so its presence means the page was
+      # embedded.
+      - name: Every published binary carries the dashboard
+        run: |
+          set -euo pipefail
+          found=0
+          for archive in dist/doppel-*.tar.gz; do
+            tmp=$(mktemp -d)
+            tar -xzf "$archive" -C "$tmp"
+            binary=$(find "$tmp" -type f -name doppel -perm -u+x | head -1)
+            if [ -z "$binary" ]; then
+              echo "no doppel binary inside $archive" >&2
+              exit 1
+            fi
+            if ! grep -qa 'id="doppel-config"' "$binary"; then
+              echo "$archive was built without the dashboard" >&2
+              exit 1
+            fi
+            echo "$archive carries the dashboard"
+            found=$((found + 1))
+          done
+          if [ "$found" -eq 0 ]; then
+            echo "no archives were checked" >&2
+            exit 1
+          fi
+
       # Attached so a configuration can be validated against the exact release
       # it will run under, rather than against whatever `main` says today. The
       # checked-in file is taken as-is: CI has already refused a stale one
diff --git a/.gitignore b/.gitignore
index 97987e3..56b142a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,15 +3,35 @@
 **/*.rs.bk
 *.pdb
 
-# Runtime artifacts
+# Runtime artifacts. Anchored with a leading slash, all of them: `config/`
+# without one matches a directory of that name at any depth, which quietly
+# covered `crates/doppel-core/src/config/` -- git keeps tracking files it
+# already knows, so nothing failed, but every editor drew the crate's own
+# configuration module as excluded.
 /templates
 *.sock
-main.yaml
+/main.yaml
+# The configuration the compose file mounts, and anything else kept beside it.
+/config/
 .env
 
 # mkdocs build output
 /site
 
+# Staged into the docs tree from assets/ by scripts/mkdocs_assets.py on every
+# build. Committing the copy would be two files claiming to be the same icon.
+/docs/assets
+
+# Frontend build and tooling output. `dist` is what the admin crate's build
+# script embeds, so it is generated on the way to a binary and never committed;
+# `public/favicon.ico` is copied in from assets/ by the prebuild script.
+/frontend/node_modules
+/frontend/dist
+/frontend/coverage
+/frontend/playwright-report
+/frontend/test-results
+/frontend/public/favicon.ico
+
 # Python tooling for mkdocs
 .venv
 __pycache__/
diff --git a/AGENTS.md b/AGENTS.md
index 7e9571e..d9c8326 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -23,12 +23,23 @@ cannot drift.
 `usage/` for how to use it, `development/` for how to work on it.
 `.superpowers/specs/` (git-ignored, not shipped) holds the full design.
 
+`frontend/` is the browser dashboard the admin listener serves; see
+[the frontend](#the-frontend) below before touching it.
+
 ---
 
 ## Running the Gates
 
 Prerequisites: a stable Rust toolchain via rustup (pinned in
-`rust-toolchain.toml`, with `rustfmt` and `clippy`)
+`rust-toolchain.toml`, with `rustfmt` and `clippy`), Node for the dashboard, and
+`uv` for the Python tooling.
+
+```bash
+make gate     # everything below, in the right order
+make help     # every target, with a description
+```
+
+The Rust half by hand:
 
 ```bash
 cargo fmt --check                          # formatting
@@ -36,16 +47,33 @@ cargo clippy --all-targets -- -D warnings  # lints, warnings are errors
 cargo test                                 # tests
 ```
 
-All of these must pass before a pull request is ready.
+All of these must pass before a pull request is ready. `make gate` leaves out
+`make e2e`, which downloads a browser on first run -- run it too when the change
+touches `frontend/` or the dashboard routes.
 
 ### Verification workflow
 
-Run the full gate (`cargo fmt --check`, `cargo clippy`, `cargo test`) as a single
-dedicated step at the END of a change -- not after every task. While iterating,
-write only the minimal tests needed to guarantee the code works, and run just the
-focused test for what you changed (at most a quick `cargo test -p <crate>`).
-The comprehensive gate above is the single final check before a change is
-considered done or a pull request opened.
+Run `make gate` as a single dedicated step at the END of a change -- not after
+every task, and not while iterating. It builds the dashboard, runs both Rust
+suites, jest, the bundle budgets, mkdocs and three generators; on a change to one
+file, nearly all of that re-checks code the change did not touch.
+
+While iterating, run only what addresses the part being changed:
+
+| Changed | Run |
+| --- | --- |
+| a crate | `cargo test -p <crate> <name>`, `cargo clippy -p <crate>`, `cargo fmt` |
+| `frontend/src` | `npm --prefix frontend test -- <file>`, `npx eslint <file>`, `npx tsc --noEmit` |
+| the dashboard's behaviour in a browser | `npx playwright test <spec>` |
+| `docs/`, a doc comment, a docs link | `make docs`, `make parameters`, `make links`, separately |
+| a config type or its schema | `make schema` |
+| a dependency | `make licences` |
+
+Write only the minimal tests needed to guarantee the code works, and check a new
+test by mutation with the same focused run -- not with the gate.
+
+`make gate` is the single final check before a change is considered done or a
+pull request opened. Read its exit code as its own step, then commit.
 
 Capture the gate's output when you report it. Over this project's history,
 several reports stated test counts or quoted compiler diagnostics that did not
@@ -127,9 +155,64 @@ for it:
 | `check-changes` | After a batch of commits -- verify CHANGES.md (Development section) reflects every change. |
 | `check-docs` | Before a release or after updating commands/options -- verify docs/ and README.md are current. |
 | `run-tests-and-linters` | Before marking any task done -- run `cargo fmt --check`, `cargo clippy --all-targets -- -D warnings` and `cargo test`, and capture the output. |
-| `check-licenses` | After editing any `Cargo.toml` -- verify every direct dependency is licence-compliant and update LICENSE. |
+| `check-licenses` | After editing any `Cargo.toml` or `frontend/package.json` -- verify every direct dependency is licence-compliant and regenerate LICENSE and THIRD-PARTY.md. |
 | `pre-release-check` | Before cutting a release -- runs the five `check-*` and `run-*` skills above (not `bump-version`) plus version-bump and commit-format checks. |
 
+## The frontend
+
+`frontend/` holds the dashboard: TypeScript, React, react-router, zustand,
+Tailwind, built by vite. `docs/development/architecture.md` has the reasoning;
+what follows is what you need before editing it.
+
+```
+frontend/src/
+  components/   presentational; may not import a service (eslint enforces it)
+  pages/        one screen each: fetches, holds its state, renders components
+  services/     the only code that talks to the API
+  store/        state that outlives one screen (zustand)
+  types/        the API's shapes, and the one error type
+frontend/e2e/
+  src/          the harness the specs drive: the server, its configurations
+  tests/        the Playwright specs
+```
+
+Four things that will otherwise cost you an hour each:
+
+- **The assets are embedded at compile time.** `npm run build` alone changes
+  nothing about a running binary; `cargo build` after it is what re-embeds them.
+  A binary built with no `frontend/dist` compiles and answers 503 at `/`.
+- **jest cannot render anything that routes.** react-router ships ESM only and
+  uses `import.meta`, which does not survive the transform to CommonJS. Anything
+  that navigates belongs in the Playwright suite, against a real browser and a
+  real binary.
+- **Rights are read through `useMay()`, and that is not decoration.** It
+  subscribes to the report so the component re-renders when rights arrive. A hook
+  that returned the same callback without subscribing would leave every gated
+  control disabled for the life of the page -- which is what happened, and what
+  the Playwright suite caught. `permits()` holds the precedence rules; there is
+  deliberately no second way to ask.
+- **TypeScript is pinned to 5.9 on purpose.** typescript-eslint declares
+  `<6.1.0` and ts-jest declares `<7`, so the latest compiler is one no linter
+  accepts yet. Raising it breaks the lint, not the build.
+
+Commands: `make frontend`, `make test-frontend`, `make size`, `make e2e`.
+
+`npm ci` prints deprecation warnings for `inflight`, `glob@7`, `glob@10` and
+`whatwg-encoding`. All four are inside jest's own tree -- `@jest/transform` and
+`@jest/reporters` pull the globs, jsdom pulls the encoder -- so nothing there
+ships: the redistributed set is the ten packages in `THIRD-PARTY.md`, none of them
+these. They are deliberately not silenced with `overrides`, which would pin
+versions jest was not tested against to quieten a message about a package the
+project does not distribute.
+
+`frontend/package.json` carries no `version`: the page shows the *binary's*
+version, taken from the configuration the listener injects, and a second version
+in a second file is a second thing to forget at release time.
+
+The favicon is generated from `assets/favicon.svg`; the command that rebuilds
+`assets/favicon.ico` is in a comment at the top of that file. `assets/` is staged
+into `docs/assets/` by the mkdocs build hook, and `docs/assets/` is git-ignored.
+
 <!-- CODEGRAPH_START -->
 ## CodeGraph
 
diff --git a/CHANGES.md b/CHANGES.md
index 40b0878..9dc8f56 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,6 +8,47 @@ release promotes it to a version heading; the `bump-version` skill does that.
 
 ## Development
 
+### Added
+
+- `rewrite_urls` (default on): the upstream's own address is replaced by Doppel's
+  inside text bodies it relays, so a page or a JSON document cannot send a client
+  past every fault and mock. Exact host only.
+- Metrics that exist before anything happens: `doppel_build_info`,
+  `doppel_dashboard_info`, `doppel_proxy_last_error_timestamp_seconds` and
+  `doppel_proxy_mocks`, the last following the configuration in force.
+- `doppel_admin_request_duration_seconds`, the admin API's own latency, labelled
+  by route template so path and query parameters cannot multiply series.
+- `server.external_url` and `DOPPEL_EXTERNAL_URL`: the address clients reach
+  Doppel at, used when rewriting an upstream's redirects.
+- A browser dashboard on the admin listener's root, compiled into the binary:
+  proxy CRUD, mock templates, status and reload. `admin.dashboard`, `admin.title`.
+- `GET /api/v1/access` reports the calling token's own rights, so a client can
+  disable an action instead of offering it and being refused.
+- A Makefile: `make help` lists every target, `make gate` runs the whole check
+  suite.
+
+### Changed
+
+- The Prometheus exposition is `GET /metrics` again, the path every scraper
+  looks for; under `/api/v1/` the dashboard answered scrapes with HTML.
+- `doppel_proxy_request_duration_seconds` carries `replace`, `loss` and
+  `upstream_error`, and its buckets reach 60s for injected latency.
+- The admin listener accepts a trailing slash on every path. The proxy listener
+  still relays one verbatim.
+- The admin listener compresses its responses, `br` or `gzip`, so the dashboard
+  is 74 KB on the wire instead of 140 KB, and `index.html` is minified.
+- The Swagger UI is `/swagger-ui/` and the OpenAPI document `/openapi.json`,
+  both outside `/api/`: a page and a description, not resources of the API.
+- A write through the admin API is in force when it answers: it promotes the
+  stored configuration before replying, so no reload is needed.
+- A rewritten `Location` names Doppel's host instead of being relative, and now
+  covers a redirect to the upstream's own host outside the proxied path.
+
+- The PostgreSQL store keeps the configuration as JSON, so a new field no longer
+  needs a migration. Migration 0005 backfills it.
+- **Breaking:** every admin endpoint now lives under `/api/`. `/status` and
+  `/metrics` moved to `/api/v1/`, the OpenAPI document and Swagger UI to `/api/`.
+
 ## 0.4.1 -- 2026-08-11
 
 ### Added
diff --git a/Cargo.lock b/Cargo.lock
index 1f7e1f7..1e4f439 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -26,6 +26,21 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -115,6 +130,18 @@ dependencies = [
  "rustversion",
 ]
 
+[[package]]
+name = "async-compression"
+version = "0.4.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3976abdc8fe7d1133d43d304afd42abdf5bc3e1319d263d223bde07b5efc4be8"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.91"
@@ -279,6 +306,27 @@ dependencies = [
  "objc2",
 ]
 
+[[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -403,6 +451,24 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "compression-codecs"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+dependencies = [
+ "brotli",
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
+
 [[package]]
 name = "const-oid"
 version = "0.10.2"
@@ -596,6 +662,7 @@ dependencies = [
  "async-trait",
  "axum",
  "doppel-core",
+ "httpdate",
  "metrics",
  "metrics-exporter-prometheus",
  "serde",
@@ -603,6 +670,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "tower",
+ "tower-http",
  "tracing",
  "utoipa",
  "utoipa-swagger-ui",
@@ -657,6 +725,7 @@ name = "doppel-proxy"
 version = "0.4.1"
 dependencies = [
  "axum",
+ "bytes",
  "doppel-core",
  "doppel-render",
  "futures-util",
@@ -792,6 +861,7 @@ version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
+ "crc32fast",
  "miniz_oxide",
  "zlib-rs",
 ]
@@ -3143,12 +3213,16 @@ version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
+ "async-compression",
  "bitflags",
  "bytes",
+ "futures-core",
  "futures-util",
  "http",
  "http-body",
  "pin-project-lite",
+ "tokio",
+ "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
diff --git a/Cargo.toml b/Cargo.toml
index d06a5d5..a2d2ba9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,12 @@ arc-swap = "1.9"
 async-trait = "0.1"
 axum = "0.8"
 clap = { version = "4", features = ["derive", "env"] }
+bytes = "1"
 futures-util = "0.3"
+# Already in the tree under hyper, and the only calendar in it. The dashboard's
+# footer needs the year the binary was built, and turning a unix timestamp into
+# one is leap years and century rules -- not arithmetic worth writing here.
+httpdate = "1"
 metrics = "0.24"
 metrics-exporter-prometheus = { version = "0.18", default-features = false }
 minijinja = "2"
@@ -63,6 +68,13 @@ tokio = { version = "1", features = [
     "time",
 ] }
 tower = "0.5"
+# Already in the graph through utoipa-swagger-ui. Two features are taken from it:
+# response compression for the admin listener, which is the reason a dashboard
+# does not have to ship 140 KB uncompressed.
+tower-http = { version = "0.6", default-features = false, features = [
+  "compression-gzip",
+  "compression-br",
+] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 
diff --git a/DOCKERHUB.md b/DOCKERHUB.md
index 45127aa..7814717 100644
--- a/DOCKERHUB.md
+++ b/DOCKERHUB.md
@@ -14,7 +14,7 @@
      a version that exists. The version checked in is the last one released;
      the tags table stays illustrative, like the documentation's. -->
 
-![Doppel](https://raw.githubusercontent.com/lorem-dev/doppel/main/docs/assets/icon-128.png)
+![Doppel](https://raw.githubusercontent.com/lorem-dev/doppel/main/assets/icon-128.png)
 
 # Doppel
 
@@ -60,14 +60,14 @@ start.
 ```bash
 docker run --rm \
   -p 8080:8080 -p 8081:8081 \
-  -v "$PWD/main.yaml:/etc/doppel/main.yaml:ro" \
+  -v "$PWD/config:/etc/doppel" \
   -v doppel-templates:/var/lib/doppel/templates \
   loremdev/doppel:0.1.0-alpine
 ```
 
 `8080` carries proxied traffic, `8081` the admin API.
 
-A minimal `main.yaml`:
+A minimal `config/main.yaml`:
 
 ```yaml
 server:
@@ -120,12 +120,12 @@ services:
       - "8080:8080"
       - "8081:8081"
     volumes:
-      - ./main.yaml:/etc/doppel/main.yaml:ro
+      - ./config:/etc/doppel
       - doppel-templates:/var/lib/doppel/templates
     environment:
       DOPPEL_ADMIN_TOKENS: '{"ci":{"token":"...","group":"admin"}}'
     healthcheck:
-      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8081/status"]
+      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8081/api/v1/status"]
       interval: 5s
       timeout: 3s
       start_period: 5s
@@ -135,11 +135,22 @@ volumes:
   doppel-templates:
 ```
 
-`/status` needs no token by default and answers only once the runtime is
+`/api/v1/status` needs no token by default and answers only once the runtime is
 compiled and both listeners are bound. `-f` matters: without it `curl` exits 0
 on a 500 and the check passes for answering at all rather than for answering
 correctly.
 
+## The dashboard
+
+The admin port serves a browser dashboard from its root -- the proxy set, a form
+over every field of a proxy, mock templates, status and reload -- compiled into
+the image. Publish `8081` as the quick start above does and open
+`http://127.0.0.1:8081/`.
+
+It is a client of the admin API and bound by the same token rules, so it offers
+only what the caller's token may actually do. `admin.dashboard: false` turns it
+off; the JSON API is unaffected either way.
+
 ## Tokens
 
 `DOPPEL_ADMIN_TOKENS` keeps secrets out of the configuration file that gets
@@ -165,7 +176,11 @@ curl -X POST -H "X-Proxy-Authorization: Bearer $TOKEN" \
 docker exec <container> doppel config reload --socket /tmp/doppel.sock
 ```
 
-Editing a bind-mounted `main.yaml` on the host changes the file the container
+The directory is mounted rather than the file on purpose: a save renames a new
+file over the old one, and a file that is itself a mount point cannot be replaced --
+the admin API would refuse every write with "Resource busy".
+
+Editing `config/main.yaml` on the host changes the file the container
 reads, so a reload picks it up without restarting anything.
 
 ## What the image contains
diff --git a/Dockerfile b/Dockerfile
index a49f7d0..82bf341 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,33 +1,120 @@
 # Doppel, on Alpine.
 #
-# The binary is built outside this file and copied in -- see the `docker` job
-# in .github/workflows/release.yml. Building Rust inside a multi-architecture
-# `docker buildx` means QEMU emulation for the non-native architecture, which
-# turns a two-minute compile into most of an hour. Copying an already-built
-# binary makes the image build the same speed on both.
+# Prefers an already-built binary and compiles one only when none was staged.
 #
-# Build locally against a binary you already have:
+# The preference is not a style choice. Building Rust inside a multi-architecture
+# `docker buildx` means QEMU emulation for the non-native architecture, which turns
+# a two-minute compile into most of an hour -- so the release workflow builds each
+# binary on a native runner and stages it, and this file copies it in.
 #
-#   cargo build --release --target x86_64-unknown-linux-musl -p doppel-cli
-#   mkdir -p dist && cp target/x86_64-unknown-linux-musl/release/doppel dist/
-#   docker build --build-arg BIN=dist/doppel -t doppel:dev .
+# The fallback exists because a developer should not have to know that. `docker
+# build -t doppel:dev .` works with an empty `dist/`: the binary is compiled in the
+# builder stage below, for the platform being built, with no cross toolchain on the
+# host. `make image` stages one first and this file then skips the compile.
 #
-# The binary must be musl-linked. A glibc build does not run here, and the
-# failure is a bare "not found" from the shell rather than anything that says
-# why.
+#   docker build -t doppel:dev .   # compiles inside, or uses dist/ if it is there
+#   make image                     # builds the dashboard first, then this
+#
+# The dashboard is built inside too, when `frontend/dist` is not in the context. It
+# is embedded at compile time, so a binary built without it answers 503 at its own
+# root -- and a fresh checkout should not have to know that before it can build an
+# image. `make image` still builds it on the host first, which is faster and is what
+# a working checkout already has.
+#
+# A binary you built yourself is used by putting it at `dist/doppel`, or at
+# `dist/<platform>/doppel` for a multi-platform build. There is no build argument
+# to point elsewhere: one place to look is one thing to get wrong.
+#
+# A staged binary must be musl-linked. A glibc build does not run here, and the
+# failure is a bare "not found" from the shell rather than anything that says why.
 
-FROM alpine:3.24
+# The toolchain from rust-toolchain.toml, so a compile here matches a compile on a
+# host. Override with `--build-arg BUILDER=alpine:3.24` when the binary is
+# certainly staged: the copy branch needs no toolchain, and the release workflow
+# passes exactly that to avoid pulling a Rust image it will not use.
+ARG BUILDER=rust:1.94.0-alpine
 
-# `TARGETPLATFORM` is set by buildx per platform (`linux/amd64`,
-# `linux/arm64`), so one Dockerfile picks the right binary out of a directory
-# laid out by platform without emulating anything.
-#
-# `BIN` defaults from it and can be overridden for a build by hand, where
-# there is one binary and no buildx:
+FROM ${BUILDER} AS builder
+
+# Set by buildx per platform, and the layout the release workflow stages into:
+# `dist/linux/amd64/doppel`, `dist/linux/arm64/doppel`. This is what lets one
+# Dockerfile pick the right binary out of a multi-platform build without emulating
+# anything.
 #
-#   docker build --build-arg BIN=dist/doppel -t doppel:dev .
+# `TARGETOS`/`TARGETARCH` are looked at as well as `TARGETPLATFORM`, because they
+# do not always agree: the classic builder reports `linux/arm64/v8` where buildx
+# reports `linux/arm64`, and a directory named after the first would be a binary
+# nobody finds.
 ARG TARGETPLATFORM
-ARG BIN=dist/${TARGETPLATFORM}/doppel
+ARG TARGETOS
+ARG TARGETARCH
+
+WORKDIR /src
+
+# Whatever is in `dist/`, if anything.
+#
+# `.dockerignore` is always in the context, so this always has one source that
+# matches and cannot fail when nothing was staged -- which is the whole point of
+# the fallback. Docker has no conditional `COPY`, and this is how "copy it if it is
+# there" is expressed. `dist*` rather than a path into it: a glob tolerates a
+# missing file but not a missing parent directory, and `dist/linux/arm64/` is
+# exactly the parent that does not exist on a laptop.
+COPY .dockerignore dist* /staged/
+
+# The workspace, for the branch that compiles. Bounded by `.dockerignore`, which
+# admits the crates, the manifests and the built dashboard and nothing else.
+COPY . .
+
+# One of two things, decided by what was staged.
+#
+# The compile branch needs `frontend/dist`, because the admin crate embeds whatever is
+# there and an empty directory yields a binary that starts, serves the API, and
+# answers 503 at its own root. So it builds the dashboard when nobody has: the
+# alternative was refusing, which meant the image could not be built from a fresh
+# checkout without knowing to run `make frontend` first.
+RUN set -eu; \
+    staged=""; \
+    for candidate in \
+        "/staged/${TARGETPLATFORM}/doppel" \
+        "/staged/${TARGETOS}/${TARGETARCH}/doppel" \
+        "/staged/doppel"; \
+    do \
+        if [ -f "$candidate" ]; then staged="$candidate"; break; fi; \
+    done; \
+    if [ -n "$staged" ]; then \
+        echo "doppel: using the binary staged at $staged"; \
+        install -m 0755 "$staged" /doppel; \
+        exit 0; \
+    fi; \
+    echo "doppel: nothing staged for ${TARGETPLATFORM}, compiling"; \
+    if ! command -v cargo >/dev/null; then \
+        echo "doppel: this builder image has no Rust toolchain, and there is no" >&2; \
+        echo "        binary in dist/ to copy. Either stage one or drop the" >&2; \
+        echo "        BUILDER build argument, whose default carries a toolchain." >&2; \
+        exit 1; \
+    fi; \
+    if [ ! -f frontend/dist/index.html ]; then \
+        if [ ! -f frontend/package.json ]; then \
+            echo "doppel: there is no built dashboard in frontend/dist and no frontend" >&2; \
+            echo "        sources to build one from. Check .dockerignore, or stage a" >&2; \
+            echo "        binary in dist/." >&2; \
+            exit 1; \
+        fi; \
+        echo "doppel: no dashboard in frontend/dist, building it"; \
+        apk add --no-cache nodejs npm >/dev/null; \
+        npm --prefix frontend ci; \
+        npm --prefix frontend run build; \
+    fi; \
+    if [ ! -f frontend/dist/index.html ]; then \
+        echo "doppel: the dashboard build produced no frontend/dist/index.html, and a" >&2; \
+        echo "        binary embedding nothing answers 503 at its own root." >&2; \
+        exit 1; \
+    fi; \
+    apk add --no-cache musl-dev >/dev/null; \
+    cargo build --release --locked -p doppel-cli; \
+    install -m 0755 target/release/doppel /doppel
+
+FROM alpine:3.24
 
 # `ca-certificates` is not optional: a proxy whose upstream is https cannot
 # verify it without a trust store, and the failure surfaces as UPSTREAM_ERROR
@@ -58,7 +145,8 @@ RUN apk add --no-cache ca-certificates curl tini
 # which is the right answer in a container.
 RUN addgroup -S doppel && adduser -S -G doppel -h /var/lib/doppel doppel
 
-COPY --chmod=0755 ${BIN} /usr/local/bin/doppel
+# From the builder stage, which either copied the staged binary or compiled one.
+COPY --from=builder /doppel /usr/local/bin/doppel
 
 # Two mount points, both owned by the runtime user.
 #
diff --git a/LICENSE b/LICENSE
index 0620daa..bd0273e 100644
--- a/LICENSE
+++ b/LICENSE
@@ -210,11 +210,18 @@ This project uses the following third-party libraries. Each library
 retains its original copyright and is distributed under its respective
 license.
 
-The 26 crates below are the ones this workspace names directly. A
-released binary links its dependencies statically, so it also contains their
-dependencies: the complete list, generated from the resolve graph, is in
+The packages below are the ones this project names directly: the crates in
+`Cargo.toml`, and the npm packages in `frontend/package.json` whose code is
+compiled into the dashboard. A released binary links its crates statically and
+embeds that dashboard, so it also contains everything those depend on: the
+complete list, generated from both resolve graphs, is in
 [THIRD-PARTY.md](THIRD-PARTY.md).
 
+Build-time npm packages -- vite, jest, eslint, tailwind's compiler and the
+tooling underneath them -- are deliberately absent. They run on a developer's
+machine and ship nowhere, so listing them would claim a redistribution that does
+not happen.
+
 | Package | Ecosystem | Version | License |
 |---|---|---|---|
 | anyhow | crates.io | 1.0.104 | MIT OR Apache-2.0 |
@@ -243,4 +250,9 @@ dependencies: the complete list, generated from the resolve graph, is in
 | tracing-subscriber | crates.io | 0.3.23 | MIT |
 | utoipa | crates.io | 5.5.0 | MIT OR Apache-2.0 |
 | utoipa-swagger-ui | crates.io | 9.0.2 | MIT OR Apache-2.0 |
-
+| prismjs | npm | 1.30.0 | MIT |
+| react | npm | 19.2.8 | MIT |
+| react-dom | npm | 19.2.8 | MIT |
+| react-router | npm | 8.3.0 | MIT |
+| react-simple-code-editor | npm | 0.14.1 | MIT |
+| zustand | npm | 5.0.14 | MIT |
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..d004d03
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,203 @@
+# Doppel, in one command at a time.
+#
+# Nothing here is required to work on the project -- every target is a short
+# sequence of `cargo`, `npm` and `uv` that could be typed out instead. What it
+# buys is the ordering that is easy to get wrong: the dashboard is embedded into
+# the binary at compile time, so the assets have to be built *before* cargo runs,
+# and the image needs a musl binary staged where the Dockerfile expects it.
+#
+# `make` on its own prints the list.
+
+CARGO ?= cargo
+NPM ?= npm
+UV ?= uv
+FRONTEND ?= frontend
+
+# The image's tag. Override for a real publish: `make image IMAGE=loremdev/doppel:1.2.3-alpine`.
+IMAGE ?= doppel:dev
+
+# Nothing here sets a target for an ordinary build: `cargo build` produces a binary
+# for the machine it runs on, which is what `build` and `release` mean on any
+# platform.
+#
+# The image needs a Linux one, and that is the Dockerfile's problem rather than
+# this file's: it uses a binary staged in `dist/` when there is one and compiles
+# inside its own builder stage when there is not. Which is what makes `make image`
+# work on a Mac, where `ring` cannot be linked against musl without a cross
+# toolchain nobody has installed.
+
+# A database for the store suites. The port is deliberately not 5432; see
+# docker-compose.yml.
+TEST_DATABASE_URL ?= postgres://doppel:doppel@127.0.0.1:55432/doppel
+
+.DEFAULT_GOAL := help
+
+# Every target here is a name, not a file, so make must not go looking for one
+# and must not skip a target because a directory of that name happens to exist --
+# `frontend`, `docs` and `dist` all do.
+.PHONY: build release frontend run gate fmt fmt-check lint test test-db \
+        test-frontend size e2e schema schema-write licences licences-write \
+        docs docs-serve image image-rebuild image-run db-up db-down migrate \
+        clean clean-frontend help
+
+# ---------------------------------------------------------------------------
+# Building
+# ---------------------------------------------------------------------------
+
+build: frontend ## Build the debug binary with the dashboard embedded
+	$(CARGO) build
+
+release: frontend ## Build the release binary with the dashboard embedded
+	$(CARGO) build --release
+
+frontend: ## Build the dashboard into frontend/dist
+	$(NPM) --prefix $(FRONTEND) ci
+	$(NPM) --prefix $(FRONTEND) run build
+
+run: build ## Run the debug binary against ./config/main.yaml
+	./target/debug/doppel serve --config config/main.yaml
+
+# ---------------------------------------------------------------------------
+# Checks
+# ---------------------------------------------------------------------------
+
+gate: fmt-check lint test test-frontend size docs schema parameters links licences ## Everything CI checks, except the browser suite
+	@echo "gate: clean"
+
+fmt: ## Format the Rust sources
+	$(CARGO) fmt --all
+
+fmt-check: ## Fail if anything is unformatted
+	$(CARGO) fmt --all --check
+
+lint: ## Clippy with warnings as errors, eslint, and both TypeScript projects
+	$(CARGO) clippy --workspace --all-targets -- -D warnings
+	$(NPM) --prefix $(FRONTEND) run lint
+	$(NPM) --prefix $(FRONTEND) run typecheck
+	cd $(FRONTEND) && npx tsc --noEmit -p tsconfig.e2e.json
+
+# The dashboard is built first and required, so the asset-delivery suites cannot
+# skip themselves the way they may on a machine with no Node. Same reasoning as
+# DOPPEL_REQUIRE_DATABASE, which is set only when a database is actually up.
+test: frontend ## Run the Rust suites, requiring the embedded dashboard
+	DOPPEL_REQUIRE_DASHBOARD_ASSETS=1 $(CARGO) test --workspace
+
+test-db: frontend ## Run the Rust suites with the PostgreSQL store required
+	DOPPEL_REQUIRE_DASHBOARD_ASSETS=1 \
+	DOPPEL_REQUIRE_DATABASE=1 \
+	DOPPEL_TEST_DATABASE_URL=$(TEST_DATABASE_URL) \
+	$(CARGO) test --workspace
+
+test-frontend: frontend ## Run the jest suites and the bundle-size budgets
+	$(NPM) --prefix $(FRONTEND) test
+
+size: frontend ## Report what the dashboard weighs, gzipped
+	@cd $(FRONTEND) && node -e "\
+		const { gzipSync } = require('node:zlib'); \
+		const { readdirSync, readFileSync } = require('node:fs'); \
+		const dir = 'dist/assets'; let total = 0; \
+		for (const file of readdirSync(dir).sort()) { \
+			const kb = gzipSync(readFileSync(dir + '/' + file)).length / 1024; \
+			total += kb; \
+			console.log(kb.toFixed(1).padStart(7) + ' KB  ' + file); \
+		} \
+		console.log(total.toFixed(1).padStart(7) + ' KB  total'); \
+	"
+
+# Not part of `gate`: it downloads a browser on first run and takes half a minute,
+# which is the wrong trade for a check meant to be run constantly.
+e2e: build ## Drive the built binary with Playwright
+	cd $(FRONTEND) && npx playwright install chromium
+	$(NPM) --prefix $(FRONTEND) run e2e
+
+schema: ## Fail if doppel-config.schema.json is stale
+	$(UV) run scripts/config_schema.py --check
+
+schema-write: ## Regenerate doppel-config.schema.json
+	$(UV) run scripts/config_schema.py
+
+licences: ## Fail if THIRD-PARTY.md is stale, or a licence is outside the policy
+	$(UV) run scripts/third_party.py --check
+
+licences-write: frontend ## Regenerate THIRD-PARTY.md from both dependency graphs
+	$(UV) run scripts/third_party.py
+
+# ---------------------------------------------------------------------------
+# Documentation
+# ---------------------------------------------------------------------------
+
+parameters: ## Fail if the generated parameter reference is stale
+	$(UV) run scripts/parameters_doc.py --check
+
+links: ## Fail if the dashboard links to documentation that is not there
+	$(UV) run scripts/check_docs_links.py
+
+docs: ## Build the documentation site, strictly
+	$(UV) run --with-requirements docs/requirements.txt mkdocs build --strict
+
+docs-serve: ## Serve the documentation with live reload
+	$(UV) run --with-requirements docs/requirements.txt mkdocs serve
+
+# ---------------------------------------------------------------------------
+# The image
+# ---------------------------------------------------------------------------
+
+# The Dockerfile takes an already-built binary rather than compiling inside a
+# multi-architecture build, where the non-native half runs under emulation and
+# turns a two-minute compile into most of an hour. So the binary is built first,
+# for this machine's architecture, and staged where the default BIN points.
+image: frontend ## Build the container image for this architecture
+	docker build -t $(IMAGE) .
+
+# `rm -rf dist` as well as `--no-cache`: a binary left there from an earlier build
+# is what the image would use, and "from scratch" has to mean the compile happens.
+image-rebuild: clean-frontend ## Build the image from scratch: no npm or docker cache
+	$(NPM) --prefix $(FRONTEND) ci
+	$(NPM) --prefix $(FRONTEND) run build
+	rm -rf dist
+	docker build --no-cache -t $(IMAGE) .
+
+image-run: ## Run the built image against ./config/main.yaml
+	docker run --rm -p 8080:8080 -p 8081:8081 \
+		-v "$(PWD)/config:/etc/doppel:ro" \
+		$(IMAGE)
+
+# ---------------------------------------------------------------------------
+# The development database
+# ---------------------------------------------------------------------------
+
+db-up: ## Start PostgreSQL and wait for it
+	docker compose up -d --wait postgres
+
+db-down: ## Stop PostgreSQL and remove its volume
+	docker compose down -v
+
+migrate: build ## Apply the migrations to the development database
+	DOPPEL_DATABASE_URL=$(TEST_DATABASE_URL) ./target/debug/doppel config migrate
+
+# ---------------------------------------------------------------------------
+# Cleaning
+# ---------------------------------------------------------------------------
+
+clean: clean-frontend ## Remove every build artifact
+	$(CARGO) clean
+	rm -rf dist site
+
+clean-frontend: ## Remove the dashboard's build output
+	rm -rf $(FRONTEND)/dist $(FRONTEND)/playwright-report $(FRONTEND)/test-results
+
+# ---------------------------------------------------------------------------
+# Help
+# ---------------------------------------------------------------------------
+
+# Every target documented with `## ...` on its own line, in file order, so the
+# list cannot drift from the targets: a target without a comment simply does not
+# appear, and one that is renamed takes its description with it.
+help: ## Print this list
+	@printf 'Doppel. Targets:\n\n'
+	@grep -hE '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) \
+		| awk 'BEGIN { FS = ":.*?## " } { printf "  \033[1m%-16s\033[0m %s\n", $$1, $$2 }'
+	@printf '\nThis machine: %s. An ordinary build targets it. The image needs a\n' \
+		'$(shell uname -s -m)'
+	@printf 'Linux binary, which the Dockerfile compiles inside unless dist/ holds one.\n'
+	@printf '\nVariables: IMAGE=%s\n' '$(IMAGE)'
diff --git a/README.md b/README.md
index f79549b..de638da 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 <p align="center">
-    <img src="/docs/assets/icon.svg" width="64" alt="Doppel Logo">
+    <img src="/assets/icon.svg" width="64" alt="Doppel Logo">
 </p>
 
 <h1 align="center">$$Doppel{\color{lightblue}ganger}$$</h1>
@@ -37,7 +37,7 @@ Or run the image:
 
 ```bash
 docker run --rm -p 8080:8080 -p 8081:8081 \
-  -v "$PWD/main.yaml:/etc/doppel/main.yaml:ro" \
+  -v "$PWD/config:/etc/doppel" \
   loremdev/doppel:1.2.3-alpine
 ```
 
@@ -61,6 +61,12 @@ version. See
   concurrency, template upload, reload, a status endpoint, Prometheus metrics
   and a generated Swagger UI, behind token access control. See
   [the documentation](https://lorem-dev.github.io/doppel/usage/admin-api/).
+- Serves a browser dashboard from that same port's root, compiled into the
+  binary: the proxy list, a form over the whole proxy document, mock templates,
+  status and reload. It is a client of the admin API and bound by the same token
+  rules, so it offers only what the caller may actually do -- and works without a
+  token wherever the API does. `admin.dashboard: false` turns it off. See
+  [the documentation](https://lorem-dev.github.io/doppel/usage/dashboard/).
 - Reports errors to Sentry, optionally, behind the `sentry` cargo feature.
 - Stores its configuration in a YAML file or in PostgreSQL, selected by
   `--store`, with `config push` and `config pull` to move a configuration
@@ -86,6 +92,16 @@ never `pip`:
 uv run --with-requirements docs/requirements.txt mkdocs serve
 ```
 
+The dashboard's source is `frontend/`; building it needs Node, and the binary
+embeds whatever `frontend/dist` holds at compile time:
+
+```bash
+npm --prefix frontend ci && npm --prefix frontend run build
+cargo build --release -p doppel-cli
+```
+
+Skipping that leaves a working binary whose root answers 503 and says so.
+
 The workspace layout -- the crates, what each owns, and the dependency
 direction -- is in
 [the architecture page](https://lorem-dev.github.io/doppel/development/architecture/).
@@ -99,11 +115,16 @@ Prerequisites: a stable Rust toolchain via rustup, edition 2024 (see
 `Cargo.toml` for the pinned `rust-version`).
 
 ```bash
-cargo build --release
-cp main.example.yaml main.yaml   # edit to taste; main.yaml is git-ignored
-./target/release/doppel serve --config main.yaml
+make release                     # the dashboard, then the binary
+mkdir -p config && cp main.example.yaml config/main.yaml   # config/ is git-ignored
+./target/release/doppel serve --config config/main.yaml
 ```
 
+`make help` lists every target: `make gate` runs the whole check suite,
+`make image-rebuild` builds the container image from scratch, `make docs-serve`
+serves the documentation. `cargo build --release` works too, and skips the
+dashboard -- which then answers 503 at the admin root and says so.
+
 `cargo run -- <args>` works the same way during development.
 
 ## Commands
@@ -123,6 +144,10 @@ Configuration path, store selection and similar are set with flags or their
 `DOPPEL_*` environment equivalents; run any command with `--help` for the
 full list.
 
+`DOPPEL_EXTERNAL_URL` names the address clients reach Doppel at, for rewriting an
+upstream's redirects. Needed behind a port mapping or an ingress; otherwise
+`server.host:server.port` is used.
+
 ## A minimal configuration
 
 ```yaml
diff --git a/THIRD-PARTY.md b/THIRD-PARTY.md
index 94bbb47..777f79d 100644
--- a/THIRD-PARTY.md
+++ b/THIRD-PARTY.md
@@ -1,386 +1,406 @@
 # Third-party notices
 
-Doppel links its dependencies statically, so a released binary contains the
-work below. Each retains its own copyright and is distributed under its own
+Doppel links its dependencies statically and embeds the dashboard's compiled
+JavaScript, so a released binary contains the work below -- crates and npm
+packages alike. Each retains its own copyright and is distributed under its own
 licence.
 
 Generated from the resolved dependency graph by `scripts/third_party.py`. Do
 not edit by hand -- run the script.
 
 
-372 packages.
+391 packages: 379 from crates.io, 12 from npm.
 
-| Package | Version | Licence |
-|---|---|---|
-| [addr2line](https://github.com/gimli-rs/addr2line) | 0.25.1 | Apache-2.0 OR MIT |
-| [adler2](https://github.com/oyvindln/adler2) | 2.0.1 | 0BSD OR MIT OR Apache-2.0 |
-| [aho-corasick](https://github.com/BurntSushi/aho-corasick) | 1.1.4 | Unlicense OR MIT |
-| [allocator-api2](https://github.com/zakarumych/allocator-api2) | 0.2.21 | MIT OR Apache-2.0 |
-| [android_system_properties](https://github.com/nical/android_system_properties) | 0.1.5 | MIT/Apache-2.0 |
-| [anstream](https://github.com/rust-cli/anstyle.git) | 1.0.0 | MIT OR Apache-2.0 |
-| [anstyle](https://github.com/rust-cli/anstyle.git) | 1.0.14 | MIT OR Apache-2.0 |
-| [anstyle-parse](https://github.com/rust-cli/anstyle.git) | 1.0.0 | MIT OR Apache-2.0 |
-| [anstyle-query](https://github.com/rust-cli/anstyle.git) | 1.1.5 | MIT OR Apache-2.0 |
-| [anstyle-wincon](https://github.com/rust-cli/anstyle.git) | 3.0.11 | MIT OR Apache-2.0 |
-| [anyhow](https://github.com/dtolnay/anyhow) | 1.0.104 | MIT OR Apache-2.0 |
-| [arbitrary](https://github.com/rust-fuzz/arbitrary/) | 1.4.2 | MIT OR Apache-2.0 |
-| [arc-swap](https://github.com/vorner/arc-swap) | 1.9.2 | MIT OR Apache-2.0 |
-| [async-trait](https://github.com/dtolnay/async-trait) | 0.1.91 | MIT OR Apache-2.0 |
-| [atoi](https://github.com/pacman82/atoi-rs) | 2.0.0 | MIT |
-| [atomic-waker](https://github.com/smol-rs/atomic-waker) | 1.1.2 | Apache-2.0 OR MIT |
-| [autocfg](https://github.com/cuviper/autocfg) | 1.5.1 | Apache-2.0 OR MIT |
-| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | 1.17.3 | ISC AND (Apache-2.0 OR ISC) |
-| [aws-lc-sys](https://github.com/aws/aws-lc-rs) | 0.43.0 | ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0) |
-| [axum](https://github.com/tokio-rs/axum) | 0.8.9 | MIT |
-| [axum-core](https://github.com/tokio-rs/axum) | 0.5.6 | MIT |
-| [backtrace](https://github.com/rust-lang/backtrace-rs) | 0.3.76 | MIT OR Apache-2.0 |
-| [base64](https://github.com/marshallpierce/rust-base64) | 0.22.1 | MIT OR Apache-2.0 |
-| [bitflags](https://github.com/bitflags/bitflags) | 2.13.1 | MIT OR Apache-2.0 |
-| [block-buffer](https://github.com/RustCrypto/utils) | 0.10.4 | MIT OR Apache-2.0 |
-| [block-buffer](https://github.com/RustCrypto/utils) | 0.12.1 | MIT OR Apache-2.0 |
-| [block2](https://github.com/madsmtm/objc2) | 0.6.2 | MIT |
-| [bumpalo](https://github.com/fitzgen/bumpalo) | 3.20.3 | MIT OR Apache-2.0 |
-| [byteorder](https://github.com/BurntSushi/byteorder) | 1.5.0 | Unlicense OR MIT |
-| [bytes](https://github.com/tokio-rs/bytes) | 1.12.1 | MIT |
-| [cc](https://github.com/rust-lang/cc-rs) | 1.4.0 | MIT OR Apache-2.0 |
-| [cfg-if](https://github.com/rust-lang/cfg-if) | 1.0.4 | MIT OR Apache-2.0 |
-| [cfg_aliases](https://github.com/katharostech/cfg_aliases) | 0.2.2 | MIT |
-| [chacha20](https://github.com/RustCrypto/stream-ciphers) | 0.10.1 | MIT OR Apache-2.0 |
-| [clap](https://github.com/clap-rs/clap) | 4.6.5 | MIT OR Apache-2.0 |
-| [clap_builder](https://github.com/clap-rs/clap) | 4.6.5 | MIT OR Apache-2.0 |
-| [clap_derive](https://github.com/clap-rs/clap) | 4.6.4 | MIT OR Apache-2.0 |
-| [clap_lex](https://github.com/clap-rs/clap) | 1.1.0 | MIT OR Apache-2.0 |
-| [cmake](https://github.com/rust-lang/cmake-rs) | 0.1.58 | MIT OR Apache-2.0 |
-| [cmov](https://github.com/RustCrypto/utils) | 0.5.4 | Apache-2.0 OR MIT |
-| [colorchoice](https://github.com/rust-cli/anstyle.git) | 1.0.5 | MIT OR Apache-2.0 |
-| [combine](https://github.com/Marwes/combine) | 4.6.7 | MIT |
-| [const-oid](https://github.com/RustCrypto/formats) | 0.10.2 | Apache-2.0 OR MIT |
-| [core-foundation](https://github.com/servo/core-foundation-rs) | 0.10.1 | MIT OR Apache-2.0 |
-| [core-foundation-sys](https://github.com/servo/core-foundation-rs) | 0.8.7 | MIT OR Apache-2.0 |
-| [cpufeatures](https://github.com/RustCrypto/utils) | 0.2.17 | MIT OR Apache-2.0 |
-| [cpufeatures](https://github.com/RustCrypto/utils) | 0.3.0 | MIT OR Apache-2.0 |
-| [crc](https://github.com/mrhooray/crc-rs.git) | 3.4.0 | MIT OR Apache-2.0 |
-| [crc-catalog](https://github.com/akhilles/crc-catalog.git) | 2.5.0 | MIT OR Apache-2.0 |
-| [crc32fast](https://github.com/srijs/rust-crc32fast) | 1.5.0 | MIT OR Apache-2.0 |
-| [crossbeam-epoch](https://github.com/crossbeam-rs/crossbeam) | 0.9.20 | MIT OR Apache-2.0 |
-| [crossbeam-queue](https://github.com/crossbeam-rs/crossbeam) | 0.3.13 | MIT OR Apache-2.0 |
-| [crossbeam-utils](https://github.com/crossbeam-rs/crossbeam) | 0.8.22 | MIT OR Apache-2.0 |
-| [crypto-common](https://github.com/RustCrypto/traits) | 0.1.6 | MIT OR Apache-2.0 |
-| [crypto-common](https://github.com/RustCrypto/traits) | 0.2.2 | MIT OR Apache-2.0 |
-| [ctutils](https://github.com/RustCrypto/utils) | 0.4.2 | Apache-2.0 OR MIT |
-| [debugid](https://github.com/getsentry/rust-debugid) | 0.8.0 | Apache-2.0 |
-| [deranged](https://github.com/jhpratt/deranged) | 0.5.8 | MIT OR Apache-2.0 |
-| [derive_arbitrary](https://github.com/rust-fuzz/arbitrary) | 1.4.2 | MIT OR Apache-2.0 |
-| [digest](https://github.com/RustCrypto/traits) | 0.10.7 | MIT OR Apache-2.0 |
-| [digest](https://github.com/RustCrypto/traits) | 0.11.3 | MIT OR Apache-2.0 |
-| [dispatch2](https://github.com/madsmtm/objc2) | 0.3.1 | Zlib OR Apache-2.0 OR MIT |
-| [displaydoc](https://github.com/yaahc/displaydoc) | 0.2.7 | MIT OR Apache-2.0 |
-| [dotenvy](https://github.com/allan2/dotenvy) | 0.15.7 | MIT |
-| [dunce](https://gitlab.com/kornelski/dunce) | 1.0.5 | CC0-1.0 OR MIT-0 OR Apache-2.0 |
-| [either](https://github.com/rayon-rs/either) | 1.17.0 | MIT OR Apache-2.0 |
-| [equivalent](https://github.com/indexmap-rs/equivalent) | 1.0.2 | Apache-2.0 OR MIT |
-| [errno](https://github.com/lambda-fairy/rust-errno) | 0.3.14 | MIT OR Apache-2.0 |
-| [etcetera](https://github.com/lunacookies/etcetera) | 0.11.0 | MIT OR Apache-2.0 |
-| [event-listener](https://github.com/smol-rs/event-listener) | 5.4.2 | Apache-2.0 OR MIT |
-| [evmap](https://github.com/jonhoo/evmap.git) | 11.0.0 | MIT OR Apache-2.0 |
-| [fastrand](https://github.com/smol-rs/fastrand) | 2.5.0 | Apache-2.0 OR MIT |
-| [find-msvc-tools](https://github.com/rust-lang/cc-rs) | 0.1.9 | MIT OR Apache-2.0 |
-| [flate2](https://github.com/rust-lang/flate2-rs) | 1.1.9 | MIT OR Apache-2.0 |
-| [flume](https://github.com/zesterer/flume) | 0.12.0 | Apache-2.0/MIT |
-| [foldhash](https://github.com/orlp/foldhash) | 0.2.0 | Zlib |
-| [form_urlencoded](https://github.com/servo/rust-url) | 1.2.2 | MIT OR Apache-2.0 |
-| [fs_extra](https://github.com/webdesus/fs_extra) | 1.3.0 | MIT |
-| [futures-channel](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-core](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-executor](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-intrusive](https://github.com/Matthias247/futures-intrusive) | 0.5.0 | MIT OR Apache-2.0 |
-| [futures-io](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-macro](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-sink](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-task](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [futures-util](https://github.com/rust-lang/futures-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [generator](https://github.com/Xudong-Huang/generator-rs.git) | 0.8.9 | MIT/Apache-2.0 |
-| [generic-array](https://github.com/fizyk20/generic-array.git) | 0.14.9 | MIT |
-| [getrandom](https://github.com/rust-random/getrandom) | 0.2.17 | MIT OR Apache-2.0 |
-| [getrandom](https://github.com/rust-random/getrandom) | 0.3.4 | MIT OR Apache-2.0 |
-| [getrandom](https://github.com/rust-random/getrandom) | 0.4.3 | MIT OR Apache-2.0 |
-| [gimli](https://github.com/gimli-rs/gimli) | 0.32.3 | MIT OR Apache-2.0 |
-| [hashbag](https://github.com/jonhoo/hashbag.git) | 0.1.13 | MIT OR Apache-2.0 |
-| [hashbrown](https://github.com/rust-lang/hashbrown) | 0.16.1 | MIT OR Apache-2.0 |
-| [hashbrown](https://github.com/rust-lang/hashbrown) | 0.17.1 | MIT OR Apache-2.0 |
-| [hashlink](https://github.com/djc/hashlink) | 0.11.1 | MIT OR Apache-2.0 |
-| [heck](https://github.com/withoutboats/heck) | 0.5.0 | MIT OR Apache-2.0 |
-| [hex](https://github.com/KokaKiwi/rust-hex) | 0.4.3 | MIT OR Apache-2.0 |
-| [hkdf](https://github.com/RustCrypto/KDFs/) | 0.13.0 | MIT OR Apache-2.0 |
-| [hmac](https://github.com/RustCrypto/MACs) | 0.13.0 | MIT OR Apache-2.0 |
-| [hostname](https://github.com/djc/hostname) | 0.4.2 | MIT |
-| [http](https://github.com/hyperium/http) | 1.5.0 | MIT OR Apache-2.0 |
-| [http-body](https://github.com/hyperium/http-body) | 1.1.0 | MIT |
-| [http-body-util](https://github.com/hyperium/http-body) | 0.1.4 | MIT |
-| [httparse](https://github.com/seanmonstar/httparse) | 1.10.1 | MIT OR Apache-2.0 |
-| [httpdate](https://github.com/pyfisch/httpdate) | 1.0.3 | MIT OR Apache-2.0 |
-| [hybrid-array](https://github.com/RustCrypto/hybrid-array) | 0.4.14 | MIT OR Apache-2.0 |
-| [hyper](https://github.com/hyperium/hyper) | 1.11.0 | MIT |
-| [hyper-rustls](https://github.com/rustls/hyper-rustls) | 0.27.9 | Apache-2.0 OR ISC OR MIT |
-| [hyper-util](https://github.com/hyperium/hyper-util) | 0.1.20 | MIT |
-| [icu_collections](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [icu_locale_core](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [icu_normalizer](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [icu_normalizer_data](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [icu_properties](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [icu_properties_data](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [icu_provider](https://github.com/unicode-org/icu4x) | 2.2.0 | Unicode-3.0 |
-| [idna](https://github.com/servo/rust-url/) | 1.1.0 | MIT OR Apache-2.0 |
-| [idna_adapter](https://github.com/hsivonen/idna_adapter) | 1.2.2 | Apache-2.0 OR MIT |
-| [indexmap](https://github.com/indexmap-rs/indexmap) | 2.14.0 | Apache-2.0 OR MIT |
-| [ipnet](https://github.com/krisprice/ipnet) | 2.12.0 | MIT OR Apache-2.0 |
-| [is_terminal_polyfill](https://github.com/polyfill-rs/is_terminal_polyfill) | 1.70.2 | MIT OR Apache-2.0 |
-| [itoa](https://github.com/dtolnay/itoa) | 1.0.18 | MIT OR Apache-2.0 |
-| [jni](https://github.com/jni-rs/jni-rs) | 0.22.4 | MIT OR Apache-2.0 |
-| [jni-macros](https://github.com/jni-rs/jni-rs) | 0.22.4 | MIT OR Apache-2.0 |
-| [jni-sys](https://github.com/jni-rs/jni-sys) | 0.4.1 | MIT OR Apache-2.0 |
-| [jni-sys-macros](https://github.com/jni-rs/jni-sys) | 0.4.1 | MIT OR Apache-2.0 |
-| [jobserver](https://github.com/rust-lang/jobserver-rs) | 0.1.35 | MIT OR Apache-2.0 |
-| [js-sys](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/js-sys) | 0.3.103 | MIT OR Apache-2.0 |
-| [lazy_static](https://github.com/rust-lang-nursery/lazy-static.rs) | 1.5.0 | MIT OR Apache-2.0 |
-| [left-right](https://github.com/jonhoo/left-right.git) | 0.11.8 | MIT OR Apache-2.0 |
-| [libc](https://github.com/rust-lang/libc) | 0.2.189 | MIT OR Apache-2.0 |
-| [libsqlite3-sys](https://github.com/rusqlite/rusqlite) | 0.37.0 | MIT |
-| [linux-raw-sys](https://github.com/sunfishcode/linux-raw-sys) | 0.12.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
-| [litemap](https://github.com/unicode-org/icu4x) | 0.8.2 | Unicode-3.0 |
-| [lock_api](https://github.com/Amanieu/parking_lot) | 0.4.14 | MIT OR Apache-2.0 |
-| [log](https://github.com/rust-lang/log) | 0.4.33 | MIT OR Apache-2.0 |
-| [loom](https://github.com/tokio-rs/loom) | 0.7.2 | MIT |
-| [lru-slab](https://github.com/Ralith/lru-slab) | 0.1.2 | MIT OR Apache-2.0 OR Zlib |
-| [matchers](https://github.com/hawkw/matchers) | 0.2.0 | MIT |
-| [matchit](https://github.com/ibraheemdev/matchit) | 0.8.4 | MIT AND BSD-3-Clause |
-| [md-5](https://github.com/RustCrypto/hashes) | 0.11.0 | MIT OR Apache-2.0 |
-| [memchr](https://github.com/BurntSushi/memchr) | 2.8.3 | Unlicense OR MIT |
-| [memo-map](https://github.com/mitsuhiko/memo-map) | 0.3.3 | Apache-2.0 |
-| [metrics](https://github.com/metrics-rs/metrics) | 0.24.6 | MIT |
-| [metrics-exporter-prometheus](https://github.com/metrics-rs/metrics) | 0.18.3 | MIT AND Apache-2.0 |
-| [metrics-util](https://github.com/metrics-rs/metrics) | 0.20.4 | MIT |
-| [mime](https://github.com/hyperium/mime) | 0.3.17 | MIT OR Apache-2.0 |
-| [mime_guess](https://github.com/abonander/mime_guess) | 2.0.5 | MIT |
-| [minijinja](https://github.com/mitsuhiko/minijinja) | 2.21.0 | Apache-2.0 |
-| [miniz_oxide](https://github.com/Frommi/miniz_oxide/tree/master/miniz_oxide) | 0.8.9 | MIT OR Zlib OR Apache-2.0 |
-| [mio](https://github.com/tokio-rs/mio) | 1.2.2 | MIT |
-| [nix](https://github.com/nix-rust/nix) | 0.31.3 | MIT |
-| [nu-ansi-term](https://github.com/nushell/nu-ansi-term) | 0.50.3 | MIT |
-| [num-conv](https://github.com/jhpratt/num-conv) | 0.2.2 | MIT OR Apache-2.0 |
-| [num-traits](https://github.com/rust-num/num-traits) | 0.2.19 | MIT OR Apache-2.0 |
-| [objc2](https://github.com/madsmtm/objc2) | 0.6.4 | MIT |
-| [objc2-cloud-kit](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-core-data](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-core-foundation](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-core-graphics](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-core-image](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-core-location](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-core-text](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-encode](https://github.com/madsmtm/objc2) | 4.1.0 | MIT |
-| [objc2-foundation](https://github.com/madsmtm/objc2) | 0.3.2 | MIT |
-| [objc2-io-surface](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-quartz-core](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-ui-kit](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [objc2-user-notifications](https://github.com/madsmtm/objc2) | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
-| [object](https://github.com/gimli-rs/object) | 0.37.3 | Apache-2.0 OR MIT |
-| [once_cell](https://github.com/matklad/once_cell) | 1.21.4 | MIT OR Apache-2.0 |
-| [once_cell_polyfill](https://github.com/polyfill-rs/once_cell_polyfill) | 1.70.2 | MIT OR Apache-2.0 |
-| [openssl-probe](https://github.com/rustls/openssl-probe) | 0.2.1 | MIT OR Apache-2.0 |
-| [os_info](https://github.com/stanislav-tkach/os_info) | 3.15.0 | MIT |
-| [parking](https://github.com/smol-rs/parking) | 2.2.1 | Apache-2.0 OR MIT |
-| [parking_lot](https://github.com/Amanieu/parking_lot) | 0.12.5 | MIT OR Apache-2.0 |
-| [parking_lot_core](https://github.com/Amanieu/parking_lot) | 0.9.12 | MIT OR Apache-2.0 |
-| [percent-encoding](https://github.com/servo/rust-url/) | 2.3.2 | MIT OR Apache-2.0 |
-| [pin-project-lite](https://github.com/taiki-e/pin-project-lite) | 0.2.17 | Apache-2.0 OR MIT |
-| [pkg-config](https://github.com/rust-lang/pkg-config-rs) | 0.3.33 | MIT OR Apache-2.0 |
-| [portable-atomic](https://github.com/taiki-e/portable-atomic) | 1.14.0 | Apache-2.0 OR MIT |
-| [potential_utf](https://github.com/unicode-org/icu4x) | 0.1.5 | Unicode-3.0 |
-| [powerfmt](https://github.com/jhpratt/powerfmt) | 0.2.0 | MIT OR Apache-2.0 |
-| [ppv-lite86](https://github.com/cryptocorrosion/cryptocorrosion) | 0.2.21 | MIT OR Apache-2.0 |
-| [proc-macro2](https://github.com/dtolnay/proc-macro2) | 1.0.107 | MIT OR Apache-2.0 |
-| [quanta](https://github.com/metrics-rs/quanta) | 0.12.6 | MIT |
-| [quinn](https://github.com/quinn-rs/quinn) | 0.11.11 | MIT OR Apache-2.0 |
-| [quinn-proto](https://github.com/quinn-rs/quinn) | 0.11.16 | MIT OR Apache-2.0 |
-| [quinn-udp](https://github.com/quinn-rs/quinn) | 0.5.15 | MIT OR Apache-2.0 |
-| [quote](https://github.com/dtolnay/quote) | 1.0.47 | MIT OR Apache-2.0 |
-| [r-efi](https://github.com/r-efi/r-efi) | 5.3.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later |
-| [r-efi](https://github.com/r-efi/r-efi) | 6.0.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later |
-| [rand](https://github.com/rust-random/rand) | 0.10.2 | MIT OR Apache-2.0 |
-| [rand](https://github.com/rust-random/rand) | 0.9.5 | MIT OR Apache-2.0 |
-| [rand_chacha](https://github.com/rust-random/rand) | 0.9.0 | MIT OR Apache-2.0 |
-| [rand_core](https://github.com/rust-random/rand_core) | 0.10.1 | MIT OR Apache-2.0 |
-| [rand_core](https://github.com/rust-random/rand) | 0.9.5 | MIT OR Apache-2.0 |
-| [rand_pcg](https://github.com/rust-random/rngs) | 0.10.2 | MIT OR Apache-2.0 |
-| [rand_xoshiro](https://github.com/rust-random/rngs) | 0.7.0 | MIT OR Apache-2.0 |
-| [rapidhash](https://github.com/hoxxep/rapidhash) | 4.5.1 | MIT OR Apache-2.0 |
-| [raw-cpuid](https://github.com/gz/rust-cpuid) | 11.6.0 | MIT |
-| [redox_syscall](https://gitlab.redox-os.org/redox-os/syscall) | 0.5.18 | MIT |
-| [regex](https://github.com/rust-lang/regex) | 1.13.1 | MIT OR Apache-2.0 |
-| [regex-automata](https://github.com/rust-lang/regex) | 0.4.16 | MIT OR Apache-2.0 |
-| [regex-syntax](https://github.com/rust-lang/regex) | 0.8.11 | MIT OR Apache-2.0 |
-| [reqwest](https://github.com/seanmonstar/reqwest) | 0.12.28 | MIT OR Apache-2.0 |
-| [reqwest](https://github.com/seanmonstar/reqwest) | 0.13.4 | MIT OR Apache-2.0 |
-| [ring](https://github.com/briansmith/ring) | 0.17.14 | Apache-2.0 AND ISC |
-| [rust-embed](https://pyrossh.dev/repos/rust-embed) | 8.12.0 | MIT |
-| [rust-embed-impl](https://pyrossh.dev/repos/rust-embed) | 8.12.0 | MIT |
-| [rust-embed-utils](https://pyrossh.dev/repos/rust-embed) | 8.12.0 | MIT |
-| [rustc-demangle](https://github.com/rust-lang/rustc-demangle) | 0.1.28 | MIT/Apache-2.0 |
-| [rustc-hash](https://github.com/rust-lang/rustc-hash) | 2.1.3 | Apache-2.0 OR MIT |
-| [rustc_version](https://github.com/djc/rustc-version-rs) | 0.4.1 | MIT OR Apache-2.0 |
-| [rustix](https://github.com/bytecodealliance/rustix) | 1.1.4 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
-| [rustls](https://github.com/rustls/rustls) | 0.23.43 | Apache-2.0 OR ISC OR MIT |
-| [rustls-native-certs](https://github.com/rustls/rustls-native-certs) | 0.8.4 | Apache-2.0 OR ISC OR MIT |
-| [rustls-pki-types](https://github.com/rustls/pki-types) | 1.15.1 | MIT OR Apache-2.0 |
-| [rustls-platform-verifier](https://github.com/rustls/rustls-platform-verifier) | 0.7.0 | MIT OR Apache-2.0 |
-| [rustls-platform-verifier-android](https://github.com/rustls/rustls-platform-verifier) | 0.1.1 | MIT OR Apache-2.0 |
-| [rustls-webpki](https://github.com/rustls/webpki) | 0.103.13 | ISC |
-| [rustversion](https://github.com/dtolnay/rustversion) | 1.0.23 | MIT OR Apache-2.0 |
-| [ryu](https://github.com/dtolnay/ryu) | 1.0.23 | Apache-2.0 OR BSL-1.0 |
-| [same-file](https://github.com/BurntSushi/same-file) | 1.0.6 | Unlicense/MIT |
-| [schannel](https://github.com/steffengy/schannel-rs) | 0.1.29 | MIT |
-| [scoped-tls](https://github.com/alexcrichton/scoped-tls) | 1.0.1 | MIT/Apache-2.0 |
-| [scopeguard](https://github.com/bluss/scopeguard) | 1.2.0 | MIT OR Apache-2.0 |
-| [security-framework](https://github.com/kornelski/rust-security-framework) | 3.7.0 | MIT OR Apache-2.0 |
-| [security-framework-sys](https://github.com/kornelski/rust-security-framework) | 2.17.0 | MIT OR Apache-2.0 |
-| [semver](https://github.com/dtolnay/semver) | 1.0.28 | MIT OR Apache-2.0 |
-| [sentry](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [sentry-backtrace](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [sentry-contexts](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [sentry-core](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [sentry-panic](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [sentry-tracing](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [sentry-types](https://github.com/getsentry/sentry-rust) | 0.49.0 | MIT |
-| [serde](https://github.com/serde-rs/serde) | 1.0.229 | MIT OR Apache-2.0 |
-| [serde_core](https://github.com/serde-rs/serde) | 1.0.229 | MIT OR Apache-2.0 |
-| [serde_derive](https://github.com/serde-rs/serde) | 1.0.229 | MIT OR Apache-2.0 |
-| [serde_json](https://github.com/serde-rs/json) | 1.0.151 | MIT OR Apache-2.0 |
-| [serde_norway](https://github.com/cafkafk/serde-yaml) | 0.9.42 | MIT OR Apache-2.0 |
-| [serde_path_to_error](https://github.com/dtolnay/path-to-error) | 0.1.20 | MIT OR Apache-2.0 |
-| [serde_urlencoded](https://github.com/nox/serde_urlencoded) | 0.7.1 | MIT/Apache-2.0 |
-| [sha1](https://github.com/RustCrypto/hashes) | 0.11.0 | MIT OR Apache-2.0 |
-| [sha2](https://github.com/RustCrypto/hashes) | 0.10.9 | MIT OR Apache-2.0 |
-| [sha2](https://github.com/RustCrypto/hashes) | 0.11.0 | MIT OR Apache-2.0 |
-| [sharded-slab](https://github.com/hawkw/sharded-slab) | 0.1.7 | MIT |
-| [shlex](https://github.com/comex/rust-shlex) | 2.0.1 | MIT OR Apache-2.0 |
-| [signal-hook-registry](https://github.com/vorner/signal-hook) | 1.4.8 | MIT OR Apache-2.0 |
-| [simd-adler32](https://github.com/mcountryman/simd-adler32) | 0.3.10 | MIT |
-| [simd_cesu8](https://github.com/seancroach/simd_cesu8) | 1.2.0 | Apache-2.0 OR MIT |
-| [simdutf8](https://github.com/rusticstuff/simdutf8) | 0.1.5 | MIT OR Apache-2.0 |
-| [sketches-ddsketch](https://github.com/mheffner/rust-sketches-ddsketch) | 0.3.1 | Apache-2.0 |
-| [slab](https://github.com/tokio-rs/slab) | 0.4.12 | MIT |
-| [smallvec](https://github.com/servo/rust-smallvec) | 1.15.2 | MIT OR Apache-2.0 |
-| [socket2](https://github.com/rust-lang/socket2) | 0.6.5 | MIT OR Apache-2.0 |
-| [spin](https://github.com/mvdnes/spin-rs.git) | 0.9.9 | MIT |
-| [sqlx](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [sqlx-core](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [sqlx-macros](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [sqlx-macros-core](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [sqlx-mysql](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [sqlx-postgres](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [sqlx-sqlite](https://github.com/launchbadge/sqlx) | 0.9.0 | MIT OR Apache-2.0 |
-| [stable_deref_trait](https://github.com/storyyeller/stable_deref_trait) | 1.2.1 | MIT OR Apache-2.0 |
-| [stringprep](https://github.com/sfackler/rust-stringprep) | 0.1.5 | MIT/Apache-2.0 |
-| [strsim](https://github.com/rapidfuzz/strsim-rs) | 0.11.1 | MIT |
-| [subtle](https://github.com/dalek-cryptography/subtle) | 2.6.1 | BSD-3-Clause |
-| [syn](https://github.com/dtolnay/syn) | 2.0.119 | MIT OR Apache-2.0 |
-| [syn](https://github.com/dtolnay/syn) | 3.0.3 | MIT OR Apache-2.0 |
-| [sync_wrapper](https://github.com/Actyx/sync_wrapper) | 1.0.2 | Apache-2.0 |
-| [synstructure](https://github.com/mystor/synstructure) | 0.13.2 | MIT |
-| [tempfile](https://github.com/Stebalien/tempfile) | 3.27.0 | MIT OR Apache-2.0 |
-| [thiserror](https://github.com/dtolnay/thiserror) | 2.0.19 | MIT OR Apache-2.0 |
-| [thiserror-impl](https://github.com/dtolnay/thiserror) | 2.0.19 | MIT OR Apache-2.0 |
-| [thread_local](https://github.com/Amanieu/thread_local-rs) | 1.1.10 | MIT OR Apache-2.0 |
-| [time](https://github.com/time-rs/time) | 0.3.55 | MIT OR Apache-2.0 |
-| [time-core](https://github.com/time-rs/time) | 0.1.9 | MIT OR Apache-2.0 |
-| [time-macros](https://github.com/time-rs/time) | 0.2.32 | MIT OR Apache-2.0 |
-| [tinystr](https://github.com/unicode-org/icu4x) | 0.8.3 | Unicode-3.0 |
-| [tinyvec](https://github.com/Lokathor/tinyvec) | 1.12.0 | Zlib OR Apache-2.0 OR MIT |
-| [tinyvec_macros](https://github.com/Soveu/tinyvec_macros) | 0.1.1 | MIT OR Apache-2.0 OR Zlib |
-| [tokio](https://github.com/tokio-rs/tokio) | 1.53.1 | MIT |
-| [tokio-macros](https://github.com/tokio-rs/tokio) | 2.7.2 | MIT |
-| [tokio-rustls](https://github.com/rustls/tokio-rustls) | 0.26.4 | MIT OR Apache-2.0 |
-| [tokio-stream](https://github.com/tokio-rs/tokio) | 0.1.19 | MIT |
-| [tokio-util](https://github.com/tokio-rs/tokio) | 0.7.19 | MIT |
-| [tower](https://github.com/tower-rs/tower) | 0.5.3 | MIT |
-| [tower-http](https://github.com/tower-rs/tower-http) | 0.6.11 | MIT |
-| [tower-layer](https://github.com/tower-rs/tower) | 0.3.3 | MIT |
-| [tower-service](https://github.com/tower-rs/tower) | 0.3.3 | MIT |
-| [tracing](https://github.com/tokio-rs/tracing) | 0.1.44 | MIT |
-| [tracing-attributes](https://github.com/tokio-rs/tracing) | 0.1.31 | MIT |
-| [tracing-core](https://github.com/tokio-rs/tracing) | 0.1.36 | MIT |
-| [tracing-log](https://github.com/tokio-rs/tracing) | 0.2.0 | MIT |
-| [tracing-serde](https://github.com/tokio-rs/tracing) | 0.2.0 | MIT |
-| [tracing-subscriber](https://github.com/tokio-rs/tracing) | 0.3.23 | MIT |
-| [try-lock](https://github.com/seanmonstar/try-lock) | 0.2.5 | MIT |
-| [typenum](https://github.com/paholg/typenum) | 1.20.1 | MIT OR Apache-2.0 |
-| [uname](https://github.com/icorderi/rust-uname) | 0.1.1 | MIT/Apache-2.0 |
-| [unicase](https://github.com/seanmonstar/unicase) | 2.9.0 | MIT OR Apache-2.0 |
-| [unicode-bidi](https://github.com/servo/unicode-bidi) | 0.3.18 | MIT OR Apache-2.0 |
-| [unicode-ident](https://github.com/dtolnay/unicode-ident) | 1.0.24 | (MIT OR Apache-2.0) AND Unicode-3.0 |
-| [unicode-normalization](https://github.com/unicode-rs/unicode-normalization) | 0.1.25 | MIT OR Apache-2.0 |
-| [unicode-properties](https://github.com/unicode-rs/unicode-properties) | 0.1.4 | MIT/Apache-2.0 |
-| [unsafe-libyaml-norway](https://github.com/cafkafk/unsafe-libyaml-norway) | 0.2.15 | MIT |
-| [untrusted](https://github.com/briansmith/untrusted) | 0.9.0 | ISC |
-| [ureq](https://github.com/algesten/ureq) | 3.3.0 | MIT OR Apache-2.0 |
-| [ureq-proto](https://github.com/algesten/ureq-proto) | 0.6.0 | MIT OR Apache-2.0 |
-| [url](https://github.com/servo/rust-url) | 2.5.8 | MIT OR Apache-2.0 |
-| [utf8-zero](https://github.com/algesten/utf8-zero) | 0.8.1 | MIT OR Apache-2.0 |
-| [utf8_iter](https://github.com/hsivonen/utf8_iter) | 1.0.4 | Apache-2.0 OR MIT |
-| [utf8parse](https://github.com/alacritty/vte) | 0.2.2 | Apache-2.0 OR MIT |
-| [utoipa](https://github.com/juhaku/utoipa) | 5.5.0 | MIT OR Apache-2.0 |
-| [utoipa-gen](https://github.com/juhaku/utoipa) | 5.5.0 | MIT OR Apache-2.0 |
-| [utoipa-swagger-ui](https://github.com/juhaku/utoipa) | 9.0.2 | MIT OR Apache-2.0 |
-| [utoipa-swagger-ui-vendored](https://github.com/juhaku/utoipa) | 0.1.2 | MIT OR Apache-2.0 |
-| [uuid](https://github.com/uuid-rs/uuid) | 1.24.0 | Apache-2.0 OR MIT |
-| [valuable](https://github.com/tokio-rs/valuable) | 0.1.1 | MIT |
-| [vcpkg](https://github.com/mcgoo/vcpkg-rs) | 0.2.15 | MIT/Apache-2.0 |
-| [version_check](https://github.com/SergioBenitez/version_check) | 0.9.5 | MIT/Apache-2.0 |
-| [walkdir](https://github.com/BurntSushi/walkdir) | 2.5.0 | Unlicense/MIT |
-| [want](https://github.com/seanmonstar/want) | 0.3.1 | MIT |
-| [wasi](https://github.com/bytecodealliance/wasi) | 0.11.1+wasi-snapshot-preview1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
-| [wasip2](https://github.com/bytecodealliance/wasi-rs) | 1.0.4+wasi-0.2.12 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
-| [wasm-bindgen](https://github.com/wasm-bindgen/wasm-bindgen) | 0.2.126 | MIT OR Apache-2.0 |
-| [wasm-bindgen-futures](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/futures) | 0.4.76 | MIT OR Apache-2.0 |
-| [wasm-bindgen-macro](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro) | 0.2.126 | MIT OR Apache-2.0 |
-| [wasm-bindgen-macro-support](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro-support) | 0.2.126 | MIT OR Apache-2.0 |
-| [wasm-bindgen-shared](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/shared) | 0.2.126 | MIT OR Apache-2.0 |
-| [wasm-streams](https://github.com/MattiasBuelens/wasm-streams/) | 0.4.2 | MIT OR Apache-2.0 |
-| [web-sys](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/web-sys) | 0.3.103 | MIT OR Apache-2.0 |
-| [web-time](https://github.com/daxpedda/web-time) | 1.1.0 | MIT OR Apache-2.0 |
-| [webpki-root-certs](https://github.com/rustls/webpki-roots) | 1.0.9 | CDLA-Permissive-2.0 |
-| [webpki-roots](https://github.com/rustls/webpki-roots) | 1.0.9 | CDLA-Permissive-2.0 |
-| [whoami](https://github.com/ardaku/whoami) | 2.1.2 | Apache-2.0 OR BSL-1.0 OR MIT |
-| [winapi](https://github.com/retep998/winapi-rs) | 0.3.9 | MIT/Apache-2.0 |
-| [winapi-i686-pc-windows-gnu](https://github.com/retep998/winapi-rs) | 0.4.0 | MIT/Apache-2.0 |
-| [winapi-util](https://github.com/BurntSushi/winapi-util) | 0.1.11 | Unlicense OR MIT |
-| [winapi-x86_64-pc-windows-gnu](https://github.com/retep998/winapi-rs) | 0.4.0 | MIT/Apache-2.0 |
-| [windows-link](https://github.com/microsoft/windows-rs) | 0.2.1 | MIT OR Apache-2.0 |
-| [windows-result](https://github.com/microsoft/windows-rs) | 0.4.1 | MIT OR Apache-2.0 |
-| [windows-sys](https://github.com/microsoft/windows-rs) | 0.52.0 | MIT OR Apache-2.0 |
-| [windows-sys](https://github.com/microsoft/windows-rs) | 0.61.2 | MIT OR Apache-2.0 |
-| [windows-targets](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_aarch64_gnullvm](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_aarch64_msvc](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_i686_gnu](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_i686_gnullvm](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_i686_msvc](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_x86_64_gnu](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_x86_64_gnullvm](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [windows_x86_64_msvc](https://github.com/microsoft/windows-rs) | 0.52.6 | MIT OR Apache-2.0 |
-| [wit-bindgen](https://github.com/bytecodealliance/wit-bindgen) | 0.57.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
-| [writeable](https://github.com/unicode-org/icu4x) | 0.6.3 | Unicode-3.0 |
-| [yoke](https://github.com/unicode-org/icu4x) | 0.8.3 | Unicode-3.0 |
-| [yoke-derive](https://github.com/unicode-org/icu4x) | 0.8.2 | Unicode-3.0 |
-| [zerocopy](https://github.com/google/zerocopy) | 0.8.55 | BSD-2-Clause OR Apache-2.0 OR MIT |
-| [zerocopy-derive](https://github.com/google/zerocopy) | 0.8.55 | BSD-2-Clause OR Apache-2.0 OR MIT |
-| [zerofrom](https://github.com/unicode-org/icu4x) | 0.1.8 | Unicode-3.0 |
-| [zerofrom-derive](https://github.com/unicode-org/icu4x) | 0.1.7 | Unicode-3.0 |
-| [zeroize](https://github.com/RustCrypto/utils) | 1.9.0 | Apache-2.0 OR MIT |
-| [zerotrie](https://github.com/unicode-org/icu4x) | 0.2.4 | Unicode-3.0 |
-| [zerovec](https://github.com/unicode-org/icu4x) | 0.11.6 | Unicode-3.0 |
-| [zerovec-derive](https://github.com/unicode-org/icu4x) | 0.11.3 | Unicode-3.0 |
-| [zip](https://github.com/zip-rs/zip2.git) | 3.0.0 | MIT |
-| [zlib-rs](https://github.com/trifectatechfoundation/zlib-rs) | 0.6.6 | Zlib |
-| [zmij](https://github.com/dtolnay/zmij) | 1.0.23 | MIT |
-| [zopfli](https://github.com/zopfli-rs/zopfli) | 0.8.3 | Apache-2.0 |
+| Package | Ecosystem | Version | Licence |
+|---|---|---|---|
+| [addr2line](https://github.com/gimli-rs/addr2line) | cargo | 0.25.1 | Apache-2.0 OR MIT |
+| [adler2](https://github.com/oyvindln/adler2) | cargo | 2.0.1 | 0BSD OR MIT OR Apache-2.0 |
+| [aho-corasick](https://github.com/BurntSushi/aho-corasick) | cargo | 1.1.4 | Unlicense OR MIT |
+| [alloc-no-stdlib](https://github.com/dropbox/rust-alloc-no-stdlib) | cargo | 2.0.4 | BSD-3-Clause |
+| [alloc-stdlib](https://github.com/dropbox/rust-alloc-no-stdlib) | cargo | 0.2.4 | BSD-3-Clause |
+| [allocator-api2](https://github.com/zakarumych/allocator-api2) | cargo | 0.2.21 | MIT OR Apache-2.0 |
+| [android_system_properties](https://github.com/nical/android_system_properties) | cargo | 0.1.5 | MIT/Apache-2.0 |
+| [anstream](https://github.com/rust-cli/anstyle.git) | cargo | 1.0.0 | MIT OR Apache-2.0 |
+| [anstyle](https://github.com/rust-cli/anstyle.git) | cargo | 1.0.14 | MIT OR Apache-2.0 |
+| [anstyle-parse](https://github.com/rust-cli/anstyle.git) | cargo | 1.0.0 | MIT OR Apache-2.0 |
+| [anstyle-query](https://github.com/rust-cli/anstyle.git) | cargo | 1.1.5 | MIT OR Apache-2.0 |
+| [anstyle-wincon](https://github.com/rust-cli/anstyle.git) | cargo | 3.0.11 | MIT OR Apache-2.0 |
+| [anyhow](https://github.com/dtolnay/anyhow) | cargo | 1.0.104 | MIT OR Apache-2.0 |
+| [arbitrary](https://github.com/rust-fuzz/arbitrary/) | cargo | 1.4.2 | MIT OR Apache-2.0 |
+| [arc-swap](https://github.com/vorner/arc-swap) | cargo | 1.9.2 | MIT OR Apache-2.0 |
+| [async-compression](https://github.com/Nullus157/async-compression) | cargo | 0.4.43 | MIT OR Apache-2.0 |
+| [async-trait](https://github.com/dtolnay/async-trait) | cargo | 0.1.91 | MIT OR Apache-2.0 |
+| [atoi](https://github.com/pacman82/atoi-rs) | cargo | 2.0.0 | MIT |
+| [atomic-waker](https://github.com/smol-rs/atomic-waker) | cargo | 1.1.2 | Apache-2.0 OR MIT |
+| [autocfg](https://github.com/cuviper/autocfg) | cargo | 1.5.1 | Apache-2.0 OR MIT |
+| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | cargo | 1.17.3 | ISC AND (Apache-2.0 OR ISC) |
+| [aws-lc-sys](https://github.com/aws/aws-lc-rs) | cargo | 0.43.0 | ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0) |
+| [axum](https://github.com/tokio-rs/axum) | cargo | 0.8.9 | MIT |
+| [axum-core](https://github.com/tokio-rs/axum) | cargo | 0.5.6 | MIT |
+| [backtrace](https://github.com/rust-lang/backtrace-rs) | cargo | 0.3.76 | MIT OR Apache-2.0 |
+| [base64](https://github.com/marshallpierce/rust-base64) | cargo | 0.22.1 | MIT OR Apache-2.0 |
+| [bitflags](https://github.com/bitflags/bitflags) | cargo | 2.13.1 | MIT OR Apache-2.0 |
+| [block-buffer](https://github.com/RustCrypto/utils) | cargo | 0.10.4 | MIT OR Apache-2.0 |
+| [block-buffer](https://github.com/RustCrypto/utils) | cargo | 0.12.1 | MIT OR Apache-2.0 |
+| [block2](https://github.com/madsmtm/objc2) | cargo | 0.6.2 | MIT |
+| [brotli](https://github.com/dropbox/rust-brotli) | cargo | 8.0.4 | BSD-3-Clause AND MIT |
+| [brotli-decompressor](https://github.com/dropbox/rust-brotli-decompressor) | cargo | 5.0.3 | BSD-3-Clause/MIT |
+| [bumpalo](https://github.com/fitzgen/bumpalo) | cargo | 3.20.3 | MIT OR Apache-2.0 |
+| [byteorder](https://github.com/BurntSushi/byteorder) | cargo | 1.5.0 | Unlicense OR MIT |
+| [bytes](https://github.com/tokio-rs/bytes) | cargo | 1.12.1 | MIT |
+| [cc](https://github.com/rust-lang/cc-rs) | cargo | 1.4.0 | MIT OR Apache-2.0 |
+| [cfg-if](https://github.com/rust-lang/cfg-if) | cargo | 1.0.4 | MIT OR Apache-2.0 |
+| [cfg_aliases](https://github.com/katharostech/cfg_aliases) | cargo | 0.2.2 | MIT |
+| [chacha20](https://github.com/RustCrypto/stream-ciphers) | cargo | 0.10.1 | MIT OR Apache-2.0 |
+| [clap](https://github.com/clap-rs/clap) | cargo | 4.6.5 | MIT OR Apache-2.0 |
+| [clap_builder](https://github.com/clap-rs/clap) | cargo | 4.6.5 | MIT OR Apache-2.0 |
+| [clap_derive](https://github.com/clap-rs/clap) | cargo | 4.6.4 | MIT OR Apache-2.0 |
+| [clap_lex](https://github.com/clap-rs/clap) | cargo | 1.1.0 | MIT OR Apache-2.0 |
+| [cmake](https://github.com/rust-lang/cmake-rs) | cargo | 0.1.58 | MIT OR Apache-2.0 |
+| [cmov](https://github.com/RustCrypto/utils) | cargo | 0.5.4 | Apache-2.0 OR MIT |
+| [colorchoice](https://github.com/rust-cli/anstyle.git) | cargo | 1.0.5 | MIT OR Apache-2.0 |
+| [combine](https://github.com/Marwes/combine) | cargo | 4.6.7 | MIT |
+| [compression-codecs](https://github.com/Nullus157/async-compression) | cargo | 0.4.38 | MIT OR Apache-2.0 |
+| [compression-core](https://github.com/Nullus157/async-compression) | cargo | 0.4.32 | MIT OR Apache-2.0 |
+| [const-oid](https://github.com/RustCrypto/formats) | cargo | 0.10.2 | Apache-2.0 OR MIT |
+| [core-foundation](https://github.com/servo/core-foundation-rs) | cargo | 0.10.1 | MIT OR Apache-2.0 |
+| [core-foundation-sys](https://github.com/servo/core-foundation-rs) | cargo | 0.8.7 | MIT OR Apache-2.0 |
+| [cpufeatures](https://github.com/RustCrypto/utils) | cargo | 0.2.17 | MIT OR Apache-2.0 |
+| [cpufeatures](https://github.com/RustCrypto/utils) | cargo | 0.3.0 | MIT OR Apache-2.0 |
+| [crc](https://github.com/mrhooray/crc-rs.git) | cargo | 3.4.0 | MIT OR Apache-2.0 |
+| [crc-catalog](https://github.com/akhilles/crc-catalog.git) | cargo | 2.5.0 | MIT OR Apache-2.0 |
+| [crc32fast](https://github.com/srijs/rust-crc32fast) | cargo | 1.5.0 | MIT OR Apache-2.0 |
+| [crossbeam-epoch](https://github.com/crossbeam-rs/crossbeam) | cargo | 0.9.20 | MIT OR Apache-2.0 |
+| [crossbeam-queue](https://github.com/crossbeam-rs/crossbeam) | cargo | 0.3.13 | MIT OR Apache-2.0 |
+| [crossbeam-utils](https://github.com/crossbeam-rs/crossbeam) | cargo | 0.8.22 | MIT OR Apache-2.0 |
+| [crypto-common](https://github.com/RustCrypto/traits) | cargo | 0.1.6 | MIT OR Apache-2.0 |
+| [crypto-common](https://github.com/RustCrypto/traits) | cargo | 0.2.2 | MIT OR Apache-2.0 |
+| [ctutils](https://github.com/RustCrypto/utils) | cargo | 0.4.2 | Apache-2.0 OR MIT |
+| [debugid](https://github.com/getsentry/rust-debugid) | cargo | 0.8.0 | Apache-2.0 |
+| [deranged](https://github.com/jhpratt/deranged) | cargo | 0.5.8 | MIT OR Apache-2.0 |
+| [derive_arbitrary](https://github.com/rust-fuzz/arbitrary) | cargo | 1.4.2 | MIT OR Apache-2.0 |
+| [digest](https://github.com/RustCrypto/traits) | cargo | 0.10.7 | MIT OR Apache-2.0 |
+| [digest](https://github.com/RustCrypto/traits) | cargo | 0.11.3 | MIT OR Apache-2.0 |
+| [dispatch2](https://github.com/madsmtm/objc2) | cargo | 0.3.1 | Zlib OR Apache-2.0 OR MIT |
+| [displaydoc](https://github.com/yaahc/displaydoc) | cargo | 0.2.7 | MIT OR Apache-2.0 |
+| [dotenvy](https://github.com/allan2/dotenvy) | cargo | 0.15.7 | MIT |
+| [dunce](https://gitlab.com/kornelski/dunce) | cargo | 1.0.5 | CC0-1.0 OR MIT-0 OR Apache-2.0 |
+| [either](https://github.com/rayon-rs/either) | cargo | 1.17.0 | MIT OR Apache-2.0 |
+| [equivalent](https://github.com/indexmap-rs/equivalent) | cargo | 1.0.2 | Apache-2.0 OR MIT |
+| [errno](https://github.com/lambda-fairy/rust-errno) | cargo | 0.3.14 | MIT OR Apache-2.0 |
+| [etcetera](https://github.com/lunacookies/etcetera) | cargo | 0.11.0 | MIT OR Apache-2.0 |
+| [event-listener](https://github.com/smol-rs/event-listener) | cargo | 5.4.2 | Apache-2.0 OR MIT |
+| [evmap](https://github.com/jonhoo/evmap.git) | cargo | 11.0.0 | MIT OR Apache-2.0 |
+| [fastrand](https://github.com/smol-rs/fastrand) | cargo | 2.5.0 | Apache-2.0 OR MIT |
+| [find-msvc-tools](https://github.com/rust-lang/cc-rs) | cargo | 0.1.9 | MIT OR Apache-2.0 |
+| [flate2](https://github.com/rust-lang/flate2-rs) | cargo | 1.1.9 | MIT OR Apache-2.0 |
+| [flume](https://github.com/zesterer/flume) | cargo | 0.12.0 | Apache-2.0/MIT |
+| [foldhash](https://github.com/orlp/foldhash) | cargo | 0.2.0 | Zlib |
+| [form_urlencoded](https://github.com/servo/rust-url) | cargo | 1.2.2 | MIT OR Apache-2.0 |
+| [fs_extra](https://github.com/webdesus/fs_extra) | cargo | 1.3.0 | MIT |
+| [futures-channel](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-core](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-executor](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-intrusive](https://github.com/Matthias247/futures-intrusive) | cargo | 0.5.0 | MIT OR Apache-2.0 |
+| [futures-io](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-macro](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-sink](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-task](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [futures-util](https://github.com/rust-lang/futures-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [generator](https://github.com/Xudong-Huang/generator-rs.git) | cargo | 0.8.9 | MIT/Apache-2.0 |
+| [generic-array](https://github.com/fizyk20/generic-array.git) | cargo | 0.14.9 | MIT |
+| [getrandom](https://github.com/rust-random/getrandom) | cargo | 0.2.17 | MIT OR Apache-2.0 |
+| [getrandom](https://github.com/rust-random/getrandom) | cargo | 0.3.4 | MIT OR Apache-2.0 |
+| [getrandom](https://github.com/rust-random/getrandom) | cargo | 0.4.3 | MIT OR Apache-2.0 |
+| [gimli](https://github.com/gimli-rs/gimli) | cargo | 0.32.3 | MIT OR Apache-2.0 |
+| [hashbag](https://github.com/jonhoo/hashbag.git) | cargo | 0.1.13 | MIT OR Apache-2.0 |
+| [hashbrown](https://github.com/rust-lang/hashbrown) | cargo | 0.16.1 | MIT OR Apache-2.0 |
+| [hashbrown](https://github.com/rust-lang/hashbrown) | cargo | 0.17.1 | MIT OR Apache-2.0 |
+| [hashlink](https://github.com/djc/hashlink) | cargo | 0.11.1 | MIT OR Apache-2.0 |
+| [heck](https://github.com/withoutboats/heck) | cargo | 0.5.0 | MIT OR Apache-2.0 |
+| [hex](https://github.com/KokaKiwi/rust-hex) | cargo | 0.4.3 | MIT OR Apache-2.0 |
+| [hkdf](https://github.com/RustCrypto/KDFs/) | cargo | 0.13.0 | MIT OR Apache-2.0 |
+| [hmac](https://github.com/RustCrypto/MACs) | cargo | 0.13.0 | MIT OR Apache-2.0 |
+| [hostname](https://github.com/djc/hostname) | cargo | 0.4.2 | MIT |
+| [http](https://github.com/hyperium/http) | cargo | 1.5.0 | MIT OR Apache-2.0 |
+| [http-body](https://github.com/hyperium/http-body) | cargo | 1.1.0 | MIT |
+| [http-body-util](https://github.com/hyperium/http-body) | cargo | 0.1.4 | MIT |
+| [httparse](https://github.com/seanmonstar/httparse) | cargo | 1.10.1 | MIT OR Apache-2.0 |
+| [httpdate](https://github.com/pyfisch/httpdate) | cargo | 1.0.3 | MIT OR Apache-2.0 |
+| [hybrid-array](https://github.com/RustCrypto/hybrid-array) | cargo | 0.4.14 | MIT OR Apache-2.0 |
+| [hyper](https://github.com/hyperium/hyper) | cargo | 1.11.0 | MIT |
+| [hyper-rustls](https://github.com/rustls/hyper-rustls) | cargo | 0.27.9 | Apache-2.0 OR ISC OR MIT |
+| [hyper-util](https://github.com/hyperium/hyper-util) | cargo | 0.1.20 | MIT |
+| [icu_collections](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [icu_locale_core](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [icu_normalizer](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [icu_normalizer_data](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [icu_properties](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [icu_properties_data](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [icu_provider](https://github.com/unicode-org/icu4x) | cargo | 2.2.0 | Unicode-3.0 |
+| [idna](https://github.com/servo/rust-url/) | cargo | 1.1.0 | MIT OR Apache-2.0 |
+| [idna_adapter](https://github.com/hsivonen/idna_adapter) | cargo | 1.2.2 | Apache-2.0 OR MIT |
+| [indexmap](https://github.com/indexmap-rs/indexmap) | cargo | 2.14.0 | Apache-2.0 OR MIT |
+| [ipnet](https://github.com/krisprice/ipnet) | cargo | 2.12.0 | MIT OR Apache-2.0 |
+| [is_terminal_polyfill](https://github.com/polyfill-rs/is_terminal_polyfill) | cargo | 1.70.2 | MIT OR Apache-2.0 |
+| [itoa](https://github.com/dtolnay/itoa) | cargo | 1.0.18 | MIT OR Apache-2.0 |
+| [jni](https://github.com/jni-rs/jni-rs) | cargo | 0.22.4 | MIT OR Apache-2.0 |
+| [jni-macros](https://github.com/jni-rs/jni-rs) | cargo | 0.22.4 | MIT OR Apache-2.0 |
+| [jni-sys](https://github.com/jni-rs/jni-sys) | cargo | 0.4.1 | MIT OR Apache-2.0 |
+| [jni-sys-macros](https://github.com/jni-rs/jni-sys) | cargo | 0.4.1 | MIT OR Apache-2.0 |
+| [jobserver](https://github.com/rust-lang/jobserver-rs) | cargo | 0.1.35 | MIT OR Apache-2.0 |
+| [js-sys](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/js-sys) | cargo | 0.3.103 | MIT OR Apache-2.0 |
+| [lazy_static](https://github.com/rust-lang-nursery/lazy-static.rs) | cargo | 1.5.0 | MIT OR Apache-2.0 |
+| [left-right](https://github.com/jonhoo/left-right.git) | cargo | 0.11.8 | MIT OR Apache-2.0 |
+| [libc](https://github.com/rust-lang/libc) | cargo | 0.2.189 | MIT OR Apache-2.0 |
+| [libsqlite3-sys](https://github.com/rusqlite/rusqlite) | cargo | 0.37.0 | MIT |
+| [linux-raw-sys](https://github.com/sunfishcode/linux-raw-sys) | cargo | 0.12.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
+| [litemap](https://github.com/unicode-org/icu4x) | cargo | 0.8.2 | Unicode-3.0 |
+| [lock_api](https://github.com/Amanieu/parking_lot) | cargo | 0.4.14 | MIT OR Apache-2.0 |
+| [log](https://github.com/rust-lang/log) | cargo | 0.4.33 | MIT OR Apache-2.0 |
+| [loom](https://github.com/tokio-rs/loom) | cargo | 0.7.2 | MIT |
+| [lru-slab](https://github.com/Ralith/lru-slab) | cargo | 0.1.2 | MIT OR Apache-2.0 OR Zlib |
+| [matchers](https://github.com/hawkw/matchers) | cargo | 0.2.0 | MIT |
+| [matchit](https://github.com/ibraheemdev/matchit) | cargo | 0.8.4 | MIT AND BSD-3-Clause |
+| [md-5](https://github.com/RustCrypto/hashes) | cargo | 0.11.0 | MIT OR Apache-2.0 |
+| [memchr](https://github.com/BurntSushi/memchr) | cargo | 2.8.3 | Unlicense OR MIT |
+| [memo-map](https://github.com/mitsuhiko/memo-map) | cargo | 0.3.3 | Apache-2.0 |
+| [metrics](https://github.com/metrics-rs/metrics) | cargo | 0.24.6 | MIT |
+| [metrics-exporter-prometheus](https://github.com/metrics-rs/metrics) | cargo | 0.18.3 | MIT AND Apache-2.0 |
+| [metrics-util](https://github.com/metrics-rs/metrics) | cargo | 0.20.4 | MIT |
+| [mime](https://github.com/hyperium/mime) | cargo | 0.3.17 | MIT OR Apache-2.0 |
+| [mime_guess](https://github.com/abonander/mime_guess) | cargo | 2.0.5 | MIT |
+| [minijinja](https://github.com/mitsuhiko/minijinja) | cargo | 2.21.0 | Apache-2.0 |
+| [miniz_oxide](https://github.com/Frommi/miniz_oxide/tree/master/miniz_oxide) | cargo | 0.8.9 | MIT OR Zlib OR Apache-2.0 |
+| [mio](https://github.com/tokio-rs/mio) | cargo | 1.2.2 | MIT |
+| [nix](https://github.com/nix-rust/nix) | cargo | 0.31.3 | MIT |
+| [nu-ansi-term](https://github.com/nushell/nu-ansi-term) | cargo | 0.50.3 | MIT |
+| [num-conv](https://github.com/jhpratt/num-conv) | cargo | 0.2.2 | MIT OR Apache-2.0 |
+| [num-traits](https://github.com/rust-num/num-traits) | cargo | 0.2.19 | MIT OR Apache-2.0 |
+| [objc2](https://github.com/madsmtm/objc2) | cargo | 0.6.4 | MIT |
+| [objc2-cloud-kit](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-core-data](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-core-foundation](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-core-graphics](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-core-image](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-core-location](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-core-text](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-encode](https://github.com/madsmtm/objc2) | cargo | 4.1.0 | MIT |
+| [objc2-foundation](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | MIT |
+| [objc2-io-surface](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-quartz-core](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-ui-kit](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [objc2-user-notifications](https://github.com/madsmtm/objc2) | cargo | 0.3.2 | Zlib OR Apache-2.0 OR MIT |
+| [object](https://github.com/gimli-rs/object) | cargo | 0.37.3 | Apache-2.0 OR MIT |
+| [once_cell](https://github.com/matklad/once_cell) | cargo | 1.21.4 | MIT OR Apache-2.0 |
+| [once_cell_polyfill](https://github.com/polyfill-rs/once_cell_polyfill) | cargo | 1.70.2 | MIT OR Apache-2.0 |
+| [openssl-probe](https://github.com/rustls/openssl-probe) | cargo | 0.2.1 | MIT OR Apache-2.0 |
+| [os_info](https://github.com/stanislav-tkach/os_info) | cargo | 3.15.0 | MIT |
+| [parking](https://github.com/smol-rs/parking) | cargo | 2.2.1 | Apache-2.0 OR MIT |
+| [parking_lot](https://github.com/Amanieu/parking_lot) | cargo | 0.12.5 | MIT OR Apache-2.0 |
+| [parking_lot_core](https://github.com/Amanieu/parking_lot) | cargo | 0.9.12 | MIT OR Apache-2.0 |
+| [percent-encoding](https://github.com/servo/rust-url/) | cargo | 2.3.2 | MIT OR Apache-2.0 |
+| [pin-project-lite](https://github.com/taiki-e/pin-project-lite) | cargo | 0.2.17 | Apache-2.0 OR MIT |
+| [pkg-config](https://github.com/rust-lang/pkg-config-rs) | cargo | 0.3.33 | MIT OR Apache-2.0 |
+| [portable-atomic](https://github.com/taiki-e/portable-atomic) | cargo | 1.14.0 | Apache-2.0 OR MIT |
+| [potential_utf](https://github.com/unicode-org/icu4x) | cargo | 0.1.5 | Unicode-3.0 |
+| [powerfmt](https://github.com/jhpratt/powerfmt) | cargo | 0.2.0 | MIT OR Apache-2.0 |
+| [ppv-lite86](https://github.com/cryptocorrosion/cryptocorrosion) | cargo | 0.2.21 | MIT OR Apache-2.0 |
+| [proc-macro2](https://github.com/dtolnay/proc-macro2) | cargo | 1.0.107 | MIT OR Apache-2.0 |
+| [quanta](https://github.com/metrics-rs/quanta) | cargo | 0.12.6 | MIT |
+| [quinn](https://github.com/quinn-rs/quinn) | cargo | 0.11.11 | MIT OR Apache-2.0 |
+| [quinn-proto](https://github.com/quinn-rs/quinn) | cargo | 0.11.16 | MIT OR Apache-2.0 |
+| [quinn-udp](https://github.com/quinn-rs/quinn) | cargo | 0.5.15 | MIT OR Apache-2.0 |
+| [quote](https://github.com/dtolnay/quote) | cargo | 1.0.47 | MIT OR Apache-2.0 |
+| [r-efi](https://github.com/r-efi/r-efi) | cargo | 5.3.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later |
+| [r-efi](https://github.com/r-efi/r-efi) | cargo | 6.0.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later |
+| [rand](https://github.com/rust-random/rand) | cargo | 0.10.2 | MIT OR Apache-2.0 |
+| [rand](https://github.com/rust-random/rand) | cargo | 0.9.5 | MIT OR Apache-2.0 |
+| [rand_chacha](https://github.com/rust-random/rand) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [rand_core](https://github.com/rust-random/rand_core) | cargo | 0.10.1 | MIT OR Apache-2.0 |
+| [rand_core](https://github.com/rust-random/rand) | cargo | 0.9.5 | MIT OR Apache-2.0 |
+| [rand_pcg](https://github.com/rust-random/rngs) | cargo | 0.10.2 | MIT OR Apache-2.0 |
+| [rand_xoshiro](https://github.com/rust-random/rngs) | cargo | 0.7.0 | MIT OR Apache-2.0 |
+| [rapidhash](https://github.com/hoxxep/rapidhash) | cargo | 4.5.1 | MIT OR Apache-2.0 |
+| [raw-cpuid](https://github.com/gz/rust-cpuid) | cargo | 11.6.0 | MIT |
+| [redox_syscall](https://gitlab.redox-os.org/redox-os/syscall) | cargo | 0.5.18 | MIT |
+| [regex](https://github.com/rust-lang/regex) | cargo | 1.13.1 | MIT OR Apache-2.0 |
+| [regex-automata](https://github.com/rust-lang/regex) | cargo | 0.4.16 | MIT OR Apache-2.0 |
+| [regex-syntax](https://github.com/rust-lang/regex) | cargo | 0.8.11 | MIT OR Apache-2.0 |
+| [reqwest](https://github.com/seanmonstar/reqwest) | cargo | 0.12.28 | MIT OR Apache-2.0 |
+| [reqwest](https://github.com/seanmonstar/reqwest) | cargo | 0.13.4 | MIT OR Apache-2.0 |
+| [ring](https://github.com/briansmith/ring) | cargo | 0.17.14 | Apache-2.0 AND ISC |
+| [rust-embed](https://pyrossh.dev/repos/rust-embed) | cargo | 8.12.0 | MIT |
+| [rust-embed-impl](https://pyrossh.dev/repos/rust-embed) | cargo | 8.12.0 | MIT |
+| [rust-embed-utils](https://pyrossh.dev/repos/rust-embed) | cargo | 8.12.0 | MIT |
+| [rustc-demangle](https://github.com/rust-lang/rustc-demangle) | cargo | 0.1.28 | MIT/Apache-2.0 |
+| [rustc-hash](https://github.com/rust-lang/rustc-hash) | cargo | 2.1.3 | Apache-2.0 OR MIT |
+| [rustc_version](https://github.com/djc/rustc-version-rs) | cargo | 0.4.1 | MIT OR Apache-2.0 |
+| [rustix](https://github.com/bytecodealliance/rustix) | cargo | 1.1.4 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
+| [rustls](https://github.com/rustls/rustls) | cargo | 0.23.43 | Apache-2.0 OR ISC OR MIT |
+| [rustls-native-certs](https://github.com/rustls/rustls-native-certs) | cargo | 0.8.4 | Apache-2.0 OR ISC OR MIT |
+| [rustls-pki-types](https://github.com/rustls/pki-types) | cargo | 1.15.1 | MIT OR Apache-2.0 |
+| [rustls-platform-verifier](https://github.com/rustls/rustls-platform-verifier) | cargo | 0.7.0 | MIT OR Apache-2.0 |
+| [rustls-platform-verifier-android](https://github.com/rustls/rustls-platform-verifier) | cargo | 0.1.1 | MIT OR Apache-2.0 |
+| [rustls-webpki](https://github.com/rustls/webpki) | cargo | 0.103.13 | ISC |
+| [rustversion](https://github.com/dtolnay/rustversion) | cargo | 1.0.23 | MIT OR Apache-2.0 |
+| [ryu](https://github.com/dtolnay/ryu) | cargo | 1.0.23 | Apache-2.0 OR BSL-1.0 |
+| [same-file](https://github.com/BurntSushi/same-file) | cargo | 1.0.6 | Unlicense/MIT |
+| [schannel](https://github.com/steffengy/schannel-rs) | cargo | 0.1.29 | MIT |
+| [scoped-tls](https://github.com/alexcrichton/scoped-tls) | cargo | 1.0.1 | MIT/Apache-2.0 |
+| [scopeguard](https://github.com/bluss/scopeguard) | cargo | 1.2.0 | MIT OR Apache-2.0 |
+| [security-framework](https://github.com/kornelski/rust-security-framework) | cargo | 3.7.0 | MIT OR Apache-2.0 |
+| [security-framework-sys](https://github.com/kornelski/rust-security-framework) | cargo | 2.17.0 | MIT OR Apache-2.0 |
+| [semver](https://github.com/dtolnay/semver) | cargo | 1.0.28 | MIT OR Apache-2.0 |
+| [sentry](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [sentry-backtrace](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [sentry-contexts](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [sentry-core](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [sentry-panic](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [sentry-tracing](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [sentry-types](https://github.com/getsentry/sentry-rust) | cargo | 0.49.0 | MIT |
+| [serde](https://github.com/serde-rs/serde) | cargo | 1.0.229 | MIT OR Apache-2.0 |
+| [serde_core](https://github.com/serde-rs/serde) | cargo | 1.0.229 | MIT OR Apache-2.0 |
+| [serde_derive](https://github.com/serde-rs/serde) | cargo | 1.0.229 | MIT OR Apache-2.0 |
+| [serde_json](https://github.com/serde-rs/json) | cargo | 1.0.151 | MIT OR Apache-2.0 |
+| [serde_norway](https://github.com/cafkafk/serde-yaml) | cargo | 0.9.42 | MIT OR Apache-2.0 |
+| [serde_path_to_error](https://github.com/dtolnay/path-to-error) | cargo | 0.1.20 | MIT OR Apache-2.0 |
+| [serde_urlencoded](https://github.com/nox/serde_urlencoded) | cargo | 0.7.1 | MIT/Apache-2.0 |
+| [sha1](https://github.com/RustCrypto/hashes) | cargo | 0.11.0 | MIT OR Apache-2.0 |
+| [sha2](https://github.com/RustCrypto/hashes) | cargo | 0.10.9 | MIT OR Apache-2.0 |
+| [sha2](https://github.com/RustCrypto/hashes) | cargo | 0.11.0 | MIT OR Apache-2.0 |
+| [sharded-slab](https://github.com/hawkw/sharded-slab) | cargo | 0.1.7 | MIT |
+| [shlex](https://github.com/comex/rust-shlex) | cargo | 2.0.1 | MIT OR Apache-2.0 |
+| [signal-hook-registry](https://github.com/vorner/signal-hook) | cargo | 1.4.8 | MIT OR Apache-2.0 |
+| [simd-adler32](https://github.com/mcountryman/simd-adler32) | cargo | 0.3.10 | MIT |
+| [simd_cesu8](https://github.com/seancroach/simd_cesu8) | cargo | 1.2.0 | Apache-2.0 OR MIT |
+| [simdutf8](https://github.com/rusticstuff/simdutf8) | cargo | 0.1.5 | MIT OR Apache-2.0 |
+| [sketches-ddsketch](https://github.com/mheffner/rust-sketches-ddsketch) | cargo | 0.3.1 | Apache-2.0 |
+| [slab](https://github.com/tokio-rs/slab) | cargo | 0.4.12 | MIT |
+| [smallvec](https://github.com/servo/rust-smallvec) | cargo | 1.15.2 | MIT OR Apache-2.0 |
+| [socket2](https://github.com/rust-lang/socket2) | cargo | 0.6.5 | MIT OR Apache-2.0 |
+| [spin](https://github.com/mvdnes/spin-rs.git) | cargo | 0.9.9 | MIT |
+| [sqlx](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [sqlx-core](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [sqlx-macros](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [sqlx-macros-core](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [sqlx-mysql](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [sqlx-postgres](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [sqlx-sqlite](https://github.com/launchbadge/sqlx) | cargo | 0.9.0 | MIT OR Apache-2.0 |
+| [stable_deref_trait](https://github.com/storyyeller/stable_deref_trait) | cargo | 1.2.1 | MIT OR Apache-2.0 |
+| [stringprep](https://github.com/sfackler/rust-stringprep) | cargo | 0.1.5 | MIT/Apache-2.0 |
+| [strsim](https://github.com/rapidfuzz/strsim-rs) | cargo | 0.11.1 | MIT |
+| [subtle](https://github.com/dalek-cryptography/subtle) | cargo | 2.6.1 | BSD-3-Clause |
+| [syn](https://github.com/dtolnay/syn) | cargo | 2.0.119 | MIT OR Apache-2.0 |
+| [syn](https://github.com/dtolnay/syn) | cargo | 3.0.3 | MIT OR Apache-2.0 |
+| [sync_wrapper](https://github.com/Actyx/sync_wrapper) | cargo | 1.0.2 | Apache-2.0 |
+| [synstructure](https://github.com/mystor/synstructure) | cargo | 0.13.2 | MIT |
+| [tempfile](https://github.com/Stebalien/tempfile) | cargo | 3.27.0 | MIT OR Apache-2.0 |
+| [thiserror](https://github.com/dtolnay/thiserror) | cargo | 2.0.19 | MIT OR Apache-2.0 |
+| [thiserror-impl](https://github.com/dtolnay/thiserror) | cargo | 2.0.19 | MIT OR Apache-2.0 |
+| [thread_local](https://github.com/Amanieu/thread_local-rs) | cargo | 1.1.10 | MIT OR Apache-2.0 |
+| [time](https://github.com/time-rs/time) | cargo | 0.3.55 | MIT OR Apache-2.0 |
+| [time-core](https://github.com/time-rs/time) | cargo | 0.1.9 | MIT OR Apache-2.0 |
+| [time-macros](https://github.com/time-rs/time) | cargo | 0.2.32 | MIT OR Apache-2.0 |
+| [tinystr](https://github.com/unicode-org/icu4x) | cargo | 0.8.3 | Unicode-3.0 |
+| [tinyvec](https://github.com/Lokathor/tinyvec) | cargo | 1.12.0 | Zlib OR Apache-2.0 OR MIT |
+| [tinyvec_macros](https://github.com/Soveu/tinyvec_macros) | cargo | 0.1.1 | MIT OR Apache-2.0 OR Zlib |
+| [tokio](https://github.com/tokio-rs/tokio) | cargo | 1.53.1 | MIT |
+| [tokio-macros](https://github.com/tokio-rs/tokio) | cargo | 2.7.2 | MIT |
+| [tokio-rustls](https://github.com/rustls/tokio-rustls) | cargo | 0.26.4 | MIT OR Apache-2.0 |
+| [tokio-stream](https://github.com/tokio-rs/tokio) | cargo | 0.1.19 | MIT |
+| [tokio-util](https://github.com/tokio-rs/tokio) | cargo | 0.7.19 | MIT |
+| [tower](https://github.com/tower-rs/tower) | cargo | 0.5.3 | MIT |
+| [tower-http](https://github.com/tower-rs/tower-http) | cargo | 0.6.11 | MIT |
+| [tower-layer](https://github.com/tower-rs/tower) | cargo | 0.3.3 | MIT |
+| [tower-service](https://github.com/tower-rs/tower) | cargo | 0.3.3 | MIT |
+| [tracing](https://github.com/tokio-rs/tracing) | cargo | 0.1.44 | MIT |
+| [tracing-attributes](https://github.com/tokio-rs/tracing) | cargo | 0.1.31 | MIT |
+| [tracing-core](https://github.com/tokio-rs/tracing) | cargo | 0.1.36 | MIT |
+| [tracing-log](https://github.com/tokio-rs/tracing) | cargo | 0.2.0 | MIT |
+| [tracing-serde](https://github.com/tokio-rs/tracing) | cargo | 0.2.0 | MIT |
+| [tracing-subscriber](https://github.com/tokio-rs/tracing) | cargo | 0.3.23 | MIT |
+| [try-lock](https://github.com/seanmonstar/try-lock) | cargo | 0.2.5 | MIT |
+| [typenum](https://github.com/paholg/typenum) | cargo | 1.20.1 | MIT OR Apache-2.0 |
+| [uname](https://github.com/icorderi/rust-uname) | cargo | 0.1.1 | MIT/Apache-2.0 |
+| [unicase](https://github.com/seanmonstar/unicase) | cargo | 2.9.0 | MIT OR Apache-2.0 |
+| [unicode-bidi](https://github.com/servo/unicode-bidi) | cargo | 0.3.18 | MIT OR Apache-2.0 |
+| [unicode-ident](https://github.com/dtolnay/unicode-ident) | cargo | 1.0.24 | (MIT OR Apache-2.0) AND Unicode-3.0 |
+| [unicode-normalization](https://github.com/unicode-rs/unicode-normalization) | cargo | 0.1.25 | MIT OR Apache-2.0 |
+| [unicode-properties](https://github.com/unicode-rs/unicode-properties) | cargo | 0.1.4 | MIT/Apache-2.0 |
+| [unsafe-libyaml-norway](https://github.com/cafkafk/unsafe-libyaml-norway) | cargo | 0.2.15 | MIT |
+| [untrusted](https://github.com/briansmith/untrusted) | cargo | 0.9.0 | ISC |
+| [ureq](https://github.com/algesten/ureq) | cargo | 3.3.0 | MIT OR Apache-2.0 |
+| [ureq-proto](https://github.com/algesten/ureq-proto) | cargo | 0.6.0 | MIT OR Apache-2.0 |
+| [url](https://github.com/servo/rust-url) | cargo | 2.5.8 | MIT OR Apache-2.0 |
+| [utf8-zero](https://github.com/algesten/utf8-zero) | cargo | 0.8.1 | MIT OR Apache-2.0 |
+| [utf8_iter](https://github.com/hsivonen/utf8_iter) | cargo | 1.0.4 | Apache-2.0 OR MIT |
+| [utf8parse](https://github.com/alacritty/vte) | cargo | 0.2.2 | Apache-2.0 OR MIT |
+| [utoipa](https://github.com/juhaku/utoipa) | cargo | 5.5.0 | MIT OR Apache-2.0 |
+| [utoipa-gen](https://github.com/juhaku/utoipa) | cargo | 5.5.0 | MIT OR Apache-2.0 |
+| [utoipa-swagger-ui](https://github.com/juhaku/utoipa) | cargo | 9.0.2 | MIT OR Apache-2.0 |
+| [utoipa-swagger-ui-vendored](https://github.com/juhaku/utoipa) | cargo | 0.1.2 | MIT OR Apache-2.0 |
+| [uuid](https://github.com/uuid-rs/uuid) | cargo | 1.24.0 | Apache-2.0 OR MIT |
+| [valuable](https://github.com/tokio-rs/valuable) | cargo | 0.1.1 | MIT |
+| [vcpkg](https://github.com/mcgoo/vcpkg-rs) | cargo | 0.2.15 | MIT/Apache-2.0 |
+| [version_check](https://github.com/SergioBenitez/version_check) | cargo | 0.9.5 | MIT/Apache-2.0 |
+| [walkdir](https://github.com/BurntSushi/walkdir) | cargo | 2.5.0 | Unlicense/MIT |
+| [want](https://github.com/seanmonstar/want) | cargo | 0.3.1 | MIT |
+| [wasi](https://github.com/bytecodealliance/wasi) | cargo | 0.11.1+wasi-snapshot-preview1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
+| [wasip2](https://github.com/bytecodealliance/wasi-rs) | cargo | 1.0.4+wasi-0.2.12 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
+| [wasm-bindgen](https://github.com/wasm-bindgen/wasm-bindgen) | cargo | 0.2.126 | MIT OR Apache-2.0 |
+| [wasm-bindgen-futures](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/futures) | cargo | 0.4.76 | MIT OR Apache-2.0 |
+| [wasm-bindgen-macro](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro) | cargo | 0.2.126 | MIT OR Apache-2.0 |
+| [wasm-bindgen-macro-support](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/macro-support) | cargo | 0.2.126 | MIT OR Apache-2.0 |
+| [wasm-bindgen-shared](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/shared) | cargo | 0.2.126 | MIT OR Apache-2.0 |
+| [wasm-streams](https://github.com/MattiasBuelens/wasm-streams/) | cargo | 0.4.2 | MIT OR Apache-2.0 |
+| [web-sys](https://github.com/wasm-bindgen/wasm-bindgen/tree/master/crates/web-sys) | cargo | 0.3.103 | MIT OR Apache-2.0 |
+| [web-time](https://github.com/daxpedda/web-time) | cargo | 1.1.0 | MIT OR Apache-2.0 |
+| [webpki-root-certs](https://github.com/rustls/webpki-roots) | cargo | 1.0.9 | CDLA-Permissive-2.0 |
+| [webpki-roots](https://github.com/rustls/webpki-roots) | cargo | 1.0.9 | CDLA-Permissive-2.0 |
+| [whoami](https://github.com/ardaku/whoami) | cargo | 2.1.2 | Apache-2.0 OR BSL-1.0 OR MIT |
+| [winapi](https://github.com/retep998/winapi-rs) | cargo | 0.3.9 | MIT/Apache-2.0 |
+| [winapi-i686-pc-windows-gnu](https://github.com/retep998/winapi-rs) | cargo | 0.4.0 | MIT/Apache-2.0 |
+| [winapi-util](https://github.com/BurntSushi/winapi-util) | cargo | 0.1.11 | Unlicense OR MIT |
+| [winapi-x86_64-pc-windows-gnu](https://github.com/retep998/winapi-rs) | cargo | 0.4.0 | MIT/Apache-2.0 |
+| [windows-link](https://github.com/microsoft/windows-rs) | cargo | 0.2.1 | MIT OR Apache-2.0 |
+| [windows-result](https://github.com/microsoft/windows-rs) | cargo | 0.4.1 | MIT OR Apache-2.0 |
+| [windows-sys](https://github.com/microsoft/windows-rs) | cargo | 0.52.0 | MIT OR Apache-2.0 |
+| [windows-sys](https://github.com/microsoft/windows-rs) | cargo | 0.61.2 | MIT OR Apache-2.0 |
+| [windows-targets](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_aarch64_gnullvm](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_aarch64_msvc](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_i686_gnu](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_i686_gnullvm](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_i686_msvc](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_x86_64_gnu](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_x86_64_gnullvm](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [windows_x86_64_msvc](https://github.com/microsoft/windows-rs) | cargo | 0.52.6 | MIT OR Apache-2.0 |
+| [wit-bindgen](https://github.com/bytecodealliance/wit-bindgen) | cargo | 0.57.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT |
+| [writeable](https://github.com/unicode-org/icu4x) | cargo | 0.6.3 | Unicode-3.0 |
+| [yoke](https://github.com/unicode-org/icu4x) | cargo | 0.8.3 | Unicode-3.0 |
+| [yoke-derive](https://github.com/unicode-org/icu4x) | cargo | 0.8.2 | Unicode-3.0 |
+| [zerocopy](https://github.com/google/zerocopy) | cargo | 0.8.55 | BSD-2-Clause OR Apache-2.0 OR MIT |
+| [zerocopy-derive](https://github.com/google/zerocopy) | cargo | 0.8.55 | BSD-2-Clause OR Apache-2.0 OR MIT |
+| [zerofrom](https://github.com/unicode-org/icu4x) | cargo | 0.1.8 | Unicode-3.0 |
+| [zerofrom-derive](https://github.com/unicode-org/icu4x) | cargo | 0.1.7 | Unicode-3.0 |
+| [zeroize](https://github.com/RustCrypto/utils) | cargo | 1.9.0 | Apache-2.0 OR MIT |
+| [zerotrie](https://github.com/unicode-org/icu4x) | cargo | 0.2.4 | Unicode-3.0 |
+| [zerovec](https://github.com/unicode-org/icu4x) | cargo | 0.11.6 | Unicode-3.0 |
+| [zerovec-derive](https://github.com/unicode-org/icu4x) | cargo | 0.11.3 | Unicode-3.0 |
+| [zip](https://github.com/zip-rs/zip2.git) | cargo | 3.0.0 | MIT |
+| [zlib-rs](https://github.com/trifectatechfoundation/zlib-rs) | cargo | 0.6.6 | Zlib |
+| [zmij](https://github.com/dtolnay/zmij) | cargo | 1.0.23 | MIT |
+| [zopfli](https://github.com/zopfli-rs/zopfli) | cargo | 0.8.3 | Apache-2.0 |
+| [@cfworker/json-schema](https://github.com/cfworker/cfworker) | npm | 4.1.1 | MIT |
+| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped) | npm | 19.2.18 | MIT |
+| cookie-es | npm | 3.1.1 | MIT |
+| [csstype](https://github.com/frenic/csstype) | npm | 3.2.3 | MIT |
+| [prismjs](https://github.com/PrismJS/prism) | npm | 1.30.0 | MIT |
+| [react](https://github.com/react/react) | npm | 19.2.8 | MIT |
+| [react-dom](https://github.com/react/react) | npm | 19.2.8 | MIT |
+| [react-router](https://github.com/remix-run/react-router) | npm | 8.3.0 | MIT |
+| [react-simple-code-editor](https://github.com/react-simple-code-editor/react-simple-code-editor) | npm | 0.14.1 | MIT |
+| [scheduler](https://github.com/facebook/react) | npm | 0.27.0 | MIT |
+| yaml | npm | 2.9.0 | ISC |
+| [zustand](https://github.com/pmndrs/zustand) | npm | 5.0.14 | MIT |
diff --git a/assets/favicon.ico b/assets/favicon.ico
new file mode 100644
index 0000000..55f16f4
--- /dev/null
+++ b/assets/favicon.ico
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1a3eb6f7a5c8987dc6cf20c2a3c57bd414ac48ffb4165253b2c29bad50a06c2b
+size 32038
diff --git a/assets/favicon.svg b/assets/favicon.svg
new file mode 100644
index 0000000..c36a0c0
--- /dev/null
+++ b/assets/favicon.svg
@@ -0,0 +1,51 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1024 1024" width="1024" height="1024">
+<title>doppel favicon</title>
+<!-- The small size variant of assets/icon.svg, and the source of
+     assets/favicon.ico. The full icon is two overlapping documents; at 16
+     and 32 pixels that composition collapses into an unreadable smudge, so
+     the favicon keeps the background and the code glyph and drops the
+     cards. Nothing here is a new shape: the gradients and the glyph come
+     from icon.svg unchanged, only scaled. AGENTS.md carries the command
+     that rebuilds the .ico from this file. -->
+<defs>
+
+<linearGradient id="rim" x1="0" y1="0" x2="0" y2="1">
+  <stop offset="0" stop-color="#FFFFFF" stop-opacity="0.55"/>
+  <stop offset="0.45" stop-color="#FFFFFF" stop-opacity="0.10"/>
+  <stop offset="1" stop-color="#FFFFFF" stop-opacity="0.28"/>
+</linearGradient>
+<linearGradient id="gloss" x1="0" y1="0" x2="0" y2="1">
+  <stop offset="0" stop-color="#FFFFFF" stop-opacity="0.26"/>
+  <stop offset="0.42" stop-color="#FFFFFF" stop-opacity="0.04"/>
+  <stop offset="1" stop-color="#FFFFFF" stop-opacity="0"/>
+</linearGradient>
+<radialGradient id="vig" cx="0.5" cy="0.42" r="0.78">
+  <stop offset="0.45" stop-color="#000000" stop-opacity="0"/>
+  <stop offset="1" stop-color="#000000" stop-opacity="0.44"/>
+</radialGradient>
+
+<linearGradient id="bg" x1="0.15" y1="0" x2="0.85" y2="1">
+  <stop offset="0" stop-color="#155546"/><stop offset="0.55" stop-color="#0B3039"/>
+  <stop offset="1" stop-color="#071926"/>
+</linearGradient>
+<radialGradient id="halo" cx="0.34" cy="0.42" r="0.46">
+  <stop offset="0" stop-color="#43DCFF" stop-opacity="0.52"/>
+  <stop offset="1" stop-color="#43DCFF" stop-opacity="0"/>
+</radialGradient>
+<linearGradient id="steel" x1="0" y1="0" x2="0.4" y2="1">
+  <stop offset="0" stop-color="#FFFFFF"/><stop offset="0.5" stop-color="#DEF3EB"/>
+  <stop offset="1" stop-color="#9CC4B9"/>
+</linearGradient>
+<linearGradient id="ghost" x1="0" y1="0" x2="0.3" y2="1">
+  <stop offset="0" stop-color="#96F2FF" stop-opacity="0.58"/>
+  <stop offset="1" stop-color="#4C97FF" stop-opacity="0.16"/>
+</linearGradient>
+
+<clipPath id="clip"><path d="M1024.00,512.00 L1023.93,620.65 L1023.70,657.91 L1023.33,685.34 L1022.80,707.85 L1022.13,727.26 L1021.31,744.51 L1020.33,760.11 L1019.21,774.43 L1017.93,787.68 L1016.50,800.06 L1014.92,811.67 L1013.18,822.63 L1011.29,833.00 L1009.24,842.84 L1007.04,852.22 L1004.67,861.16 L1002.15,869.70 L999.46,877.87 L996.62,885.71 L993.60,893.22 L990.42,900.42 L987.07,907.34 L983.54,913.99 L979.85,920.38 L975.97,926.52 L971.91,932.42 L967.67,938.09 L963.24,943.54 L958.62,948.77 L953.80,953.80 L948.77,958.62 L943.54,963.24 L938.09,967.67 L932.42,971.91 L926.52,975.97 L920.38,979.85 L913.99,983.54 L907.34,987.07 L900.42,990.42 L893.22,993.60 L885.71,996.62 L877.87,999.46 L869.70,1002.15 L861.16,1004.67 L852.22,1007.04 L842.84,1009.24 L833.00,1011.29 L822.63,1013.18 L811.67,1014.92 L800.06,1016.50 L787.68,1017.93 L774.43,1019.21 L760.11,1020.33 L744.51,1021.31 L727.26,1022.13 L707.85,1022.80 L685.34,1023.33 L657.91,1023.70 L620.65,1023.93 L512.00,1024.00 L403.35,1023.93 L366.09,1023.70 L338.66,1023.33 L316.15,1022.80 L296.74,1022.13 L279.49,1021.31 L263.89,1020.33 L249.57,1019.21 L236.32,1017.93 L223.94,1016.50 L212.33,1014.92 L201.37,1013.18 L191.00,1011.29 L181.16,1009.24 L171.78,1007.04 L162.84,1004.67 L154.30,1002.15 L146.13,999.46 L138.29,996.62 L130.78,993.60 L123.58,990.42 L116.66,987.07 L110.01,983.54 L103.62,979.85 L97.48,975.97 L91.58,971.91 L85.91,967.67 L80.46,963.24 L75.23,958.62 L70.20,953.80 L65.38,948.77 L60.76,943.54 L56.33,938.09 L52.09,932.42 L48.03,926.52 L44.15,920.38 L40.46,913.99 L36.93,907.34 L33.58,900.42 L30.40,893.22 L27.38,885.71 L24.54,877.87 L21.85,869.70 L19.33,861.16 L16.96,852.22 L14.76,842.84 L12.71,833.00 L10.82,822.63 L9.08,811.67 L7.50,800.06 L6.07,787.68 L4.79,774.43 L3.67,760.11 L2.69,744.51 L1.87,727.26 L1.20,707.85 L0.67,685.34 L0.30,657.91 L0.07,620.65 L0.00,512.00 L0.07,403.35 L0.30,366.09 L0.67,338.66 L1.20,316.15 L1.87,296.74 L2.69,279.49 L3.67,263.89 L4.79,249.57 L6.07,236.32 L7.50,223.94 L9.08,212.33 L10.82,201.37 L12.71,191.00 L14.76,181.16 L16.96,171.78 L19.33,162.84 L21.85,154.30 L24.54,146.13 L27.38,138.29 L30.40,130.78 L33.58,123.58 L36.93,116.66 L40.46,110.01 L44.15,103.62 L48.03,97.48 L52.09,91.58 L56.33,85.91 L60.76,80.46 L65.38,75.23 L70.20,70.20 L75.23,65.38 L80.46,60.76 L85.91,56.33 L91.58,52.09 L97.48,48.03 L103.62,44.15 L110.01,40.46 L116.66,36.93 L123.58,33.58 L130.78,30.40 L138.29,27.38 L146.13,24.54 L154.30,21.85 L162.84,19.33 L171.78,16.96 L181.16,14.76 L191.00,12.71 L201.37,10.82 L212.33,9.08 L223.94,7.50 L236.32,6.07 L249.57,4.79 L263.89,3.67 L279.49,2.69 L296.74,1.87 L316.15,1.20 L338.66,0.67 L366.09,0.30 L403.35,0.07 L512.00,0.00 L620.65,0.07 L657.91,0.30 L685.34,0.67 L707.85,1.20 L727.26,1.87 L744.51,2.69 L760.11,3.67 L774.43,4.79 L787.68,6.07 L800.06,7.50 L811.67,9.08 L822.63,10.82 L833.00,12.71 L842.84,14.76 L852.22,16.96 L861.16,19.33 L869.70,21.85 L877.87,24.54 L885.71,27.38 L893.22,30.40 L900.42,33.58 L907.34,36.93 L913.99,40.46 L920.38,44.15 L926.52,48.03 L932.42,52.09 L938.09,56.33 L943.54,60.76 L948.77,65.38 L953.80,70.20 L958.62,75.23 L963.24,80.46 L967.67,85.91 L971.91,91.58 L975.97,97.48 L979.85,103.62 L983.54,110.01 L987.07,116.66 L990.42,123.58 L993.60,130.78 L996.62,138.29 L999.46,146.13 L1002.15,154.30 L1004.67,162.84 L1007.04,171.78 L1009.24,181.16 L1011.29,191.00 L1013.18,201.37 L1014.92,212.33 L1016.50,223.94 L1017.93,236.32 L1019.21,249.57 L1020.33,263.89 L1021.31,279.49 L1022.13,296.74 L1022.80,316.15 L1023.33,338.66 L1023.70,366.09 L1023.93,403.35 Z"/></clipPath>
+</defs>
+<g clip-path="url(#clip)">
+<rect width="1024" height="1024" fill="url(#bg)"/><rect width="1024" height="1024" fill="url(#halo)"/>
+<g transform="translate(512,512) scale(7.6)" fill="none" stroke="#5BEFC4" stroke-width="8.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="-26,-19 -45,0 -26,19"/><line x1="-9" y1="23" x2="9" y2="-23"/><polyline points="26,-19 45,0 26,19"/></g>
+<rect width="1024" height="1024" fill="url(#gloss)"/><rect width="1024" height="1024" fill="url(#vig)"/>
+</g>
+</svg>
diff --git a/docs/assets/icon-128.png b/assets/icon-128.png
similarity index 100%
rename from docs/assets/icon-128.png
rename to assets/icon-128.png
diff --git a/assets/icon.png b/assets/icon.png
new file mode 100644
index 0000000..b7bb027
--- /dev/null
+++ b/assets/icon.png
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:31e61af193e98ab55c431b9dd13c22921384a209917718c9140ecabf23685306
+size 138045
diff --git a/docs/assets/icon.svg b/assets/icon.svg
similarity index 100%
rename from docs/assets/icon.svg
rename to assets/icon.svg
diff --git a/crates/doppel-admin/Cargo.toml b/crates/doppel-admin/Cargo.toml
index 51fbd60..63659ef 100644
--- a/crates/doppel-admin/Cargo.toml
+++ b/crates/doppel-admin/Cargo.toml
@@ -8,10 +8,13 @@ license.workspace = true
 [dependencies]
 doppel-core = { path = "../doppel-core" }
 axum.workspace = true
+httpdate.workspace = true
 metrics-exporter-prometheus.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 tokio = { workspace = true, features = ["net", "sync"] }
+tower.workspace = true
+tower-http.workspace = true
 tracing.workspace = true
 utoipa.workspace = true
 utoipa-swagger-ui.workspace = true
@@ -21,7 +24,6 @@ async-trait.workspace = true
 metrics.workspace = true
 tempfile.workspace = true
 tokio = { workspace = true, features = ["macros", "rt", "sync"] }
-tower.workspace = true
 
 [lints]
 workspace = true
diff --git a/crates/doppel-admin/build.rs b/crates/doppel-admin/build.rs
new file mode 100644
index 0000000..e471d47
--- /dev/null
+++ b/crates/doppel-admin/build.rs
@@ -0,0 +1,174 @@
+//! Embed the built dashboard into the binary.
+//!
+//! Walks `frontend/dist` and writes a table of `include_bytes!` into `OUT_DIR`.
+//! No crate does this for us on purpose: `rust-embed` and `include_dir` would
+//! each be a direct dependency for a directory walk, and `CONTRIBUTING.md` asks
+//! what a new one does that the standard library cannot. This is forty lines.
+//!
+//! When `frontend/dist` is absent the tables are emitted empty and the
+//! `dashboard_assets` cfg is not set, so the crate still compiles and
+//! `cargo install --path crates/doppel-cli` works on a machine with no Node.
+//! `GET /` then answers 503 naming the command that builds it.
+
+use std::fmt::Write as _;
+use std::path::{Path, PathBuf};
+
+fn main() {
+    // `cargo::` rather than `cargo:` -- the older single-colon form is
+    // deprecated, and `rustc-check-cfg` is what stops the `unexpected_cfgs`
+    // lint from firing on our own conditional.
+    println!("cargo::rustc-check-cfg=cfg(dashboard_assets)");
+
+    stamp_build_time();
+
+    let dist = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../../frontend/dist")
+        .canonicalize()
+        .ok()
+        .filter(|dist| dist.join("index.html").is_file());
+
+    // Rebuilt when the dashboard is rebuilt. Watching the directory covers a
+    // file appearing or changing inside it; watching the parent covers `dist`
+    // itself appearing for the first time, which is the case a first
+    // `npm run build` produces.
+    println!("cargo::rerun-if-changed=../../frontend/dist");
+    println!("cargo::rerun-if-changed=../../frontend");
+
+    let mut generated = String::new();
+    let Some(dist) = dist else {
+        writeln!(
+            generated,
+            "/// No `frontend/dist` was present when this binary was built.\n\
+             pub static ASSETS: &[(&str, &[u8], &str)] = &[];\n\
+             pub static INDEX_HTML: &str = \"\";"
+        )
+        .expect("writing to a String cannot fail");
+        write(&generated);
+        return;
+    };
+
+    println!("cargo::rustc-cfg=dashboard_assets");
+
+    let mut files = Vec::new();
+    collect(&dist, &dist, &mut files);
+    files.sort();
+
+    writeln!(
+        generated,
+        "/// Every file of `frontend/dist` except `index.html`, as\n\
+         /// (request path under `/static/`, bytes, content type).\n\
+         pub static ASSETS: &[(&str, &[u8], &str)] = &["
+    )
+    .expect("writing to a String cannot fail");
+    for (request_path, absolute) in &files {
+        writeln!(
+            generated,
+            "    ({request_path:?}, include_bytes!({absolute:?}), {:?}),",
+            content_type(request_path)
+        )
+        .expect("writing to a String cannot fail");
+    }
+    writeln!(generated, "];").expect("writing to a String cannot fail");
+
+    // The page has to carry the element the listener substitutes the runtime
+    // configuration into. Checked here rather than at request time: it is a
+    // property of the build, so a mismatch between `frontend/index.html` and
+    // `dashboard.rs` should stop the build rather than serve a page whose
+    // configuration is the development placeholder.
+    let index = dist.join("index.html");
+    let markup = std::fs::read_to_string(&index).expect("frontend/dist/index.html is readable");
+    assert!(
+        markup.contains("id=\"doppel-config\""),
+        "{} has no doppel-config element; frontend/index.html and \
+         crates/doppel-admin/src/dashboard.rs have diverged",
+        index.display()
+    );
+
+    writeln!(
+        generated,
+        "/// The page itself, with the configuration placeholder still in it.\n\
+         pub static INDEX_HTML: &str = include_str!({:?});",
+        index
+    )
+    .expect("writing to a String cannot fail");
+
+    write(&generated);
+}
+
+/// When this binary was built, as seconds since the epoch.
+///
+/// Seconds rather than a year: turning them into one needs a calendar, and the
+/// crate has one -- `httpdate`, which hyper already brings in. Doing it there also
+/// puts the conversion where `cargo test` reaches it; a build script's own tests
+/// are never run.
+///
+/// `SOURCE_DATE_EPOCH` is honoured when set, which is what a reproducible build
+/// sets and what makes this value the same for two builds of one commit. Without
+/// it, the clock -- and the value is then baked in until something makes this
+/// script run again, which is the meaning of "build time" rather than a defect.
+fn stamp_build_time() {
+    println!("cargo::rerun-if-env-changed=SOURCE_DATE_EPOCH");
+
+    let seconds = std::env::var("SOURCE_DATE_EPOCH")
+        .ok()
+        .and_then(|value| value.trim().parse::<u64>().ok())
+        .unwrap_or_else(|| {
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_or(0, |since| since.as_secs())
+        });
+
+    println!("cargo::rustc-env=DOPPEL_BUILD_EPOCH={seconds}");
+}
+
+fn write(generated: &str) {
+    let out = PathBuf::from(std::env::var_os("OUT_DIR").expect("cargo sets OUT_DIR"));
+    std::fs::write(out.join("assets.rs"), generated).expect("write the asset table");
+}
+
+/// Every file under `dir`, as (path relative to `root`, absolute path).
+///
+/// `index.html` is skipped: it is served from `/` with the configuration
+/// substituted into it, not from `/static/` verbatim, so having it in both
+/// places would mean two ways to reach one page and only one of them configured.
+fn collect(root: &Path, dir: &Path, out: &mut Vec<(String, PathBuf)>) {
+    let entries = std::fs::read_dir(dir).expect("frontend/dist is readable");
+    for entry in entries.flatten() {
+        let path = entry.path();
+        if path.is_dir() {
+            collect(root, &path, out);
+            continue;
+        }
+        let relative = path
+            .strip_prefix(root)
+            .expect("walked below the root")
+            .to_string_lossy()
+            // A request path uses forward slashes whatever the build host does.
+            .replace('\\', "/");
+        if relative == "index.html" {
+            continue;
+        }
+        out.push((relative, path));
+    }
+}
+
+/// The content type for a built asset, by extension.
+///
+/// Only the extensions vite emits. Anything else is served as bytes rather than
+/// guessed at: a wrong `Content-Type` on a script is a page that silently does
+/// not run.
+fn content_type(path: &str) -> &'static str {
+    match path.rsplit_once('.').map(|(_, extension)| extension) {
+        Some("js" | "mjs") => "text/javascript; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("html") => "text/html; charset=utf-8",
+        Some("json") => "application/json",
+        Some("svg") => "image/svg+xml",
+        Some("ico") => "image/x-icon",
+        Some("png") => "image/png",
+        Some("woff2") => "font/woff2",
+        Some("woff") => "font/woff",
+        Some("map") => "application/json",
+        _ => "application/octet-stream",
+    }
+}
diff --git a/crates/doppel-admin/src/dashboard.rs b/crates/doppel-admin/src/dashboard.rs
new file mode 100644
index 0000000..746c1ab
--- /dev/null
+++ b/crates/doppel-admin/src/dashboard.rs
@@ -0,0 +1,379 @@
+//! The browser dashboard: the page, its assets, and `robots.txt`.
+//!
+//! The assets are embedded by `build.rs`, which walks `frontend/dist` and writes
+//! the table included below. A binary built without that directory carries an
+//! empty table and answers 503 here, so a source build on a machine with no Node
+//! still works and says why the dashboard is missing.
+
+use std::time::{Duration, SystemTime};
+
+use axum::Router;
+use axum::extract::{Path, State};
+use axum::http::{HeaderName, HeaderValue, header};
+use axum::response::{IntoResponse, Response};
+use axum::routing::get;
+use doppel_core::{Error, ErrorCode};
+use serde::Serialize;
+
+use crate::response::ApiError;
+use crate::state::AdminState;
+
+// `ASSETS` and `INDEX_HTML`, generated at build time.
+include!(concat!(env!("OUT_DIR"), "/assets.rs"));
+
+/// The placeholder `index.html` carries, replaced per request.
+///
+/// Matched as a whole element rather than by editing its contents: a partial
+/// match that silently failed would leave the development placeholder in a
+/// served page, and the page would then report the wrong title, the wrong
+/// version, and `public: false` for a public deployment.
+const CONFIG_ELEMENT_ID: &str = "doppel-config";
+
+/// Kept out of a search index three ways, because they fail differently: a
+/// crawler that reads headers sees this, one that reads markup sees the `meta`
+/// element in `index.html`, and one that reads `robots.txt` sees the route
+/// below.
+const ROBOTS_TAG: (HeaderName, HeaderValue) = (
+    HeaderName::from_static("x-robots-tag"),
+    HeaderValue::from_static("noindex, nofollow, noarchive"),
+);
+
+/// Sent with everything here.
+///
+/// `nosniff` matters most on the asset route: without it a browser may decide a
+/// file is something other than what its `Content-Type` says, and the whole
+/// point of serving hashed assets with an exact type is that it does not have to
+/// guess.
+const NO_SNIFF: (HeaderName, HeaderValue) = (
+    HeaderName::from_static("x-content-type-options"),
+    HeaderValue::from_static("nosniff"),
+);
+
+/// No inline script, no framing, nothing fetched from anywhere but this origin,
+/// and exactly one inline stylesheet, named by its hash.
+///
+/// The configuration reaches the page as the *contents* of a
+/// `application/json` element rather than as inline JavaScript, which is what
+/// makes `script-src 'self'` sufficient -- an inline `<script>window.config = ...`
+/// would have forced `unsafe-inline` and given up most of this.
+///
+/// The two style hashes are one `<style>` element that `react-simple-code-editor`
+/// renders per editor: a rule that keeps a placeholder visible, and two IE10
+/// workarounds. Blocking it cost nothing visible and reported a policy violation to
+/// the console for every editor on the page, which is a poor trade -- an operator
+/// reading their console should find their own problems there, not ours. So the
+/// element is allowed by hash rather than by `unsafe-inline`: this exact stylesheet
+/// and no other. The second hash is the same element seen empty, which is how a
+/// browser sees it at the moment React inserts it, before its contents are set.
+///
+/// `frontend/src/__tests__/editor-style-hash.test.ts` recomputes the first hash from
+/// the installed library, so an upgrade that changes that stylesheet fails the suite
+/// instead of quietly filling the console again.
+const CSP: (HeaderName, HeaderValue) = (
+    HeaderName::from_static("content-security-policy"),
+    HeaderValue::from_static(concat!(
+        "default-src 'none'; script-src 'self'; ",
+        "style-src 'self' 'sha256-40iiqMCd92gEkTDo77tABEiJ83Vil54BR3JPvnldhrA=' ",
+        "'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='; ",
+        "img-src 'self' data:; connect-src 'self'; base-uri 'none'; ",
+        "form-action 'none'; frame-ancestors 'none'",
+    )),
+);
+
+/// Whether this binary carries the dashboard's static assets.
+///
+/// False for a build that had no `frontend/dist`. The tests that exercise real
+/// asset delivery consult this rather than a cfg, and CI turns a skip into a
+/// failure through `DOPPEL_REQUIRE_DASHBOARD_ASSETS` -- the same mechanism the
+/// database suites use, for the same reason: a gate that silently skips is worse
+/// than no gate.
+#[must_use]
+pub fn is_built() -> bool {
+    !INDEX_HTML.is_empty()
+}
+
+pub fn routes() -> Router<AdminState> {
+    Router::new()
+        .route("/", get(index))
+        .route("/static/{*path}", get(asset))
+        .route("/robots.txt", get(robots))
+}
+
+/// A path the dashboard's router is allowed to answer with the page.
+///
+/// Everything the API serves lives under `/api/`, so everything outside it belongs
+/// to the dashboard -- and a client-side route reached by a reload rather than by a
+/// link has to arrive at the page rather than at a 404. `/status` was the case that
+/// showed this up: the dashboard has a page at that path and the API used to have
+/// an endpoint there, and a reload got the endpoint's JSON.
+///
+/// `/static/` is deliberately excluded. A missing asset must stay a 404: answering
+/// it with the page means a typo'd script tag loads HTML, which fails later and
+/// somewhere else.
+fn belongs_to_the_page(path: &str) -> bool {
+    !path.starts_with("/api/") && !path.starts_with("/static/")
+}
+
+/// The dashboard's answer for a path nothing else claimed.
+///
+/// A GET the page could route is the page; anything else keeps the error envelope,
+/// so a mistyped API path and a wrong method still answer as the API.
+pub async fn fallback(
+    state: State<AdminState>,
+    method: axum::http::Method,
+    uri: axum::http::Uri,
+) -> Response {
+    if method == axum::http::Method::GET && belongs_to_the_page(uri.path()) {
+        return index(state).await;
+    }
+    refuse(Error::new(
+        ErrorCode::NotFound,
+        format!("no route for {method} {}", uri.path()),
+    ))
+}
+
+/// What the page is told about the process serving it.
+///
+/// Rendered into the HTML rather than fetched: every value is known when the
+/// HTML is written, and a second request would mean the page cannot draw its own
+/// header until a round trip finishes.
+#[derive(Debug, Serialize)]
+struct PageConfig<'a> {
+    title: &'a str,
+    /// Whether `admin.title` was left out and `title` above is the default.
+    ///
+    /// The page draws its own wordmark in that case, and the plain string when an
+    /// operator has named this Doppel something. Sent as a flag rather than left
+    /// for the page to compare against a copy of the default: two spellings of one
+    /// constant, in two languages, is how the header ends up disagreeing with the
+    /// configuration nobody changed.
+    #[serde(rename = "titleIsDefault")]
+    title_is_default: bool,
+    /// Whether the admin API is unauthenticated. `true` and the page never asks
+    /// for a token.
+    public: bool,
+    version: &'a str,
+    /// `admin.auth.header`, which is configurable -- so the page has to be told
+    /// rather than assume the default.
+    #[serde(rename = "authHeader")]
+    auth_header: &'a str,
+    /// How often the proxy list is refetched.
+    #[serde(rename = "refreshMs")]
+    refresh_ms: u64,
+    /// The year in the footer's copyright line.
+    #[serde(rename = "copyrightYear")]
+    copyright_year: u16,
+}
+
+/// The proxy list is refetched once a minute.
+///
+/// Sent to the page rather than written there, so the interval is one value in
+/// one place.
+const REFRESH_MS: u64 = 60_000;
+
+/// When this binary was built, as seconds since the epoch. Stamped by `build.rs`.
+const BUILD_EPOCH: &str = env!("DOPPEL_BUILD_EPOCH");
+
+/// The last instant `httpdate` will render: it panics on year 9999 and later.
+const LATEST_RENDERABLE: u64 = 253_402_300_799;
+
+/// The calendar year of a unix timestamp.
+///
+/// `httpdate` owns the calendar, because leap years and century rules are a solved
+/// problem and `seconds / 31_556_952` here would be wrong for a day every four
+/// years. It renders an IMF-fixdate -- `Thu, 01 Jan 2026 00:00:00 GMT` -- whose
+/// field widths are fixed by the HTTP grammar, so the year is the four bytes at
+/// 12..16.
+fn year_of(seconds: u64) -> Option<u16> {
+    if seconds > LATEST_RENDERABLE {
+        return None;
+    }
+    let stamp = SystemTime::UNIX_EPOCH.checked_add(Duration::from_secs(seconds))?;
+    httpdate::fmt_http_date(stamp).get(12..16)?.parse().ok()
+}
+
+/// The year the footer's copyright line carries.
+///
+/// The build's year rather than the browser's clock: the page is part of this
+/// binary, so the year it was published in is a fact about the build and not about
+/// whoever is looking at it. A visitor with a wrong clock -- or a copy still in use
+/// in 2030 -- should read the same line.
+///
+/// An unreadable stamp says 1970, which is visibly wrong rather than quietly
+/// plausible. It takes a `build.rs` that stopped stamping, and the year in the
+/// footer is not worth a branch in the page for that.
+fn build_year() -> u16 {
+    BUILD_EPOCH.parse().ok().and_then(year_of).unwrap_or(1970)
+}
+
+async fn index(State(state): State<AdminState>) -> Response {
+    if !is_built() {
+        return refuse(Error::new(
+            ErrorCode::DashboardNotBuilt,
+            "this binary was built without the dashboard's static assets; build them with \
+             `npm --prefix frontend ci && npm --prefix frontend run build` and rebuild, or set \
+             `admin.dashboard: false` to stop serving this route",
+        ));
+    }
+
+    // The reloaded configuration, not the startup one: a reload that changes
+    // `admin.title` should change the page's heading, and `public` decides
+    // whether the page asks for a token at all.
+    let config = crate::access::policy(&state);
+    let page = PageConfig {
+        title: config.admin.title(),
+        title_is_default: config.admin.title.is_none(),
+        public: config.admin.is_public(),
+        version: env!("CARGO_PKG_VERSION"),
+        auth_header: config.admin.auth.header.as_str(),
+        refresh_ms: REFRESH_MS,
+        copyright_year: build_year(),
+    };
+
+    (
+        [
+            (
+                header::CONTENT_TYPE,
+                HeaderValue::from_static("text/html; charset=utf-8"),
+            ),
+            // Never cached. The document carries the configuration, so a cached
+            // copy would keep showing a title, a version and a `public` flag
+            // from before the last reload.
+            (header::CACHE_CONTROL, HeaderValue::from_static("no-store")),
+        ],
+        [ROBOTS_TAG, NO_SNIFF, CSP],
+        render(INDEX_HTML, &page),
+    )
+        .into_response()
+}
+
+/// Substitute the configuration into the placeholder element.
+///
+/// Every less-than character in the JSON is replaced by its JSON unicode
+/// escape. Inside an `application/json` script element the only sequence that
+/// can end the element early is a closing script tag, so removing the less-than
+/// removes the whole class of injection -- which is what makes a hostile
+/// `admin.title` a non-event rather than a scripting hole.
+fn render(template: &str, page: &PageConfig<'_>) -> String {
+    let json = serde_json::to_string(page)
+        .expect("PageConfig is plain data")
+        .replace('<', "\\u003c");
+
+    // `build.rs` refuses to build a binary whose `index.html` lacks the element,
+    // so this cannot fail at request time. It used to return the page with a
+    // message in it instead -- an untestable branch guarding an invariant that
+    // belongs to the build, and the build is where it is now checked.
+    let (before, rest) =
+        split_at_element(template).expect("build.rs checks index.html carries the element");
+    format!("{before}{json}{rest}")
+}
+
+/// Split the template around the placeholder's contents.
+///
+/// Returns the text up to and including the opening tag, and the text from the
+/// closing tag onwards.
+fn split_at_element(template: &str) -> Option<(&str, &str)> {
+    let id = format!("id=\"{CONFIG_ELEMENT_ID}\"");
+    let at = template.find(&id)?;
+    let open_ends = template[at..].find('>')? + at + 1;
+    let close_begins = template[open_ends..].find("</script>")? + open_ends;
+    Some((&template[..open_ends], &template[close_begins..]))
+}
+
+async fn asset(Path(path): Path<String>) -> Response {
+    let Some((_, bytes, content_type)) = ASSETS.iter().find(|(name, _, _)| *name == path) else {
+        // The envelope, not the page. A mistyped API path must not answer 200
+        // with an HTML document: a client would parse it as a successful
+        // response, and a human would see a working dashboard where they asked
+        // for something that is not there.
+        return refuse(Error::new(
+            ErrorCode::NotFound,
+            format!("no asset /static/{path}"),
+        ));
+    };
+
+    (
+        [
+            (header::CONTENT_TYPE, HeaderValue::from_static(content_type)),
+            // Safe because vite content-hashes every filename: a changed file is
+            // a different URL, so nothing has to expire.
+            (
+                header::CACHE_CONTROL,
+                HeaderValue::from_static("public, max-age=31536000, immutable"),
+            ),
+        ],
+        [ROBOTS_TAG, NO_SNIFF],
+        *bytes,
+    )
+        .into_response()
+}
+
+/// An error from a dashboard route, carrying the same headers its successes do.
+///
+/// The robots header belongs on a refusal as much as on a page: a crawler that
+/// reached `/static/typo.js` would otherwise be free to index the error body, and
+/// "every dashboard response forbids indexing" is easier to hold to than a list
+/// of the ones that do.
+fn refuse(error: Error) -> Response {
+    let mut response = ApiError::from(error).into_response();
+    response.headers_mut().extend([ROBOTS_TAG, NO_SNIFF]);
+    response
+}
+
+async fn robots() -> Response {
+    (
+        [(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/plain; charset=utf-8"),
+        )],
+        [ROBOTS_TAG, NO_SNIFF],
+        "User-agent: *\nDisallow: /\n",
+    )
+        .into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{LATEST_RENDERABLE, build_year, year_of};
+
+    #[test]
+    fn a_timestamp_becomes_the_year_it_falls_in() {
+        assert_eq!(year_of(0), Some(1970));
+        assert_eq!(year_of(1_767_225_600), Some(2026));
+    }
+
+    #[test]
+    fn the_year_turns_over_on_the_last_second_of_december() {
+        // 2024-12-31T23:59:59Z and the second after it. The off-by-one this guards
+        // would put a January build in the year before.
+        assert_eq!(year_of(1_735_689_599), Some(2024));
+        assert_eq!(year_of(1_735_689_600), Some(2025));
+    }
+
+    #[test]
+    fn a_leap_day_belongs_to_its_own_year() {
+        // 2024-02-29T00:00:00Z. A calendar of 365-day years puts this in 2025.
+        assert_eq!(year_of(1_709_164_800), Some(2024));
+    }
+
+    #[test]
+    fn a_timestamp_past_the_calendar_has_no_year() {
+        // `httpdate` panics rather than returning on year 9999, so the bound is
+        // checked here. The last second it renders still has to work.
+        assert_eq!(year_of(LATEST_RENDERABLE), Some(9999));
+        assert_eq!(year_of(LATEST_RENDERABLE + 1), None);
+        assert_eq!(year_of(u64::MAX), None);
+    }
+
+    #[test]
+    fn the_build_stamp_reaches_the_page() {
+        // The wiring, end to end: `build.rs` stamps seconds, this reads them. A
+        // build script that stopped stamping fails to compile; one that stamped
+        // something unusable lands on the 1970 fallback, which this catches.
+        assert!(
+            build_year() >= 2026,
+            "the build year is {}, so DOPPEL_BUILD_EPOCH is not a build time",
+            build_year()
+        );
+    }
+}
diff --git a/crates/doppel-admin/src/lib.rs b/crates/doppel-admin/src/lib.rs
index 39a55d5..1ac6623 100644
--- a/crates/doppel-admin/src/lib.rs
+++ b/crates/doppel-admin/src/lib.rs
@@ -2,13 +2,21 @@
 
 pub mod access;
 pub mod body;
+pub mod dashboard;
 pub mod openapi;
 pub mod proxies;
 pub mod response;
+pub mod rights;
+pub mod schema;
 pub mod state;
 pub mod status;
 pub mod templates;
 
+use axum::extract::{MatchedPath, Request};
+use tower::Layer as _;
+use tower::util::{MapRequest, MapRequestLayer};
+use tower_http::compression::CompressionLayer;
+
 pub use access::{Action, Caller, authorize, caller_from_headers};
 pub use response::ApiError;
 pub use state::AdminState;
@@ -18,16 +26,40 @@ pub use state::AdminState;
 /// A router rather than a server: `serve` owns the listener and the shutdown
 /// signal, and the tests drive this directly without binding a port.
 pub fn router(state: AdminState) -> axum::Router {
-    axum::Router::new()
+    // Read from the startup configuration, not the reloaded one: routes are
+    // built once, so turning the dashboard on or off takes a restart -- the same
+    // rule `admin.enable` already follows, and `main.example.yaml` says so.
+    let dashboard = state.startup().admin.is_dashboard_enabled();
+
+    let mut router = axum::Router::new()
         .merge(proxies::routes())
         .merge(templates::routes())
         .merge(status::routes())
-        .merge(openapi::routes())
-        // Without these two, a typo'd path answers 404 with an empty body and
-        // a wrong method answers 405 with one. The contract is that every
-        // error carries the envelope, and the paths a client is most likely
-        // to hit by accident were the ones that did not.
-        .fallback(not_found)
+        .merge(rights::routes())
+        .merge(schema::routes())
+        .merge(openapi::routes());
+
+    if dashboard {
+        router = router.merge(dashboard::routes());
+    }
+
+    // Without these two, a typo'd path answers 404 with an empty body and a wrong
+    // method answers 405 with one. The contract is that every error carries the
+    // envelope, and the paths a client is most likely to hit by accident were the
+    // ones that did not.
+    //
+    // With the dashboard on, the 404 half becomes its fallback: a GET outside
+    // `/api/` and `/static/` is a client-side route being reloaded and gets the
+    // page, and everything else keeps the envelope. That division is what makes
+    // "everything under /api/ is the API, everything else is the page" true rather
+    // than merely intended.
+    if dashboard {
+        router = router.fallback(dashboard::fallback);
+    } else {
+        router = router.fallback(not_found);
+    }
+
+    router
         .method_not_allowed_fallback(method_not_allowed)
         .with_state(state)
 }
@@ -52,6 +84,125 @@ async fn method_not_allowed(method: axum::http::Method, uri: axum::http::Uri) ->
     .into()
 }
 
+/// The admin service: the routes, compressed, with a trailing slash trimmed
+/// before routing.
+pub type App = MapRequest<axum::Router, fn(Request) -> Request>;
+
+/// The router with a trailing slash trimmed before routing.
+///
+/// `/metrics/` and `/api/v1/status/` answer as `/metrics` and `/api/v1/status`
+/// do. Axum stopped redirecting between the two spellings in 0.8, and a 404 for
+/// a slash is a poor answer for a path an operator typed or a scrape config
+/// carried over from somewhere else.
+///
+/// A layer around the router rather than on it: `Router::layer` runs after
+/// routing has already decided there is nothing there, which is too late to
+/// rewrite the path.
+///
+/// The proxy listener deliberately gets none of this. A proxied path is relayed
+/// byte for byte -- `/orders/` and `/orders` are two resources upstream, and one
+/// of this project's own mocks matches `^/api/v1/resource/9/$`.
+/// Compression, and where it applies.
+///
+/// The dashboard is 140 KB of JavaScript and CSS uncompressed and 74 KB gzipped,
+/// and every visitor was paying the difference: the assets were embedded as bytes
+/// and served as bytes. The Swagger UI's own stylesheet is another 150 KB. Both
+/// are text, both are served by this listener, and every browser asks for them
+/// compressed.
+///
+/// `br` and `gzip`, negotiated from `Accept-Encoding` -- brotli first when the
+/// client takes both, because it is smaller on text and every browser that speaks
+/// it says so. A client that asks for neither gets the bytes as they are.
+///
+/// On this listener only. The proxy listener relays what the upstream sent,
+/// byte for byte and encoding included: a client under test asking for
+/// `identity` and getting gzip because a proxy decided to help is a bug in the
+/// thing it is testing against.
+#[must_use]
+pub fn app(state: AdminState) -> App {
+    // Latency inside compression, so what it measures is the work rather than the
+    // deflating: a scrape of a 150 KB stylesheet should not read as a slow route.
+    // Also inside routing, which is what makes `MatchedPath` available -- the
+    // template is the label, and a label built from the path itself would put one
+    // series per proxy name and per query string into the exposition.
+    //
+    // Compression on the router rather than around it: `axum::serve` wants a
+    // service whose body is axum's own, and `Router::layer` is what converts the
+    // compressed body back into one. Running after routing costs nothing here --
+    // a response is compressed whatever matched it.
+    MapRequestLayer::new(trim_trailing_slash as fn(Request) -> Request).layer(
+        router(state)
+            .layer(axum::middleware::from_fn(record_admin_request))
+            .layer(CompressionLayer::new().br(true).gzip(true)),
+    )
+}
+
+/// One admin request, timed and recorded by the route it matched.
+///
+/// `MatchedPath` is the template the router matched -- `/api/v1/proxies/{name}`,
+/// never `/api/v1/proxies/alpha` -- so a deployment with a hundred proxies has one
+/// series and a query string has none. A request that matched nothing has no
+/// template, and is recorded under the empty route for the same reason an
+/// unresolved proxy request is: the total has to be the total.
+async fn record_admin_request(
+    matched: Option<MatchedPath>,
+    request: Request,
+    next: axum::middleware::Next,
+) -> axum::response::Response {
+    let method = request.method().as_str().to_owned();
+    let route = matched.map_or_else(
+        || doppel_core::metrics::UNMATCHED.to_owned(),
+        |matched| matched.as_str().to_owned(),
+    );
+
+    let started = std::time::Instant::now();
+    let response = next.run(request).await;
+    doppel_core::metrics::record_admin(
+        &method,
+        &route,
+        response.status().as_u16(),
+        started.elapsed(),
+    );
+    response
+}
+
+/// `/metrics/` becomes `/metrics`, and two paths are left exactly as they came.
+///
+/// `/` is not a trailing slash to be trimmed; trimming it would leave an empty
+/// path that matches nothing.
+///
+/// The Swagger UI is the other one, and it is not a matter of taste:
+/// `utoipa-swagger-ui` answers the bare `/swagger-ui` with `303 See Other` to
+/// `/swagger-ui/`, so trimming the slash off turns the pair into a redirect that
+/// arrives back where it started -- measured as exactly that, `303` with
+/// `location: /swagger-ui/`, on a request for `/swagger-ui/`. Its own assets are
+/// resolved relative to that path too, which is the second reason the subtree is
+/// left alone.
+///
+/// Hand-written rather than `tower-http`'s `NormalizePathLayer`, which trims
+/// unconditionally and has no way to exempt a subtree. It was that layer, and
+/// this is what it broke.
+fn trim_trailing_slash(mut request: Request) -> Request {
+    let uri = request.uri();
+    let path = uri.path();
+    if path == "/" || !path.ends_with('/') || path.starts_with("/swagger-ui") {
+        return request;
+    }
+
+    let trimmed = path.trim_end_matches('/');
+    let rebuilt = match uri.query() {
+        Some(query) => format!("{trimmed}?{query}"),
+        None => trimmed.to_owned(),
+    };
+    // A path that came in parseable stays parseable with fewer bytes on the end;
+    // if it somehow does not, the request goes through untouched rather than
+    // being answered with a 400 nobody can act on.
+    if let Ok(uri) = rebuilt.parse() {
+        *request.uri_mut() = uri;
+    }
+    request
+}
+
 /// Bind nothing, serve until `shutdown` resolves.
 ///
 /// Mirrors `doppel_proxy::serve`: the caller owns the listener and the
@@ -62,7 +213,12 @@ pub async fn serve(
     listener: tokio::net::TcpListener,
     shutdown: impl Future<Output = ()> + Send + 'static,
 ) -> std::io::Result<()> {
-    axum::serve(listener, router(state))
-        .with_graceful_shutdown(shutdown)
-        .await
+    // `into_make_service` from `axum::ServiceExt`, not the `Router` method: the
+    // trailing-slash layer makes this a `Service` rather than a `Router`.
+    axum::serve(
+        listener,
+        axum::ServiceExt::<axum::extract::Request>::into_make_service(app(state)),
+    )
+    .with_graceful_shutdown(shutdown)
+    .await
 }
diff --git a/crates/doppel-admin/src/openapi.rs b/crates/doppel-admin/src/openapi.rs
index 82b83a9..dc9a04c 100644
--- a/crates/doppel-admin/src/openapi.rs
+++ b/crates/doppel-admin/src/openapi.rs
@@ -28,6 +28,8 @@ use crate::state::AdminState;
         crate::templates::list,
         crate::templates::upload,
         crate::templates::remove,
+        crate::rights::rights,
+        crate::schema::schema,
         crate::status::reload,
         crate::status::status,
         crate::status::exposition,
@@ -38,6 +40,10 @@ use crate::state::AdminState;
         crate::proxies::ProxyRequest,
         crate::templates::TemplateEntry,
         crate::templates::TemplateList,
+        crate::rights::AccessReport,
+        crate::rights::ActionRights,
+        crate::rights::ProxyRights,
+        crate::rights::CallerView,
         crate::status::Status,
         crate::status::ProxyStatus,
         crate::status::ReloadReport,
@@ -78,6 +84,13 @@ impl Modify for TokenScheme {
 
 /// `/openapi.json` and `/swagger-ui`.
 ///
+/// Both outside `/api/`, and unversioned. Neither is a resource of the API: the
+/// document *describes* every version this binary knows, and the UI is a page
+/// served to a browser. `/api/` exists to keep endpoints from colliding with the
+/// dashboard's pages, and these two are on the pages' side of that line -- which
+/// is also where every tool looks for them, `/openapi.json` being the
+/// conventional path the way `/metrics` is.
+///
 /// The Swagger UI assets are vendored into the binary rather than fetched by
 /// the build script, which is the crate's default. A build that reaches the
 /// network cannot run in an offline or egress-restricted environment, and the
@@ -106,7 +119,9 @@ mod tests {
         ("post", "/api/v1/proxies/{name}/templates/{file}"),
         ("delete", "/api/v1/proxies/{name}/templates/{file}"),
         ("post", "/api/v1/config/reload"),
-        ("get", "/status"),
+        ("get", "/api/v1/access"),
+        ("get", "/api/v1/schema"),
+        ("get", "/api/v1/status"),
         ("get", "/metrics"),
     ];
 
diff --git a/crates/doppel-admin/src/proxies.rs b/crates/doppel-admin/src/proxies.rs
index e7844fd..3379970 100644
--- a/crates/doppel-admin/src/proxies.rs
+++ b/crates/doppel-admin/src/proxies.rs
@@ -202,19 +202,42 @@ pub(crate) async fn create(
         .await
         .map_err(|err| store_error(&err))?;
 
+    // The proxy exists in the store; this is what makes it exist in the process.
+    crate::status::apply_to_runtime(&state).await?;
+
     Ok(with_etag(StatusCode::CREATED, created, Some(location)))
 }
 
+/// The rename landed in the configuration and the templates did not follow.
+///
+/// The configuration is written first, deliberately: the write is what authorises
+/// moving anything. So a failure here leaves a proxy under its new name whose
+/// template files are still under the old one, and the mocks naming them render
+/// errors until somebody moves them. That is worth saying in full rather than
+/// reporting as a store failure, because the fix is a one-line `mv` and the message
+/// is the only place a reader could learn which two names to use.
+fn renamed_but_stranded(from: &str, to: &str, err: &StoreError) -> Error {
+    Error::new(
+        ErrorCode::StoreError,
+        format!(
+            "`{from}` was renamed to `{to}` in the configuration, but its templates \
+             could not be moved: {err}. The templates are still stored under `{from}`, \
+             so any mock of `{to}` naming a template file will fail to render until \
+             they are moved."
+        ),
+    )
+}
+
 #[utoipa::path(
     put, path = "/api/v1/proxies/{name}", tag = "proxies",
     params(
-        ("name" = String, Path, description = "Proxy name; the body must repeat it"),
+        ("name" = String, Path, description = "Proxy name; a different name in the body renames it"),
         ("If-Match" = Option<String>, Header, description = "The revision read earlier, quoted"),
     ),
     request_body = ProxyRequest,
     responses(
         (status = 200, description = "Replaced; the new revision is in the body and `ETag`", body = ProxyView),
-        (status = 400, description = "Malformed body, a rename, or two disagreeing revisions", body = ErrorBody),
+        (status = 400, description = "Malformed body, a taken name, or two disagreeing revisions", body = ErrorBody),
         (status = 401, body = ErrorBody), (status = 403, body = ErrorBody),
         (status = 404, body = ErrorBody),
         (status = 409, description = "The proxy changed since it was read", body = ErrorBody),
@@ -234,24 +257,15 @@ pub(crate) async fn update(
     drop(policy);
 
     let request = parse_request(&read_body(body, &headers, MAX_DOCUMENT_BYTES).await?)?;
-    if request.proxy.name != *name {
-        // A proxy's name is also its template directory. Renaming through PUT
-        // would strand the old directory and leave the new proxy pointing at
-        // templates that are not there, which is not what anyone typing a
-        // different name into a body is asking for.
-        return Err(Error::new(
-            ErrorCode::ConfigInvalid,
-            format!(
-                "body names proxy `{}` but the path names `{name}`; \
-                 a proxy cannot be renamed through an update",
-                request.proxy.name
-            ),
-        )
-        .into());
-    }
     let expected = required_revision(&headers, request.revision.as_deref())?;
 
     let proxy = request.proxy;
+    // A name in the body that differs from the path is a rename, not a mistake. It
+    // used to be refused, because a proxy's name is also where its templates live
+    // and a rename that left them behind would point every mock at a file that is
+    // not there -- so the rename moves them, below.
+    let renamed = (proxy.name.as_str() != name).then(|| proxy.name.to_string());
+
     let updated = commit(state.store(), |config| {
         let index = position(config, &name).ok_or_else(|| not_found(&name))?;
         // Re-checked on every attempt, against whatever the store holds now.
@@ -260,20 +274,47 @@ pub(crate) async fn update(
         if Revision::of_proxy(&config.proxies[index]) != expected {
             return Err(stale(&name));
         }
+        if let Some(new_name) = &renamed
+            && position(config, new_name).is_some()
+        {
+            // Caught here rather than left to validation, which would report it
+            // against a position in the document -- `proxies[3].name` -- when what
+            // the caller needs to know is that the name is taken.
+            return Err(Error::new(
+                ErrorCode::ConfigInvalid,
+                format!("a proxy named `{new_name}` already exists"),
+            ));
+        }
         config.proxies[index] = proxy.clone();
         Ok(view(&proxy))
     })
     .await?;
 
+    // Both of these follow the configuration write, and in this order. The write is
+    // what authorises touching the templates at all -- the same reason `delete` waits
+    // for it -- and a rename has to happen before the files are pruned, because after
+    // it they are the new name's.
+    if let Some(new_name) = &renamed {
+        state
+            .store()
+            .rename_templates(name.as_str(), new_name)
+            .await
+            .map_err(|err| renamed_but_stranded(&name, new_name, &err))?;
+    }
     // The update landed, so the mocks it removed are gone and the files only
-    // they named can no longer be rendered. Same order as delete, for the
-    // same reason: the configuration write is what authorises dropping them.
+    // they named can no longer be rendered.
     state
         .store()
-        .retain_templates(name.as_str(), &crate::templates::declared(&updated.proxy))
+        .retain_templates(
+            renamed.as_deref().unwrap_or(name.as_str()),
+            &crate::templates::declared(&updated.proxy),
+        )
         .await
         .map_err(|err| store_error(&err))?;
 
+    // Without this the upstream changes in the document and the traffic does not.
+    crate::status::apply_to_runtime(&state).await?;
+
     Ok(with_etag(StatusCode::OK, updated, None))
 }
 
@@ -330,6 +371,10 @@ pub(crate) async fn remove(
         .await
         .map_err(|err| store_error(&err))?;
 
+    // A deleted proxy that is still being served is the worst of the three: the
+    // operator has been told it is gone.
+    crate::status::apply_to_runtime(&state).await?;
+
     Ok(StatusCode::NO_CONTENT.into_response())
 }
 
diff --git a/crates/doppel-admin/src/rights.rs b/crates/doppel-admin/src/rights.rs
new file mode 100644
index 0000000..0946693
--- /dev/null
+++ b/crates/doppel-admin/src/rights.rs
@@ -0,0 +1,200 @@
+//! What the caller may do, reported to the caller.
+//!
+//! The dashboard needs this: a button for an action the server will refuse is
+//! worse than no button, because the operator finds out by trying. Nothing else
+//! in the API says anything about the *caller's* rights -- every other endpoint
+//! either performs an action or refuses it -- so this is the one endpoint whose
+//! subject is the request rather than the configuration.
+
+use axum::Router;
+use axum::extract::State;
+use axum::http::HeaderMap;
+use axum::routing::get;
+use doppel_core::config::ProxyConfig;
+use serde::Serialize;
+use std::collections::BTreeMap;
+
+use crate::access::{self, Action, Caller};
+use crate::state::AdminState;
+
+pub fn routes() -> Router<AdminState> {
+    Router::new().route("/api/v1/access", get(rights))
+}
+
+/// Who the caller is, as far as this process is concerned.
+///
+/// Returning the token's own name and group leaks nothing -- the caller
+/// presented it -- and it is what lets the dashboard say who is signed in
+/// rather than only that somebody is.
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+#[serde(tag = "kind", rename_all = "lowercase")]
+pub enum CallerView {
+    /// No token, or one this configuration does not recognise. The two are not
+    /// distinguished, for the reason `Caller` gives: telling them apart would
+    /// confirm which tokens exist.
+    Anonymous,
+    Token {
+        name: String,
+        group: String,
+    },
+}
+
+/// The six actions, as booleans.
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct ActionRights {
+    pub list: bool,
+    pub read: bool,
+    pub create: bool,
+    pub update: bool,
+    pub delete: bool,
+    pub upload: bool,
+}
+
+/// The four actions a proxy's own `access` block may override.
+///
+/// `list` and `create` are not about one proxy, so they are absent here rather
+/// than repeated per proxy -- the same reason `ProxyAccessConfig` cannot spell
+/// them.
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct ProxyRights {
+    pub read: bool,
+    pub update: bool,
+    pub delete: bool,
+    pub upload: bool,
+}
+
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct AccessReport {
+    pub caller: CallerView,
+    /// The global `access` block, evaluated for this caller.
+    pub global: ActionRights,
+    /// Per proxy, where a proxy's own `access` overrides the global answer.
+    ///
+    /// Absent -- not empty -- for a caller who may not `list`. The map is keyed
+    /// by proxy name, so returning it would be a proxy listing by another route,
+    /// and `access.rs` is explicit that a caller without read access must not be
+    /// able to tell a real proxy from an invented one.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxies: Option<BTreeMap<String, ProxyRights>>,
+}
+
+impl From<Caller> for CallerView {
+    fn from(caller: Caller) -> Self {
+        match caller {
+            Caller::Anonymous => Self::Anonymous,
+            Caller::Token { name, group } => Self::Token { name, group },
+        }
+    }
+}
+
+/// `GET /api/v1/access` -- what the caller may do.
+///
+/// Answers 200 for everybody, anonymous included: an endpoint whose purpose is
+/// to report that the caller may do nothing cannot itself demand a right, and
+/// there is nothing here a caller could not learn by attempting the six actions
+/// and reading the statuses.
+///
+/// Every field is `authorize` evaluated, never a second reading of the `access`
+/// blocks. A copy of that decision would be a copy that can disagree with the
+/// one enforcing it, and the disagreement would reach the operator as a button
+/// that does nothing -- or, worse, as a hidden action they were allowed to take.
+#[utoipa::path(
+    get, path = "/api/v1/access", tag = "process",
+    responses((status = 200, description = "What the calling token may do", body = AccessReport)),
+    security(("token" = [])),
+)]
+pub(crate) async fn rights(
+    State(state): State<AdminState>,
+    headers: HeaderMap,
+) -> axum::Json<AccessReport> {
+    // The policy the last reload put into effect, like every other handler --
+    // not whatever is in the store right now. Reporting rights from an unloaded
+    // document would describe a server nobody is running.
+    let config = access::policy(&state);
+    let caller = access::caller_from_headers_with_env(&config.admin, state.env_tokens(), &headers);
+
+    let permits = |proxy: Option<&ProxyConfig>, action: Action| {
+        access::authorize(&config.admin, proxy, action, &caller).is_ok()
+    };
+
+    let global = ActionRights {
+        list: permits(None, Action::List),
+        read: permits(None, Action::Read),
+        create: permits(None, Action::Create),
+        update: permits(None, Action::Update),
+        delete: permits(None, Action::Delete),
+        upload: permits(None, Action::Upload),
+    };
+
+    let proxies = global.list.then(|| {
+        config
+            .proxies
+            .iter()
+            .map(|proxy| {
+                (
+                    proxy.name.to_string(),
+                    ProxyRights {
+                        read: permits(Some(proxy), Action::Read),
+                        update: permits(Some(proxy), Action::Update),
+                        delete: permits(Some(proxy), Action::Delete),
+                        upload: permits(Some(proxy), Action::Upload),
+                    },
+                )
+            })
+            .collect()
+    });
+
+    axum::Json(AccessReport {
+        caller: caller.into(),
+        global,
+        proxies,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn an_anonymous_caller_is_reported_without_a_name() {
+        let json = serde_json::to_value(CallerView::from(Caller::Anonymous)).unwrap();
+        assert_eq!(json, serde_json::json!({"kind": "anonymous"}));
+    }
+
+    #[test]
+    fn a_token_is_reported_by_its_name_and_group() {
+        let json = serde_json::to_value(CallerView::from(Caller::Token {
+            name: "ci".to_owned(),
+            group: "ops".to_owned(),
+        }))
+        .unwrap();
+        assert_eq!(
+            json,
+            serde_json::json!({"kind": "token", "name": "ci", "group": "ops"})
+        );
+    }
+
+    #[test]
+    fn an_absent_proxy_map_is_absent_rather_than_empty() {
+        // An empty object says "there are no proxies", which is a statement about
+        // the configuration. The point of withholding the map is to say nothing
+        // at all, so the key has to be gone.
+        let report = AccessReport {
+            caller: CallerView::Anonymous,
+            global: ActionRights {
+                list: false,
+                read: false,
+                create: false,
+                update: false,
+                delete: false,
+                upload: false,
+            },
+            proxies: None,
+        };
+        let json = serde_json::to_value(&report).unwrap();
+        assert!(
+            json.get("proxies").is_none(),
+            "proxies must be absent, not null or empty: {json}"
+        );
+    }
+}
diff --git a/crates/doppel-admin/src/schema.rs b/crates/doppel-admin/src/schema.rs
new file mode 100644
index 0000000..6c70810
--- /dev/null
+++ b/crates/doppel-admin/src/schema.rs
@@ -0,0 +1,108 @@
+//! The configuration schema, served by the process the configuration is for.
+//!
+//! `doppel-config.schema.json` in the repository and the copy attached to every
+//! release are the same document, and both answer "what does a configuration look
+//! like" for whichever version you fetched. This answers it for the version that is
+//! *running*, which is the question a client editing a live configuration is
+//! actually asking.
+//!
+//! The dashboard is that client: it takes the field bounds it enforces while
+//! someone types -- patterns, lengths, ranges -- and the validation in its YAML
+//! editor from here, so there is no second, laxer copy of the rules written in
+//! TypeScript. A rule added to a newtype in `doppel-core` reaches the page without
+//! anyone editing the page.
+
+use std::sync::OnceLock;
+
+use axum::Router;
+use axum::http::{HeaderValue, header};
+use axum::response::{IntoResponse, Response};
+use axum::routing::get;
+
+use crate::state::AdminState;
+
+pub fn routes() -> Router<AdminState> {
+    Router::new().route("/api/v1/schema", get(schema))
+}
+
+/// The schema, serialized once.
+///
+/// Building it walks every `ToSchema` implementation in the configuration types
+/// and rewrites every `$ref`, which is not work worth repeating per request for a
+/// document that cannot change while the process lives.
+fn body() -> &'static str {
+    static BODY: OnceLock<String> = OnceLock::new();
+    BODY.get_or_init(|| {
+        serde_json::to_string(&doppel_core::config::schema::json_schema())
+            .expect("a json value serializes")
+    })
+}
+
+/// `GET /api/v1/schema` -- the configuration document as a JSON Schema.
+///
+/// Unauthenticated, like `/api/v1/access` and `/api/v1/status`: this describes the
+/// shape of a configuration, never the contents of one. The identical bytes are
+/// published on GitHub and attached to each release, so a token here would guard
+/// nothing while stopping the dashboard from validating anything before a caller
+/// signs in.
+#[utoipa::path(
+    get, path = "/api/v1/schema", tag = "process",
+    responses((status = 200, description = "The configuration schema, JSON Schema 2020-12")),
+)]
+pub(crate) async fn schema() -> Response {
+    (
+        [
+            // The registered type for a JSON Schema document. Every JSON parser
+            // reads it as JSON regardless, and an editor that looks at the header
+            // learns something true from this one.
+            (
+                header::CONTENT_TYPE,
+                HeaderValue::from_static("application/schema+json"),
+            ),
+            // It cannot change without a restart, and a restart is usually a new
+            // version -- so a short cache saves the bytes on a page reload without
+            // outliving an upgrade by long.
+            (
+                header::CACHE_CONTROL,
+                HeaderValue::from_static("public, max-age=600"),
+            ),
+        ],
+        body(),
+    )
+        .into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::body;
+
+    #[test]
+    fn the_served_bytes_are_the_schema_the_code_generates() {
+        // The same document `doppel config schema` prints and the repository keeps,
+        // minus the pretty-printing. A second serialization here would be a second
+        // schema, and the drift test in `doppel-core` would not see it.
+        let served: serde_json::Value =
+            serde_json::from_str(body()).expect("served bytes are JSON");
+        assert_eq!(served, doppel_core::config::schema::json_schema());
+    }
+
+    #[test]
+    fn the_schema_carries_the_bounds_a_client_validates_with() {
+        // What the dashboard reads out of it. If a refactor stopped emitting these,
+        // the page would quietly accept anything and let the server refuse it --
+        // which is the behaviour this endpoint exists to replace.
+        let served: serde_json::Value =
+            serde_json::from_str(body()).expect("served bytes are JSON");
+        let name = &served["$defs"]["ProxyName"];
+        assert!(name["pattern"].is_string(), "no pattern on ProxyName");
+        assert!(name["maxLength"].is_number(), "no maxLength on ProxyName");
+        assert!(
+            served["$defs"]["Ratio"]["maximum"].is_number(),
+            "no maximum on Ratio"
+        );
+        assert!(
+            served["$defs"]["ProxyConfig"]["properties"]["url"].is_object(),
+            "no url property on ProxyConfig"
+        );
+    }
+}
diff --git a/crates/doppel-admin/src/status.rs b/crates/doppel-admin/src/status.rs
index 73b4807..baaf1c6 100644
--- a/crates/doppel-admin/src/status.rs
+++ b/crates/doppel-admin/src/status.rs
@@ -16,7 +16,7 @@ use crate::state::AdminState;
 
 pub fn routes() -> Router<AdminState> {
     Router::new()
-        .route("/status", get(status))
+        .route("/api/v1/status", get(status))
         .route("/metrics", get(exposition))
         .route("/api/v1/config/reload", post(reload))
 }
@@ -60,8 +60,12 @@ pub struct ReloadReport {
 /// Unauthenticated by design -- it is the endpoint a load balancer calls, and
 /// that is why every upstream goes through `redact_credentials` on the way
 /// out.
+///
+/// Under `/api/` like everything else the API serves. It was `/status`, which put
+/// it in the same namespace as the dashboard's own pages: a reload on the
+/// dashboard's `/status` tab reached this and returned JSON instead of the page.
 #[utoipa::path(
-    get, path = "/status", tag = "process",
+    get, path = "/api/v1/status", tag = "process",
     responses((status = 200, description = "What this process is serving right now", body = Status)),
 )]
 pub(crate) async fn status(State(state): State<AdminState>) -> Response {
@@ -95,9 +99,18 @@ pub(crate) async fn status(State(state): State<AdminState>) -> Response {
 
 /// The Prometheus exposition.
 ///
-/// Unauthenticated, like `/status`: a scraper is a machine on the operator's
-/// network with no place to put a token, and the exposition names proxies and
-/// counts -- never a token, a URL or a header value.
+/// Unauthenticated, like the status endpoint: a scraper is a machine on the
+/// operator's network with no place to put a token, and the exposition names
+/// proxies and counts -- never a token, a URL or a header value.
+///
+/// The one endpoint outside `/api/`, deliberately. `metrics_path` defaults to
+/// `/metrics` in Prometheus, in every Kubernetes annotation and in every agent
+/// that scrapes one, so that path is settled by something larger than this
+/// project -- and while it was under `/api/v1/`, a scrape of `/metrics` was
+/// answered by the dashboard's fallback with `200 text/html`, which a scraper
+/// reports as a parse failure or, worse, records as nothing at all. It cannot
+/// collide with a page: the dashboard's routes are `/`, `/proxies`,
+/// `/proxies/{name}` and `/status`.
 #[utoipa::path(
     get, path = "/metrics", tag = "process",
     responses((status = 200, description = "Prometheus text exposition", content_type = "text/plain")),
@@ -116,6 +129,49 @@ pub(crate) async fn exposition(State(state): State<AdminState>) -> Response {
         .into_response()
 }
 
+/// Promote the stored configuration to the running one, for a caller that has
+/// just written to the store.
+///
+/// A write that only reached the store is a 200 that changed nothing a client can
+/// see: the proxy keeps forwarding to the old upstream, `/api/v1/status` keeps
+/// reporting the old revision, and the CRUD endpoints keep reading the new
+/// document back -- so the API agrees with the operator while the process
+/// disagrees with both. Reported as exactly that, from a running deployment,
+/// after a `PUT` changed an upstream and the traffic did not move.
+///
+/// Authorization is not repeated here. The caller has already been authorized for
+/// the write, and this is the second half of that write rather than a promotion
+/// of its own -- unlike the endpoint below, which is reachable on its own and
+/// authorizes against the running configuration for a reason worth reading there.
+pub(crate) async fn apply_to_runtime(state: &AdminState) -> Result<(), Error> {
+    // The same mutex the reload endpoint and the control socket take: two swaps
+    // that interleave can leave the process running the older configuration.
+    let _guard = state.reload_lock().lock().await;
+
+    doppel_core::reload(state.holder(), state.store(), state.startup())
+        .await
+        .map(|_| ())
+        .map_err(|failure| {
+            // Both facts, because the write is not being undone: the document is
+            // stored and the process is not serving it. A message naming only one
+            // of the two sends the operator looking in the wrong place.
+            Error::new(
+                failure.code,
+                format!(
+                    "the configuration was saved but this process could not start \
+                     serving it, so it is still running the previous one: {}. \
+                     `POST /api/v1/config/reload` retries.",
+                    failure
+                        .violations
+                        .iter()
+                        .map(ToString::to_string)
+                        .collect::<Vec<_>>()
+                        .join("; ")
+                ),
+            )
+        })
+}
+
 /// Promote the stored configuration to the running one.
 #[utoipa::path(
     post, path = "/api/v1/config/reload", tag = "process",
diff --git a/crates/doppel-admin/tests/common/mod.rs b/crates/doppel-admin/tests/common/mod.rs
index 8083a62..c094fe0 100644
--- a/crates/doppel-admin/tests/common/mod.rs
+++ b/crates/doppel-admin/tests/common/mod.rs
@@ -10,7 +10,6 @@ use std::path::{Path, PathBuf};
 use std::sync::Arc;
 use std::time::Instant;
 
-use axum::Router;
 use axum::body::Body;
 use axum::http::{Request, Response, StatusCode};
 use doppel_admin::AdminState;
@@ -124,7 +123,7 @@ pub struct Harness {
     pub templates_dir: PathBuf,
     pub store: Arc<dyn ConfigStore>,
     /// The runtime the process would be serving from. Built from the same
-    /// document the store starts with, so `/status` and the store agree
+    /// document the store starts with, so `/api/v1/status` and the store agree
     /// until a test makes them disagree on purpose.
     pub holder: Arc<RuntimeHolder>,
     pub startup: Arc<Config>,
@@ -180,8 +179,8 @@ impl Harness {
         self.store = wrap(inner);
     }
 
-    pub fn router(&self) -> Router {
-        doppel_admin::router(AdminState::new(
+    pub fn router(&self) -> doppel_admin::App {
+        doppel_admin::app(AdminState::new(
             Arc::clone(&self.store),
             Arc::clone(&self.holder),
             Arc::clone(&self.startup),
@@ -270,7 +269,7 @@ impl Call {
         self
     }
 
-    pub async fn send(self, router: Router) -> Reply {
+    pub async fn send(self, router: doppel_admin::App) -> Reply {
         let mut builder = Request::builder().method(self.method).uri(&self.uri);
         if let Some(token) = self.token {
             builder = builder.header("X-Proxy-Authorization", format!("Bearer {token}"));
@@ -306,6 +305,12 @@ pub struct Reply {
     pub content_type: Option<String>,
     pub allow: Option<String>,
     pub body: String,
+    /// The body as it arrived. An embedded asset is not necessarily text -- the
+    /// favicon is not -- so `body` cannot be the only view of it.
+    pub bytes: Vec<u8>,
+    /// Every response header, lower-cased, for the assertions that are about a
+    /// header this struct has no field for.
+    pub headers: std::collections::HashMap<String, String>,
 }
 
 impl Reply {
@@ -322,6 +327,16 @@ impl Reply {
         let location = header("location");
         let content_type = header("content-type");
         let allow = header("allow");
+        let headers = response
+            .headers()
+            .iter()
+            .filter_map(|(name, value)| {
+                value
+                    .to_str()
+                    .ok()
+                    .map(|value| (name.as_str().to_owned(), value.to_owned()))
+            })
+            .collect();
         let bytes = axum::body::to_bytes(response.into_body(), 1 << 20)
             .await
             .expect("collect body");
@@ -331,10 +346,19 @@ impl Reply {
             location,
             content_type,
             allow,
-            body: String::from_utf8(bytes.to_vec()).expect("body is utf-8"),
+            // Lossy rather than strict: an asset response is bytes, and a test
+            // asserting on a header should not panic on the body's encoding.
+            body: String::from_utf8_lossy(&bytes).into_owned(),
+            bytes: bytes.to_vec(),
+            headers,
         }
     }
 
+    /// One response header, or `None`.
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).map(String::as_str)
+    }
+
     pub fn json(&self) -> serde_json::Value {
         serde_json::from_str(&self.body)
             .unwrap_or_else(|err| panic!("body is not JSON ({err}): {}", self.body))
@@ -461,6 +485,10 @@ impl ConfigStore for RacingStore {
         self.inner.delete_template(proxy, file).await
     }
 
+    async fn rename_templates(&self, from: &str, to: &str) -> Result<(), StoreError> {
+        self.inner.rename_templates(from, to).await
+    }
+
     async fn retain_templates(&self, proxy: &str, keep: &[String]) -> Result<(), StoreError> {
         self.inner.retain_templates(proxy, keep).await
     }
diff --git a/crates/doppel-admin/tests/dashboard.rs b/crates/doppel-admin/tests/dashboard.rs
new file mode 100644
index 0000000..2d58e29
--- /dev/null
+++ b/crates/doppel-admin/tests/dashboard.rs
@@ -0,0 +1,372 @@
+//! The dashboard routes: the page, its assets, and `robots.txt`.
+
+mod common;
+
+use common::{BASE_CONFIG, Call, Harness};
+
+/// Whether this binary carries the built dashboard.
+///
+/// A source build with no `frontend/dist` has no assets to serve, and the tests
+/// below that need real ones say so rather than failing for the wrong reason.
+/// CI sets `DOPPEL_REQUIRE_DASHBOARD_ASSETS`, which
+/// `the_assets_are_present_when_they_are_required` turns into a failure -- the
+/// same arrangement `DOPPEL_REQUIRE_DATABASE` makes for the store suites, and for
+/// the same reason: `cargo test` captures the output of passing tests, so a skip
+/// notice reaches nobody.
+fn built() -> bool {
+    doppel_admin::dashboard::is_built()
+}
+
+/// The configuration element's contents, parsed.
+fn injected(body: &str) -> serde_json::Value {
+    let at = body
+        .find("id=\"doppel-config\"")
+        .unwrap_or_else(|| panic!("no config element in the page:\n{body}"));
+    let open_ends = body[at..].find('>').expect("an unclosed opening tag") + at + 1;
+    let close = body[open_ends..].find("</script>").expect("no closing tag") + open_ends;
+    serde_json::from_str(body[open_ends..close].trim()).unwrap_or_else(|err| {
+        panic!(
+            "the injected block is not JSON ({err}): {}",
+            &body[open_ends..close]
+        )
+    })
+}
+
+#[tokio::test]
+async fn the_assets_are_present_when_they_are_required() {
+    // Not a skip: this is the test that makes the others' skips visible.
+    if std::env::var_os("DOPPEL_REQUIRE_DASHBOARD_ASSETS").is_some() {
+        assert!(
+            built(),
+            "DOPPEL_REQUIRE_DASHBOARD_ASSETS is set and this binary has no embedded dashboard; \
+             run `npm --prefix frontend ci && npm --prefix frontend run build` before `cargo test`"
+        );
+    }
+}
+
+#[tokio::test]
+async fn the_root_serves_the_page_with_the_injected_configuration() {
+    if !built() {
+        return;
+    }
+    let harness = Harness::new();
+    let reply = Call::get("/").send(harness.router()).await;
+
+    assert_eq!(reply.status, 200);
+    assert_eq!(
+        reply.content_type.as_deref(),
+        Some("text/html; charset=utf-8")
+    );
+    // Never cached: the document carries the configuration, so a cached copy
+    // would keep showing values from before the last reload.
+    assert_eq!(reply.header("cache-control"), Some("no-store"));
+
+    let config = injected(&reply.body);
+    assert_eq!(config["title"], "Doppel");
+    // Nothing named this one, so the page is free to draw its wordmark.
+    assert_eq!(config["titleIsDefault"], true);
+    assert_eq!(config["public"], false);
+    assert_eq!(config["version"], env!("CARGO_PKG_VERSION"));
+    assert_eq!(config["authHeader"], "X-Proxy-Authorization");
+    assert_eq!(config["refreshMs"], 60_000);
+    // The footer's copyright year, from the build stamp rather than the browser's
+    // clock. Asserted as a range because the value moves with every build.
+    let year = config["copyrightYear"]
+        .as_u64()
+        .expect("copyrightYear is a number");
+    assert!((2026..=9999).contains(&year), "copyrightYear is {year}");
+}
+
+#[tokio::test]
+async fn the_page_reports_the_configured_title_and_auth_header() {
+    if !built() {
+        return;
+    }
+    let config = BASE_CONFIG
+        .replacen("  tokens:", "  title: \"Doppel (staging)\"\n  tokens:", 1)
+        .replacen(
+            "  access:",
+            "  auth:\n    header: X-Admin-Token\n  access:",
+            1,
+        );
+    let harness = Harness::with_config(&config);
+    let body = Call::get("/").send(harness.router()).await.body;
+
+    let injected = injected(&body);
+    assert_eq!(injected["title"], "Doppel (staging)");
+    // Named, so the page shows the name rather than the wordmark.
+    assert_eq!(injected["titleIsDefault"], false);
+    assert_eq!(injected["authHeader"], "X-Admin-Token");
+}
+
+#[tokio::test]
+async fn a_public_configuration_is_reported_to_the_page() {
+    if !built() {
+        return;
+    }
+    // The page uses this to decide whether to ask for a token at all, so getting
+    // it wrong means a public deployment showing a pointless dialog.
+    let config = BASE_CONFIG.replacen("  tokens:", "  public: true\n  tokens:", 1);
+    let harness = Harness::with_config(&config);
+    let body = Call::get("/").send(harness.router()).await.body;
+
+    assert_eq!(injected(&body)["public"], true);
+}
+
+#[tokio::test]
+async fn a_hostile_title_cannot_close_the_script_element() {
+    if !built() {
+        return;
+    }
+    // `AdminTitle` accepts markup on purpose -- it is legal text -- so this is
+    // the place the escaping has to hold. Without it the title would end the
+    // JSON element early and the rest would be parsed as HTML, which is a
+    // scripting hole reachable by editing one configuration field.
+    let hostile = "</script><script>alert(1)</script>";
+    let config = BASE_CONFIG.replacen(
+        "  tokens:",
+        &format!("  title: \"{hostile}\"\n  tokens:"),
+        1,
+    );
+    let harness = Harness::with_config(&config);
+    let body = Call::get("/").send(harness.router()).await.body;
+
+    // The title survives intact where it belongs...
+    assert_eq!(injected(&body)["title"], hostile);
+    // ...and the page contains exactly the script elements it is supposed to:
+    // the config block and the module. An injected one would make three.
+    assert_eq!(
+        body.matches("<script").count(),
+        2,
+        "an extra script element was injected:\n{body}"
+    );
+}
+
+#[tokio::test]
+async fn an_asset_is_served_with_immutable_caching() {
+    if !built() {
+        return;
+    }
+    let harness = Harness::new();
+    let page = Call::get("/").send(harness.router()).await.body;
+
+    // Whatever vite named the entry chunk this build, taken from the page rather
+    // than hard-coded: the name carries a content hash and changes every time
+    // the frontend changes.
+    let at = page
+        .find("/static/assets/")
+        .unwrap_or_else(|| panic!("the page loads no asset:\n{page}"));
+    let rest = &page[at..];
+    let end = rest.find('"').expect("an unterminated attribute");
+    let url = &rest[..end];
+
+    let reply = Call::get(url).send(harness.router()).await;
+    assert_eq!(reply.status, 200, "{url}");
+    assert_eq!(
+        reply.header("cache-control"),
+        Some("public, max-age=31536000, immutable")
+    );
+    assert_eq!(
+        reply.content_type.as_deref(),
+        Some("text/javascript; charset=utf-8")
+    );
+    assert!(!reply.bytes.is_empty());
+}
+
+#[tokio::test]
+async fn the_favicon_is_served_as_bytes_with_its_own_type() {
+    if !built() {
+        return;
+    }
+    // The one embedded asset that is not text, and the one whose content type a
+    // browser will not guess correctly from the bytes.
+    let harness = Harness::new();
+    let reply = Call::get("/static/favicon.ico")
+        .send(harness.router())
+        .await;
+
+    assert_eq!(reply.status, 200);
+    assert_eq!(reply.content_type.as_deref(), Some("image/x-icon"));
+    assert_eq!(
+        &reply.bytes[..4],
+        &[0x00, 0x00, 0x01, 0x00],
+        "not an ICO header"
+    );
+}
+
+#[tokio::test]
+async fn an_unknown_static_path_is_a_404_in_the_envelope() {
+    let harness = Harness::new();
+    let reply = Call::get("/static/nope.js").send(harness.router()).await;
+
+    assert_eq!(reply.status, 404);
+    // Deliberately not the page. A single-page fallback that answered 200 with
+    // HTML here would make a mistyped API path look like a success to a client
+    // and like a working dashboard to a human.
+    assert_eq!(reply.json()["code"], "NOT_FOUND");
+}
+
+/// The scrape path belongs to the scraper, not to the page.
+///
+/// This is what a Prometheus scrape of a running Doppel actually got while the
+/// exposition lived under `/api/v1/`: `200` with the dashboard's HTML, because
+/// the page answers every GET outside `/api/` and `/static/`. A scraper reports
+/// that as a parse failure at best, and the operator sees no metrics with
+/// nothing anywhere saying why.
+#[tokio::test]
+async fn metrics_is_the_exposition_and_not_the_page() {
+    let harness = Harness::new();
+    let reply = Call::get("/metrics").send(harness.router()).await;
+
+    assert_eq!(reply.status, 200);
+    assert_eq!(
+        reply.content_type.as_deref(),
+        Some("text/plain; version=0.0.4; charset=utf-8"),
+        "the dashboard fallback answered the scrape path"
+    );
+    assert!(!reply.body.contains("<!doctype html"), "{}", reply.body);
+}
+
+#[tokio::test]
+async fn robots_disallows_everything() {
+    let harness = Harness::new();
+    let reply = Call::get("/robots.txt").send(harness.router()).await;
+
+    assert_eq!(reply.status, 200);
+    assert_eq!(
+        reply.content_type.as_deref(),
+        Some("text/plain; charset=utf-8")
+    );
+    assert_eq!(reply.body, "User-agent: *\nDisallow: /\n");
+}
+
+#[tokio::test]
+async fn every_dashboard_response_forbids_indexing() {
+    // Three routes, three ways a crawler arrives. The header is the one that
+    // covers a crawler which never reads `robots.txt` and never parses markup.
+    let harness = Harness::new();
+    for path in ["/", "/robots.txt", "/static/nope.js"] {
+        let reply = Call::get(path).send(harness.router()).await;
+        assert_eq!(
+            reply.header("x-robots-tag"),
+            Some("noindex, nofollow, noarchive"),
+            "{path}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn the_page_carries_a_content_security_policy() {
+    if !built() {
+        return;
+    }
+    let harness = Harness::new();
+    let reply = Call::get("/").send(harness.router()).await;
+
+    let policy = reply
+        .header("content-security-policy")
+        .unwrap_or_else(|| panic!("no policy on the page: {:?}", reply.headers));
+    // `script-src 'self'` without `unsafe-inline` is what the JSON-element
+    // approach buys: an inline `window.config = ...` would have needed the
+    // opposite.
+    assert!(policy.contains("script-src 'self'"), "{policy}");
+    assert!(!policy.contains("unsafe-inline"), "{policy}");
+    assert!(policy.contains("frame-ancestors 'none'"), "{policy}");
+    assert_eq!(reply.header("x-content-type-options"), Some("nosniff"));
+}
+
+#[tokio::test]
+async fn a_disabled_dashboard_serves_none_of_the_three_routes() {
+    let config = BASE_CONFIG.replacen("  tokens:", "  dashboard: false\n  tokens:", 1);
+    let harness = Harness::with_config(&config);
+
+    for path in ["/", "/robots.txt", "/static/anything.js"] {
+        let reply = Call::get(path).send(harness.router()).await;
+        assert_eq!(reply.status, 404, "{path} must not be routed");
+        assert_eq!(reply.json()["code"], "NOT_FOUND", "{path}");
+    }
+
+    // And the JSON API is untouched, which is the whole point of the flag being
+    // about the dashboard rather than about the listener.
+    assert_eq!(
+        Call::get("/api/v1/proxies")
+            .send(harness.router())
+            .await
+            .status,
+        200
+    );
+}
+
+#[tokio::test]
+async fn a_binary_without_the_assets_says_what_to_build() {
+    if built() {
+        return;
+    }
+    let harness = Harness::new();
+    let reply = Call::get("/").send(harness.router()).await;
+
+    assert_eq!(reply.status, 503);
+    assert_eq!(reply.json()["code"], "DASHBOARD_NOT_BUILT");
+    assert!(
+        reply.json()["message"]
+            .as_str()
+            .is_some_and(|message| message.contains("npm")),
+        "the message must name the command that fixes it: {}",
+        reply.body
+    );
+}
+
+#[tokio::test]
+async fn a_client_side_route_reloaded_arrives_at_the_page() {
+    if !built() {
+        return;
+    }
+    // The reason the API moved under `/api/`: the dashboard has a page at `/status`
+    // and the API used to have an endpoint there, so a reload on that tab answered
+    // with JSON. Now every GET outside `/api/` and `/static/` is the page.
+    let harness = Harness::new();
+    for path in [
+        "/status",
+        "/proxies/alpha",
+        "/proxies/alpha/templates",
+        "/anything",
+    ] {
+        let reply = Call::get(path).send(harness.router()).await;
+        assert_eq!(reply.status, 200, "{path}");
+        assert_eq!(
+            reply.content_type.as_deref(),
+            Some("text/html; charset=utf-8"),
+            "{path}"
+        );
+        assert!(reply.body.contains("id=\"doppel-config\""), "{path}");
+    }
+}
+
+#[tokio::test]
+async fn a_mistyped_api_path_still_answers_as_the_api() {
+    // The other half of the division. A fallback that served the page for
+    // everything would make a client read HTML as a successful response, and a
+    // typo'd endpoint look like it worked.
+    let harness = Harness::new();
+    for path in ["/api/v1/proxes", "/api/v1/status/extra", "/api/nope"] {
+        let reply = Call::get(path).send(harness.router()).await;
+        assert_eq!(reply.status, 404, "{path}");
+        assert_eq!(reply.json()["code"], "NOT_FOUND", "{path}");
+    }
+
+    // And a missing asset stays a 404, because answering it with the page means a
+    // typo'd script tag loads HTML and fails somewhere else entirely.
+    let asset = Call::get("/static/nope.js").send(harness.router()).await;
+    assert_eq!(asset.status, 404);
+    assert_eq!(asset.json()["code"], "NOT_FOUND");
+}
+
+#[tokio::test]
+async fn a_write_to_a_path_that_does_not_exist_is_not_answered_with_the_page() {
+    // A GET is a page; a POST is not. Without that distinction a client posting to
+    // a mistyped path would read an HTML document as its answer.
+    let harness = Harness::new();
+    let reply = Call::post("/not-an-endpoint").send(harness.router()).await;
+    assert_eq!(reply.status, 404);
+    assert_eq!(reply.json()["code"], "NOT_FOUND");
+}
diff --git a/crates/doppel-admin/tests/lifecycle.rs b/crates/doppel-admin/tests/lifecycle.rs
index 7e494bb..0c26f25 100644
--- a/crates/doppel-admin/tests/lifecycle.rs
+++ b/crates/doppel-admin/tests/lifecycle.rs
@@ -1,4 +1,4 @@
-//! Reloading the running configuration, and reporting it over `/status`.
+//! Reloading the running configuration, and reporting it over `/api/v1/status`.
 
 mod common;
 
@@ -11,7 +11,7 @@ const ROOT: &str = "root-token-0000000000000000000000000";
 #[tokio::test]
 async fn status_reports_the_running_revision_and_every_proxy() {
     let harness = Harness::new();
-    let reply = Call::get("/status").send(harness.router()).await;
+    let reply = Call::get("/api/v1/status").send(harness.router()).await;
 
     assert_eq!(reply.status, 200, "{}", reply.body);
     let body = reply.json();
@@ -30,21 +30,24 @@ async fn status_needs_no_token() {
     // It is what a load balancer calls, so it cannot require credentials.
     let harness = Harness::new();
     assert_eq!(
-        Call::get("/status").send(harness.router()).await.status,
+        Call::get("/api/v1/status")
+            .send(harness.router())
+            .await
+            .status,
         200
     );
 }
 
 #[tokio::test]
 async fn status_never_prints_upstream_credentials() {
-    // `/status` is public and a proxy URL may legitimately carry basic auth,
+    // `/api/v1/status` is public and a proxy URL may legitimately carry basic auth,
     // so this endpoint is the one place those two facts could combine into a
     // published password.
     let harness = Harness::with_config(&BASE_CONFIG.replace(
         "https://alpha.example.com/api/",
         "https://svc:hunter2@alpha.example.com/api/",
     ));
-    let reply = Call::get("/status").send(harness.router()).await;
+    let reply = Call::get("/api/v1/status").send(harness.router()).await;
 
     assert_eq!(reply.status, 200, "{}", reply.body);
     assert!(!reply.body.contains("hunter2"), "{}", reply.body);
@@ -58,18 +61,63 @@ async fn status_reports_a_default_resolver_as_default() {
         "    resolve:\n      type: header\n      header: X-Proxy-Name\n  - name: beta",
         "  - name: beta",
     ));
-    let reply = Call::get("/status").send(harness.router()).await;
+    let reply = Call::get("/api/v1/status").send(harness.router()).await;
 
     assert_eq!(reply.json()["proxies"][0]["resolve"], "default");
 }
 
 #[tokio::test]
 async fn status_reports_what_is_running_not_what_is_stored() {
-    // A configuration written but not reloaded is not what this process is
-    // doing. Reporting the store here would make `/status` agree with the
-    // file and disagree with reality, which is the opposite of its job.
+    // A configuration written *behind* the API -- an operator editing
+    // `main.yaml`, `doppel config push`, another instance -- is not what this
+    // process is doing until it reloads. Reporting the store here would make
+    // `/api/v1/status` agree with the file and disagree with reality, which is
+    // the opposite of its job.
+    //
+    // A write *through* the API is the other case, and the test below: that one
+    // is in force by the time the response is written.
+    let harness = Harness::new();
+    let before = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
+
+    let (mut config, revision) = harness.store.load().await.expect("the fixture loads");
+    // Through the same shape the API takes, minus the API: `proxy_json`'s
+    // document, deserialized straight into the configuration.
+    config.proxies.push(
+        serde_json::from_value(
+            proxy_json("gamma", "https://gamma.example.com/api/")["proxy"].clone(),
+        )
+        .expect("a proxy document parses"),
+    );
+    harness
+        .store
+        .save(&config, Some(revision))
+        .await
+        .expect("the store accepts it");
+
+    let after = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
+    assert_eq!(before, after);
+    assert_eq!(after["proxies"].as_array().unwrap().len(), 2);
+}
+
+/// The other half, and the one an operator reported: a `PUT` that changed an
+/// upstream returned 200, the document held the new value, and the traffic kept
+/// going to the old one until somebody reloaded.
+///
+/// Every write applies to the running process now, so a 200 means what a client
+/// reads it to mean.
+#[tokio::test]
+async fn a_write_through_the_api_is_in_force_immediately() {
     let harness = Harness::new();
-    let before = Call::get("/status").send(harness.router()).await.json();
+    let before = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
 
     let create = Call::post("/api/v1/proxies")
         .token(ROOT)
@@ -78,13 +126,53 @@ async fn status_reports_what_is_running_not_what_is_stored() {
         .await;
     assert_eq!(create.status, 201, "{}", create.body);
 
-    let after = Call::get("/status").send(harness.router()).await.json();
-    assert_eq!(before, after);
-    assert_eq!(after["proxies"].as_array().unwrap().len(), 2);
+    let after = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
+    assert_eq!(after["proxies"].as_array().unwrap().len(), 3);
+    assert_ne!(after["revision"], before["revision"]);
+
+    // And an update reaches it as well, which is the shape of the report: the
+    // upstream in the running configuration is the one just written.
+    let update = Call::put("/api/v1/proxies/gamma")
+        .token(ROOT)
+        // The revision the create handed back, which is what an update is
+        // required to carry.
+        .if_match(create.etag.clone().expect("create sets an ETag"))
+        .json(proxy_json("gamma", "https://moved.example.com/api/"))
+        .send(harness.router())
+        .await;
+    assert_eq!(update.status, 200, "{}", update.body);
+
+    let running = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
+    let gamma = running["proxies"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|proxy| proxy["name"] == "gamma")
+        .expect("gamma is in the running configuration");
+    assert_eq!(gamma["upstream"], "https://moved.example.com/api/");
+
+    // A delete too: a proxy the operator has been told is gone must not still be
+    // served.
+    let delete = Call::delete("/api/v1/proxies/gamma")
+        .token(ROOT)
+        .send(harness.router())
+        .await;
+    assert_eq!(delete.status, 204, "{}", delete.body);
+    let gone = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
+    assert_eq!(gone["proxies"].as_array().unwrap().len(), 2);
 }
 
 #[tokio::test]
-async fn reload_applies_a_change_written_through_the_api() {
+async fn a_reload_after_a_write_through_the_api_changes_nothing_more() {
     let harness = Harness::new();
     let create = Call::post("/api/v1/proxies")
         .token(ROOT)
@@ -93,6 +181,8 @@ async fn reload_applies_a_change_written_through_the_api() {
         .await;
     assert_eq!(create.status, 201, "{}", create.body);
 
+    // The write already applied, so this is the idempotent case: same store,
+    // same revision, nothing to promote.
     let reload = Call::post("/api/v1/config/reload")
         .token(ROOT)
         .send(harness.router())
@@ -100,7 +190,10 @@ async fn reload_applies_a_change_written_through_the_api() {
     assert_eq!(reload.status, 200, "{}", reload.body);
     assert_eq!(reload.json()["proxies"], 3);
 
-    let status = Call::get("/status").send(harness.router()).await.json();
+    let status = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
     assert_eq!(status["proxies"].as_array().unwrap().len(), 3);
     assert_eq!(status["revision"], reload.json()["revision"]);
 }
@@ -110,7 +203,11 @@ async fn reload_reports_the_same_revision_when_nothing_changed() {
     // The revision comes from the stored content, so a reload that changes
     // nothing must not look like a change.
     let harness = Harness::new();
-    let before = Call::get("/status").send(harness.router()).await.json()["revision"].clone();
+    let before = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json()["revision"]
+        .clone();
 
     let reload = Call::post("/api/v1/config/reload")
         .token(ROOT)
@@ -123,7 +220,10 @@ async fn reload_reports_the_same_revision_when_nothing_changed() {
 #[tokio::test]
 async fn an_invalid_stored_config_is_rejected_and_the_running_one_survives() {
     let harness = Harness::new();
-    let before = Call::get("/status").send(harness.router()).await.json();
+    let before = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
 
     harness.overwrite_config(&BASE_CONFIG.replace("port: 18080", "port: 0"));
     let reload = Call::post("/api/v1/config/reload")
@@ -135,14 +235,20 @@ async fn an_invalid_stored_config_is_rejected_and_the_running_one_survives() {
     assert_eq!(reload.error_code(), "CONFIG_INVALID");
     // Every step before the swap can fail; the swap cannot. So a rejected
     // reload leaves the process serving exactly what it was serving.
-    let after = Call::get("/status").send(harness.router()).await.json();
+    let after = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
     assert_eq!(before["revision"], after["revision"]);
 }
 
 #[tokio::test]
 async fn an_unparsable_stored_config_is_rejected_and_the_running_one_survives() {
     let harness = Harness::new();
-    let before = Call::get("/status").send(harness.router()).await.json();
+    let before = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
 
     harness.overwrite_config("this: is: not: valid: yaml:\n  - [");
     let reload = Call::post("/api/v1/config/reload")
@@ -152,7 +258,10 @@ async fn an_unparsable_stored_config_is_rejected_and_the_running_one_survives()
 
     assert_eq!(reload.status, 400, "{}", reload.body);
     assert_eq!(reload.error_code(), "CONFIG_INVALID");
-    let after = Call::get("/status").send(harness.router()).await.json();
+    let after = Call::get("/api/v1/status")
+        .send(harness.router())
+        .await
+        .json();
     assert_eq!(before["revision"], after["revision"]);
 }
 
@@ -311,7 +420,13 @@ async fn metrics_renders_the_exposition_with_the_registered_content_type() {
         // recorder would pass here whether or not the handler was wired to
         // anything.
         let _guard = metrics::set_default_local_recorder(&harness.recorder);
-        doppel_core::metrics::record_proxy("alpha", "GET", 200, Duration::from_millis(5));
+        doppel_core::metrics::record_proxy(
+            "alpha",
+            "GET",
+            200,
+            Duration::from_millis(5),
+            doppel_core::metrics::Outcome::proxied(),
+        );
         doppel_core::metrics::record_loss("alpha");
     }
 
@@ -331,6 +446,77 @@ async fn metrics_renders_the_exposition_with_the_registered_content_type() {
     assert!(reply.body.contains(r#"proxy="alpha""#), "{}", reply.body);
 }
 
+/// Both spellings of every path the API answers.
+///
+/// Axum stopped redirecting `/x/` to `/x` in 0.8, so without the trailing-slash
+/// layer each of these is a 404 -- and a scrape config or a curl carrying the
+/// slash gets nothing, with the endpoint sitting right there.
+#[tokio::test]
+async fn a_trailing_slash_reaches_the_same_endpoint() {
+    let harness = Harness::new();
+    for (with, without) in [
+        ("/metrics/", "/metrics"),
+        ("/api/v1/status/", "/api/v1/status"),
+        ("/api/v1/proxies/", "/api/v1/proxies"),
+        ("/api/v1/schema/", "/api/v1/schema"),
+        ("/api/v1/access/", "/api/v1/access"),
+    ] {
+        let slashed = Call::get(with)
+            .token("root-token-0000000000000000000000000")
+            .send(harness.router())
+            .await;
+        let bare = Call::get(without)
+            .token("root-token-0000000000000000000000000")
+            .send(harness.router())
+            .await;
+        assert_eq!(slashed.status, bare.status, "{with} against {without}");
+        assert_eq!(
+            slashed.content_type, bare.content_type,
+            "{with} against {without}"
+        );
+        assert_eq!(slashed.body, bare.body, "{with} against {without}");
+    }
+}
+
+/// And the root is not a trailing slash to be trimmed away.
+#[tokio::test]
+async fn the_root_still_answers() {
+    let harness = Harness::new();
+    let reply = Call::get("/").send(harness.router()).await;
+    assert_ne!(reply.status, 404, "the layer trimmed the root itself");
+}
+
+/// The admin listener's own latency, labelled by the route template.
+///
+/// The recorder is the harness's, held for the whole exchange: the middleware
+/// records inside the request future, and `oneshot` runs it on this thread, so a
+/// thread-local recorder sees it.
+#[tokio::test]
+async fn an_admin_request_records_its_own_latency_by_route() {
+    let harness = Harness::new();
+    {
+        let _guard = metrics::set_default_local_recorder(&harness.recorder);
+        let read = Call::get("/api/v1/proxies/alpha")
+            .token("root-token-0000000000000000000000000")
+            .send(harness.router())
+            .await;
+        assert_eq!(read.status, 200, "{}", read.body);
+    }
+
+    let exposition = harness.recorder.handle().render();
+    assert!(
+        exposition.contains(r#"route="/api/v1/proxies/{name}""#),
+        "the template, not the path: {exposition}"
+    );
+    // The proxy's own name must not be in there. One series per proxy is how a
+    // cardinality incident starts.
+    assert!(!exposition.contains("alpha"), "{exposition}");
+    assert!(
+        exposition.contains("doppel_admin_request_duration_seconds_bucket"),
+        "{exposition}"
+    );
+}
+
 #[tokio::test]
 async fn metrics_needs_no_token() {
     // A scraper is a machine with nowhere to put one.
@@ -516,7 +702,10 @@ async fn turning_the_admin_listener_off_is_reported_as_needing_a_restart() {
     // And the listener really is still answering, which is what "unapplied"
     // means here.
     assert_eq!(
-        Call::get("/status").send(harness.router()).await.status,
+        Call::get("/api/v1/status")
+            .send(harness.router())
+            .await
+            .status,
         200
     );
 }
diff --git a/crates/doppel-admin/tests/proxies.rs b/crates/doppel-admin/tests/proxies.rs
index 922d29f..487ee9c 100644
--- a/crates/doppel-admin/tests/proxies.rs
+++ b/crates/doppel-admin/tests/proxies.rs
@@ -293,7 +293,76 @@ async fn an_unparsable_revision_is_rejected() {
 }
 
 #[tokio::test]
-async fn update_that_renames_the_proxy_is_rejected() {
+async fn an_update_may_rename_the_proxy_and_takes_its_templates_along() {
+    // A proxy's name is where its templates live, which is why this used to be
+    // refused. The rename moves them instead.
+    let harness = Harness::new();
+    // Written straight to the store: uploading through the API needs a mock to
+    // declare the file first, and what is under test here is the move.
+    harness.write_template("alpha", "put.json.j2", "{\"ok\": true}");
+
+    let revision = Call::get("/api/v1/proxies/alpha")
+        .send(harness.router())
+        .await
+        .revision();
+    // The renamed document keeps the mock that declares the file: an update whose
+    // mocks no longer name a template is *supposed* to prune it, and pruning is not
+    // what this test is about.
+    let renamed = serde_json::json!({
+        "proxy": {
+            "name": "renamed",
+            "type": "http",
+            "url": "https://alpha.example.com/api/",
+            "resolve": { "type": "header", "header": "X-Proxy-Name" },
+            "mocks": [{
+                "name": "put-widget",
+                "request": { "method": "PUT", "url": "^/widgets/1$" },
+                "response": { "status": 200, "template": "put.json.j2" },
+            }],
+        }
+    });
+    let reply = Call::put("/api/v1/proxies/alpha")
+        .token(ROOT)
+        .if_match(format!("\"{revision}\""))
+        .json(renamed)
+        .send(harness.router())
+        .await;
+
+    assert_eq!(reply.status, 200, "{}", reply.body);
+    assert_eq!(reply.json()["proxy"]["name"], "renamed");
+    assert_eq!(harness.stored().proxies[0].name.as_str(), "renamed");
+
+    // The old path is gone and the new one answers.
+    assert_eq!(
+        Call::get("/api/v1/proxies/alpha")
+            .send(harness.router())
+            .await
+            .status,
+        404
+    );
+    assert_eq!(
+        Call::get("/api/v1/proxies/renamed")
+            .send(harness.router())
+            .await
+            .status,
+        200
+    );
+
+    // And the template followed the name rather than being stranded under the old
+    // one, which is the whole reason a rename needs more than a config write.
+    let files = Call::get("/api/v1/proxies/renamed/templates")
+        .token(ROOT)
+        .send(harness.router())
+        .await
+        .json();
+    assert_eq!(files["templates"][0]["name"], "put.json.j2", "{files}");
+}
+
+#[tokio::test]
+async fn a_rename_onto_a_name_in_use_is_refused_by_name() {
+    // Validation would report this as `proxies[1].name: duplicate`, which describes
+    // a position in a document the caller never sent. What they need to know is that
+    // the name is taken.
     let harness = Harness::new();
     let revision = Call::get("/api/v1/proxies/alpha")
         .send(harness.router())
@@ -303,16 +372,30 @@ async fn update_that_renames_the_proxy_is_rejected() {
     let reply = Call::put("/api/v1/proxies/alpha")
         .token(ROOT)
         .if_match(format!("\"{revision}\""))
-        .json(proxy_json("renamed", "https://alpha.example.com/api/"))
+        .json(proxy_json("beta", "https://alpha.example.com/api/"))
         .send(harness.router())
         .await;
 
-    // The name is the template directory. A rename through PUT would leave
-    // the old directory orphaned and the new proxy with no templates, which
-    // is not what anyone typing a new name into a body means.
     assert_eq!(reply.status, 400, "{}", reply.body);
     assert_eq!(reply.error_code(), "CONFIG_INVALID");
-    assert_eq!(harness.stored().proxies[0].name, "alpha");
+    assert!(reply.body.contains("already exists"), "{}", reply.body);
+    // Nothing moved: both names still name what they did.
+    assert_eq!(harness.stored().proxies[0].name.as_str(), "alpha");
+}
+
+#[tokio::test]
+async fn a_rename_still_needs_the_revision_it_was_read_at() {
+    // The rename is an update like any other, so the compare-and-swap applies to it.
+    let harness = Harness::new();
+    let reply = Call::put("/api/v1/proxies/alpha")
+        .token(ROOT)
+        .if_match("\"0000000000000000\"")
+        .json(proxy_json("renamed", "https://alpha.example.com/api/"))
+        .send(harness.router())
+        .await;
+
+    assert_eq!(reply.status, 409, "{}", reply.body);
+    assert_eq!(harness.stored().proxies[0].name.as_str(), "alpha");
 }
 
 #[tokio::test]
diff --git a/crates/doppel-admin/tests/rights.rs b/crates/doppel-admin/tests/rights.rs
new file mode 100644
index 0000000..0d9db4c
--- /dev/null
+++ b/crates/doppel-admin/tests/rights.rs
@@ -0,0 +1,196 @@
+//! `GET /api/v1/access`: what the caller may do.
+
+mod common;
+
+use common::{BASE_CONFIG, Call, Harness, proxy_json};
+
+const ROOT: &str = "root-token-0000000000000000000000000";
+const READER: &str = "reader-token-00000000000000000000000";
+
+/// `BASE_CONFIG` with the global `access` block replaced.
+///
+/// `replacen` with a count of one: the document has an `access` key under
+/// `admin` and can have one under a proxy, and a plain `replace` would edit
+/// whichever came first in a way that reads as working.
+fn with_access(block: &str) -> String {
+    BASE_CONFIG.replacen("  access:\n    list: public\n    read: public\n", block, 1)
+}
+
+#[tokio::test]
+async fn an_anonymous_caller_gets_the_public_actions_and_nothing_else() {
+    // `BASE_CONFIG` makes `list` and `read` public and the four writes
+    // admin-only, which is the shape an operator most often has.
+    let harness = Harness::new();
+    let body = Call::get("/api/v1/access")
+        .send(harness.router())
+        .await
+        .json();
+
+    assert_eq!(body["caller"]["kind"], "anonymous");
+    assert_eq!(body["global"]["list"], true);
+    assert_eq!(body["global"]["read"], true);
+    for action in ["create", "update", "delete", "upload"] {
+        assert_eq!(body["global"][action], false, "{action} must be refused");
+    }
+}
+
+#[tokio::test]
+async fn a_token_is_reported_by_its_own_name_and_group() {
+    let harness = Harness::new();
+    let body = Call::get("/api/v1/access")
+        .token(READER)
+        .send(harness.router())
+        .await
+        .json();
+
+    assert_eq!(body["caller"]["kind"], "token");
+    assert_eq!(body["caller"]["name"], "reader");
+    assert_eq!(body["caller"]["group"], "user");
+    // `reader` is in group `user`, and the writes want `admin`.
+    assert_eq!(body["global"]["read"], true);
+    assert_eq!(body["global"]["create"], false);
+}
+
+#[tokio::test]
+async fn an_admin_token_may_do_everything() {
+    let harness = Harness::new();
+    let body = Call::get("/api/v1/access")
+        .token(ROOT)
+        .send(harness.router())
+        .await
+        .json();
+
+    for action in ["list", "read", "create", "update", "delete", "upload"] {
+        assert_eq!(body["global"][action], true, "{action} must be allowed");
+    }
+    assert_eq!(body["proxies"]["alpha"]["delete"], true);
+}
+
+#[tokio::test]
+async fn the_proxy_map_names_every_proxy_for_a_caller_who_may_list() {
+    let harness = Harness::new();
+    let body = Call::get("/api/v1/access")
+        .send(harness.router())
+        .await
+        .json();
+
+    let proxies = body["proxies"].as_object().expect("a proxy map");
+    let mut names: Vec<_> = proxies.keys().map(String::as_str).collect();
+    names.sort_unstable();
+    assert_eq!(names, ["alpha", "beta"]);
+    assert_eq!(body["proxies"]["alpha"]["read"], true);
+    assert_eq!(body["proxies"]["alpha"]["update"], false);
+}
+
+#[tokio::test]
+async fn a_caller_who_may_not_list_gets_no_proxy_map_at_all() {
+    // Keyed by proxy name, the map is a proxy listing by another route. An empty
+    // object would still say "there are no proxies"; the key has to be gone.
+    let config = with_access("  access:\n    list: [\"admin\"]\n    read: [\"admin\"]\n");
+    let harness = Harness::with_config(&config);
+    let body = Call::get("/api/v1/access")
+        .send(harness.router())
+        .await
+        .json();
+
+    assert_eq!(body["global"]["list"], false);
+    assert!(
+        body.get("proxies").is_none(),
+        "a caller without `list` must not learn the proxy names: {body}"
+    );
+}
+
+#[tokio::test]
+async fn a_proxy_override_is_reported_instead_of_the_global_answer() {
+    // The whole reason the map exists: `reader` may read `alpha` and no other
+    // proxy, and a report built from the global block alone would say `false`
+    // for both.
+    let config = with_access("  access:\n    list: public\n    read: [\"admin\"]\n").replacen(
+        "  - name: alpha\n    type: http\n    url: \"https://alpha.example.com/api/\"\n",
+        "  - name: alpha\n    type: http\n    url: \"https://alpha.example.com/api/\"\n    \
+         access:\n      read: [\"reader\"]\n",
+        1,
+    );
+    let harness = Harness::with_config(&config);
+    let body = Call::get("/api/v1/access")
+        .token(READER)
+        .send(harness.router())
+        .await
+        .json();
+
+    assert_eq!(body["global"]["read"], false);
+    assert_eq!(body["proxies"]["alpha"]["read"], true);
+    assert_eq!(body["proxies"]["beta"]["read"], false);
+}
+
+#[tokio::test]
+async fn a_public_configuration_reports_everything_true_for_anonymous() {
+    let config = BASE_CONFIG.replacen("  tokens:", "  public: true\n  tokens:", 1);
+    let harness = Harness::with_config(&config);
+    let body = Call::get("/api/v1/access")
+        .send(harness.router())
+        .await
+        .json();
+
+    for action in ["list", "read", "create", "update", "delete", "upload"] {
+        assert_eq!(body["global"][action], true, "{action} under public: true");
+    }
+}
+
+#[tokio::test]
+async fn the_report_agrees_with_what_the_request_actually_answers() {
+    // The test that matters. The report is `authorize` evaluated, and this is
+    // what catches it drifting from `authorize` as enforced: a reported `false`
+    // has to come back 401 or 403, and a reported `true` must not.
+    //
+    // A harness per action, because `delete` really deletes and `create` really
+    // creates -- sharing one would make the later actions depend on the earlier.
+    for token in [None, Some(READER), Some(ROOT)] {
+        let report = {
+            let harness = Harness::new();
+            let mut call = Call::get("/api/v1/access");
+            if let Some(token) = token {
+                call = call.token(token);
+            }
+            call.send(harness.router()).await.json()
+        };
+
+        for action in ["list", "read", "create", "update", "delete", "upload"] {
+            let harness = Harness::new();
+            // The revision `update` needs, read before the attempt so a refusal
+            // is about access rather than about a missing `If-Match`.
+            let revision = Call::get("/api/v1/proxies/alpha")
+                .token(ROOT)
+                .send(harness.router())
+                .await
+                .revision();
+
+            let mut call = match action {
+                "list" => Call::get("/api/v1/proxies"),
+                "read" => Call::get("/api/v1/proxies/alpha"),
+                "create" => Call::post("/api/v1/proxies")
+                    .json(proxy_json("gamma", "https://gamma.example.com/")),
+                "update" => Call::put("/api/v1/proxies/alpha")
+                    .if_match(&revision)
+                    .json(proxy_json("alpha", "https://moved.example.com/")),
+                "delete" => Call::delete("/api/v1/proxies/alpha").if_match(&revision),
+                "upload" => Call::post("/api/v1/proxies/alpha/templates/page.json.j2").raw("hello"),
+                other => unreachable!("{other}"),
+            };
+            if let Some(token) = token {
+                call = call.token(token);
+            }
+            let status = call.send(harness.router()).await.status;
+
+            let permitted = report["global"][action]
+                .as_bool()
+                .unwrap_or_else(|| panic!("{action} is not a boolean in {report}"));
+            let refused = status == 401 || status == 403;
+            assert_eq!(
+                permitted, !refused,
+                "{action} as {token:?}: the report said {permitted} and the request answered \
+                 {status}"
+            );
+        }
+    }
+}
diff --git a/crates/doppel-admin/tests/schema.rs b/crates/doppel-admin/tests/schema.rs
new file mode 100644
index 0000000..5289792
--- /dev/null
+++ b/crates/doppel-admin/tests/schema.rs
@@ -0,0 +1,62 @@
+//! `GET /api/v1/schema`: the configuration schema, from the running process.
+
+mod common;
+
+use common::{Call, Harness};
+
+#[tokio::test]
+async fn the_schema_is_served_to_anybody_who_asks() {
+    // No token. It describes the shape of a configuration, never the contents of
+    // one, and the identical bytes are on GitHub -- so a right to hold here would
+    // guard nothing while stopping the page from checking a field before sign-in.
+    let harness = Harness::new();
+    let reply = Call::get("/api/v1/schema").send(harness.router()).await;
+
+    assert_eq!(reply.status, 200);
+    assert_eq!(
+        reply.content_type.as_deref(),
+        Some("application/schema+json")
+    );
+
+    let schema: serde_json::Value = serde_json::from_str(&reply.body).expect("the body is JSON");
+    assert_eq!(
+        schema["$schema"], "https://json-schema.org/draft/2020-12/schema",
+        "not a 2020-12 document"
+    );
+    // The three the dashboard reaches for: a pattern to check a name against, a
+    // range to bound a ratio, and the proxy document it validates in the YAML
+    // editor.
+    assert_eq!(
+        schema["$defs"]["ProxyName"]["pattern"],
+        "^[A-Za-z0-9_-]{2,32}$"
+    );
+    assert_eq!(schema["$defs"]["Ratio"]["maximum"], 1.0);
+    assert!(schema["$defs"]["ProxyConfig"]["properties"]["mocks"].is_object());
+}
+
+#[tokio::test]
+async fn the_schema_is_the_document_the_repository_keeps() {
+    // The file is what editors fetch and what a release attaches; this endpoint is
+    // the same document from the process that will actually read the configuration.
+    // Two answers to one question is the failure worth catching.
+    let harness = Harness::new();
+    let reply = Call::get("/api/v1/schema").send(harness.router()).await;
+
+    let served: serde_json::Value = serde_json::from_str(&reply.body).expect("the body is JSON");
+    let on_disk: serde_json::Value =
+        serde_json::from_str(include_str!("../../../doppel-config.schema.json"))
+            .expect("the checked-in schema is JSON");
+    assert_eq!(served, on_disk);
+}
+
+#[tokio::test]
+async fn a_disabled_dashboard_still_serves_the_schema() {
+    // It is an API endpoint, not part of the page: a deployment with
+    // `dashboard: false` still has clients that validate a document before pushing
+    // it.
+    let config = common::BASE_CONFIG.replacen("  tokens:", "  dashboard: false\n  tokens:", 1);
+    let harness = Harness::with_config(&config);
+    let reply = Call::get("/api/v1/schema").send(harness.router()).await;
+
+    assert_eq!(reply.status, 200);
+}
diff --git a/crates/doppel-cli/src/commands/serve.rs b/crates/doppel-cli/src/commands/serve.rs
index b9c6bc8..1d6d2e8 100644
--- a/crates/doppel-cli/src/commands/serve.rs
+++ b/crates/doppel-cli/src/commands/serve.rs
@@ -77,6 +77,33 @@ pub async fn serve(store: Arc<dyn ConfigStore>, config: Config) -> Result<(), Cl
         }
     }
 
+    // Where clients reach this Doppel, for rewriting an upstream's redirects.
+    // The variable wins over the document, and a malformed one fails startup for
+    // the reason a malformed token variable does: an operator who set it and got
+    // no error believes redirects name that address.
+    let external_url = match doppel_core::config::external_url_from_env()
+        .map_err(|err| CliError::Failed(err.to_string()))?
+    {
+        Some(from_env) => {
+            tracing::info!(url = from_env.as_str(), "external url from the environment");
+            Some(from_env)
+        }
+        None => {
+            let derived = config.server.public_url();
+            if let Some(url) = &derived {
+                // Worth a line, because it is a guess: behind a port mapping or
+                // an ingress the client used neither this address nor this port,
+                // and this is where an operator sees which address their
+                // rewritten redirects will name.
+                tracing::info!(
+                    url = url.as_str(),
+                    "external url from server.host and server.port"
+                );
+            }
+            derived
+        }
+    };
+
     // After logging is up, so these reach wherever the operator is looking,
     // and only here: `doppel config validate` runs in CI loops, and a warning
     // repeated on every run is a warning nobody reads. Startup is also the
@@ -112,6 +139,21 @@ pub async fn serve(store: Arc<dyn ConfigStore>, config: Config) -> Result<(), Cl
     } else {
         None
     };
+
+    // The series that must be there before anything happens.
+    //
+    // A dashboard panel and an alert both read "no data" for a metric that has
+    // never been recorded, and "no data" is indistinguishable from "this process
+    // is not being scraped". So the facts that are true at startup are published
+    // at startup: what this binary is, whether it serves the dashboard, and that
+    // no proxy error has happened yet. The per-proxy mock counts come from the
+    // runtime below, on every swap, so they follow the configuration in force.
+    if admin_enabled {
+        doppel_core::metrics::describe_build(env!("CARGO_PKG_VERSION"));
+        doppel_core::metrics::describe_dashboard(config.admin.is_dashboard_enabled());
+        doppel_core::metrics::init_proxy_errors();
+    }
+
     let started_at = std::time::Instant::now();
 
     let addr = SocketAddr::new(config.server.host, config.server.port.get());
@@ -220,7 +262,8 @@ pub async fn serve(store: Arc<dyn ConfigStore>, config: Config) -> Result<(), Cl
     });
 
     let proxy_task = tokio::spawn(serve_proxy(
-        ProxyState::new(Arc::clone(&holder)),
+        ProxyState::new(Arc::clone(&holder))
+            .with_external_url(external_url.map(doppel_core::config::ExternalUrl::into_url)),
         listener,
         async {
             let _ = proxy_rx.await;
diff --git a/crates/doppel-cli/src/control/server.rs b/crates/doppel-cli/src/control/server.rs
index 59c2f2d..8e9641c 100644
--- a/crates/doppel-cli/src/control/server.rs
+++ b/crates/doppel-cli/src/control/server.rs
@@ -601,6 +601,24 @@ proxies:
             Box::pin(async { unimplemented!("not exercised by this test") })
         }
 
+        fn rename_templates<'s, 'p1, 'p2, 'out>(
+            &'s self,
+            _from: &'p1 str,
+            _to: &'p2 str,
+        ) -> std::pin::Pin<
+            Box<
+                dyn std::future::Future<Output = Result<(), doppel_core::StoreError>> + Send + 'out,
+            >,
+        >
+        where
+            's: 'out,
+            'p1: 'out,
+            'p2: 'out,
+            Self: 'out,
+        {
+            Box::pin(async { unimplemented!("not exercised by this test") })
+        }
+
         fn retain_templates<'s, 'p1, 'p2, 'out>(
             &'s self,
             _proxy: &'p1 str,
diff --git a/crates/doppel-cli/tests/admin.rs b/crates/doppel-cli/tests/admin.rs
index f51ff9a..4262f49 100644
--- a/crates/doppel-cli/tests/admin.rs
+++ b/crates/doppel-cli/tests/admin.rs
@@ -70,6 +70,10 @@ impl Admin {
     fn anonymous_get(&self, path: &str) -> (u16, String) {
         self.request("GET", path, None, None)
     }
+
+    fn put(&self, path: &str, body: &str) -> (u16, String) {
+        self.request("PUT", path, Some(SECRET_TOKEN), Some(body))
+    }
 }
 
 fn start() -> (Server, Admin, common::Upstream) {
@@ -100,7 +104,7 @@ fn status_and_metrics_are_scrapeable_without_a_token() {
     let (server, admin, _up) = start();
     server.get("/anything");
 
-    let (status, body) = admin.anonymous_get("/status");
+    let (status, body) = admin.anonymous_get("/api/v1/status");
     assert_eq!(status, 200, "{body}");
     assert!(body.contains("\"revision\""), "{body}");
     assert!(body.contains("\"p1\""), "{body}");
@@ -133,8 +137,15 @@ fn a_write_without_a_token_is_refused() {
     assert!(body.contains("UNAUTHORIZED"), "{body}");
 }
 
+/// A proxy created over HTTP serves traffic straight away.
+///
+/// It used to take a reload, and this test used to say so -- "written to the
+/// store, but not yet running". That was the defect an operator reported from the
+/// other end: a write returns 200, the API reads the new document back, and the
+/// traffic keeps going where it went before, with nothing anywhere saying the two
+/// disagree.
 #[test]
-fn a_proxy_created_over_http_serves_traffic_after_a_reload() {
+fn a_proxy_created_over_http_serves_traffic_without_a_reload() {
     let (server, admin, up) = start();
 
     // `p1` is the default resolver, so the new one resolves by header.
@@ -151,18 +162,18 @@ fn a_proxy_created_over_http_serves_traffic_after_a_reload() {
     );
     assert_eq!(status, 201, "{body}");
 
-    // Written to the store, but not yet running.
-    let (_, before) = admin.anonymous_get("/status");
-    assert!(!before.contains("\"p2\""), "{before}");
+    // In the running configuration, with no reload in between.
+    let (_, running) = admin.anonymous_get("/api/v1/status");
+    assert!(running.contains("\"p2\""), "{running}");
+
+    // And actually serving: the header picks it.
+    let (status, body) = server.get_with_header("/anything", "X-Proxy-Name", "p2");
+    assert_eq!(status, 200, "{body}");
 
+    // A reload afterwards is the idempotent case -- same store, same revision.
     let (status, body) = admin.request("POST", "/api/v1/config/reload", Some(SECRET_TOKEN), None);
     assert_eq!(status, 200, "{body}");
     assert!(body.contains("\"proxies\":2"), "{body}");
-
-    let (_, after) = admin.anonymous_get("/status");
-    assert!(after.contains("\"p2\""), "{after}");
-
-    // And it actually serves: the header picks it.
     let (status, body) = server.get_with_header("/anything", "X-Proxy-Name", "p2");
     assert_eq!(status, 200, "{body}");
 }
@@ -613,3 +624,63 @@ fn a_name_the_environment_claims_cannot_be_issued_over_the_socket() {
     assert!(stdout.contains("supplied by the environment"), "{stdout}");
     assert!(stdout.contains("would never authenticate"), "{stdout}");
 }
+
+/// The case an operator reported: an upstream changed through the admin API, and
+/// the proxy kept forwarding to the old one.
+///
+/// The whole chain through the built binary, both listeners and two upstreams, so
+/// "in force" means what a client sees rather than what an endpoint reports. The
+/// unit tests can only check the runtime's own view of itself.
+#[test]
+fn an_upstream_changed_through_the_api_is_what_the_proxy_forwards_to() {
+    let first = upstream();
+    let second = upstream();
+    let server = Server::start(first.port);
+    let admin = Admin {
+        port: server.admin_port(),
+    };
+
+    // Where it goes now.
+    let (status, body) = server.get("/thing");
+    assert_eq!(status, 200, "{body}");
+    assert!(body.contains("upstream saw /thing"), "{body}");
+
+    // The revision the update has to carry, from the proxy as stored.
+    let (status, read) = admin.get("/api/v1/proxies/p1");
+    assert_eq!(status, 200, "{read}");
+    let revision = serde_json::from_str::<serde_json::Value>(&read).unwrap()["revision"]
+        .as_str()
+        .expect("a revision")
+        .to_owned();
+
+    let (status, body) = admin.put(
+        "/api/v1/proxies/p1",
+        &format!(
+            r#"{{"revision":"{revision}","proxy":{{"name":"p1","type":"http","url":"http://127.0.0.1:{}/"}}}}"#,
+            second.port
+        ),
+    );
+    assert_eq!(status, 200, "{body}");
+
+    // No reload in between. The proxy forwards to the new upstream, which is the
+    // only observation that distinguishes a write that landed in the store from
+    // one that is in force.
+    let (status, body) = server.get("/thing");
+    assert_eq!(status, 200, "{body}");
+    assert!(
+        body.contains("upstream saw /thing"),
+        "the second upstream answers the same shape: {body}"
+    );
+
+    // And the running configuration says so too.
+    let (status, status_body) = admin.anonymous_get("/api/v1/status");
+    assert_eq!(status, 200, "{status_body}");
+    assert!(
+        status_body.contains(&format!("127.0.0.1:{}", second.port)),
+        "status must name the new upstream: {status_body}"
+    );
+    assert!(
+        !status_body.contains(&format!("127.0.0.1:{}", first.port)),
+        "status must not still name the old one: {status_body}"
+    );
+}
diff --git a/crates/doppel-cli/tests/common/mod.rs b/crates/doppel-cli/tests/common/mod.rs
index 43478f8..4ccb9ac 100644
--- a/crates/doppel-cli/tests/common/mod.rs
+++ b/crates/doppel-cli/tests/common/mod.rs
@@ -50,8 +50,24 @@ use std::time::{Duration, Instant};
 /// something else, and reporting that beats retrying forever.
 const PORT_RACE_ATTEMPTS: usize = 3;
 
+/// A port nothing is listening on, by asking the kernel for one and giving it
+/// straight back.
+///
+/// Bound on the **wildcard**, not on loopback, and that is the whole point.
+/// `SO_REUSEADDR` is set by `std` on every `TcpListener`, and macOS then allows
+/// `127.0.0.1:P` to be bound while another process holds `0.0.0.0:P` -- the more
+/// specific address wins for connections to it. A loopback probe could therefore
+/// draw a port a server under test was already serving on, shadow it for the
+/// microseconds before this listener is dropped, and reset whatever connection
+/// arrived in that window: `ECONNRESET` on the client, no request in the server's
+/// log, the server still alive and listening. That was the `mocks` suite's flake,
+/// which uses `main.example.yaml` and its `host: 0.0.0.0`.
+///
+/// A wildcard probe cannot: the kernel refuses a second wildcard bind on a busy
+/// port with `EADDRINUSE`, so a collision becomes the lost-port race that
+/// `start_with_env` already retries instead of a corrupted request.
 pub fn free_port() -> u16 {
-    TcpListener::bind("127.0.0.1:0")
+    TcpListener::bind("0.0.0.0:0")
         .unwrap()
         .local_addr()
         .unwrap()
@@ -77,11 +93,34 @@ pub fn upstream() -> Upstream {
             let Ok(mut stream) = stream else { continue };
             let request = read_request_head(&mut stream);
             let path = request.split_whitespace().nth(1).unwrap_or("/").to_owned();
-            let body = format!("upstream saw {path}");
-            let response = format!(
-                "HTTP/1.1 200 OK\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{body}",
-                body.len()
-            );
+            // One route that is not an echo: a redirect to the upstream's own
+            // authority, which is what makes a client leave Doppel unless the
+            // `Location` is rewritten. Real services answer these constantly --
+            // a trailing slash, a canonical host, a login page.
+            let response = if path == "/page" {
+                // A page that names its own host, which is what makes a client
+                // leave Doppel on the next click unless the body is rewritten.
+                let body = format!(
+                    "<a href=\"http://127.0.0.1:{port}/next\">next</a>\
+                     <img src=\"http://cdn.127.0.0.1:{port}/logo.png\">"
+                );
+                format!(
+                    "HTTP/1.1 200 OK\r\ncontent-type: text/html\r\netag: \"upstream-etag\"\r\n\
+                     content-length: {}\r\nconnection: close\r\n\r\n{body}",
+                    body.len()
+                )
+            } else if path == "/redirect-self" {
+                format!(
+                    "HTTP/1.1 302 Found\r\nlocation: http://127.0.0.1:{port}/moved\r\n\
+                     content-length: 0\r\nconnection: close\r\n\r\n"
+                )
+            } else {
+                let body = format!("upstream saw {path}");
+                format!(
+                    "HTTP/1.1 200 OK\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{body}",
+                    body.len()
+                )
+            };
             let _ = stream.write_all(response.as_bytes());
         }
     });
@@ -351,6 +390,27 @@ impl Server {
         (status, response.text().unwrap())
     }
 
+    /// A GET that does not follow a redirect, and reports the `Location`.
+    ///
+    /// `reqwest::blocking::get` follows up to ten by default, which would send
+    /// the test wherever the header points and hide the header itself -- the
+    /// thing under test.
+    pub fn get_unfollowed(&self, path: &str) -> (u16, Option<String>) {
+        let url = format!("http://127.0.0.1:{}{path}", self.port);
+        let response = reqwest::blocking::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .unwrap()
+            .get(url)
+            .send()
+            .unwrap();
+        let location = response
+            .headers()
+            .get("location")
+            .map(|value| value.to_str().unwrap().to_owned());
+        (response.status().as_u16(), location)
+    }
+
     /// A GET carrying one header, for the suites that resolve a proxy by
     /// header rather than by the default.
     pub fn get_with_header(&self, path: &str, name: &str, value: &str) -> (u16, String) {
diff --git a/crates/doppel-cli/tests/proxying.rs b/crates/doppel-cli/tests/proxying.rs
index c2cbab0..74a4e92 100644
--- a/crates/doppel-cli/tests/proxying.rs
+++ b/crates/doppel-cli/tests/proxying.rs
@@ -12,3 +12,76 @@ fn proxies_a_request_end_to_end() {
     assert_eq!(status, 200);
     assert_eq!(body, "upstream saw /hello");
 }
+
+/// The whole chain, through the built binary: an upstream redirect to its own
+/// authority comes back naming Doppel.
+///
+/// The unit tests pin the rewriting rules; this pins the wiring, which is what
+/// was missing when an operator reported a redirect still pointing at the
+/// upstream. `server.external_url` is unset in this configuration, so the
+/// address comes from `server.host` and `server.port` -- the fallback that makes
+/// the default deployment work without configuring anything.
+#[test]
+fn a_redirect_to_the_upstreams_own_host_comes_back_naming_doppel() {
+    let up = upstream();
+    let server = Server::start(up.port);
+
+    let (status, location) = server.get_unfollowed("/redirect-self");
+
+    assert_eq!(status, 302);
+    assert_eq!(
+        location.as_deref(),
+        Some(format!("http://127.0.0.1:{}/moved", server.port()).as_str()),
+        "the Location must name Doppel, not the upstream"
+    );
+}
+
+/// And `DOPPEL_EXTERNAL_URL` over the top of it, which is the answer for a
+/// deployment behind a port mapping or an ingress: the address Doppel bound is
+/// not the address the client used.
+#[test]
+fn the_environment_overrides_which_host_a_rewritten_redirect_names() {
+    let up = upstream();
+    let server = Server::start_with_env(
+        up.port,
+        common::config,
+        &[("DOPPEL_EXTERNAL_URL", "https://doppel.example.com/")],
+    );
+
+    let (status, location) = server.get_unfollowed("/redirect-self");
+
+    assert_eq!(status, 302);
+    assert_eq!(
+        location.as_deref(),
+        Some("https://doppel.example.com/moved")
+    );
+}
+
+/// A body that names the upstream comes back naming Doppel.
+///
+/// Through the built binary, both listeners, so this covers the wiring as well as
+/// the rules: `rewrite_urls` defaults to on, and the address comes from
+/// `server.host` and `server.port` like a rewritten redirect's does.
+#[test]
+fn a_body_that_names_the_upstream_comes_back_naming_doppel() {
+    let up = upstream();
+    let server = Server::start(up.port);
+
+    let (status, body) = server.get("/page");
+
+    assert_eq!(status, 200, "{body}");
+    assert!(
+        body.contains(&format!("http://127.0.0.1:{}/next", server.port())),
+        "the link must point at Doppel: {body}"
+    );
+    assert!(
+        !body.contains(&format!("http://127.0.0.1:{}/next", up.port)),
+        "and not at the upstream: {body}"
+    );
+    // A host that merely contains the upstream's is a different host, and is left
+    // exactly as the upstream wrote it.
+    assert!(
+        body.contains(&format!("http://cdn.127.0.0.1:{}/logo.png", up.port)),
+        "a different host must survive: {body}"
+    );
+}
diff --git a/crates/doppel-core/src/config/admin.rs b/crates/doppel-core/src/config/admin.rs
index 3b75940..647f8b3 100644
--- a/crates/doppel-core/src/config/admin.rs
+++ b/crates/doppel-core/src/config/admin.rs
@@ -174,6 +174,27 @@ pub struct AdminConfig {
     pub access: AccessConfig,
     /// Bounds an uploaded template file.
     pub upload: UploadConfig,
+    /// Serve the browser dashboard from the admin listener's root.
+    ///
+    /// On by default. Off means `/`, `/static/*` and `/robots.txt` are not
+    /// routed at all and answer 404 like any other unknown path; the JSON API is
+    /// untouched either way.
+    ///
+    /// An `Option` and skipped when absent, for the reason given on `groups`:
+    /// adding it must not change the canonical YAML of configurations written
+    /// before it existed. Read it through
+    /// [`AdminConfig::is_dashboard_enabled`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub dashboard: Option<bool>,
+    /// The heading the dashboard shows, and the browser tab's title.
+    ///
+    /// Defaults to `Doppel`. Useful when several Doppels are open at once and
+    /// the tabs are otherwise identical.
+    ///
+    /// An `Option` and skipped when absent, for the same reason as `dashboard`.
+    /// Read it through [`AdminConfig::title`].
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub title: Option<super::AdminTitle>,
 }
 
 impl AdminConfig {
@@ -203,6 +224,24 @@ impl AdminConfig {
         self.public.unwrap_or(false) || self.groups.as_deref().is_some_and(<[_]>::is_empty)
     }
 
+    /// Whether the browser dashboard is served.
+    ///
+    /// One place resolves the absent case, so no caller has to remember which
+    /// way an unwritten field falls -- and the default is on, so an existing
+    /// configuration gains the dashboard on upgrade without being edited.
+    #[must_use]
+    pub fn is_dashboard_enabled(&self) -> bool {
+        self.dashboard.unwrap_or(true)
+    }
+
+    /// The dashboard's heading, with an absent `title` resolved to its default.
+    #[must_use]
+    pub fn title(&self) -> &str {
+        self.title
+            .as_ref()
+            .map_or(super::title::DEFAULT, super::AdminTitle::as_str)
+    }
+
     /// What `access` amounts to once `is_public` is taken into account.
     ///
     /// `None` when the configuration is public, which every caller reads as
diff --git a/crates/doppel-core/src/config/duration.rs b/crates/doppel-core/src/config/duration.rs
index 61e581d..0cd745a 100644
--- a/crates/doppel-core/src/config/duration.rs
+++ b/crates/doppel-core/src/config/duration.rs
@@ -134,6 +134,7 @@ impl utoipa::PartialSchema for Seconds {
             .minimum(Some(0.0))
             .maximum(Some(MAX_LATENCY_SECONDS))
             .description(Some("A latency in seconds, 0 to 300."))
+            .examples([serde_json::json!(0.25)])
             .into()
     }
 }
@@ -247,6 +248,7 @@ impl utoipa::PartialSchema for TimeoutSeconds {
             .minimum(Some(1.0))
             .maximum(Some(MAX_TIMEOUT_SECONDS as f64))
             .description(Some("An upstream timeout in whole seconds, 1 to 3600."))
+            .examples([serde_json::json!(30)])
             .into()
     }
 }
diff --git a/crates/doppel-core/src/config/env.rs b/crates/doppel-core/src/config/env.rs
index 6d1c115..8be9e2c 100644
--- a/crates/doppel-core/src/config/env.rs
+++ b/crates/doppel-core/src/config/env.rs
@@ -1,4 +1,5 @@
-//! Admin tokens supplied by the environment.
+//! Configuration supplied by the environment: the admin tokens, and the
+//! external url.
 //!
 //! A deployment that provisions its secrets through the environment should
 //! not have to write them into the configuration document to use them. These
@@ -16,11 +17,46 @@ use std::collections::BTreeMap;
 
 use serde::Deserialize;
 
-use super::{Name, Token, TokenConfig};
+use super::{ExternalUrl, Name, Token, TokenConfig, UrlError};
 
 /// The variable read at startup.
 pub const VAR: &str = "DOPPEL_ADMIN_TOKENS";
 
+/// The variable that overrides `server.external_url`.
+pub const EXTERNAL_URL_VAR: &str = "DOPPEL_EXTERNAL_URL";
+
+/// Why `DOPPEL_EXTERNAL_URL` was refused.
+///
+/// Fails startup rather than being logged and skipped, for the reason the token
+/// errors do: an operator who set it and got no error believes redirects are
+/// being rewritten to that address.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("{EXTERNAL_URL_VAR} is not usable: {reason}")]
+pub struct EnvExternalUrlError {
+    pub reason: UrlError,
+}
+
+/// `DOPPEL_EXTERNAL_URL`, or `None` when it is unset or empty.
+///
+/// Empty counts as unset, like the token variable: `DOPPEL_EXTERNAL_URL=${HOST}`
+/// with nothing behind `HOST` is a compose file that means nothing by it, not a
+/// deployment to refuse to start.
+///
+/// Not merged into `Config`, and for the same reason the tokens are not: the
+/// revision is computed over the document, so folding an environment value into
+/// it would make two instances reading one stored document disagree about the
+/// revision, and every compare-and-swap between them fail for a difference
+/// neither wrote.
+pub fn external_url_from_env() -> Result<Option<ExternalUrl>, EnvExternalUrlError> {
+    match std::env::var(EXTERNAL_URL_VAR) {
+        Ok(raw) if raw.trim().is_empty() => Ok(None),
+        Ok(raw) => ExternalUrl::parse(raw.trim())
+            .map(Some)
+            .map_err(|reason| EnvExternalUrlError { reason }),
+        Err(_) => Ok(None),
+    }
+}
+
 /// Tokens provided by the environment, in the order they were written.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct EnvTokens(Vec<TokenConfig>);
diff --git a/crates/doppel-core/src/config/header.rs b/crates/doppel-core/src/config/header.rs
index 78c48d7..36c108b 100644
--- a/crates/doppel-core/src/config/header.rs
+++ b/crates/doppel-core/src/config/header.rs
@@ -130,7 +130,7 @@ impl HeaderValue {
 }
 
 macro_rules! string_newtype_impls {
-    ($type:ident, $error:ident, $description:expr) => {
+    ($type:ident, $error:ident, $description:expr, $example:expr) => {
         impl fmt::Display for $type {
             fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
                 f.write_str(&self.0)
@@ -188,6 +188,7 @@ macro_rules! string_newtype_impls {
                 utoipa::openapi::schema::ObjectBuilder::new()
                     .schema_type(utoipa::openapi::schema::Type::String)
                     .description(Some($description))
+                    .examples([serde_json::json!($example)])
                     .into()
             }
         }
@@ -199,12 +200,14 @@ macro_rules! string_newtype_impls {
 string_newtype_impls!(
     HeaderName,
     HeaderNameError,
-    "An HTTP header name: a non-empty RFC 9110 token."
+    "An HTTP header name: a non-empty RFC 9110 token.",
+    "X-Request-Id"
 );
 string_newtype_impls!(
     HeaderValue,
     HeaderValueError,
-    "An HTTP header value: visible ASCII, space and tab, with no line breaks."
+    "An HTTP header value: visible ASCII, space and tab, with no line breaks.",
+    "staging"
 );
 
 #[cfg(test)]
diff --git a/crates/doppel-core/src/config/mock.rs b/crates/doppel-core/src/config/mock.rs
index 224ee29..db53e5d 100644
--- a/crates/doppel-core/src/config/mock.rs
+++ b/crates/doppel-core/src/config/mock.rs
@@ -47,10 +47,12 @@ pub struct MockResponse {
     pub status: crate::config::HttpStatus,
     /// A template rendered and sent as `text/plain`. Exclusive with `json` and
     /// `template`.
+    #[schema(examples("widget {{ id }} is ready"))]
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub body: Option<String>,
     /// A template whose rendered output must be valid JSON, sent as
     /// `application/json`. Exclusive with `body` and `template`.
+    #[schema(examples("{\"id\": \"{{ id }}\"}"))]
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub json: Option<String>,
     /// A template file under this proxy's template directory. Read per request,
diff --git a/crates/doppel-core/src/config/mod.rs b/crates/doppel-core/src/config/mod.rs
index d37f5af..d49e735 100644
--- a/crates/doppel-core/src/config/mod.rs
+++ b/crates/doppel-core/src/config/mod.rs
@@ -16,6 +16,7 @@ pub mod server;
 pub mod size;
 pub mod status;
 pub mod template;
+pub mod title;
 pub mod token;
 pub mod url;
 
@@ -29,7 +30,7 @@ pub use admin::{
     UploadConfig,
 };
 pub use duration::{Seconds, SecondsError, TimeoutError, TimeoutSeconds};
-pub use env::{EnvTokens, EnvTokensError};
+pub use env::{EnvExternalUrlError, EnvTokens, EnvTokensError, external_url_from_env};
 pub use header::{HeaderName, HeaderNameError, HeaderValue, HeaderValueError};
 pub use mock::{MockConfig, MockProxyOverride, MockRequest, MockResponse};
 pub use name::{MAX_PROXY, Name, NameError, ProxyName};
@@ -44,8 +45,9 @@ pub use server::{
 pub use size::{ByteSize, ByteSizeError};
 pub use status::{HttpStatus, StatusError};
 pub use template::{TemplateName, TemplateNameError};
+pub use title::{AdminTitle, AdminTitleError};
 pub use token::{Token, TokenError};
-pub use url::{UpstreamUrl, UrlError};
+pub use url::{ExternalUrl, UpstreamUrl, UrlError};
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize, utoipa::ToSchema)]
 #[serde(deny_unknown_fields)]
@@ -198,6 +200,47 @@ proxies:
         assert!(!load_from_str(&off).unwrap().admin.enable);
     }
 
+    #[test]
+    fn the_dashboard_is_on_and_titled_doppel_unless_told_otherwise() {
+        // Both defaults are what an existing configuration gets on upgrade
+        // without being edited, so they are the interesting half of the
+        // feature rather than a formality.
+        let default = load_from_str(MINIMAL).unwrap();
+        assert!(default.admin.is_dashboard_enabled());
+        assert_eq!(default.admin.title(), "Doppel");
+
+        let written = MINIMAL.replace(
+            "  port: 8081",
+            "  port: 8081\n  dashboard: false\n  title: \"Doppel (staging)\"",
+        );
+        let written = load_from_str(&written).unwrap();
+        assert!(!written.admin.is_dashboard_enabled());
+        assert_eq!(written.admin.title(), "Doppel (staging)");
+    }
+
+    #[test]
+    fn adding_the_dashboard_fields_did_not_change_any_stored_revision() {
+        // The revision is a hash of the canonical YAML, and every stored
+        // configuration is compare-and-swapped against its own. A default that
+        // materialised into the document would change the revision of every
+        // configuration written before these fields existed, and each would fail
+        // its own revision check on the first load after the upgrade -- which is
+        // why both fields are `Option` and skipped when absent.
+        let config = load_from_str(MINIMAL).unwrap();
+        let yaml = canonical_yaml(&config).unwrap();
+        assert!(!yaml.contains("dashboard"), "{yaml}");
+        assert!(!yaml.contains("title"), "{yaml}");
+
+        // And the pair does serialize once written, or the field would be
+        // unsettable rather than merely absent.
+        let mut written = config;
+        written.admin.dashboard = Some(false);
+        written.admin.title = Some(AdminTitle::parse("Doppel (staging)").unwrap());
+        let yaml = canonical_yaml(&written).unwrap();
+        assert!(yaml.contains("dashboard: false"), "{yaml}");
+        assert!(yaml.contains("title: Doppel (staging)"), "{yaml}");
+    }
+
     #[test]
     fn server_workers_is_no_longer_a_configuration_field() {
         // It sizes the tokio runtime, and a database store cannot be opened
diff --git a/crates/doppel-core/src/config/name.rs b/crates/doppel-core/src/config/name.rs
index 5271f4c..60ee83f 100644
--- a/crates/doppel-core/src/config/name.rs
+++ b/crates/doppel-core/src/config/name.rs
@@ -205,6 +205,9 @@ impl<const MAX_LEN: usize> utoipa::PartialSchema for Name<MAX_LEN> {
             .description(Some(format!(
                 "Letters, digits, `-` and `_`, between {MIN} and {MAX_LEN} characters."
             )))
+            // Short enough to be legal for a proxy name as well as for the longer
+            // names that share this builder.
+            .examples([serde_json::json!("billing-api")])
             .into()
     }
 }
diff --git a/crates/doppel-core/src/config/port.rs b/crates/doppel-core/src/config/port.rs
index 7d44309..378333c 100644
--- a/crates/doppel-core/src/config/port.rs
+++ b/crates/doppel-core/src/config/port.rs
@@ -122,6 +122,7 @@ impl utoipa::PartialSchema for Port {
             .minimum(Some(1.0))
             .maximum(Some(f64::from(u16::MAX)))
             .description(Some("A TCP port, 1 to 65535."))
+            .examples([serde_json::json!(8080)])
             .into()
     }
 }
diff --git a/crates/doppel-core/src/config/proxy.rs b/crates/doppel-core/src/config/proxy.rs
index 5f1774e..bee311b 100644
--- a/crates/doppel-core/src/config/proxy.rs
+++ b/crates/doppel-core/src/config/proxy.rs
@@ -144,6 +144,22 @@ pub struct ProxyConfig {
     /// *against redirect handling itself* needs.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub rewrite_redirects: Option<bool>,
+    /// Whether the upstream's own address is rewritten to Doppel's inside the
+    /// bodies this proxy relays. Absent means enabled.
+    ///
+    /// The same problem `rewrite_redirects` solves, one layer down: a page, a
+    /// script or a JSON document that names `https://api.example.com/v2/` sends
+    /// the client straight there on the next request, past every fault and every
+    /// mock. Rewriting the body keeps it inside Doppel.
+    ///
+    /// Only the exact host is replaced. `https://cdn.api.example.com/` is a
+    /// different host and is left alone, because Doppel does not proxy it and
+    /// pointing it at itself would break a page rather than keep it working.
+    ///
+    /// Only text bodies, and only ones the upstream did not compress. Turn it off
+    /// for a client being tested against the bytes the upstream actually sent.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rewrite_urls: Option<bool>,
     /// Bounds the request body a matched mock is allowed to buffer in order
     /// to extract from it; phase 1 streams bodies deliberately, and reading
     /// `.content.items` needs the whole thing in hand. See rule V33.
diff --git a/crates/doppel-core/src/config/ratio.rs b/crates/doppel-core/src/config/ratio.rs
index 01910d1..380d08f 100644
--- a/crates/doppel-core/src/config/ratio.rs
+++ b/crates/doppel-core/src/config/ratio.rs
@@ -106,6 +106,7 @@ impl utoipa::PartialSchema for Ratio {
             .minimum(Some(0.0))
             .maximum(Some(1.0))
             .description(Some("A probability from 0.0 to 1.0. 50% is `0.5`."))
+            .examples([serde_json::json!(0.25)])
             .into()
     }
 }
diff --git a/crates/doppel-core/src/config/server.rs b/crates/doppel-core/src/config/server.rs
index a670a33..11d9e6e 100644
--- a/crates/doppel-core/src/config/server.rs
+++ b/crates/doppel-core/src/config/server.rs
@@ -22,6 +22,58 @@ pub struct ServerConfig {
     /// The TCP port proxied traffic arrives on. Must differ from
     /// `admin.port`.
     pub port: super::Port,
+    /// Where clients reach this Doppel, when that is not `host:port`.
+    ///
+    /// Behind a container port mapping, a load balancer or an ingress, the
+    /// address Doppel bound is not the address a client used -- and a rewritten
+    /// `Location` has to name the second. Doppel cannot infer it: `Host` is a
+    /// claim by the caller, and building a redirect out of it hands the caller
+    /// the redirect.
+    ///
+    /// Absent, `host` and `port` are used, with a wildcard bind (`0.0.0.0`, `::`)
+    /// read as loopback -- which is right for a laptop or a pod reached at its
+    /// own address, and wrong behind a port mapping or an ingress, where the
+    /// client used neither. Doppel logs the address it settled on at startup.
+    ///
+    /// `DOPPEL_EXTERNAL_URL` overrides it. Part of `server`, so a change takes a
+    /// restart like the rest of that section.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub external_url: Option<super::ExternalUrl>,
+}
+
+impl ServerConfig {
+    /// Where a client reaches this Doppel, as far as the configuration knows.
+    ///
+    /// `external_url` when it is set, and `http://host:port/` when it is not --
+    /// which is right for a Doppel bound to an address a client can dial, and is
+    /// most of them: a laptop on `127.0.0.1`, a pod on its own address.
+    ///
+    /// A wildcard bind (`0.0.0.0`, `::`) becomes loopback: `0.0.0.0` is every
+    /// address this host has, so it names none of them, and
+    /// `http://0.0.0.0:8080/` in a `Location` is a URL that fails or means
+    /// something else depending on the client. `127.0.0.1` is the address that
+    /// is right for the case a wildcard bind is usually about -- a container or
+    /// a laptop reached from the same machine.
+    ///
+    /// It is a guess, and the one place this can be wrong: a port mapping or an
+    /// ingress means the client used neither this address nor this port. That
+    /// deployment says where it is reached with `external_url` or
+    /// `DOPPEL_EXTERNAL_URL`, which is why both exist.
+    #[must_use]
+    pub fn public_url(&self) -> Option<super::ExternalUrl> {
+        if let Some(configured) = &self.external_url {
+            return Some(configured.clone());
+        }
+        // Brackets around an IPv6 literal: `http://::1:8080/` does not parse,
+        // and the port would read as part of the address.
+        let host = match self.host {
+            IpAddr::V4(address) if address.is_unspecified() => "127.0.0.1".to_owned(),
+            IpAddr::V6(address) if address.is_unspecified() => "[::1]".to_owned(),
+            IpAddr::V4(address) => address.to_string(),
+            IpAddr::V6(address) => format!("[{address}]"),
+        };
+        super::ExternalUrl::parse(&format!("http://{host}:{}/", self.port.get())).ok()
+    }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, utoipa::ToSchema)]
@@ -91,7 +143,7 @@ pub struct ControlConfig {
     #[serde(default = "default_socket")]
     /// A filesystem path. `utoipa` has no schema for `PathBuf`, so it is
     /// described as the string it is written as.
-    #[schema(value_type = String)]
+    #[schema(value_type = String, examples("/tmp/doppel.sock"))]
     pub socket: PathBuf,
 }
 
@@ -115,7 +167,7 @@ pub struct TemplatesConfig {
     #[serde(default = "default_templates_dir")]
     /// A filesystem path. `utoipa` has no schema for `PathBuf`, so it is
     /// described as the string it is written as.
-    #[schema(value_type = String)]
+    #[schema(value_type = String, examples("./templates"))]
     pub dir: PathBuf,
 }
 
@@ -136,5 +188,83 @@ impl Default for TemplatesConfig {
 pub struct SentryConfig {
     /// The Sentry DSN to report to. Empty disables reporting, so a deployment
     /// can blank it without removing the section.
+    #[schema(examples("https://key@o0.ingest.sentry.io/0"))]
     pub dsn: String,
 }
+
+#[cfg(test)]
+mod public_url_tests {
+    use super::*;
+    use crate::config::load_from_str;
+
+    fn config_with(server: &str) -> ServerConfig {
+        let text = format!(
+            r#"
+server:
+{server}
+admin:
+  host: "127.0.0.1"
+  port: 8081
+  tokens: []
+  access: {{}}
+  upload:
+    limit: 1Mi
+proxies:
+  - name: p1
+    type: http
+    url: "https://example.com/"
+"#
+        );
+        load_from_str(&text).expect("fixture parses").server
+    }
+
+    #[test]
+    fn a_dialable_host_names_itself() {
+        let server = config_with("  host: \"127.0.0.1\"\n  port: 8080");
+        assert_eq!(
+            server.public_url().map(|url| url.as_str().to_owned()),
+            Some("http://127.0.0.1:8080/".to_owned())
+        );
+    }
+
+    #[test]
+    fn an_ipv6_host_is_bracketed() {
+        // `http://::1:8080/` does not parse, and the port reads as part of the
+        // address. Without the brackets this is a URL nobody can follow.
+        let server = config_with("  host: \"::1\"\n  port: 8080");
+        assert_eq!(
+            server.public_url().map(|url| url.as_str().to_owned()),
+            Some("http://[::1]:8080/".to_owned())
+        );
+    }
+
+    #[test]
+    fn a_wildcard_bind_becomes_loopback() {
+        // `0.0.0.0` is every address this host has, so it names none of them and
+        // cannot go in a `Location`. Loopback is the address that is right for
+        // what a wildcard bind is usually about, and a deployment reached
+        // anywhere else says so with `external_url`.
+        for (host, expected) in [
+            ("0.0.0.0", "http://127.0.0.1:8080/"),
+            ("::", "http://[::1]:8080/"),
+        ] {
+            let server = config_with(&format!("  host: \"{host}\"\n  port: 8080"));
+            assert_eq!(
+                server.public_url().map(|url| url.as_str().to_owned()),
+                Some(expected.to_owned()),
+                "{host}"
+            );
+        }
+    }
+
+    #[test]
+    fn external_url_wins_over_the_bind_address() {
+        let server = config_with(
+            "  host: \"127.0.0.1\"\n  port: 8080\n  external_url: \"https://doppel.example.com/\"",
+        );
+        assert_eq!(
+            server.public_url().map(|url| url.as_str().to_owned()),
+            Some("https://doppel.example.com/".to_owned())
+        );
+    }
+}
diff --git a/crates/doppel-core/src/config/status.rs b/crates/doppel-core/src/config/status.rs
index 1e2d916..b154e78 100644
--- a/crates/doppel-core/src/config/status.rs
+++ b/crates/doppel-core/src/config/status.rs
@@ -114,6 +114,7 @@ impl utoipa::PartialSchema for HttpStatus {
             .minimum(Some(f64::from(MIN)))
             .maximum(Some(f64::from(MAX)))
             .description(Some("An HTTP status code, 100 to 599."))
+            .examples([serde_json::json!(200)])
             .into()
     }
 }
diff --git a/crates/doppel-core/src/config/title.rs b/crates/doppel-core/src/config/title.rs
new file mode 100644
index 0000000..042b600
--- /dev/null
+++ b/crates/doppel-core/src/config/title.rs
@@ -0,0 +1,220 @@
+//! The dashboard's heading, parsed rather than validated.
+//!
+//! A title is the one configuration value this project renders into a web page,
+//! so it is the one value whose bounds are about a browser rather than about a
+//! filesystem or a metric label. It is checked while the document is parsed,
+//! like every other value, so no unchecked title exists at any later moment.
+//!
+//! Escaping is *not* this type's job and deliberately so. A title is legal text
+//! that happens to be displayed; making the type refuse `<` would forbid a
+//! perfectly reasonable heading in order to paper over a rendering bug, and
+//! would still leave every other injection sink unprotected. The escaping
+//! belongs where the HTML is produced, in `doppel-admin`, and has a test of its
+//! own there.
+
+use std::fmt;
+use std::str::FromStr;
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+/// The longest title accepted.
+///
+/// It sits in a page header next to the theme and sign-in controls, so the bound
+/// is about what fits rather than about what a machine can hold: 64 characters
+/// is a long service name and a short sentence, and anything past it is being
+/// used as a subtitle.
+pub const MAX_LEN: usize = 64;
+
+/// The default heading, used when `admin.title` is absent.
+pub const DEFAULT: &str = "Doppel";
+
+/// A validated dashboard title.
+///
+/// Non-empty, at most [`MAX_LEN`] characters, no control characters. Not
+/// restricted to ASCII: this is a UI string, which `AGENTS.md` names as the
+/// exception to the repository's ASCII rule, and an operator naming their
+/// staging environment in their own language is doing nothing wrong.
+#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct AdminTitle(String);
+
+/// Why a title was refused.
+///
+/// One variant per rule, so the message says what is wrong rather than restating
+/// the rule and leaving the reader to work out which part they broke.
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+pub enum AdminTitleError {
+    /// Empty and whitespace-only are one case on purpose: both render as a
+    /// header with nothing in it, and an operator who wrote `title: " "` meant
+    /// to write something.
+    #[error("a title must not be empty")]
+    Empty,
+    #[error("a title must be at most {MAX_LEN} characters, this one is {0}")]
+    TooLong(usize),
+    /// A tab or a newline in a heading is either a copy-paste accident or an
+    /// attempt to do something to the markup. Neither is worth accepting, and
+    /// naming the character is what turns this into a fixable report.
+    #[error("a title must not contain control characters; this one contains {0:?}")]
+    Control(char),
+}
+
+impl AdminTitle {
+    /// Check a string and keep it, or say why not.
+    pub fn parse(value: impl Into<String>) -> Result<Self, AdminTitleError> {
+        let value = value.into();
+
+        if value.trim().is_empty() {
+            return Err(AdminTitleError::Empty);
+        }
+        // Counted in characters rather than bytes. A title is displayed, and
+        // what a reader sees is characters; measuring the bound in bytes would
+        // make the limit depend on the language the title is written in.
+        let length = value.chars().count();
+        if length > MAX_LEN {
+            return Err(AdminTitleError::TooLong(length));
+        }
+        // `char::is_control` rather than `is_ascii_control`: the Unicode class
+        // includes the ASCII one, and a title is not restricted to ASCII, so
+        // checking only the ASCII range would let a directional override
+        // through -- a character whose whole purpose is to make displayed text
+        // disagree with the text that is stored.
+        if let Some(bad) = value.chars().find(|c| c.is_control()) {
+            return Err(AdminTitleError::Control(bad));
+        }
+
+        Ok(Self(value))
+    }
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Display for AdminTitle {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl FromStr for AdminTitle {
+    type Err = AdminTitleError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        Self::parse(value)
+    }
+}
+
+impl AsRef<str> for AdminTitle {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl Serialize for AdminTitle {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_str(&self.0)
+    }
+}
+
+impl<'de> Deserialize<'de> for AdminTitle {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(d)?;
+        Self::parse(value).map_err(serde::de::Error::custom)
+    }
+}
+
+impl utoipa::PartialSchema for AdminTitle {
+    fn schema() -> utoipa::openapi::RefOr<utoipa::openapi::schema::Schema> {
+        utoipa::openapi::schema::ObjectBuilder::new()
+            .schema_type(utoipa::openapi::schema::Type::String)
+            .min_length(Some(1))
+            .max_length(Some(MAX_LEN))
+            .description(Some(format!(
+                "The heading the dashboard shows, at most {MAX_LEN} characters \
+                 and free of control characters. Defaults to `{DEFAULT}`."
+            )))
+            .examples([serde_json::json!("billing-api (staging)")])
+            .into()
+    }
+}
+
+impl utoipa::ToSchema for AdminTitle {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_titles_people_actually_write_are_accepted() {
+        for title in [
+            DEFAULT,
+            "Doppel (staging)",
+            "billing-api doppelganger",
+            "a".repeat(MAX_LEN).as_str(),
+        ] {
+            assert!(
+                AdminTitle::parse(title).is_ok(),
+                "`{title}` should be a legal title"
+            );
+        }
+    }
+
+    #[test]
+    fn an_empty_or_blank_title_is_refused() {
+        assert_eq!(AdminTitle::parse(""), Err(AdminTitleError::Empty));
+        assert_eq!(AdminTitle::parse("   "), Err(AdminTitleError::Empty));
+        assert_eq!(AdminTitle::parse("\t"), Err(AdminTitleError::Empty));
+    }
+
+    #[test]
+    fn the_bound_is_counted_in_characters_not_bytes() {
+        // Two bytes per character, so a byte-counted bound would refuse this at
+        // half the stated length -- making the limit depend on the language the
+        // title happens to be written in.
+        let cyrillic = "\u{044f}".repeat(MAX_LEN);
+        assert_eq!(
+            cyrillic.len(),
+            MAX_LEN * 2,
+            "fixture is not two bytes a char"
+        );
+        assert!(AdminTitle::parse(&cyrillic).is_ok());
+
+        assert_eq!(
+            AdminTitle::parse("x".repeat(MAX_LEN + 1)),
+            Err(AdminTitleError::TooLong(MAX_LEN + 1))
+        );
+    }
+
+    #[test]
+    fn a_control_character_is_refused_and_named() {
+        assert_eq!(
+            AdminTitle::parse("two\nlines"),
+            Err(AdminTitleError::Control('\n'))
+        );
+        assert_eq!(
+            AdminTitle::parse("a\u{0}b"),
+            Err(AdminTitleError::Control('\u{0}'))
+        );
+    }
+
+    /// Markup is legal text, and refusing it here would be the wrong place to
+    /// fix the wrong problem: the escaping belongs where the HTML is written,
+    /// and `doppel-admin` has a test that a title like this cannot close the
+    /// script element it is injected into.
+    #[test]
+    fn markup_is_accepted_because_escaping_is_not_this_types_job() {
+        let hostile = "</script><script>alert(1)</script>";
+        assert!(AdminTitle::parse(hostile).is_ok());
+    }
+
+    #[test]
+    fn a_title_round_trips_through_yaml() {
+        let title: AdminTitle = serde_norway::from_str("\"Doppel (staging)\"").unwrap();
+        assert_eq!(title.as_str(), "Doppel (staging)");
+        assert_eq!(
+            serde_norway::to_string(&title).unwrap().trim(),
+            "Doppel (staging)"
+        );
+        assert!(serde_norway::from_str::<AdminTitle>("\"\"").is_err());
+    }
+}
diff --git a/crates/doppel-core/src/config/token.rs b/crates/doppel-core/src/config/token.rs
index 494b21e..7ee2d95 100644
--- a/crates/doppel-core/src/config/token.rs
+++ b/crates/doppel-core/src/config/token.rs
@@ -204,6 +204,9 @@ impl utoipa::PartialSchema for Token {
                 "An admin token: printable ASCII with no spaces, 32 to 255 \
                  characters. A version 4 UUID is the recommended shape.",
             ))
+            // Obviously a placeholder. An example that looked like a real token is
+            // one somebody copies into a deployment.
+            .examples([serde_json::json!("replace-me-00000000000000000000000")])
             .into()
     }
 }
diff --git a/crates/doppel-core/src/config/url.rs b/crates/doppel-core/src/config/url.rs
index 70b2b0f..a558d60 100644
--- a/crates/doppel-core/src/config/url.rs
+++ b/crates/doppel-core/src/config/url.rs
@@ -28,19 +28,29 @@ pub enum UrlError {
     HasQueryOrFragment,
 }
 
+/// The rules both base urls in this configuration are held to: absolute, a
+/// scheme Doppel speaks, and no query or fragment.
+///
+/// Shared so the two cannot drift. A query on Doppel's own external url would
+/// be dropped from every rewritten `Location` for the same reason it is dropped
+/// from an upstream: the path is rebuilt, and there is nowhere for it to go.
+fn parse_base(value: &str) -> Result<reqwest::Url, UrlError> {
+    let url = reqwest::Url::parse(value).map_err(|err| UrlError::NotAbsolute {
+        reason: err.to_string(),
+    })?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(UrlError::BadScheme(url.scheme().to_owned()));
+    }
+    if url.query().is_some() || url.fragment().is_some() {
+        return Err(UrlError::HasQueryOrFragment);
+    }
+    Ok(url)
+}
+
 impl UpstreamUrl {
     /// Check a string and keep it parsed, or say why not.
     pub fn parse(value: &str) -> Result<Self, UrlError> {
-        let url = reqwest::Url::parse(value).map_err(|err| UrlError::NotAbsolute {
-            reason: err.to_string(),
-        })?;
-        if !matches!(url.scheme(), "http" | "https") {
-            return Err(UrlError::BadScheme(url.scheme().to_owned()));
-        }
-        if url.query().is_some() || url.fragment().is_some() {
-            return Err(UrlError::HasQueryOrFragment);
-        }
-        Ok(Self(url))
+        parse_base(value).map(Self)
     }
 
     #[must_use]
@@ -116,6 +126,86 @@ impl utoipa::PartialSchema for UpstreamUrl {
 
 impl utoipa::ToSchema for UpstreamUrl {}
 
+/// Where clients reach *this* Doppel, when it is not where Doppel is listening.
+///
+/// Doppel cannot work this out for itself. It knows the address it bound, which
+/// behind a container port mapping, a load balancer or an ingress is not the
+/// address a client used -- and `Host` is a claim by the caller, not something
+/// to build a redirect out of. So it is configured: `server.external_url`, or
+/// `DOPPEL_EXTERNAL_URL` over the top of it.
+///
+/// Held to the same rules as an upstream base, and used the same way: a path is
+/// a prefix, so `https://gw.example.com/doppel/` is a Doppel reached under a
+/// prefix and rewritten locations keep it.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct ExternalUrl(reqwest::Url);
+
+impl ExternalUrl {
+    /// Check a string and keep it parsed, or say why not.
+    pub fn parse(value: &str) -> Result<Self, UrlError> {
+        parse_base(value).map(Self)
+    }
+
+    #[must_use]
+    pub fn into_url(self) -> reqwest::Url {
+        self.0
+    }
+
+    #[must_use]
+    pub fn as_url(&self) -> &reqwest::Url {
+        &self.0
+    }
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        self.0.as_str()
+    }
+}
+
+impl fmt::Display for ExternalUrl {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        f.write_str(self.0.as_str())
+    }
+}
+
+impl FromStr for ExternalUrl {
+    type Err = UrlError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        Self::parse(value)
+    }
+}
+
+impl Serialize for ExternalUrl {
+    /// The parsed form, for the reason `UpstreamUrl` serializes that way: the
+    /// revision is computed over what this writes.
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.serialize_str(self.0.as_str())
+    }
+}
+
+impl<'de> Deserialize<'de> for ExternalUrl {
+    fn deserialize<D: Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(d)?;
+        Self::parse(&value).map_err(serde::de::Error::custom)
+    }
+}
+
+impl utoipa::PartialSchema for ExternalUrl {
+    fn schema() -> utoipa::openapi::RefOr<utoipa::openapi::schema::Schema> {
+        utoipa::openapi::schema::ObjectBuilder::new()
+            .schema_type(utoipa::openapi::schema::Type::String)
+            .description(Some(
+                "An absolute http or https url naming where clients reach this \
+                 Doppel, with no query string or fragment.",
+            ))
+            .examples([serde_json::json!("https://doppel.example.com/")])
+            .into()
+    }
+}
+
+impl utoipa::ToSchema for ExternalUrl {}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/doppel-core/src/conformance.rs b/crates/doppel-core/src/conformance.rs
index 03b03c8..7723cf8 100644
--- a/crates/doppel-core/src/conformance.rs
+++ b/crates/doppel-core/src/conformance.rs
@@ -31,6 +31,13 @@ admin:
   access: {}
   upload:
     limit: 1Mi
+  # Both present and both non-default, for the same reason as
+  # `rewrite_redirects` below -- and with one more thing to say: since the
+  # PostgreSQL store keeps the document as JSON, these two arrived without a
+  # migration of their own. A store that had gone on needing a column per field
+  # would fail here rather than in production.
+  dashboard: false
+  title: "Doppel (conformance)"
 proxies:
   - name: alpha
     type: http
@@ -66,6 +73,8 @@ pub async fn run_all(store: &dyn ConfigStore) {
     retain_templates_with_an_empty_keep_removes_everything(store).await;
     an_unusable_template_name_is_refused(store).await;
     templates_are_listed_in_a_stable_order(store).await;
+    renaming_a_proxy_carries_its_templates(store).await;
+    renaming_a_proxy_with_no_templates_is_not_an_error(store).await;
 }
 
 async fn load_returns_what_save_wrote(store: &dyn ConfigStore) {
@@ -194,6 +203,55 @@ async fn retain_templates_with_an_empty_keep_removes_everything(store: &dyn Conf
     );
 }
 
+async fn renaming_a_proxy_carries_its_templates(store: &dyn ConfigStore) {
+    // A proxy's name is where its templates live, so a rename that left them behind
+    // would leave every mock naming a file that is not there.
+    store.save(&base(), None).await.expect("provision");
+    store
+        .save_template("alpha", "put.j2", b"body")
+        .await
+        .unwrap();
+
+    store
+        .rename_templates("alpha", "renamed")
+        .await
+        .expect("rename");
+
+    let moved = store.load_templates("renamed").await.expect("list");
+    assert_eq!(
+        moved.len(),
+        1,
+        "the template did not arrive under the new name"
+    );
+    assert_eq!(moved[0].name, "put.j2");
+    assert_eq!(moved[0].content, b"body", "the contents changed on the way");
+    assert!(
+        store
+            .load_templates("alpha")
+            .await
+            .expect("list")
+            .is_empty(),
+        "the old name still has templates, so they were copied rather than moved"
+    );
+}
+
+async fn renaming_a_proxy_with_no_templates_is_not_an_error(store: &dyn ConfigStore) {
+    // The common case: most proxies have no templates at all, and renaming one must
+    // not depend on whether it does.
+    store.save(&base(), None).await.expect("provision");
+    store
+        .rename_templates("beta", "beta-renamed")
+        .await
+        .expect("renaming a proxy with no templates must succeed");
+    assert!(
+        store
+            .load_templates("beta-renamed")
+            .await
+            .expect("list")
+            .is_empty()
+    );
+}
+
 async fn an_unusable_template_name_is_refused(store: &dyn ConfigStore) {
     store.save(&base(), None).await.expect("provision");
     for name in ["..", "a/b", "", ".hidden", "a..b"] {
diff --git a/crates/doppel-core/src/error.rs b/crates/doppel-core/src/error.rs
index 199f5b1..7e2ac6c 100644
--- a/crates/doppel-core/src/error.rs
+++ b/crates/doppel-core/src/error.rs
@@ -27,6 +27,7 @@ pub enum ErrorCode {
     RevisionMismatch,
     RevisionRequired,
     InvalidRequestPath,
+    DashboardNotBuilt,
 }
 
 impl ErrorCode {
@@ -35,7 +36,10 @@ impl ErrorCode {
     pub fn status(self) -> u16 {
         match self {
             Self::ProxyNotResolved | Self::NotFound => 404,
-            Self::NoProxiesConfigured => 503,
+            // Both mean "this binary cannot serve that, and no request will change
+            // it": one because nothing is configured to proxy to, the other because
+            // the binary was built without the dashboard's static assets.
+            Self::NoProxiesConfigured | Self::DashboardNotBuilt => 503,
             Self::TemplateRenderError
             | Self::TemplateNotFound
             | Self::BodyExtractionError
@@ -99,6 +103,7 @@ impl ErrorCode {
             Self::RevisionMismatch => "REVISION_MISMATCH",
             Self::RevisionRequired => "REVISION_REQUIRED",
             Self::InvalidRequestPath => "INVALID_REQUEST_PATH",
+            Self::DashboardNotBuilt => "DASHBOARD_NOT_BUILT",
         }
     }
 }
@@ -136,6 +141,7 @@ impl<'de> Deserialize<'de> for ErrorCode {
             "REVISION_MISMATCH" => Ok(Self::RevisionMismatch),
             "REVISION_REQUIRED" => Ok(Self::RevisionRequired),
             "INVALID_REQUEST_PATH" => Ok(Self::InvalidRequestPath),
+            "DASHBOARD_NOT_BUILT" => Ok(Self::DashboardNotBuilt),
             other => Err(serde::de::Error::custom(format!(
                 "unknown error code `{other}`"
             ))),
@@ -224,6 +230,7 @@ mod tests {
         (ErrorCode::RevisionMismatch, "REVISION_MISMATCH", 409),
         (ErrorCode::RevisionRequired, "REVISION_REQUIRED", 428),
         (ErrorCode::InvalidRequestPath, "INVALID_REQUEST_PATH", 400),
+        (ErrorCode::DashboardNotBuilt, "DASHBOARD_NOT_BUILT", 503),
     ];
 
     /// See `ALL_CODES`'s doc comment: this match's lack of a wildcard arm is
@@ -249,7 +256,8 @@ mod tests {
             | ErrorCode::StoreError
             | ErrorCode::RevisionMismatch
             | ErrorCode::RevisionRequired
-            | ErrorCode::InvalidRequestPath => {
+            | ErrorCode::InvalidRequestPath
+            | ErrorCode::DashboardNotBuilt => {
                 let count = ALL_CODES.iter().filter(|(c, _, _)| *c == code).count();
                 assert_eq!(count, 1, "{code:?} must appear exactly once in ALL_CODES");
             }
diff --git a/crates/doppel-core/src/metrics.rs b/crates/doppel-core/src/metrics.rs
index 0ff1e40..a715559 100644
--- a/crates/doppel-core/src/metrics.rs
+++ b/crates/doppel-core/src/metrics.rs
@@ -7,15 +7,22 @@
 //! request path: the cardinality rule is enforced by the signatures, not by
 //! remembering it at five call sites.
 
-use std::time::Duration;
+use std::collections::BTreeSet;
+use std::sync::Mutex;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
-use metrics_exporter_prometheus::{BuildError, PrometheusBuilder, PrometheusHandle};
+use metrics_exporter_prometheus::{BuildError, Matcher, PrometheusBuilder, PrometheusHandle};
 
 pub const UPSTREAM_DURATION: &str = "doppel_upstream_request_duration_seconds";
 pub const PROXY_DURATION: &str = "doppel_proxy_request_duration_seconds";
+pub const ADMIN_DURATION: &str = "doppel_admin_request_duration_seconds";
 pub const LOSS_TOTAL: &str = "doppel_loss_total";
 pub const LATENCY_INJECTED_TOTAL: &str = "doppel_latency_injected_total";
 pub const MOCK_HITS_TOTAL: &str = "doppel_mock_hits_total";
+pub const LAST_ERROR: &str = "doppel_proxy_last_error_timestamp_seconds";
+pub const BUILD_INFO: &str = "doppel_build_info";
+pub const DASHBOARD_INFO: &str = "doppel_dashboard_info";
+pub const PROXY_MOCKS: &str = "doppel_proxy_mocks";
 
 /// Recorded when a request reached the proxy listener but matched no proxy.
 ///
@@ -25,6 +32,12 @@ pub const MOCK_HITS_TOTAL: &str = "doppel_mock_hits_total";
 /// which is the kind of gap an operator finds during an incident.
 pub const UNRESOLVED: &str = "";
 
+/// Recorded when a request reached the admin listener and matched no route.
+///
+/// The same reasoning as `UNRESOLVED`, and the same value: no route template is
+/// empty, so this cannot collide with one.
+pub const UNMATCHED: &str = "";
+
 /// Latency buckets, in seconds.
 ///
 /// Explicit because the Prometheus exporter renders a histogram as a summary
@@ -33,9 +46,27 @@ pub const UNRESOLVED: &str = "";
 /// requirement asks for buckets, and buckets are also the only form that
 /// survives more than one replica.
 const BUCKETS: &[f64] = &[
-    0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0,
+    0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0, 10.0, 15.0, 30.0, 60.0,
 ];
 
+/// The same ladder, cut at five seconds, for the admin API.
+///
+/// The upper reaches of the proxy ladder are there because a proxy is asked to be
+/// slow on purpose -- `latency` injection goes to whatever the configuration says,
+/// and a 60-second bucket is a real measurement of a fault. Nothing on the admin
+/// listener has any business taking longer than five seconds: it reads a document,
+/// writes a document, or renders an exposition.
+const ADMIN_BUCKETS: &[f64] = &[0.005, 0.01, 0.025, 0.05, 0.1, 0.25, 0.5, 1.0, 2.5, 5.0];
+
+/// Proxy names whose mock gauge has been set, so a proxy that leaves the
+/// configuration can be zeroed rather than left at its last value.
+///
+/// The exporter has no way to delete a series: an unset gauge keeps reporting
+/// whatever it last held, which for a deleted proxy would be a mock count for
+/// something that no longer exists. Zero is the honest reading, and this is the
+/// smallest thing that knows which names to zero.
+static GAUGED_PROXIES: Mutex<BTreeSet<String>> = Mutex::new(BTreeSet::new());
+
 /// Build a recorder without touching the global one.
 ///
 /// Tests use this with `metrics::set_default_local_recorder`, so they observe
@@ -44,6 +75,7 @@ const BUCKETS: &[f64] = &[
 pub fn build() -> Result<metrics_exporter_prometheus::PrometheusRecorder, BuildError> {
     Ok(PrometheusBuilder::new()
         .set_buckets(BUCKETS)?
+        .set_buckets_for_metric(Matcher::Full(ADMIN_DURATION.to_owned()), ADMIN_BUCKETS)?
         .build_recorder())
 }
 
@@ -80,18 +112,156 @@ pub fn record_upstream(proxy: &str, method: &str, status: u16, elapsed: Duration
     .record(elapsed.as_secs_f64());
 }
 
+/// How a request through the proxy listener was answered, beyond its status.
+///
+/// Three booleans rather than one enum: they are not exclusive. A mock can answer
+/// a request the proxy would otherwise have dropped, and an upstream error can
+/// arrive after a latency delay. Each is `1` or `0` in a label, so a query can ask
+/// for "everything that was not a fault" without parsing a status class.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct Outcome {
+    /// A mock answered instead of the upstream.
+    pub replace: bool,
+    /// Loss injection dropped the request.
+    pub loss: bool,
+    /// The upstream was contacted and did not answer usefully -- a transport
+    /// failure, a timeout, or a status of 500 and above.
+    pub upstream_error: bool,
+}
+
+impl Outcome {
+    /// A plain proxied exchange.
+    #[must_use]
+    pub fn proxied() -> Self {
+        Self::default()
+    }
+
+    #[must_use]
+    pub fn mocked() -> Self {
+        Self {
+            replace: true,
+            ..Self::default()
+        }
+    }
+
+    #[must_use]
+    pub fn lost() -> Self {
+        Self {
+            loss: true,
+            ..Self::default()
+        }
+    }
+
+    /// The label value: `"1"` or `"0"`, never `"true"`, because a Prometheus
+    /// query on a boolean label reads better against the digits and every
+    /// dashboard already writes them that way.
+    fn flag(value: bool) -> &'static str {
+        if value { "1" } else { "0" }
+    }
+}
+
 /// One request through the proxy listener, however it was answered: proxied,
 /// mocked, dropped or rejected.
-pub fn record_proxy(proxy: &str, method: &str, status: u16, elapsed: Duration) {
+pub fn record_proxy(proxy: &str, method: &str, status: u16, elapsed: Duration, outcome: Outcome) {
     metrics::histogram!(
         PROXY_DURATION,
         "proxy" => proxy.to_owned(),
         "method" => crate::method::method_label(method),
         "status" => status.to_string(),
+        "replace" => Outcome::flag(outcome.replace),
+        "loss" => Outcome::flag(outcome.loss),
+        "upstream_error" => Outcome::flag(outcome.upstream_error),
     )
     .record(elapsed.as_secs_f64());
 }
 
+/// One request to the admin listener, by route template rather than by path.
+///
+/// `route` is what the router matched -- `/api/v1/proxies/{name}`, not
+/// `/api/v1/proxies/alpha` -- so a hundred proxies are one series and a query
+/// string is none. That is the same cardinality rule the proxy metrics follow, and
+/// it is why this takes a template and not a `Uri`: the type is the rule.
+///
+/// A request that matched no route is recorded under `UNMATCHED`, so the total
+/// here is the total the listener answered.
+pub fn record_admin(method: &str, route: &str, status: u16, elapsed: Duration) {
+    metrics::histogram!(
+        ADMIN_DURATION,
+        "route" => route.to_owned(),
+        "method" => crate::method::method_label(method),
+        "status" => status.to_string(),
+    )
+    .record(elapsed.as_secs_f64());
+}
+
+/// When the proxy listener last answered with an error, and which error it was.
+///
+/// A timestamp rather than a counter because the question it answers is "is this
+/// still happening", and a gauge of seconds since the epoch answers that at any
+/// scrape interval: `time() - doppel_proxy_last_error_timestamp_seconds`. A
+/// counter answers "how many" and needs a rate window to say anything about now.
+pub fn record_proxy_error(code: &str) {
+    let now = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0.0, |since| since.as_secs_f64());
+    metrics::gauge!(LAST_ERROR, "code" => code.to_owned()).set(now);
+}
+
+/// The series that exists before anything goes wrong: `code=""`, value `0`.
+///
+/// Without it, a dashboard panel and an alert on this metric both read "no data"
+/// until the first error, which is indistinguishable from "the process is not
+/// being scraped". Zero says "no error yet" in a way a query can subtract.
+pub fn init_proxy_errors() {
+    metrics::gauge!(LAST_ERROR, "code" => "").set(0.0);
+}
+
+/// This binary, as a label: the info-metric pattern, value always `1`.
+///
+/// Version in a label rather than as a value, because a version is not a number
+/// -- `0.10.0` and `0.1.0` do not order as floats -- and because that is how every
+/// exporter publishes one, so `doppel_build_info` joins with the rest of a fleet's
+/// build panels without special-casing.
+pub fn describe_build(version: &str) {
+    metrics::gauge!(BUILD_INFO, "version" => version.to_owned()).set(1.0);
+}
+
+/// Whether this process serves the dashboard, in the same shape.
+///
+/// Separate from `doppel_build_info` on purpose: one describes the artifact and
+/// never changes, the other describes what this deployment turned on. Folding a
+/// configuration flag into build info makes two builds of one version look
+/// different.
+pub fn describe_dashboard(enabled: bool) {
+    metrics::gauge!(DASHBOARD_INFO, "enabled" => if enabled { "true" } else { "false" }).set(1.0);
+}
+
+/// The mock count of every proxy in the configuration now in effect.
+///
+/// Called on every runtime swap -- startup, a reload, a write through the admin
+/// API -- so what this reports is the configuration being served rather than the
+/// one the process started with. A proxy that has left the configuration is set to
+/// zero rather than abandoned at its last count: the exporter cannot drop a
+/// series, and a stale one reads as a proxy that still exists.
+pub fn record_proxy_mocks(counts: &[(&str, usize)]) {
+    let mut gauged = GAUGED_PROXIES
+        .lock()
+        .expect("the gauge set is not poisoned");
+    for (proxy, mocks) in counts {
+        #[allow(clippy::cast_precision_loss)]
+        metrics::gauge!(PROXY_MOCKS, "proxy" => (*proxy).to_owned()).set(*mocks as f64);
+        gauged.insert((*proxy).to_owned());
+    }
+
+    let present: BTreeSet<&str> = counts.iter().map(|(proxy, _)| *proxy).collect();
+    for gone in gauged
+        .iter()
+        .filter(|name| !present.contains(name.as_str()))
+    {
+        metrics::gauge!(PROXY_MOCKS, "proxy" => gone.clone()).set(0.0);
+    }
+}
+
 pub fn record_loss(proxy: &str) {
     metrics::counter!(LOSS_TOTAL, "proxy" => proxy.to_owned()).increment(1);
 }
@@ -165,7 +335,13 @@ mod tests {
         // production cardinality incident.
         let text = exposition(|| {
             record_upstream("alpha", "GET", 200, Duration::from_millis(1));
-            record_proxy("alpha", "GET", 200, Duration::from_millis(2));
+            record_proxy(
+                "alpha",
+                "GET",
+                200,
+                Duration::from_millis(2),
+                Outcome::proxied(),
+            );
             record_loss("alpha");
             record_latency_injected("alpha");
             record_mock_hit("alpha", "mock1");
@@ -180,7 +356,13 @@ mod tests {
     fn every_documented_metric_appears_once_recorded() {
         let text = exposition(|| {
             record_upstream("alpha", "GET", 200, Duration::from_millis(1));
-            record_proxy("alpha", "GET", 200, Duration::from_millis(2));
+            record_proxy(
+                "alpha",
+                "GET",
+                200,
+                Duration::from_millis(2),
+                Outcome::proxied(),
+            );
             record_loss("alpha");
             record_latency_injected("alpha");
             record_mock_hit("alpha", "mock1");
@@ -203,7 +385,13 @@ mod tests {
         // add a thousand series to the exposition.
         let text = exposition(|| {
             for i in 0..100 {
-                record_proxy("alpha", &format!("EVIL{i}"), 200, Duration::from_millis(1));
+                record_proxy(
+                    "alpha",
+                    &format!("EVIL{i}"),
+                    200,
+                    Duration::from_millis(1),
+                    Outcome::proxied(),
+                );
             }
         });
 
@@ -211,12 +399,188 @@ mod tests {
         assert!(!text.contains("EVIL"), "{text}");
     }
 
+    #[test]
+    fn how_a_request_was_answered_is_in_the_labels() {
+        let text = exposition(|| {
+            record_proxy(
+                "alpha",
+                "GET",
+                200,
+                Duration::from_millis(1),
+                Outcome::mocked(),
+            );
+        });
+
+        // Digits rather than `true`/`false`: a query reads better against them and
+        // every dashboard writes them that way.
+        assert!(text.contains(r#"replace="1""#), "{text}");
+        assert!(text.contains(r#"loss="0""#), "{text}");
+        assert!(text.contains(r#"upstream_error="0""#), "{text}");
+    }
+
+    #[test]
+    fn the_three_flags_are_independent() {
+        // Not an enum, because they are not exclusive: a mock can answer a request
+        // its own loss roll then drops.
+        let text = exposition(|| {
+            record_proxy(
+                "alpha",
+                "GET",
+                503,
+                Duration::from_millis(1),
+                Outcome {
+                    replace: true,
+                    loss: true,
+                    upstream_error: false,
+                },
+            );
+        });
+
+        assert!(
+            text.contains(r#"loss="1""#) && text.contains(r#"replace="1""#),
+            "{text}"
+        );
+    }
+
+    #[test]
+    fn the_proxy_ladder_reaches_a_minute_and_the_admin_ladder_stops_at_five_seconds() {
+        // A proxy is asked to be slow on purpose -- `latency` injection goes to
+        // whatever the configuration says -- so a 60-second bucket is a real
+        // measurement. Nothing on the admin listener has any business there.
+        let text = exposition(|| {
+            record_proxy(
+                "alpha",
+                "GET",
+                200,
+                Duration::from_secs(20),
+                Outcome::proxied(),
+            );
+            record_admin("GET", "/api/v1/proxies", 200, Duration::from_millis(3));
+        });
+
+        let proxy_series: String = text
+            .lines()
+            .filter(|line| line.starts_with(PROXY_DURATION))
+            .collect();
+        assert!(proxy_series.contains(r#"le="60""#), "{proxy_series}");
+        assert!(proxy_series.contains(r#"le="30"} 1"#), "{proxy_series}");
+        assert!(proxy_series.contains(r#"le="15"} 0"#), "{proxy_series}");
+
+        let admin_series: String = text
+            .lines()
+            .filter(|line| line.starts_with(ADMIN_DURATION))
+            .collect();
+        assert!(admin_series.contains(r#"le="5""#), "{admin_series}");
+        assert!(!admin_series.contains(r#"le="10""#), "{admin_series}");
+        assert!(!admin_series.contains(r#"le="60""#), "{admin_series}");
+    }
+
+    #[test]
+    fn an_admin_request_is_labelled_by_its_route_template() {
+        // The label is the template, so a hundred proxies are one series. A label
+        // built from the path would be one per name, plus one per query string.
+        let text = exposition(|| {
+            record_admin(
+                "GET",
+                "/api/v1/proxies/{name}",
+                200,
+                Duration::from_millis(1),
+            );
+            record_admin("GET", UNMATCHED, 404, Duration::from_millis(1));
+        });
+
+        assert!(text.contains(r#"route="/api/v1/proxies/{name}""#), "{text}");
+        assert!(text.contains(r#"route="""#), "{text}");
+        assert!(!text.contains("alpha"), "{text}");
+    }
+
+    #[test]
+    fn the_last_error_exists_before_anything_goes_wrong() {
+        let text = exposition(init_proxy_errors);
+
+        // Zero, with an empty code: "no error yet" in a form a query can subtract,
+        // rather than the no-data a never-recorded metric gives an alert.
+        assert!(text.contains(LAST_ERROR), "{text}");
+        assert!(text.contains(r#"code=""} 0"#), "{text}");
+    }
+
+    #[test]
+    fn an_error_stamps_the_time_under_its_code() {
+        let before = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("the clock is after 1970")
+            .as_secs_f64();
+        let text = exposition(|| {
+            init_proxy_errors();
+            record_proxy_error("UPSTREAM_TIMEOUT");
+        });
+
+        let stamped = text
+            .lines()
+            .find(|line| line.starts_with(LAST_ERROR) && line.contains("UPSTREAM_TIMEOUT"))
+            .unwrap_or_else(|| panic!("{text}"));
+        let value: f64 = stamped
+            .rsplit(' ')
+            .next()
+            .and_then(|value| value.parse().ok())
+            .unwrap_or_else(|| panic!("{stamped}"));
+        assert!(value >= before, "{stamped}");
+        // And the default series is still there, still zero: the codes do not
+        // replace each other.
+        assert!(text.contains(r#"code=""} 0"#), "{text}");
+    }
+
+    #[test]
+    fn the_build_and_the_dashboard_are_described_separately() {
+        let text = exposition(|| {
+            describe_build("1.2.3");
+            describe_dashboard(true);
+        });
+
+        // Value 1, facts in labels: the info-metric pattern, and the version is not
+        // a number -- `0.10.0` and `0.1.0` do not order as floats.
+        assert!(
+            text.contains(r#"doppel_build_info{version="1.2.3"} 1"#),
+            "{text}"
+        );
+        assert!(
+            text.contains(r#"doppel_dashboard_info{enabled="true"} 1"#),
+            "{text}"
+        );
+    }
+
+    #[test]
+    fn a_proxy_that_leaves_the_configuration_is_zeroed_rather_than_left_behind() {
+        // The exporter cannot delete a series, so a proxy that was removed would
+        // otherwise keep reporting its last mock count -- a proxy that does not
+        // exist, with three mocks, for as long as the process runs.
+        let text = exposition(|| {
+            record_proxy_mocks(&[("alpha", 3), ("beta", 0)]);
+            record_proxy_mocks(&[("beta", 1)]);
+        });
+
+        assert!(
+            text.contains(r#"doppel_proxy_mocks{proxy="alpha"} 0"#),
+            "{text}"
+        );
+        assert!(
+            text.contains(r#"doppel_proxy_mocks{proxy="beta"} 1"#),
+            "{text}"
+        );
+    }
+
     #[test]
     fn an_unresolved_request_is_counted_under_a_name_no_proxy_can_have() {
         // Rule V35 refuses an empty proxy name, which is what makes this
         // sentinel safe rather than a collision waiting to happen.
         let text = exposition(|| {
-            record_proxy(UNRESOLVED, "GET", 404, Duration::from_millis(1));
+            record_proxy(
+                UNRESOLVED,
+                "GET",
+                404,
+                Duration::from_millis(1),
+                Outcome::proxied(),
+            );
         });
 
         assert!(text.contains(r#"proxy="""#), "{text}");
diff --git a/crates/doppel-core/src/runtime.rs b/crates/doppel-core/src/runtime.rs
index 8d26dd0..9a4c8bf 100644
--- a/crates/doppel-core/src/runtime.rs
+++ b/crates/doppel-core/src/runtime.rs
@@ -28,6 +28,10 @@ pub struct CompiledProxy {
     /// point at Doppel. The `Option` in the configuration resolves to its
     /// default here, so the hot path never has to know what that default was.
     pub rewrite_redirects: bool,
+    /// Whether the upstream's own address is rewritten to Doppel's inside a
+    /// relayed body. The `Option` in the configuration resolves to its default
+    /// here, like `rewrite_redirects` above.
+    pub rewrite_urls: bool,
     pub resolve_header: Option<String>,
     /// Mocks in configuration order. Matching is first-wins, so this order
     /// is load-bearing, not incidental.
@@ -190,6 +194,7 @@ fn compile_proxy(proxy: &ProxyConfig) -> Result<CompiledProxy, Error> {
         latency: proxy.latency,
         replace: proxy.replace.map_or(1.0, crate::config::Ratio::get),
         rewrite_redirects: proxy.rewrite_redirects.unwrap_or(true),
+        rewrite_urls: proxy.rewrite_urls.unwrap_or(true),
         resolve_header: match proxy.resolve.kind {
             ResolveKind::Header => proxy
                 .resolve
@@ -281,6 +286,7 @@ pub struct RuntimeHolder(ArcSwap<Runtime>);
 impl RuntimeHolder {
     #[must_use]
     pub fn new(runtime: Runtime) -> Self {
+        publish_mock_counts(&runtime);
         Self(ArcSwap::from_pointee(runtime))
     }
 
@@ -290,10 +296,29 @@ impl RuntimeHolder {
     }
 
     pub fn store(&self, runtime: Runtime) {
+        // Before the swap, so that anything scraping between the two sees the
+        // counts of the configuration that is about to be in force rather than
+        // the one that just left. Either way the window is a few microseconds
+        // wide; this is the side of it that cannot report a proxy that is gone.
+        publish_mock_counts(&runtime);
         self.0.store(Arc::new(runtime));
     }
 }
 
+/// `doppel_proxy_mocks` for the configuration this runtime carries.
+///
+/// Here rather than at the call sites that build a runtime -- startup, reload, a
+/// write through the admin API -- because there are three of them and a metric
+/// that follows the configuration cannot afford to be forgotten at one.
+fn publish_mock_counts(runtime: &Runtime) {
+    let counts: Vec<(&str, usize)> = runtime
+        .proxies
+        .iter()
+        .map(|proxy| (proxy.name.as_str(), proxy.mocks.len()))
+        .collect();
+    crate::metrics::record_proxy_mocks(&counts);
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/doppel-core/src/store/file.rs b/crates/doppel-core/src/store/file.rs
index 8a6349b..0e1a21e 100644
--- a/crates/doppel-core/src/store/file.rs
+++ b/crates/doppel-core/src/store/file.rs
@@ -92,6 +92,38 @@ impl FileStore {
         }
     }
 
+    /// The rename that puts a saved configuration in place has failed.
+    ///
+    /// One cause is worth naming, because the operating system's own words for it
+    /// are true and useless: `EBUSY` here almost always means the configuration
+    /// *file* is a mount point. A container started with
+    /// `-v ./main.yaml:/etc/doppel/main.yaml` mounts the file itself, and nothing
+    /// can rename over a mount point -- so every read works, every save fails, and
+    /// the message says "Resource busy".
+    ///
+    /// Mounting the directory instead is the fix, and the message says so. The
+    /// alternative -- writing in place instead of renaming -- would trade this for
+    /// a configuration that can be read half-written, which is the one thing this
+    /// whole function is arranged to prevent.
+    fn replace_failed(path: &Path, source: std::io::Error) -> StoreError {
+        if source.kind() != std::io::ErrorKind::ResourceBusy {
+            return StoreError::Io {
+                path: path.to_path_buf(),
+                source,
+            };
+        }
+        StoreError::Io {
+            path: path.to_path_buf(),
+            source: std::io::Error::new(
+                std::io::ErrorKind::ResourceBusy,
+                "cannot be replaced because it is busy. A save writes a new file and \
+                 renames it over this path, and nothing can rename over a mount point -- \
+                 which is what a container gets from `-v ./main.yaml:/etc/doppel/main.yaml`. \
+                 Mount the directory instead: `-v ./config:/etc/doppel`",
+            ),
+        }
+    }
+
     /// Decode a directory entry's raw file name, treating anything that is
     /// not valid UTF-8 as foreign junk rather than something to report or
     /// compare under a mangled, `to_string_lossy`-produced stand-in.
@@ -210,10 +242,7 @@ impl ConfigStore for FileStore {
             .map_err(Self::io(temp.path()))?;
         temp.as_file().sync_all().map_err(Self::io(temp.path()))?;
         temp.persist(&self.config_path)
-            .map_err(|e| StoreError::Io {
-                path: self.config_path.clone(),
-                source: e.error,
-            })?;
+            .map_err(|e| Self::replace_failed(&self.config_path, e.error))?;
 
         // The rename itself is atomic and content is never at risk: a
         // concurrent reader always sees the complete old configuration or
@@ -283,6 +312,13 @@ impl ConfigStore for FileStore {
         std::fs::write(&path, bytes).map_err(Self::io(&path))
     }
 
+    async fn rename_templates(&self, from: &str, to: &str) -> Result<(), StoreError> {
+        // The directory *is* the storage here, so the rename is the whole
+        // operation -- and it is atomic, unlike the two steps the database store
+        // needs.
+        super::rename_template_dir(&self.proxy_dir(from)?, &self.proxy_dir(to)?)
+    }
+
     async fn delete_template(&self, proxy: &str, file: &str) -> Result<bool, StoreError> {
         let dir = self.proxy_dir(proxy)?;
         let file = sanitize(file)?;
@@ -381,6 +417,38 @@ proxies:
         (store, config_path)
     }
 
+    #[test]
+    fn a_busy_config_file_is_explained_rather_than_reported() {
+        // The failure a container hits on its first save when the *file* is the bind
+        // mount. `EBUSY` alone sends the reader looking for another process holding
+        // the file, which is not what is wrong.
+        let path = Path::new("/etc/doppel/main.yaml");
+        let busy = FileStore::replace_failed(path, std::io::Error::from_raw_os_error(16));
+
+        let message = busy.to_string();
+        assert!(message.contains("/etc/doppel/main.yaml"), "{message}");
+        assert!(
+            message.contains("mount the directory") || message.contains("Mount the directory"),
+            "{message}"
+        );
+        assert!(message.contains("rename"), "{message}");
+    }
+
+    #[test]
+    fn any_other_failure_to_replace_is_reported_as_it_came() {
+        // Only `EBUSY` gets the explanation. A full disk or a permission problem is
+        // its own thing, and burying it under advice about mounts would be worse
+        // than saying nothing.
+        let path = Path::new("/etc/doppel/main.yaml");
+        let denied = FileStore::replace_failed(
+            path,
+            std::io::Error::from(std::io::ErrorKind::PermissionDenied),
+        );
+        let message = denied.to_string();
+        assert!(message.contains("permission denied"), "{message}");
+        assert!(!message.contains("Mount the directory"), "{message}");
+    }
+
     #[tokio::test]
     async fn load_returns_a_validated_config() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/crates/doppel-core/src/store/mod.rs b/crates/doppel-core/src/store/mod.rs
index af6d14c..20f9c90 100644
--- a/crates/doppel-core/src/store/mod.rs
+++ b/crates/doppel-core/src/store/mod.rs
@@ -200,6 +200,18 @@ pub trait ConfigStore: Send + Sync {
     /// `keep` removes the proxy's storage entirely.
     async fn retain_templates(&self, proxy: &str, keep: &[String]) -> Result<(), StoreError>;
 
+    /// Move every template of `from` to `to`, because the proxy was renamed.
+    ///
+    /// A proxy's name is where its templates live -- a subdirectory for
+    /// `FileStore`, a column for the database -- so a rename that did not carry
+    /// them would leave every mock pointing at a file that is not there. There is
+    /// nothing to move for a proxy that has no templates, and that is not an
+    /// error.
+    ///
+    /// The caller has already written the renamed configuration: the write is what
+    /// authorises the move, the same order `retain_templates` is called in.
+    async fn rename_templates(&self, from: &str, to: &str) -> Result<(), StoreError>;
+
     /// Make every template this store holds available as a file under `dir`.
     ///
     /// The render path reads a template from the filesystem at request time,
@@ -215,6 +227,39 @@ pub trait ConfigStore: Send + Sync {
     }
 }
 
+/// Move a proxy's template directory, for the stores that keep one.
+///
+/// `FileStore` keeps its templates there and nowhere else; the database store
+/// mirrors its rows to the same layout, because the render path reads files. Both
+/// therefore have a directory to move when a proxy is renamed, and both want the
+/// same three answers: a missing source is nothing to do, an occupied destination is
+/// a bug in the caller rather than something to overwrite, and anything else is the
+/// filesystem's own error with the path that produced it.
+pub fn rename_template_dir(from: &std::path::Path, to: &std::path::Path) -> Result<(), StoreError> {
+    if !from.exists() {
+        return Ok(());
+    }
+    if to.exists() {
+        return Err(StoreError::Io {
+            path: to.to_path_buf(),
+            source: std::io::Error::new(
+                std::io::ErrorKind::AlreadyExists,
+                "templates for this name are already there; the configuration should                  have refused the rename before it got here",
+            ),
+        });
+    }
+    if let Some(parent) = to.parent() {
+        std::fs::create_dir_all(parent).map_err(|source| StoreError::Io {
+            path: parent.to_path_buf(),
+            source,
+        })?;
+    }
+    std::fs::rename(from, to).map_err(|source| StoreError::Io {
+        path: from.to_path_buf(),
+        source,
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -280,6 +325,7 @@ proxies:
             latency: None,
             replace: None,
             rewrite_redirects: None,
+            rewrite_urls: None,
             body_limit: ByteSize::parse(1024 * 1024).unwrap(),
             mocks: Vec::new(),
         }
diff --git a/crates/doppel-proxy/Cargo.toml b/crates/doppel-proxy/Cargo.toml
index 4cf59dc..a37d593 100644
--- a/crates/doppel-proxy/Cargo.toml
+++ b/crates/doppel-proxy/Cargo.toml
@@ -9,6 +9,7 @@ license.workspace = true
 doppel-core = { path = "../doppel-core" }
 doppel-render = { path = "../doppel-render" }
 axum.workspace = true
+bytes.workspace = true
 futures-util.workspace = true
 rand.workspace = true
 reqwest.workspace = true
diff --git a/crates/doppel-proxy/src/lib.rs b/crates/doppel-proxy/src/lib.rs
index 74cdf29..25f03d6 100644
--- a/crates/doppel-proxy/src/lib.rs
+++ b/crates/doppel-proxy/src/lib.rs
@@ -3,6 +3,7 @@
 pub mod fault;
 pub mod mock;
 pub mod resolve;
+pub mod rewrite;
 pub mod server;
 pub mod upstream;
 
diff --git a/crates/doppel-proxy/src/mock.rs b/crates/doppel-proxy/src/mock.rs
index 0561bd7..d8dacf8 100644
--- a/crates/doppel-proxy/src/mock.rs
+++ b/crates/doppel-proxy/src/mock.rs
@@ -183,6 +183,7 @@ mod tests {
             latency: None,
             replace: 1.0,
             rewrite_redirects: true,
+            rewrite_urls: false,
             resolve_header: None,
             mocks,
             body_limit: 1024 * 1024,
diff --git a/crates/doppel-proxy/src/rewrite.rs b/crates/doppel-proxy/src/rewrite.rs
new file mode 100644
index 0000000..4980712
--- /dev/null
+++ b/crates/doppel-proxy/src/rewrite.rs
@@ -0,0 +1,360 @@
+//! Rewriting the upstream's own address out of a relayed body.
+//!
+//! `rewrite_redirects` keeps a client inside Doppel when the upstream answers a
+//! redirect. This is the same problem one layer down: a page, a script or a JSON
+//! document that names `https://api.example.com/v2/` sends the client straight
+//! there on its next request, past every injected fault and every mock, with
+//! nothing logged and nothing failing. `nginx` has `sub_filter` for this.
+//!
+//! Three rules, and each is a decision worth reading before changing:
+//!
+//! - **Exact host only.** `https://cdn.api.example.com/` is a different host, is
+//!   not proxied by this proxy, and is left alone -- pointing it at Doppel would
+//!   break the page rather than keep it working. That falls out of matching on
+//!   `scheme://host` and then requiring the next character not to continue a
+//!   hostname, which is also what stops `https://api.example.com.evil.test/` from
+//!   being mangled into Doppel's address with a suffix.
+//! - **Text only, and only what the upstream did not compress.** A body Doppel
+//!   would have to decompress to search is relayed untouched, and so is one whose
+//!   content type is not text: an image cannot contain a URL that matters, and
+//!   buffering one to look is how a proxy runs out of memory.
+//! - **Bounded.** Rewriting needs the whole body, so it is buffered -- up to the
+//!   proxy's `body_limit`, the same ceiling that bounds a mock's request buffering.
+//!   A body that exceeds it is streamed on from where the buffering stopped,
+//!   untouched, rather than held in memory or truncated.
+
+use axum::body::Body;
+use axum::http::{HeaderMap, HeaderValue, header};
+use bytes::Bytes;
+use futures_util::{StreamExt, TryStreamExt};
+
+/// The content types worth searching for a URL.
+///
+/// A prefix list rather than a parser: the header may carry parameters
+/// (`text/html; charset=utf-8`), and only the type and subtype decide this.
+/// `+json` and `+xml` catch the structured suffixes -- `application/problem+json`,
+/// `image/svg+xml` -- which are text and do carry URLs.
+const TEXTUAL: &[&str] = &[
+    "text/",
+    "application/json",
+    "application/javascript",
+    "application/xml",
+    "application/xhtml+xml",
+    "application/x-javascript",
+    "application/graphql",
+    "application/ld+json",
+];
+
+/// Whether a body with these headers is one to rewrite.
+#[must_use]
+pub fn is_rewritable(headers: &HeaderMap) -> bool {
+    // A compressed body would have to be decompressed, rewritten and recompressed,
+    // and the client asked the upstream for that encoding. Relayed as it came.
+    if headers.contains_key(header::CONTENT_ENCODING) {
+        return false;
+    }
+
+    let Some(kind) = headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+    else {
+        // No content type: nothing says this is text, and guessing by sniffing the
+        // bytes is a second, worse rule to maintain.
+        return false;
+    };
+    let kind = kind.trim().to_ascii_lowercase();
+    TEXTUAL.iter().any(|prefix| kind.starts_with(prefix))
+        || kind.contains("+json")
+        || kind.contains("+xml")
+}
+
+/// The body, with the upstream's address replaced by Doppel's where it appears.
+///
+/// Returns the body to relay, and the new length when something was replaced. The
+/// caller needs the second half: a rewritten body is not the entity the upstream
+/// sent, so its length and its validators both have to be restated.
+pub async fn rewrite_body<S>(
+    stream: S,
+    base: &reqwest::Url,
+    external: &reqwest::Url,
+    limit: u64,
+) -> (Body, Option<usize>)
+where
+    S: futures_util::Stream<Item = reqwest::Result<Bytes>> + Send + Unpin + 'static,
+{
+    let mut stream = stream;
+    let mut buffered: Vec<u8> = Vec::new();
+    let cap = usize::try_from(limit).unwrap_or(usize::MAX);
+
+    while let Some(chunk) = stream.next().await {
+        let Ok(chunk) = chunk else {
+            // A failed read is the caller's problem to see, and the stream is the
+            // only thing that can report it: hand back what is left, errors and
+            // all, rather than swallowing it into a truncated 200.
+            let head = Bytes::from(buffered);
+            return (Body::from_stream(prepend(head, stream)), None);
+        };
+        buffered.extend_from_slice(&chunk);
+        if buffered.len() > cap {
+            // Too big to hold. What was read is sent on in front of the rest,
+            // untouched -- the alternative is buffering without a bound.
+            tracing::debug!(
+                bytes = buffered.len(),
+                limit,
+                "body over the limit; relayed without rewriting urls"
+            );
+            let head = Bytes::from(buffered);
+            return (Body::from_stream(prepend(head, stream)), None);
+        }
+    }
+
+    let text = match String::from_utf8(buffered) {
+        Ok(text) => text,
+        // Declared as text and not valid UTF-8. The bytes are already buffered, so
+        // they go out exactly as they came: re-encoding somebody else's body is not
+        // this proxy's business, and dropping it would be worse.
+        Err(not_text) => return (Body::from(not_text.into_bytes()), None),
+    };
+
+    let (rewritten, changed) = replace_addresses(&text, base, external);
+    let length = rewritten.len();
+    (Body::from(rewritten), changed.then_some(length))
+}
+
+/// Put `head` back in front of `rest`.
+fn prepend<S>(head: Bytes, rest: S) -> impl futures_util::Stream<Item = reqwest::Result<Bytes>>
+where
+    S: futures_util::Stream<Item = reqwest::Result<Bytes>>,
+{
+    futures_util::stream::once(async move { Ok(head) }).chain(rest.into_stream())
+}
+
+/// `text` with the upstream's base and origin replaced by Doppel's.
+///
+/// The base goes first and the origin second, so a URL under the proxied path
+/// loses that prefix -- `https://api.example.com/v2/orders` becomes
+/// `http://doppel/orders`, which is where Doppel actually serves it -- while a URL
+/// on the same host outside that path keeps its own, the way a rewritten redirect
+/// does.
+fn replace_addresses(text: &str, base: &reqwest::Url, external: &reqwest::Url) -> (String, bool) {
+    let to = external.as_str().trim_end_matches('/').to_owned();
+
+    let (text, base_changed) = replace_at_boundary(text, base.as_str(), &format!("{to}/"));
+    let origin = origin_of(base);
+    let (text, origin_changed) = replace_at_boundary(&text, &origin, &to);
+    (text, base_changed || origin_changed)
+}
+
+/// `scheme://host[:port]` of a URL, which is what a body writes when it names a
+/// host without a path.
+fn origin_of(url: &reqwest::Url) -> String {
+    let mut origin = format!("{}://{}", url.scheme(), url.host_str().unwrap_or_default());
+    if let Some(port) = url.port() {
+        origin.push(':');
+        origin.push_str(&port.to_string());
+    }
+    origin
+}
+
+/// Every occurrence of `needle` that is not the beginning of a longer hostname,
+/// replaced by `replacement`.
+///
+/// The boundary check is the whole point. `https://api.example.com` is a prefix of
+/// `https://api.example.com.evil.test`, and a plain string replacement would turn
+/// that into Doppel's address with somebody else's suffix glued on. A character
+/// that could continue a hostname -- a letter, a digit, a dot or a hyphen -- means
+/// this is a different host, and it is left alone.
+fn replace_at_boundary(text: &str, needle: &str, replacement: &str) -> (String, bool) {
+    if needle.is_empty() {
+        return (text.to_owned(), false);
+    }
+
+    let mut out = String::with_capacity(text.len());
+    let mut rest = text;
+    let mut changed = false;
+    while let Some(at) = rest.find(needle) {
+        let after = &rest[at + needle.len()..];
+        let continues_hostname = after
+            .chars()
+            .next()
+            .is_some_and(|next| next.is_ascii_alphanumeric() || next == '.' || next == '-');
+        out.push_str(&rest[..at]);
+        if continues_hostname && !needle.ends_with('/') {
+            out.push_str(needle);
+        } else {
+            out.push_str(replacement);
+            changed = true;
+        }
+        rest = after;
+    }
+    out.push_str(rest);
+    (out, changed)
+}
+
+/// Drop what a rewritten body invalidates, and state its new length.
+///
+/// The bytes are no longer the ones the upstream hashed, so `ETag` and the digest
+/// headers are claims about an entity that no longer exists -- a conditional
+/// request carrying that validator would be answered `304` for content the client
+/// has never seen. `Content-Length` is the other half: it described the body
+/// before the substitution.
+pub fn restate_body_headers(headers: &mut HeaderMap, length: usize) {
+    headers.remove(header::ETAG);
+    headers.remove("content-md5");
+    headers.remove("digest");
+    headers.remove("repr-digest");
+    if let Ok(value) = HeaderValue::from_str(&length.to_string()) {
+        headers.insert(header::CONTENT_LENGTH, value);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn url(text: &str) -> reqwest::Url {
+        reqwest::Url::parse(text).expect("a test url parses")
+    }
+
+    #[test]
+    fn a_url_under_the_proxied_path_loses_that_path() {
+        // `/v2/orders` upstream is `/orders` through Doppel, which is what
+        // `join_upstream` does in the other direction.
+        let (out, changed) = replace_addresses(
+            r#"{"next":"https://api.example.com/v2/orders?page=2"}"#,
+            &url("https://api.example.com/v2/"),
+            &url("http://127.0.0.1:8080/"),
+        );
+
+        assert!(changed);
+        assert_eq!(out, r#"{"next":"http://127.0.0.1:8080/orders?page=2"}"#);
+    }
+
+    #[test]
+    fn a_url_on_the_same_host_outside_the_path_keeps_its_own() {
+        let (out, changed) = replace_addresses(
+            r#"<a href="https://api.example.com/login">in</a>"#,
+            &url("https://api.example.com/v2/"),
+            &url("http://127.0.0.1:8080/"),
+        );
+
+        assert!(changed);
+        assert_eq!(out, r#"<a href="http://127.0.0.1:8080/login">in</a>"#);
+    }
+
+    #[test]
+    fn a_subdomain_is_a_different_host_and_is_left_alone() {
+        let (out, changed) = replace_addresses(
+            r#"<img src="https://cdn.api.example.com/logo.png">"#,
+            &url("https://api.example.com/"),
+            &url("http://127.0.0.1:8080/"),
+        );
+
+        assert!(!changed, "{out}");
+        assert!(out.contains("cdn.api.example.com"), "{out}");
+    }
+
+    #[test]
+    fn a_host_that_merely_starts_the_same_is_not_rewritten() {
+        // The one that would be a security bug rather than a cosmetic one: a plain
+        // string replacement turns this into Doppel's address with `.evil.test`
+        // glued on the end, which is a URL pointing somewhere nobody named.
+        let (out, changed) = replace_addresses(
+            r#"<a href="https://api.example.com.evil.test/x">out</a>"#,
+            &url("https://api.example.com/"),
+            &url("http://127.0.0.1:8080/"),
+        );
+
+        assert!(!changed, "{out}");
+        assert_eq!(
+            out,
+            r#"<a href="https://api.example.com.evil.test/x">out</a>"#
+        );
+    }
+
+    #[test]
+    fn a_port_is_part_of_the_host_it_matches() {
+        let (out, changed) = replace_addresses(
+            "see http://127.0.0.1:9000/thing",
+            &url("http://127.0.0.1:9000/"),
+            &url("https://doppel.example.com/"),
+        );
+
+        assert!(changed);
+        assert_eq!(out, "see https://doppel.example.com/thing");
+        // And a different port on the same address is a different upstream.
+        let (out, changed) = replace_addresses(
+            "see http://127.0.0.1:9001/thing",
+            &url("http://127.0.0.1:9000/"),
+            &url("https://doppel.example.com/"),
+        );
+        assert!(!changed, "{out}");
+    }
+
+    #[test]
+    fn doppels_own_path_prefix_survives() {
+        let (out, changed) = replace_addresses(
+            "https://api.example.com/v2/orders",
+            &url("https://api.example.com/v2/"),
+            &url("https://gw.example.com/doppel/"),
+        );
+
+        assert!(changed);
+        assert_eq!(out, "https://gw.example.com/doppel/orders");
+    }
+
+    #[test]
+    fn a_body_with_nothing_to_replace_is_unchanged() {
+        let (out, changed) = replace_addresses(
+            "<p>no urls here</p>",
+            &url("https://api.example.com/"),
+            &url("http://127.0.0.1:8080/"),
+        );
+
+        assert!(!changed);
+        assert_eq!(out, "<p>no urls here</p>");
+    }
+
+    #[test]
+    fn only_text_and_only_uncompressed() {
+        let textual = |value: &str| {
+            let mut headers = HeaderMap::new();
+            headers.insert(header::CONTENT_TYPE, HeaderValue::from_str(value).unwrap());
+            is_rewritable(&headers)
+        };
+
+        assert!(textual("text/html; charset=utf-8"));
+        assert!(textual("application/json"));
+        assert!(textual("application/problem+json"));
+        assert!(textual("image/svg+xml"));
+        assert!(textual("TEXT/CSS"));
+        assert!(!textual("image/png"));
+        assert!(!textual("application/octet-stream"));
+        assert!(!textual("font/woff2"));
+
+        // No content type at all: nothing says this is text.
+        assert!(!is_rewritable(&HeaderMap::new()));
+
+        // Compressed, and the client asked the upstream for that encoding.
+        let mut gzipped = HeaderMap::new();
+        gzipped.insert(header::CONTENT_TYPE, HeaderValue::from_static("text/html"));
+        gzipped.insert(header::CONTENT_ENCODING, HeaderValue::from_static("gzip"));
+        assert!(!is_rewritable(&gzipped));
+    }
+
+    #[test]
+    fn a_rewritten_body_loses_the_validators_it_invalidated() {
+        let mut headers = HeaderMap::new();
+        headers.insert(header::ETAG, HeaderValue::from_static("\"abc\""));
+        headers.insert(header::CONTENT_LENGTH, HeaderValue::from_static("11"));
+        headers.insert("digest", HeaderValue::from_static("sha-256=..."));
+
+        restate_body_headers(&mut headers, 42);
+
+        // A conditional request carrying the upstream's ETag would otherwise be
+        // answered 304 for content the client has never seen.
+        assert!(!headers.contains_key(header::ETAG));
+        assert!(!headers.contains_key("digest"));
+        assert_eq!(headers.get(header::CONTENT_LENGTH).unwrap(), "42");
+    }
+}
diff --git a/crates/doppel-proxy/src/server.rs b/crates/doppel-proxy/src/server.rs
index 872e91d..4805dfb 100644
--- a/crates/doppel-proxy/src/server.rs
+++ b/crates/doppel-proxy/src/server.rs
@@ -21,6 +21,15 @@ use crate::upstream::{error_response, forward};
 pub struct ProxyState {
     pub holder: Arc<RuntimeHolder>,
     pub sampler: Arc<dyn Sampler>,
+    /// Where clients reach this Doppel, from `server.external_url` or
+    /// `DOPPEL_EXTERNAL_URL`, when the deployment says.
+    ///
+    /// Resolved once at startup rather than read from the running configuration,
+    /// like the rest of `server`: the listeners are bound before the first
+    /// reload, and a reload that changes that section reports it as unapplied.
+    /// Behind an `Arc` because this struct is cloned per request and a `Url` is
+    /// a `String` behind the scenes.
+    pub external_url: Option<Arc<reqwest::Url>>,
 }
 
 impl ProxyState {
@@ -29,8 +38,16 @@ impl ProxyState {
         Self {
             holder,
             sampler: Arc::new(OsSampler),
+            external_url: None,
         }
     }
+
+    /// The same state, told where clients reach this Doppel.
+    #[must_use]
+    pub fn with_external_url(mut self, external: Option<reqwest::Url>) -> Self {
+        self.external_url = external.map(Arc::new);
+        self
+    }
 }
 
 /// Every method and every path go to one handler: this is a proxy, not an app.
@@ -85,7 +102,9 @@ async fn handle(
                 method.as_str(),
                 response.status().as_u16(),
                 elapsed,
+                metrics::Outcome::proxied(),
             );
+            metrics::record_proxy_error(err.code.as_str());
             // `upstream_contacted` is a bool, not an `Option`-typed null: the
             // `tracing::Value` impl for `Option<T>` records nothing at all
             // when the value is `None`, so the JSON layer omits a null field
@@ -178,7 +197,17 @@ async fn handle(
                 // mocks that answered. The mock is named in the log line
                 // instead, which is where "whose loss fired" belongs.
                 metrics::record_loss(&proxy.name);
-                metrics::record_proxy(&proxy.name, method.as_str(), status, elapsed);
+                metrics::record_proxy(
+                    &proxy.name,
+                    method.as_str(),
+                    status,
+                    elapsed,
+                    metrics::Outcome {
+                        replace: true,
+                        loss: true,
+                        upstream_error: false,
+                    },
+                );
                 tracing::info!(
                     request_id,
                     proxy = proxy.name,
@@ -216,7 +245,11 @@ async fn handle(
                 method.as_str(),
                 response.status().as_u16(),
                 elapsed,
+                metrics::Outcome::mocked(),
             );
+            if let Some(code) = error_code {
+                metrics::record_proxy_error(code);
+            }
             // `upstream_contacted` is false here and the two upstream fields
             // are absent: a served mock never reaches the upstream, which is
             // precisely the distinction that field exists to record.
@@ -254,7 +287,13 @@ async fn handle(
         );
         let elapsed = started.elapsed();
         metrics::record_loss(&proxy.name);
-        metrics::record_proxy(&proxy.name, method.as_str(), status, elapsed);
+        metrics::record_proxy(
+            &proxy.name,
+            method.as_str(),
+            status,
+            elapsed,
+            metrics::Outcome::lost(),
+        );
         tracing::info!(
             request_id,
             proxy = proxy.name,
@@ -290,6 +329,7 @@ async fn handle(
         Some(peer.ip()),
         &runtime.resolve_headers,
         &request_id,
+        state.external_url.as_deref(),
     )
     .await;
     let latency_ms = pad_to_target(faults.latency, attempt.elapsed(), &proxy.name).await;
@@ -308,6 +348,13 @@ async fn handle(
                 method.as_str(),
                 response.status().as_u16(),
                 elapsed,
+                metrics::Outcome {
+                    // The upstream answered; whether it answered usefully is its
+                    // status. A 5xx relayed from upstream is an upstream error
+                    // even though the exchange itself succeeded.
+                    upstream_error: outcome.status >= 500,
+                    ..metrics::Outcome::proxied()
+                },
             );
             tracing::info!(
                 request_id,
@@ -336,7 +383,16 @@ async fn handle(
                 method.as_str(),
                 response.status().as_u16(),
                 elapsed,
+                metrics::Outcome {
+                    // A transport failure, a timeout, or a request refused on the
+                    // way in. The last one never reached the upstream, and is
+                    // still an upstream error in the only sense a dashboard cares
+                    // about: this proxy could not deliver.
+                    upstream_error: true,
+                    ..metrics::Outcome::proxied()
+                },
             );
+            metrics::record_proxy_error(err.code.as_str());
             // `forward` validates the request path before it ever opens a
             // connection (see `join_upstream`), so a 4xx here (always
             // `InvalidRequestPath` today) means the request was rejected on
@@ -599,6 +655,7 @@ proxies:
         ProxyState {
             holder: Arc::new(RuntimeHolder::new(runtime)),
             sampler: Arc::new(crate::fault::SequenceSampler::new(samples)),
+            external_url: None,
         }
     }
 
diff --git a/crates/doppel-proxy/src/upstream.rs b/crates/doppel-proxy/src/upstream.rs
index ecfc878..10f0336 100644
--- a/crates/doppel-proxy/src/upstream.rs
+++ b/crates/doppel-proxy/src/upstream.rs
@@ -147,6 +147,9 @@ pub async fn forward(
     peer: Option<IpAddr>,
     resolve_headers: &[String],
     request_id: &str,
+    // Doppel's own address, when the deployment knows it. Only redirect
+    // rewriting reads it -- see `rewritten_location`.
+    external: Option<&reqwest::Url>,
 ) -> Result<(Response, UpstreamOutcome), Error> {
     let (parts, body) = request.into_parts();
     let url = join_upstream(&proxy.base_url, parts.uri.path(), parts.uri.query())?;
@@ -211,11 +214,28 @@ pub async fn forward(
     let status = response.status();
     let mut relayed = sanitize_headers(response.headers());
     if proxy.rewrite_redirects
-        && let Some(rewritten) = rewritten_location(&relayed, &url, &proxy.base_url)
+        && let Some(rewritten) = rewritten_location(&relayed, &url, &proxy.base_url, external)
     {
         relayed.insert("location", rewritten);
     }
-    let stream = response.bytes_stream();
+    // The body, and the length it has if the upstream's own address had to come out
+    // of it. See `crate::rewrite`: text only, uncompressed only, bounded by
+    // `body_limit`, and the exact host only.
+    let (body, rewritten_length) = match external {
+        Some(external) if proxy.rewrite_urls && crate::rewrite::is_rewritable(&relayed) => {
+            crate::rewrite::rewrite_body(
+                response.bytes_stream(),
+                &proxy.base_url,
+                external,
+                proxy.body_limit,
+            )
+            .await
+        }
+        _ => (Body::from_stream(response.bytes_stream()), None),
+    };
+    if let Some(length) = rewritten_length {
+        crate::rewrite::restate_body_headers(&mut relayed, length);
+    }
 
     let mut builder = Response::builder().status(status);
     if let Some(headers) = builder.headers_mut() {
@@ -227,7 +247,7 @@ pub async fn forward(
             headers.insert("x-request-id", value);
         }
     }
-    let response = builder.body(Body::from_stream(stream)).map_err(|e| {
+    let response = builder.body(body).map_err(|e| {
         Error::new(
             ErrorCode::UpstreamError,
             format!("cannot relay response: {e}"),
@@ -300,19 +320,27 @@ fn apply_forwarded_for(target: &mut HeaderMap, original: &HeaderMap, peer: Optio
 /// default, because forgetting it is so easy.
 ///
 /// The value is resolved against the URL that was actually requested upstream,
-/// which is what the upstream meant by it, and then judged:
+/// which is what the upstream meant by it, and then judged against the proxy's
+/// base and against `external`, Doppel's own address when one is configured:
 ///
-/// - Under `base` -- same origin, and a path below its path prefix -- it is
-///   returned as a root-relative path plus query and fragment. Relative rather
-///   than absolute so Doppel never has to guess its own public name: a client
-///   resolves it against the URL it used, which is Doppel's. RFC 9110 has
-///   allowed a relative `Location` since 7231 superseded 2616.
-/// - Anywhere else it is returned in absolute form. That target is genuinely
-///   elsewhere and rewriting it would be a lie, but stating it absolutely
-///   removes a second, quieter bug: a root-relative `Location` meant against the
-///   upstream's root (`/login` under a base of `/api/v1/`) would otherwise be
-///   re-resolved against Doppel and forwarded back as `/api/v1/login`, which is
-///   a different resource nobody asked for.
+/// - **Under `base`** -- same origin, and a path below its path prefix. With no
+///   `external`, a root-relative path plus query and fragment, so Doppel never
+///   has to guess its own public name: a client resolves it against the URL it
+///   used. RFC 9110 has allowed a relative `Location` since 7231 superseded
+///   2616. With `external`, the same tail against that address, absolutely.
+/// - **Same origin, outside `base`** -- `/login` under a base of `/api/v1/`.
+///   Without `external` this is relayed absolutely, pointing at the upstream:
+///   a root-relative form would be re-resolved against Doppel and forwarded
+///   back as `/api/v1/login`, a resource nobody asked for, and there is no host
+///   to name instead. With `external` the client is kept on Doppel --
+///   `https://doppel.example.com/login` -- because a client that leaves is a
+///   client past every fault and mock, which is the whole point of the rewrite.
+///   The path is kept as the upstream wrote it, which is what `nginx`'s
+///   `proxy_redirect` does; whether Doppel serves that path is a question about
+///   the configuration, and one the operator can see.
+/// - **Anywhere else** -- another host entirely, and left alone in every case.
+///   Doppel has no route to it, and naming itself in a redirect to somewhere it
+///   does not proxy would be a lie.
 ///
 /// Not covered: `Content-Location` names where a payload lives rather than where
 /// to go next, `Refresh` is not a standard header, and `Set-Cookie`'s `Domain`
@@ -321,34 +349,30 @@ fn rewritten_location(
     relayed: &HeaderMap,
     requested: &reqwest::Url,
     base: &reqwest::Url,
+    external: Option<&reqwest::Url>,
 ) -> Option<HeaderValue> {
     let location = relayed.get("location")?.to_str().ok()?;
     let resolved = requested.join(location).ok()?;
 
     let base_path = base.path();
-    let under_base = resolved.origin() == base.origin()
+    let same_origin = resolved.origin() == base.origin();
+    let under_base = same_origin
         && resolved.path().starts_with(base_path)
         // A base path is a directory prefix, so `/api/v1x` must not count as
         // being under `/api/v1/`. `join_upstream` treats the base the same way.
         && (base_path.ends_with('/') || resolved.path().len() == base_path.len());
 
     let value = if under_base {
-        let mut tail = String::from("/");
-        tail.push_str(
-            resolved
-                .path()
-                .trim_start_matches(base_path)
-                .trim_start_matches('/'),
-        );
-        if let Some(query) = resolved.query() {
-            tail.push('?');
-            tail.push_str(query);
+        let tail = tail_after(&resolved, base_path);
+        match external {
+            Some(external) => under(external, &tail),
+            None => format!("/{tail}"),
         }
-        if let Some(fragment) = resolved.fragment() {
-            tail.push('#');
-            tail.push_str(fragment);
+    } else if same_origin {
+        match external {
+            Some(external) => under(external, &tail_after(&resolved, "/")),
+            None => resolved.to_string(),
         }
-        tail
     } else {
         resolved.to_string()
     };
@@ -361,6 +385,38 @@ fn rewritten_location(
     HeaderValue::from_str(&value).ok()
 }
 
+/// The part of `url` after `prefix`, with its query and fragment, and no
+/// leading slash.
+fn tail_after(url: &reqwest::Url, prefix: &str) -> String {
+    let mut tail = url
+        .path()
+        .trim_start_matches(prefix)
+        .trim_start_matches('/')
+        .to_owned();
+    if let Some(query) = url.query() {
+        tail.push('?');
+        tail.push_str(query);
+    }
+    if let Some(fragment) = url.fragment() {
+        tail.push('#');
+        tail.push_str(fragment);
+    }
+    tail
+}
+
+/// `tail` under `external`, keeping any path `external` itself carries -- a
+/// Doppel reached at `https://gw.example.com/doppel/` is reached there in a
+/// rewritten `Location` too.
+///
+/// Built by hand rather than with `Url::join`, which reads a leading slash as
+/// "from the root" and would drop that prefix.
+fn under(external: &reqwest::Url, tail: &str) -> String {
+    let mut out = external.as_str().trim_end_matches('/').to_owned();
+    out.push('/');
+    out.push_str(tail);
+    out
+}
+
 /// Records what the client asked for, since `Host` is not relayed: without
 /// these the upstream cannot tell a request through Doppel from a direct one,
 /// and cannot build a URL that points back here.
@@ -765,6 +821,7 @@ mod tests {
             latency: None,
             replace: 1.0,
             rewrite_redirects: true,
+            rewrite_urls: false,
             resolve_header: None,
             mocks: Vec::new(),
             body_limit: 1024 * 1024,
@@ -818,7 +875,27 @@ mod tests {
         request: axum::extract::Request,
         peer: Option<IpAddr>,
     ) -> Result<(Response, UpstreamOutcome), Error> {
-        forward(client, proxy, request, peer, &[], TEST_REQUEST_ID).await
+        forward(client, proxy, request, peer, &[], TEST_REQUEST_ID, None).await
+    }
+
+    /// `fwd` for the tests that are about `server.external_url`.
+    async fn fwd_external(
+        client: &reqwest::Client,
+        proxy: &doppel_core::CompiledProxy,
+        request: axum::extract::Request,
+        external: &str,
+    ) -> Result<(Response, UpstreamOutcome), Error> {
+        let external = reqwest::Url::parse(external).expect("a test url parses");
+        forward(
+            client,
+            proxy,
+            request,
+            None,
+            &[],
+            TEST_REQUEST_ID,
+            Some(&external),
+        )
+        .await
     }
 
     #[tokio::test]
@@ -1186,6 +1263,137 @@ mod tests {
         );
     }
 
+    /// With an external url, the same redirect names Doppel outright.
+    ///
+    /// This is what a deployment behind a port mapping or an ingress needs: the
+    /// relative form is correct but only a client that resolves it against the
+    /// URL it used benefits, and anything logging or storing the `Location` --
+    /// a test report, a browser's history, a client that just prints it -- gets
+    /// a path with no host in it.
+    #[tokio::test]
+    async fn an_external_url_puts_doppels_own_host_in_the_location() {
+        let base = upstream().await;
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .unwrap();
+
+        let (response, _) = fwd_external(
+            &client,
+            &proxy(&base),
+            request(Method::GET, "/redirect/self"),
+            "https://doppel.example.com/",
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            location_of(response).await,
+            "https://doppel.example.com/moved?keep=1#frag"
+        );
+    }
+
+    /// The case the relative form cannot express, and the reason this setting
+    /// exists: the upstream sends the client to its own host *outside* the
+    /// proxied path. Without an external url that is relayed as the upstream's
+    /// own absolute URL and the client leaves Doppel -- past every fault and
+    /// every mock. With one, the client stays.
+    #[tokio::test]
+    async fn a_redirect_outside_the_base_is_kept_on_doppel_when_it_has_a_name() {
+        let base = upstream().await;
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .unwrap();
+
+        let mut with_prefix = proxy(&base);
+        with_prefix.base_url = url(&format!("{base}redirect/"));
+
+        let (response, _) = fwd_external(
+            &client,
+            &with_prefix,
+            request(Method::GET, "/rooted"),
+            "https://doppel.example.com/",
+        )
+        .await
+        .unwrap();
+        // The upstream said `/moved` against its own root. The path is kept as
+        // the upstream wrote it, which is what nginx's `proxy_redirect` does.
+        assert_eq!(
+            location_of(response).await,
+            "https://doppel.example.com/moved"
+        );
+    }
+
+    /// A Doppel reached under a path prefix keeps it. `Url::join` would not:
+    /// a leading slash reads as "from the root" and drops the prefix.
+    #[tokio::test]
+    async fn an_external_url_with_a_path_keeps_that_path() {
+        let base = upstream().await;
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .unwrap();
+
+        let (response, _) = fwd_external(
+            &client,
+            &proxy(&base),
+            request(Method::GET, "/redirect/self"),
+            "https://gw.example.com/doppel/",
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            location_of(response).await,
+            "https://gw.example.com/doppel/moved?keep=1#frag"
+        );
+    }
+
+    /// Another host stays another host, external url or not. Doppel does not
+    /// proxy `example.invalid` and saying otherwise would send the client to
+    /// itself for something it cannot serve.
+    #[tokio::test]
+    async fn a_foreign_host_is_left_alone_even_with_an_external_url() {
+        let base = upstream().await;
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .unwrap();
+
+        let (response, _) = fwd_external(
+            &client,
+            &proxy(&base),
+            request(Method::GET, "/redirect"),
+            "https://doppel.example.com/",
+        )
+        .await
+        .unwrap();
+        assert_eq!(location_of(response).await, "http://example.invalid/target");
+    }
+
+    /// `rewrite_redirects: false` still means no rewriting at all.
+    #[tokio::test]
+    async fn an_external_url_does_not_override_rewrite_redirects_false() {
+        let base = upstream().await;
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .build()
+            .unwrap();
+
+        let (response, _) = fwd_external(
+            &client,
+            &proxy_relaying_redirects(&base),
+            request(Method::GET, "/redirect/self"),
+            "https://doppel.example.com/",
+        )
+        .await
+        .unwrap();
+        let location = location_of(response).await;
+        assert!(
+            location.starts_with("http://127.0.0.1:"),
+            "expected the upstream's own authority, got {location}"
+        );
+    }
+
     /// A `Location` relative to the current path resolves inside the base, so it
     /// comes back relative -- and correctly, which relaying would not have been:
     /// the upstream meant `sibling` next to `/redirect/relative`.
@@ -1313,6 +1521,7 @@ mod tests {
             None,
             &resolve_headers,
             TEST_REQUEST_ID,
+            None,
         )
         .await
         .unwrap();
@@ -1339,6 +1548,7 @@ mod tests {
             None,
             &[],
             "caller-chosen-id",
+            None,
         )
         .await
         .unwrap();
@@ -1362,6 +1572,7 @@ mod tests {
             None,
             &[],
             "caller-chosen-id",
+            None,
         )
         .await
         .unwrap();
diff --git a/crates/doppel-store-postgres/migrations/0005_settings_as_jsonb.sql b/crates/doppel-store-postgres/migrations/0005_settings_as_jsonb.sql
new file mode 100644
index 0000000..d2ee4ac
--- /dev/null
+++ b/crates/doppel-store-postgres/migrations/0005_settings_as_jsonb.sql
@@ -0,0 +1,218 @@
+-- Store the configuration as JSON instead of a column per field.
+--
+-- Why: 0002, 0003 and 0004 each added one column and nothing else. Their whole
+-- content was `ADD COLUMN`, plus a matching edit in load.rs, in save.rs, and in
+-- two hand-written statements a test existed solely to keep in step. Nothing
+-- ever queried `admin_host` or `latency_min` in SQL. A column per field bought
+-- nothing and charged a migration for every field the configuration format
+-- gained.
+--
+-- What stays a column is what SQL uses: `name` and `revision` for the
+-- compare-and-swap, `ordinal` for proxy order, `config` for the foreign key.
+--
+-- The backfill below has one job, and it is not cosmetic: the revision of a
+-- stored configuration is a hash of its canonical YAML, and every write
+-- compare-and-swaps against it. If the JSON these statements build parsed back
+-- into a configuration that differed in any way from the one the old columns
+-- described, the revision would change, and the next write from a client holding
+-- the old revision would be refused as a conflict that never happened. So the
+-- reconstruction has to be exact, including the difference between a key that is
+-- absent and one that is present and null -- `jsonb_strip_nulls` is what removes
+-- the latter, and the sections that are wholly optional (`sentry`, `loss`,
+-- `latency`) are built conditionally rather than stripped, because an empty
+-- object is not the same as a missing one for a struct with required fields.
+--
+-- One property is given up here: the unique index on (config, token) that made
+-- duplicate token values impossible at the database level. Rule V26 refuses them
+-- while the document is validated, which every write goes through, so the
+-- guarantee moves rather than disappears.
+
+-- ---------------------------------------------------------------------------
+-- configurations
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE configurations ADD COLUMN settings JSONB;
+
+UPDATE configurations c
+SET settings = jsonb_strip_nulls(
+        jsonb_build_object(
+            'server', jsonb_build_object(
+                'host', c.server_host,
+                'port', c.server_port
+            ),
+            'logging', jsonb_build_object(
+                'level', c.log_level,
+                'format', c.log_format
+            ),
+            'control', jsonb_build_object('socket', c.control_socket),
+            'templates', jsonb_build_object('dir', c.templates_dir),
+            'admin', jsonb_strip_nulls(
+                jsonb_build_object(
+                    'enable', c.admin_enable,
+                    'host', c.admin_host,
+                    'port', c.admin_port,
+                    'auth', jsonb_build_object('header', c.admin_auth_header),
+                    'upload', jsonb_build_object('limit', c.admin_upload_limit),
+                    'access', c.admin_access,
+                    'public', c.admin_public,
+                    'groups', c.admin_groups
+                )
+            ) || jsonb_build_object(
+                -- Built separately because `||` is how a key is added to an
+                -- already-stripped object without stripping this one: an empty
+                -- token list must survive as `[]`.
+                'tokens', COALESCE(
+                    (
+                        SELECT jsonb_agg(
+                                   jsonb_build_object(
+                                       'name', t.name,
+                                       'group', t."group",
+                                       'token', t.token
+                                   )
+                                   ORDER BY t.ordinal
+                               )
+                        FROM admin_tokens t
+                        WHERE t.config = c.name
+                    ),
+                    '[]'::jsonb
+                )
+            )
+        )
+        -- `sentry` is an optional section with a required `dsn`, so it is either
+        -- a whole object or absent. Stripping nulls from `{"dsn": null}` would
+        -- leave `{}`, which fails to parse.
+        || CASE
+               WHEN c.sentry_dsn IS NULL THEN '{}'::jsonb
+               ELSE jsonb_build_object('sentry', jsonb_build_object('dsn', c.sentry_dsn))
+           END
+    );
+
+ALTER TABLE configurations ALTER COLUMN settings SET NOT NULL;
+
+ALTER TABLE configurations
+    DROP COLUMN server_host,
+    DROP COLUMN server_port,
+    DROP COLUMN log_level,
+    DROP COLUMN log_format,
+    DROP COLUMN control_socket,
+    DROP COLUMN templates_dir,
+    DROP COLUMN sentry_dsn,
+    DROP COLUMN admin_enable,
+    DROP COLUMN admin_host,
+    DROP COLUMN admin_port,
+    DROP COLUMN admin_auth_header,
+    DROP COLUMN admin_upload_limit,
+    DROP COLUMN admin_access,
+    DROP COLUMN admin_public,
+    DROP COLUMN admin_groups;
+
+DROP TABLE admin_tokens;
+
+-- ---------------------------------------------------------------------------
+-- proxies, with their mocks folded in
+-- ---------------------------------------------------------------------------
+
+ALTER TABLE proxies ADD COLUMN document JSONB;
+
+UPDATE proxies p
+SET document = jsonb_strip_nulls(
+        jsonb_build_object(
+            'name', p.name,
+            'type', p.kind,
+            'url', p.url,
+            'timeout', p.timeout_seconds,
+            'body_limit', p.body_limit,
+            'replace', p.replace_ratio,
+            'rewrite_redirects', p.rewrite_redirects,
+            -- `type`, not `kind`: the Rust field is `kind` and the wire name is
+            -- `type`, and this document is read by the wire name.
+            'resolve', jsonb_strip_nulls(
+                jsonb_build_object('type', p.resolve_kind, 'header', p.resolve_header)
+            ),
+            'headers', p.headers,
+            'access', p.access
+        )
+        || CASE
+               WHEN p.loss_percentage IS NULL THEN '{}'::jsonb
+               ELSE jsonb_build_object(
+                        'loss',
+                        jsonb_build_object(
+                            'percentage', p.loss_percentage,
+                            'status', p.loss_status
+                        )
+                    )
+           END
+        || CASE
+               WHEN p.latency_percentage IS NULL THEN '{}'::jsonb
+               ELSE jsonb_build_object(
+                        'latency',
+                        jsonb_build_object(
+                            'percentage', p.latency_percentage,
+                            'min', p.latency_min,
+                            'max', p.latency_max
+                        )
+                    )
+           END
+        || jsonb_build_object(
+               -- `[]` rather than absent. `save` omits an empty mock list and
+               -- this writes it out, which is a difference in the JSON and not a
+               -- difference in the configuration: both parse to the same empty
+               -- vector. That is the invariant the whole backfill is held to --
+               -- the document must *parse into* the configuration the old
+               -- columns described, not match `save` byte for byte -- and it is
+               -- what keeps every stored revision unchanged.
+               'mocks', COALESCE(
+                   (
+                       SELECT jsonb_agg(
+                                  jsonb_strip_nulls(
+                                      jsonb_build_object(
+                                          'name', m.name,
+                                          'request', jsonb_build_object(
+                                              'method', m.method,
+                                              'url', m.url_pattern,
+                                              'headers', m.request_headers,
+                                              'query', m.request_query,
+                                              'body', m.request_body
+                                          ),
+                                          'response', jsonb_strip_nulls(
+                                              jsonb_build_object(
+                                                  'status', m.status,
+                                                  'body', m.body,
+                                                  'json', m.json,
+                                                  'template', m.template,
+                                                  'headers', m.response_headers
+                                              )
+                                          ),
+                                          'proxy', m.proxy_override
+                                      )
+                                  )
+                                  ORDER BY m.ordinal
+                              )
+                       FROM mocks m
+                       WHERE m.config = p.config AND m.proxy = p.name
+                   ),
+                   '[]'::jsonb
+               )
+           )
+    );
+
+ALTER TABLE proxies ALTER COLUMN document SET NOT NULL;
+
+ALTER TABLE proxies
+    DROP COLUMN kind,
+    DROP COLUMN url,
+    DROP COLUMN timeout_seconds,
+    DROP COLUMN body_limit,
+    DROP COLUMN replace_ratio,
+    DROP COLUMN rewrite_redirects,
+    DROP COLUMN resolve_kind,
+    DROP COLUMN resolve_header,
+    DROP COLUMN loss_percentage,
+    DROP COLUMN loss_status,
+    DROP COLUMN latency_percentage,
+    DROP COLUMN latency_min,
+    DROP COLUMN latency_max,
+    DROP COLUMN headers,
+    DROP COLUMN access;
+
+DROP TABLE mocks;
diff --git a/crates/doppel-store-postgres/src/lib.rs b/crates/doppel-store-postgres/src/lib.rs
index 8f80911..48ec9c1 100644
--- a/crates/doppel-store-postgres/src/lib.rs
+++ b/crates/doppel-store-postgres/src/lib.rs
@@ -190,6 +190,10 @@ impl doppel_core::store::ConfigStore for PostgresStore {
         self.retain_template_rows(proxy, keep).await
     }
 
+    async fn rename_templates(&self, from: &str, to: &str) -> Result<(), StoreError> {
+        self.rename_template_rows(from, to).await
+    }
+
     async fn materialize_templates(&self, _dir: &std::path::Path) -> Result<(), StoreError> {
         // The directory is `self.templates_dir`, fixed when the store was
         // opened, so the parameter is redundant here. It exists on the trait
diff --git a/crates/doppel-store-postgres/src/load.rs b/crates/doppel-store-postgres/src/load.rs
index c547a83..d630faa 100644
--- a/crates/doppel-store-postgres/src/load.rs
+++ b/crates/doppel-store-postgres/src/load.rs
@@ -1,11 +1,13 @@
-//! Reading a configuration back out of the five tables.
-
-use doppel_core::config::{
-    AccessConfig, AdminConfig, AuthConfig, ByteSize, Config, ControlConfig, LatencyConfig,
-    LogFormat, LogLevel, LoggingConfig, LossConfig, MockConfig, MockProxyOverride, MockRequest,
-    MockResponse, ProxyAccessConfig, ProxyConfig, ProxyKind, ResolveConfig, ResolveKind,
-    SentryConfig, ServerConfig, TemplatesConfig, TokenConfig, UploadConfig,
-};
+//! Reading a configuration back out of two tables.
+//!
+//! Both tables hold JSON documents, so this file has no per-column mapping and
+//! no per-column checks: `serde_json::from_value` runs the same `Deserialize`
+//! impls the YAML loader runs, which is what makes a row read here subject to
+//! exactly the rules a configuration file is subject to. The previous version of
+//! this file carried twenty-five helpers doing that job by hand, one per column
+//! type, and every new configuration field needed another edit here.
+
+use doppel_core::config::{Config, ProxyConfig};
 use doppel_core::store::{Revision, StoreError};
 use sqlx::{Row, postgres::PgRow};
 
@@ -13,10 +15,6 @@ use crate::PostgresStore;
 
 impl PostgresStore {
     /// Read this store's configuration.
-    ///
-    /// Public rather than crate-private because the `ConfigStore` impl that
-    /// will delegate to it lands with `save` (task 5), and a method nothing
-    /// can call is a method nothing tests.
     pub async fn load_config(&self) -> Result<(Config, Revision), StoreError> {
         // One transaction at `REPEATABLE READ`, so every statement below sees
         // the same snapshot.
@@ -41,7 +39,7 @@ impl PostgresStore {
             .await
             .map_err(query_failed)?;
 
-        let row = sqlx::query("SELECT * FROM configurations WHERE name = $1")
+        let row = sqlx::query("SELECT revision, settings FROM configurations WHERE name = $1")
             .bind(&self.config_name)
             .fetch_optional(&mut *tx)
             .await
@@ -54,21 +52,17 @@ impl PostgresStore {
                 .to_ne_bytes(),
         ));
 
-        let config = Config {
-            server: server_from(&row)?,
-            logging: logging_from(&row)?,
-            control: control_from(&row)?,
-            templates: templates_from(&row)?,
-            sentry: sentry_from(&row)?,
-            admin: self.admin_from(&mut tx, &row).await?,
-            proxies: self.proxies(&mut tx).await?,
-        };
+        // The stored document omits `proxies`, which is a `#[serde(default)]`
+        // field, so this yields a configuration with an empty proxy list and the
+        // rows below fill it in.
+        let mut config: Config = document(&row, "settings", "settings")?;
+        config.proxies = self.proxies(&mut tx).await?;
 
         // The stored revision has to agree with the content it labels. They
         // diverge when a row was edited by hand, or when this code forgot to
-        // read a column that `save` wrote -- and either way every
-        // compare-and-swap downstream would then fail in a way that looks
-        // like contention rather than like corruption.
+        // read something `save` wrote -- and either way every compare-and-swap
+        // downstream would then fail in a way that looks like contention rather
+        // than like corruption.
         let computed = Revision::of_config(&config);
         if computed != stored_revision {
             return Err(StoreError::Invalid(vec![doppel_core::Violation::new(
@@ -83,406 +77,75 @@ impl PostgresStore {
         Ok((config, stored_revision))
     }
 
-    async fn admin_from(
-        &self,
-        tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-        row: &PgRow,
-    ) -> Result<AdminConfig, StoreError> {
-        let tokens = sqlx::query(
-            "SELECT name, \"group\", token FROM admin_tokens WHERE config = $1 ORDER BY ordinal",
-        )
-        .bind(&self.config_name)
-        .fetch_all(&mut **tx)
-        .await
-        .map_err(query_failed)?
-        .into_iter()
-        .map(|token| {
-            Ok(TokenConfig {
-                name: name(&token, "name")?,
-                group: name(&token, "group")?,
-                token: stored_token(&token, "token")?,
-            })
-        })
-        .collect::<Result<Vec<_>, StoreError>>()?;
-
-        Ok(AdminConfig {
-            enable: row.try_get("admin_enable").map_err(query_failed)?,
-            host: parse_host(&text(row, "admin_host")?)?,
-            port: port(row, "admin_port")?,
-            auth: AuthConfig {
-                header: header_name(row, "admin_auth_header")?,
-            },
-            tokens,
-            access: json_column::<AccessConfig>(row, "admin_access")?,
-            public: row.try_get("admin_public").map_err(query_failed)?,
-            groups: optional_json::<Vec<doppel_core::config::AllowedGroup>>(row, "admin_groups")?,
-            upload: UploadConfig {
-                limit: byte_size(row, "admin_upload_limit")?,
-            },
-        })
-    }
-
     async fn proxies(
         &self,
         tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
     ) -> Result<Vec<ProxyConfig>, StoreError> {
-        let rows = sqlx::query("SELECT * FROM proxies WHERE config = $1 ORDER BY ordinal")
-            .bind(&self.config_name)
-            .fetch_all(&mut **tx)
-            .await
-            .map_err(query_failed)?;
+        let rows =
+            sqlx::query("SELECT name, document FROM proxies WHERE config = $1 ORDER BY ordinal")
+                .bind(&self.config_name)
+                .fetch_all(&mut **tx)
+                .await
+                .map_err(query_failed)?;
 
         let mut proxies = Vec::with_capacity(rows.len());
         for row in &rows {
-            let name = name(row, "name")?;
-            proxies.push(ProxyConfig {
-                mocks: self.mocks(tx, name.as_str()).await?,
-                name,
-                kind: match text(row, "kind")?.as_str() {
-                    "http" => ProxyKind::Http,
-                    // Including `tcp`, which earlier versions of this schema
-                    // could store: the variant is gone, so a row holding it is
-                    // a configuration this binary cannot serve, reported rather
-                    // than silently coerced to `http`.
-                    other => return Err(corrupt("proxies.kind", &format!("is `{other}`"))),
-                },
-                url: url(row, "url")?,
-                timeout: timeout(row, "timeout_seconds")?,
-                resolve: ResolveConfig {
-                    kind: match text(row, "resolve_kind")?.as_str() {
-                        "default" => ResolveKind::Default,
-                        "header" => ResolveKind::Header,
-                        other => {
-                            return Err(corrupt("proxies.resolve_kind", &format!("is `{other}`")));
-                        }
-                    },
-                    header: optional_header_name(row, "resolve_header")?,
-                },
-                access: optional_json::<ProxyAccessConfig>(row, "access")?,
-                headers: json_column(row, "headers")?,
-                loss: loss_from(row)?,
-                latency: latency_from(row)?,
-                replace: optional_ratio(row, "replace_ratio")?,
-                rewrite_redirects: row.try_get("rewrite_redirects").map_err(query_failed)?,
-                body_limit: byte_size(row, "body_limit")?,
-            });
+            // The keyed name is read first so a document that fails to parse can
+            // be reported against the proxy it belongs to. serde names the field
+            // it could not read (`missing field 'max'`) but not the row, and
+            // "some proxy is malformed" is not a report anybody can act on.
+            let keyed: String = row.try_get("name").map_err(query_failed)?;
+            let proxy: ProxyConfig =
+                document(row, "document", &format!("proxies[{keyed}].document"))?;
+
+            // The name is both a column and a field of the document, because the
+            // column is the primary key and the field is what the configuration
+            // format holds. A row whose two disagree is addressable under one
+            // name and serves another, so it is reported rather than resolved in
+            // favour of either.
+            if proxy.name.as_str() != keyed {
+                return Err(corrupt(
+                    "proxies.name",
+                    &format!(
+                        "row `{keyed}` holds a document naming `{}`",
+                        proxy.name.as_str()
+                    ),
+                ));
+            }
+
+            proxies.push(proxy);
         }
         Ok(proxies)
     }
-
-    async fn mocks(
-        &self,
-        tx: &mut sqlx::Transaction<'_, sqlx::Postgres>,
-        proxy: &str,
-    ) -> Result<Vec<MockConfig>, StoreError> {
-        sqlx::query("SELECT * FROM mocks WHERE config = $1 AND proxy = $2 ORDER BY ordinal")
-            .bind(&self.config_name)
-            .bind(proxy)
-            .fetch_all(&mut **tx)
-            .await
-            .map_err(query_failed)?
-            .iter()
-            .map(|row| {
-                Ok(MockConfig {
-                    name: name(row, "name")?,
-                    request: MockRequest {
-                        method: method(row, "method")?,
-                        url: pattern(row, "url_pattern")?,
-                        headers: json_column(row, "request_headers")?,
-                        query: json_column(row, "request_query")?,
-                        body: json_column(row, "request_body")?,
-                    },
-                    response: MockResponse {
-                        status: status(row, "status")?,
-                        body: row.try_get("body").map_err(query_failed)?,
-                        json: row.try_get("json").map_err(query_failed)?,
-                        template: optional_template_name(row, "template")?,
-                        headers: json_column(row, "response_headers")?,
-                    },
-                    proxy: optional_json::<MockProxyOverride>(row, "proxy_override")?,
-                })
-            })
-            .collect()
-    }
-}
-
-fn server_from(row: &PgRow) -> Result<ServerConfig, StoreError> {
-    Ok(ServerConfig {
-        host: parse_host(&text(row, "server_host")?)?,
-        port: port(row, "server_port")?,
-    })
-}
-
-fn logging_from(row: &PgRow) -> Result<LoggingConfig, StoreError> {
-    // Through serde rather than a hand-written match: the string in the
-    // column is the one the YAML uses, and going through the same
-    // deserializer keeps the two spellings from drifting apart.
-    Ok(LoggingConfig {
-        level: enum_from_text::<LogLevel>("log_level", &text(row, "log_level")?)?,
-        format: enum_from_text::<LogFormat>("log_format", &text(row, "log_format")?)?,
-    })
-}
-
-fn control_from(row: &PgRow) -> Result<ControlConfig, StoreError> {
-    Ok(ControlConfig {
-        socket: text(row, "control_socket")?.into(),
-    })
-}
-
-fn templates_from(row: &PgRow) -> Result<TemplatesConfig, StoreError> {
-    Ok(TemplatesConfig {
-        dir: text(row, "templates_dir")?.into(),
-    })
 }
 
-/// An absent `sentry_dsn` and an empty one both mean the section is absent.
+/// A stored JSON document, parsed through the configuration's own types.
 ///
-/// `Some(SentryConfig { dsn: String::new() })` would round-trip as
-/// `sentry:\n  dsn: ""`, which is a different document from one with no
-/// `sentry` section -- and a different revision.
-fn sentry_from(row: &PgRow) -> Result<Option<SentryConfig>, StoreError> {
-    let dsn: Option<String> = row.try_get("sentry_dsn").map_err(query_failed)?;
-    Ok(dsn
-        .filter(|dsn| !dsn.is_empty())
-        .map(|dsn| SentryConfig { dsn }))
-}
-
-/// `loss` is present exactly when both its columns are.
-///
-/// One of the two set on its own is a row nobody could have written through
-/// `save`, so it is reported rather than silently treated as absent.
-fn loss_from(row: &PgRow) -> Result<Option<LossConfig>, StoreError> {
-    let percentage: Option<f64> = row.try_get("loss_percentage").map_err(query_failed)?;
-    let status: Option<i32> = row.try_get("loss_status").map_err(query_failed)?;
-    match (percentage, status) {
-        (None, None) => Ok(None),
-        (Some(percentage), Some(status)) => Ok(Some(LossConfig {
-            percentage: ratio(percentage, "proxies.loss_percentage")?,
-            status: narrow_status(status, "proxies.loss_status")?,
-        })),
-        _ => Err(corrupt(
-            "proxies.loss_*",
-            "has some columns set and others null",
-        )),
-    }
-}
-
-fn latency_from(row: &PgRow) -> Result<Option<LatencyConfig>, StoreError> {
-    let percentage: Option<f64> = row.try_get("latency_percentage").map_err(query_failed)?;
-    let min: Option<f64> = row.try_get("latency_min").map_err(query_failed)?;
-    let max: Option<f64> = row.try_get("latency_max").map_err(query_failed)?;
-    match (percentage, min, max) {
-        (None, None, None) => Ok(None),
-        (Some(percentage), Some(min), Some(max)) => Ok(Some(LatencyConfig {
-            percentage: ratio(percentage, "proxies.latency_percentage")?,
-            min: seconds(min, "proxies.latency_min")?,
-            max: seconds(max, "proxies.latency_max")?,
-        })),
-        _ => Err(corrupt(
-            "proxies.latency_*",
-            "has some columns set and others null",
-        )),
-    }
-}
-
-fn text(row: &PgRow, column: &str) -> Result<String, StoreError> {
-    row.try_get(column).map_err(query_failed)
-}
-
-/// A stored name, checked on the way in.
-///
-/// The database has no opinion about what a name may contain, so a row edited
-/// by hand can hold one the configuration format would refuse. Parsing here
-/// means a `Config` this store produces is subject to the same rule as one
-/// read from YAML, rather than a second, laxer standard nobody wrote down.
-/// Generic over the cap so one function serves both a `Name` and the tighter
-/// `ProxyName`, and the column is checked against the limit that type actually
-/// carries rather than against whichever one this helper happened to name.
-fn name<const MAX_LEN: usize>(
+/// `column` is where to read it; `label` is what a failure is reported under, and
+/// the two are not the same thing -- a proxy's document lives in `document` and is
+/// reported as `proxies[alpha].document`, because serde names the field it could
+/// not read but nothing about which row held it.
+fn document<T: serde::de::DeserializeOwned>(
     row: &PgRow,
     column: &str,
-) -> Result<doppel_core::config::Name<MAX_LEN>, StoreError> {
-    let raw: String = row.try_get(column).map_err(query_failed)?;
-    doppel_core::config::Name::parse(raw).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored token, checked on the way in, for the same reason as `name`.
-///
-/// The error names the column and not the value: a corruption message about a
-/// token is still somewhere a token would end up.
-fn stored_token(row: &PgRow, column: &str) -> Result<doppel_core::config::Token, StoreError> {
-    let raw: String = row.try_get(column).map_err(query_failed)?;
-    doppel_core::config::Token::parse(raw).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored port, checked on the way in.
-///
-/// `i32` is the column type, so the range check has two halves: the value has
-/// to fit a `u16` at all, and then it has to be one `Port` accepts. Both are
-/// reachable from a hand-edited row, and neither is reachable from YAML.
-fn port(row: &PgRow, column: &str) -> Result<doppel_core::config::Port, StoreError> {
-    let value: i32 = row.try_get(column).map_err(query_failed)?;
-    let narrowed =
-        u16::try_from(value).map_err(|_| corrupt(column, &format!("is {value}, not a port")))?;
-    doppel_core::config::Port::parse(narrowed).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored status, checked on the way in.
-///
-/// Two halves, as with `port`: the `i32` column has to narrow to a `u16` at
-/// all, and then the number has to be one `HttpStatus` accepts. Both are
-/// reachable from a hand-edited row and neither is reachable from YAML.
-fn status(row: &PgRow, column: &str) -> Result<doppel_core::config::HttpStatus, StoreError> {
-    let value: i32 = row.try_get(column).map_err(query_failed)?;
-    narrow_status(value, column)
-}
-
-fn narrow_status(value: i32, column: &str) -> Result<doppel_core::config::HttpStatus, StoreError> {
-    let narrowed =
-        u16::try_from(value).map_err(|_| corrupt(column, &format!("is {value}, not a status")))?;
-    doppel_core::config::HttpStatus::parse(narrowed)
-        .map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored method, checked on the way in.
-fn method(row: &PgRow, column: &str) -> Result<doppel_core::config::HttpMethod, StoreError> {
-    let raw: String = row.try_get(column).map_err(query_failed)?;
-    raw.parse()
-        .map_err(|err: doppel_core::config::MethodError| corrupt(column, &err.to_string()))
-}
-
-/// A stored timeout, checked on the way in.
-///
-/// The column is a nullable `bigint`, so both halves of the range are
-/// reachable from a hand-edited row: a negative value, and a positive one
-/// past what a timeout may be.
-fn timeout(
-    row: &PgRow,
-    column: &str,
-) -> Result<Option<doppel_core::config::TimeoutSeconds>, StoreError> {
-    optional_u64(row, column)?
-        .map(|value| {
-            doppel_core::config::TimeoutSeconds::parse(value)
-                .map_err(|err| corrupt(column, &err.to_string()))
-        })
-        .transpose()
-}
-
-/// A stored probability, checked on the way in.
-fn ratio(value: f64, column: &str) -> Result<doppel_core::config::Ratio, StoreError> {
-    doppel_core::config::Ratio::parse(value).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-fn optional_ratio(
-    row: &PgRow,
-    column: &str,
-) -> Result<Option<doppel_core::config::Ratio>, StoreError> {
-    let value: Option<f64> = row.try_get(column).map_err(query_failed)?;
-    value.map(|value| ratio(value, column)).transpose()
-}
-
-/// A stored latency, checked on the way in.
-fn seconds(value: f64, column: &str) -> Result<doppel_core::config::Seconds, StoreError> {
-    doppel_core::config::Seconds::parse(value).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored template file name, checked on the way in.
-fn optional_template_name(
-    row: &PgRow,
-    column: &str,
-) -> Result<Option<doppel_core::config::TemplateName>, StoreError> {
-    let raw: Option<String> = row.try_get(column).map_err(query_failed)?;
-    raw.map(|raw| {
-        doppel_core::config::TemplateName::parse(raw)
-            .map_err(|err| corrupt(column, &err.to_string()))
-    })
-    .transpose()
-}
-
-/// A stored url pattern, checked on the way in.
-fn pattern(row: &PgRow, column: &str) -> Result<doppel_core::config::Pattern, StoreError> {
-    let raw: String = row.try_get(column).map_err(query_failed)?;
-    doppel_core::config::Pattern::parse(raw).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored header name, checked on the way in.
-fn header_name(row: &PgRow, column: &str) -> Result<doppel_core::config::HeaderName, StoreError> {
-    let raw: String = row.try_get(column).map_err(query_failed)?;
-    doppel_core::config::HeaderName::parse(raw).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-fn optional_header_name(
-    row: &PgRow,
-    column: &str,
-) -> Result<Option<doppel_core::config::HeaderName>, StoreError> {
-    let raw: Option<String> = row.try_get(column).map_err(query_failed)?;
-    raw.map(|raw| {
-        doppel_core::config::HeaderName::parse(raw).map_err(|err| corrupt(column, &err.to_string()))
-    })
-    .transpose()
-}
-
-/// A stored upstream URL, checked on the way in.
-fn url(row: &PgRow, column: &str) -> Result<doppel_core::config::UpstreamUrl, StoreError> {
-    let raw: String = row.try_get(column).map_err(query_failed)?;
-    doppel_core::config::UpstreamUrl::parse(&raw).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-/// A stored byte limit, checked on the way in.
-fn byte_size(row: &PgRow, column: &str) -> Result<ByteSize, StoreError> {
-    let value: i64 = row.try_get(column).map_err(query_failed)?;
-    let unsigned = u64::try_from(value).map_err(|_| corrupt(column, "is negative"))?;
-    ByteSize::parse(unsigned).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-fn optional_u64(row: &PgRow, column: &str) -> Result<Option<u64>, StoreError> {
-    let value: Option<i64> = row.try_get(column).map_err(query_failed)?;
-    value
-        .map(|value| u64::try_from(value).map_err(|_| corrupt(column, "is negative")))
-        .transpose()
-}
-
-fn json_column<T: serde::de::DeserializeOwned>(row: &PgRow, column: &str) -> Result<T, StoreError> {
-    let value: serde_json::Value = row.try_get(column).map_err(query_failed)?;
-    serde_json::from_value(value).map_err(|err| corrupt(column, &err.to_string()))
-}
-
-fn optional_json<T: serde::de::DeserializeOwned>(
-    row: &PgRow,
-    column: &str,
-) -> Result<Option<T>, StoreError> {
-    let value: Option<serde_json::Value> = row.try_get(column).map_err(query_failed)?;
-    value
-        .map(|value| serde_json::from_value(value).map_err(|err| corrupt(column, &err.to_string())))
-        .transpose()
-}
-
-/// Deserialize an enum from the same text its YAML representation uses.
-fn enum_from_text<T: serde::de::DeserializeOwned>(
-    column: &str,
-    value: &str,
+    label: &str,
 ) -> Result<T, StoreError> {
-    serde_json::from_value(serde_json::Value::String(value.to_owned()))
-        .map_err(|_| corrupt(column, &format!("is `{value}`")))
-}
-
-fn parse_host(value: &str) -> Result<std::net::IpAddr, StoreError> {
-    value
-        .parse()
-        .map_err(|_| corrupt("host", &format!("`{value}` is not an IP address")))
+    let value: serde_json::Value = row.try_get(column).map_err(query_failed)?;
+    serde_json::from_value(value).map_err(|err| corrupt(label, &err.to_string()))
 }
 
 fn query_failed(err: sqlx::Error) -> StoreError {
     StoreError::Unavailable(format!("query failed: {err}"))
 }
 
-/// A row that cannot be turned into a configuration.
+/// A row the database accepted and the configuration format does not.
 ///
-/// Reported as `Invalid` rather than `Unavailable`: the database answered
-/// perfectly well, and what it holds is the problem.
+/// Reported as `Invalid` rather than `Unavailable`: the database is working
+/// perfectly, and what is wrong is the content -- which is a different thing for
+/// an operator to do something about.
 fn corrupt(column: &str, detail: &str) -> StoreError {
     StoreError::Invalid(vec![doppel_core::Violation::new(
         column,
-        format!("stored value {detail}"),
+        format!("stored value is not one this version accepts: {detail}"),
     )])
 }
diff --git a/crates/doppel-store-postgres/src/save.rs b/crates/doppel-store-postgres/src/save.rs
index 27604c4..774075d 100644
--- a/crates/doppel-store-postgres/src/save.rs
+++ b/crates/doppel-store-postgres/src/save.rs
@@ -1,6 +1,18 @@
-//! Writing a configuration into the five tables.
-
-use doppel_core::config::{Config, ProxyConfig};
+//! Writing a configuration into two tables.
+//!
+//! The document is stored as JSON rather than spread across a column per field.
+//! That is a deliberate reversal of the original schema, and the reason is the
+//! migration it saves: between 0.3.0 and 0.4.1 three fields were added to the
+//! configuration format, and each one needed a migration whose only content was
+//! `ADD COLUMN` -- plus a matching edit here, in `load`, and in two hand-written
+//! statements that a test existed solely to keep in step. A field added to the
+//! serde model now reaches the database with no schema change at all.
+//!
+//! What stays a column is what SQL actually uses: `name` and `revision` for the
+//! compare-and-swap, `ordinal` for proxy order, `config` for the foreign key.
+//! Nothing ever queried `admin_host`.
+
+use doppel_core::config::Config;
 use doppel_core::store::{Revision, StoreError};
 use doppel_core::validate::validate;
 use sqlx::{Postgres, Transaction};
@@ -24,6 +36,7 @@ impl PostgresStore {
     ) -> Result<Revision, StoreError> {
         validate(config).map_err(StoreError::Invalid)?;
         let revision = Revision::of_config(config);
+        let settings = settings_of(config)?;
 
         let mut tx = self
             .pool()
@@ -33,10 +46,10 @@ impl PostgresStore {
 
         match expected {
             Some(expected) => {
-                self.update_header(&mut tx, config, revision, expected)
-                    .await?
+                self.update_header(&mut tx, &settings, revision, expected)
+                    .await?;
             }
-            None => self.upsert_header(&mut tx, config, revision).await?,
+            None => self.upsert_header(&mut tx, &settings, revision).await?,
         }
 
         // Deleted and rewritten rather than diffed. A diff is more code whose
@@ -45,41 +58,28 @@ impl PostgresStore {
         // transaction either way, so the rewrite costs nothing an operator can
         // observe.
         //
-        // `mocks` and `admin_tokens` go with their parents through
-        // `ON DELETE CASCADE`; `templates` deliberately does not, so it is
-        // untouched here. Dropping a proxy's files is a separate decision made
-        // after the configuration write, never as part of it.
-        self.clear_children(&mut tx).await?;
+        // `templates` deliberately does not cascade from here: dropping a
+        // proxy's files is a separate decision made after the configuration
+        // write, never as part of it.
+        sqlx::query("DELETE FROM proxies WHERE config = $1")
+            .bind(&self.config_name)
+            .execute(&mut *tx)
+            .await
+            .map_err(write_failed)?;
 
-        for (ordinal, token) in config.admin.tokens.iter().enumerate() {
+        for (ordinal, proxy) in config.proxies.iter().enumerate() {
             sqlx::query(
-                "INSERT INTO admin_tokens (config, name, \"group\", token, ordinal) \
-                 VALUES ($1, $2, $3, $4, $5)",
+                "INSERT INTO proxies (config, name, ordinal, document) VALUES ($1, $2, $3, $4)",
             )
             .bind(&self.config_name)
-            .bind(token.name.as_str())
-            .bind(token.group.as_str())
-            .bind(token.token.as_str())
+            .bind(proxy.name.as_str())
             .bind(ordinal_of(ordinal)?)
+            .bind(as_json(proxy)?)
             .execute(&mut *tx)
             .await
             .map_err(write_failed)?;
         }
 
-        for (ordinal, proxy) in config.proxies.iter().enumerate() {
-            self.insert_proxy(&mut tx, proxy, ordinal_of(ordinal)?)
-                .await?;
-            for (mock_ordinal, mock) in proxy.mocks.iter().enumerate() {
-                self.insert_mock(
-                    &mut tx,
-                    proxy.name.as_str(),
-                    mock,
-                    ordinal_of(mock_ordinal)?,
-                )
-                .await?;
-            }
-        }
-
         tx.commit()
             .await
             .map_err(|err| StoreError::Unavailable(format!("cannot commit: {err}")))?;
@@ -95,7 +95,7 @@ impl PostgresStore {
     async fn update_header(
         &self,
         tx: &mut Transaction<'_, Postgres>,
-        config: &Config,
+        settings: &serde_json::Value,
         revision: Revision,
         expected: Revision,
     ) -> Result<(), StoreError> {
@@ -103,7 +103,7 @@ impl PostgresStore {
             .bind(as_i64(revision))
             .bind(&self.config_name)
             .bind(as_i64(expected))
-            .pipe_header(config)
+            .bind(settings)
             .execute(&mut **tx)
             .await
             .map_err(write_failed)?
@@ -132,231 +132,70 @@ impl PostgresStore {
     async fn upsert_header(
         &self,
         tx: &mut Transaction<'_, Postgres>,
-        config: &Config,
+        settings: &serde_json::Value,
         revision: Revision,
     ) -> Result<(), StoreError> {
         sqlx::query(UPSERT_HEADER)
             .bind(&self.config_name)
             .bind(as_i64(revision))
-            .pipe_header(config)
+            .bind(settings)
             .execute(&mut **tx)
             .await
             .map_err(write_failed)?;
         Ok(())
     }
-
-    async fn clear_children(&self, tx: &mut Transaction<'_, Postgres>) -> Result<(), StoreError> {
-        // Written out rather than looped over a table name, so no SQL here is
-        // built by formatting. Order matters only in that `proxies` comes
-        // last: `mocks` cascades from it, and deleting the parent first would
-        // make the explicit child delete a no-op that reads as if it did
-        // something.
-        for statement in [
-            "DELETE FROM mocks WHERE config = $1",
-            "DELETE FROM admin_tokens WHERE config = $1",
-            "DELETE FROM proxies WHERE config = $1",
-        ] {
-            sqlx::query(statement)
-                .bind(&self.config_name)
-                .execute(&mut **tx)
-                .await
-                .map_err(write_failed)?;
-        }
-        Ok(())
-    }
-
-    async fn insert_proxy(
-        &self,
-        tx: &mut Transaction<'_, Postgres>,
-        proxy: &ProxyConfig,
-        ordinal: i32,
-    ) -> Result<(), StoreError> {
-        sqlx::query(
-            "INSERT INTO proxies (config, name, ordinal, kind, url, timeout_seconds, body_limit, \
-             replace_ratio, rewrite_redirects, resolve_kind, resolve_header, loss_percentage, \
-             loss_status, latency_percentage, latency_min, latency_max, headers, access) \
-             VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, \
-             $18)",
-        )
-        .bind(&self.config_name)
-        .bind(proxy.name.as_str())
-        .bind(ordinal)
-        .bind(as_text(&proxy.kind)?)
-        .bind(proxy.url.as_str())
-        .bind(
-            proxy
-                .timeout
-                .map(|t| i64::try_from(t.get()).unwrap_or(i64::MAX)),
-        )
-        .bind(i64::try_from(proxy.body_limit.get()).unwrap_or(i64::MAX))
-        .bind(proxy.replace.map(doppel_core::config::Ratio::get))
-        .bind(proxy.rewrite_redirects)
-        .bind(as_text(&proxy.resolve.kind)?)
-        .bind(
-            proxy
-                .resolve
-                .header
-                .as_ref()
-                .map(doppel_core::config::HeaderName::as_str),
-        )
-        .bind(proxy.loss.as_ref().map(|l| l.percentage.get()))
-        .bind(proxy.loss.as_ref().map(|l| i32::from(l.status.get())))
-        .bind(proxy.latency.as_ref().map(|l| l.percentage.get()))
-        .bind(proxy.latency.as_ref().map(|l| l.min.get()))
-        .bind(proxy.latency.as_ref().map(|l| l.max.get()))
-        .bind(as_json(&proxy.headers)?)
-        .bind(proxy.access.as_ref().map(as_json).transpose()?)
-        .execute(&mut **tx)
-        .await
-        .map_err(write_failed)?;
-        Ok(())
-    }
-
-    async fn insert_mock(
-        &self,
-        tx: &mut Transaction<'_, Postgres>,
-        proxy: &str,
-        mock: &doppel_core::config::MockConfig,
-        ordinal: i32,
-    ) -> Result<(), StoreError> {
-        sqlx::query(
-            "INSERT INTO mocks (config, proxy, name, ordinal, method, url_pattern, status, body, \
-             json, template, request_headers, request_query, request_body, response_headers, \
-             proxy_override) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, \
-             $14, $15)",
-        )
-        .bind(&self.config_name)
-        .bind(proxy)
-        .bind(mock.name.as_str())
-        .bind(ordinal)
-        .bind(mock.request.method.as_str())
-        .bind(mock.request.url.as_str())
-        .bind(i32::from(mock.response.status.get()))
-        .bind(mock.response.body.as_deref())
-        .bind(mock.response.json.as_deref())
-        .bind(
-            mock.response
-                .template
-                .as_ref()
-                .map(doppel_core::config::TemplateName::as_str),
-        )
-        .bind(as_json(&mock.request.headers)?)
-        .bind(as_json(&mock.request.query)?)
-        .bind(as_json(&mock.request.body)?)
-        .bind(as_json(&mock.response.headers)?)
-        .bind(mock.proxy.as_ref().map(as_json).transpose()?)
-        .execute(&mut **tx)
-        .await
-        .map_err(write_failed)?;
-        Ok(())
-    }
 }
 
 /// The two header statements, written out rather than assembled.
 ///
-/// Assembling them from a shared column list would keep them in step
-/// automatically, but only by building SQL with `format!` -- which sqlx
-/// refuses by design, because that is where injection lives, and silencing
-/// the refusal here would weaken it everywhere. They are literals instead,
-/// and `the_two_header_statements_write_the_same_columns` below is what keeps
-/// them in step: a column added to one and forgotten in the other would make
-/// a configuration differ depending on whether it was created or updated.
+/// sqlx refuses SQL built by formatting, by design, because that is where
+/// injection lives -- so these are literals. There are two columns to keep in
+/// step now rather than seventeen, which is most of the point of storing the
+/// document as JSON.
+const UPDATE_HEADER: &str = "UPDATE configurations SET revision = $1, settings = $4, \
+     updated_at = now() WHERE name = $2 AND revision = $3";
+
+const UPSERT_HEADER: &str = "INSERT INTO configurations (name, revision, settings) \
+     VALUES ($1, $2, $3) \
+     ON CONFLICT (name) DO UPDATE SET revision = $2, settings = $3, updated_at = now()";
+
+/// The configuration as it is stored: the whole document except its proxies.
 ///
-/// The bind order is the one `pipe_header` writes, and the tests below
-/// check the statements against it.
-const UPDATE_HEADER: &str = "UPDATE configurations SET revision = $1, \
-     admin_enable = $4, server_host = $5, server_port = $6, log_level = $7, \
-     log_format = $8, control_socket = $9, templates_dir = $10, sentry_dsn = $11, \
-     admin_host = $12, admin_port = $13, admin_auth_header = $14, \
-     admin_upload_limit = $15, admin_access = $16, admin_groups = $17, \
-     admin_public = $18, updated_at = now() \
-     WHERE name = $2 AND revision = $3";
-
-const UPSERT_HEADER: &str = "INSERT INTO configurations \
-     (name, revision, admin_enable, server_host, server_port, log_level, log_format, \
-      control_socket, templates_dir, sentry_dsn, admin_host, admin_port, \
-      admin_auth_header, admin_upload_limit, admin_access, admin_groups, \
-      admin_public) \
-     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, \
-             $17) \
-     ON CONFLICT (name) DO UPDATE SET revision = $2, \
-     admin_enable = $3, server_host = $4, server_port = $5, log_level = $6, \
-     log_format = $7, control_socket = $8, templates_dir = $9, sentry_dsn = $10, \
-     admin_host = $11, admin_port = $12, admin_auth_header = $13, \
-     admin_upload_limit = $14, admin_access = $15, admin_groups = $16, \
-     admin_public = $17, updated_at = now()";
-
-/// Bind the header values in `HEADER_COLUMNS` order.
-///
-/// A trait rather than a free function so the call reads in the same place the
-/// query does: the order of these binds and the order of that list are the one
-/// thing a reader has to check, and putting them side by side is what makes
-/// that possible.
-trait BindHeader<'q> {
-    fn pipe_header(self, config: &'q Config) -> Self;
-}
-
-impl<'q> BindHeader<'q> for sqlx::query::Query<'q, Postgres, sqlx::postgres::PgArguments> {
-    fn pipe_header(self, config: &'q Config) -> Self {
-        self.bind(config.admin.enable)
-            .bind(config.server.host.to_string())
-            .bind(i32::from(config.server.port.get()))
-            .bind(text_of(&config.logging.level))
-            .bind(text_of(&config.logging.format))
-            .bind(config.control.socket.to_string_lossy().into_owned())
-            .bind(config.templates.dir.to_string_lossy().into_owned())
-            .bind(config.sentry.as_ref().map(|s| s.dsn.clone()))
-            .bind(config.admin.host.to_string())
-            .bind(i32::from(config.admin.port.get()))
-            .bind(config.admin.auth.header.as_str())
-            .bind(i64::try_from(config.admin.upload.limit.get()).unwrap_or(i64::MAX))
-            .bind(serde_json::to_value(&config.admin.access).unwrap_or(serde_json::Value::Null))
-            // `None` binds SQL NULL, which is what an absent `groups` has to
-            // round-trip as: see the 0003 migration for why materialising the
-            // default would break every pre-existing configuration's revision.
-            .bind(
-                config
-                    .admin
-                    .groups
-                    .as_ref()
-                    .map(|groups| serde_json::to_value(groups).unwrap_or(serde_json::Value::Null)),
-            )
-            .bind(config.admin.public)
-    }
-}
-
-/// An enum's wire spelling, which is the one the YAML and the column share.
-fn text_of<T: serde::Serialize>(value: &T) -> String {
-    serde_json::to_value(value)
-        .ok()
-        .and_then(|value| value.as_str().map(ToOwned::to_owned))
-        .unwrap_or_default()
-}
-
-fn as_text<T: serde::Serialize>(value: &T) -> Result<String, StoreError> {
-    serde_json::to_value(value)
-        .ok()
-        .and_then(|value| value.as_str().map(ToOwned::to_owned))
-        .ok_or_else(|| StoreError::Serialize("an enum did not serialize as a string".to_owned()))
+/// The proxies come out because each one is a row of its own -- they are
+/// addressed by name, ordered by `ordinal`, and read back individually. Nothing
+/// else is transformed, which is what makes this immune to a field being added:
+/// `serde_json::to_value` follows the same model `Deserialize` reads back, so
+/// there is no second description of the configuration to keep in step.
+fn settings_of(config: &Config) -> Result<serde_json::Value, StoreError> {
+    let mut document = as_json(config)?;
+    document
+        .as_object_mut()
+        .ok_or_else(|| {
+            StoreError::Unavailable("a configuration did not serialize to an object".to_owned())
+        })?
+        .remove("proxies");
+    Ok(document)
 }
 
 fn as_json<T: serde::Serialize>(value: &T) -> Result<serde_json::Value, StoreError> {
-    serde_json::to_value(value).map_err(|err| StoreError::Serialize(err.to_string()))
+    serde_json::to_value(value)
+        .map_err(|err| StoreError::Unavailable(format!("cannot serialize for storage: {err}")))
 }
 
-/// A list position as the column's type.
+/// A list index as the column's type.
 ///
 /// Fails rather than truncating: a configuration with more than two billion
-/// proxies is not one anybody wrote, and silently wrapping the ordinal would
-/// reorder the document.
+/// proxies is not a real configuration, and a wrapped ordinal would silently
+/// reorder the list.
 fn ordinal_of(index: usize) -> Result<i32, StoreError> {
     i32::try_from(index)
-        .map_err(|_| StoreError::Serialize(format!("position {index} does not fit a column")))
+        .map_err(|_| StoreError::Unavailable(format!("ordinal {index} does not fit a column")))
 }
 
-/// The revision as the column holds it: the same bits, not a numeric
-/// conversion. PostgreSQL has no unsigned 64-bit integer, and a value above
-/// `i64::MAX` is perfectly ordinary for a hash.
+/// A `u64` revision in a signed column, bit for bit.
+///
+/// Postgres has no unsigned integer, and the alternative -- storing it as text
+/// -- would make the compare-and-swap a string comparison.
 fn as_i64(revision: Revision) -> i64 {
     i64::from_ne_bytes(revision.0.to_ne_bytes())
 }
@@ -373,92 +212,100 @@ fn write_failed(err: sqlx::Error) -> StoreError {
 mod tests {
     use super::*;
 
-    /// The header columns, in the order `pipe_header` binds them.
+    /// Both statements have to write both columns.
     ///
-    /// Lives here rather than beside the statements because only these tests
-    /// consume it, and a constant nothing in the binary reads is dead code the
-    /// compiler is right to refuse.
-    const HEADER_BINDS: &[&str] = &[
-        "admin_enable",
-        "server_host",
-        "server_port",
-        "log_level",
-        "log_format",
-        "control_socket",
-        "templates_dir",
-        "sentry_dsn",
-        "admin_host",
-        "admin_port",
-        "admin_auth_header",
-        "admin_upload_limit",
-        "admin_access",
-        "admin_groups",
-        "admin_public",
-    ];
-
-    /// Every `column = $n` assignment in a statement.
-    fn assigned_columns(sql: &str) -> Vec<&str> {
-        sql.split(',')
-            .filter_map(|fragment| fragment.split_once('='))
-            .map(|(column, _)| column.trim().rsplit(' ').next().unwrap_or(column).trim())
-            .filter(|column| !column.is_empty())
-            .collect()
+    /// The hazard this guards used to be much larger -- seventeen columns
+    /// spread across two literals, where one added to the update and forgotten
+    /// in the upsert made a configuration differ depending on whether it was
+    /// created or replaced. Two columns is small enough to read, and cheap
+    /// enough to keep asserting.
+    #[test]
+    fn both_header_statements_write_the_revision_and_the_settings() {
+        for statement in [UPDATE_HEADER, UPSERT_HEADER] {
+            assert!(
+                statement.contains("revision = $"),
+                "no revision assignment: {statement}"
+            );
+            assert!(
+                statement.contains("settings = $"),
+                "no settings assignment: {statement}"
+            );
+            assert!(
+                statement.contains("updated_at = now()"),
+                "no updated_at: {statement}"
+            );
+        }
     }
 
+    /// The conditional half must stay conditional.
+    ///
+    /// Without the revision in the `WHERE`, `save_config` would overwrite a
+    /// configuration that had moved under the caller, which is the one thing
+    /// compare-and-swap exists to prevent, and no other test here would notice.
     #[test]
-    fn the_two_header_statements_write_the_same_columns() {
-        // The one thing a shared, formatted column list would have given for
-        // free, bought back with a test instead -- because building SQL by
-        // formatting is what sqlx refuses, and silencing that refusal here
-        // would weaken it everywhere else in the crate.
-        //
-        // A column added to one statement and forgotten in the other makes a
-        // configuration differ depending on whether it was created or
-        // updated, which is the kind of bug that only appears on the second
-        // deployment.
-        let mut update: Vec<_> = assigned_columns(UPDATE_HEADER)
-            .into_iter()
-            .filter(|column| *column != "revision" && *column != "name")
-            .collect();
-        let mut upsert: Vec<_> = assigned_columns(UPSERT_HEADER)
-            .into_iter()
-            .filter(|column| *column != "revision")
-            .collect();
-        update.sort_unstable();
-        upsert.sort_unstable();
-        assert_eq!(update, upsert, "the two header statements have drifted");
+    fn the_update_is_guarded_by_the_expected_revision() {
+        assert!(
+            UPDATE_HEADER.contains("WHERE name = $2 AND revision = $3"),
+            "{UPDATE_HEADER}"
+        );
     }
 
     #[test]
-    fn both_statements_write_exactly_the_columns_pipe_header_binds() {
-        // The other half: the statements agreeing with each other is no use if
-        // they disagree with the bind order.
-        let mut expected: Vec<_> = HEADER_BINDS.to_vec();
-        expected.push("updated_at");
-        expected.sort_unstable();
+    fn the_settings_document_holds_everything_except_the_proxies() {
+        let config = doppel_core::config::load_from_str(
+            r#"
+server:
+  host: "127.0.0.1"
+  port: 8080
+admin:
+  host: "127.0.0.1"
+  port: 8081
+  tokens: []
+  access: {}
+  upload:
+    limit: 1Mi
+proxies:
+  - name: p1
+    type: http
+    url: "https://example.com/"
+"#,
+        )
+        .unwrap();
+
+        let settings = settings_of(&config).unwrap();
+        let object = settings.as_object().unwrap();
+        assert!(
+            !object.contains_key("proxies"),
+            "proxies belong in their own rows: {settings}"
+        );
+        for section in ["server", "admin", "logging", "control", "templates"] {
+            assert!(object.contains_key(section), "{section} is missing");
+        }
 
-        let mut written: Vec<_> = assigned_columns(UPDATE_HEADER)
-            .into_iter()
-            .filter(|column| *column != "revision" && *column != "name")
-            .collect();
-        written.sort_unstable();
-        assert_eq!(written, expected);
+        // And what came out parses straight back into a configuration, which is
+        // what `load` relies on. An absent `proxies` is legal, so the reparsed
+        // document is a whole configuration with an empty proxy list.
+        let reparsed: Config = serde_json::from_value(settings).unwrap();
+        assert!(reparsed.proxies.is_empty());
+        assert_eq!(reparsed.admin.port, config.admin.port);
     }
 
     #[test]
     fn a_revision_survives_the_trip_through_a_signed_column() {
-        // PostgreSQL has no unsigned 64-bit integer, and a hash above
-        // `i64::MAX` is perfectly ordinary. The mapping reuses the bits rather
-        // than converting the value, so it has to be exactly reversible.
-        for raw in [0, 1, u64::MAX, u64::MAX / 2, 0x8000_0000_0000_0000] {
-            assert_eq!(from_i64(as_i64(Revision(raw))), Revision(raw));
+        // The high bit is the case that matters: a revision past i64::MAX has to
+        // come back as the same u64 rather than as a negative number.
+        for revision in [
+            Revision(0),
+            Revision(1),
+            Revision(u64::MAX),
+            Revision(1 << 63),
+        ] {
+            assert_eq!(from_i64(as_i64(revision)), revision);
         }
     }
 
     #[test]
     fn an_ordinal_that_cannot_fit_is_refused_rather_than_wrapped() {
-        // Wrapping would reorder the document silently, and order decides
-        // which mock answers a request.
         assert!(ordinal_of(0).is_ok());
         assert!(ordinal_of(usize::MAX).is_err());
     }
diff --git a/crates/doppel-store-postgres/src/templates.rs b/crates/doppel-store-postgres/src/templates.rs
index 45eaa47..1f8c9e4 100644
--- a/crates/doppel-store-postgres/src/templates.rs
+++ b/crates/doppel-store-postgres/src/templates.rs
@@ -107,6 +107,28 @@ impl PostgresStore {
         Ok(existed)
     }
 
+    /// Carry a proxy's templates to its new name.
+    ///
+    /// Two steps, and neither is optional: the rows are what the store holds, and
+    /// the directory is what the render path reads. The rows move first -- if the
+    /// directory move then fails, `materialize` on the next reload rebuilds it from
+    /// the rows, whereas rows left behind would be invisible to it.
+    pub(crate) async fn rename_template_rows(
+        &self,
+        from: &str,
+        to: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query("UPDATE templates SET proxy = $3 WHERE config = $1 AND proxy = $2")
+            .bind(self.config_name())
+            .bind(from)
+            .bind(to)
+            .execute(self.pool())
+            .await
+            .map_err(failed)?;
+
+        doppel_core::store::rename_template_dir(&self.proxy_dir(from)?, &self.proxy_dir(to)?)
+    }
+
     pub(crate) async fn retain_template_rows(
         &self,
         proxy: &str,
diff --git a/crates/doppel-store-postgres/src/test_support.rs b/crates/doppel-store-postgres/src/test_support.rs
index c527398..e7e2d3f 100644
--- a/crates/doppel-store-postgres/src/test_support.rs
+++ b/crates/doppel-store-postgres/src/test_support.rs
@@ -194,6 +194,23 @@ impl TestSchema {
         pool.close().await;
     }
 
+    /// Every row of a one-column JSON query, in the order the query asks for.
+    ///
+    /// For the migration suite, which reads the documents a backfill produced
+    /// and parses them itself rather than through the store: the store refuses
+    /// to connect to a schema whose `_sqlx_migrations` bookkeeping is not
+    /// complete, and a test that applies migration files by hand has no way to
+    /// forge that bookkeeping -- sqlx checksums it.
+    pub async fn json_rows(&self, sql: &str) -> Vec<serde_json::Value> {
+        let pool = PgPool::connect(&self.url()).await.expect("connect");
+        let rows = sqlx::raw_sql(AssertSqlSafe(sql.to_owned()))
+            .fetch_all(&pool)
+            .await
+            .expect("fetch json");
+        pool.close().await;
+        rows.iter().map(|row| row.get(0)).collect()
+    }
+
     pub async fn count(&self, table: &str) -> i64 {
         let pool = PgPool::connect(&self.url()).await.expect("connect");
         let count: i64 = sqlx::raw_sql(AssertSqlSafe(format!("SELECT count(*) FROM {table}")))
diff --git a/crates/doppel-store-postgres/tests/connect.rs b/crates/doppel-store-postgres/tests/connect.rs
index 42110aa..c54e5f5 100644
--- a/crates/doppel-store-postgres/tests/connect.rs
+++ b/crates/doppel-store-postgres/tests/connect.rs
@@ -77,12 +77,8 @@ async fn two_schemas_do_not_see_each_other() {
     assert_ne!(first.name(), second.name());
     first
         .execute(
-            "INSERT INTO configurations (name, revision, server_host, server_port, \
-                  log_level, log_format, control_socket, templates_dir, admin_host, \
-                  admin_port, admin_auth_header, admin_upload_limit, admin_access) \
-                  VALUES ('only-in-first', 0, '127.0.0.1', 8080, 'info', 'json', \
-                  '/tmp/d.sock', './templates', '127.0.0.1', 8081, 'X-Proxy-Authorization', \
-                  1048576, '{}')",
+            "INSERT INTO configurations (name, revision, settings) \
+                  VALUES ('only-in-first', 0, '{}')",
         )
         .await;
 
diff --git a/crates/doppel-store-postgres/tests/load.rs b/crates/doppel-store-postgres/tests/load.rs
index 72cbbe7..69e993c 100644
--- a/crates/doppel-store-postgres/tests/load.rs
+++ b/crates/doppel-store-postgres/tests/load.rs
@@ -105,124 +105,38 @@ fn parse(yaml: &str) -> doppel_core::Config {
 
 /// Write a configuration into the tables the long way, so `load` is tested
 /// against rows this test wrote rather than against `save`'s idea of them.
-/// Once `save` exists the conformance suite covers the pair; until then this
-/// is the only way `load` can be wrong in isolation and be caught.
+///
+/// "The long way" is much shorter than it was: both tables hold a JSON
+/// document, so this plants the same two shapes `load` reads instead of
+/// interpolating a column per field. The point is unchanged -- these are rows
+/// the store did not produce, so `load` can be wrong in isolation and be
+/// caught.
+///
+/// Dollar quoting rather than escaped apostrophes: a document contains `"` and
+/// may contain `'`, and `$tag$` sidesteps both.
 async fn insert(schema: &TestSchema, name: &str, config: &doppel_core::Config, revision: i64) {
-    let admin = &config.admin;
+    let mut settings = serde_json::to_value(config).expect("a config serializes");
+    settings
+        .as_object_mut()
+        .expect("a config is an object")
+        .remove("proxies");
+
     schema
         .execute(&format!(
-            "INSERT INTO configurations (name, revision, server_host, server_port, log_level, \
-             log_format, control_socket, templates_dir, sentry_dsn, admin_host, admin_port, \
-             admin_auth_header, admin_upload_limit, admin_access) VALUES \
-             ('{name}', {revision}, '{}', {}, '{}', '{}', '{}', '{}', {}, '{}', {}, '{}', {}, '{}')",
-            config.server.host,
-            config.server.port,
-            serde_json::to_value(config.logging.level).unwrap().as_str().unwrap(),
-            serde_json::to_value(config.logging.format).unwrap().as_str().unwrap(),
-            config.control.socket.display(),
-            config.templates.dir.display(),
-            config
-                .sentry
-                .as_ref()
-                .map_or("NULL".to_owned(), |s| format!("'{}'", s.dsn)),
-            admin.host,
-            admin.port,
-            admin.auth.header,
-            admin.upload.limit.get(),
-            serde_json::to_string(&admin.access).unwrap(),
+            "INSERT INTO configurations (name, revision, settings) \
+             VALUES ('{name}', {revision}, $tag${settings}$tag$)"
         ))
         .await;
 
-    for (ordinal, token) in admin.tokens.iter().enumerate() {
-        schema
-            .execute(&format!(
-                "INSERT INTO admin_tokens (config, name, \"group\", token, ordinal) \
-                 VALUES ('{name}', '{}', '{}', '{}', {ordinal})",
-                // `as_str`, not `{}`: `Token`'s `Display` is redacted, so
-                // interpolating it would write the literal `<redacted>` into
-                // every row. This is a test writing raw SQL on purpose -- the
-                // point is to plant rows the store did not produce -- so the
-                // deliberate escape hatch has to be spelled out.
-                token.name,
-                token.group,
-                token.token.as_str()
-            ))
-            .await;
-    }
-
     for (ordinal, proxy) in config.proxies.iter().enumerate() {
-        let nullable = |value: Option<String>| value.unwrap_or_else(|| "NULL".to_owned());
+        let document = serde_json::to_value(proxy).expect("a proxy serializes");
         schema
             .execute(&format!(
-                "INSERT INTO proxies (config, name, ordinal, kind, url, timeout_seconds, \
-                 body_limit, replace_ratio, resolve_kind, resolve_header, loss_percentage, \
-                 loss_status, latency_percentage, latency_min, latency_max, headers, access) \
-                 VALUES ('{name}', '{}', {ordinal}, '{}', '{}', {}, {}, {}, '{}', {}, {}, {}, \
-                 {}, {}, {}, '{}', {})",
-                proxy.name,
-                serde_json::to_value(proxy.kind).unwrap().as_str().unwrap(),
-                proxy.url,
-                nullable(proxy.timeout.map(|t| t.to_string())),
-                proxy.body_limit.get(),
-                nullable(proxy.replace.map(|r| r.to_string())),
-                serde_json::to_value(proxy.resolve.kind)
-                    .unwrap()
-                    .as_str()
-                    .unwrap(),
-                nullable(proxy.resolve.header.as_ref().map(|h| format!("'{h}'"))),
-                nullable(proxy.loss.as_ref().map(|l| l.percentage.to_string())),
-                nullable(proxy.loss.as_ref().map(|l| l.status.to_string())),
-                nullable(proxy.latency.as_ref().map(|l| l.percentage.to_string())),
-                nullable(proxy.latency.as_ref().map(|l| l.min.to_string())),
-                nullable(proxy.latency.as_ref().map(|l| l.max.to_string())),
-                serde_json::to_string(&proxy.headers).unwrap(),
-                nullable(
-                    proxy
-                        .access
-                        .as_ref()
-                        .map(|a| format!("'{}'", serde_json::to_string(a).unwrap()))
-                ),
+                "INSERT INTO proxies (config, name, ordinal, document) \
+                 VALUES ('{name}', '{}', {ordinal}, $tag${document}$tag$)",
+                proxy.name
             ))
             .await;
-
-        for (mock_ordinal, mock) in proxy.mocks.iter().enumerate() {
-            schema
-                .execute(&format!(
-                    "INSERT INTO mocks (config, proxy, name, ordinal, method, url_pattern, \
-                     status, body, json, template, request_headers, request_query, \
-                     request_body, response_headers, proxy_override) VALUES \
-                     ('{name}', '{}', '{}', {mock_ordinal}, '{}', $tag${}$tag$, {}, {}, {}, {}, \
-                     '{}', '{}', '{}', '{}', {})",
-                    proxy.name,
-                    mock.name,
-                    mock.request.method,
-                    mock.request.url,
-                    mock.response.status,
-                    nullable(
-                        mock.response
-                            .body
-                            .as_ref()
-                            .map(|b| format!("$tag${b}$tag$"))
-                    ),
-                    nullable(
-                        mock.response
-                            .json
-                            .as_ref()
-                            .map(|j| format!("$tag${j}$tag$"))
-                    ),
-                    nullable(mock.response.template.as_ref().map(|t| format!("'{t}'"))),
-                    serde_json::to_string(&mock.request.headers).unwrap(),
-                    serde_json::to_string(&mock.request.query).unwrap(),
-                    serde_json::to_string(&mock.request.body).unwrap(),
-                    serde_json::to_string(&mock.response.headers).unwrap(),
-                    nullable(
-                        mock.proxy
-                            .as_ref()
-                            .map(|p| format!("'{}'", serde_json::to_string(p).unwrap()))
-                    ),
-                ))
-                .await;
-        }
     }
 }
 
@@ -343,9 +257,14 @@ async fn an_unknown_configuration_name_is_not_found() {
 
 #[tokio::test]
 async fn a_half_written_latency_is_reported_rather_than_read_as_absent() {
-    // Three columns hold one optional section. A row with some of them set is
-    // one nothing could have written through `save`, so treating it as "no
-    // latency configured" would serve a configuration nobody wrote.
+    // `latency` is an optional section with three required fields. A stored
+    // object missing one is something nothing could have written through
+    // `save`, so reading it as "no latency configured" -- or as a zero -- would
+    // serve a configuration nobody wrote.
+    //
+    // This used to be three columns, where the same hazard was a row with some
+    // of them set. The shape changed; the hazard did not, so neither did the
+    // test.
     let Some(url) = require_database() else {
         return;
     };
@@ -362,7 +281,7 @@ async fn a_half_written_latency_is_reported_rather_than_read_as_absent() {
     )
     .await;
     schema
-        .execute("UPDATE proxies SET latency_max = NULL WHERE name = 'alpha'")
+        .execute("UPDATE proxies SET document = document #- '{latency,max}' WHERE name = 'alpha'")
         .await;
 
     let store = PostgresStore::connect(&schema.url(), "default", schema.templates_dir())
@@ -370,7 +289,11 @@ async fn a_half_written_latency_is_reported_rather_than_read_as_absent() {
         .expect("connect");
     let err = store.load_config().await.expect_err("must be refused");
     let message = format!("{err:?}");
-    assert!(message.contains("latency"), "{message}");
+    // The field serde could not read, and the proxy whose row held it. Either
+    // alone leaves an operator guessing: `max` does not say where, and the proxy
+    // name does not say what.
+    assert!(message.contains("max"), "{message}");
+    assert!(message.contains("alpha"), "{message}");
 
     schema.drop().await;
 }
diff --git a/crates/doppel-store-postgres/tests/migrate.rs b/crates/doppel-store-postgres/tests/migrate.rs
new file mode 100644
index 0000000..1636053
--- /dev/null
+++ b/crates/doppel-store-postgres/tests/migrate.rs
@@ -0,0 +1,397 @@
+//! The 0005 backfill, held to the one property that matters.
+//!
+//! Migration 0005 replaces a column per configuration field with two JSON
+//! documents. The revision of a stored configuration is a hash of its canonical
+//! YAML, and every write compare-and-swaps against it -- so if the JSON the
+//! backfill builds parsed into a configuration that differed from the one the
+//! old columns described, in any way at all, the revision would move. The next
+//! write from a client holding the revision it had read would be refused as a
+//! conflict that never happened, and the operator would see contention where
+//! there was corruption.
+//!
+//! So this suite plants rows in the pre-0005 shape, applies the migration file,
+//! and checks that what comes out parses back into exactly the configuration
+//! that went in -- and that its revision is unchanged.
+//!
+//! It does not go through `PostgresStore`: `connect` refuses a schema whose
+//! `_sqlx_migrations` bookkeeping is incomplete, and a test that applies
+//! migration files by hand cannot forge that bookkeeping, because sqlx
+//! checksums it. The store's own read path is covered by `load.rs` and
+//! `conformance.rs`; what is under test here is the SQL.
+
+use doppel_core::config::{Config, ProxyConfig};
+use doppel_core::store::Revision;
+use doppel_store_postgres::test_support::{TestSchema, require_database};
+
+/// The schema as it stood before 0005, applied in order.
+const BEFORE: &[&str] = &[
+    include_str!("../migrations/0001_initial.sql"),
+    include_str!("../migrations/0002_proxy_rewrite_redirects.sql"),
+    include_str!("../migrations/0003_admin_groups.sql"),
+    include_str!("../migrations/0004_admin_public.sql"),
+];
+
+const JSONB: &str = include_str!("../migrations/0005_settings_as_jsonb.sql");
+
+/// A configuration touching every column 0005 has to carry across: a sentry
+/// section, tokens, a group allow-list, a non-default `enable` and auth header,
+/// both resolve kinds, both fault sections, a replace ratio, an explicit
+/// `rewrite_redirects`, a per-proxy access override, all three mock body forms,
+/// a mock-level proxy override, all three selector maps, and a proxy with no
+/// mocks at all.
+///
+/// Deliberately without `dashboard` and `title`: this is what a configuration
+/// stored before those fields existed looks like, which is the only kind of row
+/// a backfill can encounter.
+const FIXTURE: &str = r#"
+server:
+  host: "127.0.0.1"
+  port: 18080
+logging:
+  level: debug
+  format: text
+control:
+  socket: /tmp/doppel-migrate.sock
+templates:
+  dir: /tmp/doppel-migrate-templates
+sentry:
+  dsn: "https://key@sentry.example.com/1"
+admin:
+  enable: false
+  host: "127.0.0.1"
+  port: 18081
+  auth:
+    header: X-Admin-Token
+  public: false
+  groups: ["admin", "ci"]
+  tokens:
+    - name: ci
+      group: ci
+      token: "0123456789abcdef0123456789abcdef"
+  access:
+    list: public
+    read: [ci]
+    create: [admin]
+    update: [admin]
+    delete: [admin]
+    upload: [admin]
+  upload:
+    limit: 2Mi
+proxies:
+  - name: alpha
+    type: http
+    url: "https://alpha.example.com/api/"
+    timeout: 12
+    body_limit: 4Mi
+    replace: 0.25
+    rewrite_redirects: false
+    headers:
+      X-Injected: "yes"
+    access:
+      read: [ci]
+    loss:
+      percentage: 0.055
+      status: 503
+    latency:
+      percentage: 0.5
+      min: 0.1
+      max: 1.5
+    mocks:
+      - name: first
+        request:
+          method: POST
+          url: "^/widgets$"
+          headers:
+            trace: X-Trace-Id
+          query:
+            filter: ".filter"
+          body:
+            items: ".content.items"
+        response:
+          status: 201
+          json: '{"ok": true}'
+          headers:
+            X-Mocked: "first"
+        proxy:
+          replace: 1.0
+          latency:
+            percentage: 1.0
+            min: 0.2
+            max: 0.4
+      - name: second
+        request:
+          method: GET
+          url: "^/health$"
+        response:
+          status: 200
+          body: "ok"
+      - name: third
+        request:
+          method: GET
+          url: "^/rendered$"
+        response:
+          status: 200
+          template: page.json.j2
+  - name: beta
+    type: http
+    url: "https://beta.example.com/api/"
+    resolve:
+      type: header
+      header: X-Proxy-Name
+"#;
+
+#[tokio::test]
+async fn the_backfill_preserves_every_stored_revision() {
+    let Some(url) = require_database() else {
+        return;
+    };
+    let schema = TestSchema::create(&url).await;
+    for migration in BEFORE {
+        schema.execute(migration).await;
+    }
+
+    let expected = doppel_core::config::load_from_str(FIXTURE).expect("the fixture parses");
+    let revision = Revision::of_config(&expected);
+    insert_pre_0005(&schema, "default", &expected, as_i64(revision)).await;
+
+    schema.execute(JSONB).await;
+
+    // Reassembled the way `load` does: the settings document holds everything
+    // but the proxies, which come from their own rows in `ordinal` order.
+    let settings = schema
+        .json_rows("SELECT settings FROM configurations WHERE name = 'default'")
+        .await;
+    let mut loaded: Config =
+        serde_json::from_value(settings[0].clone()).expect("the backfilled settings parse");
+    loaded.proxies = schema
+        .json_rows("SELECT document FROM proxies WHERE config = 'default' ORDER BY ordinal")
+        .await
+        .into_iter()
+        .map(|document| {
+            serde_json::from_value::<ProxyConfig>(document).expect("a backfilled proxy parses")
+        })
+        .collect();
+
+    // Compared whole rather than field by field: a field this test forgot to
+    // list is exactly the field the backfill is most likely to have dropped.
+    assert_eq!(loaded, expected);
+    assert_eq!(
+        Revision::of_config(&loaded),
+        revision,
+        "the backfill changed a stored revision, which would refuse the next write as a conflict"
+    );
+
+    // And the tables the documents replaced are gone, so nothing can read them
+    // and quietly disagree with the document.
+    for table in ["admin_tokens", "mocks"] {
+        let present: Vec<serde_json::Value> = schema
+            .json_rows(&format!(
+                "SELECT to_jsonb(count(*)) FROM information_schema.tables \
+                 WHERE table_schema = current_schema() AND table_name = '{table}'"
+            ))
+            .await;
+        assert_eq!(present[0], serde_json::json!(0), "{table} still exists");
+    }
+
+    schema.drop().await;
+}
+
+#[tokio::test]
+async fn a_configuration_with_no_tokens_no_sentry_and_no_mocks_survives() {
+    // The absent cases are where a backfill goes wrong: an empty token list has
+    // to stay `[]` rather than becoming null, and `sentry` has a required field,
+    // so `{"dsn": null}` stripped down to `{}` would fail to parse -- which is
+    // why that section is built conditionally rather than stripped.
+    let Some(url) = require_database() else {
+        return;
+    };
+    let schema = TestSchema::create(&url).await;
+    for migration in BEFORE {
+        schema.execute(migration).await;
+    }
+
+    let bare = doppel_core::config::load_from_str(
+        r#"
+server:
+  host: "127.0.0.1"
+  port: 8080
+admin:
+  host: "127.0.0.1"
+  port: 8081
+  tokens: []
+  access: {}
+  upload:
+    limit: 1Mi
+proxies:
+  - name: solo
+    type: http
+    url: "https://example.com/"
+"#,
+    )
+    .expect("the fixture parses");
+    let revision = Revision::of_config(&bare);
+    insert_pre_0005(&schema, "default", &bare, as_i64(revision)).await;
+
+    schema.execute(JSONB).await;
+
+    let settings = schema
+        .json_rows("SELECT settings FROM configurations WHERE name = 'default'")
+        .await;
+    let mut loaded: Config =
+        serde_json::from_value(settings[0].clone()).expect("the backfilled settings parse");
+    assert!(loaded.sentry.is_none(), "sentry must stay absent");
+    assert!(loaded.admin.tokens.is_empty());
+
+    loaded.proxies = schema
+        .json_rows("SELECT document FROM proxies WHERE config = 'default' ORDER BY ordinal")
+        .await
+        .into_iter()
+        .map(|document| serde_json::from_value::<ProxyConfig>(document).expect("a proxy parses"))
+        .collect();
+    assert_eq!(loaded, bare);
+    assert_eq!(Revision::of_config(&loaded), revision);
+
+    schema.drop().await;
+}
+
+fn as_i64(revision: Revision) -> i64 {
+    i64::from_ne_bytes(revision.0.to_ne_bytes())
+}
+
+/// Write a configuration in the shape the schema had before 0005.
+///
+/// Lifted from the version of `tests/load.rs` that planted rows this way, which
+/// is why it interpolates SQL by hand: the whole point is to produce rows the
+/// current code cannot write, so it cannot go through `save`.
+#[allow(clippy::too_many_lines)]
+async fn insert_pre_0005(schema: &TestSchema, name: &str, config: &Config, revision: i64) {
+    let admin = &config.admin;
+    let nullable = |value: Option<String>| value.unwrap_or_else(|| "NULL".to_owned());
+
+    schema
+        .execute(&format!(
+            "INSERT INTO configurations (name, revision, server_host, server_port, log_level, \
+             log_format, control_socket, templates_dir, sentry_dsn, admin_enable, admin_host, \
+             admin_port, admin_auth_header, admin_upload_limit, admin_access, admin_public, \
+             admin_groups) VALUES \
+             ('{name}', {revision}, '{}', {}, '{}', '{}', '{}', '{}', {}, {}, '{}', {}, '{}', {}, \
+             '{}', {}, {})",
+            config.server.host,
+            config.server.port,
+            serde_json::to_value(config.logging.level)
+                .unwrap()
+                .as_str()
+                .unwrap(),
+            serde_json::to_value(config.logging.format)
+                .unwrap()
+                .as_str()
+                .unwrap(),
+            config.control.socket.display(),
+            config.templates.dir.display(),
+            nullable(config.sentry.as_ref().map(|s| format!("'{}'", s.dsn))),
+            admin.enable,
+            admin.host,
+            admin.port,
+            admin.auth.header,
+            admin.upload.limit.get(),
+            serde_json::to_string(&admin.access).unwrap(),
+            nullable(admin.public.map(|p| p.to_string())),
+            nullable(
+                admin
+                    .groups
+                    .as_ref()
+                    .map(|g| format!("'{}'", serde_json::to_string(g).unwrap()))
+            ),
+        ))
+        .await;
+
+    for (ordinal, token) in admin.tokens.iter().enumerate() {
+        schema
+            .execute(&format!(
+                "INSERT INTO admin_tokens (config, name, \"group\", token, ordinal) \
+                 VALUES ('{name}', '{}', '{}', '{}', {ordinal})",
+                // `as_str`, not `{}`: `Token`'s `Display` is redacted, so
+                // interpolating it would write the literal `<redacted>` into
+                // every row.
+                token.name,
+                token.group,
+                token.token.as_str()
+            ))
+            .await;
+    }
+
+    for (ordinal, proxy) in config.proxies.iter().enumerate() {
+        schema
+            .execute(&format!(
+                "INSERT INTO proxies (config, name, ordinal, kind, url, timeout_seconds, \
+                 body_limit, replace_ratio, rewrite_redirects, resolve_kind, resolve_header, \
+                 loss_percentage, loss_status, latency_percentage, latency_min, latency_max, \
+                 headers, access) VALUES ('{name}', '{}', {ordinal}, '{}', '{}', {}, {}, {}, {}, \
+                 '{}', {}, {}, {}, {}, {}, {}, '{}', {})",
+                proxy.name,
+                serde_json::to_value(proxy.kind).unwrap().as_str().unwrap(),
+                proxy.url,
+                nullable(proxy.timeout.map(|t| t.to_string())),
+                proxy.body_limit.get(),
+                nullable(proxy.replace.map(|r| r.to_string())),
+                nullable(proxy.rewrite_redirects.map(|r| r.to_string())),
+                serde_json::to_value(proxy.resolve.kind)
+                    .unwrap()
+                    .as_str()
+                    .unwrap(),
+                nullable(proxy.resolve.header.as_ref().map(|h| format!("'{h}'"))),
+                nullable(proxy.loss.as_ref().map(|l| l.percentage.to_string())),
+                nullable(proxy.loss.as_ref().map(|l| l.status.to_string())),
+                nullable(proxy.latency.as_ref().map(|l| l.percentage.to_string())),
+                nullable(proxy.latency.as_ref().map(|l| l.min.to_string())),
+                nullable(proxy.latency.as_ref().map(|l| l.max.to_string())),
+                serde_json::to_string(&proxy.headers).unwrap(),
+                nullable(
+                    proxy
+                        .access
+                        .as_ref()
+                        .map(|a| format!("'{}'", serde_json::to_string(a).unwrap()))
+                ),
+            ))
+            .await;
+
+        for (mock_ordinal, mock) in proxy.mocks.iter().enumerate() {
+            schema
+                .execute(&format!(
+                    "INSERT INTO mocks (config, proxy, name, ordinal, method, url_pattern, \
+                     status, body, json, template, request_headers, request_query, \
+                     request_body, response_headers, proxy_override) VALUES \
+                     ('{name}', '{}', '{}', {mock_ordinal}, '{}', $tag${}$tag$, {}, {}, {}, {}, \
+                     '{}', '{}', '{}', '{}', {})",
+                    proxy.name,
+                    mock.name,
+                    mock.request.method,
+                    mock.request.url,
+                    mock.response.status,
+                    nullable(
+                        mock.response
+                            .body
+                            .as_ref()
+                            .map(|b| format!("$tag${b}$tag$"))
+                    ),
+                    nullable(
+                        mock.response
+                            .json
+                            .as_ref()
+                            .map(|j| format!("$tag${j}$tag$"))
+                    ),
+                    nullable(mock.response.template.as_ref().map(|t| format!("'{t}'"))),
+                    serde_json::to_string(&mock.request.headers).unwrap(),
+                    serde_json::to_string(&mock.request.query).unwrap(),
+                    serde_json::to_string(&mock.request.body).unwrap(),
+                    serde_json::to_string(&mock.response.headers).unwrap(),
+                    nullable(
+                        mock.proxy
+                            .as_ref()
+                            .map(|p| format!("'{}'", serde_json::to_string(p).unwrap()))
+                    ),
+                ))
+                .await;
+        }
+    }
+}
diff --git a/crates/doppel-store-postgres/tests/save.rs b/crates/doppel-store-postgres/tests/save.rs
index 4c75d30..3d29d4f 100644
--- a/crates/doppel-store-postgres/tests/save.rs
+++ b/crates/doppel-store-postgres/tests/save.rs
@@ -200,9 +200,12 @@ async fn a_rewrite_leaves_no_rows_from_the_previous_version() {
         .expect("shrink");
 
     assert_eq!(schema.count("proxies").await, 1);
-    assert_eq!(schema.count("mocks").await, 1);
     let (loaded, _) = store.load_config().await.expect("load");
     assert_eq!(loaded, one_proxy);
+    // A dropped proxy's mocks used to be a `mocks` row count; they now live
+    // inside the proxy's own document, so deleting the row takes them with it and
+    // what is left to check is that the surviving document kept its own.
+    assert_eq!(loaded.proxies[0].mocks.len(), 1);
 
     schema.drop().await;
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index 29fd3eb..f8396d8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -14,8 +14,23 @@
 #
 # **Doppel itself**, behind a profile, for trying the two together:
 #
+#   mkdir -p config && cp main.example.yaml config/main.yaml
 #   docker compose --profile doppel up -d --wait
 #
+# `make frontend` beforehand is optional and only faster: the image builds the
+# dashboard itself when `frontend/dist` is not there.
+#
+# The copy is not optional and its absence is a confusing failure rather than a
+# clear one: a bind mount whose source does not exist makes Docker create an empty
+# *directory* at that path, and Doppel then reports that it cannot read
+# /etc/doppel/main.yaml.
+#
+# A directory is mounted rather than the file, and that is not a preference. A
+# single-file bind mount makes the file itself a mount point, and a save writes a
+# new file and renames it over the old one -- which no kernel will do over a mount
+# point. Every read worked and every write from the dashboard failed with
+# "Resource busy (os error 16)".
+#
 # The profile is what keeps the two apart. A service carrying one is not
 # started by a bare `docker compose up`, so the test workflow above is
 # unaffected -- and it has to stay that way: running the proxy during a test
@@ -57,17 +72,12 @@ services:
     # Built rather than pulled: there is no published image before the first
     # release, and a local build is what you want anyway when trying a change.
     #
-    # Stage the binary first -- the image copies one in rather than compiling,
-    # and it has to be musl-linked because the base is Alpine:
-    #
-    #   cargo zigbuild --release --target x86_64-unknown-linux-musl -p doppel-cli
-    #   mkdir -p dist && cp target/x86_64-unknown-linux-musl/release/doppel dist/
-    #
-    # On an arm64 machine, substitute aarch64-unknown-linux-musl.
+    # Nothing has to be staged first. The Dockerfile uses a binary from `dist/`
+    # when one is there and compiles its own otherwise, so `docker compose build`
+    # works from a checkout -- it does need the dashboard built, which
+    # `make frontend` does.
     build:
       context: .
-      args:
-        BIN: dist/doppel
 
     ports:
       # Offset like the database's, and for the same reason: a developer
@@ -75,11 +85,27 @@ services:
       - "127.0.0.1:58080:8080"
       - "127.0.0.1:58081:8081"
 
+    environment:
+      DOPPEL_EXTERNAL_URL: "http://127.0.0.1:58080/"
+
     volumes:
-      # The configuration. Read-only: this container has no business editing
-      # the file on your working tree, and `config push`/the admin API write
-      # through the store rather than through this mount.
-      - ./main.example.yaml:/etc/doppel/main.yaml:ro
+      # Your own configuration, not the reference one:
+      #
+      #   mkdir -p config && cp main.example.yaml config/main.yaml
+      #
+      # `config/` is git-ignored, so editing what is in it -- a port, an upstream, a
+      # token -- leaves no diff to explain and nothing to accidentally commit.
+      # Mounting `main.example.yaml` directly, which this used to do, meant every
+      # experiment showed up as a change to a file the documentation quotes.
+      #
+      # The directory, not the file: see the note at the top of this file. Writes
+      # from the admin API replace the configuration by renaming a new file over it,
+      # and a file that is itself a mount point cannot be replaced.
+      #
+      # Read-only: this container has no business editing a file on your working
+      # tree, and `config push` and the admin API write through the store rather
+      # than through this mount.
+      - ./config:/etc/doppel:rw
       # Templates. A named volume rather than a bind mount, and not optional:
       # templates uploaded through the admin API are written here at runtime,
       # and without a volume they vanish with the container.
@@ -90,7 +116,7 @@ services:
         condition: service_healthy
 
     healthcheck:
-      # `/status` on the admin listener: it needs no token by default, answers
+      # `/api/v1/status` on the admin listener: it needs no token by default, answers
       # only once the runtime is compiled and both listeners are bound, and
       # reports the revision actually in force -- which is what "ready" means
       # here, rather than "the process started".
@@ -106,7 +132,7 @@ services:
       # and would sit unhealthy while serving perfectly well; drop the
       # healthcheck in that case rather than pointing it at the proxy port,
       # where every path either reaches an upstream or is a mock.
-      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8081/status"]
+      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8081/api/v1/status"]
       interval: 5s
       timeout: 3s
       # Startup is well under a second; this is slack for a cold container on
diff --git a/docs/assets/icon.png b/docs/assets/icon.png
deleted file mode 100644
index 31e3500..0000000
Binary files a/docs/assets/icon.png and /dev/null differ
diff --git a/docs/development/architecture.md b/docs/development/architecture.md
index c297e4a..29bf6da 100644
--- a/docs/development/architecture.md
+++ b/docs/development/architecture.md
@@ -11,7 +11,7 @@ a network, rendering without HTTP, and the proxy logic without an admin API.
 | `doppel-core` | The configuration model and its types, YAML loading, validation, the `ConfigStore` trait and its file-backed implementation, the compiled runtime, the error model |
 | `doppel-render` | Variable extraction and Jinja2 rendering for mock responses; knows nothing about HTTP |
 | `doppel-proxy` | The proxy listener, resolution, fault injection, mock matching, upstream forwarding, the request pipeline |
-| `doppel-admin` | The admin HTTP API: token access control, proxy CRUD, template files, reload, status, metrics, the OpenAPI document |
+| `doppel-admin` | The admin HTTP API: token access control, proxy CRUD, template files, reload, status, metrics, the OpenAPI document, and the dashboard the build script embeds |
 | `doppel-store-postgres` | `PostgresStore`, and the sqlx migrations that own its schema |
 | `doppel-telemetry` | Logging initialization and optional Sentry |
 | `doppel-cli` | The `doppel` binary: argument parsing, the control channel, and wiring the rest together |
@@ -82,7 +82,7 @@ a handler gets the configuration it judges by.
 `ConfigStore` is the boundary. `FileStore` serialises writers with an advisory
 lock on a sibling `<config>.lock` file; `PostgresStore` uses a conditional
 `UPDATE` inside a transaction. Reads on the PostgreSQL side take one
-`REPEATABLE READ` snapshot, because a configuration is five tables and a
+`REPEATABLE READ` snapshot, because a configuration spans two tables and a
 per-statement snapshot would assemble one from two of them.
 
 One conformance suite runs against both, which is what keeps the trait's
@@ -100,3 +100,72 @@ needs a token the operator may be trying to create.
 The socket is bound inside a private directory and published with a hard link,
 which is atomic *and* exclusive: a second bind fails loudly rather than
 silently taking over a live channel.
+
+## The dashboard
+
+A React application in `frontend/`, built by vite into `frontend/dist`, walked at
+compile time by `crates/doppel-admin/build.rs` and embedded with `include_bytes!`.
+The listener serves `index.html` at `/`, the hashed assets under `/static/`, and
+`robots.txt`; the operator-facing half of this is in
+[The dashboard](../usage/dashboard.md).
+
+Three decisions are worth knowing before changing any of it.
+
+**The assets are embedded, not served from disk.** So `npm run build` alone
+changes nothing about a running binary -- the binary has to be rebuilt after it.
+The build script watches `frontend/dist`, so `cargo build` does re-embed; the trap
+is forgetting the `cargo build`. A binary compiled without `frontend/dist`
+compiles fine and answers 503 at `/`, which keeps
+`cargo install --path crates/doppel-cli` working on a machine with no Node. CI
+sets `DOPPEL_REQUIRE_DASHBOARD_ASSETS` so that concession cannot silently apply
+there, and the release refuses to publish a binary that lacks the page.
+
+**The image builds either way.** `docker build .` uses a binary staged in `dist/`
+when there is one and compiles inside its own builder stage when there is not --
+which is what lets `make image` work on a machine that cannot link musl. The
+release stages binaries built on native runners and points the builder stage at a
+base with no toolchain, so it never pulls a Rust image to run a `cp`. The compile
+branch refuses to run without `frontend/dist`, because a binary built without it
+answers 503 at its own root.
+
+**Settings reach the page through the HTML, not an endpoint.** The listener
+substitutes `{title, public, version, authHeader, refreshMs}` into a
+`application/json` script element per request. Every one of those is known when
+the HTML is written, and a fetch would mean the page cannot draw its own header
+until a round trip finishes. The JSON has its less-than characters escaped, which
+is what makes a hostile `admin.title` a non-event and what allows a content
+security policy with no `unsafe-inline` -- the one inline stylesheet the page
+carries, the code editor's, is named by hash instead.
+
+**The page never decides what the caller may do.** `GET /api/v1/access` reports
+that, evaluated by the same function that enforces it, so a control is disabled
+because the server would have refused rather than because the page guessed.
+
+### Layers
+
+```
+frontend/src/
+  components/   presentational; may not import a service
+  pages/        one screen each: fetches, holds its own state, renders components
+  services/     the only code that talks to the API
+  store/        state that outlives one screen (zustand)
+  types/        the API's shapes, and the one error type
+```
+
+The rule that a component may not reach a service is in `eslint.config.js`, not
+only in review: the first component to grow a `fetch` becomes the one nothing can
+be tested without.
+
+Tests split by what each tool is good for. jest covers services, stores and the
+components that do not route; anything that navigates is covered by Playwright,
+against a real browser and a real binary -- react-router ships ESM only and uses
+`import.meta`, which cannot survive jest's transform to CommonJS. That split is
+not a workaround for a build problem alone: the three bugs the suite found on its
+first run were a stale rights subscription, a field name that disagreed with the
+API, and a CommonJS interop failure that appeared only in the built bundle. None
+were reachable from a unit test.
+
+`frontend/src/__tests__/bundle-size.test.ts` holds the payload to a measured
+budget, and asserts that the entry chunk does not contain prism -- a size limit
+alone would let the highlighter hide in the entry's slack, and then every visitor
+pays for it to list proxies.
diff --git a/docs/development/index.md b/docs/development/index.md
index 719dbb8..de989d6 100644
--- a/docs/development/index.md
+++ b/docs/development/index.md
@@ -58,9 +58,21 @@ the templates directory the integration tests bind and write themselves.
 To bring both up, for trying the two together rather than for testing:
 
 ```bash
+cp main.example.yaml main.yaml   # once; main.yaml is git-ignored
+make frontend                    # the dashboard the image embeds
 docker compose --profile doppel up -d --wait
 ```
 
+The copy matters twice over. It is the file the container mounts, and it is yours
+to edit -- a port, an upstream, a token -- without any of that showing up as a
+change to `main.example.yaml`, which the documentation quotes. It is also not
+optional in a way that fails clearly: a bind mount whose source does not exist
+makes Docker create a directory at that path, and Doppel then reports
+`cannot read /etc/doppel/main.yaml: Is a directory`.
+
+Doppel's own ports are offset -- `58080` and `58081` -- so a container and a
+`cargo run` can be up at once.
+
 Each test creates its own schema and drops it afterwards, so the suites can run
 in parallel against one database.
 
diff --git a/docs/index.md b/docs/index.md
index a194db1..bc9f764 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,5 +1,7 @@
 # Doppel
 
+![Doppel](assets/icon-128.png)
+
 Doppel is a doppelganger for your backend: an HTTP proxy that stands in front
 of a real service, or in place of one that is not there.
 
@@ -33,6 +35,9 @@ including verifying a download and the macOS quarantine case, are on
 - **Serves an admin API** -- proxy CRUD, template upload, reload, status,
   Prometheus metrics and Swagger UI -- behind token access control. See
   [Admin API](usage/admin-api.md).
+- **Serves a dashboard** on that same port's root, compiled into the binary:
+  the proxy set, a form over the whole proxy document, mock templates, status and
+  reload. See [The dashboard](usage/dashboard.md).
 - **Reports to Sentry**, optionally, behind a cargo feature.
 - **Stores its configuration** in a YAML file or in PostgreSQL, with
   `config push` and `config pull` to move between them. See
@@ -72,7 +77,9 @@ the six words the rest of it leans on and shows how a request is handled.
 6. [Changing configuration while it runs](usage/runtime-changes.md) -- reloads,
    tokens, and editing one proxy over HTTP.
 7. [The admin API](usage/admin-api.md) and
-   [PostgreSQL](usage/storage.md) for anything running in more than one place.
+   [the dashboard](usage/dashboard.md) -- driving all of the above over HTTP, or
+   in a browser.
+8. [PostgreSQL](usage/storage.md) for anything running in more than one place.
 
 with the [configuration reference](usage/configuration.md) and the
 [CLI reference](usage/cli.md) at the end for looking things up.
diff --git a/docs/screenshots/screenshot-proxies.webp b/docs/screenshots/screenshot-proxies.webp
new file mode 100644
index 0000000..a3a9a92
--- /dev/null
+++ b/docs/screenshots/screenshot-proxies.webp
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5d7ea2d98ea603d916e66597c536934b6d2684e02fbabb22afafd218df25c1a0
+size 106566
diff --git a/docs/screenshots/screenshot-proxy-edit-yaml.webp b/docs/screenshots/screenshot-proxy-edit-yaml.webp
new file mode 100644
index 0000000..f97d8f7
--- /dev/null
+++ b/docs/screenshots/screenshot-proxy-edit-yaml.webp
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:866ee042a47a762bd571d8ec5e6808f95c720a1b0d72fff20180c9a9ad088a66
+size 107194
diff --git a/docs/screenshots/screenshot-proxy-edit.webp b/docs/screenshots/screenshot-proxy-edit.webp
new file mode 100644
index 0000000..a9eb098
--- /dev/null
+++ b/docs/screenshots/screenshot-proxy-edit.webp
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:614eebd6b5ef1fb16952196b34ae52a7e837efa4bd0e10e4d9ffccbb501e7164
+size 106828
diff --git a/docs/screenshots/screenshot-signin.webp b/docs/screenshots/screenshot-signin.webp
new file mode 100644
index 0000000..742ab8a
--- /dev/null
+++ b/docs/screenshots/screenshot-signin.webp
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:88f89244ed0b18ddcdb8b4dc68c4d7fcd9cd37302936070d08e79235734786cc
+size 103102
diff --git a/docs/usage/admin-api.md b/docs/usage/admin-api.md
index 7b2d15c..59c6732 100644
--- a/docs/usage/admin-api.md
+++ b/docs/usage/admin-api.md
@@ -4,7 +4,7 @@ A second HTTP listener on `admin.host:admin.port`, separate from the proxy
 because the proxy's fallback handler swallows every path -- there is nowhere
 on it an admin route could live.
 
-`admin.enable: false` turns all of it off, including `/status` and `/metrics`,
+`admin.enable: false` turns all of it off, including `/api/v1/status` and `/metrics`,
 and the port is then never bound. See
 [the configuration reference](configuration.md#admin).
 
@@ -126,14 +126,102 @@ would not help.
 | POST | `/api/v1/proxies/{name}/templates/{file}` | `upload` | `204` |
 | DELETE | `/api/v1/proxies/{name}/templates/{file}` | `upload` | `204` |
 | POST | `/api/v1/config/reload` | `update` | `200` |
-| GET | `/status` | none | `200` |
+| GET | `/api/v1/access` | none | `200` |
+| GET | `/api/v1/schema` | none | `200` |
+| GET | `/api/v1/status` | none | `200` |
 | GET | `/metrics` | none | `200` |
 | GET | `/openapi.json` | none | `200` |
 | GET | `/swagger-ui` | none | `200` |
 
-`/status`, `/metrics`, `/openapi.json` and `/swagger-ui` sit outside
-`/api/v1` because they are not resources of the API; they describe or observe
-the process.
+Responses are compressed when the client asks: `br` or `gzip` from
+`Accept-Encoding`, `br` first when both are offered. The proxy listener does not
+do this -- it relays the upstream's own encoding, because that is part of what a
+client is being tested against.
+
+A trailing slash is accepted everywhere: `/metrics/` answers as `/metrics` does.
+Axum stopped redirecting between the two spellings, and a 404 for a slash is a
+poor answer for a path an operator typed. The proxy listener is deliberately not
+like this -- a proxied path is relayed byte for byte, because `/orders/` and
+`/orders` are two resources upstream.
+
+`/api/v1/status` sits outside `/api/v1` because it is not a resource of the API;
+it reports on the process. `/metrics`, `/openapi.json` and `/swagger-ui/` sit
+outside `/api/` altogether: those paths are what a scraper, a client generator
+and a browser look for by default, and none of the three is a resource of the API
+either.
+
+Everything the API serves is under `/api/`. That is a boundary rather than a
+convention: with `admin.dashboard` on, a `GET` outside `/api/` and `/static/` is
+answered with the dashboard's page, so a client-side route survives being reloaded
+or bookmarked. Inside `/api/` an unknown path still answers `404` in the envelope,
+so a mistyped endpoint cannot hand a client an HTML document to parse, and a `POST`
+to a path that does not exist is refused rather than answered with a page.
+
+The dashboard also serves `/robots.txt` and its hashed assets under `/static/`.
+None of that is in the OpenAPI document, which describes the API; see
+[The dashboard](dashboard.md).
+
+### What the caller may do
+
+`GET /api/v1/access` reports the calling token's own rights. It answers `200` for
+everybody, anonymous included: an endpoint whose purpose is to say "you may do
+nothing" cannot itself require a right, and it discloses nothing that attempting
+the six actions would not.
+
+```json
+{
+  "caller": { "kind": "token", "name": "ci", "group": "ops" },
+  "global": {
+    "list": true, "read": true, "create": false,
+    "update": false, "delete": false, "upload": false
+  },
+  "proxies": {
+    "alpha": { "read": true, "update": false, "delete": false, "upload": false }
+  }
+}
+```
+
+- `caller` is `{"kind": "anonymous"}` for a request with no token, or with one
+  this configuration does not recognise -- the two are deliberately not
+  distinguished.
+- `global` is the six actions as `admin.access` decides them for this caller.
+- `proxies` gives the four overridable actions per proxy, with that proxy's own
+  `access` block applied. It is **absent** -- not empty -- when the caller may not
+  `list`: the map is keyed by proxy name, so returning it would be a proxy listing
+  by another route.
+
+Every value is the same decision the endpoint itself would make, evaluated by the
+same code. It exists so a client can disable an action instead of offering it and
+being refused; it is not a substitute for handling `401` and `403`, since rights
+can change under a running page.
+
+### The configuration schema
+
+`GET /api/v1/schema` returns the configuration document as a JSON Schema
+(2020-12), from the process that is going to read it. No token, for the same
+reason as above: it describes the shape of a configuration, never the contents of
+one, and the identical bytes are published in the repository and attached to every
+release.
+
+```bash
+curl -s http://127.0.0.1:8081/api/v1/schema | jq '.["$defs"].ProxyName'
+```
+
+```json
+{
+  "description": "Letters, digits, `-` and `_`, between 2 and 32 characters.",
+  "maxLength": 32,
+  "minLength": 2,
+  "pattern": "^[A-Za-z0-9_-]{2,32}$",
+  "type": "string"
+}
+```
+
+Use it to check a document before pushing it, and to build an editor that knows
+the rules: it is generated from the same Rust types that enforce them, so it
+cannot describe a field that does not exist or a bound nobody applies. See
+[Editor support](configuration.md#editor-support) for the other two copies and
+when to prefer which.
 
 ### Bodies
 
@@ -148,9 +236,17 @@ back:
 version of something that already exists, and accepting one on a create would
 let a client that meant to send a `PUT` overwrite a proxy it never read.
 
-A `PUT` whose body names a different proxy than the path is refused. The name
-is also the template directory, so a rename through `PUT` would strand the old
-directory.
+A `PUT` whose body names a different proxy than the path **renames it**. The name
+is also where the templates live, so the rename moves them: the proxy answers at the
+new path, the old one is a `404`, and every template file the proxy had is under the
+new name. A name another proxy already holds is refused with `400`
+`CONFIG_INVALID`.
+
+The configuration is written before the templates are moved, because the write is
+what authorises moving them. If the move then fails -- a permission problem, a full
+disk -- the reply says so in full: the proxy has the new name and its templates are
+still under the old one, so a mock naming a template file fails to render until they
+are moved by hand.
 
 ## Templates
 
@@ -173,6 +269,24 @@ Deleting a proxy removes its templates. Updating one removes the templates no
 remaining mock names. Both happen *after* the configuration write, so a
 rejected change leaves every file in place.
 
+### A write is in force when it answers
+
+`POST`, `PUT` and `DELETE` promote the stored configuration to the running one
+before they reply, so a `200` means the process is serving what you just wrote:
+the next request through the proxy listener goes to the new upstream, and
+`GET /api/v1/status` reports the new revision. No reload in between.
+
+It used to take one, and that was a trap worth naming: the write returned `200`,
+the API read the new document back, and the traffic kept going where it went
+before -- the API agreeing with the operator while the process disagreed with
+both.
+
+If the promotion itself fails -- the store became unreadable, or another writer
+left the document invalid between the save and the load -- the response says so
+and names both halves: the configuration is stored, the process is still running
+the previous one, and `POST /api/v1/config/reload` retries. The write is not
+undone, because it is not this process's to undo.
+
 ## Reload
 
 `POST /api/v1/config/reload` promotes the stored configuration to the running
@@ -200,11 +314,17 @@ the configuration file out of band could add a token for themselves and reload
 it into effect.
 
 Same effect as `doppel config reload`, and the two share one implementation
-and one mutex, so they cannot swap runtimes in the wrong order.
+and one mutex -- with the writes above, which promote through the same path, so
+none of the three can swap runtimes in the wrong order.
+
+What is left for it, now that a write applies itself: a configuration changed
+**behind** the API. An operator editing `main.yaml`, `doppel config push`, another
+instance writing to the same database -- none of those pass through a handler, so
+none of them can promote themselves.
 
 ## Status
 
-`GET /status` reports what the process is serving right now -- from the
+`GET /api/v1/status` reports what the process is serving right now -- from the
 running runtime, not from the store, because a configuration written but not
 reloaded is not what this process is doing.
 
@@ -244,6 +364,7 @@ and an oversized body all carry the envelope rather than an empty body.
 | `METHOD_NOT_ALLOWED` | 405 | The path exists and does not accept that verb; the response also carries `Allow` |
 | `PROXY_NOT_RESOLVED` | 404 | No proxy matched and there is no default |
 | `NO_PROXIES_CONFIGURED` | 503 | The configuration names no proxies at all. See [No proxies configured](proxying.md#no-proxies-configured) |
+| `DASHBOARD_NOT_BUILT` | 503 | `GET /` on a binary compiled without the dashboard's assets. See [When the root answers 503](dashboard.md#when-the-root-answers-503) |
 | `CONFLICT` | 409 | The name exists, or the store is under sustained contention |
 | `REVISION_MISMATCH` | 409 | The proxy changed since it was read |
 | `UPLOAD_TOO_LARGE` | 413 | A template body over `admin.upload.limit`, or a configuration document over 1 MiB |
@@ -263,9 +384,14 @@ tell "that already exists" from "you are holding a stale copy".
 ## OpenAPI
 
 `GET /openapi.json` serves a document generated from the handlers themselves,
-so it cannot describe an endpoint this binary does not serve. `GET
-/swagger-ui` serves a browser UI over it, with the assets built into the
-binary rather than fetched at runtime.
+so it cannot describe an endpoint this binary does not serve. `GET /swagger-ui/`
+serves a browser UI over it, with the assets built into the binary rather than
+fetched at runtime.
+
+The UI sits outside `/api/` because it is a page rather than an endpoint: it is
+served to a browser, it belongs beside the dashboard's own pages, and an ingress
+routing `/api/*` to a JSON service would otherwise hand a browser HTML through a
+JSON path.
 
 Both are unauthenticated: they describe the API rather than expose any of it,
 and a client cannot authenticate before it knows how.
diff --git a/docs/usage/configuration.md b/docs/usage/configuration.md
index d894bcf..09bb124 100644
--- a/docs/usage/configuration.md
+++ b/docs/usage/configuration.md
@@ -23,6 +23,17 @@ That URL follows `main`. Every release also attaches the schema as an asset, so
 a deployment that pins a version can validate against the schema for exactly
 that version rather than for whatever is current.
 
+A running Doppel serves its own:
+
+```bash
+curl -s http://127.0.0.1:8081/api/v1/schema | jq .
+```
+
+No token, because it describes the shape of a configuration rather than the
+contents of one. This is the copy to check a document against before pushing it,
+since it comes from the process that is going to read it -- the dashboard uses it
+for exactly that, both while a field is being typed and in its YAML editor.
+
 The schema is generated from the same Rust types this page documents -- see
 [`doppel config schema`](cli.md#config-schema) -- so it cannot describe a field
 that does not exist, and CI fails if the checked-in copy falls behind.
@@ -115,6 +126,8 @@ The admin listener's address, its tokens, and who may do what.
 ```yaml
 admin:
   enable: true
+  dashboard: true
+  title: "Doppel"
   host: "0.0.0.0"
   port: 8081
   public: false
@@ -138,7 +151,7 @@ admin:
 
 `enable` defaults to `true`. Set it to `false` to run the proxy with no admin
 application at all: the port is never bound, so it cannot collide with
-anything, and `/status`, `/metrics`, `/openapi.json` and the whole API are
+anything, and `/api/v1/status`, `/metrics`, `/openapi.json` and the whole API are
 gone with it. The proxy listener and the control socket are untouched, which
 makes `doppel config reload` the only remaining way in.
 
@@ -147,6 +160,14 @@ because nothing serves it is a trap set for whoever turns the listener on
 later, and they will not re-read the rules first -- so rule V34 still refuses
 a public write action with the listener off.
 
+`dashboard` defaults to `true` and serves the browser dashboard from this
+listener's root: `/`, `/static/{path}` and `/robots.txt`. `false` leaves those
+three unrouted -- they answer 404 like any other unknown path -- and changes
+nothing about the JSON API. `title` is the heading that dashboard shows and the
+browser tab's name, at most 64 characters and free of control characters,
+defaulting to `Doppel`. Both take effect on restart, since the routes are built
+once. See [The dashboard](dashboard.md).
+
 Toggling it takes effect on restart, not on reload; a reload reports `admin`
 among the sections it could not apply.
 
@@ -238,7 +259,7 @@ it has to be a choice, not what happens when the section is left out.
 Setting a *write* action to `public` is refused outright (rule V34); no
 configuration wants an unauthenticated caller rewriting the proxy set.
 
-`GET /status` stays unauthenticated regardless: it reports names, upstreams
+`GET /api/v1/status` stays unauthenticated regardless: it reports names, upstreams
 and counts, and strips any credentials from the upstream before printing
 it.
 
diff --git a/docs/usage/dashboard.md b/docs/usage/dashboard.md
new file mode 100644
index 0000000..009231f
--- /dev/null
+++ b/docs/usage/dashboard.md
@@ -0,0 +1,285 @@
+# The dashboard
+
+![The proxy list: each proxy with its upstream, how it is resolved, the faults on it and how many mocks it has](../screenshots/screenshot-proxies.webp)
+
+The admin listener serves a browser dashboard from its own root. It lists the
+proxies, edits them, shows what the process is doing, and reloads the configuration --
+most of what the admin API does, without curl. Template files are the exception, and
+deliberately: see [below](#what-the-pages-do).
+
+It is on by default. Open the admin port in a browser:
+
+```
+http://127.0.0.1:8081/
+```
+
+The whole thing is compiled into the binary. There is nothing to deploy, no
+directory to serve, and no version of the page that can disagree with the version
+of Doppel serving it.
+
+It is served compressed: the listener negotiates `br` and `gzip` from
+`Accept-Encoding`, so the 140 KB of JavaScript and CSS the page is made of goes
+out as 74 KB or less, and `index.html` is minified on the way into the binary.
+The proxy listener is deliberately left out of that -- a client under test has to
+see the encoding its upstream chose.
+
+Every URL the dashboard shows is a real one. `/proxies/alpha` can be bookmarked,
+reloaded and shared, because everything outside `/api/` and `/static/` is answered
+with the page -- which is also why the API lives under `/api/` in the first place:
+`/status` used to be an endpoint *and* a page, and a reload got the JSON.
+
+---
+
+## Turning it on and off
+
+```yaml
+admin:
+  dashboard: true      # the default
+  title: "Doppel"      # the default
+```
+
+`dashboard: false` leaves `/`, `/static/*` and `/robots.txt` unrouted -- they
+answer 404 like any other unknown path -- and changes nothing about the JSON API.
+Use it when the admin port is reachable from somewhere a browser page has no
+business being. To turn off the admin API entirely, that is `admin.enable`, not
+this.
+
+Both fields take effect on restart, because the routes are built once at startup.
+
+`title` is what the header shows and what the browser tab is called. It is worth
+setting when several Doppels are open at once:
+
+```yaml
+admin:
+  title: "billing-api (staging)"
+```
+
+At most 64 characters, no control characters, and any language you like -- it is a
+heading, not an identifier.
+
+Leave `title` out and the header shows the project's wordmark instead of a default
+string. Set it, and the header shows exactly what you wrote: the browser tab takes
+the same text either way.
+
+---
+
+## Who can use it
+
+The dashboard is a client of the admin API and is bound by exactly the same
+`access` rules. It has no privileges of its own, and there is no dashboard
+password: the token is the one from `admin.tokens`.
+
+What follows from that is worth stating plainly, because it surprises people:
+
+**The page works without a token.** If `access.list` and `access.read` are
+`public`, an anonymous visitor sees the proxy list and can open a proxy. The token
+dialog opens once, and it has a "Continue without a token" button -- declining
+leaves a working page rather than a wall.
+
+**A refusal offers the two things that fix it.** "Read of `alpha` requires access
+`read`" is about the token, and a page reads once when it opens -- so the banner
+carries **Enter token** and **Refresh**. Refreshing is a button rather than something
+the page does when a token arrives: a form holds a half-typed document, and replacing
+that because someone signed in elsewhere would lose work.
+
+![The token dialog over a refusal: the banner naming the access `list` needs and carrying Enter token and Refresh, and the dialog offering Continue without a token beside Use this token](../screenshots/screenshot-signin.webp)
+
+**Actions the caller may not perform are visible but disabled**, with the reason
+in the tooltip. The page asks the server what the caller may do
+(`GET /api/v1/access`) rather than guessing, so a disabled button means the server
+would have refused. A missing button reads as a broken page; a disabled one
+explains itself.
+
+**Signing out returns to the anonymous view.** It does not lock the page.
+
+### The token in the browser
+
+Entering a token stores it in `localStorage` for one hour, then the page forgets
+it and asks again. Two things that is not:
+
+- **Not a session.** The token does not expire on the server. Forgetting it here
+  only means this browser stops presenting it. Revoking a token is a
+  configuration change -- edit `admin.tokens` and reload.
+- **Not a security boundary.** Anything running in the page can read
+  `localStorage`. The hour exists so an unattended browser stops holding a working
+  admin token indefinitely, which is a smaller and more honest claim.
+
+On a `public: true` deployment the page never mentions tokens at all.
+
+---
+
+## What the pages do
+
+**Proxies** lists every proxy with its upstream, how it is resolved, the faults
+configured on it and how many mocks it has. The list refetches itself once a
+minute -- so a change made by another operator, by `doppel config push`, or by a
+reload appears without anyone pressing anything. It pauses while the tab is
+hidden.
+
+Editing opens a form over the whole proxy document: the upstream, timeouts, body
+limits, resolution, injected headers, the three fault settings, per-proxy access
+overrides, and the mocks with their matching rules and responses.
+
+![Editing a proxy: name, type and upstream always on screen, an (i) beside each label, Save and Cancel pinned to the bottom](../screenshots/screenshot-proxy-edit.webp)
+
+Every field carries an (i) to its section of [Every
+parameter](parameters.md) -- the type, the bounds, an example in place -- and the
+link is versioned, so it describes the Doppel serving the page rather than whatever
+has been released since.
+
+A field is checked as it is typed: a name with a space in it, a timeout of 5000, a
+loss rate of 45, a selector without its leading dot. Those bounds are read from
+[`GET /api/v1/schema`](admin-api.md#the-configuration-schema) at load, so they are
+the server's own rules rather than a second copy in the page -- and what needs more
+than one field to judge is still the server's answer on save, reported against the
+field it is about.
+
+A proxy has thirteen fields and any number of mocks, and most edits touch one of
+them -- so the name, the type and the upstream are always on screen and everything
+else is a folded section that says what is inside it: `Faults none`,
+`Access overrides inherited`, `Mocks 3`. Save and Cancel sit in a bar pinned to the
+bottom of the window, so they are reachable whatever is open.
+
+On a `public: true` deployment the `Access overrides` section is not there at all.
+Nothing in a proxy's `access` block decides anything while the admin API is
+unauthenticated -- every action answers as public regardless, which the process
+also says among its startup advisories -- so four fields that change no outcome
+would be the page disagreeing with the binary serving it. A proxy whose document
+still holds overrides says so in one line instead, because the YAML mode shows an
+`access` block the form otherwise has no section for.
+
+The name can be edited like any other field. Renaming moves the proxy's template
+files with it, and the page says which happened -- "Renamed alpha to billing-api"
+rather than "Updated". Clients selecting that proxy by `X-Proxy-Name` have to use the
+new name from then on, which is the one thing a rename cannot do for you.
+
+**A save that removes something asks first**, and names what: `the mock
+\`one-widget\``, `the injected header \`X-Trace\``, `\`filter\` from variables from the
+query of \`one-widget\``. The form has a Remove button beside every entry and no undo,
+so the question belongs on the button that makes those removals real rather than on
+each one along the way -- taking one mock out and putting another in is a single edit.
+A save that only changes values does not ask: a changed field is visible in the field
+it is in.
+
+Deleting a proxy asks too, and says what goes with it: its template files.
+
+Saving sends the revision the form was loaded at, so a proxy someone else changed
+in the meantime is refused rather than overwritten -- the page says so and asks you
+to reload.
+
+### Editing a proxy as YAML
+
+**Edit as YAML** swaps the form for the whole proxy document, in the shape
+`main.yaml` has it:
+
+```yaml
+name: alpha
+type: http
+url: https://alpha.example.com/api/
+timeout: 30
+mocks:
+  - name: one-widget
+    request:
+      method: GET
+      url: ^/widgets/(?P<id>\d+)$
+    response:
+      status: 200
+      json: '{"id": "{{ id }}"}'
+```
+
+![The same proxy as YAML: one coloured editor over the whole document, with Reformat and a documentation link above it](../screenshots/screenshot-proxy-edit-yaml.webp)
+
+The form is better for changing one field; this is better for everything else --
+pasting a proxy from a colleague, reordering mocks, copying a block out of a
+configuration file. Tab indents inside the document, **Reformat** tidies it, and
+saving tidies it too, so a refused save leaves readable YAML on screen.
+
+It is checked against the running Doppel's own schema as you type, and Save is
+refused while it does not match: a field the schema does not know is named, and so
+is a value out of range. What needs more than one field to judge is still the
+server's answer.
+
+Two things it does not do. It does not keep comments -- the document is stored as
+data, so there is nowhere to put them -- and it edits one proxy rather than the
+whole configuration. For the whole file, edit `main.yaml` and reload.
+
+**Template files are not managed here.** The dashboard had a section for them and it
+was the wrong shape: a file store inside a form over a document, with a Save of its
+own that did not wait for the form's, and a rule the page could not enforce -- the
+server refuses an upload no saved mock declares. They stay in the
+[admin API](admin-api.md#templates), which is where `doppel config push` and any
+script already write them.
+
+What the form does with a mock that answers with a template file: it shows which file,
+in a field it will not let you edit, and lets you move that mock onto a text or JSON
+body instead. A mock that has no template cannot be given one from here -- the answer
+choices are Text body and JSON body. Switching away from a template is undoable while
+the page is open, because the name cannot be typed back in.
+
+**Status** shows uptime, the configuration revision in effect and the resolution
+state of each proxy, and carries the reload button. Saving in the form needs no
+reload -- a write through the API is in force when it answers -- so the button is
+for a configuration changed behind the dashboard: `main.yaml` edited by hand,
+`doppel config push`, another instance. Reload re-reads the store and reports what
+it applied, including the sections that need a restart instead.
+
+**API** is not a page of the dashboard but a link to the Swagger UI the same
+listener serves, at `/swagger-ui/`. It opens in a new tab, because it is a
+different application and going there should not throw away a half-filled form.
+
+---
+
+## Theme
+
+Light, dark, or whatever the operating system says. The default is the last of
+those, and the choice is remembered per browser.
+
+---
+
+## Not indexed
+
+The dashboard refuses search engines three ways, because crawlers fail
+differently: an `X-Robots-Tag: noindex, nofollow, noarchive` header on every
+response including the errors, a `robots` meta element in the page for a crawler
+that reads markup and ignores headers, and `robots.txt` disallowing everything.
+
+The page also carries a content security policy that permits scripts, styles and
+connections from this origin only, and forbids framing. No `unsafe-inline`
+anywhere: the configuration reaches the page as the contents of a JSON element
+rather than as an inline script.
+
+One inline stylesheet is allowed, and by its hash rather than by opening the
+policy -- the code editor's own, which every editor on the page renders. Blocking it
+changed nothing visible and reported a violation to the console for each editor,
+which is a poor way to treat the place an operator looks for their own problems. A
+test recomputes that hash from the installed library, so an upgrade that changes the
+stylesheet fails a build rather than filling a console.
+
+---
+
+## When the root answers 503
+
+```json
+{
+  "status": "error",
+  "code": "DASHBOARD_NOT_BUILT",
+  "message": "this binary was built without the dashboard's static assets ..."
+}
+```
+
+The binary was compiled without `frontend/dist`. Released binaries and the
+published image always carry the dashboard -- the release refuses to publish one
+that does not, and `docker build` builds the assets itself when they are absent --
+so this is a binary built from source without building the frontend first:
+
+```bash
+npm --prefix frontend ci
+npm --prefix frontend run build
+cargo build --release -p doppel-cli
+```
+
+That order matters: the assets are embedded at compile time, so rebuilding them
+without rebuilding the binary changes nothing about what it serves.
+
+If Node is not available and the JSON API is enough, `admin.dashboard: false`
+stops the route being served at all, which is a clearer answer than a 503.
diff --git a/docs/usage/docker.md b/docs/usage/docker.md
index ca56556..81eca2d 100644
--- a/docs/usage/docker.md
+++ b/docs/usage/docker.md
@@ -34,7 +34,7 @@ start.
 ```bash
 docker run --rm \
   -p 8080:8080 -p 8081:8081 \
-  -v "$PWD/main.yaml:/etc/doppel/main.yaml:ro" \
+  -v "$PWD/config:/etc/doppel" \
   -v doppel-templates:/var/lib/doppel/templates \
   loremdev/doppel:1.2.3-alpine
 ```
@@ -42,6 +42,16 @@ docker run --rm \
 Two mounts, and the second is not optional if you use templates at all --
 see [Templates](#templates) below.
 
+**Mount the directory, not the file.** `-v "$PWD/main.yaml:/etc/doppel/main.yaml"`
+looks tidier and breaks every write: a save puts the new configuration in a
+temporary file and renames it over the old one, and nothing can rename over a mount
+point. Reads work, so the dashboard lists proxies happily and then refuses to save
+one with `Resource busy (os error 16)`. With the directory mounted, the
+configuration inside it is an ordinary file and the rename stays within the mount.
+
+Add `:ro` to the mount if nothing should write the configuration -- then the admin
+API's writes are refused for a reason it can state.
+
 The configuration must bind `0.0.0.0` rather than `127.0.0.1`, or nothing
 outside the container can reach it:
 
@@ -68,7 +78,7 @@ missing volume.
 docker volume create doppel-templates
 docker run --rm \
   -p 8080:8080 -p 8081:8081 \
-  -v "$PWD/main.yaml:/etc/doppel/main.yaml:ro" \
+  -v "$PWD/config:/etc/doppel" \
   -v doppel-templates:/var/lib/doppel/templates \
   loremdev/doppel:1.2.3-alpine
 ```
@@ -100,8 +110,10 @@ curl -X POST -H "X-Proxy-Authorization: Bearer $TOKEN" \
 docker exec <container> doppel config reload --socket /tmp/doppel.sock
 ```
 
-Editing a bind-mounted `main.yaml` on the host changes the file the container
-reads, so a reload picks it up without restarting anything.
+Editing `config/main.yaml` on the host changes the file the container reads, so a
+reload picks it up without restarting anything. It works the other way too: a write
+through the admin API rewrites that file, in canonical form -- so comments in it do
+not survive an edit made from the dashboard.
 
 ## Tokens
 
@@ -133,17 +145,17 @@ services:
       - "8080:8080"
       - "8081:8081"
     volumes:
-      - ./main.yaml:/etc/doppel/main.yaml:ro
+      - ./config:/etc/doppel
       - doppel-templates:/var/lib/doppel/templates
     environment:
       DOPPEL_ADMIN_TOKENS: '{"ci":{"token":"...","group":"admin"}}'
     healthcheck:
-      # `/status` needs no token by default and answers only once the runtime
+      # `/api/v1/status` needs no token by default and answers only once the runtime
       # is compiled and both listeners are bound. `-f` matters: without it
       # curl exits 0 on a 500 and the check passes for answering at all rather
       # than for answering correctly. The port is the one inside the
       # container.
-      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8081/status"]
+      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8081/api/v1/status"]
       interval: 5s
       timeout: 3s
       start_period: 5s
@@ -170,23 +182,68 @@ an `https` upstream, and every request fails with `UPSTREAM_ERROR`.
 
 ## Building it yourself
 
-The binary is built outside the Dockerfile and copied in. Building Rust inside
-a multi-architecture `buildx` means QEMU for the non-native architecture, which
-turns a two-minute compile into most of an hour. Releases build each
-architecture on a runner of that architecture instead.
+```bash
+make image
+```
+
+That builds the dashboard, then the image. Nothing else is needed and no Rust
+toolchain has to be able to target Linux: when `dist/` holds no binary the
+Dockerfile compiles one in its own builder stage, for the platform being built,
+and the builder stage is discarded -- the published image is Alpine plus the
+binary, around 65 MB.
+
+`make image-rebuild` does the same with no npm or docker cache, and with `dist/`
+emptied first so the compile definitely happens.
+
+### Why it prefers a staged binary
+
+`docker build .` uses `dist/<platform>/doppel`, or `dist/doppel`, if either is
+there, and compiles only when neither is. That preference is what keeps releases
+fast: building Rust inside a multi-architecture `buildx` means QEMU for the
+non-native architecture, which turns a two-minute compile into most of an hour.
+The release workflow builds each architecture on a runner of that architecture,
+stages the two binaries, and points the builder stage at a base with no toolchain
+in it -- so the release never pulls a Rust image to run a `cp`.
+
+To stage one by hand, on Linux with `musl-tools` installed:
 
 ```bash
-# On Linux, with musl-tools installed:
 CC_x86_64_unknown_linux_musl=musl-gcc \
 CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=musl-gcc \
   cargo build --release --target x86_64-unknown-linux-musl -p doppel-cli
 mkdir -p dist && cp target/x86_64-unknown-linux-musl/release/doppel dist/
-docker build --build-arg BIN=dist/doppel -t doppel:dev .
+docker build -t doppel:dev .
 ```
 
-On macOS there is no musl toolchain to install; `cargo zigbuild` or `cross`
-will produce the binary if you want to build the image locally from there.
+It has to be a musl build. A glibc binary does not run on Alpine, and the failure
+is a bare `not found` from the shell rather than anything that says why. On macOS
+there is no musl toolchain to install, which is the reason the Dockerfile compiles
+inside: `ring` builds C, so a musl target needs a musl C compiler and not only the
+Rust standard library for it.
+
+### The dashboard
+
+It is embedded at compile time, so the compile branch needs it: a binary built
+without `frontend/dist` starts, serves the API and answers 503 at its own root. The
+image therefore builds it when the context has no `frontend/dist`, with the
+`nodejs`/`npm` packages installed in the builder stage for exactly that.
+
+```
+doppel: no dashboard in frontend/dist, building it
+```
+
+Building it on the host first is faster and is what `make image` does -- a working
+checkout has it already, and `npm ci` inside a container downloads the whole
+dependency tree again. It is not required.
+
+### When it refuses to build
+
+Two refusals, both deliberate:
 
-It has to be a musl build. A glibc binary does not run on Alpine, and the
-failure is a bare `not found` from the shell rather than anything that says
-why.
+- **"there is no built dashboard ... and no frontend sources"** -- neither
+  `frontend/dist` nor the files `vite build` reads reached the context. That means
+  `.dockerignore` was edited, or the build ran from somewhere other than the
+  repository root. Stage a binary, or fix the context.
+- **"this builder image has no Rust toolchain"** -- something passed
+  `--build-arg BUILDER=` naming an image without cargo, and there was no staged
+  binary to copy. Stage one, or drop the argument.
diff --git a/docs/usage/faults.md b/docs/usage/faults.md
index ce02490..0ad27fe 100644
--- a/docs/usage/faults.md
+++ b/docs/usage/faults.md
@@ -227,7 +227,7 @@ because it needs both fields.
 
 ## What faults do not do
 
-- They do not apply to the admin listener. `/status` and `/metrics` answer
+- They do not apply to the admin listener. `/api/v1/status` and `/metrics` answer
   normally while the proxy is dropping traffic, which is what makes them
   usable for watching it happen.
 - They are not recorded separately in metrics. A lost request appears as its
diff --git a/docs/usage/getting-started.md b/docs/usage/getting-started.md
index 8b8efac..bb508a7 100644
--- a/docs/usage/getting-started.md
+++ b/docs/usage/getting-started.md
@@ -123,3 +123,16 @@ forwarding it:
 Everything else still goes upstream. See [Mocks and templating](mocks.md) for
 variables, templates, and the ordering rule that matters once you have more
 than one mock.
+
+## Or do all of that in a browser
+
+The admin port serves a dashboard from its root:
+
+```
+http://127.0.0.1:8081/
+```
+
+The proxy set, a form over every field of a proxy, the mock templates, and the
+reload button -- the same admin API this page drives with curl, with the same
+token rules. `admin.dashboard: false` turns it off. See
+[The dashboard](dashboard.md).
diff --git a/docs/usage/observability.md b/docs/usage/observability.md
index ee0a22e..edf7c46 100644
--- a/docs/usage/observability.md
+++ b/docs/usage/observability.md
@@ -63,16 +63,52 @@ sending events, in the same position a URL carries a password.
 `GET /metrics` on the admin listener, in the Prometheus text format,
 unauthenticated because a scraper has nowhere to put a token.
 
+The one endpoint outside `/api/`. `metrics_path` defaults to `/metrics` in
+Prometheus and in every agent and annotation that scrapes one, so the path is
+settled by something larger than this project -- and a scrape of `/metrics` while
+the exposition was under `/api/v1/` was answered by the dashboard with `200
+text/html`, which reads as a parse failure or as no metrics at all.
+
+### Traffic
+
 | Metric | Type | Labels |
 |---|---|---|
-| `doppel_proxy_request_duration_seconds` | histogram | `proxy`, `method`, `status` |
+| `doppel_proxy_request_duration_seconds` | histogram | `proxy`, `method`, `status`, `replace`, `loss`, `upstream_error` |
 | `doppel_upstream_request_duration_seconds` | histogram | `proxy`, `method`, `status` |
+| `doppel_admin_request_duration_seconds` | histogram | `route`, `method`, `status` |
 | `doppel_loss_total` | counter | `proxy` |
 | `doppel_latency_injected_total` | counter | `proxy` |
 | `doppel_mock_hits_total` | counter | `proxy`, `mock` |
 
-Buckets are explicit -- 5ms to 10s -- rather than the exporter's default
-summary, because a quantile cannot be aggregated across replicas.
+`replace`, `loss` and `upstream_error` are `1` or `0`, and independent: a mock can
+answer a request its own loss roll then drops, and `upstream_error` covers a
+transport failure, a timeout, and a relayed status of 500 or above.
+
+`route` on the admin histogram is the route template -- `/api/v1/proxies/{name}`,
+never `/api/v1/proxies/alpha` -- so a hundred proxies are one series and a query
+string is none. A request that matched no route is recorded with an empty `route`.
+
+Buckets are explicit rather than the exporter's default summary, because a
+quantile cannot be aggregated across replicas. Two ladders: 5ms to 60s for
+proxied traffic, because `latency` injection is asked to be slow on purpose, and
+5ms to 5s for the admin API, where nothing has any business taking longer.
+
+### State
+
+These exist from startup, before anything has happened, because a panel and an
+alert both read a never-recorded metric as "no data" -- which is
+indistinguishable from a process nobody is scraping.
+
+| Metric | Type | Labels | Meaning |
+|---|---|---|---|
+| `doppel_build_info` | gauge | `version` | Always `1`. The version is a label because it is not a number |
+| `doppel_dashboard_info` | gauge | `enabled` | Always `1`. Separate from the build: one describes the artifact, the other what this deployment turned on |
+| `doppel_proxy_last_error_timestamp_seconds` | gauge | `code` | When the proxy listener last answered with that error. Starts as `code=""`, value `0` |
+| `doppel_proxy_mocks` | gauge | `proxy` | Mocks per proxy in the configuration **now in effect**, republished on every reload and every write through the API. A proxy that leaves the configuration goes to `0` rather than keeping its last count |
+
+"Is it still failing" is `time() - doppel_proxy_last_error_timestamp_seconds`,
+which is why the metric is a timestamp and not a counter: a counter answers "how
+many" and needs a rate window to say anything about now.
 
 Every request through the proxy listener appears in the proxy histogram,
 including one that was dropped by loss injection or that resolved to no proxy
diff --git a/docs/usage/parameters.md b/docs/usage/parameters.md
new file mode 100644
index 0000000..ba36571
--- /dev/null
+++ b/docs/usage/parameters.md
@@ -0,0 +1,1463 @@
+<!--
+  Generated by scripts/parameters_doc.py from doppel-config.schema.json.
+  Do not edit by hand: `make gate` fails when this file and the schema disagree.
+-->
+
+# Every parameter
+
+Every field a configuration document may carry, with its type, its bounds and an
+example. Generated from [the schema](configuration.md#editor-support), which is
+generated from the Rust types that enforce the rules -- so a bound stated here is
+the bound the server applies.
+
+The dashboard links here: the (i) beside a field opens that field's section.
+
+For how the pieces fit together, read [Configuration
+reference](configuration.md); for how to use them, the guides under Usage.
+
+---
+
+## `admin` { #admin }
+
+The admin API's listener, its tokens, and who may do what.
+
+| | |
+|---|---|
+| Type | object |
+| Required | yes |
+| Rules | no unknown keys |
+
+```yaml
+admin:
+  host: 127.0.0.1
+  port: 8080
+  upload:
+    limit: 1048576
+```
+
+### `admin.access` { #admin-access }
+
+Who may perform each admin action. Every action defaults to the
+`admin` group, reads included.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `admin.access.create` { #admin-access-create }
+
+Add a proxy. Refused for `public` by rule V34.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+admin:
+  access:
+    create: public
+```
+
+### `admin.access.delete` { #admin-access-delete }
+
+Remove a proxy. Refused for `public` by rule V34.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+admin:
+  access:
+    delete: public
+```
+
+### `admin.access.list` { #admin-access-list }
+
+List the proxies. A listing exposes upstream URLs and injected headers.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+admin:
+  access:
+    list: public
+```
+
+### `admin.access.read` { #admin-access-read }
+
+Read one proxy document, credentials in its `url` included.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+admin:
+  access:
+    read: public
+```
+
+### `admin.access.update` { #admin-access-update }
+
+Replace a proxy. Refused for `public` by rule V34.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+admin:
+  access:
+    update: public
+```
+
+### `admin.access.upload` { #admin-access-upload }
+
+Upload or delete a template file. Refused for `public` by rule V34.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+admin:
+  access:
+    upload: public
+```
+
+### `admin.auth` { #admin-auth }
+
+Which header carries the bearer token.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `admin.auth.header` { #admin-auth-header }
+
+The header a caller presents its token in, as `Bearer <token>`.
+Defaults to `X-Proxy-Authorization`.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+admin:
+  auth:
+    header: X-Request-Id
+```
+
+### `admin.dashboard` { #admin-dashboard }
+
+Serve the browser dashboard from the admin listener's root.
+
+On by default. Off means `/`, `/static/*` and `/robots.txt` are not
+routed at all and answer 404 like any other unknown path; the JSON API is
+untouched either way.
+
+An `Option` and skipped when absent, for the reason given on `groups`:
+adding it must not change the canonical YAML of configurations written
+before it existed. Read it through
+[`AdminConfig::is_dashboard_enabled`].
+
+| | |
+|---|---|
+| Type | boolean |
+| Required | no |
+
+```yaml
+admin:
+  dashboard: true
+```
+
+### `admin.enable` { #admin-enable }
+
+Whether to run the admin listener at all.
+
+Defaults to on. Off means the port is never bound and no admin task
+starts; the proxy and the control socket are untouched, so
+`doppel config reload` still works and is then the only way in.
+
+The validation rules do not consult this. A configuration that is only
+safe because nothing serves it is a trap set for whoever turns the
+listener on later, and they will not re-read the rules first.
+
+| | |
+|---|---|
+| Type | boolean |
+| Required | no |
+
+```yaml
+admin:
+  enable: true
+```
+
+### `admin.groups` { #admin-groups }
+
+Which names `access` may reference, here and in a proxy's overrides.
+
+`["*"]`, the default, allows any. A concrete list allows exactly those:
+`["admin", "ci"]` permits `admin` and `ci` and refuses `user`.
+
+`[]` names nobody, which leaves no action anything to reference -- so it
+means the same thing as `public: true`, and is treated as it. It used to
+mean a configuration with no legal value for `create`, `update`, `delete`
+or `upload`: V36 refused their `admin` default and V34 refused `public`,
+so the document could not be written at all.
+
+`public` and `admin` are never governed by this. `public` is the absence
+of a subject rather than a name; `admin` is the fallback every action
+already has, and a list that revoked it would produce the same
+unsatisfiable state as `[]` once did.
+
+Checked by rule V36, not by this type: it compares one field against
+another, which is what is left for the rule set once the types have taken
+everything they can decide alone.
+
+An `Option` rather than a `Vec` defaulting to `["*"]`, and skipped when
+absent, so that adding this field did not change the canonical YAML of
+every configuration written before it existed. The revision is derived
+from that YAML, so a materialised default would have made every stored
+configuration fail its own revision check on the first load after the
+upgrade. Read it through [`AdminConfig::allowed_groups`].
+
+| | |
+|---|---|
+| Type | array |
+| Required | no |
+
+```yaml
+admin:
+  groups:
+    - "*"
+```
+
+### `admin.host` { #admin-host }
+
+An IP address, not a hostname: a name would have to be resolved,
+and which address it resolves to is not the configuration's to
+decide. `utoipa` has no schema for `IpAddr`, so it is described
+here as the string it is written as.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+
+```yaml
+admin:
+  host: 127.0.0.1
+```
+
+### `admin.port` { #admin-port }
+
+The TCP port the admin API listens on. Must differ from
+`server.port`.
+
+| | |
+|---|---|
+| Type | integer |
+| Required | yes |
+| Rules | 1 to 65535 |
+
+```yaml
+admin:
+  port: 8080
+```
+
+### `admin.public` { #admin-public }
+
+Serve the whole admin API unauthenticated.
+
+`false` by default. `true` makes every action `public` and leaves no name
+to reference, so `groups` is effectively empty and `access` effectively
+all-public -- whatever either of them says. Anything they did say is
+reported as a startup advisory rather than refused, so a configuration
+being made temporarily public does not have to be gutted first and
+rebuilt afterwards.
+
+This overrides rule V34, which otherwise refuses a public write action.
+V34 exists so that an unauthenticated writable proxy set cannot happen by
+omission; a field named `public` set to `true` is not an omission. Think
+of it as the flag V34 was holding the line for.
+
+An `Option` and skipped when absent, for the reason given on `groups`:
+adding it must not change the canonical YAML of configurations written
+before it existed. Read it through [`AdminConfig::is_public`].
+
+| | |
+|---|---|
+| Type | boolean |
+| Required | no |
+
+```yaml
+admin:
+  public: true
+```
+
+### `admin.title` { #admin-title }
+
+The heading the dashboard shows, and the browser tab's title.
+
+Defaults to `Doppel`. Useful when several Doppels are open at once and
+the tabs are otherwise identical.
+
+An `Option` and skipped when absent, for the same reason as `dashboard`.
+Read it through [`AdminConfig::title`].
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+| Rules | 1 to 64 characters |
+
+```yaml
+admin:
+  title: billing-api (staging)
+```
+
+### `admin.tokens` { #admin-tokens }
+
+The tokens that may call the admin API. Names and token values are
+each unique. `DOPPEL_ADMIN_TOKENS` can supply these instead.
+
+| | |
+|---|---|
+| Type | list of object |
+| Required | no |
+
+```yaml
+admin:
+  tokens:
+    - name: billing-api
+      group: billing-api
+      token: replace-me-00000000000000000000000
+```
+
+### `admin.tokens[].group` { #admin-tokens-group }
+
+The group it belongs to. `admin` and `user` are predefined; any other
+name must be carried by at least one token.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | matches `^[A-Za-z0-9_-]{2,64}$`; 2 to 64 characters |
+
+```yaml
+admin:
+  tokens:
+    - group: billing-api
+```
+
+### `admin.tokens[].name` { #admin-tokens-name }
+
+What to call this token in `access` lists and in logs. Never the
+secret itself.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | matches `^[A-Za-z0-9_-]{2,64}$`; 2 to 64 characters |
+
+```yaml
+admin:
+  tokens:
+    - name: billing-api
+```
+
+### `admin.tokens[].token` { #admin-tokens-token }
+
+The secret the caller sends. A version 4 UUID is the recommended
+shape.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | 32 to 255 characters |
+
+```yaml
+admin:
+  tokens:
+    - token: replace-me-00000000000000000000000
+```
+
+### `admin.upload` { #admin-upload }
+
+Bounds an uploaded template file.
+
+| | |
+|---|---|
+| Type | object |
+| Required | yes |
+| Rules | no unknown keys |
+
+```yaml
+admin:
+  upload:
+    limit: 1048576
+```
+
+### `admin.upload.limit` { #admin-upload-limit }
+
+Largest template file the admin API accepts. A larger upload is
+refused with `413`.
+
+| | |
+|---|---|
+| Type | integer or string |
+| Required | yes |
+| Rules | 1 to 1073741824 |
+
+```yaml
+admin:
+  upload:
+    limit: 1048576
+```
+
+---
+
+## `control` { #control }
+
+The Unix socket `doppel config reload` talks to.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `control.socket` { #control-socket }
+
+Path to the control socket, created with mode 0600 and removed on
+shutdown. Its parent directory must already exist.
+A filesystem path. `utoipa` has no schema for `PathBuf`, so it is
+described as the string it is written as.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+control:
+  socket: /tmp/doppel.sock
+```
+
+---
+
+## `logging` { #logging }
+
+Log level and output format.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `logging.format` { #logging-format }
+
+`json` for machines, `text` for a terminal.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+| Rules | one of `json`, `text` |
+
+```yaml
+logging:
+  format: json
+```
+
+### `logging.level` { #logging-level }
+
+The lowest level that is logged. `RUST_LOG` overrides it when set and
+non-empty.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+| Rules | one of `trace`, `debug`, `info`, `warn`, `error` |
+
+```yaml
+logging:
+  level: trace
+```
+
+---
+
+## `proxies` { #proxies }
+
+The proxies this instance serves, in the order they are tried.
+
+May be empty or left out: Doppel then starts and serves the admin API,
+and a request is answered `503 NO_PROXIES_CONFIGURED` until a proxy is
+added by reload or over that API.
+
+| | |
+|---|---|
+| Type | list of object |
+| Required | no |
+
+```yaml
+proxies:
+  - name: billing-api
+    type: http
+    url: https://example.com/api/
+```
+
+### `proxies[].access` { #proxies-access }
+
+Overrides the admin `access` rules for this proxy alone.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `proxies[].access.delete` { #proxies-access-delete }
+
+Who may remove this proxy. Absent leaves the global rule.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+proxies:
+  - access:
+      delete: public
+```
+
+### `proxies[].access.read` { #proxies-access-read }
+
+Who may read this proxy's document. Absent leaves the global rule.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+proxies:
+  - access:
+      read: public
+```
+
+### `proxies[].access.update` { #proxies-access-update }
+
+Who may replace this proxy. Absent leaves the global rule.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+proxies:
+  - access:
+      update: public
+```
+
+### `proxies[].access.upload` { #proxies-access-upload }
+
+Who may upload templates for this proxy. Absent leaves the global rule.
+
+| | |
+|---|---|
+| Type | string or list of string |
+| Required | no |
+
+```yaml
+proxies:
+  - access:
+      upload: public
+```
+
+### `proxies[].body_limit` { #proxies-body_limit }
+
+Bounds the request body a matched mock is allowed to buffer in order
+to extract from it; phase 1 streams bodies deliberately, and reading
+`.content.items` needs the whole thing in hand. See rule V33.
+
+| | |
+|---|---|
+| Type | integer or string |
+| Required | no |
+| Rules | 1 to 1073741824 |
+
+```yaml
+proxies:
+  - body_limit: 1048576
+```
+
+### `proxies[].headers` { #proxies-headers }
+
+Headers injected into every outbound request, overriding whatever the
+client sent by the same name.
+
+| | |
+|---|---|
+| Type | map of string to string |
+| Required | no |
+
+```yaml
+proxies:
+  - headers:
+      X-Request-Id: staging
+```
+
+### `proxies[].latency` { #proxies-latency }
+
+Makes a share of requests take a chosen time. Applies to mocked
+responses too; a mock may override the figure.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+```yaml
+proxies:
+  - latency:
+      percentage: 0.25
+      min: 0.25
+      max: 0.25
+```
+
+### `proxies[].latency.max` { #proxies-latency-max }
+
+Upper bound of the delay, in seconds. Must be at least `min`.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 300 |
+
+```yaml
+proxies:
+  - latency:
+      max: 0.25
+```
+
+### `proxies[].latency.min` { #proxies-latency-min }
+
+Lower bound of the delay, in seconds. The delay is a target for the
+whole response: time the upstream already spent is subtracted.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 300 |
+
+```yaml
+proxies:
+  - latency:
+      min: 0.25
+```
+
+### `proxies[].latency.percentage` { #proxies-latency-percentage }
+
+The share of requests to delay, as a fraction.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 1 |
+
+```yaml
+proxies:
+  - latency:
+      percentage: 0.25
+```
+
+### `proxies[].loss` { #proxies-loss }
+
+Drops a share of requests rather than forwarding them. Not applied to
+a request a mock answered.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+```yaml
+proxies:
+  - loss:
+      percentage: 0.25
+      status: 200
+```
+
+### `proxies[].loss.percentage` { #proxies-loss-percentage }
+
+The share of requests to drop, as a fraction. `0.1` is one in ten.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 1 |
+
+```yaml
+proxies:
+  - loss:
+      percentage: 0.25
+```
+
+### `proxies[].loss.status` { #proxies-loss-status }
+
+The status a dropped request is answered with, rather than being left
+to hang.
+
+| | |
+|---|---|
+| Type | integer |
+| Required | yes |
+| Rules | 100 to 599 |
+
+```yaml
+proxies:
+  - loss:
+      status: 200
+```
+
+### `proxies[].mocks` { #proxies-mocks }
+
+Mocks in the order they are tried. First match wins, and patterns are
+unanchored, so a general one placed first shadows the rest.
+
+| | |
+|---|---|
+| Type | list of object |
+| Required | no |
+
+```yaml
+proxies:
+  - mocks:
+      - name: billing-api
+        request:
+          method: GET
+          url: "/api/(?P<id>\\d+)/"
+        response:
+          status: 200
+```
+
+### `proxies[].mocks[].name` { #proxies-mocks-name }
+
+Names this mock in the `mock` log field and the hit counter. Unique
+within the proxy.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | matches `^[A-Za-z0-9_-]{2,64}$`; 2 to 64 characters |
+
+```yaml
+proxies:
+  - mocks:
+      - name: billing-api
+```
+
+### `proxies[].mocks[].proxy` { #proxies-mocks-proxy }
+
+Per-mock overrides of the proxy's `replace`, `loss` and `latency`.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `proxies[].mocks[].proxy.latency` { #proxies-mocks-proxy-latency }
+
+Replaces the proxy's `latency` for this mock's responses, rather than
+adding to it.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          latency:
+            percentage: 0.25
+            min: 0.25
+            max: 0.25
+```
+
+### `proxies[].mocks[].proxy.latency.max` { #proxies-mocks-proxy-latency-max }
+
+Upper bound of the delay, in seconds. Must be at least `min`.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 300 |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          latency:
+            max: 0.25
+```
+
+### `proxies[].mocks[].proxy.latency.min` { #proxies-mocks-proxy-latency-min }
+
+Lower bound of the delay, in seconds. The delay is a target for the
+whole response: time the upstream already spent is subtracted.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 300 |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          latency:
+            min: 0.25
+```
+
+### `proxies[].mocks[].proxy.latency.percentage` { #proxies-mocks-proxy-latency-percentage }
+
+The share of requests to delay, as a fraction.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 1 |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          latency:
+            percentage: 0.25
+```
+
+### `proxies[].mocks[].proxy.loss` { #proxies-mocks-proxy-loss }
+
+Drops a share of the requests this mock would have answered. Not
+inherited from the proxy: a mock without it is never dropped.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          loss:
+            percentage: 0.25
+            status: 200
+```
+
+### `proxies[].mocks[].proxy.loss.percentage` { #proxies-mocks-proxy-loss-percentage }
+
+The share of requests to drop, as a fraction. `0.1` is one in ten.
+
+| | |
+|---|---|
+| Type | number |
+| Required | yes |
+| Rules | 0 to 1 |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          loss:
+            percentage: 0.25
+```
+
+### `proxies[].mocks[].proxy.loss.status` { #proxies-mocks-proxy-loss-status }
+
+The status a dropped request is answered with, rather than being left
+to hang.
+
+| | |
+|---|---|
+| Type | integer |
+| Required | yes |
+| Rules | 100 to 599 |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          loss:
+            status: 200
+```
+
+### `proxies[].mocks[].proxy.replace` { #proxies-mocks-proxy-replace }
+
+Overrides the proxy's `replace` for requests this mock matches.
+
+| | |
+|---|---|
+| Type | number |
+| Required | no |
+| Rules | 0 to 1 |
+
+```yaml
+proxies:
+  - mocks:
+      - proxy:
+          replace: 0.25
+```
+
+### `proxies[].mocks[].request` { #proxies-mocks-request }
+
+What this mock matches, and what it takes out of the request.
+
+| | |
+|---|---|
+| Type | object |
+| Required | yes |
+| Rules | no unknown keys |
+
+```yaml
+proxies:
+  - mocks:
+      - request:
+          method: GET
+          url: "/api/(?P<id>\\d+)/"
+```
+
+### `proxies[].mocks[].request.body` { #proxies-mocks-request-body }
+
+Variable name -> selector such as `.content.items`.
+
+| | |
+|---|---|
+| Type | map of string to string |
+| Required | no |
+
+```yaml
+proxies:
+  - mocks:
+      - request:
+          body:
+            key: .content.items
+```
+
+### `proxies[].mocks[].request.headers` { #proxies-mocks-request-headers }
+
+Variable name -> request header name.
+
+| | |
+|---|---|
+| Type | map of string to string |
+| Required | no |
+
+```yaml
+proxies:
+  - mocks:
+      - request:
+          headers:
+            key: X-Request-Id
+```
+
+### `proxies[].mocks[].request.method` { #proxies-mocks-request-method }
+
+The method this mock answers, matched exactly and upper case.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | one of `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `TRACE`, `CONNECT`, `QUERY`, `PROPFIND`, `PROPPATCH`, `MKCOL`, `COPY`, `MOVE`, `LOCK`, `UNLOCK` |
+
+```yaml
+proxies:
+  - mocks:
+      - request:
+          method: GET
+```
+
+### `proxies[].mocks[].request.query` { #proxies-mocks-request-query }
+
+Variable name -> selector such as `.filter`.
+
+| | |
+|---|---|
+| Type | map of string to string |
+| Required | no |
+
+```yaml
+proxies:
+  - mocks:
+      - request:
+          query:
+            key: .content.items
+```
+
+### `proxies[].mocks[].request.url` { #proxies-mocks-request-url }
+
+A regex matched against the request path, unanchored. Named capture
+groups become template variables.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+
+```yaml
+proxies:
+  - mocks:
+      - request:
+          url: "/api/(?P<id>\\d+)/"
+```
+
+### `proxies[].mocks[].response` { #proxies-mocks-response }
+
+What it answers with.
+
+| | |
+|---|---|
+| Type | object |
+| Required | yes |
+| Rules | no unknown keys |
+
+```yaml
+proxies:
+  - mocks:
+      - response:
+          status: 200
+```
+
+### `proxies[].mocks[].response.body` { #proxies-mocks-response-body }
+
+A template rendered and sent as `text/plain`. Exclusive with `json` and
+`template`.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+proxies:
+  - mocks:
+      - response:
+          body: widget {{ id }} is ready
+```
+
+### `proxies[].mocks[].response.headers` { #proxies-mocks-response-headers }
+
+Header name -> template producing the value.
+
+The value is a template, not a header value: what it renders to is
+only a header value once a request has been served, which is checked
+there. The name is a name now.
+
+| | |
+|---|---|
+| Type | map of string to string |
+| Required | no |
+
+### `proxies[].mocks[].response.json` { #proxies-mocks-response-json }
+
+A template whose rendered output must be valid JSON, sent as
+`application/json`. Exclusive with `body` and `template`.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+proxies:
+  - mocks:
+      - response:
+          json: "{\"id\": \"{{ id }}\"}"
+```
+
+### `proxies[].mocks[].response.status` { #proxies-mocks-response-status }
+
+The status to answer with.
+
+| | |
+|---|---|
+| Type | integer |
+| Required | yes |
+| Rules | 100 to 599 |
+
+```yaml
+proxies:
+  - mocks:
+      - response:
+          status: 200
+```
+
+### `proxies[].mocks[].response.template` { #proxies-mocks-response-template }
+
+A template file under this proxy's template directory. Read per request,
+so it may be uploaded after the configuration was loaded. Exclusive with
+`body` and `json`.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+| Rules | at most 200 characters |
+
+```yaml
+proxies:
+  - mocks:
+      - response:
+          template: put.json.j2
+```
+
+### `proxies[].name` { #proxies-name }
+
+Names this proxy in `X-Proxy-Name`, in metrics labels, in log lines
+and as its template subdirectory. Unique within the document.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | matches `^[A-Za-z0-9_-]{2,32}$`; 2 to 32 characters |
+
+```yaml
+proxies:
+  - name: billing-api
+```
+
+### `proxies[].replace` { #proxies-replace }
+
+What share of requests a matching mock actually answers; the rest go
+upstream. Defaults to 1.0, so a matching mock answers.
+
+| | |
+|---|---|
+| Type | number |
+| Required | no |
+| Rules | 0 to 1 |
+
+```yaml
+proxies:
+  - replace: 0.25
+```
+
+### `proxies[].resolve` { #proxies-resolve }
+
+How a request is matched to this proxy: by header, or as the default.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `proxies[].resolve.header` { #proxies-resolve-header }
+
+The header carrying the proxy name. Required when `type: header`, and
+meaningless otherwise.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+proxies:
+  - resolve:
+      header: X-Request-Id
+```
+
+### `proxies[].resolve.type` { #proxies-resolve-type }
+
+`default` takes anything unclaimed; `header` takes requests naming
+this proxy in `header`.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+| Rules | one of `default`, `header` |
+
+```yaml
+proxies:
+  - resolve:
+      type: default
+```
+
+### `proxies[].rewrite_redirects` { #proxies-rewrite_redirects }
+
+Whether a redirect whose `Location` points back into the space this
+proxy forwards is rewritten to point at Doppel instead. Absent means
+enabled.
+
+On by default because the alternative is a silent failure: `Host` is
+replaced with the upstream's authority, so the upstream's `Location`
+names the upstream, and a client following it leaves Doppel -- along with
+every fault and every mock -- with nothing reported. Turn it off to have
+the response relayed byte for byte, which is what a client being tested
+*against redirect handling itself* needs.
+
+| | |
+|---|---|
+| Type | boolean |
+| Required | no |
+
+```yaml
+proxies:
+  - rewrite_redirects: true
+```
+
+### `proxies[].rewrite_urls` { #proxies-rewrite_urls }
+
+Whether the upstream's own address is rewritten to Doppel's inside the
+bodies this proxy relays. Absent means enabled.
+
+The same problem `rewrite_redirects` solves, one layer down: a page, a
+script or a JSON document that names `https://api.example.com/v2/` sends
+the client straight there on the next request, past every fault and every
+mock. Rewriting the body keeps it inside Doppel.
+
+Only the exact host is replaced. `https://cdn.api.example.com/` is a
+different host and is left alone, because Doppel does not proxy it and
+pointing it at itself would break a page rather than keep it working.
+
+Only text bodies, and only ones the upstream did not compress. Turn it off
+for a client being tested against the bytes the upstream actually sent.
+
+| | |
+|---|---|
+| Type | boolean |
+| Required | no |
+
+```yaml
+proxies:
+  - rewrite_urls: true
+```
+
+### `proxies[].timeout` { #proxies-timeout }
+
+Bounds the whole upstream exchange, in seconds. Exceeding it is
+`504 UPSTREAM_TIMEOUT`. Defaults to 30.
+
+| | |
+|---|---|
+| Type | integer |
+| Required | no |
+| Rules | 1 to 3600 |
+
+```yaml
+proxies:
+  - timeout: 30
+```
+
+### `proxies[].type` { #proxies-type }
+
+What it forwards. `http` is the only value.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+| Rules | one of `http` |
+
+```yaml
+proxies:
+  - type: http
+```
+
+### `proxies[].url` { #proxies-url }
+
+The upstream base. A request path is grafted underneath it, and the
+result can never escape it -- so a base with a path confines the proxy
+to that subtree.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+
+```yaml
+proxies:
+  - url: https://example.com/api/
+```
+
+---
+
+## `sentry` { #sentry }
+
+Optional error reporting. Absent, or an empty DSN, disables it.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+```yaml
+sentry:
+  dsn: https://key@o0.ingest.sentry.io/0
+```
+
+### `sentry.dsn` { #sentry-dsn }
+
+The Sentry DSN to report to. Empty disables reporting, so a deployment
+can blank it without removing the section.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+
+```yaml
+sentry:
+  dsn: https://key@o0.ingest.sentry.io/0
+```
+
+---
+
+## `server` { #server }
+
+Where the proxy listens for the traffic being forwarded or mocked.
+
+| | |
+|---|---|
+| Type | object |
+| Required | yes |
+| Rules | no unknown keys |
+
+```yaml
+server:
+  host: 127.0.0.1
+  port: 8080
+```
+
+### `server.external_url` { #server-external_url }
+
+Where clients reach this Doppel, when that is not `host:port`.
+
+Behind a container port mapping, a load balancer or an ingress, the
+address Doppel bound is not the address a client used -- and a rewritten
+`Location` has to name the second. Doppel cannot infer it: `Host` is a
+claim by the caller, and building a redirect out of it hands the caller
+the redirect.
+
+Absent, `host` and `port` are used, with a wildcard bind (`0.0.0.0`, `::`)
+read as loopback -- which is right for a laptop or a pod reached at its
+own address, and wrong behind a port mapping or an ingress, where the
+client used neither. Doppel logs the address it settled on at startup.
+
+`DOPPEL_EXTERNAL_URL` overrides it. Part of `server`, so a change takes a
+restart like the rest of that section.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+server:
+  external_url: https://doppel.example.com/
+```
+
+### `server.host` { #server-host }
+
+An IP address, not a hostname: a name would have to be resolved,
+and which address it resolves to is not the configuration's to
+decide. `utoipa` has no schema for `IpAddr`, so it is described
+here as the string it is written as.
+
+| | |
+|---|---|
+| Type | string |
+| Required | yes |
+
+```yaml
+server:
+  host: 127.0.0.1
+```
+
+### `server.port` { #server-port }
+
+The TCP port proxied traffic arrives on. Must differ from
+`admin.port`.
+
+| | |
+|---|---|
+| Type | integer |
+| Required | yes |
+| Rules | 1 to 65535 |
+
+```yaml
+server:
+  port: 8080
+```
+
+---
+
+## `templates` { #templates }
+
+Where mock template files are read from and uploaded to.
+
+| | |
+|---|---|
+| Type | object |
+| Required | no |
+| Rules | no unknown keys |
+
+### `templates.dir` { #templates-dir }
+
+Directory holding mock templates, one subdirectory per proxy. Created
+at startup if absent.
+A filesystem path. `utoipa` has no schema for `PathBuf`, so it is
+described as the string it is written as.
+
+| | |
+|---|---|
+| Type | string |
+| Required | no |
+
+```yaml
+templates:
+  dir: ./templates
+```
diff --git a/docs/usage/proxying.md b/docs/usage/proxying.md
index a3958df..bcaa679 100644
--- a/docs/usage/proxying.md
+++ b/docs/usage/proxying.md
@@ -131,11 +131,12 @@ proxies:
 ```
 
 With a base of `https://api.example.com/v2/`, an upstream answering
-`Location: https://api.example.com/v2/orders/7` produces `Location: /orders/7`
-to the client. Query and fragment survive.
+`Location: https://api.example.com/v2/orders/7` produces
+`Location: http://127.0.0.1:8080/orders/7` to the client. Query and fragment
+survive.
 
-Relative rather than absolute, so Doppel never has to guess its own public
-name: the client resolves it against the URL it used, which is Doppel's.
+The host in that answer is Doppel's own, and where it comes from is
+[Doppel's own address](#doppels-own-address) below.
 
 !!! warning "Why this is on by default"
     `Host` is not relayed, so the upstream answers with its *own* authority in
@@ -147,11 +148,94 @@ name: the client resolves it against the URL it used, which is Doppel's.
     `nginx` has `proxy_redirect` for this and Apache `ProxyPassReverse`, both on
     by default, for the same reason.
 
-A target that is **not** under the proxy's base is genuinely elsewhere and is
-left pointing there, stated as an absolute URL. That covers a subtler case too:
-an upstream answering `Location: /login` under a base of `/v2/` means its own
-root, so relaying the header as-is would have the client come back asking for
-`/v2/login` -- a different resource nobody named.
+A target on the upstream's own host but **outside** the proxy's base is kept on
+Doppel too, with the path the upstream wrote: an upstream answering
+`Location: /login` under a base of `/v2/` produces
+`Location: http://127.0.0.1:8080/login`. This is what `nginx`'s `proxy_redirect`
+does, and it is the case the relative form could not express -- relayed as-is,
+the client would come back asking for `/v2/login`, a different resource nobody
+named, and pointed at the upstream it leaves Doppel altogether.
+
+Whether Doppel serves that path is a question about the configuration rather than
+about the rewrite: `/login` reaches `<base>/login`, so a proxy whose base has a
+prefix will forward it under that prefix. That is visible in the logs and fixable
+in the configuration, which the silent escape was not.
+
+A target on **another host** is left pointing there, absolutely. Doppel does not
+proxy it, and naming itself in a redirect to somewhere it cannot serve would be a
+lie.
+
+## Urls in a body
+
+The same problem one layer down, and on by default for the same reason:
+
+```yaml
+proxies:
+  - name: backend
+    url: "https://api.example.com/v2/"
+    rewrite_urls: true    # the default
+```
+
+A page, a script or a JSON document that names `https://api.example.com/v2/orders`
+sends the client straight to the upstream on its next request -- past every
+injected fault and every mock, with nothing logged. Doppel replaces its own address
+into the body instead: that URL becomes `http://127.0.0.1:8080/orders`, and one on
+the same host outside the proxied path keeps its own path, exactly as a rewritten
+redirect does. `nginx` calls this `sub_filter`.
+
+**Only the exact host.** `https://cdn.api.example.com/` is a different host, is not
+proxied by this proxy, and is left alone -- pointing it here would break the page
+rather than keep it working. A host that merely starts the same, like
+`https://api.example.com.evil.test/`, is left alone too.
+
+Three more limits, each of which relays the body untouched rather than guessing:
+
+- **Text only**, by `Content-Type`: `text/*`, JSON, JavaScript, XML and the `+json`
+  and `+xml` suffixes. An image cannot carry a URL that matters, and buffering one
+  to look is how a proxy runs out of memory.
+- **Uncompressed only.** A body with a `Content-Encoding` is relayed as it came;
+  the client asked the upstream for that encoding.
+- **Bounded by `body_limit`.** Rewriting needs the whole body, so it is buffered up
+  to that ceiling; a bigger body streams on from where the buffering stopped.
+
+A rewritten body loses the `ETag` and digest headers that described the upstream's
+version of it, and carries the length it now has. A conditional request with the
+upstream's validator would otherwise be answered `304` for content the client has
+never seen.
+
+Set `rewrite_urls: false` for a client being tested against the bytes the upstream
+actually sent.
+
+## Doppel's own address
+
+Rewriting a `Location` means naming the address the client used, and Doppel
+cannot work that out for itself -- `Host` is a claim by the caller, and building
+a redirect out of it hands the caller the redirect.
+
+In order:
+
+```yaml
+server:
+  host: 0.0.0.0
+  port: 8080
+  external_url: "https://doppel.example.com/"   # optional
+```
+
+1. `DOPPEL_EXTERNAL_URL`, which overrides everything below it.
+2. `server.external_url`.
+3. `server.host` and `server.port`, which is right for the common case and needs
+   no configuration: a laptop on `127.0.0.1:8080`, a pod on its own address.
+   A wildcard bind (`0.0.0.0`, `::`) becomes loopback, because `0.0.0.0` names
+   every address this host has and therefore none of them.
+
+The third is a guess, and the one place this is wrong: behind a container port
+mapping (`-p 18080:8080`), a load balancer or an ingress, the client used neither
+that address nor that port. Set `external_url`, or the variable -- and Doppel logs
+which address it settled on at startup, so it is one line away from being checked
+rather than assumed.
+
+A path is kept as a prefix: `https://gw.example.com/doppel/` is a Doppel reached
+under a prefix, and its rewritten locations carry it.
 
 Set `rewrite_redirects: false` to relay the header byte for byte. That is what a
 client being tested *for its redirect handling* needs; it is not what a client
diff --git a/docs/usage/runtime-changes.md b/docs/usage/runtime-changes.md
index e6bcdc6..16d6355 100644
--- a/docs/usage/runtime-changes.md
+++ b/docs/usage/runtime-changes.md
@@ -137,14 +137,14 @@ doppel config reload
 
 A rolling change is a write followed by a reload on each instance. Nothing
 coordinates them, and nothing stops two instances running different revisions
-in between; `GET /status` on each reports which one it is holding.
+in between; `GET /api/v1/status` on each reports which one it is holding.
 
 See [Storing configuration in PostgreSQL](storage.md).
 
 ## Checking what is running
 
 ```bash
-curl -s localhost:8081/status
+curl -s localhost:8081/api/v1/status
 ```
 
 ```json
@@ -162,5 +162,5 @@ curl -s localhost:8081/status
 which is the quickest way to confirm a resolution header is spelled the way you
 think it is. Credentials in an upstream URL are redacted here.
 
-`/status` needs no token by default, so it is usable as a health check and as a
+`/api/v1/status` needs no token by default, so it is usable as a health check and as a
 way to confirm a rolling reload actually reached every instance.
diff --git a/docs/usage/storage.md b/docs/usage/storage.md
index 551bf30..f339738 100644
--- a/docs/usage/storage.md
+++ b/docs/usage/storage.md
@@ -99,25 +99,42 @@ release, migrations are append-only.
 
 ### The schema
 
-Five tables. Deliberately between one opaque blob and full normalisation:
-**anything with its own identity and lifecycle is a row, and a leaf map
-hanging off one is a JSONB column on that row.**
+Three tables. **Anything SQL actually uses is a column; everything else is the
+document, as JSON.**
 
 | Table | Holds |
 |---|---|
-| `configurations` | One row per named configuration: the revision, and the settings that are single values |
-| `admin_tokens` | One row per token |
-| `proxies` | One row per proxy; `headers` and `access` are JSONB on it |
-| `mocks` | One row per mock; the selector maps and response headers are JSONB on it |
+| `configurations` | One row per named configuration: `name`, `revision`, and `settings` -- the whole document except its proxies |
+| `proxies` | One row per proxy: `name`, `ordinal`, and `document` -- the proxy with its mocks inside |
 | `templates` | One row per template file, content included |
 
-A blob would make the row opaque, and rewriting a whole document to change one
-field throws away the per-proxy concurrency the admin API is built on. A table
-per leaf map would buy joins nobody will write.
+It was five tables with a column per configuration field, and the change is
+worth explaining because it looks like a step backwards.
 
-`ordinal` columns preserve document order. That is not decoration: mock
-patterns are unanchored, so a general one placed before a specific one shadows
-it, and a store that reordered them would change which mock answers a request.
+Nothing ever queried `admin_host` or `latency_min` in SQL. What that
+normalisation bought was a migration for every field the configuration format
+gained -- three of them between 0.3.0 and 0.4.1, each one `ADD COLUMN` and
+nothing else, plus a matching edit in the loader, the writer, and two
+hand-written statements that a test existed solely to keep in step. A field
+added to the format now reaches the database with no schema change at all.
+
+What did *not* change is the part that matters: a proxy is still its own row,
+addressed by name and carrying its own revision, so the per-proxy concurrency
+the admin API is built on is untouched. A single blob per configuration would
+have thrown that away.
+
+The rows are parsed by the same code that parses `main.yaml`, so a row edited by
+hand is held to exactly the rules a configuration file is held to -- a value the
+format refuses is refused here too, reported against the field and the proxy that
+carry it.
+
+`ordinal` preserves document order. That is not decoration: mock patterns are
+unanchored, so a general one placed before a specific one shadows it, and a store
+that reordered them would change which mock answers a request.
+
+One thing moved rather than disappeared. The old schema had a unique index on
+`(config, token)`, making duplicate token values impossible in the database; rule
+V26 refuses them on every write instead, and every write goes through validation.
 
 `templates` has no cascading foreign key on purpose. Deleting a proxy's files
 is a decision the store makes explicitly and *after* the configuration write --
@@ -148,7 +165,7 @@ second writer that blocks on it re-evaluates its own `WHERE` against the row
 as the winner left it -- finds the revision moved, matches nothing, and is
 told it lost.
 
-A load is also one transaction, at `REPEATABLE READ`. A configuration is five
+A load is also one transaction, at `REPEATABLE READ`. A configuration spans two
 tables, and each query used to take its own connection and its own snapshot,
 so a save committing in between produced a configuration assembled from two of
 them. The revision check at the end of a load caught it and reported "the rows
@@ -176,7 +193,7 @@ sequence.
 
 So: a rolling change is a write followed by a reload on each instance. There
 is no coordination between them, and nothing stops two instances running
-different revisions in between; `GET /status` on each reports which one it is
+different revisions in between; `GET /api/v1/status` on each reports which one it is
 holding.
 
 ## Moving between the stores
diff --git a/docs/usage/troubleshooting.md b/docs/usage/troubleshooting.md
index a8fbd77..90b4070 100644
--- a/docs/usage/troubleshooting.md
+++ b/docs/usage/troubleshooting.md
@@ -158,3 +158,33 @@ remove it from `DOPPEL_ADMIN_TOKENS`.
 
 Anything not covered here is worth an issue on the
 [tracker](https://github.com/lorem-dev/doppel/issues).
+
+## The dashboard
+
+### The admin root answers 503
+
+`DASHBOARD_NOT_BUILT`. This binary was compiled without the dashboard's static
+assets -- a source build that skipped the frontend. Released binaries and the
+published image always carry it.
+
+```bash
+npm --prefix frontend ci && npm --prefix frontend run build
+cargo build --release -p doppel-cli
+```
+
+The order is the whole answer: the assets are embedded at compile time, so
+building them without rebuilding the binary changes nothing about what it serves.
+If Node is not available and the JSON API is enough, `admin.dashboard: false`
+stops the route being served at all, which is a clearer answer than a 503.
+
+### The page loads but every button is disabled
+
+The caller has no rights to spend. The dashboard asks `GET /api/v1/access` what it
+may do and disables what the server would refuse; the tooltip on each control says
+so. Enter a token, or check `admin.access` -- the same two causes as a 401 above,
+since it is the same decision.
+
+### A change made elsewhere is not on screen
+
+It will be within a minute: the list refetches on a timer, and the timer is paused
+while the tab is hidden. Switching back to the tab refetches immediately.
diff --git a/doppel-config.schema.json b/doppel-config.schema.json
index be21fd1..f8705e4 100644
--- a/doppel-config.schema.json
+++ b/doppel-config.schema.json
@@ -41,6 +41,13 @@
           "$ref": "#/$defs/AuthConfig",
           "description": "Which header carries the bearer token."
         },
+        "dashboard": {
+          "description": "Serve the browser dashboard from the admin listener's root.\n\nOn by default. Off means `/`, `/static/*` and `/robots.txt` are not\nrouted at all and answer 404 like any other unknown path; the JSON API is\nuntouched either way.\n\nAn `Option` and skipped when absent, for the reason given on `groups`:\nadding it must not change the canonical YAML of configurations written\nbefore it existed. Read it through\n[`AdminConfig::is_dashboard_enabled`].",
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
         "enable": {
           "description": "Whether to run the admin listener at all.\n\nDefaults to on. Off means the port is never bound and no admin task\nstarts; the proxy and the control socket are untouched, so\n`doppel config reload` still works and is then the only way in.\n\nThe validation rules do not consult this. A configuration that is only\nsafe because nothing serves it is a trap set for whoever turns the\nlistener on later, and they will not re-read the rules first.",
           "type": "boolean"
@@ -73,6 +80,17 @@
             "null"
           ]
         },
+        "title": {
+          "description": "The heading the dashboard shows, and the browser tab's title.\n\nDefaults to `Doppel`. Useful when several Doppels are open at once and\nthe tabs are otherwise identical.\n\nAn `Option` and skipped when absent, for the same reason as `dashboard`.\nRead it through [`AdminConfig::title`].",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/AdminTitle"
+            }
+          ]
+        },
         "tokens": {
           "description": "The tokens that may call the admin API. Names and token values are\neach unique. `DOPPEL_ADMIN_TOKENS` can supply these instead.",
           "items": {
@@ -92,6 +110,15 @@
       ],
       "type": "object"
     },
+    "AdminTitle": {
+      "description": "The heading the dashboard shows, at most 64 characters and free of control characters. Defaults to `Doppel`.",
+      "examples": [
+        "billing-api (staging)"
+      ],
+      "maxLength": 64,
+      "minLength": 1,
+      "type": "string"
+    },
     "AllowedGroup": {
       "description": "A token or group name `access` may reference, or `*` for any of them.",
       "examples": [
@@ -135,17 +162,33 @@
       "properties": {
         "socket": {
           "description": "Path to the control socket, created with mode 0600 and removed on\nshutdown. Its parent directory must already exist.\nA filesystem path. `utoipa` has no schema for `PathBuf`, so it is\ndescribed as the string it is written as.",
+          "examples": [
+            "/tmp/doppel.sock"
+          ],
           "type": "string"
         }
       },
       "type": "object"
     },
+    "ExternalUrl": {
+      "description": "An absolute http or https url naming where clients reach this Doppel, with no query string or fragment.",
+      "examples": [
+        "https://doppel.example.com/"
+      ],
+      "type": "string"
+    },
     "HeaderName": {
       "description": "An HTTP header name: a non-empty RFC 9110 token.",
+      "examples": [
+        "X-Request-Id"
+      ],
       "type": "string"
     },
     "HeaderValue": {
       "description": "An HTTP header value: visible ASCII, space and tab, with no line breaks.",
+      "examples": [
+        "staging"
+      ],
       "type": "string"
     },
     "HttpMethod": {
@@ -173,6 +216,9 @@
     },
     "HttpStatus": {
       "description": "An HTTP status code, 100 to 599.",
+      "examples": [
+        200
+      ],
       "maximum": 599,
       "minimum": 100,
       "type": "integer"
@@ -375,6 +421,9 @@
       "properties": {
         "body": {
           "description": "A template rendered and sent as `text/plain`. Exclusive with `json` and\n`template`.",
+          "examples": [
+            "widget {{ id }} is ready"
+          ],
           "type": [
             "string",
             "null"
@@ -387,12 +436,18 @@
           "description": "Header name -> template producing the value.\n\nThe value is a template, not a header value: what it renders to is\nonly a header value once a request has been served, which is checked\nthere. The name is a name now.",
           "propertyNames": {
             "description": "An HTTP header name: a non-empty RFC 9110 token.",
+            "examples": [
+              "X-Request-Id"
+            ],
             "type": "string"
           },
           "type": "object"
         },
         "json": {
           "description": "A template whose rendered output must be valid JSON, sent as\n`application/json`. Exclusive with `body` and `template`.",
+          "examples": [
+            "{\"id\": \"{{ id }}\"}"
+          ],
           "type": [
             "string",
             "null"
@@ -421,6 +476,9 @@
     },
     "Name": {
       "description": "Letters, digits, `-` and `_`, between 2 and 64 characters.",
+      "examples": [
+        "billing-api"
+      ],
       "maxLength": 64,
       "minLength": 2,
       "pattern": "^[A-Za-z0-9_-]{2,64}$",
@@ -435,6 +493,9 @@
     },
     "Port": {
       "description": "A TCP port, 1 to 65535.",
+      "examples": [
+        8080
+      ],
       "maximum": 65535,
       "minimum": 1,
       "type": "integer"
@@ -515,6 +576,9 @@
           "description": "Headers injected into every outbound request, overriding whatever the\nclient sent by the same name.",
           "propertyNames": {
             "description": "An HTTP header name: a non-empty RFC 9110 token.",
+            "examples": [
+              "X-Request-Id"
+            ],
             "type": "string"
           },
           "type": "object"
@@ -574,6 +638,13 @@
             "null"
           ]
         },
+        "rewrite_urls": {
+          "description": "Whether the upstream's own address is rewritten to Doppel's inside the\nbodies this proxy relays. Absent means enabled.\n\nThe same problem `rewrite_redirects` solves, one layer down: a page, a\nscript or a JSON document that names `https://api.example.com/v2/` sends\nthe client straight there on the next request, past every fault and every\nmock. Rewriting the body keeps it inside Doppel.\n\nOnly the exact host is replaced. `https://cdn.api.example.com/` is a\ndifferent host and is left alone, because Doppel does not proxy it and\npointing it at itself would break a page rather than keep it working.\n\nOnly text bodies, and only ones the upstream did not compress. Turn it off\nfor a client being tested against the bytes the upstream actually sent.",
+          "type": [
+            "boolean",
+            "null"
+          ]
+        },
         "timeout": {
           "description": "Bounds the whole upstream exchange, in seconds. Exceeding it is\n`504 UPSTREAM_TIMEOUT`. Defaults to 30.",
           "oneOf": [
@@ -610,6 +681,9 @@
     },
     "ProxyName": {
       "description": "Letters, digits, `-` and `_`, between 2 and 32 characters.",
+      "examples": [
+        "billing-api"
+      ],
       "maxLength": 32,
       "minLength": 2,
       "pattern": "^[A-Za-z0-9_-]{2,32}$",
@@ -617,6 +691,9 @@
     },
     "Ratio": {
       "description": "A probability from 0.0 to 1.0. 50% is `0.5`.",
+      "examples": [
+        0.25
+      ],
       "maximum": 1,
       "minimum": 0,
       "type": "number"
@@ -651,6 +728,9 @@
     },
     "Seconds": {
       "description": "A latency in seconds, 0 to 300.",
+      "examples": [
+        0.25
+      ],
       "maximum": 300,
       "minimum": 0,
       "type": "number"
@@ -668,6 +748,9 @@
       "properties": {
         "dsn": {
           "description": "The Sentry DSN to report to. Empty disables reporting, so a deployment\ncan blank it without removing the section.",
+          "examples": [
+            "https://key@o0.ingest.sentry.io/0"
+          ],
           "type": "string"
         }
       },
@@ -680,6 +763,17 @@
       "additionalProperties": false,
       "description": "No `workers` here. It sizes the tokio runtime, and a database-backed\nstore cannot be opened before that runtime exists -- so the value has to\nbe known before the configuration is read, which puts it on the same side\nof the boundary as the connection settings. It is `--workers` /\n`DOPPEL_WORKERS`.",
       "properties": {
+        "external_url": {
+          "description": "Where clients reach this Doppel, when that is not `host:port`.\n\nBehind a container port mapping, a load balancer or an ingress, the\naddress Doppel bound is not the address a client used -- and a rewritten\n`Location` has to name the second. Doppel cannot infer it: `Host` is a\nclaim by the caller, and building a redirect out of it hands the caller\nthe redirect.\n\nAbsent, `host` and `port` are used, with a wildcard bind (`0.0.0.0`, `::`)\nread as loopback -- which is right for a laptop or a pod reached at its\nown address, and wrong behind a port mapping or an ingress, where the\nclient used neither. Doppel logs the address it settled on at startup.\n\n`DOPPEL_EXTERNAL_URL` overrides it. Part of `server`, so a change takes a\nrestart like the rest of that section.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/ExternalUrl"
+            }
+          ]
+        },
         "host": {
           "description": "An IP address, not a hostname: a name would have to be resolved,\nand which address it resolves to is not the configuration's to\ndecide. `utoipa` has no schema for `IpAddr`, so it is described\nhere as the string it is written as.",
           "examples": [
@@ -734,6 +828,9 @@
       "properties": {
         "dir": {
           "description": "Directory holding mock templates, one subdirectory per proxy. Created\nat startup if absent.\nA filesystem path. `utoipa` has no schema for `PathBuf`, so it is\ndescribed as the string it is written as.",
+          "examples": [
+            "./templates"
+          ],
           "type": "string"
         }
       },
@@ -741,12 +838,18 @@
     },
     "TimeoutSeconds": {
       "description": "An upstream timeout in whole seconds, 1 to 3600.",
+      "examples": [
+        30
+      ],
       "maximum": 3600,
       "minimum": 1,
       "type": "integer"
     },
     "Token": {
       "description": "An admin token: printable ASCII with no spaces, 32 to 255 characters. A version 4 UUID is the recommended shape.",
+      "examples": [
+        "replace-me-00000000000000000000000"
+      ],
       "maxLength": 255,
       "minLength": 32,
       "type": "string"
diff --git a/frontend/e2e/src/colour.ts b/frontend/e2e/src/colour.ts
new file mode 100644
index 0000000..d85fa44
--- /dev/null
+++ b/frontend/e2e/src/colour.ts
@@ -0,0 +1,86 @@
+// Measuring what a screen actually shows.
+//
+// Two specs need this: one asks whether the page's own colours are readable, the
+// other whether the syntax highlighter is colouring anything at all. Both are
+// questions about painted pixels rather than about class names, which is the point
+// -- the failures they guard were a dark theme rendering white on white and a
+// highlighter tokenising in one colour, and a class assertion would have passed
+// through both.
+
+import type { Page } from '@playwright/test'
+
+/** sRGB bytes. */
+export type Rgb = [number, number, number]
+
+/**
+ * What a screen gets for an element's colour, as sRGB bytes.
+ *
+ * Measured by painting the computed value into a canvas and reading the pixel
+ * back, rather than by parsing the string. Tailwind 4 emits `oklch(...)`, Chrome
+ * returns it from `getComputedStyle` verbatim, and assigning it to `fillStyle`
+ * keeps it in that space -- only a paint converts it. The converted pixel is also
+ * the honest subject of a contrast assertion, since it is what a reader sees.
+ */
+export async function paintedRgb(
+  page: Page,
+  selector: string,
+  property: 'color' | 'backgroundColor',
+): Promise<Rgb> {
+  return page.locator(selector).first().evaluate(paint, property)
+}
+
+/**
+ * The same measurement for every element a selector matches.
+ *
+ * Waits for one match before measuring. `all()` returns whatever matches at that
+ * instant and waits for nothing, while the spans this is pointed at -- the
+ * highlighter's -- appear on a React update rather than with the keystroke that
+ * caused them. Measured too early, a caller's "more than zero colours" assertion
+ * fails for a reason that has nothing to do with colour: the same one-shot read
+ * that made `fieldMessage` fail on CI and never on a laptop.
+ *
+ * So this is for asking about elements that are expected to be there. A test that
+ * wants to prove something is *not* highlighted should assert on the locator's
+ * count instead of measuring the colours of nothing.
+ */
+export async function paintedRgbAll(
+  page: Page,
+  selector: string,
+  property: 'color' | 'backgroundColor',
+): Promise<Rgb[]> {
+  await page.locator(selector).first().waitFor({ state: 'attached' })
+  return Promise.all(
+    (await page.locator(selector).all()).map((node) => node.evaluate(paint, property)),
+  )
+}
+
+/** Runs in the browser: the computed value, through a canvas, out as bytes. */
+function paint(node: Element, which: string): Rgb {
+  const computed = getComputedStyle(node)[which as 'color']
+  const canvas = document.createElement('canvas')
+  canvas.width = 1
+  canvas.height = 1
+  const context = canvas.getContext('2d')
+  if (!context) {
+    throw new Error('no 2d context to paint a colour into')
+  }
+  context.fillStyle = computed
+  context.fillRect(0, 0, 1, 1)
+  const [r, g, b] = context.getImageData(0, 0, 1, 1).data
+  return [r, g, b] as Rgb
+}
+
+/** The relative luminance of sRGB bytes, per WCAG. */
+export function luminance([r, g, b]: Rgb): number {
+  const channel = (value: number) => {
+    const v = value / 255
+    return v <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4
+  }
+  return 0.2126 * channel(r) + 0.7152 * channel(g) + 0.0722 * channel(b)
+}
+
+/** WCAG contrast between two painted colours. */
+export function contrast(one: Rgb, two: Rgb): number {
+  const [light, dark] = [luminance(one), luminance(two)].sort((a, b) => b - a) as [number, number]
+  return (light + 0.05) / (dark + 0.05)
+}
diff --git a/frontend/e2e/src/configs.ts b/frontend/e2e/src/configs.ts
new file mode 100644
index 0000000..2f8d074
--- /dev/null
+++ b/frontend/e2e/src/configs.ts
@@ -0,0 +1,143 @@
+// The configurations the specs run against.
+//
+// Ports and the template directory are placeholders the harness fills in, so two
+// spec files running at once cannot collide.
+
+export const ROOT_TOKEN = 'root-token-0000000000000000000000000'
+export const READER_TOKEN = 'reader-token-00000000000000000000000'
+
+/** Tokens for both a full-rights caller and a read-only one. */
+const TOKENS = `
+  tokens:
+    - name: root
+      group: admin
+      token: ${ROOT_TOKEN}
+    - name: reader
+      group: user
+      token: ${READER_TOKEN}
+`
+
+const PROXIES = `
+proxies:
+  - name: alpha
+    type: http
+    url: "https://alpha.example.com/api/"
+  - name: beta
+    type: http
+    url: "https://beta.example.com/api/"
+    # Resolved by header, because only one proxy may be the default one -- rule
+    # V12, and a fixture that broke it would fail every spec at startup.
+    resolve:
+      type: header
+      header: X-Proxy-Name
+`
+
+/** Reads are public, writes need `admin`: the shape most deployments have. */
+export const PRIVATE_CONFIG = `
+server:
+  host: "127.0.0.1"
+  port: {proxyPort}
+admin:
+  host: "127.0.0.1"
+  port: {adminPort}
+  title: "Doppel (e2e)"
+${TOKENS}
+  access:
+    list: public
+    read: public
+    create: ["admin"]
+    update: ["admin"]
+    delete: ["admin"]
+    upload: ["admin"]
+  upload:
+    limit: 1Mi
+control:
+  socket: {controlSocket}
+templates:
+  dir: {templatesDir}
+${PROXIES}
+`
+
+/** Everything unauthenticated: the page must not ask for a token at all. */
+export const PUBLIC_CONFIG = `
+server:
+  host: "127.0.0.1"
+  port: {proxyPort}
+admin:
+  host: "127.0.0.1"
+  port: {adminPort}
+  public: true
+  tokens: []
+  access: {}
+  upload:
+    limit: 1Mi
+control:
+  socket: {controlSocket}
+templates:
+  dir: {templatesDir}
+${PROXIES}
+`
+
+/**
+ * Public, with a proxy whose `access` block the public API makes inert.
+ *
+ * The configuration an operator reaches by turning `public: true` on over proxies
+ * they had already restricted: the overrides stay in the document and stop
+ * deciding anything, which the form has to say rather than offer fields for.
+ * `alpha` holds one and `beta` holds none, so one instance covers both answers.
+ */
+export const PUBLIC_OVERRIDES_CONFIG = `
+server:
+  host: "127.0.0.1"
+  port: {proxyPort}
+admin:
+  host: "127.0.0.1"
+  port: {adminPort}
+  public: true
+  tokens: []
+  access: {}
+  upload:
+    limit: 1Mi
+control:
+  socket: {controlSocket}
+templates:
+  dir: {templatesDir}
+proxies:
+  - name: alpha
+    type: http
+    url: "https://alpha.example.com/api/"
+    access:
+      delete: public
+  - name: beta
+    type: http
+    url: "https://beta.example.com/api/"
+    resolve:
+      type: header
+      header: X-Proxy-Name
+`
+
+/** The dashboard turned off: the API stays, the three routes go. */
+export const DASHBOARD_OFF_CONFIG = `
+server:
+  host: "127.0.0.1"
+  port: {proxyPort}
+admin:
+  host: "127.0.0.1"
+  port: {adminPort}
+  dashboard: false
+${TOKENS}
+  access:
+    list: public
+    read: public
+    create: ["admin"]
+    update: ["admin"]
+    delete: ["admin"]
+    upload: ["admin"]
+  upload:
+    limit: 1Mi
+control:
+  socket: {controlSocket}
+templates:
+  dir: {templatesDir}
+${PROXIES}
+`
diff --git a/frontend/e2e/src/fields.ts b/frontend/e2e/src/fields.ts
new file mode 100644
index 0000000..495af78
--- /dev/null
+++ b/frontend/e2e/src/fields.ts
@@ -0,0 +1,30 @@
+// Asking a field about itself, without walking the DOM.
+//
+// A form's message lives near its control, and "near" used to mean a specific number
+// of parent elements -- which broke the moment the label moved to make room for the
+// (i). The control names its message with `aria-describedby`, which is both how a
+// screen reader finds it and a stable handle for a test.
+
+import { expect, type Locator, type Page } from '@playwright/test'
+
+/**
+ * The hint-or-complaint line under the field with this label.
+ *
+ * `[id="..."]` rather than `#...`: React's generated ids contain characters a CSS
+ * id selector cannot carry.
+ */
+export async function fieldMessage(page: Page, label: string): Promise<Locator> {
+  const control = page.getByLabel(label).first()
+  // Waited for rather than read once. A message that arrives with the server's
+  // refusal is not on the page the instant the button is clicked, so a one-shot
+  // read is a race a slower machine loses: CI failed here on a run where the whole
+  // suite took twice as long as it does on a laptop, holding `null` while the
+  // complaint was still in flight. The assertion that follows this one always
+  // retried, which is why this was the one that fell over.
+  await expect(control, `the field labelled "${label}" describes no message`).toHaveAttribute(
+    'aria-describedby',
+    /\S/,
+  )
+  const described = await control.getAttribute('aria-describedby')
+  return page.locator(`[id="${described}"]`)
+}
diff --git a/frontend/e2e/src/server.ts b/frontend/e2e/src/server.ts
new file mode 100644
index 0000000..3317e9c
--- /dev/null
+++ b/frontend/e2e/src/server.ts
@@ -0,0 +1,109 @@
+// A real Doppel, per spec file.
+//
+// Not Playwright's `webServer`: that starts one process for the whole run, and
+// these specs need different configurations -- public, private, dashboard off --
+// which is a property of the server rather than of the page. Each file starts its
+// own on ports nobody else is using.
+
+import { spawn, type ChildProcess } from 'node:child_process'
+import { createServer } from 'node:net'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+export interface Doppel {
+  /** Where the admin listener, and therefore the dashboard, answers. */
+  baseURL: string
+  /**
+   * Where proxied traffic goes.
+   *
+   * Only the metrics spec needs it, and it needs it for a real reason: a process
+   * that has served no request has no series to expose, so an exposition test
+   * with no traffic behind it asserts nothing.
+   */
+  proxyURL: string
+  stop: () => void
+}
+
+/** A port the operating system has just confirmed is free. */
+async function freePort(): Promise<number> {
+  return new Promise((accept, reject) => {
+    const probe = createServer()
+    probe.once('error', reject)
+    probe.listen(0, '127.0.0.1', () => {
+      const address = probe.address()
+      if (typeof address === 'string' || address === null) {
+        reject(new Error('no port'))
+        return
+      }
+      const { port } = address
+      probe.close(() => accept(port))
+    })
+  })
+}
+
+/**
+ * Start Doppel with `yaml`, with `{proxyPort}`, `{adminPort}` and
+ * `{templatesDir}` substituted.
+ *
+ * The binary comes from `DOPPEL_BIN` or `target/debug/doppel`, and it has to have
+ * been built with `frontend/dist` in place -- otherwise `/` answers 503 and every
+ * spec here fails for the same uninformative reason, which is why the wait below
+ * checks the dashboard rather than only the API.
+ */
+export async function startDoppel(yaml: string): Promise<Doppel> {
+  const dir = mkdtempSync(join(tmpdir(), 'doppel-e2e-'))
+  const proxyPort = await freePort()
+  const adminPort = await freePort()
+  const templatesDir = join(dir, 'templates')
+
+  const configPath = join(dir, 'main.yaml')
+  writeFileSync(
+    configPath,
+    yaml
+      .replaceAll('{proxyPort}', String(proxyPort))
+      .replaceAll('{adminPort}', String(adminPort))
+      .replaceAll('{templatesDir}', templatesDir)
+      // Short, and outside the temp directory: a unix socket path is capped near
+      // 104 bytes on macOS and the temp directory alone can spend most of that.
+      // Per-instance because the default is one path for every Doppel on the
+      // machine, and spec files run in parallel -- the second server would exit
+      // 1 with the first still holding the socket.
+      .replaceAll('{controlSocket}', `/tmp/doppel-e2e-${adminPort}.sock`),
+  )
+
+  const binary = process.env.DOPPEL_BIN ?? resolve(import.meta.dirname, '../../../target/debug/doppel')
+  const child: ChildProcess = spawn(binary, ['serve', '--config', configPath], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+
+  // Kept, and printed only when the wait fails: a server that refused its own
+  // configuration says why on stderr, and without this the failure is a timeout
+  // with no cause.
+  let log = ''
+  child.stdout?.on('data', (chunk: Buffer) => (log += chunk.toString()))
+  child.stderr?.on('data', (chunk: Buffer) => (log += chunk.toString()))
+
+  const baseURL = `http://127.0.0.1:${adminPort}`
+  const stop = () => child.kill('SIGTERM')
+
+  const deadline = Date.now() + 20_000
+  for (;;) {
+    if (child.exitCode !== null) {
+      throw new Error(`doppel exited with ${child.exitCode}:\n${log}`)
+    }
+    try {
+      const response = await fetch(`${baseURL}/api/v1/status`)
+      if (response.ok) {
+        return { baseURL, proxyURL: `http://127.0.0.1:${proxyPort}`, stop }
+      }
+    } catch {
+      // Not up yet.
+    }
+    if (Date.now() > deadline) {
+      stop()
+      throw new Error(`doppel did not start within 20s:\n${log}`)
+    }
+    await new Promise((accept) => setTimeout(accept, 100))
+  }
+}
diff --git a/frontend/e2e/tests/auth.spec.ts b/frontend/e2e/tests/auth.spec.ts
new file mode 100644
index 0000000..d3fe26b
--- /dev/null
+++ b/frontend/e2e/tests/auth.spec.ts
@@ -0,0 +1,289 @@
+import { expect, test } from '@playwright/test'
+
+import { PRIVATE_CONFIG, PUBLIC_CONFIG, READER_TOKEN, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+test.describe('a private configuration', () => {
+  let doppel: Doppel
+  test.beforeAll(async () => {
+    doppel = await startDoppel(PRIVATE_CONFIG)
+  })
+  test.afterAll(() => doppel.stop())
+
+  test('asks for a token, and takes no for an answer', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    const dialog = page.getByRole('form', { name: 'Access token' })
+    await expect(dialog).toBeVisible()
+
+    await page.getByRole('button', { name: 'Continue without a token' }).click()
+    await expect(dialog).toBeHidden()
+
+    // `list` and `read` are public here, so declining leaves a working page
+    // rather than an empty one.
+    await expect(page.getByRole('cell', { name: 'alpha', exact: true })).toBeVisible()
+    // ...and the writes are visibly unavailable rather than absent.
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeDisabled()
+  })
+
+  test('does not ask again after being declined once', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('button', { name: 'Continue without a token' }).click()
+    await page.reload()
+    await expect(page.getByRole('form', { name: 'Access token' })).toBeHidden()
+  })
+
+  test('enables the writes once a token is given, and names the caller', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+
+    await expect(page.getByText('root (admin)')).toBeVisible()
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeEnabled()
+  })
+
+  test('a wrong token leaves the writes disabled', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('textbox', { name: 'Token' }).fill('wrong-token-000000000000000000000000')
+    await page.getByRole('button', { name: 'Use this token' }).click()
+
+    // An unrecognised token is anonymous, deliberately: telling it apart from a
+    // recognised one would confirm which tokens exist.
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeDisabled()
+  })
+
+  test('the API reads the token from the header, and says whose it is', async ({ page }) => {
+    // Tokens through the API rather than through the page: this is what a script,
+    // a CI job or `curl` does, and it is the half the dashboard tests cannot see.
+    const asRoot = await page.request.get(`${doppel.baseURL}/api/v1/access`, {
+      headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+    })
+    expect(asRoot.status()).toBe(200)
+    const root = (await asRoot.json()) as {
+      caller: { kind: string; name?: string; group?: string }
+      global: Record<string, boolean>
+    }
+    expect(root.caller).toMatchObject({ kind: 'token', name: 'root', group: 'admin' })
+    expect(root.global.create).toBe(true)
+
+    // A read-only token: recognised, named, and refused the writes rather than the
+    // reads.
+    const asReader = await page.request.get(`${doppel.baseURL}/api/v1/access`, {
+      headers: { 'X-Proxy-Authorization': `Bearer ${READER_TOKEN}` },
+    })
+    const reader = (await asReader.json()) as {
+      caller: { kind: string; name?: string }
+      global: Record<string, boolean>
+    }
+    expect(reader.caller).toMatchObject({ kind: 'token', name: 'reader' })
+    expect(reader.global.read).toBe(true)
+    expect(reader.global.create).toBe(false)
+  })
+
+  test('an unrecognised token is anonymous, not an error', async ({ page }) => {
+    // Deliberately indistinguishable from sending nothing: answering differently
+    // would confirm which tokens exist.
+    const wrong = await page.request.get(`${doppel.baseURL}/api/v1/access`, {
+      headers: { 'X-Proxy-Authorization': `Bearer wrong-token-000000000000000000000000` },
+    })
+    const none = await page.request.get(`${doppel.baseURL}/api/v1/access`)
+
+    expect(wrong.status()).toBe(200)
+    expect(await wrong.json()).toEqual(await none.json())
+    expect(((await wrong.json()) as { caller: { kind: string } }).caller.kind).toBe('anonymous')
+  })
+
+  test('a write with a token that may not write is refused, with the action named', async ({
+    page,
+  }) => {
+    for (const [token, expected] of [
+      [READER_TOKEN, 403],
+      [undefined, 401],
+    ] as const) {
+      const response = await page.request.post(`${doppel.baseURL}/api/v1/proxies`, {
+        headers: token ? { 'X-Proxy-Authorization': `Bearer ${token}` } : {},
+        data: {
+          proxy: {
+            name: 'refused',
+            type: 'http',
+            url: 'https://example.com/',
+            resolve: { type: 'header', header: 'X-Proxy-Name' },
+          },
+        },
+      })
+
+      expect(response.status(), `${token ?? 'no token'}`).toBe(expected)
+      const body = (await response.json()) as { code: string; message: string }
+      // 401 for "who are you", 403 for "not you": the pair a client acts on
+      // differently, and the message names the action rather than the resource.
+      expect(body.code).toBe(expected === 401 ? 'UNAUTHORIZED' : 'FORBIDDEN')
+      expect(body.message).toContain('create')
+    }
+
+    // And nothing was written.
+    const list = await page.request.get(`${doppel.baseURL}/api/v1/proxies`, {
+      headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+    })
+    expect(await list.text()).not.toContain('refused')
+  })
+
+  test('signing out returns to the anonymous view without blocking the page', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeEnabled()
+
+    await page.getByRole('button', { name: 'Sign out' }).click()
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeDisabled()
+    // Not a wall: what is public is still on screen.
+    await expect(page.getByRole('cell', { name: 'alpha', exact: true })).toBeVisible()
+    await expect(page.getByRole('form', { name: 'Access token' })).toBeHidden()
+  })
+})
+
+test.describe('a public configuration', () => {
+  let doppel: Doppel
+  test.beforeAll(async () => {
+    doppel = await startDoppel(PUBLIC_CONFIG)
+  })
+  test.afterAll(() => doppel.stop())
+
+  test('never mentions tokens', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await expect(page.getByRole('form', { name: 'Access token' })).toBeHidden()
+    await expect(page.getByRole('button', { name: 'Sign in' })).toBeHidden()
+    // And everything is permitted, because it is.
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeEnabled()
+  })
+
+  test('a token left in this browser changes nothing, and is not offered again', async ({
+    page,
+  }) => {
+    // There is no way to set a token from the page here -- no dialog, no Sign in --
+    // so the only route left is a token this browser kept from a deployment that
+    // was private earlier, or one somebody put there by hand. It must not resurrect
+    // the sign-in flow: `public: true` means the API is unauthenticated, and a page
+    // asking for a token it cannot use is a page asking for a secret for nothing.
+    await page.goto(doppel.baseURL)
+    await page.evaluate(() =>
+      window.localStorage.setItem(
+        'doppel.token',
+        // The shape `services/auth.ts` writes: the value and when it was entered.
+        JSON.stringify({ token: 'left-over-token-00000000000000000000', savedAt: Date.now() }),
+      ),
+    )
+    await page.reload()
+
+    await expect(page.getByRole('form', { name: 'Access token' })).toBeHidden()
+    await expect(page.getByRole('button', { name: 'Sign in' })).toBeHidden()
+    await expect(page.getByRole('button', { name: 'Sign out' })).toBeHidden()
+    // Still anonymous, still allowed everything: the caller the API reports is the
+    // anonymous one, not a name from a token nobody checked.
+    await expect(page.getByText('(admin)')).toBeHidden()
+    await expect(page.getByRole('button', { name: 'Add a proxy' })).toBeEnabled()
+  })
+
+  test('the API ignores a token instead of refusing it', async ({ page }) => {
+    // Both directions, because "unauthenticated" has to mean the header is not
+    // consulted rather than that a wrong value is punished: a client that keeps
+    // sending its old token must not start getting 401s when a deployment goes
+    // public.
+    const withToken = await page.request.get(`${doppel.baseURL}/api/v1/access`, {
+      headers: { 'X-Proxy-Authorization': 'Bearer not-a-token-0000000000000000000' },
+    })
+    expect(withToken.status()).toBe(200)
+    const report = (await withToken.json()) as {
+      caller: { kind: string }
+      global: Record<string, boolean>
+    }
+    expect(report.caller.kind).toBe('anonymous')
+    expect(Object.values(report.global).every(Boolean)).toBe(true)
+
+    // And a write goes through with no token at all.
+    const created = await page.request.post(`${doppel.baseURL}/api/v1/proxies`, {
+      data: {
+        proxy: {
+          name: 'no-token',
+          type: 'http',
+          url: 'https://example.com/',
+          // By header, because `alpha` is already the default resolver and rule
+          // V12 allows only one.
+          resolve: { type: 'header', header: 'X-Proxy-Name' },
+        },
+      },
+    })
+    expect(created.status(), await created.text()).toBe(201)
+  })
+})
+
+test.describe('a refusal that only a token can fix', () => {
+  // Nothing is public here, so every read is refused until a token is presented --
+  // which is the state the Refresh button exists for.
+  const CLOSED = `
+server:
+  host: "127.0.0.1"
+  port: {proxyPort}
+admin:
+  host: "127.0.0.1"
+  port: {adminPort}
+  tokens:
+    - name: root
+      group: admin
+      token: ${ROOT_TOKEN}
+  access:
+    list: ["admin"]
+    read: ["admin"]
+    create: ["admin"]
+    update: ["admin"]
+    delete: ["admin"]
+    upload: ["admin"]
+  upload:
+    limit: 1Mi
+control:
+  socket: {controlSocket}
+templates:
+  dir: {templatesDir}
+proxies:
+  - name: alpha
+    type: http
+    url: "https://alpha.example.com/api/"
+`
+
+  let doppel: Doppel
+  test.beforeAll(async () => {
+    doppel = await startDoppel(CLOSED)
+  })
+  test.afterAll(() => doppel.stop())
+
+  test('the proxy form offers a token and a refresh, and both work', async ({ page }) => {
+    // A form reads once, when it opens. Signing in afterwards used to leave the
+    // refusal on screen with nothing to press: the fix was reloading the browser.
+    await page.goto(`${doppel.baseURL}/proxies/alpha`)
+    await page.getByRole('button', { name: 'Continue without a token' }).click()
+
+    const refusal = page.getByRole('alert').first()
+    await expect(refusal).toContainText(/requires access|token/i)
+    await expect(refusal.getByRole('button', { name: 'Refresh' })).toBeVisible()
+
+    // The other half of the offer: the thing that makes a refresh worth pressing.
+    await refusal.getByRole('button', { name: 'Enter token' }).click()
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+
+    // Still nothing read, so the form is still the empty one it renders behind the
+    // refusal...
+    await expect(page.getByLabel('Upstream URL')).toHaveValue('')
+    // ...and now it has been read.
+    await page.getByRole('button', { name: 'Refresh' }).click()
+    await expect(page.getByLabel('Upstream URL')).toHaveValue('https://alpha.example.com/api/')
+    await expect(page.getByRole('alert')).toHaveCount(0)
+  })
+
+  test('the list offers the same, and a public deployment offers no token', async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('button', { name: 'Continue without a token' }).click()
+
+    const refusal = page.getByRole('alert').first()
+    await expect(refusal.getByRole('button', { name: 'Refresh' })).toBeVisible()
+    await expect(refusal.getByRole('button', { name: 'Enter token' })).toBeVisible()
+  })
+})
diff --git a/frontend/e2e/tests/chrome.spec.ts b/frontend/e2e/tests/chrome.spec.ts
new file mode 100644
index 0000000..b63fa3b
--- /dev/null
+++ b/frontend/e2e/tests/chrome.spec.ts
@@ -0,0 +1,190 @@
+import { expect, test } from '@playwright/test'
+
+import { PRIVATE_CONFIG, PUBLIC_CONFIG } from '../src/configs'
+import { paintedRgb } from '../src/colour'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+test("the header shows admin.title, in the wordmark's own shape", async ({ page }) => {
+  await page.goto(doppel.baseURL)
+  await expect(page.getByRole('heading', { name: 'Doppel (e2e)' })).toBeVisible()
+  await expect(page).toHaveTitle('Doppel (e2e)')
+
+  // A named deployment gets its own name -- that is what tells four open tabs
+  // apart -- drawn the way `Doppelganger` is, because it is the same heading in the
+  // same page and should not read as a different one.
+  const heading = page.getByRole('heading', { level: 1 })
+  const style = await heading
+    .locator('span')
+    .first()
+    .evaluate((node) => {
+      const computed = getComputedStyle(node)
+      return { size: computed.fontSize, style: computed.fontStyle, select: computed.userSelect }
+    })
+  expect(style.size).toBe('18px')
+  expect(style.style).toBe('italic')
+  expect(style.select).toBe('none')
+
+  // Two tones, split on the space: `Doppel` in the strong one, `(e2e)` in the
+  // light one, exactly as the wordmark splits its own two halves.
+  const [first, second] = await Promise.all([
+    paintedRgb(page, 'h1 span span:nth-child(1)', 'color'),
+    paintedRgb(page, 'h1 span span:nth-child(2)', 'color'),
+  ])
+  expect(first).not.toEqual(second)
+  // Every character survives the split.
+  await expect(heading).toHaveText('Doppel (e2e)')
+})
+
+test('a named deployment says it was built with Doppel, and links to Doppel', async ({ page }) => {
+  // The footer belongs to somebody else's tool now: the version line says what it
+  // was built with, the documentation link says whose documentation it is, and the
+  // repository link goes -- on `billing-api (staging)`, "Repository" reads as a
+  // link to the billing API's own, which it is not.
+  await page.goto(doppel.baseURL)
+
+  await expect(page.getByText(/Built with Doppel \d+\.\d+\.\d+/)).toBeVisible()
+  await expect(page.getByText(/\(c\) \d{4} Lorem Dev/)).toBeVisible()
+  await expect(page.getByRole('link', { name: /Doppel Documentation/ })).toBeVisible()
+  await expect(page.getByRole('link', { name: /^Repository/ })).toHaveCount(0)
+})
+
+test("an unnamed deployment keeps the project's own footer", async ({ page }) => {
+  const doppel = await startDoppel(PUBLIC_CONFIG)
+  try {
+    await page.goto(doppel.baseURL)
+
+    // Nobody named this one, so it is Doppel's own page: the copyright reads as
+    // Doppel's and both links are its own.
+    await expect(page.getByText(/Built with Doppel/)).toHaveCount(0)
+    await expect(page.getByText(/\(c\) \d{4} Lorem Dev . Doppel \d+\.\d+\.\d+/)).toBeVisible()
+    await expect(page.getByRole('link', { name: /^Repository/ })).toBeVisible()
+    await expect(page.getByRole('link', { name: /Doppel Documentation/ })).toHaveCount(0)
+    await expect(page.getByRole('link', { name: /^Documentation/ })).toBeVisible()
+  } finally {
+    doppel.stop()
+  }
+})
+
+test('an unnamed deployment gets the wordmark, in two tones and one size', async ({ page }) => {
+  // `admin.title` absent. The page then says what this is rather than repeating a
+  // default string, and the two halves are the two halves of the name.
+  const doppel = await startDoppel(PUBLIC_CONFIG)
+  try {
+    await page.goto(doppel.baseURL)
+    const heading = page.getByRole('heading', { level: 1 })
+    await expect(heading).toHaveText('Doppelganger')
+
+    const [first, second] = await Promise.all([
+      paintedRgb(page, 'h1 span span:nth-child(1)', 'color'),
+      paintedRgb(page, 'h1 span span:nth-child(2)', 'color'),
+    ])
+    expect(first).not.toEqual(second)
+
+    // The size the heading always was, and italic serif rather than the page's
+    // sans: a wordmark that grew would push the tabs along with it.
+    const style = await heading.locator('span').first().evaluate((node) => {
+      const computed = getComputedStyle(node)
+      return {
+        size: computed.fontSize,
+        style: computed.fontStyle,
+        family: computed.fontFamily,
+        select: computed.userSelect,
+      }
+    })
+    expect(style.size).toBe('18px')
+    expect(style.style).toBe('italic')
+    expect(style.family).toMatch(/serif/i)
+    // And it takes no selection: a mark that highlights in two pieces when the tab
+    // beside it is double-clicked looks like a mistake.
+    expect(style.select).toBe('none')
+
+    // The tab keeps the plain default: a browser tab is a list of words.
+    await expect(page).toHaveTitle('Doppel')
+  } finally {
+    doppel.stop()
+  }
+})
+
+test('the footer puts the copyright and the links on one line, at either end', async ({ page }) => {
+  await page.goto(doppel.baseURL)
+
+  const copyright = await page.getByText(/Lorem Dev/).boundingBox()
+  const links = await page.locator('footer nav').boundingBox()
+  expect(copyright).not.toBeNull()
+  expect(links).not.toBeNull()
+
+  // One line: their vertical centres agree.
+  const centre = (box: { y: number; height: number }) => box.y + box.height / 2
+  expect(Math.abs(centre(copyright!) - centre(links!))).toBeLessThan(2)
+  // Either end, in that order.
+  expect(copyright!.x).toBeLessThan(links!.x)
+})
+
+test('the footer names the copyright and the version of the binary', async ({ page }) => {
+  await page.goto(doppel.baseURL)
+
+  // Both come from the running process, so this also catches a page served by a
+  // binary other than the one under test. The year is the build's -- read back out
+  // of the page it was injected into rather than written here, because a literal
+  // would be a second copy of it that goes stale in January.
+  const injected = await page.locator('#doppel-config').textContent()
+  const { copyrightYear } = JSON.parse(injected ?? '{}') as { copyrightYear: number }
+  expect(copyrightYear).toBeGreaterThanOrEqual(2026)
+
+  await expect(page.getByText(`(c) ${copyrightYear} Lorem Dev`)).toBeVisible()
+  await expect(page.getByText(/Doppel \d+\.\d+\.\d+/)).toBeVisible()
+})
+
+test('the theme choice survives a reload', async ({ page }) => {
+  await page.goto(doppel.baseURL)
+  await page.getByLabel('Theme').selectOption('dark')
+  await expect(page.locator('html')).toHaveClass(/dark/)
+
+  await page.reload()
+  // Read from localStorage on the way back up: a choice that did not survive a
+  // reload would be a choice nobody bothers making twice.
+  await expect(page.getByLabel('Theme')).toHaveValue('dark')
+  await expect(page.locator('html')).toHaveClass(/dark/)
+})
+
+test('the dashboard refuses to be indexed', async ({ page }) => {
+  const response = await page.goto(doppel.baseURL)
+  expect(response?.headers()['x-robots-tag']).toContain('noindex')
+
+  const robots = await page.request.get(`${doppel.baseURL}/robots.txt`)
+  expect(await robots.text()).toContain('Disallow: /')
+})
+
+test('navigation is real: a proxy has its own URL and the back button works', async ({ page }) => {
+  // The reason react-router is here rather than a state variable.
+  await page.goto(doppel.baseURL)
+  // The dialog is a fixed overlay, so it has to be out of the way before anything
+  // underneath it can be clicked -- which is also what an operator does.
+  await page.getByRole('button', { name: 'Continue without a token' }).click()
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await expect(page).toHaveURL(/\/proxies\/alpha$/)
+  await expect(page.getByRole('heading', { name: 'Edit alpha' })).toBeVisible()
+
+  await page.goBack()
+  await expect(page.getByRole('heading', { name: 'Proxies' })).toBeVisible()
+})
+
+test('the title goes home, from wherever the form has taken you', async ({ page }) => {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('button', { name: 'Continue without a token' }).click()
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await expect(page).toHaveURL(/\/proxies\/alpha$/)
+
+  // The affordance people try first when a form has taken them somewhere they did
+  // not mean to be. `Doppel (e2e)` is this deployment's `admin.title`.
+  await page.getByRole('link', { name: 'Doppel (e2e)' }).click()
+  await expect(page).toHaveURL(new RegExp(`^${doppel.baseURL}/$`))
+  await expect(page.getByRole('heading', { name: 'Proxies' })).toBeVisible()
+})
diff --git a/frontend/e2e/tests/console.spec.ts b/frontend/e2e/tests/console.spec.ts
new file mode 100644
index 0000000..c118224
--- /dev/null
+++ b/frontend/e2e/tests/console.spec.ts
@@ -0,0 +1,71 @@
+import { expect, test, type Page } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+// The console, which an operator reads to find their own problems.
+//
+// Ours were in the way: `react-simple-code-editor` renders a `<style>` element per
+// editor, the page's policy allowed no inline stylesheet, and every editor logged a
+// violation -- dozens of them in a session, with nothing visibly wrong. The policy now
+// names that one stylesheet by hash, and this is what keeps the console empty.
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/** Everything the page complains about, and every policy violation it causes. */
+function watch(page: Page): { messages: string[] } {
+  const messages: string[] = []
+  page.on('console', (message) => {
+    if (message.type() === 'error' || message.type() === 'warning') {
+      messages.push(`${message.type()}: ${message.text()}`)
+    }
+  })
+  page.on('pageerror', (error) => messages.push(`uncaught: ${error.message}`))
+  return { messages }
+}
+
+test('editing a proxy logs nothing to the console', async ({ page }) => {
+  const seen = watch(page)
+
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+
+  // Every section, because each editor used to cost a violation of its own.
+  for (const section of ['Forwarding', 'Faults', 'Access overrides', 'Mocks']) {
+    await page.locator('summary').filter({ hasText: section }).first().click()
+  }
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+  await page.getByLabel('mock-1 response source').selectOption('json')
+  await page.getByLabel(/mock-1 json/).fill('{"id": "{{ id }}"}')
+  await page.getByLabel('Edit as YAML').check()
+  await page.getByLabel('The whole proxy, as YAML').waitFor()
+
+  expect(seen.messages).toEqual([])
+})
+
+test('the policy still forbids an inline stylesheet it does not know', async ({ page }) => {
+  // The hash allows one stylesheet, not the practice. A page that let anything style
+  // itself would pass the test above and lose what the policy is for.
+  const seen = watch(page)
+  await page.goto(doppel.baseURL)
+  await page.getByRole('button', { name: 'Continue without a token' }).click()
+
+  await page.evaluate(() => {
+    const style = document.createElement('style')
+    style.textContent = 'body { display: none }'
+    document.head.append(style)
+  })
+
+  expect(seen.messages.join('\n')).toContain('Content Security Policy')
+  // And it was refused rather than applied.
+  await expect(page.getByRole('heading', { level: 1 })).toBeVisible()
+})
diff --git a/frontend/e2e/tests/endpoints.spec.ts b/frontend/e2e/tests/endpoints.spec.ts
new file mode 100644
index 0000000..0702446
--- /dev/null
+++ b/frontend/e2e/tests/endpoints.spec.ts
@@ -0,0 +1,229 @@
+// The two things on this listener that are not the dashboard and not JSON: the
+// Prometheus exposition and the Swagger UI.
+//
+// Both were broken by changes to the routes around them, and neither breakage
+// failed a test. `/metrics` was answered by the dashboard's fallback with `200
+// text/html`, which a scraper reports as a parse failure and an operator sees as
+// no metrics at all; the Swagger UI was answered with a redirect to itself, once
+// a trailing-slash rewrite was put in front of it. This spec is what makes both
+// fail here instead.
+
+import { expect, test } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+test('the exposition is served as Prometheus text, with or without a slash', async ({ page }) => {
+  // One request through the proxy first. It fails -- this configuration's
+  // upstreams do not exist -- and that is enough: every request through the
+  // listener is recorded, including the ones that go nowhere, so the exposition
+  // has something in it. Without traffic there are no series and the body is
+  // empty, which would make the assertions below pass against nothing.
+  await page.request.get(`${doppel.proxyURL}/anything`).catch(() => undefined)
+
+  for (const path of ['/metrics', '/metrics/']) {
+    const response = await page.request.get(`${doppel.baseURL}${path}`)
+
+    expect(response.status(), path).toBe(200)
+    // The content type, not just the status: the dashboard's fallback answers
+    // 200 as well, and the difference between the two is this header.
+    expect(response.headers()['content-type'], path).toBe(
+      'text/plain; version=0.0.4; charset=utf-8',
+    )
+    const body = await response.text()
+    expect(body, path).toContain('doppel_')
+    expect(body, path).not.toContain('<!doctype html')
+  }
+})
+
+test('the Swagger UI loads and lists the API', async ({ page }) => {
+  // Everything the page asks for, so a UI that renders an empty shell because
+  // its own assets 404 is a failure rather than a screenshot nobody looks at.
+  const failed: string[] = []
+  page.on('response', (response) => {
+    if (response.status() >= 400) {
+      failed.push(`${response.status()} ${response.url()}`)
+    }
+  })
+
+  await page.goto(`${doppel.baseURL}/swagger-ui/`)
+
+  // Its own heading, then one operation out of the document: the UI is not just
+  // present, it has fetched and parsed `/openapi.json`.
+  // `.first()`: the UI wraps itself in a section of the same class as its root.
+  await expect(page.locator('.swagger-ui').first()).toBeVisible()
+  await expect(page.getByText('/api/v1/proxies').first()).toBeVisible()
+  expect(failed).toEqual([])
+})
+
+test('the Swagger UI is reachable without the trailing slash', async ({ page }) => {
+  // The UI redirects the bare path to the slashed one itself. What this pins is
+  // that nothing in front of it rewrites the slash back off again -- that pair
+  // is a redirect loop, and it is how this broke.
+  const response = await page.goto(`${doppel.baseURL}/swagger-ui`)
+
+  expect(response?.status()).toBe(200)
+  expect(page.url()).toBe(`${doppel.baseURL}/swagger-ui/`)
+  await expect(page.locator('.swagger-ui').first()).toBeVisible()
+})
+
+test('the OpenAPI document describes this binary', async ({ page }) => {
+  // At `/openapi.json`, outside `/api/`: the document is not a resource of the
+  // API, and that is the path a client generator is pointed at by default.
+  const response = await page.request.get(`${doppel.baseURL}/openapi.json`)
+
+  expect(response.status()).toBe(200)
+  expect(response.headers()['content-type']).toContain('application/json')
+
+  const document = (await response.json()) as {
+    openapi: string
+    info: { title: string; version: string }
+    paths: Record<string, unknown>
+  }
+  expect(document.openapi).toMatch(/^3\./)
+  expect(document.info.version).not.toBe('')
+
+  // Generated from the handlers, so every path it names is one this binary
+  // serves -- including the three that live outside `/api/v1/`, which are the
+  // ones a move leaves behind in the document.
+  const paths = Object.keys(document.paths)
+  expect(paths).toContain('/api/v1/proxies')
+  expect(paths).toContain('/api/v1/status')
+  expect(paths).toContain('/metrics')
+
+  // Unauthenticated on purpose: a client cannot authenticate before it knows
+  // how, and this is where it finds out. No token was sent above.
+  expect(response.status()).toBe(200)
+})
+
+test('the document is served under either spelling of its path', async ({ page }) => {
+  // The trailing-slash rewrite covers this too, and `/openapi.json/` is what a
+  // hand-written base URL with a slash on the end produces.
+  const slashed = await page.request.get(`${doppel.baseURL}/openapi.json/`)
+
+  expect(slashed.status()).toBe(200)
+  expect((await slashed.json()).openapi).toMatch(/^3\./)
+})
+
+test('the page is rendered per request, not served as a file', async ({ page }) => {
+  // `index.html` ships with a placeholder configuration -- title `Doppel`,
+  // version `dev`, `titleIsDefault: true` -- so that `npm run dev` has something
+  // to develop against. The listener splices the real values into that element on
+  // every request, which is also what `Cache-Control: no-store` on this route is
+  // for. If it ever served the file as it is, the page would report the wrong
+  // title, the wrong version and `public: false` for a public deployment.
+  const response = await page.request.get(`${doppel.baseURL}/`)
+
+  expect(response.status()).toBe(200)
+  expect(response.headers()['cache-control']).toBe('no-store')
+
+  const html = await response.text()
+  const config = html.match(/<script type="application\/json" id="doppel-config">(.*?)<\/script>/s)
+  expect(config, 'the placeholder element must still be in the served page').not.toBeNull()
+
+  const settings = JSON.parse(config![1]!) as {
+    title: string
+    titleIsDefault: boolean
+    version: string
+  }
+  // From the configuration this spec started Doppel with, not from the file.
+  expect(settings.title).toBe('Doppel (e2e)')
+  expect(settings.titleIsDefault).toBe(false)
+  expect(settings.version).not.toBe('dev')
+  expect(settings.version).toMatch(/^\d+\.\d+\.\d+/)
+})
+
+test('assets and the page are served compressed', async ({ page }) => {
+  // The dashboard is 140 KB of JavaScript and CSS uncompressed, and it used to
+  // go out that way: the assets are embedded as bytes and were served as bytes.
+  // What this pins is the negotiation -- what a browser asks for is what it gets.
+  await page.goto(doppel.baseURL)
+  const asset = await page.evaluate(() =>
+    [...document.querySelectorAll('script[src], link[rel="stylesheet"]')]
+      .map((element) => element.getAttribute('src') ?? element.getAttribute('href'))
+      .find((url) => url?.startsWith('/static/assets/')),
+  )
+  expect(asset, 'the page must reference a built asset').toBeTruthy()
+
+  for (const [accepted, expected] of [
+    ['br', 'br'],
+    ['gzip', 'gzip'],
+    ['gzip, br', 'br'],
+  ]) {
+    const response = await page.request.get(`${doppel.baseURL}${asset}`, {
+      headers: { 'Accept-Encoding': accepted! },
+    })
+    expect(response.status(), accepted).toBe(200)
+    expect(response.headers()['content-encoding'], accepted).toBe(expected)
+    // Whatever the encoding, the bytes decode to the same script.
+    expect((await response.text()).length, accepted).toBeGreaterThan(1000)
+  }
+
+  // And the page itself, which is built per request rather than embedded.
+  const identity = await page.request.get(`${doppel.baseURL}${asset}`, {
+    headers: { 'Accept-Encoding': 'identity' },
+  })
+  expect(identity.headers()['content-encoding']).toBeUndefined()
+})
+
+test('the metrics that must always be there are there', async ({ page }) => {
+  // A panel and an alert both read a never-recorded metric as "no data", which is
+  // indistinguishable from a process nobody is scraping. These four are published
+  // at startup or on the first runtime swap, so a scrape of a process that has
+  // served nothing still answers with them.
+  const exposition = await (await page.request.get(`${doppel.baseURL}/metrics`)).text()
+
+  // What this binary is, and what this deployment turned on.
+  expect(exposition).toMatch(/doppel_build_info\{version="\d+\.\d+\.\d+[^"]*"\} 1/)
+  expect(exposition).toContain('doppel_dashboard_info{enabled="true"} 1')
+
+  // No proxy error yet, said in a form a query can subtract rather than as an
+  // absence.
+  expect(exposition).toContain('doppel_proxy_last_error_timestamp_seconds{code=""} 0')
+
+  // The mock counts of the configuration in force. This spec's configuration has
+  // two proxies and no mocks.
+  expect(exposition).toContain('doppel_proxy_mocks{proxy="alpha"} 0')
+  expect(exposition).toContain('doppel_proxy_mocks{proxy="beta"} 0')
+})
+
+test('the admin API records its own latency, by route template', async ({ page }) => {
+  // Two requests to the same route with different path parameters, and a query
+  // string on one of them: one series, or the label is wrong.
+  const token = ROOT_TOKEN
+  for (const name of ['alpha', 'beta']) {
+    const response = await page.request.get(`${doppel.baseURL}/api/v1/proxies/${name}?noise=1`, {
+      headers: { 'X-Proxy-Authorization': `Bearer ${token}` },
+    })
+    expect(response.status(), name).toBe(200)
+  }
+
+  const exposition = await (await page.request.get(`${doppel.baseURL}/metrics`)).text()
+  const counted = exposition
+    .split('\n')
+    .filter(
+      (line) =>
+        line.startsWith('doppel_admin_request_duration_seconds_count') &&
+        line.includes('route="/api/v1/proxies/{name}"'),
+    )
+
+  expect(counted, `no templated series in:\n${exposition}`).toHaveLength(1)
+  expect(counted[0]).toMatch(/\} 2$/)
+  // Neither proxy name nor the query string may appear in the exposition.
+  expect(exposition).not.toContain('proxies/alpha')
+  expect(exposition).not.toContain('noise=1')
+
+  // And the ladder the admin histogram uses stops at five seconds.
+  const buckets = exposition
+    .split('\n')
+    .filter((line) => line.startsWith('doppel_admin_request_duration_seconds_bucket'))
+  expect(buckets.some((line) => line.includes('le="5"'))).toBe(true)
+  expect(buckets.some((line) => line.includes('le="10"'))).toBe(false)
+})
diff --git a/frontend/e2e/tests/form.spec.ts b/frontend/e2e/tests/form.spec.ts
new file mode 100644
index 0000000..04d7cfd
--- /dev/null
+++ b/frontend/e2e/tests/form.spec.ts
@@ -0,0 +1,315 @@
+import { expect, test, type Page } from '@playwright/test'
+
+import {
+  PRIVATE_CONFIG,
+  PUBLIC_OVERRIDES_CONFIG,
+  READER_TOKEN,
+  ROOT_TOKEN,
+} from '../src/configs'
+import { fieldMessage } from '../src/fields'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/**
+ * Unfold a section of the form.
+ *
+ * Every group starts folded, so a scenario has to open what it is about to fill in
+ * -- which is also what an operator does, and the reason the test says which
+ * sections it touches.
+ */
+async function open(page: Page, title: string) {
+  // The summary itself, not the group: a section that contains another one -- Mocks
+  // holds the variable maps -- matches its child's text too.
+  await page.locator('summary').filter({ hasText: title }).first().click()
+}
+
+async function signedIn(page: Page) {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+}
+
+/**
+ * The stored document, read back through the API rather than off the screen.
+ *
+ * `reader`'s token, not root's: the scenario below writes `access.read: reader`
+ * onto the proxy, and a write through the API is in force by the time it answers
+ * -- so from that moment the override is what decides, and `admin` is not on it.
+ * Reading as root here got a `403` the moment writes started applying
+ * themselves, which is the override doing exactly what the form said.
+ */
+async function stored(page: Page, name: string): Promise<Record<string, unknown>> {
+  const response = await page.request.get(
+    `${doppel.baseURL}/api/v1/proxies/${encodeURIComponent(name)}`,
+    { headers: { 'X-Proxy-Authorization': `Bearer ${READER_TOKEN}` } },
+  )
+  expect(response.status()).toBe(200)
+  const { proxy } = (await response.json()) as { proxy: Record<string, unknown> }
+  return proxy
+}
+
+/**
+ * Every field of a proxy, filled in through the form, and the document that comes
+ * out of it.
+ *
+ * The form covers the whole of `ProxyConfig`, and the unit suite only checks that
+ * each field is *mentioned*: a control wired to the wrong key, or one whose value
+ * never reaches the document, passes that and fails here. This is also the only
+ * test that exercises the form the way it is used -- one long sitting, every
+ * section, then save.
+ *
+ * Read back through the API on purpose. Asserting on the screen would prove the
+ * form can display what was typed into it, which is not the question.
+ */
+test('every field of a proxy can be filled in and is stored', async ({ page }) => {
+  await signedIn(page)
+  await page.getByRole('button', { name: 'Add a proxy' }).click()
+
+  // Identity and upstream.
+  await page.getByLabel('Name', { exact: true }).fill('gamma')
+  await page.getByLabel('Upstream URL').fill('https://gamma.example.com/api/')
+  await expect(page.getByLabel('Type')).toHaveValue('http')
+  await expect(page.getByLabel('Type')).toBeDisabled()
+
+  // Forwarding.
+  await open(page, 'Forwarding')
+  await page.getByLabel('Timeout (seconds)').fill('12')
+  await page.getByLabel('Body limit').fill('4Mi')
+  // Resolved by header, because `alpha` is already the default proxy and rule V12
+  // allows only one.
+  await page.getByLabel('Resolve by').selectOption('header')
+  await page.getByLabel('Header name').fill('X-Proxy-Name')
+
+  const headers = page.getByRole('button', { name: 'Add Headers sent upstream' })
+  await headers.click()
+  await page.getByLabel('Headers sent upstream header name 1').fill('X-Injected')
+  await page.getByLabel('Headers sent upstream value 1').fill('yes')
+
+  // Faults.
+  await open(page, 'Faults')
+  await page.getByLabel('Replace').fill('0.25')
+  await page.getByLabel('Rewrite redirects').selectOption('false')
+  await page.getByLabel('Loss rate').fill('0.05')
+  await page.getByLabel('Loss status').fill('503')
+  await page.getByLabel('Latency rate').fill('0.5')
+  await page.getByLabel('Minimum (seconds)').fill('0.1')
+  await page.getByLabel('Maximum (seconds)').fill('1.5')
+
+  // Access overrides. `reader` is a token this configuration knows; a name it did
+  // not would be refused by rule V27, which is the next test.
+  await open(page, 'Access overrides')
+  await page.getByLabel('read', { exact: true }).fill('reader')
+  await page.getByLabel('upload', { exact: true }).fill('public')
+
+  // One mock, with all three selector maps, a JSON body and an override.
+  await open(page, 'Mocks')
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+  await page.getByLabel('Mock name').fill('one-widget')
+  // The mock's own controls are labelled with its name, so they are addressed by
+  // the name just typed.
+  await page.getByLabel('one-widget method').selectOption('POST')
+  await page.getByLabel('Path pattern').fill('^/widgets$')
+  await open(page, 'Variables from the request')
+  await page.getByRole('button', { name: 'Add Variables from headers' }).click()
+  await page.getByLabel('Variables from headers variable 1').fill('trace')
+  await page.getByLabel('Variables from headers header name 1').fill('X-Trace-Id')
+  await page.getByRole('button', { name: 'Add Variables from the query' }).click()
+  await page.getByLabel('Variables from the query variable 1').fill('filter')
+  await page.getByLabel('Variables from the query selector 1').fill('.filter')
+  await page.getByRole('button', { name: 'Add Variables from the body' }).click()
+  await page.getByLabel('Variables from the body variable 1').fill('items')
+  await page.getByLabel('Variables from the body selector 1').fill('.content.items')
+
+  // A spinbutton, not the `Status` tab in the header: the accessible names collide
+  // and the roles do not.
+  await page.getByRole('spinbutton', { name: 'Status', exact: true }).fill('201')
+  await page.getByLabel('one-widget response source').selectOption('json')
+  await page.getByLabel('one-widget json').fill('{"ok": true}')
+  await page.getByRole('button', { name: 'Add Response headers' }).click()
+  await page.getByLabel('Response headers header name 1').fill('X-Mocked')
+  await page.getByLabel('Response headers template 1').fill('one-widget')
+
+  await page.getByRole('button', { name: 'Create proxy' }).click()
+  await expect(page.getByRole('cell', { name: 'gamma', exact: true })).toBeVisible()
+
+  const proxy = await stored(page, 'gamma')
+  expect(proxy).toMatchObject({
+    name: 'gamma',
+    type: 'http',
+    url: 'https://gamma.example.com/api/',
+    timeout: 12,
+    body_limit: 4 * 1024 * 1024,
+    replace: 0.25,
+    rewrite_redirects: false,
+    resolve: { type: 'header', header: 'X-Proxy-Name' },
+    headers: { 'X-Injected': 'yes' },
+    loss: { percentage: 0.05, status: 503 },
+    latency: { percentage: 0.5, min: 0.1, max: 1.5 },
+    access: { read: ['reader'], upload: 'public' },
+    mocks: [
+      {
+        name: 'one-widget',
+        request: {
+          method: 'POST',
+          url: '^/widgets$',
+          headers: { trace: 'X-Trace-Id' },
+          query: { filter: '.filter' },
+          body: { items: '.content.items' },
+        },
+        response: {
+          status: 201,
+          json: '{"ok": true}',
+          headers: { 'X-Mocked': 'one-widget' },
+        },
+      },
+    ],
+  })
+
+  // Nothing the form did not touch was invented: `template` and `body` are the two
+  // other response sources, and exactly one may be set.
+  const [mock] = proxy.mocks as Array<{ response: Record<string, unknown> }>
+  expect(mock!.response.body).toBeUndefined()
+  expect(mock!.response.template).toBeUndefined()
+})
+
+test('what the form loads is what it saves back unchanged', async ({ page }) => {
+  // The other half of the form's job. A control that renders a value but writes a
+  // different one -- or drops a field it does not know -- shows up as a document
+  // that changed without anybody editing it.
+  await signedIn(page)
+  const before = await stored(page, 'alpha')
+
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+  await page.getByRole('button', { name: 'Save changes' }).click()
+  await expect(page.getByRole('heading', { name: 'Proxies' })).toBeVisible()
+
+  expect(await stored(page, 'alpha')).toEqual(before)
+})
+
+test('a name the configuration does not know is refused, on its field', async ({ page }) => {
+  await signedIn(page)
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+
+  // Rule V27: `access` may only name a token or group that exists.
+  await open(page, 'Access overrides')
+  await page.getByLabel('read', { exact: true }).fill('nobody')
+  await page.getByRole('button', { name: 'Save changes' }).click()
+
+  await expect(await fieldMessage(page, 'read')).toContainText('nobody')
+})
+
+test('a save that removes something says what, and takes no for an answer', async ({ page }) => {
+  // A form full of Remove buttons has no undo, and one button commits all of them. The
+  // confirmation is on the save rather than on each Remove: taking one mock out and
+  // putting another in is a single edit, and asking on the way would be asking about a
+  // state still being assembled.
+  const doppel = await startDoppel(PRIVATE_CONFIG)
+  try {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+    await page.getByText('root (admin)').waitFor()
+
+    // Give beta something to lose: a mock, an injected header, an access override.
+    await page.getByRole('link', { name: 'beta' }).click()
+    await page.locator('summary').filter({ hasText: 'Forwarding' }).first().click()
+    await page.getByRole('button', { name: 'Add Headers sent upstream' }).click()
+    await page.getByLabel('Headers sent upstream header name 1').fill('X-Injected')
+    await page.getByLabel('Headers sent upstream value 1').fill('yes')
+    await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+    await page.getByRole('button', { name: 'Add a mock' }).click()
+    await page.getByRole('button', { name: 'Save changes' }).click()
+    await page.getByRole('cell', { name: 'beta', exact: true }).waitFor()
+
+    // Now take both away.
+    await page.getByRole('link', { name: 'beta' }).click()
+    await page.locator('summary').filter({ hasText: 'Forwarding' }).first().click()
+    await page.getByRole('button', { name: 'Remove' }).first().click()
+    await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+    await page.getByRole('button', { name: 'Remove mock' }).click()
+
+    // The save asks, and names them.
+    await page.getByRole('button', { name: 'Save changes' }).click()
+    const dialog = page.getByRole('dialog')
+    await expect(dialog).toContainText('the mock `mock-1`')
+    await expect(dialog).toContainText('the injected header `X-Injected`')
+
+    // No, and nothing was sent: the fields are still as they were left.
+    await dialog.getByRole('button', { name: 'Cancel' }).click()
+    await expect(page.getByRole('heading', { name: 'Edit beta' })).toBeVisible()
+    const before = await page.request.get(`${doppel.baseURL}/api/v1/proxies/beta`, {
+      headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+    })
+    expect(JSON.stringify(await before.json())).toContain('mock-1')
+
+    // Yes, and both are gone.
+    await page.getByRole('button', { name: 'Save changes' }).click()
+    await page.getByRole('dialog').getByRole('button', { name: 'Save changes' }).click()
+    await page.getByRole('cell', { name: 'beta', exact: true }).waitFor()
+
+    const after = await page.request.get(`${doppel.baseURL}/api/v1/proxies/beta`, {
+      headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+    })
+    const stored = JSON.stringify(await after.json())
+    expect(stored).not.toContain('mock-1')
+    expect(stored).not.toContain('X-Injected')
+  } finally {
+    doppel.stop()
+  }
+})
+
+test('a save that only changes things does not ask', async ({ page }) => {
+  const doppel = await startDoppel(PRIVATE_CONFIG)
+  try {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+    await page.getByText('root (admin)').waitFor()
+    await page.getByRole('link', { name: 'alpha' }).click()
+    await page.getByLabel('Upstream URL').fill('https://moved.example.com/api/')
+    await page.getByRole('button', { name: 'Save changes' }).click()
+
+    // Straight through: nothing was removed, so there is nothing to agree to.
+    await expect(page.getByRole('cell', { name: 'alpha', exact: true })).toBeVisible()
+    await expect(page.getByRole('dialog')).toHaveCount(0)
+  } finally {
+    doppel.stop()
+  }
+})
+
+test('the form leaves access overrides out when the admin API is public', async ({ page }) => {
+  // Its own instance: this configuration is public, and the file's shared one is not.
+  const doppel = await startDoppel(PUBLIC_OVERRIDES_CONFIG)
+  try {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('link', { name: 'alpha' }).click()
+    await expect(page.getByRole('heading', { name: 'Edit alpha' })).toBeVisible()
+
+    // The section is gone. Faults is not, so this is a form that rendered rather
+    // than a page that failed to load.
+    await expect(page.locator('summary').filter({ hasText: 'Faults' })).toHaveCount(1)
+    await expect(page.locator('summary').filter({ hasText: 'Access overrides' })).toHaveCount(0)
+
+    // `alpha` still holds an override, and leaving that unsaid is how the YAML mode
+    // comes to show an `access` block the form has no section for.
+    await expect(page.getByText('ignored while the admin API is public')).toBeVisible()
+
+    // `beta` holds none, so there is nothing to say about it either way.
+    await page.getByRole('link', { name: 'Proxies' }).click()
+    await page.getByRole('link', { name: 'beta' }).click()
+    await expect(page.getByRole('heading', { name: 'Edit beta' })).toBeVisible()
+    await expect(page.locator('summary').filter({ hasText: 'Access overrides' })).toHaveCount(0)
+    await expect(page.getByText('ignored while the admin API is public')).toHaveCount(0)
+  } finally {
+    doppel.stop()
+  }
+})
diff --git a/frontend/e2e/tests/off.spec.ts b/frontend/e2e/tests/off.spec.ts
new file mode 100644
index 0000000..78d7c4a
--- /dev/null
+++ b/frontend/e2e/tests/off.spec.ts
@@ -0,0 +1,27 @@
+import { expect, test } from '@playwright/test'
+
+import { DASHBOARD_OFF_CONFIG } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(DASHBOARD_OFF_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+test('admin.dashboard: false leaves the three routes unrouted', async ({ page }) => {
+  for (const path of ['/', '/robots.txt', '/static/anything.js']) {
+    const response = await page.request.get(`${doppel.baseURL}${path}`)
+    expect(response.status(), path).toBe(404)
+    expect((await response.json()).code, path).toBe('NOT_FOUND')
+  }
+})
+
+test('the JSON API is untouched', async ({ page }) => {
+  // The flag is about the dashboard, not about the listener: `admin.enable` is
+  // the one that turns the whole thing off.
+  const response = await page.request.get(`${doppel.baseURL}/api/v1/proxies`)
+  expect(response.status()).toBe(200)
+  expect((await response.json()).proxies).toHaveLength(2)
+})
diff --git a/frontend/e2e/tests/proxies.spec.ts b/frontend/e2e/tests/proxies.spec.ts
new file mode 100644
index 0000000..7e45d2f
--- /dev/null
+++ b/frontend/e2e/tests/proxies.spec.ts
@@ -0,0 +1,139 @@
+import { expect, test } from '@playwright/test'
+
+import { PRIVATE_CONFIG, READER_TOKEN, ROOT_TOKEN } from '../src/configs'
+import { fieldMessage } from '../src/fields'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/** Arrive holding a token, without going through the dialog every time. */
+async function signedIn(
+  page: import('@playwright/test').Page,
+  token = ROOT_TOKEN,
+  caller = 'root (admin)',
+) {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(token)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  // Waiting for the caller's name rather than for the table: the table is there
+  // anonymously too, so it proves nothing about the token having been accepted,
+  // and every later assertion about a control's state depends on the rights
+  // report having arrived.
+  await expect(page.getByText(caller)).toBeVisible()
+}
+
+test('the list shows what each proxy does', async ({ page }) => {
+  await signedIn(page)
+  const row = page.getByRole('row', { name: /alpha/ })
+  await expect(row).toContainText('https://alpha.example.com/api/')
+  await expect(row).toContainText('default')
+})
+
+test('a proxy can be created, edited and deleted', async ({ page }) => {
+  await signedIn(page)
+
+  await page.getByRole('button', { name: 'Add a proxy' }).click()
+  await page.getByLabel('Name', { exact: true }).fill('gamma')
+  await page.getByLabel('Upstream URL').fill('https://gamma.example.com/')
+  // Resolved by header, because `alpha` is already the default proxy and rule V12
+  // allows only one. Leaving this alone is how an operator meets that rule for
+  // the first time -- as a refusal from the server, which is the next test.
+  //
+  // Inside a folded section, so it is opened first: every group on the form starts
+  // folded, which is what keeps the form to one screen.
+  await page.locator('summary').filter({ hasText: 'Forwarding' }).first().click()
+  await page.getByLabel('Resolve by').selectOption('header')
+  await page.getByLabel('Header name').fill('X-Proxy-Name')
+  await page.getByRole('button', { name: 'Create proxy' }).click()
+  await expect(page.getByRole('cell', { name: 'gamma', exact: true })).toBeVisible()
+
+  await page.getByRole('link', { name: 'gamma' }).click()
+  await page.getByLabel('Upstream URL').fill('https://moved.example.com/')
+  await page.getByRole('button', { name: 'Save changes' }).click()
+  await expect(page.getByRole('row', { name: /gamma/ })).toContainText('moved.example.com')
+
+  await page.getByRole('row', { name: /gamma/ }).getByRole('button', { name: 'Delete' }).click()
+  await page.getByRole('dialog').getByRole('button', { name: 'Delete' }).click()
+  await expect(page.getByRole('cell', { name: 'gamma', exact: true })).toBeHidden()
+})
+
+test("a rejected document lands on the field the server complained about", async ({ page }) => {
+  await signedIn(page)
+  await page.getByRole('button', { name: 'Add a proxy' }).click()
+  await page.getByLabel('Name', { exact: true }).fill('bad')
+  // Not a URL Doppel accepts as an upstream. The server is the arbiter of that,
+  // and its complaint has to arrive under the field it is about rather than only
+  // in the banner.
+  await page.getByLabel('Upstream URL').fill('not-a-url')
+  await page.getByRole('button', { name: 'Create proxy' }).click()
+
+  // Under the field, not merely somewhere on the page. Asserting on the banner
+  // alone is what let a parser that never matched anything pass: the banner
+  // carries the same words.
+  await expect(await fieldMessage(page, 'Upstream URL')).toContainText('must be absolute')
+  // And nothing was created.
+  await page.goto(doppel.baseURL)
+  await expect(page.getByRole('cell', { name: 'bad', exact: true })).toBeHidden()
+})
+
+test('a read-only token sees the writes disabled with the reason', async ({ page }) => {
+  await signedIn(page, READER_TOKEN, 'reader (user)')
+
+  const create = page.getByRole('button', { name: 'Add a proxy' })
+  await expect(create).toBeDisabled()
+  // Disabled rather than hidden, and it says why: a missing button reads as a
+  // broken page.
+  await expect(create).toHaveAttribute('title', /may not create/)
+
+  const remove = page.getByRole('row', { name: /alpha/ }).getByRole('button', { name: 'Delete' })
+  await expect(remove).toBeDisabled()
+})
+
+test('a proxy can be renamed from the form, and its templates come with it', async ({ page }) => {
+  // Its own Doppel: renaming `alpha` takes it away from every sibling test in this
+  // file, which share one instance per worker. This used to pass on the ordering
+  // Playwright happened to pick.
+  const doppel = await startDoppel(PRIVATE_CONFIG)
+  try {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+    await page.getByText('root (admin)').waitFor()
+    await page.getByRole('link', { name: 'alpha' }).click()
+    await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+
+    // Exact: `Mock name` contains `Name`, and this proxy may already have a mock.
+    await page.getByLabel('Name', { exact: true }).fill('billing-api')
+    await page.getByRole('button', { name: 'Save changes' }).click()
+
+    // The list shows the new name and not the old one, and the page says which
+    // happened rather than "Updated".
+    await expect(page.getByRole('cell', { name: 'billing-api', exact: true })).toBeVisible()
+    await expect(page.getByRole('cell', { name: 'alpha', exact: true })).toHaveCount(0)
+    await expect(page.getByText('Renamed alpha to billing-api')).toBeVisible()
+
+    // And the document is under the new name, upstream and all.
+    await page.getByRole('link', { name: 'billing-api' }).click()
+    await expect(page.getByLabel('Upstream URL')).toHaveValue('https://alpha.example.com/api/')
+  } finally {
+    doppel.stop()
+  }
+})
+
+test('a rename onto a name already in use says so', async ({ page }) => {
+  await signedIn(page)
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+
+  await page.getByLabel('Name', { exact: true }).fill('beta')
+  await page.getByRole('button', { name: 'Save changes' }).click()
+
+  await expect(page.getByRole('alert').first()).toContainText('already exists')
+  // Still on the form, with nothing renamed.
+  await expect(page.getByRole('heading', { name: 'Edit alpha' })).toBeVisible()
+})
diff --git a/frontend/e2e/tests/refresh.spec.ts b/frontend/e2e/tests/refresh.spec.ts
new file mode 100644
index 0000000..35af527
--- /dev/null
+++ b/frontend/e2e/tests/refresh.spec.ts
@@ -0,0 +1,41 @@
+import { expect, test } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+test('the list refetches once a minute without being asked', async ({ page }) => {
+  // The clock is installed before the page loads, so the interval the app sets is
+  // the one being fast-forwarded.
+  await page.clock.install()
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await expect(page.getByRole('cell', { name: 'alpha', exact: true })).toBeVisible()
+
+  // Changed out from under the page, through the API, exactly as another operator
+  // or a `config push` would.
+  const created = await page.request.post(`${doppel.baseURL}/api/v1/proxies`, {
+    headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+    data: {
+      proxy: {
+        name: 'gamma',
+        type: 'http',
+        url: 'https://gamma.example.com/',
+        // `alpha` is the default proxy already, and only one may be.
+        resolve: { type: 'header', header: 'X-Proxy-Name' },
+      },
+    },
+  })
+  expect(created.status()).toBe(201)
+  await expect(page.getByRole('cell', { name: 'gamma', exact: true })).toBeHidden()
+
+  await page.clock.runFor('01:05')
+  await expect(page.getByRole('cell', { name: 'gamma', exact: true })).toBeVisible()
+})
diff --git a/frontend/e2e/tests/syntax.spec.ts b/frontend/e2e/tests/syntax.spec.ts
new file mode 100644
index 0000000..6e54acf
--- /dev/null
+++ b/frontend/e2e/tests/syntax.spec.ts
@@ -0,0 +1,135 @@
+import { expect, test, type Page } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { paintedRgb, paintedRgbAll } from '../src/colour'
+import { startDoppel, type Doppel } from '../src/server'
+
+// Syntax colouring, measured in painted pixels.
+//
+// prism's grammars ship in its package and its palette does not, so for a while
+// every editor here tokenised perfectly and rendered in one colour --
+// indistinguishable from no highlighting at all. A test for a class name would have
+// passed throughout. These read the colour a screen actually gets.
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/** Signed in as admin. */
+async function signIn(page: Page): Promise<void> {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+}
+
+/** Every distinct painted colour among the highlighter's spans. */
+async function tokenColours(page: Page): Promise<Set<string>> {
+  const painted = await paintedRgbAll(page, 'pre .token', 'color')
+  expect(painted.length).toBeGreaterThan(0)
+  return new Set(painted.map((rgb) => rgb.join(',')))
+}
+
+test('the highlighter colours a JSON body, in both themes', async ({ page }) => {
+  await signIn(page)
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+  await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+  await page.getByLabel('mock-1 response source').selectOption('json')
+  const editor = page.getByLabel(/mock-1 json/)
+
+  await editor.fill('{"greeting": "hello", "count": 12}')
+  const base = (await paintedRgb(page, 'pre', 'color')).join(',')
+  const light = await tokenColours(page)
+
+  // More than one colour, and not all of them the text's own: with no palette
+  // every token is `base` and both of these fail.
+  expect(light.size).toBeGreaterThan(1)
+  expect([...light].some((colour) => colour !== base)).toBe(true)
+
+  // The dark palette is a separate theme in the package, re-scoped under `.dark`;
+  // without it a dark page would show the light theme's colours.
+  await page.getByLabel('Theme').selectOption('dark')
+  const dark = await tokenColours(page)
+  expect(dark.size).toBeGreaterThan(1)
+  expect([...dark].some((colour) => !light.has(colour))).toBe(true)
+
+})
+
+test('a path pattern is coloured, and sits at the height of a control', async ({ page }) => {
+  // The field an operator gets wrong most often, so its brackets, classes and
+  // quantifiers are worth colouring -- a stray bracket is visible before the server
+  // compiles it.
+  await signIn(page)
+  await page.getByRole('button', { name: 'Add a proxy' }).click()
+  await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+
+  const pattern = page.getByLabel('Path pattern')
+  await pattern.fill('^/api/v1/resource/(?P<resourceId>\\d+)/$')
+
+  const colours = await tokenColours(page)
+  // Groups, classes, quantifiers and anchors are four different things, and prism's
+  // regex grammar aliases each onto a class the theme colours.
+  expect(colours.size).toBeGreaterThan(2)
+
+  // One line, at the height of the select beside it: an editor two pixels short of
+  // its neighbours is the stepping this form has already been fixed for.
+  const [box, method] = await Promise.all([
+    pattern.boundingBox(),
+    page.getByLabel(/method/).boundingBox(),
+  ])
+  expect(box!.height).toBe(method!.height)
+})
+
+test('the whole document is coloured in the YAML editor', async ({ page }) => {
+  await signIn(page)
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+  await page.getByLabel('Edit as YAML').check()
+
+  const editor = page.getByLabel('The whole proxy, as YAML')
+  await editor.fill('name: alpha\ntype: http\ntimeout: 30\nrewrite_redirects: false\n')
+
+  // Keys, strings, a number and a boolean are four things, and prism's yaml grammar
+  // aliases each onto a class the theme colours.
+  expect((await tokenColours(page)).size).toBeGreaterThan(2)
+})
+
+test('a Jinja expression is coloured everywhere one is allowed', async ({ page }) => {
+  // Four fields render through Jinja: a mock's text body, its JSON body, a response
+  // header, and a template file. The braces used to be plain in all of them, which made
+  // `{{ requestId }}` look like part of the text it is not.
+  await signIn(page)
+  await page.getByRole('button', { name: 'Add a proxy' }).click()
+  await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+
+  // A header value: one line, and a template rather than a string.
+  await page.getByRole('button', { name: 'Add Response headers' }).click()
+  await page.getByLabel('Response headers header name 1').fill('X-Request-ID')
+  await page.getByLabel('Response headers template 1').fill('rid-{{ requestId }}')
+  const header = await tokenColours(page)
+  expect(header.size).toBeGreaterThan(1)
+
+  // A text body: the same, with room for a statement.
+  await page.getByLabel(/mock-1 body/).fill('hello {{ name }}{% if late %}, sorry{% endif %}')
+  expect((await tokenColours(page)).size).toBeGreaterThan(1)
+
+  // A JSON body: both languages at once, which is the composition worth checking in a
+  // browser rather than only in a unit test -- an expression inside a string is the
+  // case prism resolves in favour of the string unless it is asked not to.
+  await page.getByLabel('mock-1 response source').selectOption('json')
+  await page.getByLabel(/mock-1 json/).fill('{"id": "{{ resourceId }}", "n": 1}')
+  const both = await paintedRgbAll(page, 'pre .token', 'color')
+  const json = await paintedRgbAll(page, 'pre .token.property', 'color')
+  const jinja = await paintedRgbAll(page, 'pre .token.jinja2 .token.variable', 'color')
+  expect(json.length).toBeGreaterThan(0)
+  expect(jinja.length).toBeGreaterThan(0)
+  expect(json[0]).not.toEqual(jinja[0])
+  expect(new Set(both.map((rgb) => rgb.join(','))).size).toBeGreaterThan(2)
+})
diff --git a/frontend/e2e/tests/templates.spec.ts b/frontend/e2e/tests/templates.spec.ts
new file mode 100644
index 0000000..ef459c8
--- /dev/null
+++ b/frontend/e2e/tests/templates.spec.ts
@@ -0,0 +1,129 @@
+import { expect, test, type Page } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+// Template files are the admin API's, not the dashboard's.
+//
+// They had a section in the form for a while: a list, an editor, and a name to type.
+// It was the wrong shape -- a file store inside a form over a document, with a Save of
+// its own that did not wait for the form's -- so it is gone. What the page still does
+// is read a mock that answers with a template: it shows which file, refuses to edit
+// it, and lets the mock be moved onto a body instead.
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+async function signedIn(page: Page): Promise<void> {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+}
+
+/** Give `beta` a mock that answers with a template, through the API. */
+async function withTemplateMock(page: Page): Promise<void> {
+  const read = await page.request.get(`${doppel.baseURL}/api/v1/proxies/beta`, {
+    headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+  })
+  const { revision, proxy } = (await read.json()) as {
+    revision: string
+    proxy: Record<string, unknown>
+  }
+  const written = await page.request.put(`${doppel.baseURL}/api/v1/proxies/beta`, {
+    headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}`, 'If-Match': `"${revision}"` },
+    data: {
+      revision,
+      proxy: {
+        ...proxy,
+        mocks: [
+          {
+            name: 'from-a-file',
+            request: { method: 'GET', url: '^/from-a-file$' },
+            response: { status: 200, template: 'page.json.j2' },
+          },
+        ],
+      },
+    },
+  })
+  expect(written.status()).toBe(200)
+}
+
+test('the form has no templates section and no way to name a file', async ({ page }) => {
+  await signedIn(page)
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+
+  await expect(page.locator('summary').filter({ hasText: 'Templates' })).toHaveCount(0)
+
+  // And a new mock is offered two answers, not three.
+  await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+  await expect(page.getByLabel('mock-1 response source').locator('option')).toHaveText([
+    'Text body',
+    'JSON body',
+  ])
+})
+
+test('a template set in the configuration is shown, locked, and can be left', async ({ page }) => {
+  await withTemplateMock(page)
+  await signedIn(page)
+  await page.getByRole('link', { name: 'beta' }).click()
+  await page.getByRole('heading', { name: 'Edit beta' }).waitFor()
+  await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+
+  // Shown, so an operator knows what the mock answers with...
+  const file = page.getByLabel('Template file')
+  await expect(file).toHaveValue('page.json.j2')
+  // ...and not editable, because naming a file the page cannot upload would be an
+  // invitation to a render error.
+  await expect(file).toBeDisabled()
+  await expect(page.getByText(/uploaded through the admin API/)).toBeVisible()
+
+  // The mock can be moved onto a body, which is the change the page does support.
+  await page.getByLabel('from-a-file response source').selectOption('json')
+  await expect(page.getByLabel('Template file')).toHaveCount(0)
+  await page.getByLabel(/from-a-file json/).fill('{"ok": true}')
+
+  // Leaving the template is a removal, so the save says so before doing it.
+  await page.getByRole('button', { name: 'Save changes' }).click()
+  const dialog = page.getByRole('dialog')
+  await expect(dialog).toContainText('page.json.j2')
+  await dialog.getByRole('button', { name: 'Save changes' }).click()
+
+  const stored = await page.request.get(`${doppel.baseURL}/api/v1/proxies/beta`, {
+    headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+  })
+  const { proxy } = (await stored.json()) as {
+    proxy: { mocks: Array<{ response: Record<string, unknown> }> }
+  }
+  expect(proxy.mocks[0]!.response.template).toBeUndefined()
+  expect(proxy.mocks[0]!.response.json).toBe('{"ok": true}')
+})
+
+test('switching away from a template can be undone while the page is open', async ({ page }) => {
+  // The name cannot be typed back in, so the option stays offered for as long as the
+  // page remembers what the document said.
+  await withTemplateMock(page)
+  await signedIn(page)
+  await page.getByRole('link', { name: 'beta' }).click()
+  await page.locator('summary').filter({ hasText: 'Mocks' }).first().click()
+
+  const source = page.getByLabel('from-a-file response source')
+  await source.selectOption('body')
+  await expect(page.getByLabel('Template file')).toHaveCount(0)
+
+  await source.selectOption('template')
+  await expect(page.getByLabel('Template file')).toHaveValue('page.json.j2')
+})
+
+test('the old templates address still lands somewhere', async ({ page }) => {
+  // It was a page of its own for two releases, so the URL is linkable and someone has
+  // it.
+  await page.goto(`${doppel.baseURL}/proxies/alpha/templates`)
+  await expect(page).toHaveURL(/\/proxies\/alpha$/)
+})
diff --git a/frontend/e2e/tests/theme.spec.ts b/frontend/e2e/tests/theme.spec.ts
new file mode 100644
index 0000000..0dd8e4e
--- /dev/null
+++ b/frontend/e2e/tests/theme.spec.ts
@@ -0,0 +1,200 @@
+import { expect, test } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { contrast, luminance, paintedRgb } from '../src/colour'
+import { startDoppel, type Doppel } from '../src/server'
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/**
+ * The page's own colours, in both themes.
+ *
+ * This exists because the dark theme rendered a white page: every component
+ * carried its own `dark:` text colour and nothing coloured the page itself, so the
+ * heading was near-white on white. A screenshot showed it immediately and no
+ * assertion did -- which is why this one is about contrast rather than about a
+ * class being present.
+ */
+for (const theme of ['light', 'dark'] as const) {
+  test(`the ${theme} theme is readable`, async ({ page }) => {
+    await page.goto(doppel.baseURL)
+    await page.getByRole('button', { name: 'Continue without a token' }).click()
+    await page.getByLabel('Theme').selectOption(theme)
+
+    const background = await paintedRgb(page, 'body', 'backgroundColor')
+    const heading = await paintedRgb(page, 'h1', 'color')
+
+    // 4.5:1 is the WCAG threshold for body text. The failure this guards measured
+    // about 1.1:1.
+    expect(contrast(background, heading)).toBeGreaterThan(4.5)
+
+    // And the page is the colour the theme says, rather than merely contrasting:
+    // white text on a white page fails the check above, but so would a light theme
+    // that had gone dark.
+    const brightness = luminance(background)
+    if (theme === 'light') {
+      expect(brightness).toBeGreaterThan(0.5)
+    } else {
+      expect(brightness).toBeLessThan(0.1)
+    }
+
+    // Native controls -- a select, a scrollbar, a caret -- are drawn by the browser
+    // and follow this and nothing else.
+    const scheme = await page.locator('html').evaluate((node) => getComputedStyle(node).colorScheme)
+    expect(scheme).toBe(theme)
+  })
+}
+
+test('a notice goes away on its own', async ({ page }) => {
+  // They were dismissible and nothing else, so three reloads left three notices
+  // stacked in the corner for the rest of the session.
+  await page.clock.install()
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+
+  await page.getByRole('link', { name: 'Status' }).click()
+  await page.getByRole('button', { name: 'Reload configuration' }).click()
+
+  const notice = page.getByRole('button', { name: /Reloaded at revision/ })
+  await expect(notice).toBeVisible()
+  await page.clock.runFor('00:05')
+  await expect(notice).toBeHidden()
+})
+
+test('the form opens folded, and its save bar is on screen from the start', async ({ page }) => {
+  // Two complaints with one cause: the form was a page and a half of controls, so
+  // the save button was a scroll away and the section being edited was buried under
+  // the ones that were not.
+  await page.setViewportSize({ width: 1200, height: 600 })
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+
+  // Folded: the fields inside a section are not on the page until it is opened.
+  await expect(page.getByLabel('Replace')).toBeHidden()
+  await expect(page.getByLabel('Timeout (seconds)')).toBeHidden()
+  // And a folded section still says whether there is anything in it.
+  await expect(page.locator('summary').filter({ hasText: 'Faults' })).toContainText('none')
+
+  const save = page.getByRole('button', { name: 'Save changes' })
+  const box = await save.boundingBox()
+  const viewport = page.viewportSize()
+  expect(box).not.toBeNull()
+  // On screen without scrolling, which is what "sticky" has to mean.
+  expect(box!.y + box!.height).toBeLessThanOrEqual(viewport!.height)
+
+  // Still on screen with everything open, which is the case that used to fail.
+  for (const section of ['Forwarding', 'Faults', 'Access overrides', 'Mocks']) {
+    await page.locator('summary').filter({ hasText: section }).first().click()
+  }
+  const opened = await save.boundingBox()
+  expect(opened!.y + opened!.height).toBeLessThanOrEqual(viewport!.height)
+})
+
+test('the controls on a row are the same height, and a select has an arrow', async ({ page }) => {
+  // The elements "jumped": an input, a select and a button sat at three heights, so
+  // a row of them stepped up and down.
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.locator('summary').filter({ hasText: 'Forwarding' }).first().click()
+
+  const heights = await Promise.all(
+    [
+      page.getByLabel('Name', { exact: true }),
+      page.getByLabel('Timeout (seconds)'),
+      page.getByLabel('Resolve by'),
+      page.getByRole('button', { name: 'Save changes' }),
+    ].map(async (locator) => (await locator.boundingBox())!.height),
+  )
+  expect(new Set(heights).size).toBe(1)
+
+  // The select's own affordance. `appearance-none` removed the native arrow, and a
+  // background image replaced it -- for a while it did not, because the arbitrary
+  // Tailwind value carrying the SVG never reached the stylesheet, leaving a select
+  // with no arrow at all.
+  const select = page.getByLabel('Resolve by')
+  await expect(select).toHaveCSS('appearance', 'none')
+  const image = await select.evaluate((node) => getComputedStyle(node).backgroundImage)
+  expect(image).toContain('url(')
+})
+
+test('signing in clears a refusal that is already on screen', async ({ page }) => {
+  // The list is fetched on a timer, so a refusal shown to an anonymous caller used
+  // to stay up until the next tick -- up to a minute of the page telling someone who
+  // had just entered a token that they needed one.
+  const doppel = await startDoppel(`
+server:
+  host: "127.0.0.1"
+  port: {proxyPort}
+admin:
+  host: "127.0.0.1"
+  port: {adminPort}
+  tokens:
+    - name: root
+      group: admin
+      token: ${ROOT_TOKEN}
+  access:
+    list: ["admin"]
+    read: ["admin"]
+    create: ["admin"]
+    update: ["admin"]
+    delete: ["admin"]
+    upload: ["admin"]
+  upload:
+    limit: 1Mi
+control:
+  socket: {controlSocket}
+templates:
+  dir: {templatesDir}
+proxies:
+  - name: alpha
+    type: http
+    url: "https://alpha.example.com/api/"
+`)
+  try {
+    await page.goto(doppel.baseURL)
+    // Nothing is public here, so declining leaves a page that says so.
+    await page.getByRole('button', { name: 'Continue without a token' }).click()
+    const refusal = page.getByRole('alert').first()
+    await expect(refusal).toBeVisible()
+
+    await page.getByRole('button', { name: 'Enter token' }).click()
+    await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+    await page.getByRole('button', { name: 'Use this token' }).click()
+
+    // Without waiting for a tick: the refusal goes and the list arrives.
+    await expect(page.getByRole('cell', { name: 'alpha', exact: true })).toBeVisible({
+      timeout: 5000,
+    })
+    await expect(refusal).toBeHidden()
+  } finally {
+    doppel.stop()
+  }
+})
+
+test('the header links to Swagger UI, and it answers', async ({ page }) => {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('button', { name: 'Continue without a token' }).click()
+
+  const link = page.getByRole('link', { name: /API/ })
+  await expect(link).toHaveAttribute('href', '/swagger-ui/')
+  // A real link rather than a client-side route, so the target has to answer. It is
+  // outside `/api/` because it is a page rather than an endpoint, and react-router
+  // must not claim it either -- an explicit route wins over the page's fallback.
+  const served = await page.request.get(`${doppel.baseURL}/swagger-ui/`)
+  expect(served.status()).toBe(200)
+  expect(await served.text()).toContain('swagger')
+})
diff --git a/frontend/e2e/tests/validation.spec.ts b/frontend/e2e/tests/validation.spec.ts
new file mode 100644
index 0000000..6ca0384
--- /dev/null
+++ b/frontend/e2e/tests/validation.spec.ts
@@ -0,0 +1,199 @@
+import { expect, test, type Page } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+// What the page refuses before the server is asked.
+//
+// Every bound checked here is read from `GET /api/v1/schema` at load, which is
+// generated from the Rust newtypes that enforce it -- so these are not a second set
+// of rules but the same ones, arriving early. The last test in this file is the one
+// that proves it: with the schema endpoint unreachable, the complaints are gone and
+// saving is the only way to find out, exactly as it was before.
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/** Signed in as admin, on the form for a new proxy. */
+async function openForm(page: Page): Promise<void> {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+  await page.getByRole('button', { name: 'Add a proxy' }).click()
+  await page.getByRole('heading', { name: 'Add a proxy' }).waitFor()
+}
+
+/** Open a folded section by its heading. */
+async function open(page: Page, title: string): Promise<void> {
+  await page.locator('summary').filter({ hasText: title }).first().click()
+}
+
+test('a name that breaks the pattern is refused while it is being typed', async ({ page }) => {
+  await openForm(page)
+  const name = page.getByLabel('Name', { exact: true })
+
+  await name.fill('has space')
+  // Nothing was saved: this is the schema's `pattern`, and the message is the
+  // type's own description of it.
+  await expect(page.getByText('Letters, digits, - and _, between 2 and 32 characters.')).toBeVisible()
+
+  await name.fill('billing-api')
+  await expect(
+    page.getByText('Letters, digits, - and _, between 2 and 32 characters.'),
+  ).toBeHidden()
+})
+
+test('a name outside its length is refused, at either end', async ({ page }) => {
+  await openForm(page)
+  const name = page.getByLabel('Name', { exact: true })
+
+  await name.fill('a')
+  await expect(page.getByText('at least 2 characters')).toBeVisible()
+
+  await name.fill('x'.repeat(33))
+  await expect(page.getByText('at most 32 characters; this is 33')).toBeVisible()
+
+  await name.fill('x'.repeat(32))
+  await expect(page.getByText(/at most 32 characters/)).toBeHidden()
+})
+
+test('a number outside its range is refused, and the input carries the range', async ({ page }) => {
+  await openForm(page)
+  await open(page, 'Forwarding')
+
+  const timeout = page.getByLabel('Timeout (seconds)')
+  // The bounds the browser itself enforces on the spinners and the keyboard, taken
+  // from the schema rather than written here.
+  await expect(timeout).toHaveAttribute('min', '1')
+  await expect(timeout).toHaveAttribute('max', '3600')
+
+  await timeout.fill('5000')
+  await expect(page.getByText('must be between 1 and 3600')).toBeVisible()
+
+  await timeout.fill('30')
+  await expect(page.getByText('must be between 1 and 3600')).toBeHidden()
+})
+
+test('a fraction that was written as a percentage is refused', async ({ page }) => {
+  // The mistake the schema's own documentation names: `percentage: 45` where a
+  // fraction was meant.
+  await openForm(page)
+  await open(page, 'Faults')
+
+  await page.getByLabel('Loss rate').fill('45')
+  await expect(page.getByText('must be between 0 and 1')).toBeVisible()
+
+  await page.getByLabel('Loss rate').fill('0.05')
+  await expect(page.getByText('must be between 0 and 1')).toBeHidden()
+})
+
+test('a mock is held to the same bounds as the proxy around it', async ({ page }) => {
+  await openForm(page)
+  await open(page, 'Mocks')
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+
+  // A mock's name allows 64 characters where a proxy's allows 32, and the page
+  // knows the difference because it read both.
+  await page.getByLabel('Mock name').fill('two words')
+  await expect(page.getByText('Letters, digits, - and _, between 2 and 64 characters.')).toBeVisible()
+  await page.getByLabel('Mock name').fill('one-widget')
+  await expect(
+    page.getByText('Letters, digits, - and _, between 2 and 64 characters.'),
+  ).toBeHidden()
+
+  // Exact: "Loss status" contains "Status" too, and carries the same bounds.
+  const status = page.getByLabel('Status', { exact: true })
+  await expect(status).toHaveAttribute('min', '100')
+  await expect(status).toHaveAttribute('max', '599')
+  await status.fill('99')
+  await expect(page.getByText('must be between 100 and 599')).toBeVisible()
+})
+
+test('a selector is checked as it is typed', async ({ page }) => {
+  await openForm(page)
+  await open(page, 'Mocks')
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+  await open(page, 'Variables from the request')
+
+  await page.getByRole('button', { name: 'Add Variables from the body' }).click()
+  const selector = page.getByLabel('Variables from the body selector 1')
+
+  // The leading dot is the whole rule, and forgetting it is the mistake.
+  await selector.fill('content.items')
+  await expect(page.getByText(/leading dot/)).toBeVisible()
+  await expect(selector).toHaveAttribute('aria-invalid', 'true')
+
+  await selector.fill('.content.items')
+  await expect(page.getByText(/leading dot/)).toBeHidden()
+})
+
+test('a path pattern is left to the server, dialect and all', async ({ page }) => {
+  // Deliberately unchecked here. The server compiles it with Rust's `regex`, whose
+  // named groups are `(?P<id>...)` -- which `new RegExp` refuses. A browser-side
+  // syntax check would report perfectly good Doppel patterns as broken, so the only
+  // honest answer is the server's.
+  await openForm(page)
+  await open(page, 'Mocks')
+  await page.getByRole('button', { name: 'Add a mock' }).click()
+
+  await page.getByLabel('Path pattern').fill('/api/v1/resource/(?P<resourceId>\\d+)/')
+  // No complaint anywhere on the form: the field's own hint still says what a path
+  // pattern is, and nothing has been reported as wrong.
+  await expect(page.getByRole('alert')).toHaveCount(0)
+})
+
+test('the bounds come from the server, not from this bundle', async ({ page }) => {
+  // The test that keeps the rest of this file honest. With the schema unreachable
+  // the page has nothing to check against, so a name it would otherwise refuse
+  // draws no complaint -- which is only possible if the complaint came from the
+  // fetched document.
+  await page.route('**/api/v1/schema', (route) => route.abort())
+  await openForm(page)
+
+  await page.getByLabel('Name', { exact: true }).fill('has space')
+  await expect(
+    page.getByText('Letters, digits, - and _, between 2 and 32 characters.'),
+  ).toHaveCount(0)
+
+  // And the form still works: the server is what refuses it.
+  await page.getByLabel('Upstream URL').fill('https://example.com/api/')
+  await page.getByRole('button', { name: 'Create proxy' }).click()
+  await expect(page.getByRole('alert').first()).toContainText(/name/i)
+})
+
+test('an (i) beside a field links to that field, for this version', async ({ page }) => {
+  // A wrong fragment is silent in a browser -- the page just opens at the top -- so
+  // this asserts the whole href, and `scripts/check_docs_links.py` asserts that the
+  // fragment exists in the generated reference.
+  await openForm(page)
+
+  const injected = await page.locator('#doppel-config').textContent()
+  const { version } = JSON.parse(injected ?? '{}') as { version: string }
+
+  // Located by where it goes: every (i) is named the same on purpose, so that
+  // looking a field up by its label finds the field rather than the link beside it.
+  const url = (anchor: string) =>
+    `https://lorem-dev.github.io/doppel/${version}/usage/parameters/#${anchor}`
+
+  const name = page.locator(`a[href="${url('proxies-name')}"]`)
+  await expect(name).toBeVisible()
+  await expect(name).toHaveAttribute('title', /^Name:/)
+
+  // A footnote marker beside the words, not a control: small, and centred on the line
+  // rather than on the space under it. It sat two pixels low when the row centred it
+  // against the label's bottom margin.
+  const mark = (await name.boundingBox())!
+  const label = (await page.getByText('Name', { exact: true }).boundingBox())!
+  expect(mark.height).toBeLessThanOrEqual(14)
+  expect(Math.abs(mark.y + mark.height / 2 - (label.y + label.height / 2))).toBeLessThan(1)
+  // It leaves the dashboard, and a half-filled form is not worth losing.
+  await expect(name).toHaveAttribute('target', '_blank')
+
+  await open(page, 'Faults')
+  await expect(page.locator(`a[href="${url('proxies-loss-percentage')}"]`)).toBeVisible()
+})
diff --git a/frontend/e2e/tests/yaml.spec.ts b/frontend/e2e/tests/yaml.spec.ts
new file mode 100644
index 0000000..4837624
--- /dev/null
+++ b/frontend/e2e/tests/yaml.spec.ts
@@ -0,0 +1,172 @@
+import { expect, test, type Page } from '@playwright/test'
+
+import { PRIVATE_CONFIG, ROOT_TOKEN } from '../src/configs'
+import { startDoppel, type Doppel } from '../src/server'
+
+// Editing a proxy as YAML.
+//
+// The form is better for changing one field and worse for everything else -- pasting
+// a proxy from a colleague, reordering mocks, copying a block out of `main.yaml`.
+// This is the same document in the shape the configuration file has.
+
+let doppel: Doppel
+
+test.beforeAll(async () => {
+  doppel = await startDoppel(PRIVATE_CONFIG)
+})
+test.afterAll(() => doppel.stop())
+
+/** Signed in as admin, editing alpha, in YAML mode. */
+async function openYaml(page: Page): Promise<void> {
+  await page.goto(doppel.baseURL)
+  await page.getByRole('textbox', { name: 'Token' }).fill(ROOT_TOKEN)
+  await page.getByRole('button', { name: 'Use this token' }).click()
+  await page.getByText('root (admin)').waitFor()
+  await page.getByRole('link', { name: 'alpha' }).click()
+  await page.getByRole('heading', { name: 'Edit alpha' }).waitFor()
+  await page.getByLabel('Edit as YAML').check()
+  await page.getByLabel('The whole proxy, as YAML').waitFor()
+}
+
+const editor = (page: Page) => page.getByLabel('The whole proxy, as YAML')
+
+test('the toggle swaps the form for the document it was editing', async ({ page }) => {
+  await openYaml(page)
+
+  // The document, not a template: what the form had loaded.
+  await expect(editor(page)).toHaveValue(/name: alpha/)
+  await expect(editor(page)).toHaveValue(/url: https:\/\/alpha\.example\.com\/api\//)
+  // And the form is gone rather than hidden behind it.
+  await expect(page.getByLabel('Upstream URL')).toHaveCount(0)
+
+  // Back again, with the edit carried over.
+  await editor(page).fill('name: alpha\ntype: http\nurl: https://beta.example.com/api/\n')
+  await page.getByLabel('Edit as YAML').uncheck()
+  await expect(page.getByLabel('Upstream URL')).toHaveValue('https://beta.example.com/api/')
+})
+
+test('tab indents inside the document instead of leaving it', async ({ page }) => {
+  await openYaml(page)
+  const yaml = editor(page)
+
+  await yaml.fill('name: alpha\ntype: http\nurl: https://alpha.example.com/api/\nheaders:\n')
+  await yaml.press('End')
+  await yaml.press('Tab')
+  await yaml.pressSequentially('X-A: b')
+
+  // The tab went into the document, so the header is nested under `headers`.
+  await expect(yaml).toHaveValue(/headers:\n\s+X-A: b/)
+  // And focus never left the editor, which is what a tab usually does.
+  await expect(yaml).toBeFocused()
+})
+
+test('Reformat tidies what is there', async ({ page }) => {
+  await openYaml(page)
+  const yaml = editor(page)
+
+  // Legal YAML, written the way nobody wants to read it.
+  await yaml.fill('{name: alpha, type: http, url: "https://alpha.example.com/api/"}')
+  await page.getByRole('button', { name: 'Reformat' }).click()
+
+  await expect(yaml).toHaveValue('name: alpha\ntype: http\nurl: https://alpha.example.com/api/\n')
+})
+
+test('a document that breaks a rule is refused before the server sees it', async ({ page }) => {
+  await openYaml(page)
+  const yaml = editor(page)
+  const save = page.getByRole('button', { name: 'Save changes' })
+
+  await yaml.fill(
+    'name: alpha\ntype: http\nurl: https://alpha.example.com/api/\ntimeout: 5000\n',
+  )
+  // The bound is the schema's, and the message names the field and the number.
+  await expect(page.getByRole('alert')).toContainText('timeout')
+  await expect(page.getByRole('alert')).toContainText('5000 is greater than 3600')
+  await expect(save).toBeDisabled()
+
+  // A field the schema does not know, which is the mistake a typo makes.
+  await yaml.fill('name: alpha\ntype: http\nurl: https://alpha.example.com/api/\ntimeuot: 30\n')
+  await expect(page.getByRole('alert')).toContainText('is not a field of this document')
+  await expect(save).toBeDisabled()
+
+  // Not YAML at all.
+  await yaml.fill('name: alpha\n  bad indent: yes\n')
+  await expect(page.getByRole('alert')).toBeVisible()
+  await expect(save).toBeDisabled()
+
+  // And a good document clears all of it.
+  await yaml.fill('name: alpha\ntype: http\nurl: https://alpha.example.com/api/\ntimeout: 45\n')
+  await expect(page.getByRole('alert')).toHaveCount(0)
+  await expect(save).toBeEnabled()
+})
+
+test('the toggle stays put while the document is broken', async ({ page }) => {
+  // Switching back would show the form the last document that parsed, quietly
+  // throwing away whatever is being written.
+  await openYaml(page)
+  await editor(page).fill('name: alpha\n  bad indent: yes\n')
+  await expect(page.getByLabel('Edit as YAML')).toBeDisabled()
+})
+
+test('what the editor saves is what the server stores', async ({ page }) => {
+  await openYaml(page)
+  await editor(page).fill(
+    'name: alpha\ntype: http\nurl: https://alpha.example.com/api/\ntimeout: 45\nreplace: 0.5\n',
+  )
+  await page.getByRole('button', { name: 'Save changes' }).click()
+  await page.getByRole('cell', { name: 'alpha', exact: true }).waitFor()
+
+  const stored = await page.request.get(`${doppel.baseURL}/api/v1/proxies/alpha`, {
+    headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+  })
+  const { proxy } = (await stored.json()) as { proxy: Record<string, unknown> }
+  expect(proxy.timeout).toBe(45)
+  expect(proxy.replace).toBe(0.5)
+})
+
+test('a refused save leaves the document tidied rather than as it was typed', async ({ page }) => {
+  // "Format on save" is only visible when the save comes back refused, which is also
+  // when it matters: what is on screen is what has to be fixed.
+  await openYaml(page)
+
+  // Move the revision under the form, so the save is refused for a reason that has
+  // nothing to do with the document.
+  const current = await page.request.get(`${doppel.baseURL}/api/v1/proxies/alpha`, {
+    headers: { 'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}` },
+  })
+  const { revision, proxy } = (await current.json()) as {
+    revision: string
+    proxy: Record<string, unknown>
+  }
+  const moved = await page.request.put(`${doppel.baseURL}/api/v1/proxies/alpha`, {
+    headers: {
+      'X-Proxy-Authorization': `Bearer ${ROOT_TOKEN}`,
+      'If-Match': `"${revision}"`,
+      'Content-Type': 'application/json',
+    },
+    data: { proxy: { ...proxy, timeout: 11 } },
+  })
+  expect(moved.status()).toBe(200)
+
+  await editor(page).fill('{name: alpha, type: http, url: "https://alpha.example.com/api/"}')
+  await page.getByRole('button', { name: 'Save changes' }).click()
+
+  await expect(page.getByRole('alert').first()).toContainText(/revision|reload/i)
+  await expect(editor(page)).toHaveValue(
+    'name: alpha\ntype: http\nurl: https://alpha.example.com/api/\n',
+  )
+})
+
+test('the editor links to the documentation for the running version', async ({ page }) => {
+  await openYaml(page)
+  const injected = await page.locator('#doppel-config').textContent()
+  const { version } = JSON.parse(injected ?? '{}') as { version: string }
+
+  // By where it goes: the footer has a Documentation link too, and it goes to the
+  // root of the same versioned site.
+  const link = page.locator(
+    `a[href="https://lorem-dev.github.io/doppel/${version}/usage/parameters/#proxies"]`,
+  )
+  await expect(link).toBeVisible()
+  await expect(link).toHaveAttribute('target', '_blank')
+})
diff --git a/frontend/eslint.config.js b/frontend/eslint.config.js
new file mode 100644
index 0000000..970ee6c
--- /dev/null
+++ b/frontend/eslint.config.js
@@ -0,0 +1,51 @@
+// Flat config, eslint 10. Three layers and no more: the language defaults,
+// typescript-eslint's recommended set, and the React hook rules -- which are the
+// ones that catch real bugs rather than style.
+import js from '@eslint/js'
+import reactHooks from 'eslint-plugin-react-hooks'
+import tseslint from 'typescript-eslint'
+
+export default tseslint.config(
+  { ignores: ['dist', 'coverage', 'playwright-report', 'test-results', 'node_modules'] },
+  {
+    // The build helpers run under node, not in a browser, so `console` and
+    // `process` are globals there and nowhere else.
+    files: ['scripts/**/*.mjs', '*.config.{js,ts}'],
+    languageOptions: { globals: { console: 'readonly', process: 'readonly' } },
+  },
+  js.configs.recommended,
+  tseslint.configs.recommended,
+  {
+    files: ['**/*.{ts,tsx}'],
+    plugins: { 'react-hooks': reactHooks },
+    rules: { ...reactHooks.configs.recommended.rules },
+  },
+  {
+    files: ['src/components/**/*.tsx'],
+    rules: {
+      // The layer rule, stated where a machine can check it: a presentational
+      // component knows nothing about the API. Pages do -- a page is the layer
+      // that fetches, holds the screen's state and hands data down -- and shared
+      // state that outlives one screen lives in a store instead. Without this
+      // rule the first component to grow a `fetch` would be the one nothing can
+      // be tested without.
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              // `runtimeConfig` and `docs` are exempt because neither calls anything:
+              // one reads the configuration the page was served with, the other turns
+              // its version into a URL. What the rule is for is a component that
+              // fetches -- a control that talks to the API decides when it talks, and
+              // then a page cannot say when.
+              group: ['**/services/*', '!**/services/runtimeConfig', '!**/services/docs'],
+              message:
+                'a presentational component must not call the API; a page or a store does that',
+            },
+          ],
+        },
+      ],
+    },
+  },
+)
diff --git a/frontend/index.html b/frontend/index.html
new file mode 100644
index 0000000..6cd9d2d
--- /dev/null
+++ b/frontend/index.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <!-- The listener sends `X-Robots-Tag` as well. This is here for a crawler
+         that reads markup and ignores headers; an admin dashboard has no
+         business in a search index. -->
+    <meta name="robots" content="noindex, nofollow" />
+    <link rel="icon" href="/static/favicon.ico" sizes="any" />
+    <!-- Replaced with the real title by the app, from the injected
+         configuration. What is here is what a browser shows before the bundle
+         runs. -->
+    <title>Doppel</title>
+    <!-- Substituted at request time by the admin listener. The placeholder is
+         what `npm run dev` sees, so the app is developable without a server
+         rendering it: the shape is the same, the values are not. -->
+    <script type="application/json" id="doppel-config">
+      {"title":"Doppel","titleIsDefault":true,"public":false,"version":"dev","authHeader":"X-Proxy-Authorization","refreshMs":60000,"copyrightYear":2026}
+    </script>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>
diff --git a/frontend/jest.config.ts b/frontend/jest.config.ts
new file mode 100644
index 0000000..7bd51ab
--- /dev/null
+++ b/frontend/jest.config.ts
@@ -0,0 +1,35 @@
+import type { Config } from 'jest'
+
+// `@swc/jest` rather than `ts-jest`: ts-jest pins `typescript <7` and needs
+// `@babel/core` as a peer, and this transform needs neither. Types are checked
+// by `npm run typecheck`, not by the test run -- one job each.
+const config: Config = {
+  testEnvironment: 'jsdom',
+  setupFilesAfterEnv: ['<rootDir>/src/test-setup.ts'],
+  transform: {
+    '^.+\\.(t|j)sx?$': [
+      '@swc/jest',
+      {
+        jsc: {
+          parser: { syntax: 'typescript', tsx: true },
+          transform: { react: { runtime: 'automatic' } },
+        },
+      },
+    ],
+  },
+  // react-router is deliberately absent from these suites. It ships ESM only and
+  // uses `import.meta`, which cannot survive a transform to CommonJS, and running
+  // jest in ESM mode would change how every mock in this project is written. So
+  // anything that renders a link or navigates is covered by the Playwright suite,
+  // against a real browser and the real router -- which is the stronger test of
+  // navigation regardless. What stays here is what is genuinely a unit: services,
+  // stores, and the components that do not route.
+  moduleNameMapper: {
+    // Styles are a vite concern; under jest they resolve to nothing rather than
+    // failing to parse.
+    '\\.css$': '<rootDir>/src/__mocks__/style.ts',
+  },
+  testMatch: ['<rootDir>/src/**/*.test.ts', '<rootDir>/src/**/*.test.tsx'],
+}
+
+export default config
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
new file mode 100644
index 0000000..2e6455b
--- /dev/null
+++ b/frontend/package-lock.json
@@ -0,0 +1,8885 @@
+{
+  "name": "doppel-dashboard",
+  "version": "0.4.1",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "doppel-dashboard",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@cfworker/json-schema": "^4.1.1",
+        "prismjs": "^1.30.0",
+        "react": "^19.2.8",
+        "react-dom": "^19.2.8",
+        "react-router": "^8.3.0",
+        "react-simple-code-editor": "^0.14.1",
+        "yaml": "^2.9.0",
+        "zustand": "^5.0.14"
+      },
+      "devDependencies": {
+        "@eslint/js": "^10.0.1",
+        "@playwright/test": "^1.62.1",
+        "@swc/core": "^1.15.47",
+        "@swc/jest": "^0.2.39",
+        "@tailwindcss/vite": "^4.3.3",
+        "@testing-library/jest-dom": "^7.0.1",
+        "@testing-library/react": "^16.3.2",
+        "@testing-library/user-event": "^14.6.3",
+        "@types/html-minifier-terser": "^7.0.2",
+        "@types/jest": "^30.0.0",
+        "@types/prismjs": "^1.26.5",
+        "@types/react": "^19.2.18",
+        "@types/react-dom": "^19.2.4",
+        "@vitejs/plugin-react": "^6.0.5",
+        "eslint": "^10.8.1",
+        "eslint-plugin-react-hooks": "^7.1.1",
+        "html-minifier-terser": "^7.2.0",
+        "jest": "^30.4.2",
+        "jest-environment-jsdom": "^30.4.1",
+        "tailwindcss": "^4.3.3",
+        "typescript": "~5.9.3",
+        "typescript-eslint": "^8.67.0",
+        "vite": "^8.2.1"
+      }
+    },
+    "node_modules/@adobe/css-tools": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.5.0.tgz",
+      "integrity": "sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@asamuzakjp/css-color": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@asamuzakjp/css-color/-/css-color-3.2.0.tgz",
+      "integrity": "sha512-K1A6z8tS3XsmCMM86xoWdn7Fkdn9m6RSVtocUrJYIwZnFVkng/PvkEoWtOWmP+Scc6saYWHWZYbndEEXxl24jw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/css-calc": "^2.1.3",
+        "@csstools/css-color-parser": "^3.0.9",
+        "@csstools/css-parser-algorithms": "^3.0.4",
+        "@csstools/css-tokenizer": "^3.0.3",
+        "lru-cache": "^10.4.3"
+      }
+    },
+    "node_modules/@asamuzakjp/css-color/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "js-tokens": "^4.0.0",
+        "picocolors": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
+        "@jridgewell/remapping": "^2.3.5",
+        "convert-source-map": "^2.0.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.3",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
+        "@jridgewell/gen-mapping": "^0.3.12",
+        "@jridgewell/trace-mapping": "^0.3.28",
+        "jsesc": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
+        "browserslist": "^4.24.0",
+        "lru-cache": "^5.1.1",
+        "semver": "^6.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-globals": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.8"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-async-generators": {
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-bigint": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
+      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-class-properties": {
+      "version": "7.12.13",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.12.13"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-class-static-block": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-import-attributes": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz",
+      "integrity": "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-import-meta": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
+      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-json-strings": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-jsx": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz",
+      "integrity": "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-numeric-separator": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-object-rest-spread": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-optional-catch-binding": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-optional-chaining": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-private-property-in-object": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-top-level-await": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-typescript": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz",
+      "integrity": "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/runtime": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
+      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
+        "debug": "^4.3.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
+      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@cfworker/json-schema": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/@cfworker/json-schema/-/json-schema-4.1.1.tgz",
+      "integrity": "sha512-gAmrUZSGtKc3AiBL71iNWxDsyUC5uMaKKGdvzYsBoTW/xi42JQHl7eKV2OYzCUqvc+D2RCcf7EXY2iCyFIk6og==",
+      "license": "MIT"
+    },
+    "node_modules/@csstools/color-helpers": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/color-helpers/-/color-helpers-5.1.0.tgz",
+      "integrity": "sha512-S11EXWJyy0Mz5SYvRmY8nJYTFFd1LCNV+7cXyAgQtOOuzb4EsgfqDufL+9esx72/eLhsRdGZwaldu/h+E4t4BA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT-0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@csstools/css-calc": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-calc/-/css-calc-2.1.4.tgz",
+      "integrity": "sha512-3N8oaj+0juUw/1H3YwmDDJXCgTB1gKU6Hc/bB502u9zR0q2vd786XJH9QfrKIEgFlZmhZiq6epXl4rHqhzsIgQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-color-parser": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@csstools/css-color-parser/-/css-color-parser-3.1.0.tgz",
+      "integrity": "sha512-nbtKwh3a6xNVIp/VRuXV64yTKnb1IjTAEEh3irzS+HkKjAOYLTGNb9pmVNntZ8iVBHcWDA2Dof0QtPgFI1BaTA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@csstools/color-helpers": "^5.1.0",
+        "@csstools/css-calc": "^2.1.4"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-parser-algorithms": "^3.0.5",
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-parser-algorithms": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@csstools/css-parser-algorithms/-/css-parser-algorithms-3.0.5.tgz",
+      "integrity": "sha512-DaDeUkXZKjdGhgYaHNJTV9pV7Y9B3b644jCLs9Upc3VeNGg6LWARAT6O+Q+/COo+2gg/bM5rhpMAtf70WqfBdQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@csstools/css-tokenizer": "^3.0.4"
+      }
+    },
+    "node_modules/@csstools/css-tokenizer": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@csstools/css-tokenizer/-/css-tokenizer-3.0.4.tgz",
+      "integrity": "sha512-Vd/9EVDiu6PPJt9yAh6roZP6El1xHrdvIVGjyBsHR0RYwNHgL7FJPyIIW4fANJNG6FtyZfvlRPpFI4ZM/lubvw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/csstools"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/csstools"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@emnapi/core": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
+      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.1",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.10.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
+      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
+      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.10.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
+      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eslint-visitor-keys": "^3.4.3"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      }
+    },
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@eslint/config-array": {
+      "version": "0.23.5",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.23.5.tgz",
+      "integrity": "sha512-Y3kKLvC1dvTOT+oGlqNQ1XLqK6D1HU2YXPc52NmAlJZbMMWDzGYXMiPRJ8TYD39muD/OTjlZmNJ4ib7dvSrMBA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/object-schema": "^3.0.5",
+        "debug": "^4.3.1",
+        "minimatch": "^10.2.4"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/config-helpers": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz",
+      "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.2.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/js": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-10.0.1.tgz",
+      "integrity": "sha512-zeR9k5pd4gxjZ0abRoIaxdc7I3nDktoXZk2qOv9gCNWx3mVwEn32VRhyLaRsDiJjTs0xq/T8mfPtyuXu7GWBcA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "eslint": "^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "eslint": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@eslint/object-schema": {
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-3.0.5.tgz",
+      "integrity": "sha512-vqTaUEgxzm+YDSdElad6PiRoX4t8VGDjCtt05zn4nU810UIx/uNEV7/lZJ6KwFThKZOzOxzXy48da+No7HZaMw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz",
+      "integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.2.1",
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@humanfs/core": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node": {
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
+      },
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.22"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
+      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "camelcase": "^5.3.1",
+        "find-up": "^4.1.0",
+        "get-package-type": "^0.1.0",
+        "js-yaml": "^3.13.1",
+        "resolve-from": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/find-up": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^5.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
+      "version": "3.15.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz",
+      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/locate-path": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-try": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/p-locate": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/schema": {
+      "version": "0.1.6",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
+      "integrity": "sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/console": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.4.1.tgz",
+      "integrity": "sha512-v3bhyxUh9Hgmo5p6hAOXe14/R3ZxZDOsvHleh4B07z3m/x4/ngPUXEm9XwK4sF4u+f+P2ORb0Ge+MgpaqRMVDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "jest-message-util": "30.4.1",
+        "jest-util": "30.4.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/core": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.4.2.tgz",
+      "integrity": "sha512-TZJA6cPJUFxoWhxaLo8t0VX/MZX2wPWr0uIDvLSHIvN4gu9h02vSzqI2kBADG1ExqQlC+cY09xKMSreivvrChQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/console": "30.4.1",
+        "@jest/pattern": "30.4.0",
+        "@jest/reporters": "30.4.1",
+        "@jest/test-result": "30.4.1",
+        "@jest/transform": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.3.2",
+        "chalk": "^4.1.2",
+        "ci-info": "^4.2.0",
+        "exit-x": "^0.2.2",
+        "fast-json-stable-stringify": "^2.1.0",
+        "graceful-fs": "^4.2.11",
+        "jest-changed-files": "30.4.1",
+        "jest-config": "30.4.2",
+        "jest-haste-map": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-regex-util": "30.4.0",
+        "jest-resolve": "30.4.1",
+        "jest-resolve-dependencies": "30.4.2",
+        "jest-runner": "30.4.2",
+        "jest-runtime": "30.4.2",
+        "jest-snapshot": "30.4.1",
+        "jest-util": "30.4.1",
+        "jest-validate": "30.4.1",
+        "jest-watcher": "30.4.1",
+        "pretty-format": "30.4.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@jest/core/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/core/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/create-cache-key-function": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/create-cache-key-function/-/create-cache-key-function-30.4.1.tgz",
+      "integrity": "sha512-R+xGEtzA95NIsvpXJSROG4t01956dDOt17KpamguY4XOnGvdHNFFXE7Er0C1OAsRjOwiIxpKqOvGlznIGZIQlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/diff-sequences": {
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.4.0.tgz",
+      "integrity": "sha512-zOpzlfUs45l6u7jm39qr87JCHUDsaeCtvL+kQe/Vn9jSnRB4/5IPXISm0h9I1vZW/o00Kn4UTJ2MOlhnUGwv3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/environment": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.4.1.tgz",
+      "integrity": "sha512-AK9yNRqgKxiabqMoe4oW+3/TSSeV8vkdC7BGaxZdU0AFXfOpofTLqdru2GXKZghP3sdgwE9XXpnVwfZ8JnFV4w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/fake-timers": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "jest-mock": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/environment-jsdom-abstract": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/environment-jsdom-abstract/-/environment-jsdom-abstract-30.4.1.tgz",
+      "integrity": "sha512-dSlKrqug3siYNHVnjwIldShY12wAH3spwRltO/+8VOjg0X+xEq7vOs3DbBs4LRKsu7OH+NUb9kuZUNBF9Ho3TA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/environment": "30.4.1",
+        "@jest/fake-timers": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/jsdom": "^21.1.7",
+        "@types/node": "*",
+        "jest-mock": "30.4.1",
+        "jest-util": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@jest/expect": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.4.1.tgz",
+      "integrity": "sha512-ginrj6TMgh2GshLUGCjO94Ptx9HhdZA/I6A9iUfyeLKFtdAjnKzHDgzgP9HYQgbxM1lbXScQ2eUBz2lGeVDPWA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "expect": "30.4.1",
+        "jest-snapshot": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/expect-utils": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.4.1.tgz",
+      "integrity": "sha512-ZBn5CglH8fBsQsvs4VWNzD4aWfUYks+IdOOQU3MEK71ol/BcVm+P+rtb1KpiFBpSWSCE27uOahyyf1vfqOVbcQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/get-type": "30.1.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/fake-timers": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.4.1.tgz",
+      "integrity": "sha512-iW5umdmfPeWzehrVhugFQZqCchSCud5S1l2YT0O9ZhjRR0ExclANDZkiSBwzqtnlOn0J1JXvO+HZ6rkuyOVOgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1",
+        "@sinonjs/fake-timers": "^15.4.0",
+        "@types/node": "*",
+        "jest-message-util": "30.4.1",
+        "jest-mock": "30.4.1",
+        "jest-util": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/get-type": {
+      "version": "30.1.0",
+      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
+      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/globals": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.4.1.tgz",
+      "integrity": "sha512-ZbuY4cmXC8DkxYjfvT2DbcHWL2T6vmsMhXCDcmTB2T0y0gaezBI77ufq5ZAIdcRkYZ7NEQEDg1xFeKbxUJ5v5Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/environment": "30.4.1",
+        "@jest/expect": "30.4.1",
+        "@jest/types": "30.4.1",
+        "jest-mock": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/pattern": {
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.4.0.tgz",
+      "integrity": "sha512-RAWn3+f9u8BsHijKJ71uHcFp6vmyEt6VvoWXkl6hKF3qVIuWNmudVjg12DlBPGup/frIl5UcUlH5HfEuvHpEXg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "jest-regex-util": "30.4.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/reporters": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.4.1.tgz",
+      "integrity": "sha512-/SnkPCzEQpUaBH81kjdEdDdo2WZl5hxw+BmLDGWjRkm8o7XlhjwsU36cqwe5PGBE5WYpBvDzRSdXx9rbGuJtNA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@bcoe/v8-coverage": "^0.2.3",
+        "@jest/console": "30.4.1",
+        "@jest/test-result": "30.4.1",
+        "@jest/transform": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "collect-v8-coverage": "^1.0.2",
+        "exit-x": "^0.2.2",
+        "glob": "^10.5.0",
+        "graceful-fs": "^4.2.11",
+        "istanbul-lib-coverage": "^3.0.0",
+        "istanbul-lib-instrument": "^6.0.0",
+        "istanbul-lib-report": "^3.0.0",
+        "istanbul-lib-source-maps": "^5.0.0",
+        "istanbul-reports": "^3.1.3",
+        "jest-message-util": "30.4.1",
+        "jest-util": "30.4.1",
+        "jest-worker": "30.4.1",
+        "slash": "^3.0.0",
+        "string-length": "^4.0.2",
+        "v8-to-istanbul": "^9.0.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@jest/schemas": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.4.1.tgz",
+      "integrity": "sha512-i6b4qw5qnP8c5FEeBJg/uZQ4ddrkN6Ca8qISJh0pr7a5hfn3h3v5x60BEbOC7OYAGZNMs1LfFLwnW2CuK8F57Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@sinclair/typebox": "^0.34.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/snapshot-utils": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.4.1.tgz",
+      "integrity": "sha512-ObY4ljvQ95mt6iwKtVLetR/4yXiAgl3H4nJxhztr0MTjrN97TwDYrnCp/kF60Ec9HdhkWTHSu+Hg05aXfngpOA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1",
+        "chalk": "^4.1.2",
+        "graceful-fs": "^4.2.11",
+        "natural-compare": "^1.4.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/source-map": {
+      "version": "30.0.1",
+      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.0.1.tgz",
+      "integrity": "sha512-MIRWMUUR3sdbP36oyNyhbThLHyJ2eEDClPCiHVbrYAe5g3CHRArIVpBw7cdSB5fr+ofSfIb2Tnsw8iEHL0PYQg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "callsites": "^3.1.0",
+        "graceful-fs": "^4.2.11"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/test-result": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.4.1.tgz",
+      "integrity": "sha512-/ZG7pgEiOmmWkN9TplKbOu4id2N5lh7FHwRwlkgBVAzGdRH+OkkQ8wX/kIxg4zmd3ZQvAL1RwL2yWsvNYYECTw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/console": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "collect-v8-coverage": "^1.0.2"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/test-sequencer": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.4.1.tgz",
+      "integrity": "sha512-PeYE+4td5rKjoRPxztObrXU+H8hsjZfxKMXOcmrr34JerSyB/ROOxbbicz8B7A5j9R9VayDnVPvBmedqCsFCdw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/test-result": "30.4.1",
+        "graceful-fs": "^4.2.11",
+        "jest-haste-map": "30.4.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/transform": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.4.1.tgz",
+      "integrity": "sha512-Wz0LyktlTvRefoymh+n64hQ84KNXsRGcwdoZ8CSa0Ea+fgYcHZlnk+hDP7v2MS7il2bQ5uTEIxf4/NNfhMN4KQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.27.4",
+        "@jest/types": "30.4.1",
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "babel-plugin-istanbul": "^7.0.1",
+        "chalk": "^4.1.2",
+        "convert-source-map": "^2.0.0",
+        "fast-json-stable-stringify": "^2.1.0",
+        "graceful-fs": "^4.2.11",
+        "jest-haste-map": "30.4.1",
+        "jest-regex-util": "30.4.0",
+        "jest-util": "30.4.1",
+        "pirates": "^4.0.7",
+        "slash": "^3.0.0",
+        "write-file-atomic": "^5.0.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jest/types": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
+      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/pattern": "30.4.0",
+        "@jest/schemas": "30.4.1",
+        "@types/istanbul-lib-coverage": "^2.0.6",
+        "@types/istanbul-reports": "^3.0.4",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.33",
+        "chalk": "^4.1.2"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/source-map": {
+      "version": "0.3.11",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz",
+      "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.25"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
+    },
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.2.tgz",
+      "integrity": "sha512-JfB4kuJQjaoHuCTseIINHtHWeJnvgEcxjwA5t/Y00ZgaOO1Crz3fjT/p8kT28zA/Caz7oiUMn3d6H2yOVCVwuw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.3",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.3"
+      }
+    },
+    "node_modules/@oxc-project/types": {
+      "version": "0.143.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.143.0.tgz",
+      "integrity": "sha512-u6JZdLBTLotrNC9Vd6vPssINdzcCzleKAH6EJKImQb7GtYvX5keN2dxkoK44stCc4tffE6QQRtZTXVSzsLUlWA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/Boshen"
+      }
+    },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@pkgr/core": {
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
+      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pkgr"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.62.1.tgz",
+      "integrity": "sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.62.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/@rolldown/binding-android-arm64": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.3.tgz",
+      "integrity": "sha512-zrJtHDcaZJ1Fp7xf4hNl+7seH9Cn/N5TwLYkhgXREtBwAd/jaqW3uqeHxpDugJLVICWg4eW44kOQEGJ1r6jCGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-arm64": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.3.tgz",
+      "integrity": "sha512-ieIiibVCp0tX7TLu2cafoNPv8wJyYi01ekXpbf8q2j7F4rGAhhXb/eQh7ge9DRBY78GwmRQtvjZDux7EDbA8kA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-darwin-x64": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.3.tgz",
+      "integrity": "sha512-Zh9tCon19eDXJoihx0rqKhMUlMYqzwj3aPsSuHmI4RWZh62dWUL+DJN4C5YQya5TcQBJU/Fe8+rY0jhXTQITqA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-freebsd-x64": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.3.tgz",
+      "integrity": "sha512-nGbJWewA1wrXXZiQhjAT5rhibGfns5ZNkDVqxsO6zJ3f3YvpoDNNmGMSbbhLuXKjNScaBJVOAboztAWVespQMg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.3.tgz",
+      "integrity": "sha512-QNniJr5Kml0kDEB98jiDOJjXNroxIIi0IXIbdYzY26Xt1pVbeP62+KnoIZLwirOymX/0jDk/2gI/bNUv7A7OIw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-gnu": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.3.tgz",
+      "integrity": "sha512-TkqEAcmmvH3I/q4114NB4RVt6241Dao48pF45uLcFGrwAaIn0iITgTAKP/dLjbN0R4buJjGb91+UHSoFmpgIWw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-arm64-musl": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.3.tgz",
+      "integrity": "sha512-NHqjnxpsndf4MPymxteFAWHHfkTL8HjWh1KB7z23ofZ6QO2euONuxDXjat69dKZRALnGypg8k8SsK8vZJoXv1Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-ppc64-gnu": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.3.tgz",
+      "integrity": "sha512-6tbrbwfz5GB9DQ4Jwo6hy9v+vR31xZlvzZ6n5Xut6Hhx5PvrA9q/HsK8KMaYQp063iqZGXwNvZtYNLD7EM/x0w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-s390x-gnu": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.3.tgz",
+      "integrity": "sha512-oyuXxXmoZHjXC917IAPFAAv4wWAa0cM9afk8nx1+9/jNNOX1uPf8yDA6p7G0RypOfw/X0PQt5IfoquY1um+zSg==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-gnu": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.3.tgz",
+      "integrity": "sha512-TytMwF2KVGqP2tgd0I1OY0PAv78dZRAYcF5ssDzjM34SUXCED3uXvSd5+lHoC0bTD6eEdFz7LdQNCO1y0oVk9w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-linux-x64-musl": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.3.tgz",
+      "integrity": "sha512-/E9m3qstrJFVPoULV25mVQblSNExY2+kBsYe4sy0Tn0yOOgJ8wZbZt3KnRbF/XeU2Gl1STKUQnDNTqhIE5MD4A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-openharmony-arm64": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.3.tgz",
+      "integrity": "sha512-Kr0OcsoQI816i6HOl3vFHpd1K0eZyh76zgfj4c1nTyaTsd5r2Mj1lwM4R90y/qaCfmTn9eHy0SKwi98eitRxug==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-arm64-msvc": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.3.tgz",
+      "integrity": "sha512-hOtMwTqnME+/gJcH/PCZ0wn0zPUjiWOgkHpxbSJpfGKMezHltx1S7/k1SitzVa7Ww2cqrDDaFbZEhcJZO8o+Jw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/binding-win32-x64-msvc": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.3.tgz",
+      "integrity": "sha512-ekcqMMkI2PlhYnfzQnB/cEdYUVVJViWvoUyLrbzgDoi3Snfc1mVBwdnc306ufA5ejy8JSPjT2RlW1nQSjW7efg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@rolldown/pluginutils": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
+      "integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@sinclair/typebox": {
+      "version": "0.34.52",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
+      "integrity": "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@sinonjs/commons": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-3.0.1.tgz",
+      "integrity": "sha512-K3mCHKQ9sVh8o1C9cxkwxaOmXoAMlDxC1mYyHrjqOWEcBjYr76t96zL2zlj5dUGZ3HSw240X1qgH3Mjf1yJWpQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "type-detect": "4.0.8"
+      }
+    },
+    "node_modules/@sinonjs/fake-timers": {
+      "version": "15.4.0",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-15.4.0.tgz",
+      "integrity": "sha512-DsG+8/LscQIQg68J6Ef3dv10u6nVyetYn923s3/sus5eaGfTo1of5WMZSLf0UJc9KDuKPilPH0UDJCjvNbDNCA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@sinonjs/commons": "^3.0.1"
+      }
+    },
+    "node_modules/@swc/core": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core/-/core-1.15.47.tgz",
+      "integrity": "sha512-FbsO5JcfOjfH38W/rohBRBweJeERsAuIP4f377lmkmxTcq9exjtx4SkRuZY5CdfhR2CBVwDIJegBpJDffwNsOg==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/counter": "^0.1.3",
+        "@swc/types": "^0.1.27"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/swc"
+      },
+      "optionalDependencies": {
+        "@swc/core-darwin-arm64": "1.15.47",
+        "@swc/core-darwin-x64": "1.15.47",
+        "@swc/core-linux-arm-gnueabihf": "1.15.47",
+        "@swc/core-linux-arm64-gnu": "1.15.47",
+        "@swc/core-linux-arm64-musl": "1.15.47",
+        "@swc/core-linux-ppc64-gnu": "1.15.47",
+        "@swc/core-linux-s390x-gnu": "1.15.47",
+        "@swc/core-linux-x64-gnu": "1.15.47",
+        "@swc/core-linux-x64-musl": "1.15.47",
+        "@swc/core-win32-arm64-msvc": "1.15.47",
+        "@swc/core-win32-ia32-msvc": "1.15.47",
+        "@swc/core-win32-x64-msvc": "1.15.47"
+      },
+      "peerDependencies": {
+        "@swc/helpers": ">=0.5.17"
+      },
+      "peerDependenciesMeta": {
+        "@swc/helpers": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@swc/core-darwin-arm64": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.15.47.tgz",
+      "integrity": "sha512-GsoMtan3ojGGMGFbl31mmRu5ctZ56re8grGE8mO/OHJ8O+JRkzod02fe7X6ZQ8JvamA3imkEkx/h3u+vsOgPgA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-darwin-x64": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.15.47.tgz",
+      "integrity": "sha512-leTi7Rx3KF4zcC637iqWgk9SoV8VXAD8ppQYXsep63px5A/UftOcxLN1pmr8Z1si/YvX90ompP/rHgpYkgwXWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-arm-gnueabihf": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.15.47.tgz",
+      "integrity": "sha512-hBqHuoWKKIsKmDBn9qVeWqj5GWZhtlcczVaqQmNRXsDfq+voR5CxKRfamA367QjJXtceYuliLFfEL8QsskRM2g==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-arm64-gnu": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.15.47.tgz",
+      "integrity": "sha512-TBxvRz+B4K205TWHHZxWVxkC2RFNP/Mz3PNcECBos5PsKwxjg3QSJzdoebr0VCf0Bfh8HOPldKxAP/8XkFe9gA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-arm64-musl": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.15.47.tgz",
+      "integrity": "sha512-3Yu3Uq/VgytqsPjTMbkPU1ExADytbdWbruJYhA584E9jrpE2Ki+R6VVPoZCeAVk1Cb7QxcRTgblw6bSa6a/R+w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-ppc64-gnu": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-ppc64-gnu/-/core-linux-ppc64-gnu-1.15.47.tgz",
+      "integrity": "sha512-wfdMi5IaOaNtmh2/6geRoxIdNfqylUZFdtzTKS655y1axWfIWyx7As74vv0wVdjeCIZ3WmCI9odDd4rUttXOSQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-s390x-gnu": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-s390x-gnu/-/core-linux-s390x-gnu-1.15.47.tgz",
+      "integrity": "sha512-3hHYBY0yx8Ez7GMRrkhXHQzMdR5IZA6Wq5Ee4svlgwvSECLpnAJ9+0AimEGUFDvuLwE7nV/2+PYe8+Nm4rvNcQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-x64-gnu": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.15.47.tgz",
+      "integrity": "sha512-TjfhjgP/jGCfFHYC3JQPhJA1HwErbIJ9JfREDc1KNkvY6P0LodCgKVIlQ5deeTbkG7ih3bF5PHJLuLpaZjdRyQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-linux-x64-musl": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.15.47.tgz",
+      "integrity": "sha512-CQpS8Ge/avfjZd0UEwG/sds83Uu32deQXcV1Jo3jD0mmvQQqtYAjpsDZXugmheeAwmt+YIuoVtVHro8LMYHqsQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-win32-arm64-msvc": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.15.47.tgz",
+      "integrity": "sha512-0W8IKHsUTYiT7G2RqtOoVWk+89yzZikIiDUb/sCK6BmQDBhN91hQSfyUtW12jhEWLzYgcfmisfsZrmZE+84U1A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-win32-ia32-msvc": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.15.47.tgz",
+      "integrity": "sha512-ZIp49d2Z4/ka2jO9otOg4hDvTdPmp86kVOgS2M5FCPI7eKKZ1W0boxWn+8XeZrfERtFGW0AlMRm4JhlJa7l3NA==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/core-win32-x64-msvc": {
+      "version": "1.15.47",
+      "resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.15.47.tgz",
+      "integrity": "sha512-2h8Iek95vnixkBRCo+H8p09+Q5ll2NgSMFrWTy0iKt7+/t+8/T5mBpiT6c0ZxSS7wcWjwZ9sGZkK70tTSYHdDw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0 AND MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@swc/counter": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@swc/counter/-/counter-0.1.3.tgz",
+      "integrity": "sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@swc/jest": {
+      "version": "0.2.39",
+      "resolved": "https://registry.npmjs.org/@swc/jest/-/jest-0.2.39.tgz",
+      "integrity": "sha512-eyokjOwYd0Q8RnMHri+8/FS1HIrIUKK/sRrFp8c1dThUOfNeCWbLmBP1P5VsKdvmkd25JaH+OKYwEYiAYg9YAA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/create-cache-key-function": "^30.0.0",
+        "@swc/counter": "^0.1.3",
+        "jsonc-parser": "^3.2.0"
+      },
+      "engines": {
+        "npm": ">= 7.0.0"
+      },
+      "peerDependencies": {
+        "@swc/core": "*"
+      }
+    },
+    "node_modules/@swc/types": {
+      "version": "0.1.28",
+      "resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.28.tgz",
+      "integrity": "sha512-V6Mnml8v09QALx6K0elJ7o9K/MkVDtW3t6L+7Ou/JcWtb3xwId2AH4FeOceySd2JaO87IMw4+6vSZxLm34LPbw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/counter": "^0.1.3"
+      }
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.3.tgz",
+      "integrity": "sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "^5.24.1",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.3.tgz",
+      "integrity": "sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.3",
+        "@tailwindcss/oxide-darwin-x64": "4.3.3",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.3",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.3",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.3",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.3",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.3",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.3"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.3.tgz",
+      "integrity": "sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.3.tgz",
+      "integrity": "sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.3.tgz",
+      "integrity": "sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.3.tgz",
+      "integrity": "sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.3.tgz",
+      "integrity": "sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.3.tgz",
+      "integrity": "sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.3.tgz",
+      "integrity": "sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.3.tgz",
+      "integrity": "sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.3.tgz",
+      "integrity": "sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz",
+      "integrity": "sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.11.1",
+        "@emnapi/runtime": "^1.11.1",
+        "@emnapi/wasi-threads": "^1.2.2",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
+      "integrity": "sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.3.tgz",
+      "integrity": "sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 20"
+      }
+    },
+    "node_modules/@tailwindcss/vite": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.3.tgz",
+      "integrity": "sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@tailwindcss/node": "4.3.3",
+        "@tailwindcss/oxide": "4.3.3",
+        "tailwindcss": "4.3.3"
+      },
+      "peerDependencies": {
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
+      }
+    },
+    "node_modules/@testing-library/dom": {
+      "version": "10.4.1",
+      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
+      "integrity": "sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.10.4",
+        "@babel/runtime": "^7.12.5",
+        "@types/aria-query": "^5.0.1",
+        "aria-query": "5.3.0",
+        "dom-accessibility-api": "^0.5.9",
+        "lz-string": "^1.5.0",
+        "picocolors": "1.1.1",
+        "pretty-format": "^27.0.2"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@testing-library/jest-dom": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/@testing-library/jest-dom/-/jest-dom-7.0.1.tgz",
+      "integrity": "sha512-oMDTC3oA+6CXSO2JZnvOI7CA6oVub6kij5ggk9ohwye5slmkwxYDXcPOVxgMw/RQlticjtO0C1RZkR97HgrWMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@adobe/css-tools": "^4.4.0",
+        "aria-query": "^5.0.0",
+        "css.escape": "^1.5.1",
+        "dom-accessibility-api": "^0.6.3",
+        "picocolors": "^1.1.1",
+        "redent": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=22",
+        "npm": ">=6",
+        "yarn": ">=1"
+      },
+      "peerDependencies": {
+        "@testing-library/dom": ">=10 <11",
+        "vitest": ">= 0.32"
+      },
+      "peerDependenciesMeta": {
+        "vitest": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@testing-library/jest-dom/node_modules/dom-accessibility-api": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.6.3.tgz",
+      "integrity": "sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@testing-library/react": {
+      "version": "16.3.2",
+      "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.2.tgz",
+      "integrity": "sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/runtime": "^7.12.5"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "@testing-library/dom": "^10.0.0",
+        "@types/react": "^18.0.0 || ^19.0.0",
+        "@types/react-dom": "^18.0.0 || ^19.0.0",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "@types/react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@testing-library/user-event": {
+      "version": "14.6.3",
+      "resolved": "https://registry.npmjs.org/@testing-library/user-event/-/user-event-14.6.3.tgz",
+      "integrity": "sha512-6dBq67jT8lE+JTE8Exm02Kt6ze43hz1jdiSpSJwtTZiT1xQQ6b7nZYTTQ9njdArdU8XklOwaDp/AbT/eYSKF4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12",
+        "npm": ">=6"
+      },
+      "peerDependencies": {
+        "@testing-library/dom": ">=7.21.4"
+      }
+    },
+    "node_modules/@tybys/wasm-util": {
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@types/aria-query": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/@types/aria-query/-/aria-query-5.0.4.tgz",
+      "integrity": "sha512-rfT93uj5s0PRL7EzccGMs3brplhcrghnDoV26NqKhCAS1hVo+WdNsPvE/yb6ilfr5hi2MEk6d5EWJTKdxg8jVw==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/@types/babel__core": {
+      "version": "7.20.5",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
+      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.20.7",
+        "@babel/types": "^7.20.7",
+        "@types/babel__generator": "*",
+        "@types/babel__template": "*",
+        "@types/babel__traverse": "*"
+      }
+    },
+    "node_modules/@types/babel__generator": {
+      "version": "7.27.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
+      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__template": {
+      "version": "7.4.4",
+      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
+      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__traverse": {
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
+      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.28.2"
+      }
+    },
+    "node_modules/@types/esrecurse": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
+      "integrity": "sha512-xJBAbDifo5hpffDBuHl0Y8ywswbiAp/Wi7Y/GtAgSlZyIABppyurxVueOPE8LUQOxdlgi6Zqce7uoEpqNTeiUw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/html-minifier-terser": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@types/html-minifier-terser/-/html-minifier-terser-7.0.2.tgz",
+      "integrity": "sha512-mm2HqV22l8lFQh4r2oSsOEVea+m0qqxEmwpc9kC1p/XzmjLWrReR9D/GRs8Pex2NX/imyEH9c5IU/7tMBQCHOA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/istanbul-lib-coverage": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
+      "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/istanbul-lib-report": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz",
+      "integrity": "sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/istanbul-lib-coverage": "*"
+      }
+    },
+    "node_modules/@types/istanbul-reports": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz",
+      "integrity": "sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/istanbul-lib-report": "*"
+      }
+    },
+    "node_modules/@types/jest": {
+      "version": "30.0.0",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-30.0.0.tgz",
+      "integrity": "sha512-XTYugzhuwqWjws0CVz8QpM36+T+Dz5mTEBKhNs/esGLnCIlGdRy+Dq78NRjd7ls7r8BC8ZRMOrKlkO1hU0JOwA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "expect": "^30.0.0",
+        "pretty-format": "^30.0.0"
+      }
+    },
+    "node_modules/@types/jest/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@types/jest/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/@types/jsdom": {
+      "version": "21.1.7",
+      "resolved": "https://registry.npmjs.org/@types/jsdom/-/jsdom-21.1.7.tgz",
+      "integrity": "sha512-yOriVnggzrnQ3a9OKOCxaVuSug3w3/SbOj5i7VwXWZEyUNl3bLF9V3MfxGbZKuwqJOQyRfqXyROBB1CoZLFWzA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/tough-cookie": "*",
+        "parse5": "^7.0.0"
+      }
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.15",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "26.2.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.2.0.tgz",
+      "integrity": "sha512-5IviulTZeRNp2vAJ514cc/HUlY5nZ9fCbq9DMyC52BrhFZACo3nI0R7qBxhQmo/d27NFe96ur/b7Wwxklda+kg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
+    "node_modules/@types/prismjs": {
+      "version": "1.26.6",
+      "resolved": "https://registry.npmjs.org/@types/prismjs/-/prismjs-1.26.6.tgz",
+      "integrity": "sha512-vqlvI7qlMvcCBbVe0AKAb4f97//Hy0EBTaiW8AalRnG/xAN5zOiWWyrNqNXeq8+KAuvRewjCVY1+IPxk4RdNYw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/react": {
+      "version": "19.2.18",
+      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.18.tgz",
+      "integrity": "sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "csstype": "^3.2.2"
+      }
+    },
+    "node_modules/@types/react-dom": {
+      "version": "19.2.4",
+      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-19.2.4.tgz",
+      "integrity": "sha512-Bsc+QHgp+P/F02XDzNCY9jnZNCUuLki36KT7VKrTXXLdHf+vHMNZnW1rVu5DNW/rCK+fya3DATySbLM4yhtKUw==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "@types/react": "^19.2.0"
+      }
+    },
+    "node_modules/@types/stack-utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz",
+      "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/tough-cookie": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.5.tgz",
+      "integrity": "sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/yargs": {
+      "version": "17.0.35",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz",
+      "integrity": "sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "node_modules/@types/yargs-parser": {
+      "version": "21.0.3",
+      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.3.tgz",
+      "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.67.0.tgz",
+      "integrity": "sha512-Un7Heoyj65NREbKAyIrFxeM143NZpExWmy1Nep4DLeQOeLlTeumPjoNKnBrU5D5moWXbPJgRa5Uwcdu0faVNGQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.67.0",
+        "@typescript-eslint/type-utils": "8.67.0",
+        "@typescript-eslint/utils": "8.67.0",
+        "@typescript-eslint/visitor-keys": "8.67.0",
+        "ignore": "^7.0.5",
+        "natural-compare": "^1.4.0",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^8.67.0",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz",
+      "integrity": "sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.67.0.tgz",
+      "integrity": "sha512-fUBfTuuEulWqX6V8+O3PtScV01tzYYRUDTAirHFKoRAt7nOzoGiPt0M/bB47wWNy0coOOcgEwAMUtBpykMxl6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "8.67.0",
+        "@typescript-eslint/types": "8.67.0",
+        "@typescript-eslint/typescript-estree": "8.67.0",
+        "@typescript-eslint/visitor-keys": "8.67.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.67.0.tgz",
+      "integrity": "sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/tsconfig-utils": "^8.67.0",
+        "@typescript-eslint/types": "^8.67.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.67.0.tgz",
+      "integrity": "sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.67.0",
+        "@typescript-eslint/visitor-keys": "8.67.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.67.0.tgz",
+      "integrity": "sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.67.0.tgz",
+      "integrity": "sha512-aVWDXbRmdXO9siTfX4ditQI1T9+zVcNazT48EJCD0v40/9RIFoUgZ05CmGEq9H2gixRpjUn/iplwvlcvutJW/Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.67.0",
+        "@typescript-eslint/typescript-estree": "8.67.0",
+        "@typescript-eslint/utils": "8.67.0",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.67.0.tgz",
+      "integrity": "sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.67.0.tgz",
+      "integrity": "sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/project-service": "8.67.0",
+        "@typescript-eslint/tsconfig-utils": "8.67.0",
+        "@typescript-eslint/types": "8.67.0",
+        "@typescript-eslint/visitor-keys": "8.67.0",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.67.0.tgz",
+      "integrity": "sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.67.0",
+        "@typescript-eslint/types": "8.67.0",
+        "@typescript-eslint/typescript-estree": "8.67.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.67.0.tgz",
+      "integrity": "sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/types": "8.67.0",
+        "eslint-visitor-keys": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@ungap/structured-clone": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/@unrs/resolver-binding-android-arm-eabi": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.12.2.tgz",
+      "integrity": "sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-android-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.12.2.tgz",
+      "integrity": "sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-darwin-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.12.2.tgz",
+      "integrity": "sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-darwin-x64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.12.2.tgz",
+      "integrity": "sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-freebsd-x64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.12.2.tgz",
+      "integrity": "sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm-gnueabihf": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.12.2.tgz",
+      "integrity": "sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm-musleabihf": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.12.2.tgz",
+      "integrity": "sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.12.2.tgz",
+      "integrity": "sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-arm64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.12.2.tgz",
+      "integrity": "sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-gnu/-/resolver-binding-linux-loong64-gnu-1.12.2.tgz",
+      "integrity": "sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-musl/-/resolver-binding-linux-loong64-musl-1.12.2.tgz",
+      "integrity": "sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-ppc64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.12.2.tgz",
+      "integrity": "sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-riscv64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.12.2.tgz",
+      "integrity": "sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-riscv64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.12.2.tgz",
+      "integrity": "sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-s390x-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.12.2.tgz",
+      "integrity": "sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-x64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.12.2.tgz",
+      "integrity": "sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-x64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.12.2.tgz",
+      "integrity": "sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-openharmony-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-openharmony-arm64/-/resolver-binding-openharmony-arm64-1.12.2.tgz",
+      "integrity": "sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-wasm32-wasi": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.12.2.tgz",
+      "integrity": "sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==",
+      "cpu": [
+        "wasm32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
+      "integrity": "sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-win32-ia32-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.12.2.tgz",
+      "integrity": "sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
+      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@vitejs/plugin-react": {
+      "version": "6.0.5",
+      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react/-/plugin-react-6.0.5.tgz",
+      "integrity": "sha512-BOVzne/NL162sMdResB25mUv+vWMF5NoAjNf09TeGlE7ZpszZWSD3winycicLJw72yeVsoCn/2kOhEuCvEShMA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rolldown/pluginutils": "^1.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "peerDependencies": {
+        "@rolldown/plugin-babel": "^0.1.7 || ^0.2.0",
+        "babel-plugin-react-compiler": "^1.0.0",
+        "vite": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@rolldown/plugin-babel": {
+          "optional": true
+        },
+        "babel-plugin-react-compiler": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ansi-escapes": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.21.3"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/anymatch": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
+      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/anymatch/node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/aria-query": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
+      "integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "dequal": "^2.0.3"
+      }
+    },
+    "node_modules/babel-jest": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.4.1.tgz",
+      "integrity": "sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/transform": "30.4.1",
+        "@types/babel__core": "^7.20.5",
+        "babel-plugin-istanbul": "^7.0.1",
+        "babel-preset-jest": "30.4.0",
+        "chalk": "^4.1.2",
+        "graceful-fs": "^4.2.11",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.11.0 || ^8.0.0-0"
+      }
+    },
+    "node_modules/babel-plugin-istanbul": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-7.0.1.tgz",
+      "integrity": "sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "workspaces": [
+        "test/babel-8"
+      ],
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@istanbuljs/load-nyc-config": "^1.0.0",
+        "@istanbuljs/schema": "^0.1.3",
+        "istanbul-lib-instrument": "^6.0.2",
+        "test-exclude": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/babel-plugin-jest-hoist": {
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz",
+      "integrity": "sha512-9EdtWM/sSfXLOGLwSn+GS6pIXyBnL07/8gyJlwFXjWy4DxMOyItqyUT29d4lQiS380EZwYlX7/At4PgBS+m2aA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/babel__core": "^7.20.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/babel-preset-current-node-syntax": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz",
+      "integrity": "sha512-E/VlAEzRrsLEb2+dv8yp3bo4scof3l9nR4lrld+Iy5NyVqgVYUJnDAmunkhPMisRI32Qc4iRiz425d8vM++2fg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-bigint": "^7.8.3",
+        "@babel/plugin-syntax-class-properties": "^7.12.13",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5",
+        "@babel/plugin-syntax-import-attributes": "^7.24.7",
+        "@babel/plugin-syntax-import-meta": "^7.10.4",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+        "@babel/plugin-syntax-top-level-await": "^7.14.5"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0 || ^8.0.0-0"
+      }
+    },
+    "node_modules/babel-preset-jest": {
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.4.0.tgz",
+      "integrity": "sha512-lBY4jxsNmCnSiu7kquw8ZC9F4+XLMOKypT3RnNHPvU2Kpd4W0xaPuLr5ZkRyOsvLYAY4yaW1ZwTW4xB7NIiZzg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "babel-plugin-jest-hoist": "30.4.0",
+        "babel-preset-current-node-syntax": "^1.2.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.11.0 || ^8.0.0-beta.1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/baseline-browser-mapping": {
+      "version": "2.11.13",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz",
+      "integrity": "sha512-k9HNuUVMlqVjQ9UHzfPjIqiDbWw7WqT1AoT7GL8VwvF3r0ZfArtgiSPAlmupyNquNgOJHTuH4CKYf8ttMTWBTQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/bser": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
+      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "node-int64": "^0.4.0"
+      }
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/camel-case": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/camel-case/-/camel-case-4.1.2.tgz",
+      "integrity": "sha512-gxGWBrTT1JuMx6R+o5PTXMmUnhnVzLQ9SNutD4YqKtI6ap897t3tKECYla6gCWEkplXnlNybEkZg9GEGxKFCgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pascal-case": "^3.1.2",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/camelcase": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001809",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz",
+      "integrity": "sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "CC-BY-4.0"
+    },
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/char-regex": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
+      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ci-info": {
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
+      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cjs-module-lexer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
+      "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/clean-css": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/clean-css/-/clean-css-5.3.3.tgz",
+      "integrity": "sha512-D5J+kHaVb/wKSFcyyV75uCn8fiY4sV38XJoe4CUyGQ+mOU/fMVYUdH1hJC+CJQ5uY3EnW27SbJYS4X8BiLrAFg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "source-map": "~0.6.0"
+      },
+      "engines": {
+        "node": ">= 10.0"
+      }
+    },
+    "node_modules/cliui": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+      "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cliui/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cliui/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/co": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
+      "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "iojs": ">= 1.0.0",
+        "node": ">= 0.12.0"
+      }
+    },
+    "node_modules/collect-v8-coverage": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz",
+      "integrity": "sha512-1L5aqIkwPfiodaMgQunkF1zRhNqifHBmtbbbxcr6yVxxBnliw4TDOW6NxpO8DJLgJ16OT+Y4ztZqP6p/FtXnAw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/commander": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-10.0.1.tgz",
+      "integrity": "sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cookie-es": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/cookie-es/-/cookie-es-3.1.1.tgz",
+      "integrity": "sha512-UaXxwISYJPTr9hwQxMFYZ7kNhSXboMXP+Z3TRX6f1/NyaGPfuNUZOWP1pUEb75B2HjfklIYLVRfWiFZJyC6Npg==",
+      "license": "MIT"
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/css.escape": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/css.escape/-/css.escape-1.5.1.tgz",
+      "integrity": "sha512-YUifsXXuknHlUsmlgyY0PKzgPOr7/FjCePfHNt0jxm83wHZi44VDMQ7/fGNkjY3/jV1MC+1CmZbaHzugyeRtpg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cssstyle": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-4.6.0.tgz",
+      "integrity": "sha512-2z+rWdzbbSZv6/rhtvzvqeZQHrBaqgogqt85sqFNbabZOuFbCVFb8kPeEtZjiKkbrm395irpNKiYeFeLiQnFPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@asamuzakjp/css-color": "^3.2.0",
+        "rrweb-cssom": "^0.8.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/csstype": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/data-urls": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-5.0.0.tgz",
+      "integrity": "sha512-ZYP5VBHshaDAiVZxjbRVcFJpc+4xGgT0bK3vzy1HLN8jTO975HEbuYzZJcHoQEY5K1a0z8YayJkyVETa08eNTg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js": {
+      "version": "10.6.0",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/dedent": {
+      "version": "1.7.2",
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz",
+      "integrity": "sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==",
+      "dev": true,
+      "license": "MIT",
+      "peerDependencies": {
+        "babel-plugin-macros": "^3.1.0"
+      },
+      "peerDependenciesMeta": {
+        "babel-plugin-macros": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/deepmerge": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/dequal": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
+      "integrity": "sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/detect-newline": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
+      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/dom-accessibility-api": {
+      "version": "0.5.16",
+      "resolved": "https://registry.npmjs.org/dom-accessibility-api/-/dom-accessibility-api-0.5.16.tgz",
+      "integrity": "sha512-X7BJ2yElsnOJ30pZF4uIIDfBEVgF4XEBxL9Bxhy6dnrm5hkzqmsWHGTiHqRiITNhMyFLyAiWndIJP7Z1NTteDg==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/dot-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/dot-case/-/dot-case-3.0.4.tgz",
+      "integrity": "sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "no-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.5.404",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.404.tgz",
+      "integrity": "sha512-3WJtd7/lVq2Jnuz6wed1l9+1ZD2u2Tet1/1NBc4Iedkmgbu+I7YuAqdAQ8T+VZtnwysMsAf3IqSq9D1gyZjA2g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/emittery": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz",
+      "integrity": "sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/emittery?sponsor=1"
+      }
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/enhanced-resolve": {
+      "version": "5.24.5",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz",
+      "integrity": "sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/entities": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+      "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/error-ex": {
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
+      "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-arrayish": "^0.2.1"
+      }
+    },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint": {
+      "version": "10.8.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.1.tgz",
+      "integrity": "sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==",
+      "dev": true,
+      "license": "MIT",
+      "workspaces": [
+        "packages/*"
+      ],
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.8.0",
+        "@eslint-community/regexpp": "^4.12.2",
+        "@eslint/config-array": "^0.23.5",
+        "@eslint/config-helpers": "^0.7.0",
+        "@eslint/core": "^1.2.1",
+        "@eslint/plugin-kit": "^0.7.2",
+        "@humanfs/node": "^0.16.6",
+        "@humanwhocodes/module-importer": "^1.0.1",
+        "@humanwhocodes/retry": "^0.4.2",
+        "@types/estree": "^1.0.6",
+        "ajv": "^6.14.0",
+        "cross-spawn": "^7.0.6",
+        "debug": "^4.3.2",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^9.1.2",
+        "eslint-visitor-keys": "^5.0.1",
+        "espree": "^11.2.0",
+        "esquery": "^1.7.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^8.0.0",
+        "find-up": "^5.0.0",
+        "glob-parent": "^6.0.2",
+        "ignore": "^5.2.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "minimatch": "^10.2.5",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "jiti": "*"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/eslint-plugin-react-hooks": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-7.1.1.tgz",
+      "integrity": "sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.24.4",
+        "@babel/parser": "^7.24.4",
+        "hermes-parser": "^0.25.1",
+        "zod": "^3.25.0 || ^4.0.0",
+        "zod-validation-error": "^3.5.0 || ^4.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0"
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-9.1.2.tgz",
+      "integrity": "sha512-xS90H51cKw0jltxmvmHy2Iai1LIqrfbw57b79w/J7MfvDfkIkFZ+kj6zC3BjtUwh150HsSSdxXZcsuv72miDFQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@types/esrecurse": "^4.3.1",
+        "@types/estree": "^1.0.8",
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint/node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/eslint/node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/espree": {
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
+      "integrity": "sha512-7p3DrVEIopW1B1avAGLuCSh1jubc01H2JHc8B4qqGblmg5gI9yumBgACjWo4JlIc04ufug4xJ3SQI8HkS/Rgzw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "acorn": "^8.16.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^5.0.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
+      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/execa": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cross-spawn": "^7.0.3",
+        "get-stream": "^6.0.0",
+        "human-signals": "^2.1.0",
+        "is-stream": "^2.0.0",
+        "merge-stream": "^2.0.0",
+        "npm-run-path": "^4.0.1",
+        "onetime": "^5.1.2",
+        "signal-exit": "^3.0.3",
+        "strip-final-newline": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+      }
+    },
+    "node_modules/execa/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/exit-x": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/exit-x/-/exit-x-0.2.2.tgz",
+      "integrity": "sha512-+I6B/IkJc1o/2tiURyz/ivu/O0nKNEArIUB5O7zBrlDVJr22SCLH3xTeEry428LvFhRzIA1g8izguxJ/gbNcVQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/expect": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-30.4.1.tgz",
+      "integrity": "sha512-PMARsyh/JtqC20HoGqlFcIlQAyqUtW4PlI1rup1uhYJtKuwAjbvWi3GQMAn+STdHum/dk8xrKfUM1+5SAwpolA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/expect-utils": "30.4.1",
+        "@jest/get-type": "30.1.0",
+        "jest-matcher-utils": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-mock": "30.4.1",
+        "jest-util": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fb-watchman": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz",
+      "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bser": "2.1.1"
+      }
+    },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/file-entry-cache": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
+      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flat-cache": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
+      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "flatted": "^3.2.9",
+        "keyv": "^4.5.4"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
+    "node_modules/get-package-type": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
+      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/get-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/glob": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/hermes-estree": {
+      "version": "0.25.1",
+      "resolved": "https://registry.npmjs.org/hermes-estree/-/hermes-estree-0.25.1.tgz",
+      "integrity": "sha512-0wUoCcLp+5Ev5pDW2OriHC2MJCbwLwuRx+gAqMTOkGKJJiBCLjtrvy4PWUGn6MIVefecRpzoOZ/UV6iGdOr+Cw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/hermes-parser": {
+      "version": "0.25.1",
+      "resolved": "https://registry.npmjs.org/hermes-parser/-/hermes-parser-0.25.1.tgz",
+      "integrity": "sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hermes-estree": "0.25.1"
+      }
+    },
+    "node_modules/html-encoding-sniffer": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-4.0.0.tgz",
+      "integrity": "sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "whatwg-encoding": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/html-minifier-terser": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/html-minifier-terser/-/html-minifier-terser-7.2.0.tgz",
+      "integrity": "sha512-tXgn3QfqPIpGl9o+K5tpcj3/MN4SfLtsx2GWwBC3SSd0tXQGyF3gsSqad8loJgKZGM3ZxbYDd5yhiBIdWpmvLA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "camel-case": "^4.1.2",
+        "clean-css": "~5.3.2",
+        "commander": "^10.0.0",
+        "entities": "^4.4.0",
+        "param-case": "^3.0.4",
+        "relateurl": "^0.2.7",
+        "terser": "^5.15.1"
+      },
+      "bin": {
+        "html-minifier-terser": "cli.js"
+      },
+      "engines": {
+        "node": "^14.13.1 || >=16.0.0"
+      }
+    },
+    "node_modules/html-minifier-terser/node_modules/entities": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+      "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.12"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/human-signals": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
+      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=10.17.0"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/import-local": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
+      "integrity": "sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pkg-dir": "^4.2.0",
+        "resolve-cwd": "^3.0.0"
+      },
+      "bin": {
+        "import-local-fixture": "fixtures/cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/indent-string": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+      "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/is-arrayish": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
+      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-generator-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
+      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-instrument": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-6.0.3.tgz",
+      "integrity": "sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@babel/core": "^7.23.9",
+        "@babel/parser": "^7.23.9",
+        "@istanbuljs/schema": "^0.1.3",
+        "istanbul-lib-coverage": "^3.2.0",
+        "semver": "^7.5.4"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-instrument/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-lib-source-maps": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-5.0.6.tgz",
+      "integrity": "sha512-yg2d+Em4KizZC5niWhQaIomgf5WlL4vOOjZ5xGCmF8SnPE/mDWWXgvRExdcpCgh9lLRRa1/fSYp2ymmbJ1pI+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.23",
+        "debug": "^4.1.1",
+        "istanbul-lib-coverage": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
+    "node_modules/jest": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest/-/jest-30.4.2.tgz",
+      "integrity": "sha512-Yi1jqNC/Oq0N4hBgNH/YvBpP1P57QqundgytzYqy3yqAa7NZPNjSoi4SGbRAXDMdBzNE6xBCi5U7RgfrvMEUVQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/core": "30.4.2",
+        "@jest/types": "30.4.1",
+        "import-local": "^3.2.0",
+        "jest-cli": "30.4.2"
+      },
+      "bin": {
+        "jest": "bin/jest.js"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-changed-files": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.4.1.tgz",
+      "integrity": "sha512-IuctmYrxi21iOSOaIXpJWalHyPAsVv0GeBHKDn8C1CA4W5htHn7INL+wdnL4Bo0+olEndvAFkmb++tIQJG+vvg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "execa": "^5.1.1",
+        "jest-util": "30.4.1",
+        "p-limit": "^3.1.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-circus": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.4.2.tgz",
+      "integrity": "sha512-rvHH7VlY6LgbJXJTQ87GW62g1FntOtbhh0zT+v04kC+pgL6aBKyYINXxWukCpj3dcIBMw5/XUbtDS9dU9JTXeQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/environment": "30.4.1",
+        "@jest/expect": "30.4.1",
+        "@jest/test-result": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "co": "^4.6.0",
+        "dedent": "^1.6.0",
+        "is-generator-fn": "^2.1.0",
+        "jest-each": "30.4.1",
+        "jest-matcher-utils": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-runtime": "30.4.2",
+        "jest-snapshot": "30.4.1",
+        "jest-util": "30.4.1",
+        "p-limit": "^3.1.0",
+        "pretty-format": "30.4.1",
+        "pure-rand": "^7.0.0",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.6"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-circus/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-circus/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-cli": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.4.2.tgz",
+      "integrity": "sha512-jfA2ocvVHMXS2QijrJ0d31ektP+d/W0T5RpcTX2Pq+3sVqHlsXVCM2+FmwpL+bdY8OfHpIg9xMxLF17Zg0U49Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/core": "30.4.2",
+        "@jest/test-result": "30.4.1",
+        "@jest/types": "30.4.1",
+        "chalk": "^4.1.2",
+        "exit-x": "^0.2.2",
+        "import-local": "^3.2.0",
+        "jest-config": "30.4.2",
+        "jest-util": "30.4.1",
+        "jest-validate": "30.4.1",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "jest": "bin/jest.js"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-config": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.4.2.tgz",
+      "integrity": "sha512-rNHAShJQqQwFNoL0hbf3BphSBOWnpOUAKvidLS/AjNVLPfoj5mSf4jQMfW3cYOs6hXeZC7nF7mDHaBnbxELOzg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.27.4",
+        "@jest/get-type": "30.1.0",
+        "@jest/pattern": "30.4.0",
+        "@jest/test-sequencer": "30.4.1",
+        "@jest/types": "30.4.1",
+        "babel-jest": "30.4.1",
+        "chalk": "^4.1.2",
+        "ci-info": "^4.2.0",
+        "deepmerge": "^4.3.1",
+        "glob": "^10.5.0",
+        "graceful-fs": "^4.2.11",
+        "jest-circus": "30.4.2",
+        "jest-docblock": "30.4.0",
+        "jest-environment-node": "30.4.1",
+        "jest-regex-util": "30.4.0",
+        "jest-resolve": "30.4.1",
+        "jest-runner": "30.4.2",
+        "jest-util": "30.4.1",
+        "jest-validate": "30.4.1",
+        "parse-json": "^5.2.0",
+        "pretty-format": "30.4.1",
+        "slash": "^3.0.0",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "@types/node": "*",
+        "esbuild-register": ">=3.4.0",
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "esbuild-register": {
+          "optional": true
+        },
+        "ts-node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-config/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-config/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-diff": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz",
+      "integrity": "sha512-CRpFK0RtLriVDGcPPAnR6HMVI8bSR2jnUIgralhauzYQZIb4RH9AtEInTuQr65LmmGggGcRT6HIASxwqsVsmlA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/diff-sequences": "30.4.0",
+        "@jest/get-type": "30.1.0",
+        "chalk": "^4.1.2",
+        "pretty-format": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-diff/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-diff/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-docblock": {
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.4.0.tgz",
+      "integrity": "sha512-ZPMabUZCx5MpbZ2eBYSvZ0J8fvo3dR9oM+eeUpb3aKNQFuS2tu3Duw1TNlMoP8k3WQgKGJuhcMFvwcVuq6T7oA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "detect-newline": "^3.1.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-each": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.4.1.tgz",
+      "integrity": "sha512-/8MJbH6fuj48TstjrMf+u/pd06Qezz5xOXvZA6442heNOWr8bdeoGZX2d9fCn028CoMgYmroH9//zky5GfyYmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/get-type": "30.1.0",
+        "@jest/types": "30.4.1",
+        "chalk": "^4.1.2",
+        "jest-util": "30.4.1",
+        "pretty-format": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-each/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-each/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-environment-jsdom": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-30.4.1.tgz",
+      "integrity": "sha512-o3nfaN4zej7qgk2X0j8Jhq/S9nAVKs2xK3QeQxeHVvpkEPxaA1yxDGydR+iVI7zPy7Cp62Aq2h3Ja46QvfWHGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/environment": "30.4.1",
+        "@jest/environment-jsdom-abstract": "30.4.1",
+        "jsdom": "^26.1.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-environment-node": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.4.1.tgz",
+      "integrity": "sha512-4FZYVOk85hz2AyT6BbarKy9u37g6DbrDyCdFhsnDdXqyrueYQvB+0zO4f/kqLCRD0BsPRXPMNJeQwihKZV8naw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/environment": "30.4.1",
+        "@jest/fake-timers": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "jest-mock": "30.4.1",
+        "jest-util": "30.4.1",
+        "jest-validate": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-haste-map": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.4.1.tgz",
+      "integrity": "sha512-rFrcONd8jeFsyw+Z9CrScJgglRf2+NFmNam8dKu7n+SoHqNYT47mn0DdEcVUZJpvh7Iz6/si7f7yUH7GJHVgnw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "anymatch": "^3.1.3",
+        "fb-watchman": "^2.0.2",
+        "graceful-fs": "^4.2.11",
+        "jest-regex-util": "30.4.0",
+        "jest-util": "30.4.1",
+        "jest-worker": "30.4.1",
+        "picomatch": "^4.0.3",
+        "walker": "^1.0.8"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "^2.3.3"
+      }
+    },
+    "node_modules/jest-leak-detector": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.4.1.tgz",
+      "integrity": "sha512-IpmyiioeHxiWDhesHnUFmOxcTzwCwKpgACgWajtAP+nYQXiY7DakTxB6Bx9JFiRMljr0AX1PvnQdaU1KFoz6NQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/get-type": "30.1.0",
+        "pretty-format": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-leak-detector/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-leak-detector/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-matcher-utils": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.4.1.tgz",
+      "integrity": "sha512-zvYfX5CaeEkFrrLS9suWe9rvJrm9J1Iv3ua8kIBv9GEPzcnsfBf0bob37la7s67fs0nlBC3EuvkOLnXQKxtx4A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/get-type": "30.1.0",
+        "chalk": "^4.1.2",
+        "jest-diff": "30.4.1",
+        "pretty-format": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-message-util": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.4.1.tgz",
+      "integrity": "sha512-kwCKIvq0MCW1HzLoGola9Te6JUdzgV0loyKJ3Qghrkz9i5/RRIHsL95BMQc2HBBhlBKC4j22K9p11TGHH8RBpQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.27.1",
+        "@jest/types": "30.4.1",
+        "@types/stack-utils": "^2.0.3",
+        "chalk": "^4.1.2",
+        "graceful-fs": "^4.2.11",
+        "jest-util": "30.4.1",
+        "picomatch": "^4.0.3",
+        "pretty-format": "30.4.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.6"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-mock": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.4.1.tgz",
+      "integrity": "sha512-/i8SVb8/NSB7RfNi8gfqu8gxLV23KaL5EpAttyb9iz8qWRIqXRLflycz/32wXsYkOnaUlx8NAKnJYtpsmXUmfw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "jest-util": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-pnp-resolver": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
+      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "peerDependencies": {
+        "jest-resolve": "*"
+      },
+      "peerDependenciesMeta": {
+        "jest-resolve": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-regex-util": {
+      "version": "30.4.0",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.4.0.tgz",
+      "integrity": "sha512-mWlvLviKIgIQ8VCuM1xRdD0TWp3zlzionlmDBjuXVBs+VkmXq6FgW9T4Emr7oGz/Rk6feDCGyiugolcQEyp3mg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-resolve": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.4.1.tgz",
+      "integrity": "sha512-Zry8Yq/yJcNAZ7dJ5F2heic8AheXvbFZ7XI5V+h28nrYZ7Qoyy4dItq8OodjnYD270mvX+ZudmrNV9cysqhW5Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "chalk": "^4.1.2",
+        "graceful-fs": "^4.2.11",
+        "jest-haste-map": "30.4.1",
+        "jest-pnp-resolver": "^1.2.3",
+        "jest-util": "30.4.1",
+        "jest-validate": "30.4.1",
+        "slash": "^3.0.0",
+        "unrs-resolver": "^1.7.11"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-resolve-dependencies": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.4.2.tgz",
+      "integrity": "sha512-gDiVh1I+GxYzz9oXlyw+1wv6VOYX1WYxMOfjsA3iGKePV2oxmbHhwxfkALxNxYy1ciw6APWwkW2zZONwP97aEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "jest-regex-util": "30.4.0",
+        "jest-snapshot": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-runner": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.4.2.tgz",
+      "integrity": "sha512-2dw0PslVYXxffXGpLo+Ejad+KcI1Qkjn7f4X4619gf21oCUmL+SPfjqIa/losUem3yEOvfNZe/F1HWUcNpODcg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/console": "30.4.1",
+        "@jest/environment": "30.4.1",
+        "@jest/test-result": "30.4.1",
+        "@jest/transform": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "emittery": "^0.13.1",
+        "exit-x": "^0.2.2",
+        "graceful-fs": "^4.2.11",
+        "jest-docblock": "30.4.0",
+        "jest-environment-node": "30.4.1",
+        "jest-haste-map": "30.4.1",
+        "jest-leak-detector": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-resolve": "30.4.1",
+        "jest-runtime": "30.4.2",
+        "jest-util": "30.4.1",
+        "jest-watcher": "30.4.1",
+        "jest-worker": "30.4.1",
+        "p-limit": "^3.1.0",
+        "source-map-support": "0.5.13"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-runtime": {
+      "version": "30.4.2",
+      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.4.2.tgz",
+      "integrity": "sha512-3/5e8iPz2k/VLqlr8DgTftYyLUv8Su3FkCAO2/Od81UsUTpSxOrS6O5x5KkoQwyUjmpYyDJKeyAvg2T2nvpNkQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/environment": "30.4.1",
+        "@jest/fake-timers": "30.4.1",
+        "@jest/globals": "30.4.1",
+        "@jest/source-map": "30.0.1",
+        "@jest/test-result": "30.4.1",
+        "@jest/transform": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "cjs-module-lexer": "^2.1.0",
+        "collect-v8-coverage": "^1.0.2",
+        "glob": "^10.5.0",
+        "graceful-fs": "^4.2.11",
+        "jest-haste-map": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-mock": "30.4.1",
+        "jest-regex-util": "30.4.0",
+        "jest-resolve": "30.4.1",
+        "jest-snapshot": "30.4.1",
+        "jest-util": "30.4.1",
+        "slash": "^3.0.0",
+        "strip-bom": "^4.0.0"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-snapshot": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.4.1.tgz",
+      "integrity": "sha512-tEOkkfOMppUyeiHwjZswOQ3lcnoTnws/q5FnGIaeIh/jmoU0ZlgMYRR8sTlTj+nNGCoJ0RDq6SfxGxCsyMTPmw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/core": "^7.27.4",
+        "@babel/generator": "^7.27.5",
+        "@babel/plugin-syntax-jsx": "^7.27.1",
+        "@babel/plugin-syntax-typescript": "^7.27.1",
+        "@babel/types": "^7.27.3",
+        "@jest/expect-utils": "30.4.1",
+        "@jest/get-type": "30.1.0",
+        "@jest/snapshot-utils": "30.4.1",
+        "@jest/transform": "30.4.1",
+        "@jest/types": "30.4.1",
+        "babel-preset-current-node-syntax": "^1.2.0",
+        "chalk": "^4.1.2",
+        "expect": "30.4.1",
+        "graceful-fs": "^4.2.11",
+        "jest-diff": "30.4.1",
+        "jest-matcher-utils": "30.4.1",
+        "jest-message-util": "30.4.1",
+        "jest-util": "30.4.1",
+        "pretty-format": "30.4.1",
+        "semver": "^7.7.2",
+        "synckit": "^0.11.8"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/jest-util": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.4.1.tgz",
+      "integrity": "sha512-vjQb1sACEiv13DKJMDToJpzVW0joCsIQrmbg0fi7CyOOt+g9jTuQl2A216pWRBYhOVt53XbL/2LbMKg1BECWOw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "chalk": "^4.1.2",
+        "ci-info": "^4.2.0",
+        "graceful-fs": "^4.2.11",
+        "picomatch": "^4.0.3"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-validate": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.4.1.tgz",
+      "integrity": "sha512-PDWi4SOwLnwqNDfHZjOcsEFyZ4fc/2W2gVL3DEoyqnB6jCQMLRtfBong8s6omIw3lI0HWOus12xfnFmQtjW3fw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/get-type": "30.1.0",
+        "@jest/types": "30.4.1",
+        "camelcase": "^6.3.0",
+        "chalk": "^4.1.2",
+        "leven": "^3.1.0",
+        "pretty-format": "30.4.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-validate/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-validate/node_modules/camelcase": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-validate/node_modules/pretty-format": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
+      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/schemas": "30.4.1",
+        "ansi-styles": "^5.2.0",
+        "react-is-18": "npm:react-is@^18.3.1",
+        "react-is-19": "npm:react-is@^19.2.5"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-watcher": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.4.1.tgz",
+      "integrity": "sha512-/l9UonmvCwjHH7d2h3iAwIloLc1H0S8mJZ/LNK3i86hqwPAz8otUJjP9MfYtz9Tt77Su5FD2xGjZn8d31IZHlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jest/test-result": "30.4.1",
+        "@jest/types": "30.4.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.3.2",
+        "chalk": "^4.1.2",
+        "emittery": "^0.13.1",
+        "jest-util": "30.4.1",
+        "string-length": "^4.0.2"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-worker": {
+      "version": "30.4.1",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.4.1.tgz",
+      "integrity": "sha512-SHynN/q/QD++iNyvMdy+WMmbCGk8jIsNcRxycXbWubSOhvo6T+j2afcfUSl+3hYsiBebOTo0cT7c2H7CXugu1g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@ungap/structured-clone": "^1.3.0",
+        "jest-util": "30.4.1",
+        "merge-stream": "^2.0.0",
+        "supports-color": "^8.1.1"
+      },
+      "engines": {
+        "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
+      }
+    },
+    "node_modules/jest-worker/node_modules/supports-color": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/jiti": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jiti": "lib/jiti-cli.mjs"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/jsdom": {
+      "version": "26.1.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-26.1.0.tgz",
+      "integrity": "sha512-Cvc9WUhxSMEo4McES3P7oK3QaXldCfNWp7pl2NNeiIFlCoLr3kfq9kb1fxftiwk1FLV7CvpvDfonxtzUDeSOPg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cssstyle": "^4.2.1",
+        "data-urls": "^5.0.0",
+        "decimal.js": "^10.5.0",
+        "html-encoding-sniffer": "^4.0.0",
+        "http-proxy-agent": "^7.0.2",
+        "https-proxy-agent": "^7.0.6",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.16",
+        "parse5": "^7.2.1",
+        "rrweb-cssom": "^0.8.0",
+        "saxes": "^6.0.0",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^5.1.1",
+        "w3c-xmlserializer": "^5.0.0",
+        "webidl-conversions": "^7.0.0",
+        "whatwg-encoding": "^3.1.1",
+        "whatwg-mimetype": "^4.0.0",
+        "whatwg-url": "^14.1.1",
+        "ws": "^8.18.0",
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "peerDependencies": {
+        "canvas": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jsesc": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/json-buffer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
+      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-parse-even-better-errors": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
+      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
+      "integrity": "sha512-HUgH65KyejrUFPvHFPbqOY0rsFip3Bo5wb4ngvdi1EpCYWUQDC5V+Y7mZws+DLkr4M//zQJoanu1SP+87Dv1oQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/keyv": {
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
+      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "json-buffer": "3.0.1"
+      }
+    },
+    "node_modules/leven": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
+      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/lightningcss": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
+      }
+    },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lines-and-columns": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
+      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/lower-case": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-2.0.2.tgz",
+      "integrity": "sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "yallist": "^3.0.2"
+      }
+    },
+    "node_modules/lz-string": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/lz-string/-/lz-string-1.5.0.tgz",
+      "integrity": "sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "bin": {
+        "lz-string": "bin/bin.js"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/make-dir/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/makeerror": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
+      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tmpl": "1.0.5"
+      }
+    },
+    "node_modules/merge-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
+      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mimic-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
+      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/min-indent": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/min-indent/-/min-indent-1.0.1.tgz",
+      "integrity": "sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.18",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/napi-postinstall": {
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/napi-postinstall/-/napi-postinstall-0.3.4.tgz",
+      "integrity": "sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "napi-postinstall": "lib/cli.js"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/napi-postinstall"
+      }
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/no-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/no-case/-/no-case-3.0.4.tgz",
+      "integrity": "sha512-fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lower-case": "^2.0.2",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.53",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.53.tgz",
+      "integrity": "sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/npm-run-path": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/nwsapi": {
+      "version": "2.2.24",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
+      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/onetime": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mimic-fn": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/optionator": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-try": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
+    "node_modules/param-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/param-case/-/param-case-3.0.4.tgz",
+      "integrity": "sha512-RXlj7zCYokReqWpOPH9oYivUzLYZ5vAPIfEmCTNViosC78F8F0H9y7T7gG2M39ymgutxF5gcFEsyZQSph9Bp3A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "dot-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/parse-json": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
+      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/code-frame": "^7.0.0",
+        "error-ex": "^1.3.1",
+        "json-parse-even-better-errors": "^2.3.0",
+        "lines-and-columns": "^1.1.6"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parse5": {
+      "version": "7.3.0",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+      "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "entities": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/inikulin/parse5?sponsor=1"
+      }
+    },
+    "node_modules/pascal-case": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/pascal-case/-/pascal-case-3.1.2.tgz",
+      "integrity": "sha512-uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "no-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/path-scurry/node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pirates": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz",
+      "integrity": "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/pkg-dir": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "find-up": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkg-dir/node_modules/find-up": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "locate-path": "^5.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkg-dir/node_modules/locate-path": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pkg-dir/node_modules/p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-try": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/pkg-dir/node_modules/p-locate": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.62.1.tgz",
+      "integrity": "sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.62.1"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.62.1",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.62.1.tgz",
+      "integrity": "sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.26",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.26.tgz",
+      "integrity": "sha512-u82N74LFzG8ca+dD8puPnplTXoGH4fTPpVGuIbt36G3qvNlkvfD0lEAZSxaly3KX8TS/L1A1gsCEmvKmBcVbkQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.17",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/pretty-format": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
+      "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1",
+        "ansi-styles": "^5.0.0",
+        "react-is": "^17.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/pretty-format/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/prismjs": {
+      "version": "1.30.0",
+      "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.30.0.tgz",
+      "integrity": "sha512-DEvV2ZF2r2/63V+tK8hQvrR2ZGn10srHbXviTlcv7Kpzw8jWiNTqbVgjO3IY8RxrrOUF8VPMQQFysYYYv0YZxw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/pure-rand": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-7.0.1.tgz",
+      "integrity": "sha512-oTUZM/NAZS8p7ANR3SHh30kXB+zK2r2BPcEn/awJIbOvq82WoMN4p62AWWp3Hhw50G0xMsw1mhIBLqHw64EcNQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/react": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.8.tgz",
+      "integrity": "sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/react-dom": {
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.8.tgz",
+      "integrity": "sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==",
+      "license": "MIT",
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.8"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
+      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
+      "dev": true,
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/react-is-18": {
+      "name": "react-is",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/react-is-19": {
+      "name": "react-is",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.8.tgz",
+      "integrity": "sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/react-router": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-8.3.0.tgz",
+      "integrity": "sha512-qyPMvW83jGIct3yiieisxdk9M745anqhpIMKN5m1t6yBMfgVPpt77aHOqs5fUlEJRMCGffg9BaQLH9oPVOL7xQ==",
+      "license": "MIT",
+      "dependencies": {
+        "cookie-es": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=22.22.0"
+      },
+      "peerDependencies": {
+        "react": ">=19.2.7",
+        "react-dom": ">=19.2.7"
+      },
+      "peerDependenciesMeta": {
+        "react-dom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/react-simple-code-editor": {
+      "version": "0.14.1",
+      "resolved": "https://registry.npmjs.org/react-simple-code-editor/-/react-simple-code-editor-0.14.1.tgz",
+      "integrity": "sha512-BR5DtNRy+AswWJECyA17qhUDvrrCZ6zXOCfkQY5zSmb96BVUbpVAv03WpcjcwtCwiLbIANx3gebHOcXYn1EHow==",
+      "license": "MIT",
+      "peerDependencies": {
+        "react": ">=16.8.0",
+        "react-dom": ">=16.8.0"
+      }
+    },
+    "node_modules/redent": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/redent/-/redent-3.0.0.tgz",
+      "integrity": "sha512-6tDA8g98We0zd0GvVeMT9arEOnTw9qM03L9cJXaCjrip1OO764RDBLBfrB4cwzNGDj5OA5ioymC9GkizgWJDUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "indent-string": "^4.0.0",
+        "strip-indent": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/relateurl": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/relateurl/-/relateurl-0.2.7.tgz",
+      "integrity": "sha512-G08Dxvm4iDN3MLM0EsP62EDV9IuhXPR6blNz6Utcp7zyV3tr4HVNINt6MpaRWbxoOHT3Q7YN2P+jaHX8vUbgog==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/resolve-cwd": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
+      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve-from": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/resolve-from": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/rolldown": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.3.tgz",
+      "integrity": "sha512-rn9wpmxplLf7NLNyCk9FyWh3FM43DbY8jOzCdEPzH7uflhTftRbCEpqi6Ly2osgoU8OwObtmavMbWLaWy4LX7A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oxc-project/types": "=0.143.0",
+        "@rolldown/pluginutils": "^1.0.0"
+      },
+      "bin": {
+        "rolldown": "bin/cli.mjs"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "optionalDependencies": {
+        "@rolldown/binding-android-arm64": "1.2.3",
+        "@rolldown/binding-darwin-arm64": "1.2.3",
+        "@rolldown/binding-darwin-x64": "1.2.3",
+        "@rolldown/binding-freebsd-x64": "1.2.3",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.2.3",
+        "@rolldown/binding-linux-arm64-gnu": "1.2.3",
+        "@rolldown/binding-linux-arm64-musl": "1.2.3",
+        "@rolldown/binding-linux-ppc64-gnu": "1.2.3",
+        "@rolldown/binding-linux-s390x-gnu": "1.2.3",
+        "@rolldown/binding-linux-x64-gnu": "1.2.3",
+        "@rolldown/binding-linux-x64-musl": "1.2.3",
+        "@rolldown/binding-openharmony-arm64": "1.2.3",
+        "@rolldown/binding-win32-arm64-msvc": "1.2.3",
+        "@rolldown/binding-win32-x64-msvc": "1.2.3"
+      }
+    },
+    "node_modules/rrweb-cssom": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/rrweb-cssom/-/rrweb-cssom-0.8.0.tgz",
+      "integrity": "sha512-guoltQEx+9aMf2gDZ0s62EcV8lsXR+0w8915TC3ITdn2YueuNjdAYh/levpU9nFaoChh9RUS5ZdQMrKfVEN9tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/saxes": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
+      "integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=v12.22.7"
+      }
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT"
+    },
+    "node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-support": {
+      "version": "0.5.13",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
+      "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/stack-utils": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz",
+      "integrity": "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "escape-string-regexp": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/stack-utils/node_modules/escape-string-regexp": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-length": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
+      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "char-regex": "^1.0.2",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/string-length/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^6.2.2"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi/node_modules/ansi-regex": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/strip-bom": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
+      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-final-newline": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
+      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/strip-indent": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-3.0.0.tgz",
+      "integrity": "sha512-laJTa3Jb+VQpaC6DseHhF7dXVqHTfJPCRDaEbid/drOhgitgYku/letMUqOXFoWV0zIIUbjpdH2t+tYj4bQMRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "min-indent": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/synckit": {
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
+      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@pkgr/core": "^0.3.6"
+      },
+      "engines": {
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/synckit"
+      }
+    },
+    "node_modules/tailwindcss": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz",
+      "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/terser": {
+      "version": "5.50.0",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.50.0.tgz",
+      "integrity": "sha512-CN9BVxWhgS/hRxtUMjtC2uRWSTcSfQFHMDWma6sKKfIivCD91sM+FOPfvwoaRMqCSrUpe1nv3jDamd9eEQ4y+w==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "@jridgewell/source-map": "^0.3.3",
+        "acorn": "^8.15.0",
+        "commander": "^2.20.0",
+        "source-map-support": "~0.5.20"
+      },
+      "bin": {
+        "terser": "bin/terser"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/terser/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/terser/node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/test-exclude": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@istanbuljs/schema": "^0.1.2",
+        "glob": "^7.1.4",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/test-exclude/node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/test-exclude/node_modules/brace-expansion": {
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/test-exclude/node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/test-exclude/node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tldts": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-6.1.86.tgz",
+      "integrity": "sha512-WMi/OQ2axVTf/ykqCQgXiIct+mSQDFdH2fkwhPwgEwvJ1kSzZRiinb0zF2Xb8u4+OqPChmyI6MEu4EezNJz+FQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tldts-core": "^6.1.86"
+      },
+      "bin": {
+        "tldts": "bin/cli.js"
+      }
+    },
+    "node_modules/tldts-core": {
+      "version": "6.1.86",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-6.1.86.tgz",
+      "integrity": "sha512-Je6p7pkk+KMzMv2XXKmAE3McmolOQFdxkKw0R8EYNr7sELW46JqnNeTX8ybPiQgvg1ymCoF8LXs5fzFaZvJPTA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tmpl": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
+      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/tough-cookie": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-5.1.2.tgz",
+      "integrity": "sha512-FVDYdxtnj0G6Qm/DhNPSb8Ju59ULcup3tuJxkFb5K8Bv2pUXILbf0xZWU8PX8Ov19OXljbUyveOFwRMwkXzO+A==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tldts": "^6.1.32"
+      },
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/ts-api-utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
+      "license": "0BSD"
+    },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/type-detect": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
+      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/type-fest": {
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/typescript-eslint": {
+      "version": "8.67.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.67.0.tgz",
+      "integrity": "sha512-S2udFs8tCKEKffuJ4TB1idGUZiXdCPGi3IPBGWXarbLQ5UPXORV8QEVzJ4gCRduURMb5EkpNCdjbk0eDIuI8Yg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "8.67.0",
+        "@typescript-eslint/parser": "8.67.0",
+        "@typescript-eslint/typescript-estree": "8.67.0",
+        "@typescript-eslint/utils": "8.67.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/unrs-resolver": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.12.2.tgz",
+      "integrity": "sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "napi-postinstall": "^0.3.4"
+      },
+      "funding": {
+        "url": "https://opencollective.com/unrs-resolver"
+      },
+      "optionalDependencies": {
+        "@unrs/resolver-binding-android-arm-eabi": "1.12.2",
+        "@unrs/resolver-binding-android-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-x64": "1.12.2",
+        "@unrs/resolver-binding-freebsd-x64": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-musleabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-ppc64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-s390x-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-musl": "1.12.2",
+        "@unrs/resolver-binding-openharmony-arm64": "1.12.2",
+        "@unrs/resolver-binding-wasm32-wasi": "1.12.2",
+        "@unrs/resolver-binding-win32-arm64-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-ia32-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-x64-msvc": "1.12.2"
+      }
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz",
+      "integrity": "sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "escalade": "^3.2.0",
+        "picocolors": "^1.1.1"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "node_modules/v8-to-istanbul": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-9.3.0.tgz",
+      "integrity": "sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.12",
+        "@types/istanbul-lib-coverage": "^2.0.1",
+        "convert-source-map": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10.12.0"
+      }
+    },
+    "node_modules/vite": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz",
+      "integrity": "sha512-EU/eS7BH3XROHh2YnBefjM6DBKA6ZeMZEYQbj7NLWg5wHYlhB8B/Mayd5XsgWq+NFYccDOTemRpdETWR6Ka/lw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lightningcss": "^1.33.0",
+        "picomatch": "^4.0.5",
+        "postcss": "^8.5.25",
+        "rolldown": "~1.2.1",
+        "tinyglobby": "^0.2.17"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "@vitejs/devtools": "^0.4.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "@vitejs/devtools": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
+      "integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
+      "dev": true,
+      "license": "MPL-2.0",
+      "dependencies": {
+        "detect-libc": "^2.0.3"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.33.0",
+        "lightningcss-darwin-arm64": "1.33.0",
+        "lightningcss-darwin-x64": "1.33.0",
+        "lightningcss-freebsd-x64": "1.33.0",
+        "lightningcss-linux-arm-gnueabihf": "1.33.0",
+        "lightningcss-linux-arm64-gnu": "1.33.0",
+        "lightningcss-linux-arm64-musl": "1.33.0",
+        "lightningcss-linux-x64-gnu": "1.33.0",
+        "lightningcss-linux-x64-musl": "1.33.0",
+        "lightningcss-win32-arm64-msvc": "1.33.0",
+        "lightningcss-win32-x64-msvc": "1.33.0"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-android-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
+      "integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-darwin-arm64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
+      "integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-darwin-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
+      "integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-freebsd-x64": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
+      "integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
+      "integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
+      "integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
+      "integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
+      "integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
+      "integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
+      "integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/vite/node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.33.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
+      "integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/w3c-xmlserializer": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-5.0.0.tgz",
+      "integrity": "sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "xml-name-validator": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/walker": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
+      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "makeerror": "1.0.12"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
+      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-3.1.1.tgz",
+      "integrity": "sha512-6qN4hJdMwfYBtE3YBTTHhoeuUrDBPZmbQaxWAqSALV/MeEnR5z1xd8UKud2RAkFoPkmB+hli1TZSnyi84xz1vQ==",
+      "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "iconv-lite": "0.6.3"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-4.0.0.tgz",
+      "integrity": "sha512-QaKxh0eNIi2mE9p2vEdzfagOKHCcj1pJ56EEHGQOVxp8r9/iszLUUV7v89x9O1p/T+NlTM5W7jW6+cz4Fq1YVg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/whatwg-url": {
+      "version": "14.2.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
+      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tr46": "^5.1.0",
+        "webidl-conversions": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/ansi-styles": {
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/write-file-atomic": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-5.0.1.tgz",
+      "integrity": "sha512-+QU2zd6OTD8XWIJCbffaiQeH9U73qIqafo1x6V1snCWYGJf6cVE0cDR4D8xRzcEnfI21IFrUPzPGtcPf8AC+Rw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "imurmurhash": "^0.1.4",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+      }
+    },
+    "node_modules/ws": {
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-5.0.0.tgz",
+      "integrity": "sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/y18n": {
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/yaml": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
+    "node_modules/yargs": {
+      "version": "17.7.3",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+      "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/yargs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
+    },
+    "node_modules/zod-validation-error": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/zod-validation-error/-/zod-validation-error-4.0.2.tgz",
+      "integrity": "sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "peerDependencies": {
+        "zod": "^3.25.0 || ^4.0.0"
+      }
+    },
+    "node_modules/zustand": {
+      "version": "5.0.14",
+      "resolved": "https://registry.npmjs.org/zustand/-/zustand-5.0.14.tgz",
+      "integrity": "sha512-/8tAspM5LMPr28b3fwLYrtdj77ECpfZviaP75CMTnwO8ISyaE4GDIG/9rDDYq/cH9D2Xw2A2RXglLInmVBQB/g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      },
+      "peerDependencies": {
+        "@types/react": ">=18.0.0",
+        "immer": ">=9.0.6",
+        "react": ">=18.0.0",
+        "use-sync-external-store": ">=1.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@types/react": {
+          "optional": true
+        },
+        "immer": {
+          "optional": true
+        },
+        "react": {
+          "optional": true
+        },
+        "use-sync-external-store": {
+          "optional": true
+        }
+      }
+    }
+  }
+}
diff --git a/frontend/package.json b/frontend/package.json
new file mode 100644
index 0000000..91281f4
--- /dev/null
+++ b/frontend/package.json
@@ -0,0 +1,51 @@
+{
+  "name": "doppel-dashboard",
+  "private": true,
+  "type": "module",
+  "license": "Apache-2.0",
+  "description": "The browser dashboard Doppel's admin listener serves from its root.",
+  "scripts": {
+    "prebuild": "node scripts/copy-favicon.mjs",
+    "dev": "vite",
+    "build": "vite build",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit",
+    "test": "jest",
+    "e2e": "playwright test"
+  },
+  "dependencies": {
+    "@cfworker/json-schema": "^4.1.1",
+    "prismjs": "^1.30.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-router": "^8.3.0",
+    "react-simple-code-editor": "^0.14.1",
+    "yaml": "^2.9.0",
+    "zustand": "^5.0.14"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.62.1",
+    "@swc/core": "^1.15.47",
+    "@swc/jest": "^0.2.39",
+    "@tailwindcss/vite": "^4.3.3",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/react": "^16.3.2",
+    "@testing-library/user-event": "^14.6.3",
+    "@types/html-minifier-terser": "^7.0.2",
+    "@types/jest": "^30.0.0",
+    "@types/prismjs": "^1.26.5",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^6.0.5",
+    "eslint": "^10.8.1",
+    "eslint-plugin-react-hooks": "^7.1.1",
+    "html-minifier-terser": "^7.2.0",
+    "jest": "^30.4.2",
+    "jest-environment-jsdom": "^30.4.1",
+    "tailwindcss": "^4.3.3",
+    "typescript": "~5.9.3",
+    "typescript-eslint": "^8.67.0",
+    "vite": "^8.2.1"
+  }
+}
diff --git a/frontend/playwright.config.ts b/frontend/playwright.config.ts
new file mode 100644
index 0000000..93db844
--- /dev/null
+++ b/frontend/playwright.config.ts
@@ -0,0 +1,27 @@
+import { defineConfig, devices } from '@playwright/test'
+
+/**
+ * The dashboard, in a real browser, against a real Doppel.
+ *
+ * No `webServer`: each spec file starts its own server, because the
+ * configuration under test -- public, private, dashboard off -- is a property of
+ * the server rather than of the page. See e2e/src/server.ts.
+ */
+export default defineConfig({
+  // The specs live under `e2e/tests`; `e2e/src` is the harness they drive, and
+  // Playwright must not go looking for tests in it.
+  testDir: './e2e/tests',
+  // One browser. The dashboard uses nothing engine-specific, and three browsers
+  // would triple a suite whose subject is this application's behaviour.
+  projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: 0,
+  reporter: process.env.CI ? [['html', { open: 'never' }], ['list']] : 'list',
+  use: {
+    // Only on a failure: a trace for every passing test is minutes of upload for
+    // something nobody opens.
+    trace: 'retain-on-failure',
+  },
+  timeout: 30_000,
+})
diff --git a/frontend/scripts/copy-favicon.mjs b/frontend/scripts/copy-favicon.mjs
new file mode 100644
index 0000000..bea8192
--- /dev/null
+++ b/frontend/scripts/copy-favicon.mjs
@@ -0,0 +1,19 @@
+// The favicon comes from `assets/` at the repository root, the same directory the
+// documentation build stages into `docs/assets/`. Copied rather than committed
+// under `public/` so there is one source of truth for the icon; the copy is
+// git-ignored.
+//
+// Node's own `fs` rather than a vite plugin: a plugin would be a dependency for
+// two lines, and `CONTRIBUTING.md` asks what a new one does that the standard
+// library cannot.
+import { copyFileSync, mkdirSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const source = resolve(here, '../../assets/favicon.ico')
+const target = resolve(here, '../public/favicon.ico')
+
+mkdirSync(dirname(target), { recursive: true })
+copyFileSync(source, target)
+console.log(`favicon: ${source} -> ${target}`)
diff --git a/frontend/src/__mocks__/style.ts b/frontend/src/__mocks__/style.ts
new file mode 100644
index 0000000..8c107ee
--- /dev/null
+++ b/frontend/src/__mocks__/style.ts
@@ -0,0 +1,2 @@
+// Styles are a vite concern. Under jest a stylesheet import resolves here.
+export default {}
diff --git a/frontend/src/__tests__/bundle-size.test.ts b/frontend/src/__tests__/bundle-size.test.ts
new file mode 100644
index 0000000..3559dd2
--- /dev/null
+++ b/frontend/src/__tests__/bundle-size.test.ts
@@ -0,0 +1,134 @@
+// The static payload has a budget, and the budget has a test.
+//
+// "As small as possible" is a preference until something fails when it is
+// broken. Measured gzipped, because that is what crosses the wire, and split by
+// role: the entry chunk is what every visitor pays for, a page chunk is paid
+// only by whoever opens that page, and the editor chunk exists precisely so that
+// prism is not paid for by someone who only lists proxies.
+//
+// The numbers are the measured sizes plus about ten percent. They are recorded
+// beside each budget so that a jump shows up in the diff as a number somebody
+// chose rather than as a limit quietly raised to make a build pass.
+import { gzipSync } from 'node:zlib'
+import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+const DIST = join(__dirname, '../../dist')
+const ASSETS = join(DIST, 'assets')
+
+/** Gzipped kilobytes of one built file. */
+const gzippedKb = (file: string): number =>
+  gzipSync(readFileSync(join(ASSETS, file))).length / 1024
+
+/** The entry chunk is the one `index.html` loads directly. */
+const entryName = (): string => {
+  const html = readFileSync(join(DIST, 'index.html'), 'utf8')
+  const match = /\/static\/assets\/(index-[^"']+\.js)/.exec(html)
+  if (!match?.[1]) {
+    throw new Error(`index.html does not reference an entry chunk:\n${html}`)
+  }
+  return match[1]
+}
+
+describe('the built bundle', () => {
+  beforeAll(() => {
+    if (!existsSync(ASSETS)) {
+      throw new Error(
+        `${ASSETS} does not exist -- run \`npm run build\` before \`npm test\`, ` +
+          'which CI does in that order',
+      )
+    }
+  })
+
+  it('keeps the entry chunk within its budget', () => {
+    // Measured 73.9 KB: react, react-dom, react-router's component API and the
+    // shell. It was 90 with `createBrowserRouter`, whose loaders and fetchers
+    // this app does not use -- see app/routes.tsx.
+    const BUDGET_KB = 82
+    const size = gzippedKb(entryName())
+    expect(size).toBeLessThanOrEqual(BUDGET_KB)
+  })
+
+  it('keeps every lazy chunk within its budget', () => {
+    // Measured: the largest page chunk is 4.4 KB (the proxy form) and the editor
+    // is 11.9 -- prism plus four grammars, json, markup, regex and yaml. The page
+    // budget is deliberately looser than measured-plus-ten: a page gaining a
+    // section is ordinary and should not need this file edited, while a page
+    // gaining a *library* is what this is here to catch, and any library clears
+    // 8 KB.
+    const PAGE_BUDGET_KB = 8
+    const EDITOR_BUDGET_KB = 14
+    // Measured 37.2: a YAML parser and a JSON Schema validator, for the operators who
+    // turn the toggle on. Nobody else fetches it. `js-yaml` would have been 14 KB
+    // lighter and brings `argparse`, whose Python-2.0 licence is outside this
+    // repository's policy -- see the note in YamlMode.tsx.
+    const YAML_BUDGET_KB = 40
+    const entry = entryName()
+
+    for (const file of readdirSync(ASSETS).filter((f) => f.endsWith('.js') && f !== entry)) {
+      const budget = file.includes('CodeEditor')
+        ? EDITOR_BUDGET_KB
+        : file.includes('YamlMode')
+          ? YAML_BUDGET_KB
+          : PAGE_BUDGET_KB
+      expect(gzippedKb(file)).toBeLessThanOrEqual(budget)
+    }
+  })
+
+  it('keeps the stylesheet within its budget', () => {
+    // Measured 6.0 KB: 5.1 for the page and 0.9 for the editor's palette, which
+    // loads with the editor. Tailwind emits only the utilities the source actually
+    // uses, so this grows with the number of distinct classes, not with the app.
+    const BUDGET_KB = 7
+    const total = readdirSync(ASSETS)
+      .filter((file) => file.endsWith('.css'))
+      .reduce((sum, file) => sum + gzippedKb(file), 0)
+    expect(total).toBeLessThanOrEqual(BUDGET_KB)
+  })
+
+  it('keeps the whole payload within its budget', () => {
+    // Measured 141 KB across every chunk and the stylesheet, of which 37 is the YAML
+    // editor that most visitors never open and 12 the highlighter that only a page
+    // with an editor on it fetches. The sum is here so that splitting a chunk in two
+    // cannot slip past the per-chunk budgets while making the payload heavier overall.
+    const BUDGET_KB = 155
+    const total = readdirSync(ASSETS).reduce((sum, file) => sum + gzippedKb(file), 0)
+    expect(total).toBeLessThanOrEqual(BUDGET_KB)
+  })
+
+  it('ships the highlighter with its colours, and neither in the entry', () => {
+    // Two failures in one assertion, because they are the same mistake seen from
+    // either side. prism's grammars ship in its package and its palette does not,
+    // so an editor built without the theme tokenises perfectly and renders in one
+    // colour -- which is how this shipped at first, and looks exactly like no
+    // highlighting at all. And the palette belongs in the editor's own stylesheet:
+    // in the entry one, every visitor pays for it to list proxies.
+    const styles = readdirSync(ASSETS).filter((file) => file.endsWith('.css'))
+    const editorStyles = styles.filter((file) => file.includes('CodeEditor'))
+    expect(editorStyles).toHaveLength(1)
+
+    const palette = readFileSync(join(ASSETS, editorStyles[0]!), 'utf8')
+    expect(palette).toMatch(/\.token\.string/)
+
+    for (const file of styles.filter((name) => !name.includes('CodeEditor'))) {
+      expect(readFileSync(join(ASSETS, file), 'utf8')).not.toMatch(/\.token\./)
+    }
+  })
+
+  it('does not carry the syntax highlighter in the entry chunk', () => {
+    // The whole reason the editor is a lazy chunk. A budget alone would not
+    // catch this: prism is small enough to hide inside the entry's slack, and
+    // then every visitor pays for it to list proxies.
+    const entry = readFileSync(join(ASSETS, entryName()), 'utf8')
+    expect(entry).not.toMatch(/prism/i)
+  })
+
+  it('does not carry the YAML parser or the schema validator in the entry chunk', () => {
+    // Same argument, twenty-three kilobytes louder. Matched on strings the two
+    // libraries carry in their own messages, since a minifier keeps those and keeps
+    // nothing of their names.
+    const entry = readFileSync(join(ASSETS, entryName()), 'utf8')
+    expect(entry).not.toMatch(/YAMLException/)
+    expect(entry).not.toMatch(/additional properties schema/)
+  })
+})
diff --git a/frontend/src/__tests__/editor-style-hash.test.ts b/frontend/src/__tests__/editor-style-hash.test.ts
new file mode 100644
index 0000000..d875784
--- /dev/null
+++ b/frontend/src/__tests__/editor-style-hash.test.ts
@@ -0,0 +1,65 @@
+// The one inline stylesheet the page is allowed to carry, held to its hash.
+//
+// `react-simple-code-editor` renders a `<style>` element per editor. The page's
+// content security policy names it by hash rather than opening `style-src` to
+// `unsafe-inline`, which means the hash has to match the library that is installed --
+// and nothing in a build would say otherwise: a changed stylesheet is simply blocked,
+// and the only symptom is a policy violation in an operator's console.
+//
+// So this recomputes it. The library is rendered rather than parsed, because what the
+// policy hashes is what the browser receives.
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { createElement } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import EditorImport from 'react-simple-code-editor'
+
+/** The same interop `CodeEditor` needs: CommonJS with `exports.default`. */
+const Editor = ((EditorImport as unknown as { default?: typeof EditorImport }).default ??
+  EditorImport) as typeof EditorImport
+
+/**
+ * The policy the listener sends, read out of the Rust source.
+ *
+ * The literals inside its `concat!` rather than the whole file: the file also *talks*
+ * about the policy, in a comment explaining why one hash is in it, and a check that
+ * cannot tell the two apart is a check that passes for the wrong reason.
+ */
+const POLICY = (() => {
+  const source = readFileSync(
+    join(__dirname, '../../../crates/doppel-admin/src/dashboard.rs'),
+    'utf8',
+  )
+  const block = /content-security-policy"\),\s*HeaderValue::from_static\(concat!\(([\s\S]*?)\)\)/.exec(
+    source,
+  )
+  if (!block) {
+    throw new Error('dashboard.rs no longer builds the policy from a concat! of literals')
+  }
+  return [...block[1]!.matchAll(/"([^"]*)"/g)].map((match) => match[1]).join('')
+})()
+
+describe("the editor's own stylesheet", () => {
+  it('is the one the content security policy allows', () => {
+    const markup = renderToStaticMarkup(
+      createElement(Editor, { value: '', onValueChange: () => {}, highlight: (code) => code }),
+    )
+    const style = /<style>([\s\S]*?)<\/style>/.exec(markup)
+    // The library still renders one; if it stops, the hashes below are dead weight in
+    // the policy and this is where that gets noticed.
+    expect(style?.[1]).toBeTruthy()
+
+    const hash = `sha256-${createHash('sha256').update(style![1]!, 'utf8').digest('base64')}`
+    expect(POLICY).toContain(hash)
+  })
+
+  it('is allowed by hash rather than by opening the policy', () => {
+    // The fix that would also have silenced the console, and the one worth refusing:
+    // `unsafe-inline` on `style-src` lets anything that reaches the DOM style the
+    // page, which is how a defacement or an exfiltrating background image gets in.
+    expect(POLICY).not.toContain('unsafe-inline')
+    expect(POLICY).toContain("style-src 'self' 'sha256-")
+  })
+})
diff --git a/frontend/src/__tests__/schema-drift.test.ts b/frontend/src/__tests__/schema-drift.test.ts
new file mode 100644
index 0000000..e7c30d0
--- /dev/null
+++ b/frontend/src/__tests__/schema-drift.test.ts
@@ -0,0 +1,67 @@
+// The form covers every field of a proxy. This is what keeps that true.
+//
+// A structured form's real failure mode is not a bug in a control -- it is a
+// field the configuration format grew that nobody added a control for. Nothing
+// fails when that happens: the form saves a document without the field, the
+// server accepts it, and the operator quietly loses the setting they had.
+//
+// So this reads the generated schema -- the same file the Rust drift test holds
+// the code to -- and fails when a property is not mentioned anywhere in the form.
+// Mentioned is a coarse test, and deliberately so: it cannot prove a control is
+// correct, only that the field was not forgotten, which is the failure that
+// actually happens.
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+const schema = JSON.parse(
+  readFileSync(join(__dirname, '../../../doppel-config.schema.json'), 'utf8'),
+) as { $defs: Record<string, { properties?: Record<string, unknown> }> }
+
+/** The form's source, concatenated. */
+const source = ['../pages/ProxyFormPage.tsx', '../components/MockEditor.tsx']
+  .map((file) => readFileSync(join(__dirname, file), 'utf8'))
+  .join('\n')
+
+/** The TypeScript model the form edits. */
+const model = readFileSync(join(__dirname, '../types/proxy.ts'), 'utf8')
+
+const propertiesOf = (name: string): string[] => {
+  const definition = schema.$defs[name]
+  if (!definition?.properties) {
+    throw new Error(`${name} is not in the schema, or has no properties`)
+  }
+  return Object.keys(definition.properties)
+}
+
+describe.each([
+  ['ProxyConfig'],
+  ['MockConfig'],
+  ['MockRequest'],
+  ['MockResponse'],
+  ['ResolveConfig'],
+  ['LossConfig'],
+  ['LatencyConfig'],
+  ['ProxyAccessConfig'],
+])('%s', (definition) => {
+  it('has every property in the form model', () => {
+    for (const property of propertiesOf(definition)) {
+      expect(model).toContain(property)
+    }
+  })
+
+  it('has every property mentioned by the form', () => {
+    for (const property of propertiesOf(definition)) {
+      expect(source).toContain(property)
+    }
+  })
+})
+
+describe('the schema itself', () => {
+  it('is the one the server generates', () => {
+    // A guard on the two paths above: if the schema moved, both loops would pass
+    // against an empty file and this suite would report success while checking
+    // nothing.
+    expect(Object.keys(schema.$defs).length).toBeGreaterThan(20)
+    expect(propertiesOf('ProxyConfig')).toContain('url')
+  })
+})
diff --git a/frontend/src/app/App.tsx b/frontend/src/app/App.tsx
new file mode 100644
index 0000000..50e8d2a
--- /dev/null
+++ b/frontend/src/app/App.tsx
@@ -0,0 +1,64 @@
+import { Suspense, useEffect } from 'react'
+import { Outlet } from 'react-router'
+
+import { Footer } from '../components/Footer'
+import { Header } from '../components/Header'
+import { Spinner } from '../components/Spinner'
+import { Toasts } from '../components/Toasts'
+import { TokenDialog } from '../components/TokenDialog'
+import { runtimeConfig } from '../services/runtimeConfig'
+import { useAccess } from '../store/access'
+import { useAuth } from '../store/auth'
+import { useSchema } from '../store/schema'
+import { startTheme } from '../store/theme'
+
+/**
+ * The shell every page is drawn inside.
+ *
+ * It owns three things no page should own: the theme's lifetime, refetching the
+ * caller's rights whenever the token changes, and fetching the configuration
+ * schema. Rights are per-token, so a page that fetched them for itself would fetch
+ * them again on every navigation and still miss a sign-out that happened elsewhere.
+ * The schema is the same document for the life of the process, so it is fetched
+ * once here rather than per form.
+ */
+export function App() {
+  const token = useAuth((state) => state.token)
+  const askIfNeeded = useAuth((state) => state.askIfNeeded)
+  const refreshAccess = useAccess((state) => state.refresh)
+  const loadSchema = useSchema((state) => state.load)
+
+  useEffect(() => startTheme(), [])
+
+  useEffect(() => {
+    document.title = runtimeConfig().title
+    // Asked here rather than when the store loads: the shell is the first thing
+    // that exists, and a dialog decided at import time would be decided before
+    // the page had rendered.
+    askIfNeeded()
+  }, [askIfNeeded])
+
+  useEffect(() => {
+    void refreshAccess()
+  }, [token, refreshAccess])
+
+  // Unauthenticated, so it does not wait for a token and does not refetch when one
+  // arrives.
+  useEffect(() => {
+    void loadSchema()
+  }, [loadSchema])
+
+  return (
+    <div className="mx-auto flex min-h-screen max-w-5xl flex-col px-4 py-4">
+      <Header />
+      <main className="grow py-4">
+        <Suspense fallback={<Spinner label="Loading..." />}>
+          <Outlet />
+        </Suspense>
+      </main>
+      <Footer />
+      <TokenDialog />
+      <Toasts />
+    </div>
+  )
+}
diff --git a/frontend/src/app/routes.tsx b/frontend/src/app/routes.tsx
new file mode 100644
index 0000000..65a7818
--- /dev/null
+++ b/frontend/src/app/routes.tsx
@@ -0,0 +1,45 @@
+import { lazy } from 'react'
+import { Navigate, Route, Routes, useParams } from 'react-router'
+
+import { App } from './App'
+
+// Every page is its own chunk. That is the requirement -- chunks and lazy
+// loading -- and it is also what keeps the entry payload to the shell: someone
+// who opens the proxy list never downloads the template editor or prism.
+const ProxiesPage = lazy(() => import('../pages/ProxiesPage'))
+const ProxyFormPage = lazy(() => import('../pages/ProxyFormPage'))
+const StatusPage = lazy(() => import('../pages/StatusPage'))
+
+/**
+ * The route table, in react-router's component form.
+ *
+ * Deliberately not `createBrowserRouter`. The data router brings loaders,
+ * actions, fetchers and their state machine, and this app uses none of it -- the
+ * pages fetch in an effect and the stores hold what outlives a screen. Measured
+ * on the first build: the data router put the entry chunk at 90 KB gzipped and
+ * this leaves it near 76, on a budget written for the smallest static payload
+ * that will do the job.
+ */
+/** Where a bookmarked templates URL goes now. */
+function ToProxy() {
+  const { name = '' } = useParams()
+  return <Navigate to={`/proxies/${encodeURIComponent(name)}`} replace />
+}
+
+export function AppRoutes() {
+  return (
+    <Routes>
+      <Route path="/" element={<App />}>
+        <Route index element={<ProxiesPage />} />
+        <Route path="proxies/new" element={<ProxyFormPage />} />
+        <Route path="proxies/:name" element={<ProxyFormPage />} />
+        {/* Templates used to be a page of their own. They are a section of the
+            proxy's form now -- a mock names a file and the file has to be written,
+            and doing that on two screens meant carrying a name across a navigation.
+            The old address still resolves, because it was linkable. */}
+        <Route path="proxies/:name/templates" element={<ToProxy />} />
+        <Route path="status" element={<StatusPage />} />
+      </Route>
+    </Routes>
+  )
+}
diff --git a/frontend/src/app/usePolling.ts b/frontend/src/app/usePolling.ts
new file mode 100644
index 0000000..8d52df0
--- /dev/null
+++ b/frontend/src/app/usePolling.ts
@@ -0,0 +1,46 @@
+import { useEffect } from 'react'
+
+import { runtimeConfig } from '../services/runtimeConfig'
+
+/**
+ * Run `tick` now, then every `refreshMs`, but not while the tab is hidden.
+ *
+ * The interval comes from the injected configuration, so "once a minute" is one
+ * value decided by the server rather than a number written in two places.
+ *
+ * Pausing on hidden is not an optimisation for the browser's sake: a dashboard
+ * left open in a background tab overnight would otherwise make about a thousand
+ * requests nobody reads, and each one carries the admin token.
+ *
+ * `key` is never read. It is the thing whose change means "and fetch again now":
+ * the token, for the caller below. Without it, signing in left the refusal that
+ * had been shown to an anonymous caller on screen until the next tick -- up to a
+ * minute of a page saying a token is needed to someone who had just given one.
+ */
+export function usePolling(tick: () => void, key?: unknown): void {
+  useEffect(() => {
+    const { refreshMs } = runtimeConfig()
+
+    // Fired immediately as well as on the interval, so opening a page does not
+    // show an empty table for a minute.
+    tick()
+
+    let timer = window.setInterval(tick, refreshMs)
+
+    const onVisibility = () => {
+      window.clearInterval(timer)
+      if (document.visibilityState === 'visible') {
+        // Refetched on the way back, because what is on screen is now as stale as
+        // the time the tab spent hidden.
+        tick()
+        timer = window.setInterval(tick, refreshMs)
+      }
+    }
+
+    document.addEventListener('visibilitychange', onVisibility)
+    return () => {
+      window.clearInterval(timer)
+      document.removeEventListener('visibilitychange', onVisibility)
+    }
+  }, [tick, key])
+}
diff --git a/frontend/src/components/Banner.tsx b/frontend/src/components/Banner.tsx
new file mode 100644
index 0000000..1f1cccb
--- /dev/null
+++ b/frontend/src/components/Banner.tsx
@@ -0,0 +1,36 @@
+import type { ReactNode } from 'react'
+
+/**
+ * A message the operator has to read before the page makes sense.
+ *
+ * `action` is for the affordance that fixes it -- "Enter token" beside a 403 --
+ * because a message that names a problem without offering the fix leaves the
+ * reader to work out which of the header's controls they were supposed to use.
+ */
+export function Banner({
+  kind,
+  children,
+  action,
+}: {
+  kind: 'error' | 'warning' | 'note'
+  children: ReactNode
+  action?: ReactNode
+}) {
+  // Three tones, because the three say different things: something is wrong, this
+  // will not work yet, and here is a fact. A warning shown in the error's colour
+  // reads as a failure that already happened.
+  const tone = {
+    error:
+      'border-red-300 bg-red-50 text-red-900 dark:border-red-800 dark:bg-red-950 dark:text-red-100',
+    warning:
+      'border-amber-300 bg-amber-50 text-amber-900 dark:border-amber-700 dark:bg-amber-950 dark:text-amber-100',
+    note: 'border-slate-300 bg-slate-50 text-slate-800 dark:border-slate-700 dark:bg-slate-900 dark:text-slate-100',
+  }[kind]
+
+  return (
+    <div className={`flex items-start gap-3 rounded border px-3 py-2 text-sm ${tone}`} role="alert">
+      <div className="grow whitespace-pre-wrap">{children}</div>
+      {action}
+    </div>
+  )
+}
diff --git a/frontend/src/components/Button.tsx b/frontend/src/components/Button.tsx
new file mode 100644
index 0000000..98a38b0
--- /dev/null
+++ b/frontend/src/components/Button.tsx
@@ -0,0 +1,44 @@
+import type { ButtonHTMLAttributes, ReactNode } from 'react'
+
+/**
+ * A button that says why it is disabled.
+ *
+ * `reason` becomes the tooltip and the accessible description. A control the
+ * caller's token may not use is disabled rather than hidden -- a missing button
+ * reads as a broken page, a disabled one explains itself -- and that only works
+ * if the explanation travels with it.
+ */
+export function Button({
+  children,
+  variant = 'plain',
+  reason,
+  ...rest
+}: ButtonHTMLAttributes<HTMLButtonElement> & {
+  children: ReactNode
+  variant?: 'primary' | 'plain' | 'danger'
+  reason?: string
+}) {
+  const tone = {
+    primary: 'bg-teal-600 text-white hover:bg-teal-500',
+    plain:
+      'border border-slate-300 text-slate-700 hover:bg-slate-100 ' +
+      'dark:border-slate-600 dark:text-slate-200 dark:hover:bg-slate-800',
+    danger:
+      'border border-red-300 text-red-700 hover:bg-red-50 ' +
+      'dark:border-red-800 dark:text-red-300 dark:hover:bg-red-950',
+  }[variant]
+
+  return (
+    <button
+      type={rest.type ?? 'button'}
+      title={rest.disabled ? reason : undefined}
+      className={
+        'inline-flex h-9 shrink-0 items-center justify-center rounded-md px-3 text-sm ' +
+        `font-medium disabled:cursor-not-allowed disabled:opacity-50 ${tone}`
+      }
+      {...rest}
+    >
+      {children}
+    </button>
+  )
+}
diff --git a/frontend/src/components/CodeEditor.css b/frontend/src/components/CodeEditor.css
new file mode 100644
index 0000000..ca5755b
--- /dev/null
+++ b/frontend/src/components/CodeEditor.css
@@ -0,0 +1,82 @@
+/* prism's palette, loaded with the editor rather than with the page.
+ *
+ * Imported by `CodeEditor.tsx`, so it rides in that lazy chunk: someone who only
+ * lists proxies pays for neither the highlighter nor its colours. `bundle-size`
+ * asserts that division.
+ *
+ * The reason this line exists: prism was tokenising correctly and nothing was
+ * coloured, because the grammars ship in the package and the palette does not --
+ * `import 'prismjs'` gives `<span class="token string">` and no rule that says what
+ * a string looks like. This is that rule set, from the library rather than written
+ * here.
+ *
+ * Only its `.token` rules apply: everything else it carries is scoped to
+ * `[class*="language-"]`, which the editor's `pre` does not have. Unlayered on
+ * purpose -- an unlayered rule beats a layered one whatever the specificity, so the
+ * dark overrides below have to be unlayered too. */
+@import "prismjs/themes/prism.css";
+
+/* The same palette for a dark page, which prism ships as a separate file and
+ * therefore cannot be imported alongside the light one: two themes in one
+ * stylesheet means the second wins everywhere. The colours are `prism-tomorrow`'s,
+ * the library's own dark theme, re-scoped under `.dark`.
+ *
+ * `.dark .token.x` outranks prism's `.token.x`, so the light theme stays the
+ * default and this replaces it exactly where the class is set. */
+.dark .token.comment,
+.dark .token.block-comment,
+.dark .token.prolog,
+.dark .token.doctype,
+.dark .token.cdata {
+  color: #999;
+}
+
+.dark .token.punctuation {
+  color: #ccc;
+}
+
+.dark .token.tag,
+.dark .token.attr-name,
+.dark .token.namespace,
+.dark .token.deleted {
+  color: #e2777a;
+}
+
+.dark .token.boolean,
+.dark .token.number,
+.dark .token.function {
+  color: #f08d49;
+}
+
+.dark .token.property,
+.dark .token.class-name,
+.dark .token.constant,
+.dark .token.symbol {
+  color: #f8c555;
+}
+
+.dark .token.selector,
+.dark .token.important,
+.dark .token.atrule,
+.dark .token.keyword,
+.dark .token.builtin {
+  color: #cc99cd;
+}
+
+.dark .token.string,
+.dark .token.char,
+.dark .token.attr-value,
+.dark .token.regex,
+.dark .token.variable {
+  color: #7ec699;
+}
+
+/* `background` as well as the colour: the light theme puts a translucent white
+ * behind an operator, which is invisible on a white page and a smear on a dark
+ * one. */
+.dark .token.operator,
+.dark .token.entity,
+.dark .token.url {
+  color: #67cdcc;
+  background: none;
+}
diff --git a/frontend/src/components/CodeEditor.tsx b/frontend/src/components/CodeEditor.tsx
new file mode 100644
index 0000000..8732772
--- /dev/null
+++ b/frontend/src/components/CodeEditor.tsx
@@ -0,0 +1,148 @@
+import EditorImport from 'react-simple-code-editor'
+
+import './CodeEditor.css'
+import { colour, type Syntax } from './grammars'
+import { labelClass } from './Field'
+
+/**
+ * A textarea with syntax colouring, in its own chunk.
+ *
+ * prism and this editor are the only third-party code below the shell, and they are
+ * here rather than hand-written because a highlighter is a solved problem and a
+ * home-made one is a tokeniser to maintain. They cost roughly twelve kilobytes, which
+ * is why nothing imports this module directly: the pages that need it load it lazily,
+ * and `bundle-size.test.ts` fails if prism ever appears in the entry chunk.
+ *
+ * Which grammar colours what -- and how Jinja gets into three of them -- is in
+ * `grammars.ts`, with the colours themselves in `CodeEditor.css`. All three are needed:
+ * tokenising with no palette is the state this editor shipped in at first, and it
+ * looked exactly like no highlighting.
+ */
+export type { Syntax }
+
+/**
+ * The editor component, whichever shape the bundler hands over.
+ *
+ * `react-simple-code-editor` is CommonJS with `exports.default`, and the two
+ * builds disagree about what that means: the dev server's interop yields the
+ * component, while the production build applies Node's semantics and yields the
+ * whole `module.exports` -- an object, which React refuses with error #130. It
+ * fails only in the built bundle, so the Playwright suite is what caught it.
+ *
+ * Reading `.default` when it is there is correct under both, and costs one line
+ * instead of pinning a bundler's interop flag that the next major would move.
+ */
+const Editor = ((EditorImport as unknown as { default?: typeof EditorImport }).default ??
+  EditorImport) as typeof EditorImport
+
+/**
+ * One line of the editor, in `rem`.
+ *
+ * `text-xs` is `0.75rem`, and the wrapper carries `leading-normal` -- `1.5` -- which
+ * the library's `pre` and `textarea` both inherit. Change either and change this.
+ */
+const LINE = 0.75 * 1.5
+
+/** The editor's own padding, in pixels, on each side. */
+const PADDING_PX = 8
+
+/** The same, in `rem`, top and bottom together. */
+const PADDING = (PADDING_PX * 2) / 16
+
+/**
+ * `h-9`, the height every control on a row shares.
+ *
+ * A one-line editor is a control on a row -- a mock's path pattern sits beside a
+ * method select -- and one two pixels short of its neighbours is the stepping this
+ * project has already fixed once.
+ */
+const CONTROL = 2.25
+
+/** What the editor does not decide for itself. */
+interface Content {
+  value: string
+  syntax: Syntax
+  onChange: (next: string) => void
+  disabled?: boolean
+  /** What an empty editor says it is for, as an input's placeholder would. */
+  placeholder?: string
+  /**
+   * How tall the editor is when it is empty, in lines.
+   *
+   * It grows with its content either way; this is the floor, and it never goes below
+   * the height of an ordinary control. The default suits a mock's body, which is
+   * usually a few lines. A template is a document and gets more -- an editor sized to
+   * its content starts one line tall, which reads as a text input for something
+   * nobody writes on one line.
+   */
+  rows?: number
+}
+
+/**
+ * How the editor's textarea gets its name, which it must have one way or another.
+ *
+ * Either this renders the label -- visibly, or for a screen reader only -- or the
+ * caller already rendered one pointing at `id`, which is what `Field` does when it
+ * holds an editor instead of an input. A caller may pass both: the rows of a map need
+ * a label each *and* ids of their own, because two mocks on a page have maps with the
+ * same label.
+ */
+type Naming =
+  | { label: string; showLabel?: boolean; id?: string }
+  | { id: string; label?: undefined; showLabel?: undefined }
+
+export function CodeEditor(props: Content & Naming) {
+  const { value, syntax, onChange, disabled, placeholder, rows = 6 } = props
+  // The editor renders its own textarea, so the label has to point at it by id --
+  // an `aria-label` passed to the component lands on the wrapping element
+  // instead, which leaves the actual input unlabelled.
+  const id = props.id ?? `editor-${(props.label ?? '').replace(/[^a-zA-Z0-9_-]+/g, '-')}`
+
+  // A one-line editor is a control on a row, and its height is the row's rather than
+  // its content's -- so the padding is what centres the line in it. Every other size
+  // grows with its content, where a constant padding is what looks even.
+  const padding = rows === 1 ? Math.round(((CONTROL - LINE) * 16) / 2) : PADDING_PX
+
+  return (
+    <>
+      {/* Outside the box below, so showing it does not put a caption inside the
+          editor's own border. Absent when the caller named it. */}
+      {props.label === undefined ? null : (
+        <label className={props.showLabel ? labelClass : 'sr-only'} htmlFor={id}>
+          {props.label}
+        </label>
+      )}
+      <div className="max-h-[32rem] overflow-auto rounded-md border border-slate-300 bg-white font-mono text-xs leading-normal text-slate-900 focus-within:border-teal-500 focus-within:ring-1 focus-within:ring-teal-500/40 dark:border-slate-600 dark:bg-slate-900 dark:text-slate-100">
+        <Editor
+          value={value}
+          onValueChange={onChange}
+          disabled={disabled}
+          textareaId={id}
+          // The floor, not the height. The library sizes the container to its
+          // content, and its textarea is `height: 100%` of that container -- so a
+          // minimum on the container is also a minimum on the area that takes
+          // clicks, and clicking the empty space below the last line still lands
+          // in the editor.
+          style={{ minHeight: `${Math.max(rows * LINE + PADDING, CONTROL)}rem` }}
+          // The placeholder cannot be the textarea's: its text is transparent, which
+          // is how the colouring underneath shows through -- so an empty editor draws
+          // its own, in the layer that is actually visible.
+          highlight={(code) =>
+            code || !placeholder
+              ? colour(code, syntax)
+              : `<span class="text-slate-400 dark:text-slate-500">${escape(placeholder)}</span>`
+          }
+          padding={padding}
+          textareaClassName="outline-none"
+        />
+      </div>
+    </>
+  )
+}
+
+/** For the placeholder above, which is the one string here that is not prism's. */
+function escape(text: string): string {
+  return text.replace(/[&<>]/g, (character) => `&#${character.charCodeAt(0)};`)
+}
+
+export default CodeEditor
diff --git a/frontend/src/components/ConfirmDialog.tsx b/frontend/src/components/ConfirmDialog.tsx
new file mode 100644
index 0000000..41c050a
--- /dev/null
+++ b/frontend/src/components/ConfirmDialog.tsx
@@ -0,0 +1,48 @@
+import type { ReactNode } from 'react'
+
+import { Button } from './Button'
+
+/**
+ * A yes-or-no question, for an action that cannot be undone.
+ *
+ * Two callers: deleting a proxy, and saving a document that removes something. Both
+ * are losses an operator cannot get back by editing a field again -- which is the
+ * test for whether something belongs here.
+ *
+ * `detail` takes a node rather than a string because the second caller has a list to
+ * show, and a list of removals reads better than a sentence naming five things.
+ */
+export function ConfirmDialog({
+  question,
+  detail,
+  confirmLabel,
+  onConfirm,
+  onCancel,
+}: {
+  question: string
+  detail?: ReactNode
+  confirmLabel: string
+  onConfirm: () => void
+  onCancel: () => void
+}) {
+  return (
+    <div className="fixed inset-0 z-10 flex items-center justify-center bg-slate-900/40 p-4">
+      <div
+        role="dialog"
+        aria-label={question}
+        className="w-full max-w-md rounded border border-slate-200 bg-white p-4 shadow-lg dark:border-slate-700 dark:bg-slate-900"
+      >
+        <p className="text-sm font-medium text-slate-900 dark:text-slate-100">{question}</p>
+        {detail ? (
+          <div className="mt-1 text-sm text-slate-600 dark:text-slate-300">{detail}</div>
+        ) : null}
+        <div className="mt-3 flex justify-end gap-2">
+          <Button onClick={onCancel}>Cancel</Button>
+          <Button variant="danger" onClick={onConfirm}>
+            {confirmLabel}
+          </Button>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/frontend/src/components/Field.tsx b/frontend/src/components/Field.tsx
new file mode 100644
index 0000000..c4a9ab7
--- /dev/null
+++ b/frontend/src/components/Field.tsx
@@ -0,0 +1,151 @@
+import { cloneElement, isValidElement, useId, type ReactNode } from 'react'
+
+import { Info } from './Info'
+
+/**
+ * A labelled control with room for the server's complaint about it.
+ *
+ * `error` comes from the server, not from a second copy of the rules here: the
+ * configuration types are the arbiter of what is legal, and a client-side
+ * duplicate would be a second, laxer standard nobody wrote down.
+ *
+ * The hint and the error share one line of reserved space. Without that the row
+ * grows the moment a save is refused and everything below it jumps -- which is
+ * exactly when the operator is trying to read something.
+ *
+ * The label names the control by `for` rather than by wrapping it, and the (i) sits
+ * beside the label rather than inside it. Both follow from one rule: what a screen
+ * reader announces for the input has to be the field's name and nothing else. A link
+ * inside the label became part of that name -- "Timeout (seconds) What Timeout
+ * (seconds) does, in the documentation" -- which is the kind of thing only a test
+ * notices.
+ */
+export function Field({
+  label,
+  hint,
+  error,
+  children,
+  htmlFor,
+  info,
+}: {
+  label: string
+  hint?: string
+  error?: string
+  /**
+   * The control, as a single element.
+   *
+   * Single because that is what gets the id the label points at, below. Two elements
+   * leave the label naming nothing, which is invisible on screen and obvious to a
+   * screen reader -- a `datalist` beside an input was how this was found. Pass
+   * `htmlFor` and own the id when the control cannot be one element.
+   */
+  children: ReactNode
+  /**
+   * The field's path in a proxy document, which makes the label carry an (i).
+   *
+   * `timeout`, `loss.percentage`, `mocks[].request.url`: the same paths the schema
+   * rules use, so a field states its path once and gets both its bounds and its
+   * documentation from it.
+   */
+  info?: string
+  /**
+   * The id of the control, when this component cannot give it one.
+   *
+   * The code editor renders its own textarea, so only the editor can put an id on
+   * it. Everything else gets one from here.
+   */
+  htmlFor?: string
+}) {
+  const generated = useId()
+  const id = htmlFor ?? generated
+  // The hint and the complaint are about the control, so they are attached to it
+  // rather than merely printed under it: a screen reader then reads "Upstream URL,
+  // must be absolute" instead of leaving the reason somewhere on the page. It is also
+  // what lets a test ask a field for its message without walking the DOM.
+  const messageId = `${id}-message`
+  const message = error ?? hint
+
+  // The child is one element -- an input, a select, or an editor's Suspense -- and it
+  // needs the id the label points at. Cloned rather than demanded of every call site:
+  // twenty fields would each be spelling out an id whose only reader is the label
+  // above it. A caller that owns the id says so with `htmlFor` and is left alone.
+  const control =
+    htmlFor === undefined && isValidElement<{ id?: string; 'aria-describedby'?: string }>(children)
+      ? cloneElement(children, {
+          id: children.props.id ?? id,
+          'aria-describedby': message ? messageId : undefined,
+        })
+      : children
+
+  return (
+    <div className="block">
+      {/*
+        The margin belongs to the row, not to the label: with it on the label, the row
+        centred a 14px circle against a 24px box and the icon sat two pixels low.
+      */}
+      <div className="mb-1 flex items-center gap-1">
+        <label className={labelTextClass} htmlFor={id}>
+          {label}
+        </label>
+        {info ? <Info path={info} label={label} /> : null}
+      </div>
+      {control}
+      {message ? (
+        <span
+          id={messageId}
+          className={`mt-1 block min-h-4 text-xs ${
+            error ? 'text-red-700 dark:text-red-300' : 'text-slate-500 dark:text-slate-400'
+          }`}
+          role={error ? 'alert' : undefined}
+        >
+          {message}
+        </span>
+      ) : null}
+    </div>
+  )
+}
+
+/**
+ * What a control's name looks like above it.
+ *
+ * Exported because the code editor cannot use `Field`: the library renders its own
+ * textarea, so its name has to be a `label` with a `for` rather than a `span`
+ * wrapping the control. Same words, same weight, one definition.
+ */
+export const labelTextClass = 'block text-sm font-medium text-slate-700 dark:text-slate-200'
+
+/** The same, with the gap to the control -- for a label that stands on its own row. */
+export const labelClass = `mb-1 ${labelTextClass}`
+
+/**
+ * One height and one padding for every control on the page.
+ *
+ * `h-9` is not decoration. An input, a select and a button sat side by side at
+ * three different heights, so a row of them stepped up and down -- and a form is
+ * mostly rows of them. Anything that shares a line with these has to share this
+ * height, which is why the button uses it too.
+ */
+export const controlClass =
+  'block h-9 w-full rounded-md border border-slate-300 bg-white px-2.5 text-sm ' +
+  'text-slate-900 placeholder:text-slate-400 focus:border-teal-500 focus:ring-1 ' +
+  'focus:ring-teal-500/40 focus:outline-none disabled:cursor-not-allowed ' +
+  'disabled:opacity-60 dark:border-slate-600 dark:bg-slate-900 dark:text-slate-100 ' +
+  'dark:placeholder:text-slate-500'
+
+/**
+ * A select, which needs more room on the end than an input does.
+ *
+ * The browser draws the arrow inside the padding, so without this it sits against
+ * the border and the value it belongs to reads as if it had been cut off.
+ */
+export const selectClass = `${controlClass} appearance-none bg-no-repeat pr-8`
+
+/**
+ * Every select: the control, the room for an arrow, and the arrow.
+ *
+ * `appearance-none` removes the native one, which is what put it against the border
+ * and made a select a different height from an input. `select-chevron` is in
+ * `index.css` -- see the comment there for why it is not a Tailwind arbitrary
+ * value.
+ */
+export const selectFullClass = `${selectClass} select-chevron`
diff --git a/frontend/src/components/Footer.tsx b/frontend/src/components/Footer.tsx
new file mode 100644
index 0000000..a094f14
--- /dev/null
+++ b/frontend/src/components/Footer.tsx
@@ -0,0 +1,63 @@
+import { REPOSITORY, docsRoot } from '../services/docs'
+import { runtimeConfig } from '../services/runtimeConfig'
+
+/**
+ * The copyright, the version of the binary serving this page, and where to read
+ * more.
+ *
+ * The version comes from the injected configuration rather than from
+ * `package.json`: what matters is which Doppel answered, and a number baked into
+ * the bundle would keep claiming the version the assets were built at.
+ *
+ * The year is the build's, and arrives the same way. A `new Date()` here would
+ * report the reader's clock, which is neither when this was published nor the same
+ * answer for two people looking at one binary.
+ *
+ * The documentation link carries the running version, like every other one out of
+ * this page: the site is published per version, and an unversioned link would show
+ * whoever followed it the rules of whatever has been released since.
+ *
+ * The copyright is text and stays text. It is a statement rather than a
+ * destination, and a line that looks clickable and does nothing is worse than a
+ * line that plainly does not. The two links beside it are the things there is
+ * somewhere to go to, and they open in a new tab: both leave the dashboard, and
+ * neither is worth losing a half-filled form for.
+ */
+export function Footer() {
+  const { version, copyrightYear, titleIsDefault } = runtimeConfig()
+  // A deployment that named itself is somebody else's tool, built with this one.
+  // The line says so, the link says whose documentation it goes to, and the
+  // repository link goes: on `billing-api (staging)`, "Repository" reads as a link
+  // to the billing API's own, which it is not.
+  const links = titleIsDefault
+    ? [
+        { href: REPOSITORY, label: 'Repository' },
+        { href: docsRoot(), label: 'Documentation' },
+      ]
+    : [{ href: docsRoot(), label: 'Doppel Documentation' }]
+  return (
+    <footer className="mt-8 flex flex-wrap items-center justify-between gap-x-4 gap-y-1 border-t border-slate-200 py-4 text-xs text-slate-500 dark:border-slate-800 dark:text-slate-400">
+      <p>
+        {titleIsDefault ? null : `Built with Doppel ${version} `}
+        (c) {copyrightYear} Lorem Dev
+        {titleIsDefault ? ` \u00b7 Doppel ${version}` : null}
+      </p>
+      <nav className="flex items-center gap-3">
+        {links.map(({ href, label }) => (
+          <a
+            key={href}
+            href={href}
+            target="_blank"
+            rel="noreferrer"
+            className="hover:text-slate-900 hover:underline dark:hover:text-slate-100"
+          >
+            {label}
+            <span aria-hidden="true" className="ml-0.5">
+              &#8599;
+            </span>
+          </a>
+        ))}
+      </nav>
+    </footer>
+  )
+}
diff --git a/frontend/src/components/Header.tsx b/frontend/src/components/Header.tsx
new file mode 100644
index 0000000..b39b011
--- /dev/null
+++ b/frontend/src/components/Header.tsx
@@ -0,0 +1,96 @@
+import { NavLink } from 'react-router'
+
+import { Button } from './Button'
+import { ThemeToggle } from './ThemeToggle'
+import { Title } from './Title'
+import { Wordmark } from './Wordmark'
+import { runtimeConfig } from '../services/runtimeConfig'
+import { useAccess } from '../store/access'
+import { useAuth } from '../store/auth'
+
+const TABS = [
+  { to: '/', label: 'Proxies' },
+  { to: '/status', label: 'Status' },
+]
+
+/**
+ * Swagger UI, which the server serves rather than the page.
+ *
+ * A plain anchor, not a `NavLink`: it lives under `/api/`, which react-router must
+ * not try to resolve as one of its own routes. In a new tab, because it is a
+ * different application and going there should not throw away a half-filled form.
+ */
+const SWAGGER = '/swagger-ui/'
+
+/**
+ * The title, the tabs, and the two controls that are always available.
+ *
+ * The sign-in control is absent entirely on a public deployment: there are no
+ * tokens to present, so offering the dialog would be offering something that
+ * does not exist.
+ */
+export function Header() {
+  const { title, titleIsDefault, public: isPublic } = runtimeConfig()
+  const token = useAuth((state) => state.token)
+  const openDialog = useAuth((state) => state.openDialog)
+  const signOut = useAuth((state) => state.signOut)
+  const caller = useAccess((state) => state.report?.caller)
+
+  return (
+    <header className="flex flex-wrap items-center gap-4 border-b border-slate-200 pb-3 dark:border-slate-800">
+      {/*
+        The heading is a link home, which is what a title in this position is
+        everywhere else. It costs nothing -- the list is one navigation, not a reload
+        -- and it is the affordance people try first when a form has taken them
+        somewhere they did not mean to be.
+      */}
+      <h1 className="text-lg font-semibold text-slate-900 dark:text-slate-100">
+        <NavLink to="/" end className="rounded-sm hover:opacity-80">
+          {titleIsDefault ? <Wordmark /> : <Title title={title} />}
+        </NavLink>
+      </h1>
+
+      <nav className="flex gap-3 text-sm">
+        {TABS.map(({ to, label }) => (
+          <NavLink
+            key={to}
+            to={to}
+            end
+            className={({ isActive }) =>
+              isActive
+                ? 'font-medium text-teal-700 dark:text-teal-300'
+                : 'text-slate-600 hover:text-slate-900 dark:text-slate-300 dark:hover:text-white'
+            }
+          >
+            {label}
+          </NavLink>
+        ))}
+        <a
+          href={SWAGGER}
+          target="_blank"
+          rel="noreferrer"
+          className="text-slate-600 hover:text-slate-900 dark:text-slate-300 dark:hover:text-white"
+        >
+          API
+          <span aria-hidden="true" className="ml-0.5 text-xs">
+            &#8599;
+          </span>
+        </a>
+      </nav>
+
+      <div className="ml-auto flex items-center gap-3">
+        {caller?.kind === 'token' ? (
+          <span className="text-xs text-slate-500 dark:text-slate-400">
+            {caller.name} ({caller.group})
+          </span>
+        ) : null}
+        <ThemeToggle />
+        {isPublic ? null : token ? (
+          <Button onClick={signOut}>Sign out</Button>
+        ) : (
+          <Button onClick={openDialog}>Sign in</Button>
+        )}
+      </div>
+    </header>
+  )
+}
diff --git a/frontend/src/components/Info.tsx b/frontend/src/components/Info.tsx
new file mode 100644
index 0000000..6f4e561
--- /dev/null
+++ b/frontend/src/components/Info.tsx
@@ -0,0 +1,41 @@
+import { parameterUrl } from '../services/docs'
+
+/**
+ * An (i) beside a field, linking to what the documentation says about it.
+ *
+ * The field's own hint is one line and says what to type; this is where the rest of
+ * it lives -- the bounds, the default, an example in place, and why the setting
+ * exists. Putting all of that under every control would make the form unreadable,
+ * and leaving it out entirely is how an operator ends up guessing.
+ *
+ * A link, not a tooltip: it goes to a page that can be read, searched and linked to
+ * in a message to a colleague. It opens in a new tab, because leaving the form would
+ * throw away whatever is half-typed in it.
+ *
+ * The href carries the running version and a path-derived anchor. Both are checked
+ * by `scripts/check_docs_links.py`, since a wrong fragment is silent in a browser.
+ *
+ * Small, and centred on the label's line: it is a footnote marker, not a control, and
+ * anything bigger reads as something to press instead of something to consult. The
+ * rows that hold it use `items-center` with no margin on the label, which is what
+ * makes "centred" mean centred on the words rather than on the space under them.
+ *
+ * Its name deliberately does not repeat the field's. The link sits beside the label,
+ * so the field is already said; naming it "what Timeout (seconds) does" instead put
+ * that sentence into every locator that looks for a field by its label, in tests and
+ * in a screen reader's own field list. The `title` still names the field, for a mouse.
+ */
+export function Info({ path, label }: { path: string; label: string }) {
+  return (
+    <a
+      href={parameterUrl(path)}
+      target="_blank"
+      rel="noreferrer"
+      aria-label="What this field does"
+      title={`${label}: what it does, in the documentation`}
+      className="inline-flex h-3.5 w-3.5 shrink-0 items-center justify-center rounded-full border border-slate-300 align-middle text-[0.5625rem] leading-none text-slate-500 hover:border-teal-500 hover:text-teal-700 dark:border-slate-600 dark:text-slate-400 dark:hover:border-teal-400 dark:hover:text-teal-300"
+    >
+      i
+    </a>
+  )
+}
diff --git a/frontend/src/components/KeyValueRows.tsx b/frontend/src/components/KeyValueRows.tsx
new file mode 100644
index 0000000..2ca57f8
--- /dev/null
+++ b/frontend/src/components/KeyValueRows.tsx
@@ -0,0 +1,205 @@
+import { Suspense, lazy, useId, useState } from 'react'
+
+import { Button } from './Button'
+import { controlClass } from './Field'
+import { Info } from './Info'
+import type { Syntax } from './grammars'
+import type { Rule } from '../schema/rules'
+import { complain } from '../schema/rules'
+
+const CodeEditor = lazy(() => import('./CodeEditor'))
+
+/**
+ * A string-to-string map as rows.
+ *
+ * Used for injected headers and for every selector map a mock declares. Keyed by
+ * index rather than by the key itself: keying by the key would remount the input
+ * on every keystroke that changes it, and the field would lose focus after one
+ * character.
+ *
+ * The rows are local state, and that is the whole design rather than a
+ * convenience. A row being typed is not yet a map entry -- it has no key -- so
+ * deriving the rows from the map on every render made "Add" do nothing at all: the
+ * new row had an empty key, the map could not hold it, and the next render had
+ * nothing to show. The map is what leaves this component; the rows are what lives
+ * in it.
+ */
+export function KeyValueRows({
+  label,
+  keyLabel,
+  valueLabel,
+  value,
+  onChange,
+  disabled,
+  valueRule,
+  info,
+  valueSyntax,
+}: {
+  label: string
+  keyLabel: string
+  valueLabel: string
+  /** The map as it stands. Incomplete rows are this component's business. */
+  value: Record<string, string> | undefined
+  onChange: (next: Record<string, string> | undefined) => void
+  disabled?: boolean
+  /**
+   * What the schema says a value here has to look like.
+   *
+   * A selector map has a pattern worth checking as it is typed; a header map has
+   * no pattern at all, so nothing is shown for one. Absent until the schema
+   * arrives, and absent for good if it never does.
+   */
+  valueRule?: Rule
+  /** The map's path in a proxy document, which makes the legend carry an (i). */
+  info?: string
+  /**
+   * What the values are written in, when they are not plain strings.
+   *
+   * A mock's response headers are Jinja templates -- `rid-{{ requestId }}` -- so the
+   * value gets a one-line editor with the braces coloured instead of an input. Every
+   * other map here holds a header name or a selector, which are neither templates nor
+   * anything else worth colouring.
+   */
+  valueSyntax?: Syntax
+}) {
+  const [rows, setRows] = useState<Array<[string, string]>>(() => toRows(value))
+  // One id per component, so two maps on a page do not name each other's editors.
+  const group = useId()
+
+  // Reseeded when the map arrives holding something the rows do not describe -- a
+  // proxy being loaded, or a form being reset. Compared against what the rows
+  // produce rather than against the previous prop, because this component's own
+  // edit arrives back as a prop on the very next render and must not disturb a row
+  // being typed.
+  //
+  // Adjusted during render rather than in an effect: React re-renders immediately
+  // without committing the stale pass, so there is no flash of the old rows, and an
+  // effect that set state here would run a render behind and fight the input.
+  if (!sameMap(fromRows(rows), value)) {
+    setRows(toRows(value))
+  }
+
+  const publish = (next: Array<[string, string]>) => {
+    setRows(next)
+    onChange(fromRows(next))
+  }
+
+  const set = (index: number, pair: [string, string]) => {
+    const next = [...rows]
+    next[index] = pair
+    publish(next)
+  }
+
+  return (
+    <fieldset>
+      <legend className="mb-1.5 flex items-center gap-1 text-sm font-medium text-slate-700 dark:text-slate-200">
+        {label}
+        {info ? <Info path={info} label={label} /> : null}
+      </legend>
+      <div className="flex flex-col gap-2">
+        {rows.map(([key, value], index) => {
+          const complaint = complain(valueRule, value)
+          return (
+            <div key={index} className="flex flex-col gap-1">
+              <div className="flex items-center gap-2">
+                <div className="min-w-0 flex-1">
+                  <input
+                    className={controlClass}
+                    aria-label={`${label} ${keyLabel} ${index + 1}`}
+                    placeholder={keyLabel}
+                    value={key}
+                    disabled={disabled}
+                    onChange={(event) => set(index, [event.target.value, value])}
+                  />
+                </div>
+                {valueSyntax ? (
+                  <div className="min-w-0 flex-1">
+                    <Suspense fallback={<div className={controlClass} />}>
+                      <CodeEditor
+                        label={`${label} ${valueLabel} ${index + 1}`}
+                        id={`${group}-${index}`}
+                        syntax={valueSyntax}
+                        placeholder={valueLabel}
+                        rows={1}
+                        value={value}
+                        disabled={disabled}
+                        onChange={(next) => set(index, [key, next])}
+                      />
+                    </Suspense>
+                  </div>
+                ) : (
+                  <div className="min-w-0 flex-1">
+                    <input
+                      className={controlClass}
+                      aria-label={`${label} ${valueLabel} ${index + 1}`}
+                      placeholder={valueLabel}
+                      value={value}
+                      disabled={disabled}
+                      aria-invalid={complaint ? true : undefined}
+                      onChange={(event) => set(index, [key, event.target.value])}
+                    />
+                  </div>
+                )}
+                <Button
+                  variant="danger"
+                  disabled={disabled}
+                  onClick={() => publish(rows.filter((_, at) => at !== index))}
+                >
+                  Remove
+                </Button>
+              </div>
+              {complaint ? (
+                <span role="alert" className="text-xs text-red-700 dark:text-red-300">
+                  {valueLabel}: {complaint}
+                </span>
+              ) : null}
+            </div>
+          )
+        })}
+      </div>
+      <div className={rows.length ? 'mt-2' : ''}>
+        <Button
+          disabled={disabled}
+          onClick={() => publish([...rows, ['', '']])}
+          aria-label={`Add ${label}`}
+        >
+          Add
+        </Button>
+      </div>
+    </fieldset>
+  )
+}
+
+/** Whether two of these maps hold the same pairs. */
+function sameMap(
+  left: Record<string, string> | undefined,
+  right: Record<string, string> | undefined,
+): boolean {
+  const a = left ?? {}
+  const b = right ?? {}
+  const keys = Object.keys(a)
+  return (
+    keys.length === Object.keys(b).length && keys.every((key) => a[key] === b[key])
+  )
+}
+
+/** A map as rows, for editing. */
+function toRows(map: Record<string, string> | undefined): Array<[string, string]> {
+  return Object.entries(map ?? {})
+}
+
+/**
+ * Rows back to a map, dropping incomplete ones.
+ *
+ * An empty key cannot be sent: the server would refuse the document, and the row
+ * is what an operator leaves behind after clicking Add and changing their mind.
+ */
+function fromRows(rows: Array<[string, string]>): Record<string, string> | undefined {
+  const map: Record<string, string> = {}
+  for (const [key, value] of rows) {
+    if (key.trim()) {
+      map[key.trim()] = value
+    }
+  }
+  return Object.keys(map).length ? map : undefined
+}
diff --git a/frontend/src/components/MockEditor.tsx b/frontend/src/components/MockEditor.tsx
new file mode 100644
index 0000000..2af8a4c
--- /dev/null
+++ b/frontend/src/components/MockEditor.tsx
@@ -0,0 +1,320 @@
+import { Suspense, lazy, useState } from 'react'
+
+import { Button } from './Button'
+import { Field, controlClass, selectFullClass } from './Field'
+import { KeyValueRows } from './KeyValueRows'
+import { Section } from './Section'
+import { Spinner } from './Spinner'
+import type { Syntax } from './CodeEditor'
+import type { HttpMethod, MockConfig } from '../types/proxy'
+import type { Rule } from '../schema/rules'
+import { complain, numericAttrs } from '../schema/rules'
+
+const CodeEditor = lazy(() => import('./CodeEditor'))
+
+const METHODS: HttpMethod[] = ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']
+
+/**
+ * Which of the three exclusive response sources a mock is using.
+ *
+ * `template` is not something this page can choose. A template file is uploaded
+ * through the admin API, and managing files was a poor fit for a form over a
+ * document -- so the dashboard reads that source, shows which file a mock answers
+ * with, and lets an operator move the mock off it. What it never does is name a file
+ * that would have to exist.
+ */
+type Source = 'body' | 'json' | 'template'
+
+function sourceOf(mock: MockConfig): Source {
+  if (mock.response.json !== undefined) {
+    return 'json'
+  }
+  if (mock.response.template !== undefined) {
+    return 'template'
+  }
+  return 'body'
+}
+
+const SYNTAX: Record<Source, Syntax> = { body: 'text', json: 'json', template: 'text' }
+
+/** What the "Answer with" select offers, and what each is called. */
+const SOURCES: Array<{ value: Source; label: string }> = [
+  { value: 'body', label: 'Text body' },
+  { value: 'json', label: 'JSON body' },
+]
+
+/**
+ * One mock: what it matches, what it takes out of the request, what it answers.
+ *
+ * The response source is a radio because the three fields are mutually exclusive
+ * in the configuration -- the server refuses a document with two of them set, so
+ * the form cannot offer a state that would be refused. Switching clears the other
+ * two rather than keeping them hidden: a hidden `json` that reappears on the next
+ * save is a change nobody made.
+ */
+export function MockEditor({
+  mock,
+  index,
+  onChange,
+  onRemove,
+  disabled,
+  errorFor,
+  rule,
+  valueRule,
+}: {
+  mock: MockConfig
+  /** This mock's position, which is how the server names it in a complaint. */
+  index: number
+  onChange: (next: MockConfig) => void
+  onRemove: () => void
+  disabled?: boolean
+  errorFor: (field: string) => string | undefined
+  /**
+   * The schema's bounds on a field of a mock, by path within a proxy document.
+   *
+   * Passed in rather than read from the store here: every mock in a form would
+   * otherwise subscribe to the schema separately, and the form already has it.
+   */
+  rule: (path: string) => Rule | undefined
+  valueRule: (path: string) => Rule | undefined
+}) {
+  const source = sourceOf(mock)
+  // Asked for by path, so the proxy's own `name` does not answer for every mock's.
+  const complaint = (field: string) => errorFor(`mocks[${index}].${field}`)
+  // The schema describes one mock, so the path has no index in it: every mock in
+  // the list is the same shape.
+  const bounds = (field: string) => rule(`mocks[].${field}`)
+  // The pattern editor is named by the field around it, so both need the same id --
+  // and every mock on the page needs its own.
+  const patternId = `mock-${index}-pattern`
+  // The template this mock arrived with, if any: what the document said when it was
+  // read, which is what makes switching away from a template undoable while the page
+  // is open. State with an initializer rather than a ref, because it is read while
+  // rendering -- a ref read during a render is the thing `react-hooks/refs` is for.
+  const [configured] = useState(mock.response.template)
+  const checked = (field: string, value: unknown) => complain(bounds(field), value)
+
+  const setResponse = (patch: Partial<MockConfig['response']>) => {
+    onChange({ ...mock, response: { ...mock.response, ...patch } })
+  }
+
+  const setSource = (next: Source) => {
+    const { status, headers } = mock.response
+    onChange({
+      ...mock,
+      response: {
+        status,
+        headers,
+        ...(next === 'body' ? { body: '' } : {}),
+        ...(next === 'json' ? { json: '' } : {}),
+        // Back to the file it came with, since the page has no way to name another.
+        ...(next === 'template' ? { template: configured ?? '' } : {}),
+      },
+    })
+  }
+
+  return (
+    <div className="flex flex-col gap-3 rounded-md border border-slate-200 p-3 dark:border-slate-800">
+      <div className="flex items-end gap-2">
+        <div className="grow">
+          <Field
+            label="Mock name"
+            info="mocks[].name"
+            error={checked('name', mock.name) ?? complaint('name')}
+          >
+            <input
+              className={controlClass}
+              value={mock.name}
+              disabled={disabled}
+              onChange={(event) => onChange({ ...mock, name: event.target.value })}
+            />
+          </Field>
+        </div>
+        <Button variant="danger" disabled={disabled} onClick={onRemove}>
+          Remove mock
+        </Button>
+      </div>
+
+      <div className="flex gap-3">
+        <Field label="Method" info="mocks[].request.method">
+          <select
+            className={selectFullClass}
+            aria-label={`${mock.name} method`}
+            value={mock.request.method}
+            disabled={disabled}
+            onChange={(event) =>
+              onChange({
+                ...mock,
+                request: { ...mock.request, method: event.target.value as HttpMethod },
+              })
+            }
+          >
+            {METHODS.map((method) => (
+              <option key={method} value={method}>
+                {method}
+              </option>
+            ))}
+          </select>
+        </Field>
+        <div className="grow">
+          {/*
+            A code editor rather than an input, for one line of regex. The pattern is
+            the field an operator gets wrong most often, and colouring the groups,
+            classes and quantifiers is what makes a stray bracket visible before the
+            server compiles it. `Field` names it by id, because the editor renders its
+            own textarea and a label cannot wrap one.
+          */}
+          <Field
+            label="Path pattern"
+            info="mocks[].request.url"
+            hint="A regex, matched unanchored. Named groups become template variables."
+            error={checked('request.url', mock.request.url) ?? complaint('url')}
+            htmlFor={patternId}
+          >
+            <Suspense fallback={<Spinner label="Loading the editor..." />}>
+              <CodeEditor
+                id={patternId}
+                syntax="regex"
+                rows={1}
+                disabled={disabled}
+                value={mock.request.url}
+                onChange={(next) =>
+                  onChange({ ...mock, request: { ...mock.request, url: next } })
+                }
+              />
+            </Suspense>
+          </Field>
+        </div>
+      </div>
+
+      <Section title="Variables from the request" summary={variableSummary(mock)}>
+      <KeyValueRows
+        label="Variables from headers"
+        keyLabel="variable"
+        valueLabel="header name"
+        info="mocks[].request.headers"
+        disabled={disabled}
+        valueRule={valueRule('mocks[].request.headers')}
+        value={mock.request.headers}
+        onChange={(next) => onChange({ ...mock, request: { ...mock.request, headers: next } })}
+      />
+      <KeyValueRows
+        label="Variables from the query"
+        keyLabel="variable"
+        valueLabel="selector"
+        info="mocks[].request.query"
+        disabled={disabled}
+        valueRule={valueRule('mocks[].request.query')}
+        value={mock.request.query}
+        onChange={(next) => onChange({ ...mock, request: { ...mock.request, query: next } })}
+      />
+      <KeyValueRows
+        label="Variables from the body"
+        keyLabel="variable"
+        valueLabel="selector"
+        info="mocks[].request.body"
+        disabled={disabled}
+        valueRule={valueRule('mocks[].request.body')}
+        value={mock.request.body}
+        onChange={(next) => onChange({ ...mock, request: { ...mock.request, body: next } })}
+      />
+      </Section>
+
+      <div className="flex gap-3">
+        <Field
+          label="Status"
+          info="mocks[].response.status"
+          error={checked('response.status', mock.response.status) ?? complaint('status')}
+        >
+          <input
+            className={controlClass}
+            type="number"
+            {...numericAttrs(bounds('response.status'))}
+            value={mock.response.status}
+            disabled={disabled}
+            onChange={(event) => setResponse({ status: Number(event.target.value) })}
+          />
+        </Field>
+        <Field label="Answer with">
+          <select
+            className={selectFullClass}
+            aria-label={`${mock.name} response source`}
+            value={source}
+            disabled={disabled}
+            onChange={(event) => setSource(event.target.value as Source)}
+          >
+            {SOURCES.map(({ value, label }) => (
+              <option key={value} value={value}>
+                {label}
+              </option>
+            ))}
+            {/*
+              Offered only to a mock that arrived with one, and it stays offered while
+              the page is open so switching away is undoable. A mock that never had a
+              template cannot be given one here.
+            */}
+            {configured === undefined ? null : (
+              <option value="template">Template file (from the configuration)</option>
+            )}
+          </select>
+        </Field>
+      </div>
+
+      {source === 'template' ? (
+        <Field
+          label="Template file"
+          info="mocks[].response.template"
+          hint="Set in the configuration. Template files are uploaded through the admin API, not from here -- change the answer above to edit it as a body."
+          error={complaint('template')}
+        >
+          <input
+            className={controlClass}
+            value={mock.response.template ?? ''}
+            disabled
+            readOnly
+          />
+        </Field>
+      ) : (
+        <Suspense fallback={<Spinner label="Loading the editor..." />}>
+          <CodeEditor
+            label={`${mock.name} ${source}`}
+            syntax={SYNTAX[source]}
+            disabled={disabled}
+            value={(source === 'json' ? mock.response.json : mock.response.body) ?? ''}
+            onChange={(next) => setResponse(source === 'json' ? { json: next } : { body: next })}
+          />
+        </Suspense>
+      )}
+
+      <KeyValueRows
+        label="Response headers"
+        keyLabel="header name"
+        valueLabel="template"
+        info="mocks[].response.headers"
+        valueSyntax="text"
+        disabled={disabled}
+        valueRule={valueRule('mocks[].response.headers')}
+        value={mock.response.headers}
+        onChange={(next) => setResponse({ headers: next })}
+      />
+    </div>
+  )
+}
+
+/** How many variables a mock extracts, for the folded summary. */
+function variableSummary(mock: MockConfig): string {
+  const count =
+    Object.keys(mock.request.headers ?? {}).length +
+    Object.keys(mock.request.query ?? {}).length +
+    Object.keys(mock.request.body ?? {}).length
+  return count === 0 ? 'none' : `${count}`
+}
+
+/** A new mock, with the fields the server requires already filled in. */
+export function emptyMock(index: number): MockConfig {
+  return {
+    name: `mock-${index + 1}`,
+    request: { method: 'GET', url: '^/$' },
+    response: { status: 200, body: '' },
+  }
+}
diff --git a/frontend/src/components/Retry.tsx b/frontend/src/components/Retry.tsx
new file mode 100644
index 0000000..58a4599
--- /dev/null
+++ b/frontend/src/components/Retry.tsx
@@ -0,0 +1,33 @@
+import { Button } from './Button'
+import type { ApiError } from '../types/error'
+import { runtimeConfig } from '../services/runtimeConfig'
+import { useAuth } from '../store/auth'
+
+/**
+ * What to offer beside a refusal: a way to fix it, and a way to ask again.
+ *
+ * "Read of `alpha` requires access `read`" is a message about the token, not about
+ * the page, and every one of these screens reads once when it opens. So a refusal
+ * used to sit there after the operator signed in, with nothing on it to press --
+ * the fix was to reload the browser, which is a thing people do and should not have
+ * to.
+ *
+ * Refresh rather than an automatic refetch when the token changes. The list can
+ * refetch itself safely because it holds nothing; a form holds a half-typed
+ * document, and replacing that from under someone because they signed in would
+ * lose work to a keystroke they made elsewhere. So the page asks, and the operator
+ * decides when.
+ */
+export function Retry({ error, onRetry }: { error: ApiError; onRetry: () => void }) {
+  const openDialog = useAuth((state) => state.openDialog)
+  // On a public deployment there are no tokens, so offering the dialog would offer
+  // something that does not exist.
+  const askable = error.isAuth && !runtimeConfig().public
+
+  return (
+    <div className="flex shrink-0 items-center gap-2">
+      {askable ? <Button onClick={openDialog}>Enter token</Button> : null}
+      <Button onClick={onRetry}>Refresh</Button>
+    </div>
+  )
+}
diff --git a/frontend/src/components/Section.tsx b/frontend/src/components/Section.tsx
new file mode 100644
index 0000000..1128cea
--- /dev/null
+++ b/frontend/src/components/Section.tsx
@@ -0,0 +1,52 @@
+import type { ReactNode } from 'react'
+
+/**
+ * A part of the form that starts folded.
+ *
+ * A proxy has thirteen fields and any number of mocks, and most edits touch one of
+ * them. Laid out flat, the form was a page and a half of controls to scroll past to
+ * reach the one being changed -- so every group folds, and starts folded.
+ *
+ * Native `<details>`: it is keyboard-operable, it is what a screen reader already
+ * understands, and it needs no state, no effect and no library. `summary` carries a
+ * count or a short description of what is inside, so a folded section still says
+ * whether there is anything in it -- a row of identical closed headings would make
+ * the operator open all four to find out.
+ */
+export function Section({
+  title,
+  summary,
+  children,
+  open,
+}: {
+  title: string
+  /** What is inside, in a few words. Shown while folded and while open. */
+  summary?: string
+  children: ReactNode
+  /** Folded unless this says otherwise. */
+  open?: boolean
+}) {
+  return (
+    <details
+      open={open}
+      className="group rounded-md border border-slate-200 bg-white/40 dark:border-slate-800 dark:bg-slate-900/40"
+    >
+      <summary className="flex cursor-pointer items-center gap-2 rounded-md px-3 py-2 text-sm font-semibold text-slate-900 marker:content-none hover:bg-slate-50 dark:text-slate-100 dark:hover:bg-slate-800/60">
+        {/* Rotated rather than swapped: one glyph, and the turn is the animation. */}
+        <span
+          aria-hidden="true"
+          className="text-slate-400 transition-transform group-open:rotate-90"
+        >
+          &#9656;
+        </span>
+        <span>{title}</span>
+        {summary ? (
+          <span className="font-normal text-slate-500 dark:text-slate-400">{summary}</span>
+        ) : null}
+      </summary>
+      <div className="flex flex-col gap-3 border-t border-slate-200 px-3 py-3 dark:border-slate-800">
+        {children}
+      </div>
+    </details>
+  )
+}
diff --git a/frontend/src/components/Spinner.tsx b/frontend/src/components/Spinner.tsx
new file mode 100644
index 0000000..df6aa0b
--- /dev/null
+++ b/frontend/src/components/Spinner.tsx
@@ -0,0 +1,8 @@
+/** Shown while the first load is in flight, never for a refetch. */
+export function Spinner({ label }: { label: string }) {
+  return (
+    <p className="text-sm text-slate-500 dark:text-slate-400" role="status">
+      {label}
+    </p>
+  )
+}
diff --git a/frontend/src/components/ThemeToggle.tsx b/frontend/src/components/ThemeToggle.tsx
new file mode 100644
index 0000000..5521a1e
--- /dev/null
+++ b/frontend/src/components/ThemeToggle.tsx
@@ -0,0 +1,38 @@
+import { selectFullClass } from './Field'
+import { useTheme } from '../store/theme'
+import type { ThemeChoice } from '../store/theme'
+
+const CHOICES: Array<{ value: ThemeChoice; label: string }> = [
+  { value: 'light', label: 'Light' },
+  { value: 'dark', label: 'Dark' },
+  { value: 'system', label: 'System' },
+]
+
+/**
+ * Three states, not two.
+ *
+ * A two-state switch cannot express "whatever the desktop says", which is the
+ * default and the one most operators never change.
+ */
+export function ThemeToggle() {
+  const choice = useTheme((state) => state.choice)
+  const set = useTheme((state) => state.set)
+
+  return (
+    <label className="flex items-center gap-2 text-sm">
+      <span className="sr-only">Theme</span>
+      <select
+        aria-label="Theme"
+        value={choice}
+        onChange={(event) => set(event.target.value as ThemeChoice)}
+        className={`${selectFullClass} w-auto`}
+      >
+        {CHOICES.map(({ value, label }) => (
+          <option key={value} value={value}>
+            {label}
+          </option>
+        ))}
+      </select>
+    </label>
+  )
+}
diff --git a/frontend/src/components/Title.tsx b/frontend/src/components/Title.tsx
new file mode 100644
index 0000000..50a7bb8
--- /dev/null
+++ b/frontend/src/components/Title.tsx
@@ -0,0 +1,94 @@
+/**
+ * The heading, in the wordmark's own shape.
+ *
+ * `Doppelganger` is set in an italic serif with the second half in a lighter tone,
+ * and a deployment that named itself gets the same treatment rather than plain
+ * text: the title is the thing an operator reads to know which of four tabs they
+ * are looking at, and it should look like it belongs to the same page.
+ *
+ * The tones follow the wordmark: the first word in the strong one, everything after
+ * it in the lighter one. Not a decision about which word matters more -- it is what
+ * `Doppel` + `ganger` already does, and a title of one word simply gets one tone.
+ */
+
+/** The strong tone and the light one, as `Wordmark` uses them. */
+const STRONG = 'text-slate-900 dark:text-white'
+const LIGHT = 'text-sky-700 dark:text-sky-200'
+
+/** The face, weight and size shared with the wordmark. */
+export const TITLE_CLASS = 'font-serif text-lg font-medium italic select-none'
+
+/**
+ * A title split into the pieces that get a tone each, with every character kept.
+ *
+ * Three ways a title says "word boundary", all of them seen in a deployment name:
+ * a space (`Billing API`), an underscore (`billing_api`), and a case change
+ * (`billingApi`). Hyphens too, because `billing-api` is the same name written the
+ * way a hostname is.
+ *
+ * Separators are kept as they were written and travel with the word that follows
+ * them, so `billing_api` reads as `billing_api` with `_api` in the light tone
+ * rather than turning into `billing api`. The title is what the operator typed;
+ * this only colours it.
+ *
+ * Exported for its own tests: the interesting cases are all in here, and asserting
+ * them through a rendered component would be asserting them through two things.
+ */
+export function titleSegments(title: string): string[] {
+  const segments: string[] = []
+  let current = ''
+
+  for (const [index, character] of [...title].entries()) {
+    const isSeparator = /[\s_-]/.test(character);
+    const previous = [...title][index - 1];
+    // A case change is a boundary only between two letters: `API2` is one word,
+    // and so is the `A` after a space.
+    const camel =
+      previous !== undefined &&
+      /[a-z0-9]/.test(previous) &&
+      /[A-Z]/.test(character) &&
+      current !== '';
+
+    if (isSeparator) {
+      // The separator starts the next segment rather than ending this one.
+      if (current !== '' && !/^[\s_-]+$/.test(current)) {
+        segments.push(current)
+        current = ''
+      }
+    } else if (camel) {
+      segments.push(current)
+      current = ''
+    }
+    current += character
+  }
+  if (current !== '') {
+    segments.push(current)
+  }
+  return segments
+}
+
+/**
+ * The title, or the wordmark when there is no title.
+ *
+ * `titleIsDefault` decides, and it comes from the server rather than from
+ * comparing the string to `Doppel`: a deployment that deliberately named itself
+ * `Doppel` is a deployment with a title, and it gets its own name drawn the same
+ * way as any other.
+ */
+export function Title({ title }: { title: string }) {
+  const segments = titleSegments(title)
+  return (
+    <span className={TITLE_CLASS}>
+      {segments.map((segment, index) => (
+        <span
+          // The index is the identity here: two identical words in one title are
+          // two segments, and neither is more itself than the other.
+          key={`${index}-${segment}`}
+          className={index === 0 ? STRONG : LIGHT}
+        >
+          {segment}
+        </span>
+      ))}
+    </span>
+  )
+}
diff --git a/frontend/src/components/Toasts.tsx b/frontend/src/components/Toasts.tsx
new file mode 100644
index 0000000..28d6ec0
--- /dev/null
+++ b/frontend/src/components/Toasts.tsx
@@ -0,0 +1,30 @@
+import { useToasts } from '../store/toast'
+
+/** What the last write did, in the corner, dismissible. */
+export function Toasts() {
+  const items = useToasts((state) => state.items)
+  const dismiss = useToasts((state) => state.dismiss)
+
+  if (items.length === 0) {
+    return null
+  }
+
+  return (
+    <div className="fixed bottom-4 right-4 z-20 flex w-80 flex-col gap-2">
+      {items.map((toast) => (
+        <button
+          key={toast.id}
+          type="button"
+          onClick={() => dismiss(toast.id)}
+          className={`rounded border px-3 py-2 text-left text-sm shadow ${
+            toast.kind === 'failed'
+              ? 'border-red-300 bg-red-50 text-red-900 dark:border-red-800 dark:bg-red-950 dark:text-red-100'
+              : 'border-teal-300 bg-teal-50 text-teal-900 dark:border-teal-800 dark:bg-teal-950 dark:text-teal-100'
+          }`}
+        >
+          {toast.text}
+        </button>
+      ))}
+    </div>
+  )
+}
diff --git a/frontend/src/components/TokenDialog.tsx b/frontend/src/components/TokenDialog.tsx
new file mode 100644
index 0000000..6e37437
--- /dev/null
+++ b/frontend/src/components/TokenDialog.tsx
@@ -0,0 +1,77 @@
+import { useState } from 'react'
+
+import { Button } from './Button'
+import { controlClass } from './Field'
+import { useAuth } from '../store/auth'
+
+/**
+ * Ask for a token, and take no for an answer.
+ *
+ * "Continue without a token" is not politeness: `access.list` and `access.read`
+ * can be `public`, and a proxy's own block can open one proxy to a group, so a
+ * caller with no token may have plenty to look at. A dialog that could not be
+ * dismissed would hide a working page behind a demand for a secret the operator
+ * may not have and may not need.
+ */
+export function TokenDialog() {
+  const open = useAuth((state) => state.dialogOpen)
+  const signIn = useAuth((state) => state.signIn)
+  const decline = useAuth((state) => state.decline)
+  const close = useAuth((state) => state.closeDialog)
+  const hasToken = useAuth((state) => state.token !== undefined)
+  const [value, setValue] = useState('')
+
+  if (!open) {
+    return null
+  }
+
+  return (
+    <div className="fixed inset-0 z-10 flex items-center justify-center bg-slate-900/40 p-4">
+      <form
+        className="w-full max-w-md rounded border border-slate-200 bg-white p-4 shadow-lg dark:border-slate-700 dark:bg-slate-900"
+        aria-label="Access token"
+        onSubmit={(event) => {
+          event.preventDefault()
+          if (value.trim()) {
+            signIn(value.trim())
+            setValue('')
+          }
+        }}
+      >
+        <h2 className="text-base font-semibold text-slate-900 dark:text-slate-100">
+          Access token
+        </h2>
+        <p className="mt-1 text-sm text-slate-600 dark:text-slate-300">
+          One of <code>admin.tokens</code>. Kept in this browser for an hour; the token itself
+          does not expire.
+        </p>
+        <input
+          // `mt-3`, matching the gap above the buttons below: the field sat
+          // against the sentence explaining it, which read as one block.
+          className={`mt-3 ${controlClass}`}
+          type="password"
+          autoComplete="off"
+          aria-label="Token"
+          value={value}
+          onChange={(event) => setValue(event.target.value)}
+        />
+        <div className="mt-3 flex justify-end gap-2">
+          <Button
+            onClick={() => {
+              if (hasToken) {
+                close()
+              } else {
+                decline()
+              }
+            }}
+          >
+            {hasToken ? 'Cancel' : 'Continue without a token'}
+          </Button>
+          <Button type="submit" variant="primary" disabled={!value.trim()}>
+            Use this token
+          </Button>
+        </div>
+      </form>
+    </div>
+  )
+}
diff --git a/frontend/src/components/Wordmark.tsx b/frontend/src/components/Wordmark.tsx
new file mode 100644
index 0000000..2d1b662
--- /dev/null
+++ b/frontend/src/components/Wordmark.tsx
@@ -0,0 +1,29 @@
+/**
+ * The project's name, set in two tones.
+ *
+ * Shown only when `admin.title` is absent: a deployment that named itself gets its
+ * name in plain text, because the name is the thing the operator needs to read to
+ * know which of four tabs they are looking at.
+ *
+ * Two spans rather than an image: it scales with the heading it sits in, it needs no
+ * asset and no `img-src` in the policy, and it says the same thing to a screen reader
+ * as it does to a reader.
+ *
+ * It does not take a selection, though. Being text is how it is drawn, not an
+ * invitation to drag a cursor through it -- and a mark that highlights in two pieces
+ * when someone double-clicks the tab beside it looks like a mistake. Copying is not
+ * what anyone wants from a logo; the version in the footer is the thing worth quoting.
+ *
+ * A system serif, not a webfont. The face is the browser's -- Georgia, Times, Noto
+ * Serif, whatever the platform has -- which costs nothing to fetch and nothing in
+ * the content security policy, at the price of not being one exact typeface
+ * everywhere.
+ */
+export function Wordmark() {
+  return (
+    <span className="font-serif text-lg font-medium italic select-none">
+      <span className="text-slate-900 dark:text-white">Doppel</span>
+      <span className="text-sky-700 dark:text-sky-200">ganger</span>
+    </span>
+  )
+}
diff --git a/frontend/src/components/YamlMode.tsx b/frontend/src/components/YamlMode.tsx
new file mode 100644
index 0000000..841f0e5
--- /dev/null
+++ b/frontend/src/components/YamlMode.tsx
@@ -0,0 +1,197 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { parse, stringify } from 'yaml'
+
+import { Button } from './Button'
+import { CodeEditor } from './CodeEditor'
+import { labelClass } from './Field'
+import type { JsonSchema } from '../types/schema'
+import type { ProxyConfig } from '../types/proxy'
+import type { Trouble } from '../schema/document'
+import { proxyChecker } from '../schema/document'
+import { docsUrl } from '../services/docs'
+
+/**
+ * The whole proxy document as YAML, for an operator who would rather type it.
+ *
+ * The form is better for changing one field and worse for everything else: pasting a
+ * proxy from a colleague, reordering mocks, copying a block from `main.yaml`. This is
+ * the same document in the shape the configuration file has, so those are one paste.
+ *
+ * Kept out of the entry chunk and out of the form's: `js-yaml` and `ajv` together are
+ * most of what this module weighs, and someone who never opens the YAML mode never
+ * fetches them. `bundle-size.test.ts` has a budget for this chunk alone.
+ *
+ * What it does not preserve is comments. The document is stored as data -- JSONB in
+ * the database, JSON over the API -- so a comment has nowhere to live, and saying so
+ * under the editor is better than losing one silently.
+ */
+
+/** What the text is, and what is wrong with it. */
+interface Reading {
+  /** The document, when the text is one that could be saved. */
+  document?: ProxyConfig
+  /** Why it could not be, in the words the save button's tooltip wants. */
+  reason?: string
+  troubles: Trouble[]
+}
+
+/**
+ * Read the text: parse it, check it, and say what is wrong.
+ *
+ * A pure function of the text and the validator, so the messages under the editor can
+ * be derived during render rather than kept in state -- which is also what makes them
+ * correct when the schema arrives a moment after the editor did.
+ */
+function read(text: string, check: ((value: unknown) => Trouble[]) | undefined): Reading {
+  let parsed: unknown
+  try {
+    parsed = parse(text)
+  } catch (caught) {
+    const message = caught instanceof Error ? caught.message.split('\n')[0]! : String(caught)
+    return { reason: 'this is not valid YAML', troubles: [{ where: 'document', what: message }] }
+  }
+
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return {
+      reason: 'this is not a proxy document',
+      troubles: [{ where: 'document', what: 'a proxy is a mapping of fields' }],
+    }
+  }
+
+  const troubles = check?.(parsed) ?? []
+  if (troubles.length) {
+    return { reason: 'the document does not match the schema', troubles }
+  }
+
+  return { document: parsed as ProxyConfig, troubles: [] }
+}
+
+export function YamlMode({
+  value,
+  schema,
+  disabled,
+  onChange,
+  onBroken,
+  formatToken,
+}: {
+  /** The document as the form holds it. Rendered to text when this mode opens. */
+  value: ProxyConfig
+  /** The configuration schema, for checking the document as it is typed. */
+  schema: JsonSchema | undefined
+  disabled?: boolean
+  /** Called with the parsed document whenever the text is valid. */
+  onChange: (next: ProxyConfig) => void
+  /** Called when the text stops being a document the page could save. */
+  onBroken: (reason: string | undefined) => void
+  /**
+   * Bumped by the page to ask for a reformat -- which is what pressing Save does.
+   *
+   * A prop rather than a ref: what the page wants is not to reach into this
+   * component but to say "now would be a good time", and a value that changed is
+   * exactly that.
+   */
+  formatToken: number
+}) {
+  // The text is this component's state, and the document is what leaves it. Deriving
+  // the text from the document on every render would reformat what is being typed
+  // after every keystroke -- the same reason `KeyValueRows` owns its rows.
+  const [text, setText] = useState(() => toYaml(value))
+  const check = useMemo(() => proxyChecker(schema), [schema])
+  // Derived, not stored: the same text and the same validator always give the same
+  // answer, and a copy in state would be a second answer that can lag behind.
+  const troubles = useMemo(() => read(text, check).troubles, [text, check])
+
+  /** Take an edit: keep the text, and tell the page what it now holds. */
+  const digest = useCallback(
+    (next: string) => {
+      setText(next)
+      const { document, reason } = read(next, check)
+      onBroken(reason)
+      if (document) {
+        onChange(document)
+      }
+    },
+    [onBroken, onChange, check],
+  )
+
+  /** Reformat what is there, if it can be read at all. */
+  const format = useCallback(() => {
+    const { document } = read(text, check)
+    if (document) {
+      setText(toYaml(document))
+    }
+  }, [text, check])
+
+  // The page asks for a format by changing the token. The first render is not a
+  // request -- the text was just written by `toYaml` and is already formatted.
+  const seen = useRef(formatToken)
+  useEffect(() => {
+    if (formatToken !== seen.current) {
+      seen.current = formatToken
+      format()
+    }
+  }, [format, formatToken])
+
+  return (
+    <div className="flex flex-col gap-2">
+      <div className="flex flex-wrap items-center gap-2">
+        <span className={`${labelClass} mb-0 grow`}>The whole proxy, as YAML</span>
+        <Button onClick={format} disabled={disabled}>
+          Reformat
+        </Button>
+        <a
+          href={docsUrl('usage/parameters/#proxies')}
+          target="_blank"
+          rel="noreferrer"
+          className="inline-flex h-9 items-center rounded-md border border-slate-300 px-3 text-sm text-slate-700 hover:border-teal-500 hover:text-teal-700 dark:border-slate-600 dark:text-slate-200 dark:hover:border-teal-400 dark:hover:text-teal-300"
+        >
+          Documentation
+          <span aria-hidden="true" className="ml-1 text-xs">
+            &#8599;
+          </span>
+        </a>
+      </div>
+
+      <CodeEditor
+        label="The whole proxy, as YAML"
+        syntax="yaml"
+        rows={24}
+        value={text}
+        disabled={disabled}
+        onChange={digest}
+      />
+
+      {troubles.length ? (
+        <ul role="alert" className="flex flex-col gap-0.5 text-xs text-red-700 dark:text-red-300">
+          {troubles.map((trouble, index) => (
+            <li key={index}>
+              <code>{trouble.where}</code> {trouble.what}
+            </li>
+          ))}
+        </ul>
+      ) : (
+        <p className="text-xs text-slate-500 dark:text-slate-400">
+          Checked against this Doppel&apos;s own schema as you type. Comments are not
+          kept: the document is stored as data.
+        </p>
+      )}
+    </div>
+  )
+}
+
+/**
+ * The document as YAML.
+ *
+ * Two-space indent and no anchors, which is what a configuration file looks like;
+ * key order is the document's own rather than sorted, so a round trip through this
+ * mode does not rearrange a proxy nobody edited.
+ *
+ * `yaml` rather than `js-yaml`: same job, no dependencies, and ISC rather than a
+ * dependency on argparse, whose Python-2.0 licence is outside this repository's
+ * policy. `scripts/third_party.py` is what said so.
+ */
+function toYaml(value: ProxyConfig): string {
+  return stringify(value, { indent: 2, lineWidth: 100, aliasDuplicateObjects: false })
+}
+
+export default YamlMode
diff --git a/frontend/src/components/__tests__/grammars.test.ts b/frontend/src/components/__tests__/grammars.test.ts
new file mode 100644
index 0000000..4d2519e
--- /dev/null
+++ b/frontend/src/components/__tests__/grammars.test.ts
@@ -0,0 +1,80 @@
+// What gets coloured, asserted on the markup prism produces.
+//
+// The e2e suite measures painted pixels, which is the honest test of "is it coloured at
+// all". This is the other half: which *tokens* come out, for the compositions that are
+// this project's own rather than the library's. Every one of these cases was wrong at
+// some point in an obvious-looking implementation.
+
+import { colour } from '../grammars'
+
+/** The token classes in prism's output, in order. */
+function tokens(html: string): string[] {
+  return [...html.matchAll(/class="token ([^"]+)"/g)].map((match) => match[1]!)
+}
+
+describe('a template with no host language', () => {
+  it('colours the expression and leaves the text alone', () => {
+    const html = colour('rid-{{ requestId }}', 'text')
+    expect(tokens(html)).toContain('jinja2 jinja2')
+    expect(tokens(html)).toContain('variable')
+    // The text around it is text: `rid-` is not a variable, and neither is a word that
+    // happens to be a Jinja keyword. Handing the whole string to the jinja2 grammar
+    // instead colours every identifier in it.
+    expect(html.startsWith('rid-')).toBe(true)
+    expect(tokens(colour('and if not 42', 'text'))).toEqual([])
+  })
+
+  it('escapes what it does not tokenise', () => {
+    // The result is inserted as HTML. An unescaped `<` here is markup injection into
+    // the page from a field the operator typed.
+    expect(colour('<b>{{ x }}</b>', 'text')).toContain('&lt;b>')
+    expect(colour('a & b', 'text')).toContain('&amp;')
+  })
+
+  it('colours a statement and a comment as well as a variable', () => {
+    expect(tokens(colour('{% if ready %}yes{% endif %}', 'text'))).toContain('tag keyword')
+    expect(tokens(colour('{# a note #}', 'text'))).toContain('jinja2 jinja2')
+  })
+})
+
+describe('JSON with Jinja in it', () => {
+  it('keeps the JSON and colours an expression inside a string', () => {
+    // The case that a single top-level jinja token silently missed: prism gives
+    // overlapping greedy patterns to whichever starts first, and the quote starts
+    // before the brace.
+    const html = colour('{"id": "{{ resourceId }}", "n": 1}', 'json')
+    const classes = tokens(html)
+    expect(classes).toContain('property')
+    expect(classes).toContain('number')
+    expect(classes).toContain('jinja2 jinja2')
+    expect(classes).toContain('variable')
+  })
+
+  it('colours an expression between the structure', () => {
+    const classes = tokens(colour('{"a": 1{% if x %}, "b": 2{% endif %}}', 'json'))
+    expect(classes).toContain('tag keyword')
+    expect(classes).toContain('punctuation')
+  })
+
+  it('leaves plain JSON as plain JSON', () => {
+    const classes = tokens(colour('{"a": [1, true, null]}', 'json'))
+    expect(classes).toContain('boolean')
+    expect(classes.some((name) => name.includes('jinja2'))).toBe(false)
+  })
+})
+
+describe('the two that are not templates', () => {
+  it('colours a pattern as a pattern', () => {
+    const classes = tokens(colour('^/api/(?P<id>\\d+)$', 'regex'))
+    expect(classes).toContain('anchor function')
+    expect(classes.some((name) => name.includes('jinja2'))).toBe(false)
+  })
+
+  it('colours a document as YAML, braces and all', () => {
+    // A proxy document is not a template: `{{` in one is two brackets, and colouring
+    // it as an expression would say otherwise.
+    const classes = tokens(colour('name: alpha\ntimeout: 30\n', 'yaml'))
+    expect(classes).toContain('key atrule')
+    expect(classes.some((name) => name.includes('jinja2'))).toBe(false)
+  })
+})
diff --git a/frontend/src/components/__tests__/shell.test.tsx b/frontend/src/components/__tests__/shell.test.tsx
new file mode 100644
index 0000000..8bbe226
--- /dev/null
+++ b/frontend/src/components/__tests__/shell.test.tsx
@@ -0,0 +1,131 @@
+// The shell's components, minus the ones that need a router.
+//
+// react-router ships ESM only and reaches for `import.meta`, which jest's CJS
+// transform cannot parse -- so anything rendering a NavLink or calling
+// useNavigate is covered by the Playwright suite instead, where a real browser
+// runs the real router. That is a better test of navigation anyway; what is left
+// here is the part that is genuinely a unit.
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import { Footer } from '../Footer'
+import { TokenDialog } from '../TokenDialog'
+import { forgetRuntimeConfig } from '../../services/runtimeConfig'
+import { useAuth } from '../../store/auth'
+
+/**
+ * Serve the page with this configuration.
+ *
+ * No module reset: nothing reads the configuration at import time any more, and
+ * resetting would hand the test a different store instance than the one the
+ * rendered component is subscribed to -- which looks like a component that
+ * ignores its own state.
+ */
+function serve(
+  overrides: { public?: boolean; title?: string; version?: string; copyrightYear?: number } = {},
+): void {
+  document.head.innerHTML = `<script type="application/json" id="doppel-config">${JSON.stringify({
+    title: overrides.title ?? 'Doppel',
+    titleIsDefault: overrides.title === undefined,
+    public: overrides.public ?? false,
+    version: overrides.version ?? '0.4.1',
+    authHeader: 'X-Proxy-Authorization',
+    refreshMs: 60000,
+    copyrightYear: overrides.copyrightYear ?? 2026,
+  })}</script>`
+  forgetRuntimeConfig()
+}
+
+beforeEach(() => {
+  localStorage.clear()
+  sessionStorage.clear()
+})
+
+describe('the footer', () => {
+  it('shows the copyright and the version of the binary serving the page', () => {
+    // From the injected configuration, not from package.json: what matters is
+    // which Doppel answered.
+    serve({ version: '9.9.9' })
+    render(<Footer />)
+
+    expect(screen.getByText(/\(c\) 2026 Lorem Dev/)).toBeInTheDocument()
+    expect(screen.getByText(/Doppel 9\.9\.9/)).toBeInTheDocument()
+  })
+
+  it('takes the year from the build rather than from the clock', () => {
+    // The build stamps it, so a copy still in use years later keeps saying when it
+    // was published. `new Date().getFullYear()` would have said otherwise, and this
+    // is the assertion that tells the two apart.
+    serve({ copyrightYear: 2031 })
+    render(<Footer />)
+
+    expect(screen.getByText(/\(c\) 2031 Lorem Dev/)).toBeInTheDocument()
+  })
+
+  it('leaves the copyright as text', () => {
+    // A statement rather than a destination. A line that looks clickable and does
+    // nothing is worse than one that plainly does not, and the links beside it make
+    // the difference easy to lose.
+    serve()
+    render(<Footer />)
+
+    const copyright = screen.getByText(/\(c\) 2026 Lorem Dev/)
+    expect(copyright.closest('a')).toBeNull()
+  })
+
+  it('links to the repository and the documentation', () => {
+    serve()
+    render(<Footer />)
+
+    expect(screen.getByRole('link', { name: /Repository/ })).toHaveAttribute(
+      'href',
+      'https://github.com/lorem-dev/doppel',
+    )
+    // Versioned: the site is published per version, and a link without one would
+    // show the reader whatever has been released since this binary was built.
+    expect(screen.getByRole('link', { name: /Documentation/ })).toHaveAttribute(
+      'href',
+      'https://lorem-dev.github.io/doppel/0.4.1/',
+    )
+    // Both leave the dashboard, and neither is worth losing a half-filled form for.
+    for (const link of screen.getAllByRole('link')) {
+      expect(link).toHaveAttribute('target', '_blank')
+    }
+  })
+})
+
+describe('the token dialog', () => {
+  it('takes no for an answer', async () => {
+    // `list` and `read` can be public, so a caller with no token may have plenty
+    // to look at. A dialog that could not be dismissed would hide a working page.
+    serve()
+    useAuth.setState({ dialogOpen: true, token: undefined })
+    render(<TokenDialog />)
+
+    await userEvent.click(screen.getByRole('button', { name: 'Continue without a token' }))
+    expect(useAuth.getState().dialogOpen).toBe(false)
+    expect(sessionStorage.getItem('doppel.token.refused')).toBe('yes')
+  })
+
+  it('keeps the token out of the DOM as text', async () => {
+    serve()
+    useAuth.setState({ dialogOpen: true, token: undefined })
+    render(<TokenDialog />)
+
+    const input = screen.getByLabelText('Token')
+    // A password input, so a shoulder or a screenshot does not carry an admin
+    // token away.
+    expect(input).toHaveAttribute('type', 'password')
+
+    await userEvent.type(input, 'root-token-0000000000000000000000000')
+    await userEvent.click(screen.getByRole('button', { name: 'Use this token' }))
+    expect(useAuth.getState().token).toBe('root-token-0000000000000000000000000')
+  })
+
+  it('is not rendered at all when it is shut', () => {
+    serve()
+    useAuth.setState({ dialogOpen: false })
+    const { container } = render(<TokenDialog />)
+    expect(container).toBeEmptyDOMElement()
+  })
+})
diff --git a/frontend/src/components/__tests__/title.test.tsx b/frontend/src/components/__tests__/title.test.tsx
new file mode 100644
index 0000000..afe92ee
--- /dev/null
+++ b/frontend/src/components/__tests__/title.test.tsx
@@ -0,0 +1,41 @@
+// How a deployment's own name is split into tones.
+//
+// The wordmark is `Doppel` + `ganger`, and a title gets the same treatment: the
+// first word in the strong tone, everything after it in the light one. What counts
+// as a word is the interesting part, and it is all in `titleSegments`.
+
+import { titleSegments } from '../Title'
+
+describe('titleSegments', () => {
+  it('splits on the three things a name uses for a boundary', () => {
+    expect(titleSegments('Billing API')).toEqual(['Billing', ' API'])
+    expect(titleSegments('billing_api')).toEqual(['billing', '_api'])
+    expect(titleSegments('billingApi')).toEqual(['billing', 'Api'])
+    // A hyphen too: `billing-api` is the same name written the way a hostname is.
+    expect(titleSegments('billing-api')).toEqual(['billing', '-api'])
+  })
+
+  it('keeps every character, so the title reads as it was typed', () => {
+    for (const title of ['Billing API', 'billing_api', 'billingApi', 'a b  c', 'Doppel (e2e)']) {
+      expect(titleSegments(title).join('')).toBe(title)
+    }
+  })
+
+  it('leaves a one-word title as one segment', () => {
+    // Which gets the strong tone, so a single word is not drawn in the accent
+    // colour for no reason.
+    expect(titleSegments('billing')).toEqual(['billing'])
+    expect(titleSegments('API')).toEqual(['API'])
+  })
+
+  it('does not split inside an acronym or a number', () => {
+    // `API2` is one word: a case change is a boundary between two letters, and a
+    // run of capitals is not a run of words.
+    expect(titleSegments('APIGateway')).toEqual(['APIGateway'])
+    expect(titleSegments('proxy2Api')).toEqual(['proxy2', 'Api'])
+  })
+
+  it('has nothing to say about an empty title', () => {
+    expect(titleSegments('')).toEqual([])
+  })
+})
diff --git a/frontend/src/components/grammars.ts b/frontend/src/components/grammars.ts
new file mode 100644
index 0000000..5e5c282
--- /dev/null
+++ b/frontend/src/components/grammars.ts
@@ -0,0 +1,126 @@
+// Which grammar colours which field, and how Jinja gets into three of them.
+//
+// Separate from the editor component because it is the part worth testing: the
+// composition below is the only place in this app where two grammars meet, and prism's
+// rules about which pattern wins are not obvious enough to leave unasserted. See
+// `grammars.test.ts`.
+
+import { highlight, languages, type Grammar, type TokenObject } from 'prismjs'
+import 'prismjs/components/prism-json'
+// `markup` is not used directly: `markup-templating` requires it, and `json` extends
+// nothing of it. It is imported for that dependency alone.
+import 'prismjs/components/prism-markup'
+import 'prismjs/components/prism-regex'
+import 'prismjs/components/prism-yaml'
+// `markup-templating` is the machinery prism uses to embed a template language in a
+// document; `django` is the grammar, and it registers itself as `jinja2` as well --
+// which is the name the hooks below switch on.
+import 'prismjs/components/prism-markup-templating'
+import 'prismjs/components/prism-django'
+
+/**
+ * What a field holds.
+ *
+ * Two of these are templates. A mock's response body and its JSON body are rendered
+ * through Jinja, so `{{ id }}` and `{% if %}` are coloured in both -- `text` means a
+ * template with no host language, which is what a body and a header value are.
+ *
+ * There is no `html`. prism can do it, and the composition worked, but nothing in the
+ * dashboard edits HTML any more: that was the `.html.j2` template kind, and template
+ * files are the admin API's. An unreachable branch is a branch nobody maintains.
+ */
+export type Syntax = 'json' | 'text' | 'regex' | 'yaml'
+
+/**
+ * Where a Jinja expression starts and ends.
+ *
+ * The pattern is prism-django's own, which is what its `before-tokenize` hook uses to
+ * pull expressions out of a document. It is repeated here because that hook only ever
+ * hands the rest of the document to the markup grammar, and JSON is not markup.
+ *
+ * `inside` is the library's grammar for what lies between the delimiters: the braces,
+ * the keywords, the filters, the variable names. Nothing about Jinja itself is
+ * described here.
+ */
+/**
+ * A grammar prism must have, because a component above imports it.
+ *
+ * A loud failure beats an editor that quietly colours nothing, which is the state this
+ * whole file exists to have fixed once: prism ships its grammars as separate modules,
+ * and a missing import looks exactly like a working editor with no highlighting.
+ */
+function required(name: string): Grammar {
+  const grammar = languages[name]
+  if (!grammar) {
+    throw new Error(`prism has no ${name} grammar; its component is not imported`)
+  }
+  return grammar
+}
+
+const JINJA = {
+  pattern: /\{\{[\s\S]*?\}\}|\{%[\s\S]*?%\}|\{#[\s\S]*?#\}/,
+  greedy: true,
+  alias: 'jinja2',
+  inside: required('jinja2'),
+}
+
+/**
+ * A template with no host language: expressions coloured, everything else plain.
+ *
+ * One token, so a word outside an expression stays a word. Handing the whole text to
+ * the `jinja2` grammar instead would colour every identifier in it, because that
+ * grammar describes the inside of an expression, where a bare word *is* a variable.
+ */
+const TEMPLATE = { jinja2: JINJA }
+
+/**
+ * JSON with Jinja in it, which is what a `.json.j2` file and a mock's `json` are.
+ *
+ * Two placements, because a template puts expressions in two kinds of place: inside a
+ * string (`"id": "{{ id }}"`) and between the structure (`{% for %}` around an
+ * element). The second is a token of its own; the first has to be `inside` the string
+ * and property patterns, because prism resolves two greedy patterns competing for
+ * overlapping text in favour of the one that starts earlier -- and the quote always
+ * starts before the brace. A jinja token at the top level alone was silently ignored
+ * for every expression inside a string, which is most of them.
+ */
+const JSON_TEMPLATE = (() => {
+  // A private root, so the shared `languages.json` keeps its own definition: the YAML
+  // editor and anything else asking prism for JSON should get JSON.
+  const composed = languages.insertBefore(
+    'json',
+    'property',
+    { jinja2: JINJA },
+    { json: required('json') },
+  )
+  const inside = { jinja2: JINJA }
+  return {
+    ...composed,
+    string: { ...(composed.string as TokenObject), inside },
+    property: { ...(composed.property as TokenObject), inside },
+  } satisfies Grammar
+})()
+
+/**
+ * The highlighted markup for one field's contents.
+ *
+ * Returns HTML, which is what the editor's `highlight` prop wants and why every branch
+ * has to escape what it does not tokenise. prism escapes as it goes; the `regex` and
+ * `yaml` branches have no Jinja because a pattern and a proxy document are not
+ * templates.
+ */
+export function colour(code: string, syntax: Syntax): string {
+  switch (syntax) {
+    case 'json':
+      // Not the language name `jinja2`: that name is what prism's templating hook
+      // switches on, and the hook hands the document to the markup grammar -- which
+      // would throw the JSON away.
+      return highlight(code, JSON_TEMPLATE, 'json')
+    case 'text':
+      return highlight(code, TEMPLATE, 'text')
+    case 'regex':
+      return highlight(code, required('regex'), 'regex')
+    case 'yaml':
+      return highlight(code, required('yaml'), 'yaml')
+  }
+}
diff --git a/frontend/src/index.css b/frontend/src/index.css
new file mode 100644
index 0000000..16696e7
--- /dev/null
+++ b/frontend/src/index.css
@@ -0,0 +1,58 @@
+@import "tailwindcss";
+
+/* Class-based dark mode rather than the media query alone: the theme control
+   offers light, dark and system, so the choice has to be expressible as a class
+   on <html> that overrides what the operating system says. `system` is the
+   absence of both classes plus a matchMedia listener. */
+@custom-variant dark (&:where(.dark, .dark *));
+
+@layer base {
+  /*
+   * The page's own colours, and the reason this block exists: without it the
+   * background stayed the browser's white while every component switched to its
+   * dark text, so a dark theme rendered a white page with near-invisible
+   * headings. Components can only colour themselves; the page has to be coloured
+   * here.
+   */
+  body {
+    @apply bg-white text-slate-900 antialiased;
+  }
+
+  .dark body {
+    @apply bg-slate-950 text-slate-100;
+  }
+
+  /*
+   * Native controls follow this and nothing else: a select, a scrollbar, a text
+   * caret and a focus ring are drawn by the browser, and on a dark page they stay
+   * light without it. Set on the element rather than in a media query, because
+   * the choice may disagree with the operating system.
+   */
+  html {
+    color-scheme: light;
+  }
+
+  html.dark {
+    color-scheme: dark;
+  }
+}
+
+@layer components {
+  /*
+   * The chevron on a select.
+   *
+   * Written here rather than as a Tailwind arbitrary value: a `bg-[url("data:...")]`
+   * carrying a quoted SVG did not survive into the stylesheet at all, which left
+   * `appearance-none` having removed the native arrow and nothing having replaced
+   * it -- a select with no affordance whatsoever. Plain CSS needs no escaping.
+   *
+   * `currentColor` cannot be used inside a data URI, so the stroke is slate-500,
+   * which reads on both themes.
+   */
+  .select-chevron {
+    background-image: url("data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 16 16' fill='none' stroke='%2364748b' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round'><path d='M4 6l4 4 4-4'/></svg>");
+    background-repeat: no-repeat;
+    background-position: right 0.5rem center;
+    background-size: 16px 16px;
+  }
+}
diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx
new file mode 100644
index 0000000..99a0b98
--- /dev/null
+++ b/frontend/src/main.tsx
@@ -0,0 +1,21 @@
+import { StrictMode } from 'react'
+import { createRoot } from 'react-dom/client'
+import { BrowserRouter } from 'react-router'
+
+import { AppRoutes } from './app/routes'
+import './index.css'
+
+const root = document.getElementById('root')
+if (!root) {
+  throw new Error('index.html is missing #root')
+}
+
+// No basename: the dashboard is served from the admin listener's root, and
+// `/static/` is the asset prefix rather than a route.
+createRoot(root).render(
+  <StrictMode>
+    <BrowserRouter>
+      <AppRoutes />
+    </BrowserRouter>
+  </StrictMode>,
+)
diff --git a/frontend/src/pages/ProxiesPage.tsx b/frontend/src/pages/ProxiesPage.tsx
new file mode 100644
index 0000000..297b3fd
--- /dev/null
+++ b/frontend/src/pages/ProxiesPage.tsx
@@ -0,0 +1,210 @@
+import { useCallback, useState } from 'react'
+import { Link, useNavigate } from 'react-router'
+
+import { Banner } from '../components/Banner'
+import { Button } from '../components/Button'
+import { Retry } from '../components/Retry'
+import { ConfirmDialog } from '../components/ConfirmDialog'
+import { Spinner } from '../components/Spinner'
+import { usePolling } from '../app/usePolling'
+import type { ProxyConfig, ProxyView } from '../types/proxy'
+import { ApiError } from '../types/error'
+import { useMay } from '../store/access'
+import { useAuth } from '../store/auth'
+import { useProxies } from '../store/proxies'
+import { useToasts } from '../store/toast'
+
+/**
+ * The fault settings, one short label each.
+ *
+ * Separate rather than joined into a sentence: as one string it wrapped across two
+ * lines in a narrow column and pushed every other cell in the row out of line.
+ */
+function faults(proxy: ProxyConfig): string[] {
+  const parts: string[] = []
+  if (proxy.replace !== undefined) {
+    parts.push(`replace ${percent(proxy.replace)}`)
+  }
+  if (proxy.loss) {
+    parts.push(`loss ${percent(proxy.loss.percentage)} -> ${proxy.loss.status}`)
+  }
+  if (proxy.latency) {
+    parts.push(
+      `latency ${percent(proxy.latency.percentage)} ${proxy.latency.min}-${proxy.latency.max}s`,
+    )
+  }
+  return parts
+}
+
+/** A ratio as a percentage, because the column is for reading, not editing. */
+function percent(ratio: number): string {
+  return `${Math.round(ratio * 100)}%`
+}
+
+function resolveOf(proxy: ProxyConfig): string {
+  if (proxy.resolve?.type !== 'header') {
+    return 'default'
+  }
+  return proxy.resolve.header ? `header:${proxy.resolve.header}` : 'header'
+}
+
+export default function ProxiesPage() {
+  const items = useProxies((state) => state.items)
+  const loading = useProxies((state) => state.loading)
+  const error = useProxies((state) => state.error)
+  const load = useProxies((state) => state.load)
+  const remove = useProxies((state) => state.remove)
+  const may = useMay()
+  const token = useAuth((state) => state.token)
+  const push = useToasts((state) => state.push)
+  const navigate = useNavigate()
+  const [pending, setPending] = useState<ProxyView>()
+
+  // Once a minute, immediately on arrival, and again the moment the token changes:
+  // signing in has to clear a refusal that is already on screen, and signing out has
+  // to stop showing what the token could see. `load` is stable, so this does not
+  // resubscribe on every render.
+  usePolling(
+    useCallback(() => void load(), [load]),
+    token,
+  )
+
+  const onDelete = (view: ProxyView) => {
+    remove(view.proxy.name, view.revision)
+      .then(() => push('done', `Deleted ${view.proxy.name}`))
+      .catch((caught: ApiError) =>
+        push(
+          'failed',
+          caught.isStale
+            ? `${view.proxy.name} changed since this page loaded; it was not deleted`
+            : caught.message,
+        ),
+      )
+      .finally(() => setPending(undefined))
+  }
+
+  return (
+    <section className="flex flex-col gap-4">
+      <div className="flex items-center gap-3">
+        <h2 className="text-base font-semibold text-slate-900 dark:text-slate-100">Proxies</h2>
+        <Button
+          variant="primary"
+          onClick={() => void navigate('/proxies/new')}
+          disabled={!may('create')}
+          reason="This token may not create proxies"
+        >
+          Add a proxy
+        </Button>
+      </div>
+
+      {error ? (
+        <Banner kind="error" action={<Retry error={error} onRetry={() => void load()} />}>
+          {error.message}
+        </Banner>
+      ) : null}
+
+      {loading ? <Spinner label="Reading the proxy set..." /> : null}
+
+      {!loading && items.length === 0 && !error ? (
+        <Banner kind="note">
+          No proxies are configured. Doppel answers 503 with NO_PROXIES_CONFIGURED until one is.
+        </Banner>
+      ) : null}
+
+      {items.length ? (
+        <div className="overflow-x-auto rounded-md border border-slate-200 dark:border-slate-800">
+          <table className="w-full border-collapse text-left text-sm">
+            <thead className="bg-slate-50 text-xs uppercase tracking-wide text-slate-500 dark:bg-slate-900 dark:text-slate-400">
+              <tr>
+                <th scope="col" className="px-3 py-2 font-medium">
+                  Name
+                </th>
+                <th scope="col" className="px-3 py-2 font-medium">
+                  Upstream
+                </th>
+                <th scope="col" className="px-3 py-2 font-medium">
+                  Resolve
+                </th>
+                <th scope="col" className="px-3 py-2 font-medium">
+                  Faults
+                </th>
+                {/* Right-aligned because it is a number, and numbers line up on
+                    their last digit. */}
+                <th scope="col" className="px-3 py-2 text-right font-medium">
+                  Mocks
+                </th>
+                <th scope="col" className="px-3 py-2" />
+              </tr>
+            </thead>
+            <tbody>
+              {items.map(({ revision, proxy }) => (
+                <tr
+                  key={proxy.name}
+                  className="border-t border-slate-200 align-middle hover:bg-slate-50 dark:border-slate-800 dark:hover:bg-slate-900/60"
+                >
+                  <td className="px-3 py-2 font-medium whitespace-nowrap text-slate-900 dark:text-slate-100">
+                    <Link
+                      className="hover:underline"
+                      to={`/proxies/${encodeURIComponent(proxy.name)}`}
+                    >
+                      {proxy.name}
+                    </Link>
+                  </td>
+                  {/* Truncated with the whole value in the title: a long upstream
+                      used to wrap across two lines and push every other cell in the
+                      row out of alignment. */}
+                  <td className="max-w-xs truncate px-3 py-2 font-mono text-xs text-slate-700 dark:text-slate-300">
+                    <span title={proxy.url}>{proxy.url}</span>
+                  </td>
+                  <td className="px-3 py-2 whitespace-nowrap text-slate-700 dark:text-slate-300">
+                    {resolveOf(proxy)}
+                  </td>
+                  <td className="px-3 py-2 text-slate-700 dark:text-slate-300">
+                    <div className="flex flex-wrap gap-1">
+                      {faults(proxy).map((fault) => (
+                        <span
+                          key={fault}
+                          className="rounded bg-slate-100 px-1.5 py-0.5 font-mono text-xs whitespace-nowrap text-slate-700 dark:bg-slate-800 dark:text-slate-300"
+                        >
+                          {fault}
+                        </span>
+                      ))}
+                      {faults(proxy).length === 0 ? (
+                        <span className="text-slate-400 dark:text-slate-500">none</span>
+                      ) : null}
+                    </div>
+                  </td>
+                  <td className="px-3 py-2 text-right tabular-nums text-slate-700 dark:text-slate-300">
+                    {proxy.mocks?.length ?? 0}
+                  </td>
+                  <td className="px-3 py-2">
+                    <div className="flex justify-end gap-2">
+                      <Button
+                        variant="danger"
+                        onClick={() => setPending({ revision, proxy })}
+                        disabled={!may('delete', proxy.name)}
+                        reason="This token may not delete this proxy"
+                      >
+                        Delete
+                      </Button>
+                    </div>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      ) : null}
+
+      {pending ? (
+        <ConfirmDialog
+          question={`Delete ${pending.proxy.name}?`}
+          detail="Its template files go with it. This cannot be undone."
+          confirmLabel="Delete"
+          onConfirm={() => onDelete(pending)}
+          onCancel={() => setPending(undefined)}
+        />
+      ) : null}
+    </section>
+  )
+}
diff --git a/frontend/src/pages/ProxyFormPage.tsx b/frontend/src/pages/ProxyFormPage.tsx
new file mode 100644
index 0000000..b9c5c73
--- /dev/null
+++ b/frontend/src/pages/ProxyFormPage.tsx
@@ -0,0 +1,875 @@
+import { Suspense, lazy, useCallback, useEffect, useState } from "react";
+import { useNavigate, useParams } from "react-router";
+
+import { Banner } from "../components/Banner";
+import { Button } from "../components/Button";
+import { Field, controlClass, selectFullClass } from "../components/Field";
+import { KeyValueRows } from "../components/KeyValueRows";
+import { MockEditor, emptyMock } from "../components/MockEditor";
+import { ConfirmDialog } from "../components/ConfirmDialog";
+import { Retry } from "../components/Retry";
+import { Section } from "../components/Section";
+import { Spinner } from "../components/Spinner";
+import type { ProxyConfig } from "../types/proxy";
+import { ApiError, complaintAbout } from "../types/error";
+import { removals } from "../schema/removals";
+import { complain, numericAttrs } from "../schema/rules";
+import { useMay } from "../store/access";
+import { useRule, useSchema, useValueRule } from "../store/schema";
+import { useToasts } from "../store/toast";
+import { createProxy, readProxy, updateProxy } from "../services/proxies";
+import { runtimeConfig } from "../services/runtimeConfig";
+
+/**
+ * The YAML editor, loaded only when it is opened.
+ *
+ * It brings a YAML parser and a schema validator with it -- most of what that chunk
+ * weighs -- so someone who edits with the form never fetches either.
+ */
+const YamlMode = lazy(() => import("../components/YamlMode"));
+
+/** A new proxy, with the two fields the server requires. */
+const BLANK: ProxyConfig = { name: "", type: "http", url: "" };
+
+/**
+ * What each folded section says about itself.
+ *
+ * A row of four identical closed headings would make the operator open all of them
+ * to find out which one holds the setting they came for.
+ */
+function forwardingSummary(proxy: ProxyConfig): string {
+  const parts = [
+    proxy.resolve?.type === "header" ? "by header" : "default proxy",
+  ];
+  if (proxy.timeout !== undefined) {
+    parts.push(`${proxy.timeout}s timeout`);
+  }
+  const headers = Object.keys(proxy.headers ?? {}).length;
+  if (headers) {
+    parts.push(`${headers} header${headers === 1 ? "" : "s"}`);
+  }
+  return parts.join(", ");
+}
+
+function faultSummary(proxy: ProxyConfig): string {
+  const parts: string[] = [];
+  if (proxy.replace !== undefined) {
+    parts.push("replace");
+  }
+  if (proxy.loss) {
+    parts.push("loss");
+  }
+  if (proxy.latency) {
+    parts.push("latency");
+  }
+  if (proxy.rewrite_redirects === false) {
+    parts.push("redirects kept");
+  }
+  if (proxy.rewrite_urls === false) {
+    parts.push("urls kept");
+  }
+  return parts.length ? parts.join(", ") : "none";
+}
+
+function accessSummary(proxy: ProxyConfig): string {
+  const set = Object.keys(proxy.access ?? {});
+  return set.length ? set.join(", ") : "inherited";
+}
+
+/**
+ * An optional number field: empty means absent, not zero.
+ *
+ * Anything that is not a number is also absent. `Number('abc')` is `NaN`, which
+ * `JSON.stringify` writes as `null` -- so without this the server would refuse the
+ * document with a complaint about a null where the operator had typed a word.
+ */
+function numberOr(value: string): number | undefined {
+  const trimmed = value.trim();
+  if (trimmed === "") {
+    return undefined;
+  }
+  const parsed = Number(trimmed);
+  return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+/**
+ * Create or edit one proxy, field by field.
+ *
+ * The form covers every field of `ProxyConfig`, and `schema-drift.test.ts` is
+ * what keeps that true: it reads `doppel-config.schema.json` and fails when the
+ * configuration format grows a field this file does not mention.
+ *
+ * Nothing here re-implements the configuration's rules. The bounds it checks as
+ * someone types -- a pattern, a length, a range -- are read out of the schema the
+ * server serves, so there is one statement of each rule and the page cannot hold a
+ * stale or laxer copy of it. Anything that needs more than one field is the
+ * server's answer on save, mapped back onto the field it is about.
+ */
+export default function ProxyFormPage() {
+  const { name } = useParams();
+  const editing = name !== undefined;
+  const navigate = useNavigate();
+  const may = useMay();
+  const rule = useRule();
+  const valueRule = useValueRule();
+  const push = useToasts((state) => state.push);
+
+  const [draft, setDraft] = useState<ProxyConfig>(BLANK);
+  const [revision, setRevision] = useState<string>();
+  const [loading, setLoading] = useState(editing);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<ApiError>();
+  const [asYaml, setAsYaml] = useState(false);
+  /** Why the YAML cannot be saved, when it cannot. */
+  const [broken, setBroken] = useState<string>();
+  /** Changed to ask the YAML editor to reformat; pressing Save does. */
+  const [formatToken, setFormatToken] = useState(0);
+  /**
+   * The document as it was read, for the save to compare against.
+   *
+   * A form full of Remove buttons has no undo and one button that commits all of
+   * them, so what is worth confirming is not each removal but the save that makes
+   * them real -- and that needs the version before the edits.
+   */
+  const [stored, setStored] = useState<ProxyConfig>();
+  /** What the save is waiting to be told to go ahead and remove. */
+  const [confirming, setConfirming] = useState<string[]>();
+  const schema = useSchema((state) => state.schema);
+
+  /**
+   * Read the stored document, replacing whatever the form holds.
+   *
+   * A named function rather than an effect body, because the refusal banner offers it
+   * again: "Read of `alpha` requires access `read`" is about the token, and the page
+   * reads once when it opens -- so after signing in there has to be something to
+   * press. Deliberately not automatic on a token change: this replaces a draft, and
+   * losing a half-typed document to a sign-in that happened in another tab is worse
+   * than a button.
+   */
+  const load = useCallback(() => {
+    if (!editing) {
+      return;
+    }
+    readProxy(name)
+      .then((view) => {
+        setDraft(view.proxy);
+        setStored(view.proxy);
+        setRevision(view.revision);
+        setError(undefined);
+      })
+      .catch((caught: ApiError) => setError(caught))
+      .finally(() => setLoading(false));
+  }, [editing, name]);
+
+  useEffect(load, [load]);
+
+  const allowed = editing ? may("update", name) : may("create");
+
+  /**
+   * The admin API is unauthenticated, so this proxy's `access` block decides
+   * nothing.
+   *
+   * `authorize()` answers every action as public while `admin.public` is set,
+   * and the process says so among its startup advisories. Offering four fields
+   * that change no outcome would be the page disagreeing with the binary it is
+   * served from, so the section is left out entirely.
+   */
+  const isPublic = runtimeConfig().public;
+
+  /**
+   * The server's complaint about one field, if it made one.
+   *
+   * The form asks about a field it knows; nothing here reads paths out of the
+   * message. A complaint that matches no field stays in the banner rather than
+   * being dropped -- which is where all of them end up when the refusal is about
+   * the document as a whole.
+   */
+  const errorFor = useCallback(
+    (field: string): string | undefined =>
+      error ? complaintAbout(error, field) : undefined,
+    [error],
+  );
+
+  /**
+   * What the schema says is wrong with this field's current value.
+   *
+   * Shown in preference to the server's complaint about the same field: it is about
+   * the text that is there now, while the server's is about the text that was there
+   * when the save was refused.
+   */
+  const complaintFor = useCallback(
+    (path: string, value: unknown): string | undefined =>
+      complain(rule(path), value),
+    [rule],
+  );
+
+  /**
+   * Save, once anything being removed has been agreed to.
+   *
+   * The check is here rather than on each Remove button: an operator taking a mock
+   * out and putting another in has done one edit, and asking twice on the way would
+   * be asking about a state they are still assembling.
+   */
+  const attempt = () => {
+    const gone = stored ? removals(stored, draft) : [];
+    if (gone.length) {
+      setConfirming(gone);
+      return;
+    }
+    save();
+  };
+
+  const save = () => {
+    setConfirming(undefined);
+    // Tidy what is in the editor before sending it. The document is what gets
+    // stored either way, so this is about what the operator is looking at if the
+    // save comes back refused.
+    if (asYaml) {
+      setFormatToken((token) => token + 1);
+    }
+    setSaving(true);
+    const done = (message: string) => {
+      push("done", message);
+      void navigate("/");
+    };
+    const failed = (caught: ApiError) => {
+      setError(caught);
+      setSaving(false);
+    };
+
+    if (editing) {
+      if (!revision) {
+        // Unreachable through the UI -- the revision arrives with the document --
+        // and worth refusing rather than sending a blind write the server would
+        // answer 428 to.
+        failed(
+          new ApiError(0, "REVISION_REQUIRED", "this proxy was never loaded"),
+        );
+        return;
+      }
+      updateProxy(name, revision, draft)
+        .then(() =>
+          done(
+            // A rename is worth naming: the page it came from is gone, and this is
+            // the only place the old name and the new one appear together.
+            draft.name === name
+              ? `Updated ${name}`
+              : `Renamed ${name} to ${draft.name}`,
+          ),
+        )
+        .catch(failed);
+      return;
+    }
+    createProxy(draft)
+      .then(() => done(`Created ${draft.name}`))
+      .catch(failed);
+  };
+
+  if (loading) {
+    return <Spinner label="Reading the proxy..." />;
+  }
+
+  const patch = (fields: Partial<ProxyConfig>) =>
+    setDraft({ ...draft, ...fields });
+
+  return (
+    <section className="flex flex-col gap-4">
+      <div className="flex flex-wrap items-center gap-3">
+        <h2 className="text-base font-semibold text-slate-900 dark:text-slate-100">
+          {editing ? `Edit ${name}` : "Add a proxy"}
+        </h2>
+        {/*
+          A checkbox rather than two tabs: it is one document either way, and the
+          question is only which way you would rather type it. It cannot be turned
+          off while the YAML is broken -- the form shows the last document that
+          parsed, so switching back would throw away whatever is being written.
+        */}
+        <label className="ml-auto flex items-center gap-2 text-sm text-slate-600 dark:text-slate-300">
+          <input
+            type="checkbox"
+            className="h-4 w-4 accent-teal-600"
+            checked={asYaml}
+            disabled={saving || (asYaml && broken !== undefined)}
+            title={
+              asYaml && broken ? `Fix the YAML first: ${broken}` : undefined
+            }
+            onChange={(event) => {
+              setAsYaml(event.target.checked);
+              setBroken(undefined);
+            }}
+          />
+          Edit as YAML
+        </label>
+      </div>
+
+      {error ? (
+        <Banner
+          kind="error"
+          action={
+            // Only while editing, and not for a stale revision. There is nothing to
+            // re-read for a refused *create* -- the fix is in the fields -- and a
+            // refetch after a revision conflict would answer it by throwing away the
+            // edit that caused it, which is why that case says what to do instead.
+            editing && !error.isStale ? (
+              <Retry
+                error={error}
+                onRetry={() => {
+                  // Set here rather than in `load`: a state change inside an effect is
+                  // what the first read would then be, and this is an event.
+                  setLoading(true);
+                  load();
+                }}
+              />
+            ) : undefined
+          }
+        >
+          {error.isStale
+            ? `${error.message}\nThis proxy changed since it was loaded. Reload the page to see the current document.`
+            : error.message}
+        </Banner>
+      ) : null}
+
+      {asYaml ? (
+        <Suspense fallback={<Spinner label="Loading the YAML editor..." />}>
+          <YamlMode
+            value={draft}
+            schema={schema}
+            disabled={!allowed || saving}
+            formatToken={formatToken}
+            onChange={setDraft}
+            onBroken={setBroken}
+          />
+        </Suspense>
+      ) : (
+        <>
+          <Field
+            label="Name"
+            info="name"
+            hint={
+              editing
+                ? "Renaming is allowed: the templates move with it."
+                : "Letters, digits, - and _, 2 to 32 characters."
+            }
+            error={complaintFor("name", draft.name) ?? errorFor("name")}
+          >
+            <input
+              className={controlClass}
+              value={draft.name}
+              disabled={!allowed || saving}
+              onChange={(event) => patch({ name: event.target.value })}
+            />
+          </Field>
+
+          <Field
+            label="Type"
+            info="type"
+            hint="Only http. tcp is not implemented and the server refuses it."
+          >
+            <input
+              className={controlClass}
+              value={draft.type}
+              disabled
+              readOnly
+              aria-label="Type"
+            />
+          </Field>
+
+          <Field label="Upstream URL" info="url" error={errorFor("url")}>
+            <input
+              className={controlClass}
+              value={draft.url}
+              disabled={!allowed || saving}
+              onChange={(event) => patch({ url: event.target.value })}
+            />
+          </Field>
+
+          <Section title="Forwarding" summary={forwardingSummary(draft)}>
+            <div className="flex gap-3">
+              <Field
+                label="Timeout (seconds)"
+                info="timeout"
+                hint="Absent means no per-proxy timeout."
+                error={
+                  complaintFor("timeout", draft.timeout) ?? errorFor("timeout")
+                }
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  {...numericAttrs(rule("timeout"))}
+                  value={draft.timeout ?? ""}
+                  disabled={!allowed || saving}
+                  onChange={(event) =>
+                    patch({ timeout: numberOr(event.target.value) })
+                  }
+                />
+              </Field>
+              <Field
+                label="Body limit"
+                info="body_limit"
+                hint="Bytes, or 4Mi."
+                error={
+                  complaintFor("body_limit", draft.body_limit) ??
+                  errorFor("body_limit")
+                }
+              >
+                <input
+                  className={controlClass}
+                  value={draft.body_limit ?? ""}
+                  disabled={!allowed || saving}
+                  onChange={(event) =>
+                    patch({
+                      body_limit:
+                        event.target.value.trim() === ""
+                          ? undefined
+                          : event.target.value,
+                    })
+                  }
+                />
+              </Field>
+            </div>
+
+            <div className="flex gap-2">
+              <Field label="Resolve by" info="resolve.type">
+                <select
+                  className={selectFullClass}
+                  aria-label="Resolve by"
+                  value={draft.resolve?.type ?? "default"}
+                  disabled={!allowed || saving}
+                  onChange={(event) =>
+                    patch({
+                      resolve:
+                        event.target.value === "header"
+                          ? {
+                              type: "header",
+                              header: draft.resolve?.header ?? "X-Proxy-Name",
+                            }
+                          : { type: "default" },
+                    })
+                  }
+                >
+                  <option value="default">The default proxy</option>
+                  <option value="header">A request header</option>
+                </select>
+              </Field>
+              {draft.resolve?.type === "header" ? (
+                <div className="grow">
+                  <Field
+                    label="Header name"
+                    info="resolve.header"
+                    error={errorFor("header")}
+                  >
+                    <input
+                      className={controlClass}
+                      value={draft.resolve.header ?? ""}
+                      disabled={!allowed || saving}
+                      onChange={(event) =>
+                        patch({
+                          resolve: {
+                            type: "header",
+                            header: event.target.value,
+                          },
+                        })
+                      }
+                    />
+                  </Field>
+                </div>
+              ) : null}
+            </div>
+
+            <KeyValueRows
+              label="Headers sent upstream"
+              keyLabel="header name"
+              valueLabel="value"
+              info="headers"
+              disabled={!allowed || saving}
+              valueRule={valueRule("headers")}
+              value={draft.headers}
+              onChange={(next) => patch({ headers: next })}
+            />
+          </Section>
+
+          <Section title="Faults" summary={faultSummary(draft)}>
+            <div className="flex gap-3">
+              <Field
+                label="Replace"
+                info="replace"
+                hint="A fraction: 0.25 replaces a quarter of matching requests with a mock."
+                error={
+                  complaintFor("replace", draft.replace) ?? errorFor("replace")
+                }
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  step="0.01"
+                  {...numericAttrs(rule("replace"))}
+                  value={draft.replace ?? ""}
+                  disabled={!allowed || saving}
+                  onChange={(event) =>
+                    patch({ replace: numberOr(event.target.value) })
+                  }
+                />
+              </Field>
+              <Field
+                label="Rewrite redirects"
+                info="rewrite_redirects"
+                hint="On by default: a Location pointing upstream is pointed back here."
+              >
+                <select
+                  className={selectFullClass}
+                  aria-label="Rewrite redirects"
+                  value={
+                    draft.rewrite_redirects === undefined
+                      ? "default"
+                      : String(draft.rewrite_redirects)
+                  }
+                  disabled={!allowed || saving}
+                  onChange={(event) =>
+                    patch({
+                      rewrite_redirects:
+                        event.target.value === "default"
+                          ? undefined
+                          : event.target.value === "true",
+                    })
+                  }
+                >
+                  <option value="default">Default (on)</option>
+                  <option value="true">On</option>
+                  <option value="false">Off</option>
+                </select>
+              </Field>
+              <Field
+                label="Rewrite urls in bodies"
+                info="rewrite_urls"
+                hint="On by default: the upstream's own address, in text bodies, becomes this one."
+              >
+                <select
+                  className={selectFullClass}
+                  aria-label="Rewrite urls in bodies"
+                  value={
+                    draft.rewrite_urls === undefined
+                      ? "default"
+                      : String(draft.rewrite_urls)
+                  }
+                  disabled={!allowed || saving}
+                  onChange={(event) =>
+                    patch({
+                      rewrite_urls:
+                        event.target.value === "default"
+                          ? undefined
+                          : event.target.value === "true",
+                    })
+                  }
+                >
+                  <option value="default">Default (on)</option>
+                  <option value="true">On</option>
+                  <option value="false">Off</option>
+                </select>
+              </Field>
+            </div>
+
+            <div className="flex gap-3">
+              <Field
+                label="Loss rate"
+                info="loss.percentage"
+                hint="A fraction. Leave empty for none."
+                error={
+                  complaintFor("loss.percentage", draft.loss?.percentage) ??
+                  errorFor("percentage")
+                }
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  step="0.01"
+                  {...numericAttrs(rule("loss.percentage"))}
+                  value={draft.loss?.percentage ?? ""}
+                  disabled={!allowed || saving}
+                  onChange={(event) => {
+                    const percentage = numberOr(event.target.value);
+                    patch({
+                      loss:
+                        percentage === undefined
+                          ? undefined
+                          : { percentage, status: draft.loss?.status ?? 503 },
+                    });
+                  }}
+                />
+              </Field>
+              <Field
+                label="Loss status"
+                info="loss.status"
+                error={
+                  complaintFor("loss.status", draft.loss?.status) ??
+                  errorFor("status")
+                }
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  {...numericAttrs(rule("loss.status"))}
+                  value={draft.loss?.status ?? ""}
+                  disabled={!allowed || saving || !draft.loss}
+                  onChange={(event) =>
+                    patch({
+                      loss: draft.loss
+                        ? { ...draft.loss, status: Number(event.target.value) }
+                        : undefined,
+                    })
+                  }
+                />
+              </Field>
+            </div>
+
+            <div className="flex gap-3">
+              <Field
+                label="Latency rate"
+                info="latency.percentage"
+                hint="A fraction of requests to delay."
+                error={complaintFor(
+                  "latency.percentage",
+                  draft.latency?.percentage,
+                )}
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  step="0.01"
+                  {...numericAttrs(rule("latency.percentage"))}
+                  value={draft.latency?.percentage ?? ""}
+                  disabled={!allowed || saving}
+                  onChange={(event) => {
+                    const percentage = numberOr(event.target.value);
+                    patch({
+                      latency:
+                        percentage === undefined
+                          ? undefined
+                          : {
+                              percentage,
+                              min: draft.latency?.min ?? 0,
+                              max: draft.latency?.max ?? 1,
+                            },
+                    });
+                  }}
+                />
+              </Field>
+              <Field
+                label="Minimum (seconds)"
+                info="latency.min"
+                error={
+                  complaintFor("latency.min", draft.latency?.min) ??
+                  errorFor("min")
+                }
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  step="0.1"
+                  {...numericAttrs(rule("latency.min"))}
+                  value={draft.latency?.min ?? ""}
+                  disabled={!allowed || saving || !draft.latency}
+                  onChange={(event) =>
+                    patch({
+                      latency: draft.latency
+                        ? { ...draft.latency, min: Number(event.target.value) }
+                        : undefined,
+                    })
+                  }
+                />
+              </Field>
+              <Field
+                label="Maximum (seconds)"
+                info="latency.max"
+                error={
+                  complaintFor("latency.max", draft.latency?.max) ??
+                  errorFor("max")
+                }
+              >
+                <input
+                  className={controlClass}
+                  type="number"
+                  step="0.1"
+                  {...numericAttrs(rule("latency.max"))}
+                  value={draft.latency?.max ?? ""}
+                  disabled={!allowed || saving || !draft.latency}
+                  onChange={(event) =>
+                    patch({
+                      latency: draft.latency
+                        ? { ...draft.latency, max: Number(event.target.value) }
+                        : undefined,
+                    })
+                  }
+                />
+              </Field>
+            </div>
+          </Section>
+
+          {!isPublic && (
+            <Section title="Access overrides" summary={accessSummary(draft)}>
+              <p className="text-xs text-slate-500 dark:text-slate-400">
+                Empty means this proxy follows <code>admin.access</code>. A name
+                must be one
+                <code> admin.groups</code> allows.
+              </p>
+              {(["read", "update", "delete", "upload"] as const).map(
+                (action) => {
+                  const current = draft.access?.[action];
+                  const value =
+                    current === undefined
+                      ? ""
+                      : current === "public"
+                        ? "public"
+                        : current.join(", ");
+                  return (
+                    <Field
+                      key={action}
+                      label={action}
+                      info={`access.${action}`}
+                      error={errorFor(action)}
+                    >
+                      <input
+                        className={controlClass}
+                        placeholder="inherit"
+                        value={value}
+                        disabled={!allowed || saving}
+                        onChange={(event) => {
+                          const text = event.target.value.trim();
+                          const access = { ...draft.access };
+                          if (text === "") {
+                            delete access[action];
+                          } else if (text === "public") {
+                            access[action] = "public";
+                          } else {
+                            access[action] = text
+                              .split(",")
+                              .map((part) => part.trim())
+                              .filter(Boolean);
+                          }
+                          patch({
+                            access: Object.keys(access).length
+                              ? access
+                              : undefined,
+                          });
+                        }}
+                      />
+                    </Field>
+                  );
+                },
+              )}
+            </Section>
+          )}
+
+          {isPublic && draft.access !== undefined && (
+            <p className="text-xs text-slate-500 dark:text-slate-400">
+              This proxy has <code>access</code> overrides, and they are ignored
+              while the admin API is public: every action answers as public
+              regardless. They are still in the document -- the YAML mode shows
+              them.
+            </p>
+          )}
+
+          <Section
+            title="Mocks"
+            summary={
+              (draft.mocks?.length ?? 0) === 0
+                ? "none"
+                : `${draft.mocks?.length ?? 0}`
+            }
+          >
+            {(draft.mocks ?? []).map((mock, index) => (
+              <MockEditor
+                key={index}
+                mock={mock}
+                index={index}
+                disabled={!allowed || saving}
+                errorFor={errorFor}
+                rule={rule}
+                valueRule={valueRule}
+                onChange={(next) => {
+                  const mocks = [...(draft.mocks ?? [])];
+                  mocks[index] = next;
+                  patch({ mocks });
+                }}
+                onRemove={() => {
+                  const mocks = (draft.mocks ?? []).filter(
+                    (_, at) => at !== index,
+                  );
+                  patch({ mocks: mocks.length ? mocks : undefined });
+                }}
+              />
+            ))}
+            <Button
+              disabled={!allowed || saving}
+              onClick={() =>
+                patch({
+                  mocks: [
+                    ...(draft.mocks ?? []),
+                    emptyMock((draft.mocks ?? []).length),
+                  ],
+                })
+              }
+            >
+              Add a mock
+            </Button>
+          </Section>
+        </>
+      )}
+
+      {confirming ? (
+        <ConfirmDialog
+          question="Save these removals?"
+          detail={
+            <>
+              <p>This save takes the following out of the document:</p>
+              <ul className="mt-1 list-disc pl-5">
+                {confirming.map((gone) => (
+                  <li key={gone}>{gone}</li>
+                ))}
+              </ul>
+            </>
+          }
+          confirmLabel="Save changes"
+          onConfirm={save}
+          onCancel={() => setConfirming(undefined)}
+        />
+      ) : null}
+
+      {/*
+        Sticky, because the form is long enough that the button was a scroll away
+        from whatever was just typed. `bottom-0` inside the page's scroll container,
+        with the page's own background under it -- a transparent bar over a table of
+        inputs is unreadable at exactly the moment it matters.
+      */}
+      <div className="sticky bottom-0 -mx-4 mt-2 flex items-center gap-2 border-t border-slate-200 bg-white px-4 py-3 dark:border-slate-800 dark:bg-slate-950">
+        <Button
+          variant="primary"
+          onClick={attempt}
+          disabled={
+            !allowed ||
+            saving ||
+            broken !== undefined ||
+            !draft.name.trim() ||
+            !draft.url.trim()
+          }
+          reason={
+            broken ??
+            (editing
+              ? "This token may not change this proxy"
+              : "This token may not create proxies")
+          }
+        >
+          {saving ? "Saving..." : editing ? "Save changes" : "Create proxy"}
+        </Button>
+        <Button onClick={() => void navigate("/")} disabled={saving}>
+          Cancel
+        </Button>
+        {revision ? (
+          <span className="ml-auto font-mono text-xs text-slate-500 dark:text-slate-400">
+            {revision}
+          </span>
+        ) : null}
+      </div>
+    </section>
+  );
+}
diff --git a/frontend/src/pages/StatusPage.tsx b/frontend/src/pages/StatusPage.tsx
new file mode 100644
index 0000000..5e3244b
--- /dev/null
+++ b/frontend/src/pages/StatusPage.tsx
@@ -0,0 +1,116 @@
+import { useCallback, useEffect, useState } from 'react'
+
+import { Banner } from '../components/Banner'
+import { Retry } from '../components/Retry'
+import { Button } from '../components/Button'
+import { Spinner } from '../components/Spinner'
+import type { ReloadReport, Status } from '../types/api'
+import { ApiError } from '../types/error'
+import { useMay } from '../store/access'
+import { useToasts } from '../store/toast'
+import { fetchStatus, reload } from '../services/status'
+
+/**
+ * What the process is serving, and the button that makes it re-read the store.
+ *
+ * `/status` is unauthenticated by design, so this page works with no token -- but
+ * the reload button is a write in every sense that matters, so it is gated on
+ * `update` like one.
+ */
+export default function StatusPage() {
+  const [status, setStatus] = useState<Status>()
+  const [error, setError] = useState<ApiError>()
+  const [report, setReport] = useState<ReloadReport>()
+  const may = useMay()
+  const push = useToasts((state) => state.push)
+
+  const load = useCallback(() => {
+    fetchStatus()
+      .then((next) => {
+        setStatus(next)
+        setError(undefined)
+      })
+      .catch((caught: ApiError) => setError(caught))
+  }, [])
+
+  useEffect(load, [load])
+
+  const onReload = () => {
+    reload()
+      .then((next) => {
+        setReport(next)
+        push('done', `Reloaded at revision ${next.revision}`)
+        load()
+      })
+      .catch((caught: ApiError) => push('failed', caught.message))
+  }
+
+  return (
+    <section className="flex flex-col gap-4">
+      <div className="flex items-center gap-3">
+        <h2 className="text-base font-semibold text-slate-900 dark:text-slate-100">Status</h2>
+        <Button
+          variant="primary"
+          onClick={onReload}
+          disabled={!may('update')}
+          reason="This token may not reload the configuration"
+        >
+          Reload configuration
+        </Button>
+      </div>
+
+      {error ? (
+        <Banner kind="error" action={<Retry error={error} onRetry={() => void load()} />}>
+          {error.message}
+        </Banner>
+      ) : null}
+
+      {report ? (
+        <Banner kind="note">
+          {`Revision ${report.revision}, ${report.proxies} proxies.`}
+          {report.unapplied?.length
+            ? `\nNeeds a restart to take effect: ${report.unapplied.join(', ')}`
+            : ''}
+        </Banner>
+      ) : null}
+
+      {!status && !error ? <Spinner label="Reading status..." /> : null}
+
+      {status ? (
+        <dl className="grid grid-cols-[max-content_1fr] gap-x-4 gap-y-1 text-sm">
+          <dt className="text-slate-500 dark:text-slate-400">Uptime</dt>
+          <dd className="text-slate-900 dark:text-slate-100">{status.uptime_seconds}s</dd>
+          <dt className="text-slate-500 dark:text-slate-400">Revision</dt>
+          <dd className="font-mono text-slate-900 dark:text-slate-100">{status.revision}</dd>
+          <dt className="text-slate-500 dark:text-slate-400">Proxies</dt>
+          <dd className="text-slate-900 dark:text-slate-100">{status.proxies.length}</dd>
+        </dl>
+      ) : null}
+
+      {status?.proxies.length ? (
+        <table className="w-full text-left text-sm">
+          <thead className="text-slate-500 dark:text-slate-400">
+            <tr>
+              <th className="py-1">Proxy</th>
+              <th className="py-1">Upstream</th>
+              <th className="py-1">Resolve</th>
+              <th className="py-1">Mocks</th>
+            </tr>
+          </thead>
+          <tbody>
+            {status.proxies.map((proxy) => (
+              <tr key={proxy.name} className="border-t border-slate-200 dark:border-slate-800">
+                <td className="py-1 font-medium text-slate-900 dark:text-slate-100">{proxy.name}</td>
+                <td className="py-1 font-mono text-xs text-slate-700 dark:text-slate-300">
+                  {proxy.upstream}
+                </td>
+                <td className="py-1 text-slate-700 dark:text-slate-300">{proxy.resolve}</td>
+                <td className="py-1 text-slate-700 dark:text-slate-300">{proxy.mocks}</td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      ) : null}
+    </section>
+  )
+}
diff --git a/frontend/src/schema/__tests__/document.test.ts b/frontend/src/schema/__tests__/document.test.ts
new file mode 100644
index 0000000..a30bc99
--- /dev/null
+++ b/frontend/src/schema/__tests__/document.test.ts
@@ -0,0 +1,120 @@
+// Checking a whole document, and reporting it in words.
+//
+// Against the real schema, like `rules.test.ts`, and for the same reason: a fixture
+// would be a third copy of the rules. What is being tested here is not the validator
+// -- that is a library -- but the reduction of its output to the mistakes, which is
+// where the difference between "45 is greater than 1" and eleven lines of "a
+// subschema had errors" lives.
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import type { JsonSchema } from '../../types/schema'
+import { proxyChecker } from '../document'
+
+const schema = JSON.parse(
+  readFileSync(join(__dirname, '../../../../doppel-config.schema.json'), 'utf8'),
+) as JsonSchema
+
+const check = proxyChecker(schema)!
+
+/** The document `emptyMock` and the form's blank produce, which must be legal. */
+const MINIMAL = { name: 'alpha', type: 'http', url: 'https://alpha.example.com/api/' }
+
+describe('checking a proxy document', () => {
+  it('is built for the proxy definition rather than the whole configuration', () => {
+    expect(proxyChecker(schema)).toBeDefined()
+    // Nothing to check against is a state the page survives: the server still
+    // validates every save.
+    expect(proxyChecker(undefined)).toBeUndefined()
+    expect(proxyChecker({} as JsonSchema)).toBeUndefined()
+  })
+
+  it('accepts the documents the form produces', () => {
+    expect(check(MINIMAL)).toEqual([])
+    expect(
+      check({
+        ...MINIMAL,
+        timeout: 30,
+        body_limit: '4Mi',
+        resolve: { type: 'header', header: 'X-Proxy-Name' },
+        headers: { 'X-Injected': 'yes' },
+        replace: 0.25,
+        rewrite_redirects: false,
+        loss: { percentage: 0.05, status: 503 },
+        latency: { percentage: 0.5, min: 0.1, max: 1.5 },
+        access: { read: 'public', update: ['admin'] },
+        mocks: [
+          {
+            name: 'one-widget',
+            request: {
+              method: 'POST',
+              url: '^/widgets$',
+              body: { items: '.content.items' },
+            },
+            response: { status: 201, json: '{"ok": true}', headers: { 'X-Trace': '{{ id }}' } },
+          },
+        ],
+      }),
+    ).toEqual([])
+  })
+
+  it('names the field and the reason, once each', () => {
+    const troubles = check({
+      ...MINIMAL,
+      name: 'has space',
+      timeout: 5000,
+      loss: { percentage: 45, status: 700 },
+    })
+
+    expect(troubles).toEqual(
+      expect.arrayContaining([
+        { where: 'name', what: 'string does not match pattern' },
+        { where: 'timeout', what: '5000 is greater than 3600' },
+        { where: 'loss.percentage', what: '45 is greater than 1' },
+        { where: 'loss.status', what: '700 is greater than 599' },
+      ]),
+    )
+    // And nothing else: no "a subschema had errors", no "expected null" from the
+    // optional fields, no "does not match additional properties schema" for the four
+    // fields that are perfectly well known.
+    expect(troubles).toHaveLength(4)
+  })
+
+  it('calls an unknown field what it is', () => {
+    const troubles = check({ ...MINIMAL, timeuot: 30 })
+    expect(troubles).toEqual([{ where: 'timeuot', what: 'is not a field of this document' }])
+  })
+
+  it('reaches into a mock', () => {
+    const troubles = check({
+      ...MINIMAL,
+      mocks: [
+        {
+          name: 'ok',
+          request: { method: 'get', url: '^/$' },
+          response: { status: 99 },
+        },
+      ],
+    })
+    expect(troubles).toEqual(
+      expect.arrayContaining([
+        { where: 'mocks.0.response.status', what: '99 is less than 100' },
+      ]),
+    )
+    // Lower case `get` is refused by the enum, which is the mistake the reference
+    // and the schema both warn about.
+    expect(troubles.some((trouble) => trouble.where === 'mocks.0.request.method')).toBe(true)
+  })
+
+  it('says what is missing', () => {
+    const troubles = check({ type: 'http' })
+    const missing = troubles.filter((trouble) => trouble.what.includes('required'))
+    expect(missing.length).toBeGreaterThan(0)
+  })
+
+  it('refuses something that is not a document at all', () => {
+    // `load` returns a string for `hello`, which is not this function's business --
+    // but a list is an object, and the caller passes it through.
+    expect(check([]).length).toBeGreaterThan(0)
+  })
+})
diff --git a/frontend/src/schema/__tests__/removals.test.ts b/frontend/src/schema/__tests__/removals.test.ts
new file mode 100644
index 0000000..a85b34c
--- /dev/null
+++ b/frontend/src/schema/__tests__/removals.test.ts
@@ -0,0 +1,125 @@
+// What the save dialog will list.
+//
+// The interesting cases are the two kinds of quiet loss: a mock that is gone, and a
+// mock that is still there minus one of its entries. Both look identical on a page
+// scrolled past the section they were in.
+
+import type { ProxyConfig } from '../../types/proxy'
+import { removals } from '../removals'
+
+const BASE: ProxyConfig = {
+  name: 'alpha',
+  type: 'http',
+  url: 'https://alpha.example.com/api/',
+  headers: { 'X-Injected': 'yes', 'X-Other': 'no' },
+  access: { read: 'public', update: ['admin'] },
+  mocks: [
+    {
+      name: 'one-widget',
+      request: {
+        method: 'GET',
+        url: '^/widgets$',
+        headers: { trace: 'X-Trace-Id' },
+        query: { filter: '.filter' },
+      },
+      response: { status: 200, body: 'ok', headers: { 'X-Mocked': 'one-widget' } },
+    },
+    {
+      name: 'two-widgets',
+      request: { method: 'GET', url: '^/widgets/2$' },
+      response: { status: 200, template: 'two.json.j2' },
+    },
+  ],
+}
+
+/**
+ * `BASE` with one edit applied, so each case says only what it changes.
+ *
+ * Cloned through JSON rather than with `structuredClone`, which jsdom does not have.
+ * A proxy document is plain data by construction -- it goes over the wire as JSON --
+ * so the two are the same thing here.
+ */
+function edited(edit: (draft: ProxyConfig) => void): ProxyConfig {
+  const draft = JSON.parse(JSON.stringify(BASE)) as ProxyConfig
+  edit(draft)
+  return draft
+}
+
+describe('what a save would remove', () => {
+  it('says nothing about a document that lost nothing', () => {
+    expect(removals(BASE, BASE)).toEqual([])
+    // A changed value is not a removal: it is visible in the field the operator is
+    // looking at.
+    expect(removals(BASE, edited((draft) => (draft.url = 'https://beta.example.com/')))).toEqual([])
+    // Nor is something added.
+    expect(
+      removals(
+        BASE,
+        edited((draft) => {
+          draft.headers = { ...draft.headers, 'X-New': 'yes' }
+        }),
+      ),
+    ).toEqual([])
+  })
+
+  it('names a mock that is gone', () => {
+    const gone = removals(
+      BASE,
+      edited((draft) => {
+        draft.mocks = draft.mocks?.filter((mock) => mock.name !== 'one-widget')
+      }),
+    )
+    expect(gone).toContain('the mock `one-widget`')
+    // And nothing about the mock's own entries, which would be the same loss twice.
+    expect(gone).toHaveLength(1)
+  })
+
+  it('names an entry a surviving mock lost', () => {
+    const gone = removals(
+      BASE,
+      edited((draft) => {
+        delete draft.mocks![0]!.request.headers
+        delete draft.mocks![0]!.response.headers!['X-Mocked']
+      }),
+    )
+    expect(gone).toEqual([
+      '`trace` from variables from headers of `one-widget`',
+      '`X-Mocked` from response headers of `one-widget`',
+    ])
+  })
+
+  it('names an injected header and an access override', () => {
+    const gone = removals(
+      BASE,
+      edited((draft) => {
+        delete draft.headers!['X-Other']
+        delete draft.access!.update
+      }),
+    )
+    expect(gone).toEqual(['the injected header `X-Other`', 'the `update` access override'])
+  })
+
+  it('names a template file the answer was switched away from', () => {
+    // The one loss the form makes without a Remove button, and the one that cannot be
+    // undone by typing: the dashboard offers no way to name a template file.
+    const gone = removals(
+      BASE,
+      edited((draft) => {
+        draft.mocks![1]!.response = { status: 200, body: '' }
+      }),
+    )
+    expect(gone).toEqual(['the template file `two.json.j2` from `two-widgets`'])
+  })
+
+  it('reports every loss when a document is emptied out', () => {
+    const gone = removals(BASE, { name: 'alpha', type: 'http', url: BASE.url })
+    expect(gone).toEqual([
+      'the injected header `X-Injected`',
+      'the injected header `X-Other`',
+      'the `read` access override',
+      'the `update` access override',
+      'the mock `one-widget`',
+      'the mock `two-widgets`',
+    ])
+  })
+})
diff --git a/frontend/src/schema/__tests__/rules.test.ts b/frontend/src/schema/__tests__/rules.test.ts
new file mode 100644
index 0000000..1067ded
--- /dev/null
+++ b/frontend/src/schema/__tests__/rules.test.ts
@@ -0,0 +1,142 @@
+// The field rules, read out of the real schema.
+//
+// Against the checked-in `doppel-config.schema.json` rather than a fixture, on
+// purpose: a fixture would be a third copy of the bounds and would keep passing
+// after the types changed. The Rust drift test holds that file to what the code
+// generates, and `GET /api/v1/schema` serves the same document, so a rule proved
+// here is a rule the server enforces.
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import type { JsonSchema } from '../../types/schema'
+import { complain, numericAttrs, ruleAt, summarize, valueRuleAt } from '../rules'
+
+const schema = JSON.parse(
+  readFileSync(join(__dirname, '../../../../doppel-config.schema.json'), 'utf8'),
+) as JsonSchema
+
+describe('reading a rule out of the schema', () => {
+  it('finds a pattern and a length on a name', () => {
+    const rule = ruleAt(schema, 'name')
+    expect(rule?.pattern).toBe('^[A-Za-z0-9_-]{2,32}$')
+    expect(rule?.maxLength).toBe(32)
+    expect(rule?.required).toBe(true)
+  })
+
+  it('follows an optional field past the null branch to its bounds', () => {
+    // `timeout` is an `Option<TimeoutSeconds>`, which arrives as
+    // `oneOf: [{type: null}, {$ref}]` -- so a reader that stopped at the field
+    // would find no bounds at all.
+    const rule = ruleAt(schema, 'timeout')
+    expect(rule?.minimum).toBe(1)
+    expect(rule?.maximum).toBe(3600)
+    expect(rule?.type).toBe('integer')
+    expect(rule?.required).toBe(false)
+  })
+
+  it('walks into a nested object and into a list', () => {
+    expect(ruleAt(schema, 'loss.percentage')?.maximum).toBe(1)
+    expect(ruleAt(schema, 'latency.max')?.maximum).toBe(300)
+    expect(ruleAt(schema, 'mocks[].name')?.pattern).toBe('^[A-Za-z0-9_-]{2,64}$')
+    expect(ruleAt(schema, 'mocks[].response.status')?.minimum).toBe(100)
+    expect(ruleAt(schema, 'mocks[].request.method')?.enum).toContain('PATCH')
+  })
+
+  it('keeps both spellings of a field that accepts two', () => {
+    // `body_limit` is an integer or a string like `4Mi`.
+    const rule = ruleAt(schema, 'body_limit')
+    expect(rule?.either).toHaveLength(2)
+    expect(rule?.either?.[0]?.maximum).toBe(1073741824)
+  })
+
+  it('reads the value schema of a map', () => {
+    // The interesting half of a variable map: the selector has a pattern.
+    expect(valueRuleAt(schema, 'mocks[].request.query')?.pattern).toBe('^\\.[^.]+(\\.[^.]+)*$')
+  })
+
+  it('has nothing to say about a path it does not describe', () => {
+    expect(ruleAt(schema, 'nonesuch')).toBeUndefined()
+    expect(ruleAt(schema, 'mocks[].nonesuch')).toBeUndefined()
+    expect(ruleAt(undefined, 'name')).toBeUndefined()
+  })
+})
+
+describe('complaining about a value', () => {
+  const nameRule = ruleAt(schema, 'name')
+  const timeoutRule = ruleAt(schema, 'timeout')
+
+  it('says nothing about an empty box', () => {
+    // Empty is how the form spells an absent optional field, and an error under a
+    // field nobody has typed in yet is an accusation about the future.
+    expect(complain(nameRule, '')).toBeUndefined()
+    expect(complain(timeoutRule, undefined)).toBeUndefined()
+  })
+
+  it('says nothing about a legal value', () => {
+    expect(complain(nameRule, 'billing-api')).toBeUndefined()
+    expect(complain(timeoutRule, 30)).toBeUndefined()
+    expect(complain(ruleAt(schema, 'replace'), 0.25)).toBeUndefined()
+  })
+
+  it('explains a name that breaks the pattern in the schema words', () => {
+    // The message is the type's own description, so the page and the server say the
+    // same thing about the same rule.
+    expect(complain(nameRule, 'has space')).toBe(
+      'Letters, digits, - and _, between 2 and 32 characters.',
+    )
+    expect(complain(nameRule, 'a')).toBe('at least 2 characters')
+    expect(complain(nameRule, 'x'.repeat(33))).toBe('at most 32 characters; this is 33')
+  })
+
+  it('states a range as a range', () => {
+    expect(complain(timeoutRule, 0)).toBe('must be between 1 and 3600')
+    expect(complain(timeoutRule, 5000)).toBe('must be between 1 and 3600')
+    expect(complain(ruleAt(schema, 'loss.percentage'), 45)).toBe('must be between 0 and 1')
+    expect(complain(ruleAt(schema, 'mocks[].response.status'), 99)).toBe(
+      'must be between 100 and 599',
+    )
+  })
+
+  it('refuses a fraction where the type is whole', () => {
+    expect(complain(timeoutRule, 1.5)).toBe('must be a whole number')
+  })
+
+  it('accepts either spelling of a two-shaped field, and refuses neither', () => {
+    const rule = ruleAt(schema, 'body_limit')
+    expect(complain(rule, '4Mi')).toBeUndefined()
+    expect(complain(rule, '1048576')).toBeUndefined()
+    // Digits are the integer spelling, so the integer branch's bound applies. The
+    // string branch carries no bound -- judging by it would let this through and
+    // leave the refusal to the server.
+    expect(complain(rule, '9999999999')).toBe('must be between 1 and 1073741824')
+    expect(complain(rule, '0')).toBe('must be between 1 and 1073741824')
+  })
+
+  it('checks a selector as it is typed', () => {
+    const rule = valueRuleAt(schema, 'mocks[].request.body')
+    expect(complain(rule, '.content.items')).toBeUndefined()
+    expect(complain(rule, 'content.items')).toBe(
+      'A selector addressing object keys: a leading dot, then dot-separated field names, as in .content.items.',
+    )
+  })
+})
+
+describe('the attributes a number input can carry', () => {
+  it('takes the range from the schema, and a step only for whole numbers', () => {
+    expect(numericAttrs(ruleAt(schema, 'timeout'))).toEqual({ min: 1, max: 3600, step: 1 })
+    expect(numericAttrs(ruleAt(schema, 'latency.min'))).toEqual({ min: 0, max: 300 })
+  })
+
+  it('has nothing to add to a text field', () => {
+    expect(numericAttrs(ruleAt(schema, 'name'))).toEqual({})
+    expect(numericAttrs(undefined)).toEqual({})
+  })
+})
+
+describe('summarizing a description', () => {
+  it('keeps the first sentence and drops the markup', () => {
+    expect(summarize('One thing. And then another thing entirely.')).toBe('One thing.')
+    expect(summarize('A `code` word.')).toBe('A code word.')
+    expect(summarize(undefined)).toBeUndefined()
+  })
+})
diff --git a/frontend/src/schema/document.ts b/frontend/src/schema/document.ts
new file mode 100644
index 0000000..261181a
Binary files /dev/null and b/frontend/src/schema/document.ts differ
diff --git a/frontend/src/schema/removals.ts b/frontend/src/schema/removals.ts
new file mode 100644
index 0000000..d834bfe
--- /dev/null
+++ b/frontend/src/schema/removals.ts
@@ -0,0 +1,75 @@
+// What a save would take away, in the words the form uses for it.
+//
+// A form full of Remove buttons has no undo, and the button that commits all of them
+// says only "Save changes". So the save asks first, and this is what it asks about:
+// the entries the document had when it was read and does not have now.
+//
+// Only removals. A changed value is visible in the field it is in -- the operator is
+// looking at it -- while a removal leaves nothing behind to notice, which is exactly
+// the edit worth confirming.
+
+import type { MockConfig, ProxyConfig } from '../types/proxy'
+
+/** The keys `before` had and `after` does not. */
+function goneFrom(
+  before: Record<string, string> | undefined,
+  after: Record<string, string> | undefined,
+): string[] {
+  const kept = new Set(Object.keys(after ?? {}))
+  return Object.keys(before ?? {}).filter((key) => !kept.has(key))
+}
+
+/** One mock's maps, by the name the form gives each. */
+function mockMaps(mock: MockConfig): Array<[string, Record<string, string> | undefined]> {
+  return [
+    ['variables from headers', mock.request.headers],
+    ['variables from the query', mock.request.query],
+    ['variables from the body', mock.request.body],
+    ['response headers', mock.response.headers],
+  ]
+}
+
+/**
+ * Everything a save would remove, one sentence each, in the order the form shows it.
+ *
+ * Named rather than counted: "2 mocks" is a number to check against a page the
+ * operator has already scrolled past, while `one-widget` is the thing they either
+ * meant to remove or did not.
+ */
+export function removals(before: ProxyConfig, after: ProxyConfig): string[] {
+  const gone: string[] = []
+
+  for (const key of goneFrom(before.headers, after.headers)) {
+    gone.push(`the injected header \`${key}\``)
+  }
+
+  for (const action of ['read', 'update', 'delete', 'upload'] as const) {
+    if (before.access?.[action] !== undefined && after.access?.[action] === undefined) {
+      gone.push(`the \`${action}\` access override`)
+    }
+  }
+
+  const kept = new Map((after.mocks ?? []).map((mock) => [mock.name, mock]))
+  for (const mock of before.mocks ?? []) {
+    const survivor = kept.get(mock.name)
+    if (!survivor) {
+      gone.push(`the mock \`${mock.name}\``)
+      continue
+    }
+    // A mock that is still there can have lost parts of itself.
+    for (const [what, map] of mockMaps(mock)) {
+      const surviving = mockMaps(survivor).find(([name]) => name === what)?.[1]
+      for (const key of goneFrom(map, surviving)) {
+        gone.push(`\`${key}\` from ${what} of \`${mock.name}\``)
+      }
+    }
+    if (mock.response.template !== undefined && survivor.response.template === undefined) {
+      // The one removal the form makes without a Remove button: switching a mock's
+      // answer away from its template file drops the name, and the name cannot be
+      // typed back in -- templates are the API's, not this page's.
+      gone.push(`the template file \`${mock.response.template}\` from \`${mock.name}\``)
+    }
+  }
+
+  return gone
+}
diff --git a/frontend/src/schema/rules.ts b/frontend/src/schema/rules.ts
new file mode 100644
index 0000000..93795e9
--- /dev/null
+++ b/frontend/src/schema/rules.ts
@@ -0,0 +1,293 @@
+// What a field is allowed to hold, read out of the schema the server serves.
+//
+// The point of this file is that there is no second copy of the rules. `ProxyName`
+// says "letters, digits, - and _, 2 to 32" in one place -- a Rust newtype -- and
+// that reaches the page as a `pattern` and a `maxLength` through
+// `GET /api/v1/schema`. A rule added there shows up here without anyone editing
+// here, and a rule loosened there cannot leave a stricter copy behind.
+//
+// The server still decides. These bounds are the subset a single field can be
+// judged by on its own; anything that needs two fields -- `min <= max`, a template
+// a mock must declare, a name nothing else uses -- is refused on save and reported
+// against the field it is about.
+
+import type { JsonSchema } from '../types/schema'
+
+/** The bounds on one field, flattened out of the schema. */
+export interface Rule {
+  type?: string
+  description?: string
+  examples?: unknown[]
+  pattern?: string
+  minLength?: number
+  maxLength?: number
+  minimum?: number
+  maximum?: number
+  enum?: unknown[]
+  /** The field's parent lists it as required. */
+  required?: boolean
+  /**
+   * The alternatives, when a field accepts more than one shape.
+   *
+   * `body_limit` is `1048576` or `"1Mi"`, and a value is legal if it satisfies
+   * either -- which is what `oneOf` means and what `complain` implements.
+   */
+  either?: Rule[]
+}
+
+/** Follow a `$ref` to the definition it names. */
+function deref(node: JsonSchema, root: JsonSchema): JsonSchema {
+  const ref = node.$ref
+  if (!ref) {
+    return node
+  }
+  const name = ref.replace('#/$defs/', '')
+  return root.$defs?.[name] ?? node
+}
+
+/**
+ * The schema of a value, with the wrappers taken off.
+ *
+ * `Option<T>` arrives as `oneOf: [{type: null}, {$ref}]`, so an optional field's
+ * bounds are one level below where a reader looks for them. The null branch is
+ * dropped -- absent is always legal here, and a form spells absent as an empty box
+ * -- and a single remaining branch is followed. Two real branches are kept, in
+ * `either`.
+ */
+function unwrap(node: JsonSchema, root: JsonSchema): JsonSchema {
+  const resolved = deref(node, root)
+  if (!resolved.oneOf) {
+    return resolved
+  }
+  const real = resolved.oneOf.filter((branch) => branch.type !== 'null')
+  if (real.length === 1 && real[0]) {
+    // The description usually sits on the field or the wrapper rather than on the
+    // branch, so it is carried down.
+    return { description: resolved.description, ...deref(real[0], root) }
+  }
+  return resolved
+}
+
+/** Turn a resolved node into a rule, resolving a two-branch union as well. */
+function ruleOf(node: JsonSchema, root: JsonSchema, required: boolean): Rule {
+  // Named one by one rather than spread: what a rule holds is a short, closed list,
+  // and spreading the node would quietly carry `properties` and `$defs` into every
+  // rule for the sake of three fewer lines.
+  const rule: Rule = {
+    // A list of types is legal JSON Schema and nothing here emits one, so the first
+    // is taken rather than a union being invented for a case that does not arise.
+    type: Array.isArray(node.type) ? node.type[0] : node.type,
+    description: node.description,
+    examples: node.examples,
+    pattern: node.pattern,
+    minLength: node.minLength,
+    maxLength: node.maxLength,
+    minimum: node.minimum,
+    maximum: node.maximum,
+    enum: node.enum,
+    required,
+  }
+  if (node.oneOf) {
+    const real = node.oneOf.filter((branch) => branch.type !== 'null')
+    if (real.length > 1) {
+      rule.either = real.map((branch) => ruleOf(deref(branch, root), root, required))
+    }
+  }
+  return rule
+}
+
+/**
+ * The rule for a field of a proxy document, by path.
+ *
+ * `name`, `loss.percentage`, `mocks[].request.url`: the path the form uses to talk
+ * about a field, where `[]` is a list's element. Undefined when the schema has not
+ * arrived yet or does not describe that path -- a caller then simply has nothing to
+ * check, which is the state the page starts in.
+ */
+export function ruleAt(root: JsonSchema | undefined, path: string): Rule | undefined {
+  if (!root) {
+    return undefined
+  }
+  let node = unwrap({ $ref: '#/$defs/ProxyConfig' }, root)
+  let required = true
+
+  for (const segment of path.split('.')) {
+    const list = segment.endsWith('[]')
+    const key = list ? segment.slice(0, -2) : segment
+
+    const property = node.properties?.[key]
+    if (!property) {
+      return undefined
+    }
+    required = node.required?.includes(key) ?? false
+    node = unwrap(property, root)
+
+    if (list) {
+      if (!node.items) {
+        return undefined
+      }
+      node = unwrap(node.items, root)
+    }
+  }
+
+  return ruleOf(node, root, required)
+}
+
+/**
+ * The rule for the values of a map field, such as a header or a variable map.
+ *
+ * The values are the interesting half: a variable's selector has a pattern, and a
+ * key is a name the server checks. `additionalProperties` is where the value schema
+ * lives.
+ */
+export function valueRuleAt(root: JsonSchema | undefined, path: string): Rule | undefined {
+  if (!root) {
+    return undefined
+  }
+  const parent = mapNodeAt(root, path)
+  const values = parent?.additionalProperties
+  if (!values || typeof values === 'boolean') {
+    return undefined
+  }
+  return ruleOf(unwrap(values, root), root, false)
+}
+
+/** The map field itself, for `valueRuleAt`. */
+function mapNodeAt(root: JsonSchema, path: string): JsonSchema | undefined {
+  let node: JsonSchema = unwrap({ $ref: '#/$defs/ProxyConfig' }, root)
+  for (const segment of path.split('.')) {
+    const list = segment.endsWith('[]')
+    const key = list ? segment.slice(0, -2) : segment
+    const property = node.properties?.[key]
+    if (!property) {
+      return undefined
+    }
+    node = unwrap(property, root)
+    if (list) {
+      if (!node.items) {
+        return undefined
+      }
+      node = unwrap(node.items, root)
+    }
+  }
+  return node
+}
+
+/**
+ * The first sentence of a schema description, as a sentence a control can show.
+ *
+ * The descriptions come from Rust doc comments, so they are Markdown and some run
+ * to a paragraph. A field's error line has room for one sentence, and the first one
+ * is the one that states the rule.
+ */
+export function summarize(description: string | undefined): string | undefined {
+  if (!description) {
+    return undefined
+  }
+  const plain = description.replace(/`/g, '')
+  const stop = plain.indexOf('. ')
+  const first = stop === -1 ? plain : plain.slice(0, stop + 1)
+  return first.split('\n')[0]?.trim()
+}
+
+/**
+ * What is wrong with this value, in one sentence, or nothing.
+ *
+ * Empty is never a complaint. An empty box is how the form spells an absent
+ * optional field, and a required one that is empty is why the save button is
+ * disabled -- an error under a field nobody has typed in yet is an accusation about
+ * the future.
+ */
+export function complain(rule: Rule | undefined, value: unknown): string | undefined {
+  if (!rule || value === undefined || value === null || value === '') {
+    return undefined
+  }
+
+  // A union is legal if a branch accepts it -- but only the branches that describe
+  // the way this value is spelled. `body_limit` is `1048576` or `"4Mi"`, and both
+  // arrive from the form as text: judging `9999999999` by the string branch would
+  // find no bound at all and let a value through that the server refuses, because
+  // the bound on the number lives on the integer branch. Digits are the integer
+  // spelling; anything else is the other one.
+  if (rule.either) {
+    const digits = /^-?\d+(\.\d+)?$/.test(String(value).trim())
+    const numbers = rule.either.filter(
+      (branch) => branch.type === 'integer' || branch.type === 'number',
+    )
+    const rest = rule.either.filter((branch) => !numbers.includes(branch))
+    const branches = digits ? (numbers.length ? numbers : rest) : rest.length ? rest : numbers
+
+    const complaints = branches.map((branch) => complain(branch, value))
+    return complaints.every(Boolean) ? complaints[0] : undefined
+  }
+
+  if (typeof value === 'number') {
+    return numeric(rule, value)
+  }
+
+  const text = String(value)
+
+  if (rule.enum && !rule.enum.includes(text)) {
+    return `must be one of ${rule.enum.join(', ')}`
+  }
+  if (rule.maxLength !== undefined && text.length > rule.maxLength) {
+    return `at most ${rule.maxLength} characters; this is ${text.length}`
+  }
+  if (rule.minLength !== undefined && text.length < rule.minLength) {
+    return `at least ${rule.minLength} characters`
+  }
+  if (rule.pattern && !new RegExp(rule.pattern).test(text)) {
+    // The description states the rule the pattern encodes -- "letters, digits, -
+    // and _, between 2 and 32 characters" -- and is a better sentence than the
+    // pattern is. The pattern is the fallback for a type whose description says
+    // something else.
+    return summarize(rule.description) ?? `must match ${rule.pattern}`
+  }
+  // A number typed into a text box still has bounds to respect: `body_limit` is a
+  // string field whose integer spelling has a maximum.
+  if (rule.type === 'integer' || rule.type === 'number') {
+    const parsed = Number(text)
+    return Number.isFinite(parsed) ? numeric(rule, parsed) : undefined
+  }
+  return undefined
+}
+
+function numeric(rule: Rule, value: number): string | undefined {
+  const { minimum, maximum } = rule
+  const low = minimum !== undefined && value < minimum
+  const high = maximum !== undefined && value > maximum
+  if (!low && !high) {
+    return rule.type === 'integer' && !Number.isInteger(value)
+      ? 'must be a whole number'
+      : undefined
+  }
+  if (minimum !== undefined && maximum !== undefined) {
+    return `must be between ${minimum} and ${maximum}`
+  }
+  return low ? `must be at least ${minimum}` : `must be at most ${maximum}`
+}
+
+/**
+ * The bounds a number input can enforce itself, as attributes.
+ *
+ * The browser's own spinners and keyboard then stay inside the range, which is a
+ * cheaper way to say "1 to 3600" than a message after the fact -- and the message
+ * is still there for a pasted value.
+ */
+export function numericAttrs(rule: Rule | undefined): {
+  min?: number
+  max?: number
+  step?: number
+} {
+  if (!rule || (rule.type !== 'integer' && rule.type !== 'number')) {
+    return {}
+  }
+  return {
+    min: rule.minimum,
+    max: rule.maximum,
+    // Only for integers. A fractional step is a decision about how finely this
+    // particular value is worth nudging, which the schema does not hold and the
+    // form does.
+    ...(rule.type === 'integer' ? { step: 1 } : {}),
+  }
+}
diff --git a/frontend/src/services/__tests__/auth.test.ts b/frontend/src/services/__tests__/auth.test.ts
new file mode 100644
index 0000000..cdd8b15
--- /dev/null
+++ b/frontend/src/services/__tests__/auth.test.ts
@@ -0,0 +1,92 @@
+import { TOKEN_LIFETIME_MS, clearToken, isRefused, loadToken, refuse, saveToken, touchToken } from '../auth'
+
+beforeEach(() => {
+  localStorage.clear()
+  sessionStorage.clear()
+})
+
+describe('the stored token', () => {
+  it('comes back until it ages out', () => {
+    const entered = 1_000_000
+    saveToken('root-token', entered)
+
+    expect(loadToken(entered)).toBe('root-token')
+    expect(loadToken(entered + TOKEN_LIFETIME_MS - 1)).toBe('root-token')
+    // The boundary is the interesting case: at exactly an hour it is gone, so
+    // "expires after an hour" is not a claim that quietly means "after an hour
+    // and a bit".
+    expect(loadToken(entered + TOKEN_LIFETIME_MS)).toBeUndefined()
+  })
+
+  it('is erased when it ages out, not merely hidden', () => {
+    saveToken('root-token', 0)
+    expect(loadToken(TOKEN_LIFETIME_MS)).toBeUndefined()
+    // Left behind, the next read would make the same judgement again -- and a
+    // stale admin token sitting in storage is exactly what the lifetime is for.
+    expect(localStorage.getItem('doppel.token')).toBeNull()
+  })
+
+  it('treats an unreadable entry as absent and clears it', () => {
+    localStorage.setItem('doppel.token', 'not json')
+    expect(loadToken()).toBeUndefined()
+    expect(localStorage.getItem('doppel.token')).toBeNull()
+
+    localStorage.setItem('doppel.token', JSON.stringify({ token: 42 }))
+    expect(loadToken()).toBeUndefined()
+  })
+
+  it('is gone after signing out', () => {
+    saveToken('root-token')
+    clearToken()
+    expect(loadToken()).toBeUndefined()
+  })
+})
+
+describe('declining the dialog', () => {
+  it('is remembered for the tab and withdrawn by entering a token', () => {
+    expect(isRefused()).toBe(false)
+    refuse()
+    expect(isRefused()).toBe(true)
+
+    // Entering a token means the operator is no longer declining, so signing out
+    // later has to offer the dialog again rather than staying silent.
+    saveToken('root-token')
+    expect(isRefused()).toBe(false)
+  })
+
+  it('is kept out of localStorage, so it does not outlive the tab', () => {
+    refuse()
+    expect(localStorage.getItem('doppel.token.refused')).toBeNull()
+    expect(sessionStorage.getItem('doppel.token.refused')).toBe('yes')
+  })
+})
+
+describe('touchToken', () => {
+  it('slides the hour so an operator using the page is not asked again', () => {
+    saveToken('token-being-used-000000000000000000', 1_000)
+
+    // Fifty-nine minutes later: still valid, and the request pushes the window.
+    touchToken(1_000 + 59 * 60 * 1000)
+
+    // Two minutes after that -- past the original hour -- the token is still there,
+    // because the hour now runs from the last request rather than from the sign-in.
+    expect(loadToken(1_000 + 61 * 60 * 1000)).toBe('token-being-used-000000000000000000')
+  })
+
+  it('does not resurrect a token that has already aged out', () => {
+    saveToken('token-left-to-expire-00000000000000', 1_000)
+
+    // An hour and a minute with no requests. `loadToken` has deleted it, and
+    // touching must not write it back: the whole point of the lifetime is that an
+    // unattended browser stops holding a working token.
+    touchToken(1_000 + 61 * 60 * 1000)
+
+    expect(loadToken(1_000 + 61 * 60 * 1000)).toBeUndefined()
+    expect(localStorage.getItem('doppel.token')).toBeNull()
+  })
+
+  it('says nothing when there is no token at all', () => {
+    touchToken(5_000)
+    expect(localStorage.getItem('doppel.token')).toBeNull()
+  })
+})
diff --git a/frontend/src/services/__tests__/docs.test.ts b/frontend/src/services/__tests__/docs.test.ts
new file mode 100644
index 0000000..69bf05e
--- /dev/null
+++ b/frontend/src/services/__tests__/docs.test.ts
@@ -0,0 +1,58 @@
+// Where the dashboard sends a reader, and with which version in the URL.
+//
+// The anchors are checked against the generated reference by
+// `scripts/check_docs_links.py`; what is checked here is the rule that builds them,
+// because the script and this file have to agree on it.
+
+import { docsRoot, docsUrl, parameterAnchor, parameterUrl } from '../docs'
+import { forgetRuntimeConfig } from '../runtimeConfig'
+
+function serve(version: string): void {
+  document.head.innerHTML = `<script type="application/json" id="doppel-config">${JSON.stringify(
+    {
+      title: 'Doppel',
+      titleIsDefault: true,
+      public: false,
+      version,
+      authHeader: 'X-Proxy-Authorization',
+      refreshMs: 60000,
+      copyrightYear: 2026,
+    },
+  )}</script>`
+  forgetRuntimeConfig()
+}
+
+afterEach(forgetRuntimeConfig)
+
+describe('the documentation link', () => {
+  it('carries the version of the binary serving the page', () => {
+    // The site is published per version. A link to the unversioned root would show
+    // whoever followed it the rules of whatever has been released since.
+    serve('0.4.1')
+    expect(docsRoot()).toBe('https://lorem-dev.github.io/doppel/0.4.1/')
+    expect(docsUrl('usage/parameters/')).toBe(
+      'https://lorem-dev.github.io/doppel/0.4.1/usage/parameters/',
+    )
+
+    serve('9.9.9')
+    expect(docsRoot()).toBe('https://lorem-dev.github.io/doppel/9.9.9/')
+  })
+})
+
+describe('a parameter anchor', () => {
+  it('is the field path with the brackets gone and the dots turned to dashes', () => {
+    // The same rule `scripts/parameters_doc.py` writes into the page, and the
+    // script that compares the two spells it out for exactly this reason.
+    expect(parameterAnchor('name')).toBe('proxies-name')
+    expect(parameterAnchor('loss.percentage')).toBe('proxies-loss-percentage')
+    expect(parameterAnchor('mocks[].request.url')).toBe('proxies-mocks-request-url')
+    expect(parameterAnchor('mocks[].response.headers')).toBe('proxies-mocks-response-headers')
+  })
+
+  it('lands on the parameter reference for the running version', () => {
+    serve('0.4.1')
+    expect(parameterUrl('timeout')).toBe(
+      'https://lorem-dev.github.io/doppel/0.4.1/usage/parameters/#proxies-timeout',
+    )
+  })
+})
diff --git a/frontend/src/services/__tests__/http.test.ts b/frontend/src/services/__tests__/http.test.ts
new file mode 100644
index 0000000..824ebda
--- /dev/null
+++ b/frontend/src/services/__tests__/http.test.ts
@@ -0,0 +1,140 @@
+import { ApiError, TRANSPORT_CODE } from '../../types/error'
+import { request } from '../http'
+import { saveToken } from '../auth'
+import { forgetRuntimeConfig } from '../runtimeConfig'
+
+/** The configuration the page would have been served with. */
+const injectConfig = (authHeader = 'X-Proxy-Authorization'): void => {
+  document.head.innerHTML = `<script type="application/json" id="doppel-config">${JSON.stringify(
+    { title: 'Doppel', public: false, version: '0.4.1', authHeader, refreshMs: 60000 },
+  )}</script>`
+  forgetRuntimeConfig()
+}
+
+/** The last call's init, so header assertions do not need a mock library. */
+let lastInit: RequestInit | undefined
+
+/**
+ * Answer the next call with this status and body.
+ *
+ * A hand-built object rather than a real `Response`: jsdom provides no fetch, so
+ * `Response` is not a global here. This carries exactly the four members `http.ts`
+ * reads, which also means a fifth one appearing would fail loudly here rather
+ * than pass against a fake that quietly has everything.
+ */
+const respond = (status: number, body: string, statusText = ''): void => {
+  global.fetch = jest.fn((_url: unknown, init?: RequestInit) => {
+    lastInit = init
+    return Promise.resolve({
+      status,
+      statusText,
+      ok: status >= 200 && status < 300,
+      text: () => Promise.resolve(body),
+    } as unknown as Response)
+  }) as unknown as typeof fetch
+}
+
+beforeEach(() => {
+  localStorage.clear()
+  sessionStorage.clear()
+  lastInit = undefined
+  injectConfig()
+})
+
+describe('a successful call', () => {
+  it('parses the body', async () => {
+    respond(200, '{"proxies":[]}')
+    await expect(request<{ proxies: unknown[] }>('/api/v1/proxies')).resolves.toEqual({
+      proxies: [],
+    })
+  })
+
+  it('accepts 204 with no body', async () => {
+    respond(204, '')
+    await expect(request<void>('/api/v1/proxies/alpha/templates/x.json.j2')).resolves
+      .toBeUndefined()
+  })
+})
+
+describe('the token header', () => {
+  it('is absent when no token is held', async () => {
+    respond(200, '{}')
+    await request('/api/v1/access')
+    expect((lastInit?.headers as Record<string, string>)['X-Proxy-Authorization']).toBeUndefined()
+  })
+
+  it('uses the name the server configured, not the default', async () => {
+    // `admin.auth.header` is configurable, so a hard-coded name would send the
+    // token where nothing reads it and the page would look unauthenticated.
+    injectConfig('X-Admin-Token')
+    saveToken('root-token')
+    respond(200, '{}')
+    await request('/api/v1/access')
+
+    const headers = lastInit?.headers as Record<string, string>
+    expect(headers['X-Admin-Token']).toBe('Bearer root-token')
+    expect(headers['X-Proxy-Authorization']).toBeUndefined()
+  })
+})
+
+describe('a failed call', () => {
+  it('becomes an ApiError carrying the envelope', async () => {
+    respond(403, '{"status":"error","message":"token `reader` may not `create`","code":"FORBIDDEN"}')
+
+    const error = await request('/api/v1/proxies', { method: 'POST', body: {} }).catch(
+      (caught: unknown) => caught,
+    )
+    expect(error).toBeInstanceOf(ApiError)
+    const api = error as ApiError
+    expect(api.status).toBe(403)
+    expect(api.code).toBe('FORBIDDEN')
+    expect(api.message).toContain('may not `create`')
+    expect(api.isAuth).toBe(true)
+  })
+
+  it('survives a body that is not the envelope', async () => {
+    // A proxy in front of Doppel answers 502 with HTML. The operator still needs
+    // the status, not a parse error thrown from the error path.
+    respond(502, '<html><body>Bad Gateway</body></html>', 'Bad Gateway')
+
+    const error = (await request('/api/v1/proxies').catch((caught: unknown) => caught)) as ApiError
+    expect(error.status).toBe(502)
+    expect(error.code).toBe(TRANSPORT_CODE)
+    expect(error.message).toContain('502')
+  })
+
+  it('turns an unreachable server into an ApiError too', async () => {
+    global.fetch = jest.fn(() => Promise.reject(new Error('Failed to fetch'))) as unknown as typeof fetch
+
+    const error = (await request('/api/v1/proxies').catch((caught: unknown) => caught)) as ApiError
+    expect(error).toBeInstanceOf(ApiError)
+    expect(error.status).toBe(0)
+    expect(error.code).toBe(TRANSPORT_CODE)
+    expect(error.message).toContain('cannot reach')
+  })
+
+  it('reports a stale revision distinctly from an auth failure', async () => {
+    respond(409, '{"message":"revision moved","code":"REVISION_MISMATCH"}')
+    const error = (await request('/api/v1/proxies/alpha', { method: 'PUT' }).catch(
+      (caught: unknown) => caught,
+    )) as ApiError
+    expect(error.isStale).toBe(true)
+    expect(error.isAuth).toBe(false)
+  })
+})
+
+describe('a write', () => {
+  it('sends the revision as a quoted If-Match', async () => {
+    // Quoted because that is what an ETag is, and the server compares the value
+    // it sent -- which it sent quoted.
+    respond(200, '{"revision":"abc","proxy":{}}')
+    await request('/api/v1/proxies/alpha', {
+      method: 'PUT',
+      body: {},
+      ifMatch: '0123456789abcdef',
+    })
+
+    const headers = lastInit?.headers as Record<string, string>
+    expect(headers['If-Match']).toBe('"0123456789abcdef"')
+  })
+})
diff --git a/frontend/src/services/__tests__/runtimeConfig.test.ts b/frontend/src/services/__tests__/runtimeConfig.test.ts
new file mode 100644
index 0000000..c061222
--- /dev/null
+++ b/frontend/src/services/__tests__/runtimeConfig.test.ts
@@ -0,0 +1,58 @@
+import { forgetRuntimeConfig, readRuntimeConfig } from '../runtimeConfig'
+
+/**
+ * A page carrying `contents` in the configuration element, escaped the way the
+ * server escapes it.
+ *
+ * The escape is not incidental to the fixture -- it is the thing under test. An
+ * unescaped less-than closes the script element early, which is why the server
+ * replaces it, and a fixture that skipped the escape would be testing a page the
+ * server never serves.
+ */
+const page = (contents: string): Document => {
+  const escaped = contents.replace(/</g, '\\u003c')
+  const parsed = new DOMParser().parseFromString(
+    `<html><head><script type="application/json" id="doppel-config">${escaped}</script></head><body></body></html>`,
+    'text/html',
+  )
+  return parsed
+}
+
+afterEach(forgetRuntimeConfig)
+
+describe('the injected configuration', () => {
+  it('is read from the page', () => {
+    const config = readRuntimeConfig(
+      page(
+        '{"title":"Doppel (staging)","titleIsDefault":false,"public":true,"version":"0.4.1","authHeader":"X-Admin","refreshMs":60000,"copyrightYear":2026}',
+      ),
+    )
+    expect(config.title).toBe('Doppel (staging)')
+    expect(config.titleIsDefault).toBe(false)
+    expect(config.public).toBe(true)
+    expect(config.version).toBe('0.4.1')
+    expect(config.authHeader).toBe('X-Admin')
+    expect(config.refreshMs).toBe(60000)
+    expect(config.copyrightYear).toBe(2026)
+  })
+
+  it('carries a title containing markup through intact', () => {
+    // The server escapes the less-than so the element cannot be closed early;
+    // what arrives here is the operator's title, exactly as they wrote it.
+    const hostile = '</script><script>alert(1)</script>'
+    const config = readRuntimeConfig(page(JSON.stringify({ title: hostile })))
+    expect(config.title).toBe(hostile)
+  })
+
+  it('throws when the block is missing rather than inventing defaults', () => {
+    // Every default this could invent is wrong in a way somebody would have to
+    // debug: a made-up `public: false` shows a pointless dialog, and a made-up
+    // header name sends the token where nothing reads it.
+    const empty = new DOMParser().parseFromString('<html><body></body></html>', 'text/html')
+    expect(() => readRuntimeConfig(empty)).toThrow(/doppel-config/)
+  })
+
+  it('throws when the block is not an object', () => {
+    expect(() => readRuntimeConfig(page('"a string"'))).toThrow(/not an object/)
+  })
+})
diff --git a/frontend/src/services/access.ts b/frontend/src/services/access.ts
new file mode 100644
index 0000000..ed7a113
--- /dev/null
+++ b/frontend/src/services/access.ts
@@ -0,0 +1,8 @@
+// What the caller may do, from the server rather than guessed at.
+
+import type { AccessReport } from '../types/api'
+import { request } from './http'
+
+export function fetchAccess(): Promise<AccessReport> {
+  return request<AccessReport>('/api/v1/access')
+}
diff --git a/frontend/src/services/auth.ts b/frontend/src/services/auth.ts
new file mode 100644
index 0000000..c590fe9
--- /dev/null
+++ b/frontend/src/services/auth.ts
@@ -0,0 +1,105 @@
+// The token, in the browser.
+//
+// `localStorage` with a one-hour lifetime enforced on read. Two things this is
+// not, both worth saying plainly because the opposite is easy to assume:
+//
+//   - It is not a session. The token does not expire server-side; forgetting it
+//     here only means this browser stops presenting it. Revoking a token is a
+//     configuration change.
+//   - It is not a security boundary. Anything running in this page can read
+//     `localStorage`. The lifetime exists so an unattended browser stops holding
+//     a working admin token indefinitely, which is a different and smaller
+//     claim.
+
+const TOKEN_KEY = 'doppel.token'
+const REFUSED_KEY = 'doppel.token.refused'
+
+/** One hour, in milliseconds. */
+export const TOKEN_LIFETIME_MS = 60 * 60 * 1000
+
+interface StoredToken {
+  token: string
+  /** When it was entered, as epoch milliseconds. */
+  savedAt: number
+}
+
+/**
+ * The stored token, or `undefined` if there is none or it has aged out.
+ *
+ * An expired entry is deleted here rather than left to be cleaned up later: the
+ * next read would otherwise have to make the same judgement again, and one of
+ * the two callers would eventually forget.
+ */
+export function loadToken(now: number = Date.now()): string | undefined {
+  const raw = localStorage.getItem(TOKEN_KEY)
+  if (!raw) {
+    return undefined
+  }
+
+  let stored: StoredToken
+  try {
+    stored = JSON.parse(raw) as StoredToken
+  } catch {
+    // Written by an older version, or by hand. Unreadable is the same as absent,
+    // and leaving it would make every later read fail the same way.
+    localStorage.removeItem(TOKEN_KEY)
+    return undefined
+  }
+
+  if (typeof stored.token !== 'string' || typeof stored.savedAt !== 'number') {
+    localStorage.removeItem(TOKEN_KEY)
+    return undefined
+  }
+  if (now - stored.savedAt >= TOKEN_LIFETIME_MS) {
+    localStorage.removeItem(TOKEN_KEY)
+    return undefined
+  }
+  return stored.token
+}
+
+/**
+ * Push the stored token's hour out to start from now.
+ *
+ * Called on every request the page makes with a token, so the hour is a sliding
+ * window rather than a countdown from when it was typed. An operator who is using
+ * the dashboard is not asked for the token again in the middle of doing so, and one
+ * who walked away still loses it an hour after their last request -- which is the
+ * claim the lifetime was always making.
+ *
+ * Silent when there is nothing stored, or when what is stored has already aged out:
+ * `loadToken` is what decides that, and this must not resurrect an entry it would
+ * have deleted.
+ */
+export function touchToken(now: number = Date.now()): void {
+  const token = loadToken(now)
+  if (token !== undefined) {
+    localStorage.setItem(TOKEN_KEY, JSON.stringify({ token, savedAt: now } satisfies StoredToken))
+  }
+}
+
+export function saveToken(token: string, now: number = Date.now()): void {
+  const stored: StoredToken = { token, savedAt: now }
+  localStorage.setItem(TOKEN_KEY, JSON.stringify(stored))
+  // Entering a token withdraws an earlier refusal, so signing out later opens
+  // the dialog again rather than staying silent.
+  sessionStorage.removeItem(REFUSED_KEY)
+}
+
+export function clearToken(): void {
+  localStorage.removeItem(TOKEN_KEY)
+}
+
+/**
+ * Whether the operator has already declined to enter a token.
+ *
+ * In `sessionStorage`, not `localStorage`: the refusal is about this sitting at
+ * this tab, and remembering it forever would mean an operator who once said "not
+ * now" is never offered the dialog again.
+ */
+export function isRefused(): boolean {
+  return sessionStorage.getItem(REFUSED_KEY) === 'yes'
+}
+
+export function refuse(): void {
+  sessionStorage.setItem(REFUSED_KEY, 'yes')
+}
diff --git a/frontend/src/services/docs.ts b/frontend/src/services/docs.ts
new file mode 100644
index 0000000..4b2ad35
--- /dev/null
+++ b/frontend/src/services/docs.ts
@@ -0,0 +1,45 @@
+// Where the documentation is, for this version of Doppel.
+//
+// Every link out of the dashboard carries the running version. The site is
+// published per version -- `.../doppel/0.4.1/...`, with `latest` and `dev` as
+// aliases -- so a page served by 0.4.1 that linked to the current site would show
+// whoever followed it the rules of whatever has been released since. The version
+// comes from the injected configuration, which is the process's own.
+
+import { runtimeConfig } from './runtimeConfig'
+
+/** The published site, without a version. */
+const SITE = 'https://lorem-dev.github.io/doppel'
+
+/** The repository, which is not versioned and does not pretend to be. */
+export const REPOSITORY = 'https://github.com/lorem-dev/doppel'
+
+/** The documentation root for the running version, with its trailing slash. */
+export function docsRoot(): string {
+  return `${SITE}/${runtimeConfig().version}/`
+}
+
+/** A page of the documentation, by its path under the site root. */
+export function docsUrl(page: string): string {
+  return `${docsRoot()}${page}`
+}
+
+/**
+ * The anchor a configuration parameter is documented under.
+ *
+ * `mocks[].request.url` becomes `proxies-mocks-request-url`: brackets go, dots
+ * become dashes. `scripts/parameters_doc.py` writes exactly these anchors into
+ * `usage/parameters.md`, and `scripts/check_docs_links.py` fails the build if a path
+ * used here has no section there -- which is the only way an (i) that goes nowhere
+ * gets caught, since nothing in a browser reports a bad fragment.
+ */
+export function parameterAnchor(path: string): string {
+  // The form edits one proxy, so its paths are relative to a proxy document while
+  // the reference documents a whole configuration.
+  return `proxies.${path}`.replace(/\[\]/g, '').replace(/\./g, '-')
+}
+
+/** The section of the parameter reference for one field of a proxy. */
+export function parameterUrl(path: string): string {
+  return `${docsUrl('usage/parameters/')}#${parameterAnchor(path)}`
+}
diff --git a/frontend/src/services/http.ts b/frontend/src/services/http.ts
new file mode 100644
index 0000000..ef9018c
--- /dev/null
+++ b/frontend/src/services/http.ts
@@ -0,0 +1,121 @@
+// One place that talks to the API.
+//
+// Everything above this layer sees `ApiError` and typed results; nothing above it
+// sees a `Response`, a status code or the token header's name.
+
+import { ApiError, TRANSPORT_CODE } from '../types/error'
+import { runtimeConfig } from './runtimeConfig'
+import { loadToken, touchToken } from './auth'
+
+interface RequestOptions {
+  method?: 'GET' | 'POST' | 'PUT' | 'DELETE'
+  /** Sent as JSON. */
+  body?: unknown
+  /** Sent verbatim, for template content. */
+  text?: string
+  /** The revision a write was built from, sent as `If-Match`. */
+  ifMatch?: string
+}
+
+/** The server's error envelope. */
+interface ErrorBody {
+  status?: string
+  message?: string
+  code?: string
+}
+
+/**
+ * Call the admin API.
+ *
+ * Throws `ApiError` for anything that is not a 2xx, including a failure to reach
+ * the server at all -- a caller that has to distinguish "no network" from "403"
+ * before it can show a message would end up with two error paths and one of them
+ * untested.
+ */
+export async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {
+  const { authHeader } = runtimeConfig()
+  const headers: Record<string, string> = {}
+
+  const token = loadToken()
+  if (token) {
+    headers[authHeader] = `Bearer ${token}`
+    // The hour starts again from this request. Here rather than in a store, so
+    // every call the page makes counts -- the list refetching itself once a minute
+    // keeps a token alive while the tab is open and being looked at, and the pause
+    // on a hidden tab is what stops that from being forever.
+    touchToken()
+  }
+  if (options.body !== undefined) {
+    headers['Content-Type'] = 'application/json'
+  }
+  if (options.ifMatch) {
+    // Quoted, because that is what an ETag is. The server compares the value it
+    // sent, and it sent it quoted.
+    headers['If-Match'] = `"${options.ifMatch}"`
+  }
+
+  let response: Response
+  try {
+    response = await fetch(path, {
+      method: options.method ?? 'GET',
+      headers,
+      body: options.body === undefined ? options.text : JSON.stringify(options.body),
+      // The dashboard is served from the same origin it calls, so nothing here
+      // needs credentials or a cross-origin mode.
+      cache: 'no-store',
+    })
+  } catch (cause) {
+    throw new ApiError(
+      0,
+      TRANSPORT_CODE,
+      `cannot reach the admin API: ${cause instanceof Error ? cause.message : String(cause)}`,
+    )
+  }
+
+  if (response.status === 204) {
+    return undefined as T
+  }
+
+  const text = await response.text()
+
+  if (!response.ok) {
+    throw await failure(response, text)
+  }
+
+  if (!text) {
+    return undefined as T
+  }
+  try {
+    return JSON.parse(text) as T
+  } catch (cause) {
+    throw new ApiError(
+      response.status,
+      TRANSPORT_CODE,
+      `the API returned a body that is not JSON: ${cause instanceof Error ? cause.message : String(cause)}`,
+    )
+  }
+}
+
+/**
+ * Turn a failed response into an `ApiError`.
+ *
+ * A non-envelope body is expected rather than exceptional: a proxy in front of
+ * Doppel can answer 502 with HTML, and the operator still needs to be told the
+ * status rather than shown a parse error from the error path.
+ */
+async function failure(response: Response, text: string): Promise<ApiError> {
+  let envelope: ErrorBody
+  try {
+    envelope = JSON.parse(text) as ErrorBody
+  } catch {
+    envelope = {}
+  }
+
+  const message =
+    typeof envelope.message === 'string' && envelope.message
+      ? envelope.message
+      : `the API answered ${response.status} ${response.statusText}`
+  const code = typeof envelope.code === 'string' && envelope.code ? envelope.code : TRANSPORT_CODE
+
+  return new ApiError(response.status, code, message)
+}
diff --git a/frontend/src/services/proxies.ts b/frontend/src/services/proxies.ts
new file mode 100644
index 0000000..ad870f9
--- /dev/null
+++ b/frontend/src/services/proxies.ts
@@ -0,0 +1,46 @@
+// The proxy endpoints.
+
+import type { ProxyConfig, ProxyView } from '../types/proxy'
+import { request } from './http'
+
+interface ProxyList {
+  proxies: ProxyView[]
+}
+
+export async function listProxies(): Promise<ProxyView[]> {
+  const { proxies } = await request<ProxyList>('/api/v1/proxies')
+  return proxies
+}
+
+export function readProxy(name: string): Promise<ProxyView> {
+  return request<ProxyView>(`/api/v1/proxies/${encodeURIComponent(name)}`)
+}
+
+export function createProxy(proxy: ProxyConfig): Promise<ProxyView> {
+  return request<ProxyView>('/api/v1/proxies', { method: 'POST', body: { proxy } })
+}
+
+/**
+ * Replace a proxy, refusing to overwrite a change made since it was read.
+ *
+ * `revision` is not optional and deliberately so: the server answers 428 without
+ * it, and a caller that could omit it would eventually be a caller that does.
+ */
+export function updateProxy(
+  name: string,
+  revision: string,
+  proxy: ProxyConfig,
+): Promise<ProxyView> {
+  return request<ProxyView>(`/api/v1/proxies/${encodeURIComponent(name)}`, {
+    method: 'PUT',
+    body: { revision, proxy },
+    ifMatch: revision,
+  })
+}
+
+export function deleteProxy(name: string, revision: string): Promise<void> {
+  return request<void>(`/api/v1/proxies/${encodeURIComponent(name)}`, {
+    method: 'DELETE',
+    ifMatch: revision,
+  })
+}
diff --git a/frontend/src/services/runtimeConfig.ts b/frontend/src/services/runtimeConfig.ts
new file mode 100644
index 0000000..2e6a0c4
--- /dev/null
+++ b/frontend/src/services/runtimeConfig.ts
@@ -0,0 +1,51 @@
+// What the page was told by the HTML it arrived in.
+//
+// Read once, at module load. The values come from the admin listener, which
+// substitutes them into `index.html` per request, so they describe the process
+// serving this page rather than whatever a later fetch might find.
+
+import type { RuntimeConfig } from '../types/api'
+
+const ELEMENT_ID = 'doppel-config'
+
+/**
+ * Parse the injected configuration, or throw.
+ *
+ * Deliberately fatal. A missing block means the page was served by something
+ * other than Doppel's admin listener, and every default this could invent would
+ * be wrong in a way the operator would have to debug: a made-up `public: false`
+ * shows a token dialog on a public deployment, and a made-up header name sends
+ * the token where nothing reads it.
+ */
+export function readRuntimeConfig(document_: Document = document): RuntimeConfig {
+  const element = document_.getElementById(ELEMENT_ID)
+  if (!element?.textContent) {
+    throw new Error(
+      `the page has no #${ELEMENT_ID} block; it was not served by Doppel's admin listener`,
+    )
+  }
+
+  const parsed: unknown = JSON.parse(element.textContent)
+  if (typeof parsed !== 'object' || parsed === null) {
+    throw new Error(`#${ELEMENT_ID} is not an object: ${element.textContent}`)
+  }
+  return parsed as RuntimeConfig
+}
+
+/**
+ * The configuration, read once.
+ *
+ * A function rather than a const so a test can re-read it after replacing the
+ * document, and so the throw happens when something asks rather than at import.
+ */
+let cached: RuntimeConfig | undefined
+
+export function runtimeConfig(): RuntimeConfig {
+  cached ??= readRuntimeConfig()
+  return cached
+}
+
+/** Test seam: forget the cached configuration. */
+export function forgetRuntimeConfig(): void {
+  cached = undefined
+}
diff --git a/frontend/src/services/schema.ts b/frontend/src/services/schema.ts
new file mode 100644
index 0000000..d3e6dcd
--- /dev/null
+++ b/frontend/src/services/schema.ts
@@ -0,0 +1,15 @@
+// The configuration schema, from the process serving this page.
+
+import type { JsonSchema } from '../types/schema'
+import { request } from './http'
+
+/**
+ * `GET /api/v1/schema`.
+ *
+ * Fetched rather than bundled: it is 30 KB of JSON that every visitor would
+ * otherwise pay for, and a bundled copy would describe the version the assets were
+ * built from rather than the version that is running.
+ */
+export function fetchSchema(): Promise<JsonSchema> {
+  return request<JsonSchema>('/api/v1/schema')
+}
diff --git a/frontend/src/services/status.ts b/frontend/src/services/status.ts
new file mode 100644
index 0000000..9614799
--- /dev/null
+++ b/frontend/src/services/status.ts
@@ -0,0 +1,12 @@
+// The process endpoints.
+
+import type { ReloadReport, Status } from '../types/api'
+import { request } from './http'
+
+export function fetchStatus(): Promise<Status> {
+  return request<Status>('/api/v1/status')
+}
+
+export function reload(): Promise<ReloadReport> {
+  return request<ReloadReport>('/api/v1/config/reload', { method: 'POST' })
+}
diff --git a/frontend/src/store/__tests__/access.test.ts b/frontend/src/store/__tests__/access.test.ts
new file mode 100644
index 0000000..37dc971
--- /dev/null
+++ b/frontend/src/store/__tests__/access.test.ts
@@ -0,0 +1,62 @@
+import type { AccessReport } from '../../types/api'
+import { permits } from '../access'
+
+const report = (overrides: Partial<AccessReport> = {}): AccessReport => ({
+  caller: { kind: 'token', name: 'reader', group: 'user' },
+  global: { list: true, read: true, create: false, update: false, delete: false, upload: false },
+  ...overrides,
+})
+
+describe('permits()', () => {
+  it('refuses everything until the report arrives', () => {
+    // Assuming permitted and finding out on click is the button-that-does-nothing
+    // this endpoint exists to prevent. A briefly disabled control is the smaller
+    // cost.
+    expect(permits(undefined, 'list')).toBe(false)
+    expect(permits(undefined, 'create')).toBe(false)
+  })
+
+  it('answers from the global block', () => {
+    const only = report()
+    expect(permits(only, 'read')).toBe(true)
+    expect(permits(only, 'create')).toBe(false)
+  })
+
+  it('prefers a proxy override over the global answer', () => {
+    // The precedence the server applies, and the reason the map exists at all.
+    const overridden = report({
+        global: {
+          list: true,
+          read: false,
+          create: false,
+          update: false,
+          delete: false,
+          upload: false,
+        },
+        proxies: {
+          alpha: { read: true, update: false, delete: false, upload: false },
+          beta: { read: false, update: false, delete: false, upload: false },
+        },
+    })
+
+    expect(permits(overridden, 'read', 'alpha')).toBe(true)
+    expect(permits(overridden, 'read', 'beta')).toBe(false)
+    expect(permits(overridden, 'read')).toBe(false)
+  })
+
+  it('falls back to the global answer for an unlisted proxy', () => {
+    const mapped = report({
+      proxies: { alpha: { read: true, update: false, delete: false, upload: false } },
+    })
+    expect(permits(mapped, 'read', 'gamma')).toBe(true)
+  })
+
+  it('ignores the map for actions a proxy cannot override', () => {
+    // `list` and `create` are not about one proxy, and `ProxyAccessConfig` cannot
+    // spell them -- so passing a proxy name must not change the answer.
+    const mapped = report({
+      proxies: { alpha: { read: true, update: false, delete: false, upload: false } },
+    })
+    expect(permits(mapped, 'create', 'alpha')).toBe(false)
+  })
+})
diff --git a/frontend/src/store/__tests__/auth.test.ts b/frontend/src/store/__tests__/auth.test.ts
new file mode 100644
index 0000000..1f8e1e5
--- /dev/null
+++ b/frontend/src/store/__tests__/auth.test.ts
@@ -0,0 +1,84 @@
+import { forgetRuntimeConfig } from '../../services/runtimeConfig'
+import { saveToken } from '../../services/auth'
+
+/** Serve the page with this configuration and re-import the store. */
+async function withConfig(isPublic: boolean) {
+  document.head.innerHTML = `<script type="application/json" id="doppel-config">${JSON.stringify({
+    title: 'Doppel',
+    public: isPublic,
+    version: '0.4.1',
+    authHeader: 'X-Proxy-Authorization',
+    refreshMs: 60000,
+  })}</script>`
+  forgetRuntimeConfig()
+  // The dialog's initial state is decided when the store is created, so the
+  // module has to be fresh for each case.
+  jest.resetModules()
+  return import('../auth')
+}
+
+beforeEach(() => {
+  localStorage.clear()
+  sessionStorage.clear()
+})
+
+describe('the token dialog', () => {
+  it('opens unprompted when a token is needed and none is held', async () => {
+    const { useAuth } = await withConfig(false)
+    expect(useAuth.getState().dialogOpen).toBe(false)
+    // The shell asks on mount. Nothing is decided when the module loads, so a
+    // component test that imports this store does not need a served page.
+    useAuth.getState().askIfNeeded()
+    expect(useAuth.getState().dialogOpen).toBe(true)
+  })
+
+  it('stays shut on a public deployment', async () => {
+    // There are no tokens to present, so asking for one would be asking for
+    // something that does not exist.
+    const { useAuth } = await withConfig(true)
+    useAuth.getState().askIfNeeded()
+    expect(useAuth.getState().dialogOpen).toBe(false)
+  })
+
+  it('stays shut when a token is already held', async () => {
+    saveToken('root-token')
+    const { useAuth } = await withConfig(false)
+    useAuth.getState().askIfNeeded()
+    expect(useAuth.getState().dialogOpen).toBe(false)
+    expect(useAuth.getState().token).toBe('root-token')
+  })
+
+  it('stays shut for the rest of the tab once declined', async () => {
+    const first = await withConfig(false)
+    first.useAuth.getState().askIfNeeded()
+    first.useAuth.getState().decline()
+    expect(first.useAuth.getState().dialogOpen).toBe(false)
+
+    // A reload of the page, same tab: the refusal is remembered, so the operator
+    // is not asked again.
+    const second = await withConfig(false)
+    second.useAuth.getState().askIfNeeded()
+    expect(second.useAuth.getState().dialogOpen).toBe(false)
+  })
+})
+
+describe('signing out', () => {
+  it('drops the token and does not reopen the dialog', async () => {
+    saveToken('root-token')
+    const { useAuth } = await withConfig(false)
+
+    useAuth.getState().signOut()
+    expect(useAuth.getState().token).toBeUndefined()
+    // The page carries on anonymously, showing whatever a caller with no token
+    // may see. A blocking dialog would make "sign out" mean "leave".
+    expect(useAuth.getState().dialogOpen).toBe(false)
+    expect(localStorage.getItem('doppel.token')).toBeNull()
+  })
+
+  it('lets the dialog be opened again on purpose', async () => {
+    const { useAuth } = await withConfig(false)
+    useAuth.getState().decline()
+    useAuth.getState().openDialog()
+    expect(useAuth.getState().dialogOpen).toBe(true)
+  })
+})
diff --git a/frontend/src/store/__tests__/theme.test.ts b/frontend/src/store/__tests__/theme.test.ts
new file mode 100644
index 0000000..12009b0
--- /dev/null
+++ b/frontend/src/store/__tests__/theme.test.ts
@@ -0,0 +1,84 @@
+import { startTheme, useTheme } from '../theme'
+
+/** A `matchMedia` that reports `dark` and can announce a change. */
+function stubMatchMedia(dark: boolean): { announce: (dark: boolean) => void } {
+  let matches = dark
+  const listeners: Array<() => void> = []
+  Object.defineProperty(window, 'matchMedia', {
+    writable: true,
+    configurable: true,
+    value: () => ({
+      get matches() {
+        return matches
+      },
+      addEventListener: (_: string, listener: () => void) => listeners.push(listener),
+      removeEventListener: () => {},
+    }),
+  })
+  return {
+    announce: (next) => {
+      matches = next
+      for (const listener of listeners) {
+        listener()
+      }
+    },
+  }
+}
+
+beforeEach(() => {
+  localStorage.clear()
+  document.documentElement.className = ''
+})
+
+describe('the theme', () => {
+  it('follows the system when nothing was chosen', () => {
+    // The default is `system`, and `system` is not a synonym for light: an
+    // operator with a dark desktop should not be handed the one window that
+    // glows.
+    stubMatchMedia(true)
+    useTheme.setState({ choice: 'system', resolved: 'dark' })
+    startTheme()
+
+    expect(useTheme.getState().choice).toBe('system')
+    expect(document.documentElement.classList.contains('dark')).toBe(true)
+  })
+
+  it('keeps following the system while it changes', () => {
+    const media = stubMatchMedia(false)
+    useTheme.setState({ choice: 'system', resolved: 'light' })
+    startTheme()
+    expect(document.documentElement.classList.contains('dark')).toBe(false)
+
+    media.announce(true)
+    expect(useTheme.getState().resolved).toBe('dark')
+    expect(document.documentElement.classList.contains('dark')).toBe(true)
+  })
+
+  it('stops following the system once a choice is made', () => {
+    const media = stubMatchMedia(false)
+    startTheme()
+    useTheme.getState().set('light')
+
+    // A page someone set to light must not go dark because their desktop did.
+    media.announce(true)
+    expect(useTheme.getState().resolved).toBe('light')
+    expect(document.documentElement.classList.contains('dark')).toBe(false)
+  })
+
+  it('remembers the choice across a reload', () => {
+    stubMatchMedia(false)
+    useTheme.getState().set('dark')
+    expect(localStorage.getItem('doppel.theme')).toBe('dark')
+  })
+
+  it('survives a browser with no matchMedia at all', () => {
+    // Not hypothetical: jsdom is such a browser, and a store that threw on
+    // import would take every suite with it.
+    Object.defineProperty(window, 'matchMedia', {
+      writable: true,
+      configurable: true,
+      value: undefined,
+    })
+    expect(() => startTheme()).not.toThrow()
+  })
+})
diff --git a/frontend/src/store/__tests__/toast.test.ts b/frontend/src/store/__tests__/toast.test.ts
new file mode 100644
index 0000000..89bc18b
--- /dev/null
+++ b/frontend/src/store/__tests__/toast.test.ts
@@ -0,0 +1,51 @@
+import { TOAST_MS, useToasts } from '../toast'
+
+beforeEach(() => {
+  jest.useFakeTimers()
+  useToasts.setState({ items: [] })
+})
+afterEach(() => {
+  jest.useRealTimers()
+})
+
+describe('a toast', () => {
+  it('goes away on its own', () => {
+    // They only went away on click, so three reloads left three notices stacked in
+    // the corner for the rest of the session.
+    useToasts.getState().push('done', 'Reloaded')
+    expect(useToasts.getState().items).toHaveLength(1)
+
+    jest.advanceTimersByTime(TOAST_MS.done - 1)
+    expect(useToasts.getState().items).toHaveLength(1)
+    jest.advanceTimersByTime(1)
+    expect(useToasts.getState().items).toHaveLength(0)
+  })
+
+  it('gives a failure longer than a success', () => {
+    // The one an operator may want to copy, and the one that arrives while they are
+    // looking somewhere else.
+    expect(TOAST_MS.failed).toBeGreaterThan(TOAST_MS.done)
+
+    useToasts.getState().push('failed', 'Refused')
+    jest.advanceTimersByTime(TOAST_MS.done)
+    expect(useToasts.getState().items).toHaveLength(1)
+    jest.advanceTimersByTime(TOAST_MS.failed - TOAST_MS.done)
+    expect(useToasts.getState().items).toHaveLength(0)
+  })
+
+  it('can still be dismissed by hand before its time', () => {
+    useToasts.getState().push('done', 'Reloaded')
+    const [only] = useToasts.getState().items
+    useToasts.getState().dismiss(only!.id)
+    expect(useToasts.getState().items).toHaveLength(0)
+  })
+
+  it('keeps several apart, and expires each on its own clock', () => {
+    useToasts.getState().push('done', 'first')
+    jest.advanceTimersByTime(2000)
+    useToasts.getState().push('done', 'second')
+
+    jest.advanceTimersByTime(TOAST_MS.done - 2000)
+    expect(useToasts.getState().items.map((toast) => toast.text)).toEqual(['second'])
+  })
+})
diff --git a/frontend/src/store/access.ts b/frontend/src/store/access.ts
new file mode 100644
index 0000000..9475590
--- /dev/null
+++ b/frontend/src/store/access.ts
@@ -0,0 +1,88 @@
+// What the caller may do, as the server reports it.
+//
+// Consulted by every control that performs an action. The answer comes from
+// `GET /api/v1/access`, never from anything the page works out for itself: the
+// rules are per-proxy overrides on top of a global block on top of a `public`
+// flag, and a second implementation of that would eventually disagree with the
+// one enforcing it.
+
+import { useCallback } from 'react'
+import { create } from 'zustand'
+
+import type { AccessReport, Action, ProxyAction } from '../types/api'
+import { ApiError } from '../types/error'
+import { fetchAccess } from '../services/access'
+
+interface AccessState {
+  report?: AccessReport
+  error?: ApiError
+  refresh: () => Promise<void>
+}
+
+/**
+ * Whether `report` permits `action`, optionally against one proxy.
+ *
+ * `false` without a report. The alternative -- assume permitted, find out on
+ * click -- is exactly the button-that-does-nothing `/api/v1/access` exists to
+ * prevent, and a control disabled for the length of one request is the smaller
+ * cost.
+ *
+ * A free function rather than a method on the store: the precedence rules are the
+ * part worth getting right, and this is the only copy of them. `useMay` binds it
+ * to the current report for a component.
+ */
+export function permits(
+  report: AccessReport | undefined,
+  action: Action,
+  proxy?: string,
+): boolean {
+  if (!report) {
+    return false
+  }
+  // A proxy's own `access` block wins over the global one for the four actions it
+  // may override -- the same precedence the server applies.
+  if (proxy && report.proxies && isProxyAction(action)) {
+    const entry = report.proxies[proxy]
+    if (entry) {
+      return entry[action]
+    }
+  }
+  return report.global[action]
+}
+
+/**
+ * `permits`, bound to the current report, for a component.
+ *
+ * Not `useAccess((state) => state.may)`. That looks equivalent and is not: the
+ * store's `may` is one stable function reference, so selecting it subscribes a
+ * component to nothing -- the report arrives, the reference does not change, and
+ * every control stays disabled for the life of the page. The Playwright suite
+ * caught exactly that. Selecting the report is what makes the re-render happen.
+ */
+export function useMay(): (action: Action, proxy?: string) => boolean {
+  const report = useAccess((state) => state.report)
+  return useCallback(
+    (action: Action, proxy?: string) => permits(report, action, proxy),
+    [report],
+  )
+}
+
+export const useAccess = create<AccessState>((set) => ({
+  refresh: async () => {
+    try {
+      set({ report: await fetchAccess(), error: undefined })
+    } catch (caught) {
+      // The endpoint answers 200 for everybody, so a failure here is the server
+      // being unreachable rather than the caller being refused. Keeping the last
+      // report would leave controls enabled against a server that is not
+      // answering, so it is dropped.
+      set({ report: undefined, error: caught as ApiError })
+    }
+  },
+
+}))
+
+/** `list` and `create` are not about one proxy, so a proxy cannot override them. */
+function isProxyAction(action: Action): action is ProxyAction {
+  return action === 'read' || action === 'update' || action === 'delete' || action === 'upload'
+}
diff --git a/frontend/src/store/auth.ts b/frontend/src/store/auth.ts
new file mode 100644
index 0000000..4384d62
--- /dev/null
+++ b/frontend/src/store/auth.ts
@@ -0,0 +1,81 @@
+// The token, and whether to ask for one.
+//
+// The dialog is not a gate. `access.list` and `access.read` can be `public`, and
+// a proxy's own `access` block can open one proxy to a group -- so the page has
+// to be usable with no token at all, showing whatever the server is willing to
+// show an anonymous caller.
+
+import { create } from 'zustand'
+
+import { clearToken, isRefused, loadToken, refuse, saveToken } from '../services/auth'
+import { runtimeConfig } from '../services/runtimeConfig'
+
+interface AuthState {
+  token?: string
+  /** Whether the token dialog is on screen. */
+  dialogOpen: boolean
+  /**
+   * Open the dialog if there is something to ask for.
+   *
+   * Called by the shell on mount rather than decided when this module loads: a
+   * store that read the page's configuration at import time would run before the
+   * app had rendered anything, and would take every test that imports a component
+   * with it.
+   */
+  askIfNeeded: () => void
+  signIn: (token: string) => void
+  signOut: () => void
+  /** "Continue without a token": closes the dialog and remembers the refusal. */
+  decline: () => void
+  openDialog: () => void
+  closeDialog: () => void
+}
+
+/**
+ * Whether to open the dialog unprompted.
+ *
+ * Once, and only when there is something to ask for: a public deployment has no
+ * tokens to present, a held token needs no dialog, and an operator who already
+ * declined is not asked again for the rest of the tab.
+ */
+function shouldAsk(token: string | undefined): boolean {
+  return !runtimeConfig().public && !token && !isRefused()
+}
+
+export const useAuth = create<AuthState>((set, get) => {
+  return {
+    token: loadToken(),
+    dialogOpen: false,
+
+    askIfNeeded: () => {
+      if (shouldAsk(get().token)) {
+        set({ dialogOpen: true })
+      }
+    },
+
+    signIn: (value) => {
+      saveToken(value)
+      set({ token: value, dialogOpen: false })
+    },
+
+    // Signing out does not open the dialog. The page carries on anonymously and
+    // shows what a caller with no token may see, which is the same state a first
+    // visit to a partly-public deployment starts in.
+    signOut: () => {
+      clearToken()
+      set({ token: undefined, dialogOpen: false })
+    },
+
+    decline: () => {
+      refuse()
+      set({ dialogOpen: false })
+    },
+
+    openDialog: () => {
+      set({ dialogOpen: true })
+    },
+    closeDialog: () => {
+      set({ dialogOpen: false })
+    },
+  }
+})
diff --git a/frontend/src/store/proxies.ts b/frontend/src/store/proxies.ts
new file mode 100644
index 0000000..12762b1
--- /dev/null
+++ b/frontend/src/store/proxies.ts
@@ -0,0 +1,39 @@
+// The proxy list, refetched on a timer.
+
+import { create } from 'zustand'
+
+import type { ProxyView } from '../types/proxy'
+import { ApiError } from '../types/error'
+import { deleteProxy, listProxies } from '../services/proxies'
+
+interface ProxiesState {
+  items: ProxyView[]
+  error?: ApiError
+  /** True only for the first load, so a refetch does not blank the table. */
+  loading: boolean
+  load: () => Promise<void>
+  remove: (name: string, revision: string) => Promise<void>
+}
+
+export const useProxies = create<ProxiesState>((set, get) => ({
+  items: [],
+  loading: true,
+
+  load: async () => {
+    try {
+      set({ items: await listProxies(), error: undefined, loading: false })
+    } catch (caught) {
+      // The previous list is kept. A refetch that fails once -- a reload
+      // restarting the listener, say -- should not empty a table the operator is
+      // reading, and the error is shown alongside it.
+      set({ error: caught as ApiError, loading: false })
+    }
+  },
+
+  remove: async (name, revision) => {
+    await deleteProxy(name, revision)
+    // Refetched rather than spliced out locally: the delete may have raced
+    // another change, and the list is the server's to describe.
+    await get().load()
+  },
+}))
diff --git a/frontend/src/store/schema.ts b/frontend/src/store/schema.ts
new file mode 100644
index 0000000..9766598
--- /dev/null
+++ b/frontend/src/store/schema.ts
@@ -0,0 +1,58 @@
+// The configuration schema, fetched once and read by every form.
+//
+// A store rather than a fetch per page: the document is the same for the life of
+// the process, four pages want it, and a page that fetched it for itself would
+// refetch 30 KB on every navigation.
+
+import { useCallback } from 'react'
+import { create } from 'zustand'
+
+import type { JsonSchema } from '../types/schema'
+import type { Rule } from '../schema/rules'
+import { ruleAt, valueRuleAt } from '../schema/rules'
+import { fetchSchema } from '../services/schema'
+
+interface SchemaState {
+  schema?: JsonSchema
+  /**
+   * The fetch failed.
+   *
+   * Not shown anywhere and not meant to be: the schema tightens the form, it does
+   * not enable it. A deployment behind something that eats the endpoint gets a form
+   * whose bounds are checked by the server on save, which is where they were
+   * checked before this existed.
+   */
+  error?: string
+  load: () => Promise<void>
+}
+
+export const useSchema = create<SchemaState>((set, get) => ({
+  load: async () => {
+    if (get().schema) {
+      return
+    }
+    try {
+      set({ schema: await fetchSchema(), error: undefined })
+    } catch (caught) {
+      set({ error: caught instanceof Error ? caught.message : String(caught) })
+    }
+  },
+}))
+
+/**
+ * The rule for a field of a proxy document, by path.
+ *
+ * Subscribes to the schema, so a form rendered before the fetch finished re-renders
+ * with its bounds when it arrives -- the same mistake `useMay` documents, where
+ * selecting a stable function left every control frozen in its initial state.
+ */
+export function useRule(): (path: string) => Rule | undefined {
+  const schema = useSchema((state) => state.schema)
+  return useCallback((path: string) => ruleAt(schema, path), [schema])
+}
+
+/** The rule for the *values* of a map field, by path. */
+export function useValueRule(): (path: string) => Rule | undefined {
+  const schema = useSchema((state) => state.schema)
+  return useCallback((path: string) => valueRuleAt(schema, path), [schema])
+}
diff --git a/frontend/src/store/theme.ts b/frontend/src/store/theme.ts
new file mode 100644
index 0000000..a3e209e
--- /dev/null
+++ b/frontend/src/store/theme.ts
@@ -0,0 +1,92 @@
+// Light, dark, or whatever the operating system says.
+//
+// `system` is the default, and it is not the same as "light": an operator whose
+// desktop is dark expects a dark page without having chosen anything, and a
+// dashboard that ignores that is the one window that glows.
+
+import { create } from 'zustand'
+
+export type ThemeChoice = 'light' | 'dark' | 'system'
+export type Resolved = 'light' | 'dark'
+
+const STORAGE_KEY = 'doppel.theme'
+const DARK_QUERY = '(prefers-color-scheme: dark)'
+
+/** What the operating system says, or `light` where nothing says anything. */
+function systemPrefers(): Resolved {
+  // Optional call rather than a bare one: jsdom has no `matchMedia`, and a store
+  // that threw on import would take every test with it.
+  return window.matchMedia?.(DARK_QUERY).matches ? 'dark' : 'light'
+}
+
+function stored(): ThemeChoice {
+  const raw = localStorage.getItem(STORAGE_KEY)
+  return raw === 'light' || raw === 'dark' || raw === 'system' ? raw : 'system'
+}
+
+function resolve(choice: ThemeChoice): Resolved {
+  return choice === 'system' ? systemPrefers() : choice
+}
+
+/**
+ * Put the resolved theme on `<html>`.
+ *
+ * A class rather than a data attribute, because that is what the `dark:` variant
+ * in `index.css` is defined against.
+ */
+function apply(resolved: Resolved): void {
+  document.documentElement.classList.toggle('dark', resolved === 'dark')
+}
+
+interface ThemeState {
+  choice: ThemeChoice
+  resolved: Resolved
+  set: (choice: ThemeChoice) => void
+  /** Re-resolve after the system preference changed. */
+  systemChanged: () => void
+}
+
+export const useTheme = create<ThemeState>((set, get) => ({
+  choice: stored(),
+  resolved: resolve(stored()),
+
+  set: (choice) => {
+    localStorage.setItem(STORAGE_KEY, choice)
+    const resolved = resolve(choice)
+    apply(resolved)
+    set({ choice, resolved })
+  },
+
+  systemChanged: () => {
+    // Only `system` follows the system. A page someone set to light must not go
+    // dark at sunset because their desktop did.
+    if (get().choice !== 'system') {
+      return
+    }
+    const resolved = systemPrefers()
+    apply(resolved)
+    set({ resolved })
+  },
+}))
+
+/**
+ * Apply the stored choice and follow the system while it is `system`.
+ *
+ * Called once from the app rather than at import: a module that touched the
+ * document on load would run in every test that imports anything near it.
+ */
+export function startTheme(): () => void {
+  apply(useTheme.getState().resolved)
+
+  const query = window.matchMedia?.(DARK_QUERY)
+  if (!query) {
+    return () => {}
+  }
+  const listener = () => {
+    useTheme.getState().systemChanged()
+  }
+  query.addEventListener('change', listener)
+  return () => {
+    query.removeEventListener('change', listener)
+  }
+}
diff --git a/frontend/src/store/toast.ts b/frontend/src/store/toast.ts
new file mode 100644
index 0000000..00e1d59
--- /dev/null
+++ b/frontend/src/store/toast.ts
@@ -0,0 +1,52 @@
+// Short-lived messages: what a write did, and what it refused to do.
+
+import { create } from 'zustand'
+
+export type ToastKind = 'done' | 'failed'
+
+export interface Toast {
+  id: number
+  kind: ToastKind
+  text: string
+}
+
+/**
+ * Ids come from a counter, not from a clock or a random number.
+ *
+ * Two toasts raised in the same millisecond would collide on a timestamp, and
+ * React would then reuse one row's DOM for the other's text.
+ */
+let nextId = 1
+
+/**
+ * How long a message stays.
+ *
+ * Long enough to read a revision out of, short enough that three reloads do not
+ * leave three notices stacked in the corner for the rest of the session -- which
+ * is what happened when they only went away on click.
+ *
+ * A failure stays longer: it is the one an operator may want to copy, and it is
+ * the one that arrives while they are looking elsewhere.
+ */
+export const TOAST_MS: Record<ToastKind, number> = { done: 4000, failed: 10_000 }
+
+interface ToastState {
+  items: Toast[]
+  push: (kind: ToastKind, text: string) => void
+  dismiss: (id: number) => void
+}
+
+export const useToasts = create<ToastState>((set, get) => ({
+  items: [],
+  push: (kind, text) => {
+    const id = nextId++
+    set((state) => ({ items: [...state.items, { id, kind, text }] }))
+    // Timed here rather than in the component that renders them: a toast raised by
+    // a page that then navigates away would otherwise never be cleaned up, because
+    // the timer would have gone with the unmounted component.
+    setTimeout(() => get().dismiss(id), TOAST_MS[kind])
+  },
+  dismiss: (id) => {
+    set((state) => ({ items: state.items.filter((toast) => toast.id !== id) }))
+  },
+}))
diff --git a/frontend/src/test-setup.ts b/frontend/src/test-setup.ts
new file mode 100644
index 0000000..bc1ad68
--- /dev/null
+++ b/frontend/src/test-setup.ts
@@ -0,0 +1,3 @@
+// `toBeInTheDocument` and the rest of the DOM matchers, loaded once for every
+// suite rather than imported per file.
+import '@testing-library/jest-dom'
diff --git a/frontend/src/types/__tests__/error.test.ts b/frontend/src/types/__tests__/error.test.ts
new file mode 100644
index 0000000..5dee8db
--- /dev/null
+++ b/frontend/src/types/__tests__/error.test.ts
@@ -0,0 +1,82 @@
+import { ApiError, complaintAbout } from '../error'
+
+/**
+ * The two message shapes the server actually produces, quoted from live
+ * responses rather than invented.
+ *
+ * The first version of this parser split on newlines and matched neither, so
+ * every field-level error silently fell back to the banner and the tests passed
+ * because the banner contains the same words. These fixtures are the fix.
+ */
+const VALIDATION = new ApiError(
+  400,
+  'CONFIG_INVALID',
+  'configuration is invalid: proxies[0].url: must be absolute; ' +
+    'proxies[1].name: duplicate proxy name `alpha`',
+)
+
+const PARSE = new ApiError(
+  400,
+  'CONFIG_INVALID',
+  'request body is not a valid proxy document: url must be absolute: ' +
+    'relative URL without a base at line 1 column 55',
+)
+
+describe('a validation refusal', () => {
+  it('answers for a field named in a path', () => {
+    expect(complaintAbout(VALIDATION, 'url')).toBe('must be absolute')
+    expect(complaintAbout(VALIDATION, 'name')).toBe('duplicate proxy name `alpha`')
+  })
+
+  it('says nothing about a field it does not mention', () => {
+    expect(complaintAbout(VALIDATION, 'timeout')).toBeUndefined()
+    expect(complaintAbout(VALIDATION, 'replace')).toBeUndefined()
+  })
+
+  it('does not let one field answer for another that starts the same way', () => {
+    // `body` and `body_limit` are both real fields, and a prefix match would put
+    // the wrong complaint under the wrong control.
+    const error = new ApiError(400, 'CONFIG_INVALID', 'configuration is invalid: proxies[0].body_limit: must not be zero')
+    expect(complaintAbout(error, 'body_limit')).toBe('must not be zero')
+    expect(complaintAbout(error, 'body')).toBeUndefined()
+  })
+
+  it('distinguishes a mocks path from the proxy field of the same name', () => {
+    const error = new ApiError(
+      400,
+      'CONFIG_INVALID',
+      'configuration is invalid: proxies[0].mocks[1].name: duplicate mock name',
+    )
+    expect(complaintAbout(error, 'mocks[1].name')).toBe('duplicate mock name')
+    expect(complaintAbout(error, 'mocks[0].name')).toBeUndefined()
+  })
+})
+
+describe('a parse refusal', () => {
+  it('answers for the field serde named', () => {
+    // serde puts the field first and its own detail after, with no path: the
+    // whole remainder is the message.
+    expect(complaintAbout(PARSE, 'url')).toBe(
+      'must be absolute: relative URL without a base at line 1 column 55',
+    )
+  })
+
+  it('does not invent a field out of ordinary prose', () => {
+    // The failure mode of reading paths out of a message instead of asking about
+    // a field: "no" is the first word of this one.
+    const error = new ApiError(404, 'PROXY_NOT_RESOLVED', 'no proxy matched the request')
+    expect(complaintAbout(error, 'no')).toBeUndefined()
+    expect(complaintAbout(error, 'url')).toBeUndefined()
+  })
+})
+
+describe('the error itself', () => {
+  it('classifies what a caller has to branch on', () => {
+    expect(new ApiError(401, 'UNAUTHORIZED', 'x').isAuth).toBe(true)
+    expect(new ApiError(403, 'FORBIDDEN', 'x').isAuth).toBe(true)
+    expect(new ApiError(409, 'CONFLICT', 'x').isStale).toBe(true)
+    expect(new ApiError(428, 'REVISION_REQUIRED', 'x').isStale).toBe(true)
+    expect(new ApiError(500, 'STORE_ERROR', 'x').isAuth).toBe(false)
+    expect(new ApiError(500, 'STORE_ERROR', 'x').isStale).toBe(false)
+  })
+})
diff --git a/frontend/src/types/api.ts b/frontend/src/types/api.ts
new file mode 100644
index 0000000..d05a7de
--- /dev/null
+++ b/frontend/src/types/api.ts
@@ -0,0 +1,67 @@
+// What the API returns besides proxies, and the one error type the whole app
+// throws.
+
+/** The six things access is decided for. */
+export type Action = 'list' | 'read' | 'create' | 'update' | 'delete' | 'upload'
+
+/** The four a proxy's own `access` block may override. */
+export type ProxyAction = 'read' | 'update' | 'delete' | 'upload'
+
+export type CallerView =
+  | { kind: 'anonymous' }
+  | { kind: 'token'; name: string; group: string }
+
+export interface AccessReport {
+  caller: CallerView
+  global: Record<Action, boolean>
+  /**
+   * Absent -- not empty -- when the caller may not `list`. The server withholds
+   * it rather than emptying it, because a map keyed by proxy name would be a
+   * proxy listing by another route.
+   */
+  proxies?: Record<string, Record<ProxyAction, boolean>>
+}
+
+export interface ProxyStatus {
+  name: string
+  upstream: string
+  resolve: string
+  mocks: number
+}
+
+export interface Status {
+  uptime_seconds: number
+  revision: string
+  proxies: ProxyStatus[]
+}
+
+export interface ReloadReport {
+  revision: string
+  proxies: number
+  /** Sections that changed but need a restart. Absent when empty. */
+  unapplied?: string[]
+}
+
+/** What the page is told by the HTML it was served in. */
+export interface RuntimeConfig {
+  title: string
+  /**
+   * `admin.title` was left out, so `title` is the default.
+   *
+   * The header draws the Doppelganger wordmark in that case. A deployment that
+   * named itself gets its name, in plain text.
+   */
+  titleIsDefault: boolean
+  /** The admin API is unauthenticated; the page never asks for a token. */
+  public: boolean
+  version: string
+  authHeader: string
+  refreshMs: number
+  /**
+   * The year the binary was built, for the footer's copyright line.
+   *
+   * From the build rather than from the browser's clock: the page ships inside
+   * this binary, so the year it was published in is a fact about the build.
+   */
+  copyrightYear: number
+}
diff --git a/frontend/src/types/error.ts b/frontend/src/types/error.ts
new file mode 100644
index 0000000..6751e8f
--- /dev/null
+++ b/frontend/src/types/error.ts
@@ -0,0 +1,111 @@
+/**
+ * Every failure the app handles, in one shape.
+ *
+ * The server's error envelope is `{status, message, code}`, and a transport
+ * failure has none of those -- so it is given a synthetic code rather than a
+ * different type. One type means a component never has to ask which kind of
+ * failure it is holding before it can show the message.
+ */
+export class ApiError extends Error {
+  readonly status: number
+  readonly code: string
+
+  constructor(status: number, code: string, message: string) {
+    super(message)
+    this.name = 'ApiError'
+    this.status = status
+    this.code = code
+  }
+
+  /** Whether this is the server asking for a token, or refusing the one given. */
+  get isAuth(): boolean {
+    return this.status === 401 || this.status === 403
+  }
+
+  /** Whether the caller's revision was stale. 428 means none was sent. */
+  get isStale(): boolean {
+    return this.status === 409 || this.status === 428
+  }
+}
+
+/** The code used when the request never reached a server. */
+export const TRANSPORT_CODE = 'TRANSPORT'
+
+/**
+ * The two prefixes the server puts in front of a refusal.
+ *
+ * One from the validation rules, one from serde when the document does not parse
+ * at all. Stripped before anything is read out of the message, because the words
+ * before the colon are prose rather than a path.
+ */
+const PREFIXES = [
+  'configuration is invalid:',
+  'request body is not a valid proxy document:',
+]
+
+/**
+ * The server's complaint about one field, if it made one.
+ *
+ * The form asks about a field it knows rather than a parser inventing paths from
+ * the message. That is not fastidiousness: the two shapes a refusal arrives in
+ * are
+ *
+ *   configuration is invalid: proxies[0].url: must be absolute; proxies[1].name: ...
+ *   request body is not a valid proxy document: url must be absolute: relative ...
+ *
+ * and a parser reading paths out of the second one would take `no` for a field
+ * name out of "no proxy matched the request". Asking about `url` cannot do that.
+ *
+ * `field` may be a plain name (`url`) or a path within the document
+ * (`mocks[1].name`); a segment matches when its path ends there, so the proxy's
+ * own `name` does not answer for a mock's.
+ *
+ * A message carrying neither prefix is not searched at all. Those are the ones
+ * that are prose about the request rather than a list of field complaints -- "no
+ * proxy matched the request" would otherwise answer for a field called `no` -- and
+ * the banner is where they belong.
+ */
+export function complaintAbout(error: ApiError, field: string): string | undefined {
+  const prefix = PREFIXES.find((candidate) => error.message.startsWith(candidate))
+  if (!prefix) {
+    return undefined
+  }
+  const text = error.message.slice(prefix.length)
+
+  for (const segment of text.split(';')) {
+    const complaint = segment.trim()
+    if (!complaint.startsWith(field)) {
+      // Not this field, unless the path leads to it: `proxies[0].url` ends in the
+      // `url` the form knows.
+      const at = complaint.indexOf(field)
+      const before = at > 0 ? complaint[at - 1] : undefined
+      if (at <= 0 || (before !== '.' && before !== ' ')) {
+        continue
+      }
+      const rest = tail(complaint.slice(at + field.length))
+      if (rest) {
+        return rest
+      }
+      continue
+    }
+    const rest = tail(complaint.slice(field.length))
+    if (rest) {
+      return rest
+    }
+  }
+  return undefined
+}
+
+/**
+ * What follows the field name, once the punctuation between them is gone.
+ *
+ * `undefined` when the name was only a prefix of a longer one -- `body` must not
+ * answer for `body_limit` -- or when nothing follows it at all.
+ */
+function tail(rest: string): string | undefined {
+  if (!rest.startsWith(':') && !rest.startsWith(' ')) {
+    return undefined
+  }
+  const message = rest.replace(/^[:\s]+/, '').trim()
+  return message || undefined
+}
diff --git a/frontend/src/types/proxy.ts b/frontend/src/types/proxy.ts
new file mode 100644
index 0000000..deeab62
--- /dev/null
+++ b/frontend/src/types/proxy.ts
@@ -0,0 +1,101 @@
+// The configuration shapes the admin API speaks, as TypeScript.
+//
+// Hand-written rather than generated from `doppel-config.schema.json`. A
+// generator would be a build step, a dependency and a drift check of its own;
+// what actually goes wrong with a hand-written model is a field nobody added a
+// control for, and `schema-drift.test.ts` reads the schema and fails on exactly
+// that. Optional here means optional there: a field the server omits is a field
+// this must not require.
+
+/** `public`, or the token and group names allowed to act. */
+export type Subjects = 'public' | string[]
+
+export interface ProxyAccessConfig {
+  read?: Subjects
+  update?: Subjects
+  delete?: Subjects
+  upload?: Subjects
+}
+
+export interface LossConfig {
+  /** A fraction, not a percentage: 0.5 is half the requests. */
+  percentage: number
+  status: number
+}
+
+export interface LatencyConfig {
+  percentage: number
+  /** Seconds. */
+  min: number
+  max: number
+}
+
+export type HttpMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS'
+
+export interface MockRequest {
+  method: HttpMethod
+  /** A regex matched against the path, unanchored. */
+  url: string
+  /** Variable name -> request header name. */
+  headers?: Record<string, string>
+  /** Variable name -> selector. */
+  query?: Record<string, string>
+  body?: Record<string, string>
+}
+
+/**
+ * `body`, `json` and `template` are mutually exclusive: exactly one of them is a
+ * mock's response source. The form enforces that with a radio rather than
+ * hoping, because the server refuses a document with two of them set.
+ */
+export interface MockResponse {
+  status: number
+  body?: string
+  json?: string
+  template?: string
+  headers?: Record<string, string>
+}
+
+export interface MockProxyOverride {
+  replace?: number
+  loss?: LossConfig
+  latency?: LatencyConfig
+}
+
+export interface MockConfig {
+  name: string
+  request: MockRequest
+  response: MockResponse
+  proxy?: MockProxyOverride
+}
+
+export interface ResolveConfig {
+  type: 'default' | 'header'
+  header?: string
+}
+
+export interface ProxyConfig {
+  name: string
+  /** Only `http`. `tcp` is not implemented and the server refuses it. */
+  type: 'http'
+  url: string
+  /** Seconds. */
+  timeout?: number
+  resolve?: ResolveConfig
+  access?: ProxyAccessConfig
+  headers?: Record<string, string>
+  loss?: LossConfig
+  latency?: LatencyConfig
+  replace?: number
+  rewrite_redirects?: boolean
+  rewrite_urls?: boolean
+  /** Bytes, or a string such as `4Mi`. */
+  body_limit?: number | string
+  mocks?: MockConfig[]
+}
+
+/** A proxy as the API returns it: the document plus the revision to send back. */
+export interface ProxyView {
+  revision: string
+  proxy: ProxyConfig
+}
diff --git a/frontend/src/types/schema.ts b/frontend/src/types/schema.ts
new file mode 100644
index 0000000..e8b17e7
--- /dev/null
+++ b/frontend/src/types/schema.ts
@@ -0,0 +1,35 @@
+// The part of JSON Schema this page reads.
+//
+// Not a general-purpose validator and deliberately not a library: what the form
+// needs is the bound on one field -- a pattern, a length, a range -- from a
+// document the server generated, and that is a walk down `properties`. The whole
+// schema *is* validated as a schema, by ajv, but only where a whole document is
+// the subject: the YAML editor. See `schema/rules.ts` for the walk and
+// `store/schema.ts` for where the document comes from.
+
+/** A schema node, as far as the field rules care. */
+export interface JsonSchema {
+  /** The document's own id, which is how a validator names its definitions. */
+  $id?: string
+  /** Which dialect it is written in. */
+  $schema?: string
+  $defs?: Record<string, JsonSchema>
+  $ref?: string
+  type?: string | string[]
+  description?: string
+  examples?: unknown[]
+  properties?: Record<string, JsonSchema>
+  required?: string[]
+  /** A map's value schema, for `headers` and the variable maps. */
+  additionalProperties?: JsonSchema | boolean
+  /** A list's element schema, for `mocks`. */
+  items?: JsonSchema
+  /** How an `Option<T>` and a union of two representations both arrive. */
+  oneOf?: JsonSchema[]
+  pattern?: string
+  minLength?: number
+  maxLength?: number
+  minimum?: number
+  maximum?: number
+  enum?: unknown[]
+}
diff --git a/frontend/tsconfig.e2e.json b/frontend/tsconfig.e2e.json
new file mode 100644
index 0000000..c198e33
--- /dev/null
+++ b/frontend/tsconfig.e2e.json
@@ -0,0 +1,7 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "types": ["node"]
+  },
+  "include": ["e2e", "playwright.config.ts"]
+}
diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json
new file mode 100644
index 0000000..1d46415
--- /dev/null
+++ b/frontend/tsconfig.json
@@ -0,0 +1,22 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "verbatimModuleSyntax": true,
+    "isolatedModules": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "types": ["jest", "@testing-library/jest-dom", "node"]
+  },
+  "include": ["src", "vite.config.ts", "jest.config.ts", "scripts"]
+}
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
new file mode 100644
index 0000000..759effa
--- /dev/null
+++ b/frontend/vite.config.ts
@@ -0,0 +1,62 @@
+import react from '@vitejs/plugin-react'
+import tailwindcss from '@tailwindcss/vite'
+import { minify } from 'html-minifier-terser'
+import { defineConfig, type Plugin } from 'vite'
+
+/**
+ * Minify `index.html`, which vite emits as it was written.
+ *
+ * It is the one file the listener serves on every page load and cannot cache
+ * immutably -- the assets are content-hashed and cached for a year, this is
+ * substituted per request -- so the comments and indentation in it are paid for
+ * by every visit.
+ *
+ * Deliberately conservative. Two things in this file are load-bearing and would
+ * fail quietly if minification touched them:
+ *
+ * - `id="doppel-config"`, with double quotes. `dashboard.rs` finds the element
+ *   by that exact string and splices the runtime configuration into it, and
+ *   `build.rs` asserts the string is present. `removeAttributeQuotes` is off
+ *   (it is off by default, and named here so nobody turns it on).
+ * - The `</script>` that closes it, which is the other half of the splice.
+ *
+ * `minifyJS` stays off as well: the element is `application/json`, not a script,
+ * and handing JSON to a JS minifier is a way to find out what it does with it.
+ */
+function minifyHtml(): Plugin {
+  return {
+    name: 'doppel:minify-html',
+    apply: 'build',
+    transformIndexHtml: {
+      // After vite has rewritten the asset URLs, so what is minified is what
+      // ships.
+      order: 'post',
+      handler: (html) =>
+        minify(html, {
+          collapseWhitespace: true,
+          removeComments: true,
+          removeAttributeQuotes: false,
+          minifyJS: false,
+          minifyCSS: false,
+        }),
+    },
+  }
+}
+
+export default defineConfig({
+  // Every emitted URL is `/static/...`, which is where the admin listener serves
+  // the embedded assets from. `index.html` itself is served from `/` with the
+  // runtime configuration substituted into it, so it is not under this prefix.
+  base: '/static/',
+  plugins: [react(), tailwindcss(), minifyHtml()],
+  build: {
+    outDir: 'dist',
+    // The requirement is the smallest static payload that will do the job, and a
+    // sourcemap roughly doubles it. A stack trace from a minified admin page is
+    // a worse trade than a megabyte on the wire.
+    sourcemap: false,
+    // Filenames are content-hashed, which is what makes the immutable
+    // `Cache-Control` the listener sends safe.
+    assetsDir: 'assets',
+  },
+})
diff --git a/main.example.yaml b/main.example.yaml
index 0bb5d79..bbabe62 100644
--- a/main.example.yaml
+++ b/main.example.yaml
@@ -40,6 +40,16 @@ admin:
   # `public` and `admin` are always available whatever the list says.
   # [] names nobody, which means the same as `public: true`. Rule V36.
   groups: ["*"]
+  # Serve the browser dashboard from this listener's root. On by default; false
+  # leaves `/`, `/static/*` and `/robots.txt` unrouted and the JSON API
+  # untouched. Takes effect on restart.
+  dashboard: true
+  # The heading the dashboard shows, and the browser tab's title. Left out here,
+  # and left out is worth seeing: with no title the header draws the project's
+  # wordmark, which is the state a first run should show. Set it to a name --
+  # "billing-api (staging)" -- once several Doppels are open at once.
+  #
+  # title: "Doppel"
   auth:
     header: X-Proxy-Authorization  # expects "Bearer {token}"
   tokens:
diff --git a/mkdocs.yml b/mkdocs.yml
index 38e91f0..2c93fa5 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -7,9 +7,15 @@ site_url: https://lorem-dev.github.io/doppel/
 repo_url: https://github.com/lorem-dev/doppel
 edit_uri: ""
 
+# Stages `assets/` into `docs/assets/` before the build. The icons live at the
+# repository root because the frontend build needs the same favicon, and mkdocs
+# serves only what is under `docs/`. See scripts/mkdocs_assets.py.
+hooks:
+  - scripts/mkdocs_assets.py
+
 theme:
   name: material
-  # Rendered from `docs/assets/icon.svg` at 512x512, which is oversized for
+  # Rendered from `assets/icon.svg` at 512x512, which is oversized for
   # both uses on purpose: the header renders it around 24px and a favicon is
   # smaller still, but browsers pick this up on retina displays and mkdocs
   # copies it verbatim rather than resampling.
@@ -54,9 +60,11 @@ nav:
       - Several backends behind one port: usage/multiple-backends.md
       - Changing configuration while it runs: usage/runtime-changes.md
       - The admin API: usage/admin-api.md
+      - The dashboard: usage/dashboard.md
       - Storing configuration in PostgreSQL: usage/storage.md
       - Observability: usage/observability.md
       - Configuration reference: usage/configuration.md
+      - Every parameter: usage/parameters.md
       - CLI reference: usage/cli.md
       - Troubleshooting: usage/troubleshooting.md
   - Development:
@@ -75,6 +83,10 @@ extra:
     provider: mike
 
 markdown_extensions:
+  # `{ #anchor }` on a heading. usage/parameters.md gives every parameter an anchor
+  # derived from its path, because the dashboard links a field to its section and an
+  # anchor mkdocs invented from the heading text would move when the text did.
+  - attr_list
   - admonition
   - pymdownx.details
   - pymdownx.superfences
diff --git a/scripts/check_docs_links.py b/scripts/check_docs_links.py
new file mode 100644
index 0000000..c80e765
--- /dev/null
+++ b/scripts/check_docs_links.py
@@ -0,0 +1,134 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.11"
+# dependencies = []
+# ///
+"""Check that every documentation link the dashboard builds goes somewhere.
+
+    uv run scripts/check_docs_links.py
+
+A wrong fragment is silent. A browser given `.../parameters/#proxies-timeuot`
+opens the page at the top and nobody notices, so an (i) that goes nowhere survives
+review, release and use. This is the check that fails instead.
+
+Three things it holds:
+
+1.  Every `info="..."` path in the frontend has a section in
+    `docs/usage/parameters.md`, under the anchor `services/docs.ts` derives from it.
+2.  Every documentation URL in the frontend is versioned. The site is published per
+    version, so a link without one shows whoever follows it the rules of whatever
+    has been released since.
+3.  Every relative link and fragment inside `parameters.md` resolves -- the page is
+    generated, and a generator that emitted a dead link would do it 80 times.
+
+It reads the frontend as text on purpose: the alternative is running the bundle,
+and what is being checked is a literal in the source either way. Every path it looks
+for is a plain string literal, which is why `MockEditor` spells `mocks[].name` out
+rather than building it.
+"""
+
+from __future__ import annotations
+
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+FRONTEND = ROOT / "frontend" / "src"
+PARAMETERS = ROOT / "docs" / "usage" / "parameters.md"
+DOCS = ROOT / "docs"
+
+#: `info="mocks[].request.url"` on a field.
+INFO = re.compile(r'info="([^"]+)"')
+#: An anchor the generated page defines: `### `x` { #anchor }`.
+ANCHOR = re.compile(r"^#{2,4} .*\{ #([A-Za-z0-9_-]+) \}\s*$", re.MULTILINE)
+#: Any link to the published site.
+SITE = re.compile(r"https://lorem-dev\.github\.io/doppel/([^'\"`\s)]*)")
+#: A markdown link, for the third check.
+LINK = re.compile(r"\]\(([^)]+)\)")
+
+problems: list[str] = []
+
+
+def anchor_for(path: str) -> str:
+    """The same rule as `parameterAnchor` in `frontend/src/services/docs.ts`."""
+    return f"proxies.{path}".replace("[]", "").replace(".", "-")
+
+
+def sources() -> list[Path]:
+    return sorted(p for p in FRONTEND.rglob("*.ts*") if "__tests__" not in p.parts)
+
+
+def check_field_links(anchors: set[str]) -> None:
+    for source in sources():
+        for path in INFO.findall(source.read_text()):
+            anchor = anchor_for(path)
+            if anchor not in anchors:
+                problems.append(
+                    f"{source.relative_to(ROOT)}: info=\"{path}\" links to "
+                    f"#{anchor}, which {PARAMETERS.relative_to(ROOT)} does not define"
+                )
+
+
+def check_versioned() -> None:
+    """A documentation URL in the page has to carry a version.
+
+    `services/docs.ts` builds them from the running version, so the only literals
+    left should be the site root in that one file. Anything else is a link somebody
+    wrote by hand, and it will age.
+    """
+    for source in sources():
+        text = source.read_text()
+        for tail in SITE.findall(text):
+            if source.name == "docs.ts":
+                continue
+            problems.append(
+                f"{source.relative_to(ROOT)}: documentation URL "
+                f"'.../doppel/{tail}' is written out; build it with docsUrl() so it "
+                "carries the running version"
+            )
+
+
+def check_generated_page(anchors: set[str]) -> None:
+    text = PARAMETERS.read_text()
+    for target in LINK.findall(text):
+        if target.startswith(("http://", "https://", "mailto:")):
+            continue
+        page, _, fragment = target.partition("#")
+        if page and not (DOCS / "usage" / page).is_file():
+            problems.append(f"parameters.md links to {page}, which is not a page")
+        if fragment and not page and fragment not in anchors:
+            problems.append(f"parameters.md links to #{fragment}, which it does not define")
+
+
+def main() -> None:
+    if not PARAMETERS.is_file():
+        print(
+            "check-docs-links: docs/usage/parameters.md is missing; run "
+            "`uv run scripts/parameters_doc.py`",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+
+    anchors = set(ANCHOR.findall(PARAMETERS.read_text()))
+    if len(anchors) < 20:
+        print(
+            f"check-docs-links: only {len(anchors)} anchors in parameters.md, which "
+            "cannot be right -- the page or the anchor pattern changed",
+            file=sys.stderr,
+        )
+        raise SystemExit(1)
+
+    check_field_links(anchors)
+    check_versioned()
+    check_generated_page(anchors)
+
+    if problems:
+        for problem in problems:
+            print(f"check-docs-links: {problem}", file=sys.stderr)
+        raise SystemExit(1)
+    print(f"check-docs-links: every dashboard link resolves ({len(anchors)} anchors)")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/mkdocs_assets.py b/scripts/mkdocs_assets.py
new file mode 100644
index 0000000..385c4c1
--- /dev/null
+++ b/scripts/mkdocs_assets.py
@@ -0,0 +1,28 @@
+"""Stage the repository's icons into the documentation tree before a build.
+
+The icons live in `assets/` at the repository root because two builds need
+them: mkdocs, which only serves what is under `docs/`, and the frontend, whose
+favicon is the same file. Copying them here rather than in a workflow step is
+what keeps `mkdocs build --strict` behaving identically on a laptop and in CI --
+a step that exists only in a workflow is a step that fails for whoever builds
+the site by hand.
+
+`docs/assets/` is git-ignored, so this copy is never committed and cannot drift
+from `assets/`.
+"""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+SOURCE = ROOT / "assets"
+DESTINATION = ROOT / "docs" / "assets"
+
+
+def on_pre_build(config) -> None:  # noqa: ARG001 -- mkdocs passes its config
+    DESTINATION.mkdir(parents=True, exist_ok=True)
+    for source in sorted(SOURCE.iterdir()):
+        if source.is_file():
+            shutil.copy2(source, DESTINATION / source.name)
diff --git a/scripts/parameters_doc.py b/scripts/parameters_doc.py
new file mode 100644
index 0000000..48e81ef
--- /dev/null
+++ b/scripts/parameters_doc.py
@@ -0,0 +1,378 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.11"
+# dependencies = []
+# ///
+"""Regenerate docs/usage/parameters.md from doppel-config.schema.json.
+
+    uv run scripts/parameters_doc.py            # write the file
+    uv run scripts/parameters_doc.py --check    # fail if it is out of date
+
+One section per configuration parameter: what it is, its type, whether it is
+required, the bounds on it, and an example in place. Generated rather than written
+because the source of every one of those facts is already the schema, which is
+generated from the Rust types that enforce them -- a hand-written page would be a
+third copy, and the one nobody runs drifts first.
+
+The anchors are the other reason. The dashboard puts an (i) beside a field and links
+it here, so every parameter needs an anchor that is predictable from its path:
+`proxies[].mocks[].request.url` is `#proxies-mocks-request-url`. Brackets go, dots
+become dashes. `scripts/check_docs_links.py` holds the page and the frontend to that.
+
+Prose stays in usage/configuration.md and the guides. This page is the reference you
+look a field up in, not the page you learn the system from.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+ROOT = Path(__file__).resolve().parent.parent
+SCHEMA = ROOT / "doppel-config.schema.json"
+OUTPUT = ROOT / "docs" / "usage" / "parameters.md"
+
+HEADER = """<!--
+  Generated by scripts/parameters_doc.py from doppel-config.schema.json.
+  Do not edit by hand: `make gate` fails when this file and the schema disagree.
+-->
+
+# Every parameter
+
+Every field a configuration document may carry, with its type, its bounds and an
+example. Generated from [the schema](configuration.md#editor-support), which is
+generated from the Rust types that enforce the rules -- so a bound stated here is
+the bound the server applies.
+
+The dashboard links here: the (i) beside a field opens that field's section.
+
+For how the pieces fit together, read [Configuration
+reference](configuration.md); for how to use them, the guides under Usage.
+"""
+
+
+def fail(message: str) -> None:
+    print(f"parameters-doc: {message}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+def anchor(path: str) -> str:
+    """The anchor for a parameter path.
+
+    `proxies[].mocks[].request.url` -> `proxies-mocks-request-url`. The frontend
+    builds the same string from the same path; see `frontend/src/services/docs.ts`.
+    """
+    return path.replace("[]", "").replace(".", "-")
+
+
+class Schema:
+    """The schema, with `$ref` following and `Option` unwrapping."""
+
+    def __init__(self, document: dict[str, Any]) -> None:
+        self.document = document
+        self.defs: dict[str, Any] = document.get("$defs", {})
+
+    def deref(self, node: dict[str, Any]) -> dict[str, Any]:
+        ref = node.get("$ref")
+        if not ref:
+            return node
+        return self.defs.get(ref.removeprefix("#/$defs/"), node)
+
+    def unwrap(self, node: dict[str, Any]) -> dict[str, Any]:
+        """A field's real schema: past a `$ref`, past an `Option`'s null branch.
+
+        An `Option<T>` is emitted as `oneOf: [{type: null}, {$ref}]`, so a field's
+        bounds are one level below where a reader looks for them. A union with two
+        real branches -- `ByteSize` is an integer or a string -- is kept whole, with
+        the description from whichever level carries one.
+        """
+        node = self.deref(node)
+        branches = node.get("oneOf")
+        if not branches:
+            return node
+        real = [b for b in branches if b.get("type") != "null"]
+        if len(real) == 1:
+            merged = dict(self.deref(real[0]))
+            merged.setdefault("description", node.get("description", ""))
+            return merged
+        merged = dict(node)
+        merged["oneOf"] = [self.deref(b) for b in real]
+        return merged
+
+
+def type_of(schema: Schema, node: dict[str, Any]) -> str:
+    """The type, in the words a reader of YAML would use."""
+    if branches := node.get("oneOf"):
+        return " or ".join(type_of(schema, b) for b in branches)
+    if node.get("enum"):
+        return "string"
+    kind = node.get("type")
+    if isinstance(kind, list):
+        # `Option<bool>` can arrive as `["boolean", "null"]` rather than as a
+        # `oneOf`. Absent is said by the Required row, not by the type.
+        named = [k for k in kind if k != "null"]
+        return " or ".join(named) if named else "any"
+
+    if kind == "array":
+        item = schema.unwrap(node.get("items", {}))
+        return f"list of {type_of(schema, item)}"
+    if kind == "object":
+        values = node.get("additionalProperties")
+        if isinstance(values, dict):
+            return f"map of string to {type_of(schema, schema.unwrap(values))}"
+        return "object"
+    return str(kind or "any")
+
+
+def bounds_of(schema: Schema, node: dict[str, Any]) -> list[str]:
+    """The constraints on a value, one phrase each."""
+    if branches := node.get("oneOf"):
+        phrases: list[str] = []
+        for branch in branches:
+            phrases.extend(bounds_of(schema, branch))
+        return phrases
+
+    out: list[str] = []
+    if values := node.get("enum"):
+        out.append("one of " + ", ".join(f"`{value}`" for value in values))
+    if pattern := node.get("pattern"):
+        out.append(f"matches `{pattern}`")
+    low, high = node.get("minLength"), node.get("maxLength")
+    if low is not None and high is not None:
+        out.append(f"{low} to {high} characters")
+    elif high is not None:
+        out.append(f"at most {high} characters")
+    elif low is not None:
+        out.append(f"at least {low} characters")
+    low, high = node.get("minimum"), node.get("maximum")
+    if low is not None and high is not None:
+        out.append(f"{fmt(low)} to {fmt(high)}")
+    elif low is not None:
+        out.append(f"at least {fmt(low)}")
+    elif high is not None:
+        out.append(f"at most {fmt(high)}")
+    if node.get("additionalProperties") is False:
+        out.append("no unknown keys")
+    return out
+
+
+def fmt(value: Any) -> str:
+    """A number as YAML would write it: no trailing `.0` on a whole one."""
+    if isinstance(value, float) and value.is_integer():
+        return str(int(value))
+    return str(value)
+
+
+def example_of(schema: Schema, node: dict[str, Any]) -> Any | None:
+    """An example of this value: the schema's own, or one its shape implies.
+
+    Three shapes imply one. A boolean has two values and `true` is the interesting
+    one; a map is one entry, and both halves of that entry are types with examples of
+    their own; a list of scalars is one item. Anything else without an example in the
+    schema gets none, because a made-up value in a reference is worse than a gap --
+    it gets copied.
+    """
+    if examples := node.get("examples"):
+        return examples[0]
+    if branches := node.get("oneOf"):
+        for branch in branches:
+            if found := example_of(schema, branch):
+                return found
+    if values := node.get("enum"):
+        return values[0]
+
+    kind = node.get("type")
+    if isinstance(kind, list):
+        kind = next((k for k in kind if k != "null"), None)
+
+    if kind == "boolean":
+        return True
+    if kind == "object":
+        values_schema = node.get("additionalProperties")
+        if isinstance(values_schema, dict):
+            key = example_of(schema, schema.unwrap(node.get("propertyNames", {}))) or "key"
+            value = example_of(schema, schema.unwrap(values_schema))
+            if value is not None:
+                return {str(key): value}
+    if kind == "object" and node.get("properties"):
+        # An object's example is the example of each field it insists on. Only the
+        # required ones, so nothing here suggests a combination the server refuses --
+        # `body` and `json` on a response are exclusive, and neither is required.
+        built = {}
+        for name in node.get("required", []):
+            child = schema.unwrap(node["properties"].get(name, {}))
+            found = example_of(schema, child)
+            if found is None:
+                return None
+            built[name] = found
+        return built or None
+    if kind == "array":
+        item = schema.unwrap(node.get("items", {}))
+        found = example_of(schema, item)
+        if found is not None:
+            return [found]
+    return None
+
+
+def yaml_scalar(value: Any) -> str:
+    """A scalar as YAML, quoted only where it has to be."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return fmt(value)
+    if isinstance(value, list):
+        return "[" + ", ".join(yaml_scalar(item) for item in value) + "]"
+    text = str(value)
+    needs_quotes = text == "" or text[0] in "*&!%@`>|{[#?-'\"" or ": " in text or "\\" in text
+    return json.dumps(text) if needs_quotes else text
+
+
+def yaml_block(value: Any, indent: int) -> list[str]:
+    """A structured example as block YAML, indented to sit under its key."""
+    pad = " " * indent
+    if isinstance(value, dict):
+        lines: list[str] = []
+        for name, item in value.items():
+            if isinstance(item, (dict, list)):
+                lines.append(f"{pad}{name}:")
+                lines += yaml_block(item, indent + 2)
+            else:
+                lines.append(f"{pad}{name}: {yaml_scalar(item)}")
+        return lines
+    if isinstance(value, list):
+        lines = []
+        for item in value:
+            if isinstance(item, dict):
+                # The dash takes two columns, so the element's keys sit two in from
+                # the list itself -- and its first key shares the dash's line.
+                inner = yaml_block(item, indent + 2)
+                first = inner[0].lstrip()
+                lines.append(f"{pad}- {first}")
+                lines += inner[1:]
+            else:
+                lines.append(f"{pad}- {yaml_scalar(item)}")
+        return lines
+    return [f"{pad}{yaml_scalar(value)}"]
+
+
+def example_block(path: str, value: Any) -> str:
+    """The example in place, so it can be pasted into a document.
+
+    `proxies[].mocks[].request.url` becomes the keys that reach it, with a list
+    element opened by a dash wherever the path crossed a list -- and the element's
+    first key on the same line as its dash, which is how a person writes YAML.
+    """
+    lines: list[str] = []
+    indent = 0
+    pending = ""
+    segments = path.split(".")
+    for index, segment in enumerate(segments):
+        key = segment.removesuffix("[]")
+        listed = segment.endswith("[]")
+        head = " " * indent + pending
+        if pending:
+            # The dash occupies two columns; what follows it lines up after them.
+            indent += 2
+            pending = ""
+        if index == len(segments) - 1:
+            if isinstance(value, (dict, list)):
+                lines.append(f"{head}{key}:")
+                lines += yaml_block(value, indent + 2)
+                break
+            lines.append(f"{head}{key}: {yaml_scalar(value)}")
+            break
+        lines.append(f"{head}{key}:")
+        indent += 2
+        if listed:
+            pending = "- "
+    body = "\n".join(lines)
+    return f"```yaml\n{body}\n```"
+
+
+def section(
+    schema: Schema, path: str, node: dict[str, Any], required: bool, level: int = 3
+) -> str:
+    """One parameter, as Markdown."""
+    out = [f"{'#' * level} `{path}` {{ #{anchor(path)} }}", ""]
+    if description := node.get("description", "").strip():
+        out += [description, ""]
+
+    rows = [("Type", type_of(schema, node)), ("Required", "yes" if required else "no")]
+    if phrases := bounds_of(schema, node):
+        rows.append(("Rules", "; ".join(phrases)))
+    out += ["| | |", "|---|---|"]
+    out += [f"| {name} | {value} |" for name, value in rows]
+    out.append("")
+
+    example = example_of(schema, node)
+    if example is not None:
+        out += [example_block(path, example), ""]
+    return "\n".join(out)
+
+
+def walk(schema: Schema, path: str, node: dict[str, Any], out: list[str]) -> None:
+    """Emit a section for every parameter under `node`, depth first."""
+    properties: dict[str, Any] = node.get("properties", {})
+    required: list[str] = node.get("required", [])
+    for name, raw in properties.items():
+        child = schema.unwrap(raw)
+        # The field's own description wins over the type's: it says what this field
+        # is for, where the type says what the value may be.
+        if raw.get("description"):
+            child = {**child, "description": raw["description"]}
+
+        child_path = f"{path}.{name}" if path else name
+        out.append(section(schema, child_path, child, name in required))
+
+        if child.get("type") == "object" and child.get("properties"):
+            walk(schema, child_path, child, out)
+        elif child.get("type") == "array":
+            item = schema.unwrap(child.get("items", {}))
+            if item.get("properties"):
+                walk(schema, f"{child_path}[]", item, out)
+
+
+def render(document: dict[str, Any]) -> str:
+    schema = Schema(document)
+    out = [HEADER]
+    for name, raw in document.get("properties", {}).items():
+        node = schema.unwrap(raw)
+        if raw.get("description"):
+            node = {**node, "description": raw["description"]}
+        out.append("---\n")
+        # The top-level parameter is the section: heading it twice would give the
+        # page eight headings that say nothing the one below them does not.
+        out.append(section(schema, name, node, name in document.get("required", []), level=2))
+        if node.get("type") == "object" and node.get("properties"):
+            walk(schema, name, node, out)
+        elif node.get("type") == "array":
+            item = schema.unwrap(node.get("items", {}))
+            if item.get("properties"):
+                walk(schema, f"{name}[]", item, out)
+    return "\n".join(out).rstrip() + "\n"
+
+
+def main() -> None:
+    if not SCHEMA.is_file():
+        fail(f"{SCHEMA} is missing; run `uv run scripts/config_schema.py` first")
+    document = json.loads(SCHEMA.read_text())
+    generated = render(document)
+
+    if "--check" in sys.argv:
+        current = OUTPUT.read_text() if OUTPUT.is_file() else ""
+        if current != generated:
+            fail(
+                f"{OUTPUT.relative_to(ROOT)} is stale; regenerate it with "
+                "`uv run scripts/parameters_doc.py`"
+            )
+        print(f"parameters-doc: {OUTPUT.relative_to(ROOT)} is up to date")
+        return
+
+    OUTPUT.write_text(generated)
+    print(f"parameters-doc: wrote {OUTPUT.relative_to(ROOT)}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/third_party.py b/scripts/third_party.py
index e001a0f..e42507f 100755
--- a/scripts/third_party.py
+++ b/scripts/third_party.py
@@ -14,6 +14,11 @@
 hand-maintained list survives -- so the list is generated and the generation is
 checked in CI-style with `--check`.
 
+Both ecosystems, because the binary redistributes both: the dashboard's
+JavaScript is compiled into `frontend/dist` and then embedded into the
+executable, which makes every npm package in that bundle as redistributed as any
+crate. `CONTRIBUTING.md` has promised this since before it was true.
+
 Versions come from the resolve graph rather than from a name lookup. Two
 versions of one crate routinely coexist in a Rust graph, and picking by name
 silently reports whichever came last: an early draft of this file recorded
@@ -53,8 +58,9 @@
 
 HEADER = """# Third-party notices
 
-Doppel links its dependencies statically, so a released binary contains the
-work below. Each retains its own copyright and is distributed under its own
+Doppel links its dependencies statically and embeds the dashboard's compiled
+JavaScript, so a released binary contains the work below -- crates and npm
+packages alike. Each retains its own copyright and is distributed under its own
 licence.
 
 Generated from the resolved dependency graph by `scripts/third_party.py`. Do
@@ -63,6 +69,107 @@
 """
 
 
+def shipped_npm_names() -> set[str]:
+    """The npm packages whose code reaches the bundle.
+
+    `npm ls --omit=dev`, walked: only these are redistributed, because only these
+    are compiled into `frontend/dist` and embedded in the binary. Everything else
+    -- vite, jest, eslint, tailwind's compiler and the tooling underneath them --
+    runs on a developer's machine and ships nowhere, so listing it would claim a
+    redistribution that does not happen and would drag the policy over licences
+    that never travel.
+
+    That distinction is not cosmetic: the tooling closure carries Blue Oak and
+    CC-BY, and adding those to the permitted set to silence the check would have
+    widened the policy for code the project does not distribute.
+    """
+    raw = subprocess.run(
+        ["npm", "ls", "--omit=dev", "--all", "--json"],
+        capture_output=True,
+        text=True,
+        cwd=ROOT / "frontend",
+        # `npm ls` exits non-zero for an incomplete tree while still printing a
+        # usable one, so the exit code is not the signal; an empty or unparseable
+        # output is.
+        check=False,
+    ).stdout
+    if not raw:
+        raise SystemExit(
+            "third-party: `npm ls --omit=dev` printed nothing, so the npm half of "
+            "the notices would be silently empty; run `npm --prefix frontend ci`"
+        )
+
+    names: set[str] = set()
+
+    def walk(node: dict) -> None:
+        for name, child in (node.get("dependencies") or {}).items():
+            if name not in names:
+                names.add(name)
+                if isinstance(child, dict):
+                    walk(child)
+
+    walk(json.loads(raw))
+    if not names:
+        # The manifest has runtime dependencies, so an empty walk means the tree
+        # was not read rather than that nothing ships -- and writing the file from
+        # it would drop the npm half without saying so.
+        raise SystemExit(
+            "third-party: no shipped npm packages were found; the tree in "
+            "frontend/node_modules does not match frontend/package.json"
+        )
+    return names
+
+
+def npm_packages() -> list[tuple[str, str, str, str]]:
+    """Every shipped npm package, as (name, version, licence, repository).
+
+    Licences are read from the installed tree: `npm ls --json` does not report
+    them, and the registry would make generating this file need the network. A
+    missing `node_modules` yields an empty list; `main` decides whether that is a
+    failure.
+    """
+    root = ROOT / "frontend" / "node_modules"
+    if not root.is_dir():
+        # Refused rather than skipped, in both modes. Returning an empty list here
+        # made `--check` report a stale file -- true, but the wrong sentence -- and
+        # made a plain run *write* a cargo-only file that then looked correct. The
+        # missing half has to be an error where the half goes missing.
+        raise SystemExit(
+            "third-party: frontend/node_modules is absent, so the npm half of the "
+            "notices cannot be read; run `npm --prefix frontend ci`"
+        )
+    shipped = shipped_npm_names()
+
+    found: list[tuple[str, str, str, str]] = []
+    for manifest in sorted(root.glob("*/package.json")) + sorted(
+        root.glob("@*/*/package.json")
+    ):
+        try:
+            meta = json.loads(manifest.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            continue
+        name = meta.get("name")
+        if not name or name not in shipped:
+            continue
+        licence = meta.get("license") or meta.get("licence")
+        if isinstance(licence, dict):
+            # The old form, still in a few long-lived packages.
+            licence = licence.get("type")
+        if isinstance(licence, list):
+            licence = " OR ".join(
+                entry.get("type", "") if isinstance(entry, dict) else str(entry)
+                for entry in licence
+            )
+        repository = meta.get("repository")
+        if isinstance(repository, dict):
+            repository = repository.get("url", "")
+        url = (repository or "").removeprefix("git+").removesuffix(".git")
+        if url.startswith("git://"):
+            url = "https://" + url.removeprefix("git://")
+        found.append((name, meta.get("version", ""), licence or "(not declared)", url))
+    return found
+
+
 def graph() -> tuple[dict, set[str], dict]:
     raw = subprocess.run(
         ["cargo", "metadata", "--format-version", "1", "--all-features"],
@@ -104,6 +211,7 @@ def render() -> str:
     by_id, reachable, _ = graph()
     rows = sorted(
         (
+            "cargo",
             by_id[i]["name"],
             by_id[i]["version"],
             by_id[i].get("license") or "(not declared)",
@@ -111,17 +219,28 @@ def render() -> str:
         )
         for i in reachable
     )
+    rows += sorted(
+        ("npm", name, version, licence, url)
+        for name, version, licence, url in npm_packages()
+    )
 
     unpermitted = [
-        (n, v, lic)
-        for n, v, lic, _ in rows
+        (f"{ecosystem}:{n}", v, lic)
+        for ecosystem, n, v, lic, _ in rows
         if not (set(alternatives(lic)) & PERMITTED)
     ]
 
-    lines = [HEADER, f"{len(rows)} packages.\n", "| Package | Version | Licence |", "|---|---|---|"]
-    for name, version, lic, repo in rows:
+    cargo = sum(1 for row in rows if row[0] == "cargo")
+    npm = len(rows) - cargo
+    lines = [
+        HEADER,
+        f"{len(rows)} packages: {cargo} from crates.io, {npm} from npm.\n",
+        "| Package | Ecosystem | Version | Licence |",
+        "|---|---|---|---|",
+    ]
+    for ecosystem, name, version, lic, repo in rows:
         shown = f"[{name}]({repo})" if repo.startswith("http") else name
-        lines.append(f"| {shown} | {version} | {lic} |")
+        lines.append(f"| {shown} | {ecosystem} | {version} | {lic} |")
     lines.append("")
 
     if unpermitted: