sharequota.com

The site behind ShareQuota — and the gates that keep it honest.

The marketing and documentation site for ShareQuota, the local proxy that pools the AI subscriptions you already pay for behind one endpoint and one key.

111 routes · English-first and locale-scoped from the ground up · eleven automated gates · 0 accessibility findings

⚡ Run it	🧱 Stack	📁 Structure	🗺 Routes
🎨 Design system	🧪 Gates	🌐 i18n	🔁 CI
🤖 llms.txt	🔒 Security	📚 Docs	💥 The product

🇬🇧 English	🇨🇳 简体中文	🇹🇼 繁體中文	🇮🇳 हिन्दी	🇪🇸 Español	🇫🇷 Français	🇸🇦 العربية
🇧🇩 বাংলা	🇧🇷 Português	🇷🇺 Русский	🇯🇵 日本語	🇩🇪 Deutsch	🇰🇷 한국어	🇻🇳 Tiếng Việt
🇮🇩 Indonesia	🇹🇷 Türkçe	🇮🇹 Italiano	🇹🇭 ไทย	🇵🇱 Polski	🇵🇰 اردو	🇺🇦 Українська

[!IMPORTANT] One rule shapes this whole repository: nothing on the site may promise what the software cannot do.

It is not a slogan. It deleted a pricing page, a Get Pro button, an earnings calculator and an entire two-sided marketplace from this codebase. It is why RELEASE_REPO is null and a gate fails the build if any download link renders while there is no release to point at. Read docs/FLOWS.md §0 before adding any control — no automated gate can catch a button that promises something the system cannot deliver.

Contents

🧭 What this repo is

A Next.js 15 App Router site — marketing pages, a nine-page documentation tree, a catalogue of 79 models with a page each, five provider pages, and the legal and project pages a real product needs.

It is built like the product it describes: no analytics, no tag manager, no session recorder, one cookie and one local-storage entry, and every number on a page traceable to the file it was counted from.

What makes it worth reading as a codebase is not the pages — it is the enforcement layer:

One gate fails the build when a claim on /compare goes 90 days without being re-verified. Another fails it if a control's label stops matching what the control actually does.

💥 The product this site describes

ShareQuota — a single Go binary that runs on your machine and puts every AI account you own behind one local endpoint and one key. Free, MIT, no account, no server in the middle.

Claude 8 models key · OAuth

ChatGPT 32 models key · OAuth

Gemini 19 models key · OAuth

DeepSeek 6 models API key

OpenRouter 14 models API key

Claude Code ─┐                                    ┌─→ Claude      (API key · OAuth)
Codex CLI  ──┤                                    ├─→ ChatGPT     (API key · OAuth)
Gemini CLI ──┼──→  localhost:20130  ──────────────┼─→ Gemini      (API key · OAuth)
Your SDK  ───┤     one sq- key                    ├─→ DeepSeek    (API key)
curl ────────┘     4 dialects · 79 models         └─→ OpenRouter  (API key)

Every one of those figures lives in src/lib/site.ts with the file it was counted from, and is rendered on the site next to its source.

[!NOTE] The binary is not published yet. The repository is private and there is no public release, which is why RELEASE_REPO is null, why no download button on the site renders an href, and why npm run qc:releases asserts exactly that. The site says so in plain words rather than saying "coming soon" — which is a promise with a date implied.

⚡ Running it

npm install
npm run dev        # http://localhost:3000 → redirects to /en
npm run build      # production build
npm start          # serve the build
npm run typecheck  # tsc --noEmit
npm run qc         # the eleven gates, in order

Node 20.17.0 — pinned in .nvmrc, which CI reads with node-version-file, so the version is stated once and cannot drift from what a developer runs.

npx playwright install --with-deps chromium
npm run build && npm start &
npm run qc:a11y      # every page × 8 breakpoints × 2 themes
npm run qc:perf      # LCP / CLS / INP against the budget
npm run qc:parity    # diff computed styles against the reference site

🧱 Stack

Next.js 15 App Router

React 19 server-first

Tailwind v4 CSS variables

TypeScript strict

Node 20.17 pinned

Playwright dev only

Six runtime dependencies total — next, react, react-dom, clsx, tailwind-merge, server-only. No component library, no animation library, no icon package: the icons are inline SVG in src/components/ui/icons.tsx.

📁 Project structure

src/
  app/
    📄 layout.tsx                  root shell: fonts, no-flash theme script
    🎨 globals.css                 the whole token system — 2,297 lines, three layers
    🗺 sitemap.ts  robots.ts
    🤖 llms.txt/route.ts           the site described for a model, not a crawler
    📡 rss.xml/route.ts            the changelog as a feed
    🔒 .well-known/security.txt
    [locale]/
      📄 layout.tsx                header + footer, per-locale metadata & hreflang
      🏠 page.tsx                  home — hero, proof, tools, providers, features,
                                   compare, how, download, FAQ, CTA
      📚 models/                   the catalogue + a page per model (79)
      🌐 providers/                the five, + a page each
      💾 download/                 six builds, checksums, installers, requirements
      💲 pricing/                  free, and what actually costs money
      🆚 compare/                  four competitors, and the rows they win
      📖 docs/[slug]/              nine pages, sidebar, prev/next, search
      🏗 architecture/  📓 changelog/  🗺 roadmap/  📄 licenses/  🎨 brand/
      ℹ about/  📬 contact/  🔒 security/  🛡 privacy/  ⚖ terms/  🧭 sitemap/
      🚫 not-found.tsx
      🖼 opengraph-image.tsx        social card, prerendered per locale
  components/
    layout/     header, footer, section rail
    sections/   the home page's ten bands
    docs/       shell, search, callouts, bodies
    models/     catalogue, cards, capability icons, detail drawer
    ui/         primitives, buttons, cards, prose, stats, icons
  content/
    📓 CHANGELOG.md                copied from the binary repo; a gate checks it has not drifted
  i18n/
    ⚙ config.ts                    locale registry + Accept-Language matching
    📦 dictionaries.ts              per-locale dynamic import
    🇬🇧 dictionaries/en.ts           ALL copy — 1,625 lines — and the source of `Dictionary`
  lib/
    📊 site.ts                      product facts: platforms, providers, packages, deps, proof
    🤖 models.generated.ts          GENERATED from the binary's registry — do not hand-edit
    💻 snippets.ts                  every code sample, pointed at one endpoint constant
    🗺 routes.ts                    every route — read by the sitemap AND the route gate
    📖 docs.ts  🔍 seo.ts  📓 changelog.ts  🔢 format.ts
  🚦 middleware.ts                  sends /anything to /<locale>/anything

🧪 scripts/    the gates — see Quality gates
📚 docs/       the reasoning — see Documentation
📋 plans/      the work log: every round, with its measurements

🔍 Facts, copy, and the line between them

Three sources, and the separation is the point.

Nothing user-visible is typed directly into a component. That is what makes translation mechanical rather than an archaeology exercise — and it is why adding a language is three edits and no refactor.

The same discipline runs one level deeper. KEY_PREFIX, LOCAL_ENDPOINT, BINARY and RELEASE_DOCS_URL are constants because they appeared in nine code samples and two prose strings: nine-plus-two places to miss when the binary changes one of them. Every snippet in snippets.ts interpolates them.

🗺 Routes

111 routes per locale — and both directions are asserted. qc:routes reads the sitemap the app generates and checks every URL answers 200; it also checks that everything answering 200 is in the sitemap. A page missing from the sitemap is a page search engines never see, and nothing else in the build would say so.

A model page is not a doorway page: each carries its own routed id, context window, max output, published price per million tokens, price tier, reasoning format, a nine-flag capability matrix, and a runnable request in three dialects. The capability matrix shows both columns — what a model cannot do is a fact about it, and hiding it just moves the surprise to runtime.

/troubleshooting 308s to /docs/troubleshooting. Permanent, and cacheable by browser and CDN: a route that once answered 200 should never start answering 404 without a forwarding address.

🌐 Internationalisation

English-first, but locale-scoped from the ground up. middleware.ts sends /anything to /<locale>/anything, matching Accept-Language by quality value — en-GB lands on en, a malformed header never throws, and the fallback is the default locale rather than a crash.

Adding a language — three edits, no refactor

Routing, <html lang>, the hreflang set, og:locale, the sitemap and the header language switcher all read from that one registry. The switcher renders nothing while only one locale exists and appears on its own once a second one lands. RTL is already in the type (dir: 'ltr' | 'rtl').

qc:i18n catches the three things TypeScript cannot: a locale registered with no loader, a dictionary file that exists but is never registered, and a value left in English inside a translated file.

🇻🇳 Vietnamese is next in the roadmap — the font subset already includes vietnamese and formatVnd() is in lib/format.ts waiting for it. It is queued behind migrating plural handling to ICU MessageFormat, because doing that after two locales exist means editing two files instead of one.

[!WARNING] The defect that produced seo.ts. A page that declares alternates: { canonical } replaces the parent layout's alternates wholesale — Next does not merge the nested languages map. Eight of nine pages silently lost their hreflang tags that way. Every page now builds metadata through pageMetadata(), which makes that mistake unavailable.

🎨 Design system

Three layers, and a component may only consume the last two:

🎨 LAYER 1  PRIMITIVE   raw ramps. The ONLY place a colour literal may appear.
🏷 LAYER 2  SEMANTIC    role tokens (bg, fg, secondary, border, raised…), complete in BOTH themes.
🎛 LAYER 3  COMPONENT   per-component knobs.

Reaching into a primitive from a component is the same defect as hardcoding a hex.

The palette is measured, not eyeballed. It was read off the reference site's live computed styles with a Playwright probe, round-tripped through a canvas so oklab()/lab() come back as honest sRGB. Every value it produced was then checked against the contrast floor, and the ones that failed were corrected rather than copied: nine deviations, each recorded with the number that forced it.

@custom-variant desk (@media (width >= 64rem) and (pointer: fine));

🧪 Quality gates

npm run qc chains eleven, in dependency order. A finding is a defect, not a discussion.

flowchart LR
  A["🔷 typecheck"] --> B["📐 consistency"] --> C["📅 freshness"] --> D["📦 build"]
  D --> E["🔗 routes"] --> F["♿ a11y"] --> G["🔍 seo"] --> H["🔗 links"]
  H --> I["🌐 i18n"] --> J["👆 affordance"] --> K["💾 releases"]

Two more run outside the chain: qc:perf (needs a production server) and qc:parity (diffs computed styles against the reference site).

The accessibility sweep

scripts/qc.mjs drives a real browser over every page at eight widths in both themes and reports what a screenshot at one width cannot show:

It resolves oklab()/oklch() — Tailwind v4 emits those for every /opacity colour, and reading L,a,b as if they were r,g,b invents contrast failures by the hundred. It exempts sr-only elements and sections merely clipping their own decorative glow. So a finding means a defect.

✅ Current state: 0 findings. Treat any regression as a build failure.

The performance budget

The INP number is an approximation and the script says so: real INP is field data over a session. The first version of this gate reported home/phone at 240ms, then 192 / 256 / 272ms across three runs of the same build — a budget gate that changes verdict without the code changing is not a gate, so it now counts only entries with interactionId > 0 and samples deterministically.

🔁 Continuous integration

Split by what each gate costs.

The browser job is ~270 page loads for the accessibility sweep alone, which is why it does not run on every push to a branch. It installs Chromium only, builds, starts the production server, and waits on /en before measuring anything.

🤖 Dependabot runs weekly with minor and patch grouped into one PR — the alternative is a pull request per package and a repo where nobody reads them. Majors stay ungrouped on purpose: Next, React and Tailwind are pinned to versions whose behaviour is measured in docs/, and a major in any of the three is a round of work rather than a merge button.

🤖 The machine-readable surface

llms.txt carries a "What it is not" section, and that is deliberate: the most common wrong answer about this product is that it resells quota, because the name sounds like it should. Stating the negative is what stops it being repeated.

🔒 Security headers and what the site stores

X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: DENY
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

🔐 HSTS is two years and preload-eligible — the one header here with a real cost, and the correct trade for a site that has never served anything over HTTP and has no legacy subdomain to strand.

⚠ There is no CSP, and that is recorded as open rather than made silently. layout.tsx ships a blocking inline theme script, so a real CSP needs a build-computed hash or a per-request nonce — and a nonce forces every one of the static pages to render dynamically. That is a decision with a measurable cost.

What the site stores: 🍪 one cookie (your chosen language) and 💾 one local-storage entry (sq-theme). Both stay on your device. No analytics, no tag manager, no advertising network, no cross-site tracking.

📚 Documentation

docs/ holds the reasoning; the code holds the result.

📋 plans/ is the work log — one directory per round, each with its scout, research, phases, probes, before/after screenshots and a measured report. It is why a claim in this README can be checked rather than believed.

🚀 Deploying

Standard Next.js server build — Vercel, Netlify, Cloudflare, or npm start behind a reverse proxy.

[!CAUTION] output: 'export' is deliberately not used. The middleware needs a real request pipeline; a static export would drop locale negotiation and every visitor would land on English regardless of their browser.

🖼 The image optimizer is off (images: { unoptimized: true }) because the site ships no raster images — copy and SVG only. That also keeps it deployable to any static-capable host.

📦 npm audit reports three high advisories in postcss and sharp, both transitive dependencies of Next itself. The only fix npm offers is a downgrade to next@9, which is not a fix. sharp is never loaded, because the optimizer is disabled.

🚧 Before launch

Placeholders are centralised so each is a single edit.

x.com/sharequota .............. 404
youtube.com/@sharequota ....... 404
facebook.com/sharequota ....... 400
threads.net/@sharequota ....... 200, body says "Unavailable"
t.me/sharequota ............... 200, generic page, og:description EMPTY
zalo.me/sharequota ............ 200, redirects to the Zalo LOGIN page
discord.gg/sharequota ......... 200 marketing page, but the Discord API
                                answers {"message":"Unknown Invite","code":10006}
linkedin / reddit / tiktok .... unverifiable without an account

⚖ The one sanctioned deviation

docs/UX-STANDARDS.md §1 ends: "a finding is a defect, not a discussion — the one exception is a deliberate deviation, which must be recorded in the README with its measured number before it may be suppressed."

It has exactly one entry.

The alternatives were real and were declined, which is what makes this a decision rather than an oversight:

How it is enforced. scripts/qc.mjs carries a DEVIATIONS registry that matches the exact composited pair, so it stops matching the moment either colour moves and cannot widen into cover for a second defect. Every match is printed under its own heading on every run — the gate reports SANCTIONED DEVIATIONS (152 occurrences, 1 distinct) above TOTAL FINDINGS: 0 — so the exception stays visible instead of becoming silence. Removing it is a one-line change in globals.css.

🤝 Contributing

Before adding a control, read docs/FLOWS.md §0. Before adding a colour, read docs/UX-STANDARDS.md §1. Then:

📜 License

MIT — see LICENSE. Copyright © 2026 ShareQuota contributors.

MIT covers the code. It does not cover the name and the mark: say "works with ShareQuota" freely, but do not use the name or logo in a way that suggests this project endorses your work, and do not use it in your own product name, domain or app-store listing. The full rule is on /brand.

One local endpoint for the AI accounts you already pay for.

Free · MIT · no account · no server in the middle

_{Built in Vietnam 🇻🇳 · Every number on this page is counted from the source, not estimated.}