clay-server 5.1.1-beta.1 → 5.2.0-beta.2

package/lib/public/modules/server-settings.js

@@ -1,4 +1,5 @@
 import { initStorageUsage, loadStorageUsage } from './server-storage-settings.js';
+import { initAccountAuthSettings, loadAccountAuthSettings } from './account-auth-settings.js';
 // Full-app server administration shell. Page state survives navigation and closing.
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
@@ -7,7 +8,7 @@ import { closeFileViewer } from './filebrowser.js';
 import { checkAdminAccess, loadAdminSection } from './admin.js';
 import { openUserSettings } from './user-settings.js';
 import { initNetworkSettings, loadNetworkSettings } from './server-network-settings.js';
-import { initServerControls } from './server-settings-controls.js';
+import { initServerControls, setServerPinAvailability } from './server-settings-controls.js';
 import { initServerEnvironment, loadSharedEnv } from './server-settings-environment.js';
 import { renderSettingsNavigation } from './server-settings-navigation.js';
 import { hasSettingsDrafts, confirmSettingsAction, trapSettingsFocus } from './server-settings-state.js';
@@ -41,6 +42,7 @@ function selectPage(id, focus) {
   });
   document.getElementById('settings-nav-dropdown').value = id;
   if (id === 'network') loadNetworkSettings();
+  if (id === 'security') loadAccountAuthSettings();
   if (id === 'storage') loadStorageUsage();
   if (id === 'environment') loadSharedEnv();
   if (id.indexOf('admin-') === 0) {
@@ -64,6 +66,8 @@ async function openSettings() {
   var status = document.getElementById('settings-access-status');
   status.textContent = 'Checking administrator access…';
   store.set({ serverSettingsAuthorized: false });
+  var serverPinSection = document.getElementById('settings-server-pin');
+  if (serverPinSection) serverPinSection.hidden = true;
   root().querySelectorAll('.server-settings-section').forEach(function (page) { page.classList.remove('active'); });
   try {
     var response = await fetch('/api/me', { credentials: 'same-origin' });
@@ -78,6 +82,7 @@ async function openSettings() {
     await checkAdminAccess();
     if (!isSettingsOpen()) return;
     store.set({ serverSettingsAuthorized: true });
+    setServerPinAvailability(!data.multiUser);
     status.textContent = '';
     renderSettingsNavigation(!!data.multiUser, selectPage);
     selectPage(store.get('serverSettingsPage') || 'overview', false);
@@ -111,7 +116,7 @@ function closeSettings() {
 
 export function initServerSettings() {
   if (!root()) return;
-  initNetworkSettings(); initServerControls(); initServerEnvironment(); initStorageUsage();
+  initNetworkSettings(); initServerControls(); initServerEnvironment(); initStorageUsage(); initAccountAuthSettings();
   document.getElementById('server-settings-btn').addEventListener('click', openSettings);
   document.getElementById('server-settings-close').onclick = closeSettings;
   document.getElementById('settings-personal-link').onclick = function () {

package/lib/public/modules/user-settings-account.js

@@ -1,4 +1,5 @@
 import { refreshIcons } from './icons.js';
+import { resetAccountSessions } from './user-settings-sessions.js';
 import { confirmSettingsAction as showConfirmDialog } from './server-settings-state.js';
 import { store } from './store.js';
 import { getWs } from './ws-ref.js';
@@ -10,6 +11,7 @@ import { syncCapsulePreference } from './capsule-preference.js';
 import { getEmailAccountListCache } from './context-sources.js';
 function applyProjectMateDmsClass(enabled) { document.body.classList.toggle('project-mate-dms-disabled', !enabled); }
 export function showPinForm() {
+  if (store.get('userPasswordEnabled')) { window.location.href = '/account/password'; return; }
   var pinForm = document.getElementById('us-pin-form');
   if (!pinForm) return;
   if(!pinForm.classList.contains('hidden'))return;
@@ -76,6 +78,7 @@ export function hidePinForm(force) {
 // --- Account population ---
 
 export function populateAccount() {
+  resetAccountSessions();
   fetch('/api/profile').then(function (r) {
     if (!r.ok) return null;
     return r.json();
@@ -98,9 +101,19 @@ export function populateAccount() {
       if (data.role) parts.push(data.role.charAt(0).toUpperCase() + data.role.slice(1));
       accountSubline.textContent = parts.length ? parts.join(' · ') : 'Local profile';
     }
-    store.set({userPinEnabled:!!data.pinEnabled});
+    store.set({userPinEnabled:!!data.pinEnabled, userPasswordEnabled:!!data.passwordEnabled});
+    var passkeyRow = document.getElementById('us-passkey-row');
+    if (passkeyRow) passkeyRow.hidden = !data.passwordEnabled;
+    var sessionsRow = document.getElementById('us-sessions-row');
+    if (sessionsRow) sessionsRow.hidden = !data.passwordEnabled && !data.pinEnabled;
     if (pinSetBtnEl) {
       pinSetBtnEl.textContent = store.get('userPinEnabled') ? 'Change PIN' : 'Set PIN';
+      if (data.passwordEnabled) pinSetBtnEl.textContent = 'Change password';
+      var row = pinSetBtnEl.closest('.settings-field-row');
+      if (row) {
+        row.querySelector('.settings-label').textContent = data.passwordEnabled ? 'Password' : 'Account PIN';
+        row.querySelector('.settings-hint').textContent = data.passwordEnabled ? 'Change your account password or passphrase.' : 'Manage your account PIN.';
+      }
     }
     if (pinFormTitle) {
       pinFormTitle.textContent = store.get('userPinEnabled') ? 'Change PIN' : 'Set PIN';

package/lib/public/modules/user-settings-sessions.js

@@ -0,0 +1,120 @@
+import { store } from './store.js';
+
+function describe(value) {
+  if (!value || value === 'Earlier session') return 'Unknown device';
+  var browser = /Edg(?:e|A|iOS)?\//.test(value) ? 'Edge' : /Firefox\/|FxiOS\//.test(value) ? 'Firefox' : /Chrome\/|CriOS\//.test(value) ? 'Chrome' : /Safari\//.test(value) ? 'Safari' : 'Browser';
+  var system = /Android/.test(value) ? 'Android' : /iPhone|iPad/.test(value) ? 'iOS' : /Windows/.test(value) ? 'Windows' : /Macintosh/.test(value) ? 'macOS' : /Linux/.test(value) ? 'Linux' : '';
+  return browser + (system ? ' on ' + system : '');
+}
+function state() { return store.get('accountSessionsPanel') || { epoch: 0, open: false, entries: [] }; }
+function update(values) { store.set({ accountSessionsPanel: Object.assign({}, state(), values) }); render(); }
+function render() {
+  var panel = document.getElementById('us-sessions-panel'); if (!panel) return;
+  var scroll = []; var ancestor = panel.parentElement;
+  while (ancestor) { scroll.push({ element: ancestor, top: ancestor.scrollTop }); ancestor = ancestor.parentElement; }
+  var current = state(); var toggle = document.getElementById('us-sessions-toggle');
+  panel.hidden = !current.open; toggle.setAttribute('aria-expanded', String(!!current.open));
+  toggle.textContent = current.open ? 'Hide sessions' : 'Manage sessions'; toggle.disabled = !!current.saving;
+  var list = panel.querySelector('[data-list]'); list.replaceChildren();
+  var previousGroup = panel.querySelector('[data-earlier]'); if (previousGroup) previousGroup.remove();
+  var unknown = current.entries.filter(function (entry) { return entry.unknownDevice && !entry.current; });
+  var older = document.createElement('details'); older.dataset.earlier = ''; var summary = document.createElement('summary');
+  summary.className = 'settings-label'; summary.textContent = 'Earlier sessions without device details (' + unknown.length + ')'; older.append(summary);
+  var explanation = document.createElement('p'); explanation.className = 'settings-hint';
+  explanation.textContent = 'These sessions predate device tracking. Their browser and previous activity are unknown; matching labels do not mean they are the same device.';
+  older.append(explanation); older.open = !!current.showEarlier;
+  older.ontoggle = function () { if (older.isConnected) store.set({ accountSessionsPanel: Object.assign({}, state(), { showEarlier: older.open }) }); };
+  var olderList = document.createElement('div'); olderList.setAttribute('role', 'list'); older.append(olderList);
+  current.entries.forEach(function (entry) {
+    var row = document.createElement('div'); row.className = 'settings-field-row'; row.setAttribute('role', 'listitem');
+    var detail = document.createElement('div'); var title = document.createElement('span'); title.className = 'settings-label';
+    title.textContent = describe(entry.userAgent) + (entry.current ? ' · This session' : '');
+    var hint = document.createElement('p'); hint.className = 'settings-hint';
+    hint.textContent = entry.method + (entry.lastSeenAt ? ' · Last active ' + new Date(entry.lastSeenAt).toLocaleString() : ' · Previous activity unknown') +
+      (entry.address ? ' · Last observed IP ' + entry.address : '') +
+      (entry.expiresAt ? ' · Expires ' + new Date(entry.expiresAt).toLocaleDateString() : ' · Compatibility session');
+    detail.append(title, hint);
+    var button = document.createElement('button'); button.type = 'button'; button.className = 'settings-btn-sm'; button.textContent = 'Sign out';
+    button.dataset.sessionId = entry.id; button.setAttribute('aria-label', 'Sign out ' + describe(entry.userAgent) + (entry.current ? ' current session' : ''));
+    button.disabled = !!current.pending;
+    button.onclick = function () { choose(entry.id); };
+    if (current.target === entry.id) {
+      var confirmation = document.createElement('div'); confirmation.className = 'us-session-row-confirm';
+      confirmation.setAttribute('role', 'group'); confirmation.setAttribute('aria-label', 'Confirm session sign-out');
+      var question = document.createElement('p'); question.className = 'settings-hint';
+      question.textContent = entry.current ? 'Sign out this browser? You will need to sign in again.' : 'Sign out this session?';
+      var actions = document.createElement('div'); actions.className = 'settings-form-actions';
+      var confirm = document.createElement('button'); confirm.type = 'button'; confirm.className = 'settings-btn-sm settings-btn-danger';
+      confirm.dataset.rowConfirm = ''; confirm.textContent = current.saving ? 'Signing out…' : 'Sign out'; confirm.disabled = !!current.pending;
+      confirm.onclick = function () { request(entry.id); };
+      var cancel = document.createElement('button'); cancel.type = 'button'; cancel.className = 'settings-btn-sm';
+      cancel.dataset.rowCancel = ''; cancel.textContent = 'Cancel'; cancel.disabled = !!current.pending;
+      cancel.onclick = function () { update({ target: null, error: '' }); restoreFocus(entry.id); };
+      actions.append(confirm, cancel); confirmation.append(question, actions);
+      if (current.error) { var error = document.createElement('p'); error.className = 'settings-status'; error.setAttribute('role', 'alert'); error.textContent = current.error; confirmation.append(error); }
+      row.append(detail, confirmation);
+    } else row.append(detail, button);
+    (entry.unknownDevice && !entry.current ? olderList : list).append(row);
+  });
+  if (unknown.length) list.after(older);
+  panel.querySelector('[data-status]').textContent = current.target && current.target !== 'others' ? '' : current.error || (current.pending ? current.saving ? 'Signing out…' : 'Loading sessions…' : current.message || '');
+  panel.querySelector('[data-retry]').hidden = !current.error || !!current.target;
+  panel.querySelector('[data-others]').disabled = !!current.pending || !current.entries.some(function (entry) { return !entry.current; });
+  panel.querySelector('[data-confirmation]').hidden = current.target !== 'others';
+  var selected = current.entries.find(function (entry) { return entry.id === current.target; });
+  panel.querySelector('[data-question]').textContent = selected && selected.current ? 'Sign out this browser? Your settings will close and you will need to sign in again.' : 'Sign out the selected sessions? Their open connections will close.';
+  panel.querySelector('[data-confirm]').disabled = !!current.pending;
+  panel.querySelector('[data-cancel]').disabled = !!current.pending;
+  scroll.forEach(function (position) { position.element.scrollTop = position.top; });
+}
+function choose(id) {
+  update({ target: id, error: '', message: '' });
+  document.querySelector(id === 'others' ? '#us-sessions-panel [data-confirm]' : '#us-sessions-panel [data-row-confirm]').focus({ preventScroll: true });
+}
+function restoreFocus(id) {
+  var panel = document.getElementById('us-sessions-panel');
+  var button = Array.from(panel.querySelectorAll('[data-session-id]')).find(function (item) { return item.dataset.sessionId === id; });
+  (button || (id === 'others' ? panel.querySelector('[data-others]') : document.getElementById('us-sessions-toggle'))).focus({ preventScroll: true });
+}
+async function request(id) {
+  var entries = state().entries; var index = entries.findIndex(function (entry) { return entry.id === id; });
+  var neighbor = entries[index + 1] || entries[index - 1];
+  var epoch = state().epoch + 1;
+  update({ epoch: epoch, pending: true, saving: !!id, error: '', message: '' });
+  try {
+    var response = await fetch('/api/account-sessions', id ? { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ id: id }) } : {});
+    var data = await response.json();
+    if (epoch !== state().epoch) return;
+    if (!response.ok) {
+      if (response.status === 401 || response.status === 403) update({ entries: [], target: null });
+      throw new Error(data.error || 'Could not manage sessions.');
+    }
+    if (data.signedOut) { window.location.href = '/'; return; }
+    update({ entries: data.sessions, target: null, pending: false, saving: false, message: id ? 'Selected sessions signed out.' : '' });
+    if (id) restoreFocus(id === 'others' ? id : neighbor && neighbor.id);
+  } catch (error) {
+    if (epoch === state().epoch) update({ pending: false, saving: false, error: error.message });
+    var retry = document.querySelector('#us-sessions-panel [data-row-confirm]');
+    if (epoch === state().epoch && id && retry) retry.focus({ preventScroll: true });
+  }
+}
+export function resetAccountSessions() {
+  update({ epoch: state().epoch + 1, open: false, entries: [], target: null, pending: false, saving: false, error: '', message: '', showEarlier: false });
+}
+export function initAccountSessions() {
+  var toggle = document.getElementById('us-sessions-toggle'); if (!toggle || document.getElementById('us-sessions-panel')) return;
+  var panel = document.createElement('div'); panel.id = 'us-sessions-panel'; panel.hidden = true;
+  panel.innerHTML = '<p class="settings-hint">Each entry represents a browser session. Account sessions expire after 30 days, or after 7 days without use.</p>' +
+    '<div data-list role="list" aria-label="Signed-in sessions"></div><div class="settings-form-actions"><button type="button" class="settings-btn-sm" data-others>Sign out other sessions</button></div>' +
+    '<div data-confirmation role="group" aria-label="Confirm sign-out" hidden><p class="settings-hint" data-question></p><div class="settings-form-actions"><button type="button" class="settings-btn-sm settings-btn-danger" data-confirm>Sign out</button><button type="button" class="settings-btn-sm" data-cancel>Cancel</button></div></div>' +
+    '<p class="settings-status" role="status" data-status></p><button type="button" class="settings-btn-sm" data-retry hidden>Retry</button>';
+  toggle.closest('.settings-field-row').after(panel);
+  toggle.onclick = function () {
+    if (state().open) { resetAccountSessions(); toggle.focus(); }
+    else { update({ open: true }); request(); }
+  };
+  panel.querySelector('[data-others]').onclick = function () { choose('others'); };
+  panel.querySelector('[data-retry]').onclick = function () { request(); };
+  panel.querySelector('[data-confirm]').onclick = function () { request(state().target); };
+  panel.querySelector('[data-cancel]').onclick = function () { var id = state().target; update({ target: null, error: '' }); restoreFocus(id); };
+}

package/lib/public/modules/user-settings.js

@@ -1,4 +1,5 @@
 import { initPersonalAppearance } from './user-settings-appearance.js';
+import { initAccountSessions, resetAccountSessions } from './user-settings-sessions.js';
 import { initPersonalVoice } from './user-settings-voice.js';
 import { isolateSettingsDialog } from './server-settings-state.js';
 import { initPersonalProfile } from './user-settings-profile.js';
@@ -29,6 +30,7 @@ var pinCancelBtn = null;
 
 export function initUserSettings() {
   buildUserSettingsLayout();
+  initAccountSessions();
   settingsEl = document.getElementById('user-settings');
   openBtn = document.getElementById('user-settings-btn');
   closeBtn = document.getElementById('user-settings-close');
@@ -204,6 +206,7 @@ export function openUserSettings(initialSection) {
 
 export function closeUserSettings() {
   guardUserSettingsLeave(function () {
+    resetAccountSessions();
     finishUserSettingsExtras();
     settingsEl.classList.add('hidden');
     var restore=store.get('userSettingsRestore');if(restore)restore();store.set({userSettingsRestore:null});

package/lib/public/modules/you-activity.js

@@ -7,6 +7,7 @@ function state() { return store.get('youActivity') || {}; }
 function put(values) { store.set({ youActivity: Object.assign({}, state(), values) }); }
 function el(id) { return document.getElementById(id); }
 function describe(item) {
+  if (item.action === 'delete') return 'You deleted a memory from Me.';
   if (item.action === 'archive') return 'Clay stopped using a memory about you.';
   return (item.action === 'update' ? 'Clay updated: ' : 'Clay remembered: ') + (item.summary || item.title);
 }
@@ -67,7 +68,7 @@ function render() {
     var text = document.createElement('span'); text.textContent = describe(item);
     var time = document.createElement('small'); time.textContent = relativeTime(item.at);
     button.append(text, time);
-    button.addEventListener('click', function () { close(); openYou(item.action === 'archive' ? null : item.ref); });
+    button.addEventListener('click', function () { close(); openYou(item.action === 'archive' || item.action === 'delete' ? null : item.ref); });
     list.appendChild(button);
   });
   el('you-activity-more').classList.toggle('hidden', state().nextOffset == null);
@@ -76,6 +77,7 @@ export function handleYouActivity(msg) {
   if (!el('you-activity') || (msg.activity && msg.activity.seen)) return;
   if (msg.type === 'you_reviewed') { put({ error: '' }); render(); return; }
   if (msg.type === 'you_changed') {
+    if (msg.activity && msg.activity.deleted) { request(); return; }
     if (msg.activity && msg.activity.error) { put({ error: msg.activity.error }); announce(msg.activity.error); return; }
     put({ error: '' });
     if (msg.activity && msg.activity.id && (state().seen || []).indexOf(msg.activity.id) === -1) {

package/lib/public/modules/you.js

@@ -5,6 +5,8 @@ import { refreshIcons } from './icons.js';
 import { renderList, renderDetail, categoryLabel } from './project-logs-render.js';
 import { registerRightWorkbench, claimRightWorkbench, releaseRightWorkbench } from './right-workbench.js';
 
+var deleteDialog = null;
+var deleteDialogFocus = null;
 function state() { return store.get('you') || {}; }
 function put(values) { store.set({ you: Object.assign({}, state(), values) }); }
 function element(id) { return document.getElementById(id); }
@@ -70,6 +72,37 @@ function requestEntry(ref) {
   put({ readId: sendYou('you_read', { ref: ref }), selected: ref, scroll: element('you-list').scrollTop });
   status(state().readId ? 'Loading…' : 'Reconnect to read this memory.');
 }
+function closeDeleteDialog(force) {
+  if (!deleteDialog) return;
+  if (!force && state().deleteId) return;
+  deleteDialog.classList.add('hidden');
+  put({ deleteId: null, deleteEntry: null });
+  if (deleteDialogFocus && deleteDialogFocus.isConnected) deleteDialogFocus.focus();
+  deleteDialogFocus = null;
+}
+function sendDelete() {
+  var entry = state().deleteEntry;
+  if (!entry || state().deleteId) return;
+  var requestId = sendYou('you_delete', { ref: entry.ref, expectedRevision: entry.revisions });
+  put({ deleteId: requestId });
+  var confirm = deleteDialog.querySelector('[data-action="delete"]');
+  var cancel = deleteDialog.querySelector('[data-action="cancel"]');
+  confirm.disabled = true; cancel.disabled = true;
+  deleteDialog.querySelector('.you-delete-dialog-status').textContent = requestId ? 'Deleting memory… Stored audit history remains.' : 'Reconnect to delete this memory.';
+  if (requestId) { deleteDialog.tabIndex = -1; deleteDialog.focus(); }
+  if (!requestId) { put({ deleteId: null }); confirm.disabled = false; cancel.disabled = false; }
+}
+function deleteEntry(entry) {
+  if (!entry || state().deleteId || !deleteDialog) return;
+  put({ deleteEntry: entry });
+  deleteDialogFocus = document.activeElement;
+  deleteDialog.querySelector('.you-delete-dialog-title').textContent = entry.title || 'Untitled memory';
+  deleteDialog.querySelector('.you-delete-dialog-status').textContent = '';
+  deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+  deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+  deleteDialog.classList.remove('hidden');
+  deleteDialog.querySelector('[data-action="cancel"]').focus();
+}
 function windowState(wide, fullscreen) {
   put({ wide: wide, fullscreen: fullscreen });
   element('you-panel').classList.toggle('project-logs-wide', wide && !fullscreen);
@@ -117,6 +150,25 @@ function ensurePanel() {
     '<div id="you-list" class="project-logs-list" role="list"></div><main id="you-detail" class="project-logs-detail hidden"></main>' +
     '<button id="you-more" type="button" class="you-more hidden">Load more</button>';
   document.getElementById('main-panels').appendChild(panel);
+  var dialog = document.createElement('div');
+  dialog.className = 'project-log-delete-dialog you-delete-dialog hidden';
+  dialog.setAttribute('role', 'dialog'); dialog.setAttribute('aria-modal', 'true'); dialog.setAttribute('aria-labelledby', 'you-delete-heading'); dialog.tabIndex = -1;
+  dialog.innerHTML = '<div class="project-log-delete-dialog-card"><h2 id="you-delete-heading">Delete this memory?</h2><p>This removes the memory from Me immediately. Clay’s audit history will retain that it was deleted.</p><p class="project-log-delete-dialog-title you-delete-dialog-title"></p><p class="project-log-delete-dialog-status you-delete-dialog-status" role="status"></p><div class="project-log-delete-dialog-actions"><button type="button" data-action="cancel">Cancel</button><button type="button" class="danger" data-action="delete">Delete memory</button></div></div>';
+  panel.appendChild(dialog); deleteDialog = dialog;
+  dialog.querySelector('[data-action="cancel"]').addEventListener('click', function () { closeDeleteDialog(false); });
+  dialog.querySelector('[data-action="delete"]').addEventListener('click', sendDelete);
+  dialog.addEventListener('keydown', function (event) {
+    event.stopPropagation();
+    if (event.key === 'Escape') { event.preventDefault(); closeDeleteDialog(false); return; }
+    if (event.key === 'Tab') {
+      var buttons = Array.from(dialog.querySelectorAll('button:not(:disabled)'));
+      if (!buttons.length) { event.preventDefault(); dialog.focus(); return; }
+      var first = buttons[0]; var last = buttons[buttons.length - 1];
+      if (event.shiftKey && document.activeElement === first) { event.preventDefault(); last.focus(); }
+      else if (!event.shiftKey && document.activeElement === last) { event.preventDefault(); first.focus(); }
+    }
+  });
+  dialog.addEventListener('click', function (event) { if (event.target === dialog) closeDeleteDialog(false); });
   element('you-close').addEventListener('click', closeYou);
   element('you-back').addEventListener('click', showList);
   element('you-wide').addEventListener('click', function () { windowState(!state().wide, false); });
@@ -159,6 +211,7 @@ export function openYou(ref) {
   if (ref) element('you-close').focus(); else element('you-search').focus();
 }
 export function closeYou() {
+  closeDeleteDialog(true);
   releaseRightWorkbench('you');
   if (!state().open) return;
   element('you-panel').classList.add('hidden');
@@ -172,6 +225,17 @@ export function closeYou() {
 export function handleYouMessage(msg) {
   if (msg.type === 'you_reviewed') { if (state().open) { requestList(); if (state().selected) requestEntry(state().selected); } return; }
   if (msg.type === 'you_changed') {
+    if (msg.activity && msg.activity.deleted) {
+      requestAttention();
+      if (state().selected === msg.activity.ref) {
+        if (state().deleteEntry && state().deleteEntry.ref === msg.activity.ref) closeDeleteDialog(true);
+        put({ readId: null, renderedRef: null, renderedRevision: null });
+        showList();
+        element('you-search').focus();
+        status('This memory was deleted and is no longer available.');
+      } else if (state().open) requestList();
+      return;
+    }
     requestAttention();
     if (msg.activity && msg.activity.seen) { if (state().open && !state().selected) requestList(); return; }
     if (msg.activity && msg.activity.error) { status(msg.activity.error); return; }
@@ -179,7 +243,7 @@ export function handleYouMessage(msg) {
     return;
   }
   var s = state();
-  var key = { you_attention: 'attentionId', you_seen: 'seenId', you_list: 'listId', you_read: 'readId', you_comment: 'commentId', you_retry: 'retryId' }[msg.operation];
+  var key = { you_attention: 'attentionId', you_seen: 'seenId', you_list: 'listId', you_read: 'readId', you_comment: 'commentId', you_retry: 'retryId', you_delete: 'deleteId' }[msg.operation];
   if (!key || !s[key] || s[key] !== msg.requestId) return;
   var cleared = {}; cleared[key] = null; put(cleared);
   if (msg.operation === 'you_comment' && element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
@@ -189,10 +253,25 @@ export function handleYouMessage(msg) {
     return;
   }
   if (!state().open && msg.operation === 'you_read') return;
-  if (!msg.ok) { if (msg.operation === 'you_read') showList(); status(msg.error || 'Clay could not complete this request.'); return; }
+  if (!msg.ok) {
+    if (msg.operation === 'you_read') showList();
+    if (msg.operation === 'you_delete' && deleteDialog) {
+      deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+      deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+      deleteDialog.querySelector('.you-delete-dialog-status').textContent = msg.error || 'The memory could not be deleted. Try again.';
+    }
+    status(msg.error || 'Clay could not complete this request.'); return;
+  }
   status('');
   var result = msg.result;
-  if (msg.operation === 'you_list') {
+  if (msg.operation === 'you_delete') {
+    closeDeleteDialog(true);
+    put({ deleteEntry: null });
+    showList();
+    element('you-search').focus();
+    requestAttention();
+    status('Memory deleted. Stored audit history remains.');
+  } else if (msg.operation === 'you_list') {
     var entries = s.append ? (s.entries || []).concat(result.items) : result.items;
     put({ entries: entries, nextOffset: result.nextOffset });
     var emptyMessage = state().query || state().category
@@ -210,7 +289,7 @@ export function handleYouMessage(msg) {
     element('you-detail').classList.remove('hidden'); element('you-back').classList.remove('hidden');
     var previousInput = element('you-comment-input');
     var draft = previousInput && previousInput.dataset.ref === result.ref ? previousInput.value : '';
-    renderDetail(element('you-detail'), result, { commentPrefix: 'you', commentReviewer: 'Clay', onComment: function (ref, body, feedback, input) {
+    renderDetail(element('you-detail'), result, { commentPrefix: 'you', commentReviewer: 'Clay', canDelete: !result.deleted, deleteLabel: 'Delete memory', onDelete: deleteEntry, onComment: function (ref, body, feedback, input) {
       if (state().commentId) return;
       put({ commentId: sendYou('you_comment', { ref: ref, body: body }), commentRef: ref });
       input.form.querySelector('button').disabled = !!state().commentId;
@@ -236,13 +315,19 @@ export function initYou() {
   element('you-button').addEventListener('click', function () { openYou(); });
   store.subscribe(function (next, previous) {
     if (next.currentSlug !== previous.currentSlug || next.myUserId !== previous.myUserId) {
-      closeYou(); clearTimeout(state().searchTimer);
+      closeDeleteDialog(true); closeYou(); clearTimeout(state().searchTimer);
       if (next.myUserId !== previous.myUserId) { if (element('you-panel')) element('you-panel').remove(); put({ entries: [], query: '', category: '', attentionVersion: 0, acknowledged: null, attentionId: null, seenId: null }); showAttention({ unread: 0, version: 0 }); }
-      put({ listId: null, readId: null, commentId: null, retryId: null, seenId: null });
+      put({ listId: null, readId: null, commentId: null, retryId: null, seenId: null, deleteId: null, deleteEntry: null });
       if (element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
     }
     if (previous.connected && !next.connected) {
       put({ commentId: null, seenId: null, attentionId: null });
+      if (state().deleteId && deleteDialog) {
+        put({ deleteId: null });
+        deleteDialog.querySelector('[data-action="delete"]').disabled = false;
+        deleteDialog.querySelector('[data-action="cancel"]').disabled = false;
+        deleteDialog.querySelector('.you-delete-dialog-status').textContent = 'Disconnected. Reconnect before deleting. Stored audit history remains.';
+      }
       if (element('you-comment-input')) element('you-comment-input').form.querySelector('button').disabled = false;
       if (state().open) status('Disconnected. Reconnect before sending or refreshing.');
     }

package/lib/public/style.css

@@ -47,6 +47,7 @@
 @import url("css/stt.css");
 @import url("css/profile.css");
 @import url("css/user-settings.css?v=20260828-type1");
+@import url("css/user-settings-sessions.css");
 @import url("css/settings-ui.css");
 @import url("css/admin.css");
 @import url("css/session-search.css");

package/lib/server-account-passkeys.js

@@ -0,0 +1,186 @@
+var crypto = require('crypto');
+var webauthn = require('@simplewebauthn/server');
+var passwords = require('./account-passwords');
+var policyStore = require('./account-passkey-policy');
+
+function attachAccountPasskeys(ctx) {
+  var users = ctx.users;
+  var http = ctx.http;
+  var challenges = require('./account-passkey-challenges').attachChallenges(ctx);
+  function policy() { return policyStore.configured(users.loadUsers()); }
+  function eligible(user) { return user && user.passwordHash && !user.mustChangePin; }
+  function current(req, original) {
+    var user = ctx.getUser(req);
+    if (!eligible(user) || original && (user.id !== original.id || user.passwordHash !== original.passwordHash)) {
+      throw new Error('Your account credentials changed. Sign in again.');
+    }
+    return user;
+  }
+  async function reauthenticate(req, data, admin) {
+    var user = current(req);
+    if (admin && user.role !== 'admin') throw new Error('Administrator access required.');
+    http.throttle(req, user.username);
+    if (!await passwords.verify(data.currentPassword, user.passwordHash)) throw new Error('Current password is incorrect.');
+    user = current(req, user);
+    if (admin && user.role !== 'admin') throw new Error('Administrator access required.');
+    http.clearAttempts(req, user.username);
+    return user;
+  }
+  function samePolicy(expected) {
+    var now = policy();
+    if (!now || now.origin !== expected.origin || now.rpID !== expected.rpID) throw new Error('Passkey settings changed. Please retry.');
+  }
+  function label(value) {
+    if (typeof value !== 'string' || !value.trim() || Array.from(value.trim()).length > 80) throw new Error('Give this passkey a name of 1–80 characters.');
+    return value.trim();
+  }
+  function responseData(data) {
+    var response = data.response;
+    if (!response || typeof response.id !== 'string' || !response.response || typeof response.response.clientDataJSON !== 'string') throw new Error('Invalid passkey response.');
+    var client = JSON.parse(Buffer.from(response.response.clientDataJSON, 'base64url').toString('utf8'));
+    if (client.crossOrigin || client.topOrigin) throw new Error('Open Clay directly to use a passkey.');
+    return response;
+  }
+  function list(user) {
+    return (user.passkeys || []).map(function (key) { return { id: key.id, name: key.name, createdAt: key.createdAt, lastUsedAt: key.lastUsedAt || null }; });
+  }
+  async function registerOptions(req, res, data, config) {
+    var user = await reauthenticate(req, data);
+    var name = label(data.name);
+    if ((user.passkeys || []).length >= 10) throw new Error('You can register up to 10 passkeys.');
+    var handle = user.passkeyUserHandle || crypto.randomBytes(32).toString('base64url');
+    var options = await webauthn.generateRegistrationOptions({
+      rpName: 'Clay', rpID: config.rpID, userID: Buffer.from(handle, 'base64url'), userName: user.username,
+      attestationType: 'none', timeout: 60000, supportedAlgorithmIDs: [-7, -257],
+      authenticatorSelection: { residentKey: 'required', userVerification: 'required' },
+      excludeCredentials: (user.passkeys || []).map(function (key) { return { id: key.id, transports: key.transports }; }),
+    });
+    current(req, user); samePolicy(config);
+    var cookie = challenges.issue(req, config, { purpose: 'register', challenge: options.challenge, userId: user.id,
+      passwordHash: user.passwordHash, session: ctx.sessionToken(req), handle: handle, name: name });
+    http.reply(res, 200, { options: options }, cookie);
+  }
+  async function registerVerify(req, res, data, config) {
+    var proof = challenges.take(req, config, 'register');
+    var user = current(req, { id: proof.userId, passwordHash: proof.passwordHash });
+    if (ctx.sessionToken(req) !== proof.session) throw new Error('Use the same signed-in session to register this passkey.');
+    var response = responseData(data);
+    var result;
+    try {
+      result = await webauthn.verifyRegistrationResponse({ response: response, expectedChallenge: proof.challenge,
+        expectedOrigin: config.origin, expectedRPID: config.rpID, requireUserVerification: true, supportedAlgorithmIDs: [-7, -257] });
+    } catch (error) { throw new Error('Could not verify this passkey. Please try registering again.'); }
+    if (!result.verified) throw new Error('Could not verify this passkey.');
+    current(req, user); samePolicy(config);
+    if (proof.until <= Date.now()) throw new Error('Registration expired. Please try again.');
+    var state = users.loadUsers();
+    user = state.users.find(function (entry) { return entry.id === user.id; });
+    var info = result.registrationInfo; var key = info.credential;
+    if (key.id !== response.id || state.users.some(function (entry) { return (entry.passkeys || []).some(function (saved) { return saved.id === key.id; }); })) {
+      throw new Error('This passkey is already registered or has an invalid identifier.');
+    }
+    if ((user.passkeys || []).length >= 10 || user.passkeyUserHandle && user.passkeyUserHandle !== proof.handle) throw new Error('Passkeys changed. Please register again.');
+    user.passkeyUserHandle = proof.handle;
+    user.passkeys = (user.passkeys || []).concat([{ id: key.id, publicKey: Buffer.from(key.publicKey).toString('base64url'),
+      counter: key.counter, transports: key.transports, name: proof.name, createdAt: new Date().toISOString(),
+      deviceType: info.credentialDeviceType, backedUp: info.credentialBackedUp }]);
+    users.saveUsers(state);
+    http.reply(res, 200, { ok: true, passkeys: list(user) }, challenges.cookie('', config.origin));
+  }
+  async function loginOptions(req, res, config) {
+    http.throttle(req, 'passkey:' + ctx.clientAddress(req));
+    var options = await webauthn.generateAuthenticationOptions({ rpID: config.rpID, userVerification: 'required', timeout: 60000 });
+    samePolicy(config);
+    http.reply(res, 200, { options: options }, challenges.issue(req, config, { purpose: 'login', challenge: options.challenge }));
+  }
+  async function loginVerify(req, res, data, config) {
+    var proof = challenges.take(req, config, 'login');
+    var response = responseData(data);
+    var state = users.loadUsers();
+    var user = state.users.find(function (entry) { return (entry.passkeys || []).some(function (key) { return key.id === response.id; }); });
+    if (!eligible(user) || response.response.userHandle !== user.passkeyUserHandle) throw new Error('Could not sign in with this passkey.');
+    var key = user.passkeys.find(function (entry) { return entry.id === response.id; });
+    var result;
+    try {
+      result = await webauthn.verifyAuthenticationResponse({ response: response, expectedChallenge: proof.challenge,
+        expectedOrigin: config.origin, expectedRPID: config.rpID, requireUserVerification: true,
+        credential: { id: key.id, publicKey: new Uint8Array(Buffer.from(key.publicKey, 'base64url')), counter: key.counter, transports: key.transports } });
+    } catch (error) { throw new Error('Could not sign in with this passkey. Try again or use your password.'); }
+    if (!result.verified || result.authenticationInfo.credentialDeviceType !== key.deviceType) throw new Error('Could not sign in with this passkey.');
+    samePolicy(config);
+    state = users.loadUsers();
+    var latest = state.users.find(function (entry) { return entry.id === user.id; });
+    var latestKey = latest && (latest.passkeys || []).find(function (entry) { return entry.id === key.id; });
+    if (!eligible(latest) || latest.passwordHash !== user.passwordHash || !latestKey || latestKey.publicKey !== key.publicKey ||
+      latestKey.counter !== key.counter || proof.until <= Date.now()) throw new Error('Account credentials changed. Please try again.');
+    latestKey.counter = result.authenticationInfo.newCounter;
+    latestKey.backedUp = result.authenticationInfo.credentialBackedUp;
+    latestKey.lastUsedAt = new Date().toISOString();
+    users.saveUsers(state);
+    var session = ctx.createSession(latest.id, latest.passwordHash, key.id, config.origin.indexOf('https:') === 0, req);
+    http.clearAttempts(req, 'passkey:' + ctx.clientAddress(req));
+    http.reply(res, 200, { ok: true }, session.cookies.concat([challenges.cookie('', config.origin)]));
+  }
+  async function manage(req, res, data, config, remove) {
+    var user = await reauthenticate(req, data);
+    samePolicy(config);
+    var state = users.loadUsers();
+    user = state.users.find(function (entry) { return entry.id === user.id; });
+    var key = (user.passkeys || []).find(function (entry) { return entry.id === data.id; });
+    if (!key) throw new Error('Passkey not found.');
+    if (remove) user.passkeys = user.passkeys.filter(function (entry) { return entry.id !== key.id; });
+    else key.name = label(data.name);
+    users.saveUsers(state);
+    // Removing a passkey also invalidates its sessions through the live session gate.
+    var cookie = remove ? ctx.createSession(user.id, user.passwordHash, null, config.origin.indexOf('https:') === 0, req).cookies : undefined;
+    http.reply(res, 200, { ok: true, passkeys: list(user) }, cookie);
+  }
+  function handleRequest(req, res, url) {
+    if (url === '/auth/passkey-browser.js' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/javascript; charset=utf-8', 'Cache-Control': 'no-cache' });
+      res.end(require('fs').readFileSync(require('path').join(__dirname, 'public/modules/passkey-browser.js'), 'utf8')); return true;
+    }
+    if (url === '/auth/logout' && req.method === 'POST') challenges.clear(req);
+    if (url === '/account/passkeys' && req.method === 'GET') {
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'" });
+      res.end(eligible(ctx.getUser(req)) ? require('./account-passkey-page').render() : require('./account-password-page').render());
+      return true;
+    }
+    if (url === '/auth/passkeys/status' && req.method === 'GET') { http.reply(res, 200, { origin: policy() && policy().origin }); return true; }
+    if (url === '/api/passkey-policy') {
+      var admin = ctx.getUser(req);
+      if (!admin || admin.role !== 'admin') { http.reply(res, 403, { error: 'Administrator access required.' }); return true; }
+      if (req.method === 'GET') {
+        var state = users.loadUsers();
+        http.reply(res, 200, { available: state.accountAuthMethod === 'password', origin: policy() && policy().origin, locked: policyStore.count(state) > 0 }); return true;
+      }
+      if (req.method !== 'PUT') { http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+      http.read(req, res, async function (data) {
+        if (req.headers['sec-fetch-site'] === 'cross-site') throw new Error('Open Clay directly to change passkey settings.');
+        await reauthenticate(req, data, true);
+        var saved = policyStore.save(users, data.origin);
+        http.reply(res, 200, { ok: true, available: true, origin: saved.origin, locked: policyStore.count(users.loadUsers()) > 0 });
+      }); return true;
+    }
+    if (url.indexOf('/api/passkeys') !== 0 && url.indexOf('/auth/passkeys/') !== 0) return false;
+    var config = policy();
+    if (!config) { http.reply(res, 409, { error: 'Your administrator needs to configure passkeys first.' }); return true; }
+    if (url === '/api/passkeys' && req.method === 'GET') {
+      var user = ctx.getUser(req);
+      http.reply(res, eligible(user) ? 200 : 401, eligible(user) ? { origin: config.origin, passkeys: list(user) } : { error: 'Sign in to manage passkeys.' }); return true;
+    }
+    if (req.method !== 'POST') { http.reply(res, 405, { error: 'Method not allowed.' }); return true; }
+    if (req.headers.origin !== config.origin || req.headers['sec-fetch-site'] === 'cross-site') { http.reply(res, 403, { error: 'Use the configured Clay address to use passkeys.' }); return true; }
+    http.read(req, res, async function (data) {
+      if (url === '/api/passkeys/register/options') return registerOptions(req, res, data, config);
+      if (url === '/api/passkeys/register/verify') return registerVerify(req, res, data, config);
+      if (url === '/auth/passkeys/login/options') return loginOptions(req, res, config);
+      if (url === '/auth/passkeys/login/verify') return loginVerify(req, res, data, config);
+      if (url === '/api/passkeys/remove' || url === '/api/passkeys/rename') return manage(req, res, data, config, url.endsWith('/remove'));
+      http.reply(res, 404, { error: 'Passkey endpoint not found.' });
+    }, 32768);
+    return true;
+  }
+  return { handleRequest: handleRequest };
+}
+module.exports = { attachAccountPasskeys: attachAccountPasskeys };