om-memory-system 3.7.0-next.49 → 3.7.0-next.52

package/dist/services/embedding.js

@@ -75,19 +75,62 @@ export async function loadLocalTransformersBackend() {
     return ensureTransformersLoaded();
 }
 function withTimeout(promise, ms) {
+    let timer;
     return Promise.race([
         promise,
-        new Promise((_, reject) => setTimeout(() => reject(new Error(`Timeout after ${ms}ms`)), ms)),
+        new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error(`Timeout after ${ms}ms`)), ms);
+        }),
+    ]).finally(() => clearTimeout(timer));
+}
+/**
+ * The server request for an OpenAI-compatible embedder, or null for the
+ * built-in model. The URL alone selects the server; the key is optional.
+ */
+export function embeddingServerRequest(settings) {
+    if (!settings.embeddingApiUrl)
+        return null;
+    const headers = { "Content-Type": "application/json" };
+    if (settings.embeddingApiKey)
+        headers.Authorization = `Bearer ${settings.embeddingApiKey}`;
+    return { url: `${settings.embeddingApiUrl}/embeddings`, headers };
+}
+/** Changes whenever the embedder or its input text would change. */
+export function embeddingSettingsSignature(settings) {
+    return JSON.stringify([
+        settings.embeddingApiUrl ?? "",
+        settings.embeddingModel,
+        settings.embeddingApiKey ?? "",
+        settings.embeddingUseTaskPrefixes ?? false,
     ]);
 }
 export class EmbeddingService {
+    settings;
     pipe = null;
     initPromise = null;
     isWarmedUp = false;
     /** Set when warmup fails permanently; prevents "initializing forever" (#184). */
     initError = null;
     cache = new Map();
-    cachedModelName = null;
+    signature = null;
+    /** `settings` is read on every call, so a config reload reaches the next embed. */
+    constructor(settings = () => CONFIG) {
+        this.settings = settings;
+    }
+    /** Drop the loaded model, warm state, and cache when the embedder settings change. */
+    resetIfSettingsChanged() {
+        const signature = embeddingSettingsSignature(this.settings());
+        if (this.signature === signature)
+            return;
+        if (this.signature !== null) {
+            this.pipe = null;
+            this.initPromise = null;
+            this.isWarmedUp = false;
+            this.initError = null;
+        }
+        this.clearCache();
+        this.signature = signature;
+    }
     static getInstance() {
         if (!globalThis[GLOBAL_EMBEDDING_KEY]) {
             globalThis[GLOBAL_EMBEDDING_KEY] = new EmbeddingService();
@@ -95,6 +138,7 @@ export class EmbeddingService {
         return globalThis[GLOBAL_EMBEDDING_KEY];
     }
     async warmup(progressCallback) {
+        this.resetIfSettingsChanged();
         if (this.isWarmedUp)
             return;
         if (this.initError)
@@ -105,19 +149,18 @@ export class EmbeddingService {
         return this.initPromise;
     }
     async initializeModel(progressCallback) {
+        const settings = this.settings();
         try {
-            if (CONFIG.embeddingApiUrl && CONFIG.embeddingApiKey) {
+            const server = embeddingServerRequest(settings);
+            if (server) {
                 // Send a probe request to verify the API endpoint is actually reachable
                 // Uses a minimal embedding of "ping" to test the full request pipeline
-                const probeResponse = await withTimeout(fetch(`${CONFIG.embeddingApiUrl}/embeddings`, {
+                const probeResponse = await withTimeout(fetch(server.url, {
                     method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        Authorization: `Bearer ${CONFIG.embeddingApiKey}`,
-                    },
+                    headers: server.headers,
                     body: JSON.stringify({
                         input: "ping",
-                        model: CONFIG.embeddingModel,
+                        model: settings.embeddingModel,
                     }),
                 }), TIMEOUT_MS);
                 if (!probeResponse.ok) {
@@ -129,12 +172,12 @@ export class EmbeddingService {
             }
             // Local model path
             const { pipeline } = await ensureTransformersLoaded();
-            this.pipe = await pipeline("feature-extraction", CONFIG.embeddingModel, {
+            this.pipe = await pipeline("feature-extraction", settings.embeddingModel, {
                 progress_callback: progressCallback,
             });
             this.isWarmedUp = true;
             this.initError = null;
-            log("Embedding model warmed up", { model: CONFIG.embeddingModel });
+            log("Embedding model warmed up", { model: settings.embeddingModel });
         }
         catch (error) {
             const rewritten = formatOnnxruntimeInitError(error);
@@ -145,11 +188,9 @@ export class EmbeddingService {
         }
     }
     async embed(text, options) {
-        if (this.cachedModelName !== CONFIG.embeddingModel) {
-            this.clearCache();
-            this.cachedModelName = CONFIG.embeddingModel;
-        }
-        const input = applyEmbeddingTaskPrefix(text, options);
+        this.resetIfSettingsChanged();
+        const settings = this.settings();
+        const input = applyEmbeddingTaskPrefix(text, options, settings.embeddingUseTaskPrefixes ?? false);
         const cached = this.cache.get(input);
         if (cached)
             return cached;
@@ -160,20 +201,18 @@ export class EmbeddingService {
             await this.initPromise;
         }
         let result;
-        if (CONFIG.embeddingApiUrl && CONFIG.embeddingApiKey) {
-            const response = await fetch(`${CONFIG.embeddingApiUrl}/embeddings`, {
+        const server = embeddingServerRequest(settings);
+        if (server) {
+            const response = await fetch(server.url, {
                 method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    Authorization: `Bearer ${CONFIG.embeddingApiKey}`,
-                },
+                headers: server.headers,
                 body: JSON.stringify({
                     input,
-                    model: CONFIG.embeddingModel,
+                    model: settings.embeddingModel,
                 }),
             });
             if (!response.ok) {
-                throw new Error(`API embedding failed: ${response.statusText}`);
+                throw new Error(`API embedding failed: ${response.status} ${response.statusText}`);
             }
             const data = await response.json();
             result = new Float32Array(data.data[0].embedding);

package/dist/services/global-config-writer.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Written only by the embedding apply route, together, after a passing test.
+ * The general settings save refuses them, so a change always re-embeds.
+ */
+export declare const EMBEDDING_KEYS: Set<string>;
+/** Written only by the browser password route; the password itself lives in a private key file. */
+export declare const PASSWORD_KEYS: Set<string>;
 /** The page may point `memoryApiKey` at a source, never store the key itself. */
 export declare function isSecretReference(value: unknown): value is string;
 export declare class ConfigConflictError extends Error {
@@ -6,7 +13,11 @@ export declare class ConfigConflictError extends Error {
 }
 export declare function readGlobalConfigRevision(): string;
 /** Write only page-editable keys; reject edits based on a stale config revision. */
-export declare function writeGlobalConfigKeys(edits: Record<string, unknown>, expectedRevision: string): Promise<{
+export declare function writeGlobalConfigKeys(edits: Record<string, unknown>, expectedRevision: string, 
+/** A route that owns a separate set of keys passes it; the general save may not touch them. */
+options?: {
+    only?: Set<string>;
+}): Promise<{
     revision: string;
     migratedLegacy: boolean;
 }>;

package/dist/services/global-config-writer.js

@@ -24,6 +24,18 @@ const keys = new Set([
     "importPathMaps",
     "claudeConfigDir",
 ]);
+/**
+ * Written only by the embedding apply route, together, after a passing test.
+ * The general settings save refuses them, so a change always re-embeds.
+ */
+export const EMBEDDING_KEYS = new Set([
+    "embeddingApiUrl",
+    "embeddingApiKey",
+    "embeddingModel",
+    "embeddingDimensions",
+]);
+/** Written only by the browser password route; the password itself lives in a private key file. */
+export const PASSWORD_KEYS = new Set(["webServerAuthPassword", "webServerAuthUsername"]);
 const MEMORY_PROVIDERS = [
     "openai-chat",
     "openai-responses",
@@ -37,6 +49,19 @@ export function isSecretReference(value) {
     return (typeof value === "string" && /^(env:\/\/[A-Za-z_][A-Za-z0-9_]*|file:\/\/.+)$/.test(value.trim()));
 }
 function isValidEdit(key, value) {
+    // `undefined` removes the key from the file.
+    if (key === "embeddingApiUrl") {
+        return value === undefined || (typeof value === "string" && /^https?:\/\/\S+$/.test(value));
+    }
+    if (key === "embeddingApiKey" || key === "webServerAuthPassword") {
+        return value === undefined || isSecretReference(value);
+    }
+    if (key === "webServerAuthUsername") {
+        return value === undefined || (typeof value === "string" && value.trim().length > 0);
+    }
+    if (key === "embeddingDimensions") {
+        return Number.isInteger(value) && value > 0 && value <= 65536;
+    }
     if (key === "captureTrace" || key === "autoBackfill" || key === "webServerAutoStart") {
         return typeof value === "boolean";
     }
@@ -85,16 +110,19 @@ let pending = 0;
 let lastBaseRevision;
 let lastWrittenRevision;
 /** Write only page-editable keys; reject edits based on a stale config revision. */
-export async function writeGlobalConfigKeys(edits, expectedRevision) {
+export async function writeGlobalConfigKeys(edits, expectedRevision, 
+/** A route that owns a separate set of keys passes it; the general save may not touch them. */
+options = {}) {
     if (!edits || !Object.keys(edits).length)
         throw new Error("No settings to save");
     for (const [key, value] of Object.entries(edits)) {
-        if (!keys.has(key))
+        const allowed = options.only ? options.only.has(key) : keys.has(key);
+        if (!allowed)
             throw new Error(`Setting ${key} cannot be edited here`);
         if (!isValidEdit(key, value)) {
             // Never echo the value: a rejected memoryApiKey may be a literal key.
-            throw new Error(key === "memoryApiKey"
-                ? "memoryApiKey must be an env:// or file:// reference"
+            throw new Error(["memoryApiKey", "embeddingApiKey", "webServerAuthPassword"].includes(key)
+                ? `${key} must be an env:// or file:// reference`
                 : `Invalid ${key} setting`);
         }
     }

package/dist/services/migration-service.js

@@ -28,7 +28,10 @@ export class MigrationService {
                 const metadata = Object.fromEntries(metadataResult.map((row) => [row.key, row.value]));
                 const storedDimensions = parseInt(String(metadata.embedding_dimensions || "0"));
                 const storedModel = String(metadata.embedding_model || "unknown");
-                if (storedDimensions !== CONFIG.embeddingDimensions) {
+                // An old shard with no known model is flagged only on size, so an upgrade does not force a re-embed.
+                const knownModel = !["", "unknown", "legacy-unknown"].includes(storedModel);
+                const modelChanged = knownModel && storedModel !== CONFIG.embeddingModel;
+                if (storedDimensions !== CONFIG.embeddingDimensions || modelChanged) {
                     const vectorCount = await tursoVectorSearch.countAllVectors(db);
                     mismatches.push({
                         shardId: shard.id,

package/dist/services/settings-snapshot.d.ts

@@ -34,6 +34,14 @@ export declare function getSettingsSnapshot(directory: string): {
         source: import("./claude-folder.js").ClaudeFolderSource;
         exists: boolean;
     };
+    access: {
+        host: string;
+        authEnabled: boolean;
+        authUsername: string | null;
+        tokenAvailable: boolean;
+        embeddingApiUrl: string | null;
+        configTokenIgnored: boolean;
+    };
 };
 /**
  * Where `memoryApiKey` comes from and whether it resolves in this web

package/dist/services/settings-snapshot.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { parse } from "jsonc-parser";
 import { CONFIG, getGlobalConfigSourcePath } from "../config.js";
+import { hasUnexpiredApiToken } from "./api-tokens.js";
 import { resolveClaudeFolder } from "./claude-folder.js";
 import { readGlobalConfigRevision } from "./global-config-writer.js";
 import { getAutoCaptureProviderStatus, isExternalModelReady, resolveClaudeCodeLiveModel, resolvePiLiveModel, } from "./ai/live-model-choice.js";
@@ -103,6 +104,16 @@ export function getSettingsSnapshot(directory) {
         },
         // The folder Claude Code capture and import read; the check never reads transcripts.
         claudeFolder: { root: claudeRoot, source: claude.source, exists: existsSync(claudeRoot) },
+        // What the Keys and access card needs to mark each credential; no secret values.
+        access: {
+            host: CONFIG.webServerHost,
+            authEnabled: Boolean(CONFIG.webServerAuthPassword),
+            authUsername: CONFIG.webServerAuthUsername ?? null,
+            tokenAvailable: hasUnexpiredApiToken(),
+            embeddingApiUrl: CONFIG.embeddingApiUrl ?? null,
+            // The config key is imported once, then no longer read.
+            configTokenIgnored: typeof global.webServerApiToken === "string" && global.webServerApiToken !== "",
+        },
     };
 }
 /**

package/dist/services/user-prompt/profile-catch-up-lease.d.ts

@@ -0,0 +1,34 @@
+/** One batch with its retry at the 120-second limit fits well inside this. */
+export declare const LEASE_EXPIRY_MS: number;
+export type BatchStart = "ok" | "superseded" | "aborted";
+/**
+ * The catch-up run record, shared by the web app and the terminal command
+ * through `user-prompts.db`. The newest run owns the record. A run sends a
+ * batch only while it owns the record and no other run is mid-batch, so no
+ * batch is sent twice. A record not refreshed for 10 minutes has expired.
+ */
+export declare class CatchUpLease {
+    private readonly options;
+    private prepared;
+    private readonly now;
+    private readonly sleep;
+    constructor(options?: {
+        path?: string;
+        now?: () => number;
+        sleep?: (ms: number) => Promise<void>;
+    });
+    private db;
+    /** Become the owner. The previous owner's mid-batch mark stays until its batch ends. */
+    take(owner: string): Promise<void>;
+    /** Wait until this run may send its next batch, or report that a newer run took over. */
+    beginBatch(owner: string, options?: {
+        signal?: AbortSignal;
+        onWait?: () => void;
+    }): Promise<BatchStart>;
+    /** Clear this run's mid-batch mark, also after a newer run took over. */
+    endBatch(owner: string): Promise<void>;
+    /** Remove the record only when this run still owns it. */
+    release(owner: string): Promise<void>;
+    /** True while an unexpired record exists; a live pass skips meanwhile. */
+    isActive(): Promise<boolean>;
+}

package/dist/services/user-prompt/profile-catch-up-lease.js

@@ -0,0 +1,77 @@
+import { join } from "node:path";
+import { CONFIG } from "../../config.js";
+import { tursoConnectionManager } from "../turso/connection-manager.js";
+/** One batch with its retry at the 120-second limit fits well inside this. */
+export const LEASE_EXPIRY_MS = 10 * 60 * 1000;
+const WAIT_MS = 1000;
+/**
+ * The catch-up run record, shared by the web app and the terminal command
+ * through `user-prompts.db`. The newest run owns the record. A run sends a
+ * batch only while it owns the record and no other run is mid-batch, so no
+ * batch is sent twice. A record not refreshed for 10 minutes has expired.
+ */
+export class CatchUpLease {
+    options;
+    prepared = null;
+    now;
+    sleep;
+    constructor(options = {}) {
+        this.options = options;
+        this.now = options.now ?? Date.now;
+        this.sleep = options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    }
+    db() {
+        this.prepared ??= (async () => {
+            const path = this.options.path ?? join(CONFIG.storagePath, "user-prompts.db");
+            const db = await tursoConnectionManager.getConnection(path);
+            await db.run(`CREATE TABLE IF NOT EXISTS profile_catch_up_lease (
+        id INTEGER PRIMARY KEY CHECK (id = 1),
+        owner TEXT NOT NULL, busy_owner TEXT, refreshed_at INTEGER NOT NULL
+      )`);
+            return db;
+        })();
+        return this.prepared;
+    }
+    /** Become the owner. The previous owner's mid-batch mark stays until its batch ends. */
+    async take(owner) {
+        const db = await this.db();
+        await db.run(`INSERT INTO profile_catch_up_lease (id, owner, busy_owner, refreshed_at)
+      VALUES (1, ?, NULL, ?)
+      ON CONFLICT(id) DO UPDATE SET owner = excluded.owner`, [owner, this.now()]);
+    }
+    /** Wait until this run may send its next batch, or report that a newer run took over. */
+    async beginBatch(owner, options = {}) {
+        const db = await this.db();
+        for (;;) {
+            if (options.signal?.aborted)
+                return "aborted";
+            const now = this.now();
+            const changed = await db.run(`UPDATE profile_catch_up_lease SET busy_owner = ?, refreshed_at = ?
+        WHERE id = 1 AND owner = ?
+          AND (busy_owner IS NULL OR busy_owner = ? OR refreshed_at < ?)`, [owner, now, owner, owner, now - LEASE_EXPIRY_MS]);
+            if (changed > 0)
+                return "ok";
+            const row = await db.get("SELECT owner FROM profile_catch_up_lease WHERE id = 1");
+            if (!row || String(row.owner) !== owner)
+                return "superseded";
+            options.onWait?.();
+            await this.sleep(WAIT_MS);
+        }
+    }
+    /** Clear this run's mid-batch mark, also after a newer run took over. */
+    async endBatch(owner) {
+        const db = await this.db();
+        await db.run("UPDATE profile_catch_up_lease SET busy_owner = NULL, refreshed_at = ? WHERE busy_owner = ?", [this.now(), owner]);
+    }
+    /** Remove the record only when this run still owns it. */
+    async release(owner) {
+        const db = await this.db();
+        await db.run("DELETE FROM profile_catch_up_lease WHERE id = 1 AND owner = ?", [owner]);
+    }
+    /** True while an unexpired record exists; a live pass skips meanwhile. */
+    async isActive() {
+        const db = await this.db();
+        const row = await db.get("SELECT 1 FROM profile_catch_up_lease WHERE id = 1 AND refreshed_at >= ?", [this.now() - LEASE_EXPIRY_MS]);
+        return Boolean(row);
+    }
+}

package/dist/services/user-prompt/user-prompt-manager.d.ts

@@ -34,7 +34,20 @@ export declare class UserPromptManager {
     getUncapturedPrompts(limit: number): Promise<UserPrompt[]>;
     markMultipleAsCaptured(promptIds: string[]): Promise<void>;
     countUnanalyzedForUserLearning(): Promise<number>;
-    getPromptsForUserLearning(limit: number): Promise<UserPrompt[]>;
+    /**
+     * Waiting prompts, oldest first. With `recentFirst`, a live pass takes the
+     * prompts of the last 7 days newest first, so an imported backlog cannot
+     * starve it; with none waiting it falls back to the oldest.
+     */
+    getPromptsForUserLearning(limit: number, options?: {
+        recentFirst?: boolean;
+        now?: number;
+    }): Promise<UserPrompt[]>;
+    /** Mark waiting trivial prompts learned without a model call; returns how many. */
+    skipTrivialPromptsForLearning(): Promise<number>;
+    /** Waiting trivial prompts, counted without changing them; a preview uses this. */
+    countTrivialPromptsForLearning(): Promise<number>;
+    private waitingTrivialPromptIds;
     markAsUserLearningCaptured(promptId: string): Promise<void>;
     markMultipleAsUserLearningCaptured(promptIds: string[]): Promise<void>;
     deleteOldPrompts(cutoffTime: number): Promise<{

package/dist/services/user-prompt/user-prompt-manager.js

@@ -1,6 +1,8 @@
 import { join } from "node:path";
 import { tursoConnectionManager } from "../turso/connection-manager.js";
 import { CONFIG } from "../../config.js";
+import { isTrivialPrompt } from "../../core/trivial-prompt.js";
+const RECENT_LEARNING_WINDOW_MS = 7 * 86_400_000;
 const USER_PROMPTS_DB_NAME = "user-prompts.db";
 export class UserPromptManager {
     db = null;
@@ -197,8 +199,24 @@ export class UserPromptManager {
         const row = await db.get(`SELECT COUNT(*) as count FROM user_prompts WHERE user_learning_captured = 0`);
         return Number(row?.count ?? 0);
     }
-    async getPromptsForUserLearning(limit) {
+    /**
+     * Waiting prompts, oldest first. With `recentFirst`, a live pass takes the
+     * prompts of the last 7 days newest first, so an imported backlog cannot
+     * starve it; with none waiting it falls back to the oldest.
+     */
+    async getPromptsForUserLearning(limit, options = {}) {
         const db = await this.ready();
+        if (options.recentFirst) {
+            const since = (options.now ?? Date.now()) - RECENT_LEARNING_WINDOW_MS;
+            const recent = await db.all(`
+        SELECT * FROM user_prompts
+        WHERE user_learning_captured = 0 AND created_at >= ?
+        ORDER BY created_at DESC
+        LIMIT ?
+      `, [since, limit]);
+            if (recent.length > 0)
+                return recent.map((row) => this.rowToPrompt(row));
+        }
         const rows = await db.all(`
       SELECT * FROM user_prompts
       WHERE user_learning_captured = 0
@@ -207,6 +225,23 @@ export class UserPromptManager {
     `, [limit]);
         return rows.map((row) => this.rowToPrompt(row));
     }
+    /** Mark waiting trivial prompts learned without a model call; returns how many. */
+    async skipTrivialPromptsForLearning() {
+        const ids = await this.waitingTrivialPromptIds();
+        await this.markMultipleAsUserLearningCaptured(ids);
+        return ids.length;
+    }
+    /** Waiting trivial prompts, counted without changing them; a preview uses this. */
+    async countTrivialPromptsForLearning() {
+        return (await this.waitingTrivialPromptIds()).length;
+    }
+    async waitingTrivialPromptIds() {
+        const db = await this.ready();
+        const rows = await db.all(`SELECT id, content FROM user_prompts
+      WHERE user_learning_captured = 0
+        AND length(trim(content, ' ' || char(9, 10, 11, 12, 13))) < 20`);
+        return rows.filter((row) => isTrivialPrompt(String(row.content))).map((row) => String(row.id));
+    }
     async markAsUserLearningCaptured(promptId) {
         const db = await this.ready();
         await db.run(`UPDATE user_prompts SET user_learning_captured = 1 WHERE id = ?`, [promptId]);

package/dist/services/web-api-auth.d.ts

@@ -3,5 +3,9 @@ export declare function isLoopbackHost(host: string): boolean;
 export declare function isLoopbackAddress(address: string | undefined): boolean;
 /** A URL needs brackets around an IPv6 literal such as ::1. */
 export declare function webServerUrl(host: string, port: number): string;
-export declare function assertWebServerNetworkAuth(host: string, apiToken?: string, basicAuthEnabled?: boolean): void;
-export declare function authorizeApiRequest(req: Request, apiToken?: string): Response | null;
+export declare function assertWebServerNetworkAuth(host: string, tokenAvailable?: boolean, basicAuthEnabled?: boolean): void;
+/**
+ * Authorise a request by an API token from the token table, sent as a bearer
+ * token or in the OMMS token header. `webServerApiToken` is not read here.
+ */
+export declare function authorizeApiRequest(req: Request, verify?: (value: string) => boolean): Response | null;

package/dist/services/web-api-auth.js

@@ -1,3 +1,4 @@
+import { verifyApiToken } from "./api-tokens.js";
 import { getRequestToken } from "./auth-token.js";
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1", "[::1]", "0:0:0:0:0:0:0:1"]);
 export function isLoopbackHost(host) {
@@ -18,19 +19,20 @@ export function webServerUrl(host, port) {
     const urlHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
     return `http://${urlHost}:${port}`;
 }
-export function assertWebServerNetworkAuth(host, apiToken, basicAuthEnabled = false) {
-    if (!isLoopbackHost(host) && !apiToken && !basicAuthEnabled) {
-        throw new Error(`webServerHost "${host}" exposes the API on the network. Set webServerApiToken in omms.jsonc, or bind to 127.0.0.1.`);
+export function assertWebServerNetworkAuth(host, tokenAvailable = false, basicAuthEnabled = false) {
+    if (!isLoopbackHost(host) && !tokenAvailable && !basicAuthEnabled) {
+        throw new Error(`webServerHost "${host}" exposes the API on the network. Create an API token on the Settings page, set a browser password, or bind to 127.0.0.1.`);
     }
 }
-export function authorizeApiRequest(req, apiToken) {
-    if (!apiToken)
-        return null;
+/**
+ * Authorise a request by an API token from the token table, sent as a bearer
+ * token or in the OMMS token header. `webServerApiToken` is not read here.
+ */
+export function authorizeApiRequest(req, verify = verifyApiToken) {
     const header = req.headers.get("authorization");
     const bearer = header?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
-    const alt = getRequestToken(req);
-    const token = bearer || alt;
-    if (token && token === apiToken) {
+    const token = bearer || getRequestToken(req);
+    if (token && verify(token)) {
         return null;
     }
     return new Response(JSON.stringify({ success: false, error: "Unauthorized" }), {

package/dist/services/web-password.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Save the Basic Auth password to a private key file and point
+ * `webServerAuthPassword` at it. The password is never returned or logged.
+ */
+export declare function saveWebPassword(password: string, username: string | undefined, revision: string): Promise<{
+    revision: string;
+}>;
+/** Remove both config keys and the key file the page wrote; a user's own file is left alone. */
+export declare function clearWebPassword(revision: string): Promise<{
+    revision: string;
+}>;

package/dist/services/web-password.js

@@ -0,0 +1,30 @@
+import { promises as fs } from "node:fs";
+import { join } from "node:path";
+import { PASSWORD_KEYS, writeGlobalConfigKeys } from "./global-config-writer.js";
+import { secretsDirectory, storeMemoryKeySource } from "./memory-key-source.js";
+/** The page writes the browser password here and nowhere else. */
+const KEY_NAME = "web-password";
+/**
+ * Save the Basic Auth password to a private key file and point
+ * `webServerAuthPassword` at it. The password is never returned or logged.
+ */
+export async function saveWebPassword(password, username, revision) {
+    if (!password.trim())
+        throw new Error("Enter a password");
+    const stored = await storeMemoryKeySource({
+        source: "paste",
+        name: KEY_NAME,
+        value: password,
+        replace: true,
+    });
+    return writeGlobalConfigKeys({
+        webServerAuthPassword: stored.reference,
+        webServerAuthUsername: username?.trim() || undefined,
+    }, revision, { only: PASSWORD_KEYS });
+}
+/** Remove both config keys and the key file the page wrote; a user's own file is left alone. */
+export async function clearWebPassword(revision) {
+    const result = await writeGlobalConfigKeys({ webServerAuthPassword: undefined, webServerAuthUsername: undefined }, revision, { only: PASSWORD_KEYS });
+    await fs.rm(join(secretsDirectory(), `${KEY_NAME}.key`), { force: true });
+    return result;
+}

package/dist/services/web-server.d.ts

@@ -60,6 +60,14 @@ export declare class WebServer {
     setOnPowerAction(callback: (action: PowerAction) => void | Promise<void>): void;
     /** Only a local caller may stop the web app; the token alone is not enough. */
     private handlePowerAction;
+    /** API token routes. Only a caller on this machine with the local token manages tokens. */
+    private handleTokenRoute;
+    /** Profile catch-up: a preview for anyone with API access; runs only from this machine. */
+    private handleCatchUpRoute;
+    /** Set or clear the browser password. The body holds the password: never log or echo it. */
+    private handleWebPassword;
+    /** Embedding card routes. Changing the embedder needs a caller on this machine with the local token. */
+    private handleEmbeddingRoute;
     private scheduleStepAside;
     private handleStepAside;
     start(): Promise<void>;