Freezmo: self-hosted notes-to-activities study app

Next.js 15 app that turns photos, PDFs, DOCX/PPTX and text into a swipeable
feed of AI-generated activities (flashcards, multiple choice, true/false,
fill-in-the-blank, matching, ordering, short answer) using the user's own
Ollama models.

Highlights:
- All AI calls run in server route handlers; the browser never talks to Ollama.
- Bring-your-own-key mode (default): the key lives only in the browser and is
  sent per-request; server, local-daemon and shared-key modes also supported.
- Client-side document extraction (pdf.js, mammoth, jszip) with scanned-PDF
  page rendering for the vision model; notes stay in their original language.
- ChatGPT-style shell: collapsible sidebar / mobile drawer, neutral token-based
  light + dark themes, folder organisation, PWA (manifest, SW, offline page).
- Strict JSON validation with zod + auto-repair, rate limiting, and request
  guards (cross-origin, body-size, API-key sanitising).
- setup.sh bootstraps deps, .env.local and a production build.

Gitignore excludes .env*, the generated pdf.js worker and local scratch files.

lib/settings.ts

@@ -0,0 +1,84 @@
+"use client";
+
+/**
+ * Browser-side settings, including the user's own Ollama API key.
+ *
+ * The key lives ONLY here, in this browser's localStorage. It is never sent
+ * anywhere except to Freezmo's own API routes on this server (in the
+ * `x-ollama-key` header), which forward it to Ollama for that single request
+ * and never write it to disk, a log, a cookie or the environment.
+ */
+
+const STORAGE_KEY = "freezmo.settings.v1";
+
+export type BrowserSettings = {
+  /**
+   * The user's own Ollama API key. Nothing else is stored here — the endpoint
+   * and model names always come from the server's .env, never from the client.
+   */
+  apiKey: string;
+};
+
+const EMPTY: BrowserSettings = { apiKey: "" };
+
+let cached: BrowserSettings | null = null;
+const listeners = new Set<() => void>();
+
+function read(): BrowserSettings {
+  if (typeof window === "undefined") return EMPTY;
+  try {
+    const raw = window.localStorage.getItem(STORAGE_KEY);
+    if (!raw) return EMPTY;
+    const parsed = JSON.parse(raw) as Partial<BrowserSettings>;
+    return { apiKey: typeof parsed.apiKey === "string" ? parsed.apiKey.slice(0, 512) : "" };
+  } catch {
+    return EMPTY;
+  }
+}
+
+function write(next: BrowserSettings): void {
+  cached = next;
+  try {
+    if (next.apiKey) {
+      window.localStorage.setItem(STORAGE_KEY, JSON.stringify({ apiKey: next.apiKey }));
+    } else {
+      window.localStorage.removeItem(STORAGE_KEY);
+    }
+  } catch (error) {
+    console.warn("[freezmo] could not save settings (storage disabled?)", error);
+  }
+  listeners.forEach((listener) => listener());
+}
+
+export const settingsStore = {
+  subscribe(listener: () => void): () => void {
+    if (cached === null) cached = read();
+    listeners.add(listener);
+    return () => listeners.delete(listener);
+  },
+  getSnapshot(): BrowserSettings {
+    if (cached === null) cached = read();
+    return cached;
+  },
+  getServerSnapshot(): BrowserSettings {
+    return EMPTY;
+  },
+};
+
+export function getApiKey(): string {
+  return settingsStore.getSnapshot().apiKey;
+}
+
+export function saveSettings(next: BrowserSettings): void {
+  write(next);
+}
+
+export function clearApiKey(): void {
+  write({ apiKey: "" });
+}
+
+/** Header used to hand the key to our own API routes for one request. */
+export function authHeaders(): Record<string, string> {
+  const { apiKey } = settingsStore.getSnapshot();
+  return apiKey ? { "x-ollama-key": apiKey } : {};
+}