ci: add write permission to release workflow

This will fix the breaking change introduced in
da781df473
This should be merged after the next BlockSuite bump.

.devcontainer/build.sh

@@ -8,5 +8,11 @@ corepack prepare yarn@stable --activate
 # install dependencies
 yarn install
 
+# Build Server Dependencies
+yarn workspace @affine/storage build
+
 # Create database
-yarn workspace @affine/server prisma db push
+yarn workspace @affine/server prisma db push
+
+# Create user username: affine, password: affine
+echo "INSERT INTO \"users\"(\"id\",\"name\",\"email\",\"email_verified\",\"created_at\",\"password\") VALUES('99f3ad04-7c9b-441e-a6db-79f73aa64db9','affine','affine@affine.pro','2024-02-26 15:54:16.974','2024-02-26 15:54:16.974+00','\$argon2id\$v=19\$m=19456,t=2,p=1\$esDS3QCHRH0Kmeh87YPm5Q\$9S+jf+xzw2Hicj6nkWltvaaaXX3dQIxAFwCfFa9o38A');" | yarn workspace @affine/server prisma db execute --stdin

.devcontainer/devcontainer.json

@@ -21,5 +21,6 @@
     }
   },
   "updateContentCommand": "bash ./.devcontainer/build.sh",
-  "postCreateCommand": "bash ./.devcontainer/setup-user.sh"
+  "postCreateCommand": "bash ./.devcontainer/setup-user.sh",
+  "postStartCommand": ["yarn dev", "yarn workspace @affine/server dev"]
 }

.devcontainer/setup-user.sh

@@ -1,7 +1,9 @@
+set -e
+
 if [ -v GRAPHITE_TOKEN ];then
     gt auth --token $GRAPHITE_TOKEN
 fi
 
-git fetch
+git fetch origin canary:canary --depth=1
 git branch canary -t origin/canary
 gt init --trunk canary

.eslintignore

@@ -12,3 +12,4 @@ static
 web-static
 public
 packages/frontend/i18n/src/i18n-generated.ts
+packages/frontend/templates/edgeless-templates.gen.ts

.eslintrc.js

@@ -64,7 +64,7 @@ const allPackages = [
   'packages/frontend/i18n',
   'packages/frontend/native',
   'packages/frontend/templates',
-  'packages/frontend/workspace',
+  'packages/frontend/workspace-impl',
   'packages/common/debug',
   'packages/common/env',
   'packages/common/infra',

.github/ISSUE_TEMPLATE/BUG-REPORT.yml

@@ -7,6 +7,8 @@ body:
     attributes:
       value: |
         Thanks for taking the time to fill out this bug report!
+        Check out this [link](https://github.com/toeverything/AFFiNE/blob/canary/docs/issue-triaging.md)
+        to learn how we manage issues and when your issue will be processed.
   - type: textarea
     id: what-happened
     attributes:
@@ -41,6 +43,14 @@ body:
         - Firefox
         - Safari
         - Other
+  - type: checkboxes
+    id: selfhost
+    attributes:
+      label: Are you self-hosting?
+      description: >
+        If you are self-hosting, please check the box and provide information about your setup.
+      options:
+        - label: 'Yes'
   - type: textarea
     id: logs
     attributes:
@@ -53,11 +63,3 @@ body:
       description: |
         Links? References? Anything that will give us more context about the issue you are encountering!
         Tip: You can attach images here
-  - type: checkboxes
-    attributes:
-      label: Are you willing to submit a PR?
-      description: >
-        (Optional) We encourage you to submit a [Pull Request](https://github.com/toeverything/affine/pulls) (PR) to help improve AFFiNE for everyone, especially if you have a good understanding of how to implement a fix or feature.
-        See the AFFiNE [Contributing Guide](https://github.com/toeverything/affine/blob/canary/CONTRIBUTING.md) to get started.
-      options:
-        - label: Yes I'd like to help by submitting a PR!

.github/actions/build-rust/action.yml

@@ -49,7 +49,7 @@ runs:
     - name: Build
       shell: bash
       run: |
-        yarn workspace ${{ inputs.package }} nx build ${{ inputs.package }} --target ${{ inputs.target }} --use-napi-cross
+        yarn workspace ${{ inputs.package }} nx build ${{ inputs.package }} -- --target ${{ inputs.target }} --use-napi-cross
       env:
         NX_CLOUD_ACCESS_TOKEN: ${{ inputs.nx_token }}
         DEBUG: 'napi:*'

.github/actions/deploy/action.yml

@@ -24,7 +24,7 @@ runs:
       shell: bash
       run: |
         echo "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
-    - uses: azure/setup-helm@v3
+    - uses: azure/setup-helm@v4
     - id: auth
       uses: google-github-actions/auth@v2
       with:

.github/actions/deploy/deploy.mjs

@@ -15,9 +15,9 @@ const {
   R2_SECRET_ACCESS_KEY,
   ENABLE_CAPTCHA,
   CAPTCHA_TURNSTILE_SECRET,
-  OAUTH_EMAIL_SENDER,
-  OAUTH_EMAIL_LOGIN,
-  OAUTH_EMAIL_PASSWORD,
+  MAILER_SENDER,
+  MAILER_USER,
+  MAILER_PASSWORD,
   AFFINE_GOOGLE_CLIENT_ID,
   AFFINE_GOOGLE_CLIENT_SECRET,
   CLOUD_SQL_IAM_ACCOUNT,
@@ -103,9 +103,9 @@ const createHelmCommand = ({ isDryRun }) => {
     `--set-string graphql.app.objectStorage.r2.accountId="${R2_ACCOUNT_ID}"`,
     `--set-string graphql.app.objectStorage.r2.accessKeyId="${R2_ACCESS_KEY_ID}"`,
     `--set-string graphql.app.objectStorage.r2.secretAccessKey="${R2_SECRET_ACCESS_KEY}"`,
-    `--set-string graphql.app.oauth.email.sender="${OAUTH_EMAIL_SENDER}"`,
-    `--set-string graphql.app.oauth.email.login="${OAUTH_EMAIL_LOGIN}"`,
-    `--set-string graphql.app.oauth.email.password="${OAUTH_EMAIL_PASSWORD}"`,
+    `--set-string graphql.app.mailer.sender="${MAILER_SENDER}"`,
+    `--set-string graphql.app.mailer.user="${MAILER_USER}"`,
+    `--set-string graphql.app.mailer.password="${MAILER_PASSWORD}"`,
     `--set-string graphql.app.oauth.google.enabled=true`,
     `--set-string graphql.app.oauth.google.clientId="${AFFINE_GOOGLE_CLIENT_ID}"`,
     `--set-string graphql.app.oauth.google.clientSecret="${AFFINE_GOOGLE_CLIENT_SECRET}"`,
@@ -113,6 +113,7 @@ const createHelmCommand = ({ isDryRun }) => {
     `--set-string graphql.app.payment.stripe.webhookKey="${STRIPE_WEBHOOK_KEY}"`,
     `--set        graphql.app.experimental.enableJwstCodec=true`,
     `--set        graphql.app.features.earlyAccessPreview=false`,
+    `--set        graphql.app.features.syncClientVersionCheck=true`,
     `--set        sync.replicaCount=${syncReplicaCount}`,
     `--set-string sync.image.tag="${imageTag}"`,
     ...serviceAnnotations,

.github/deployment/front/Dockerfile

@@ -1,6 +1,6 @@
-FROM openresty/openresty:1.21.4.3-0-buster
+FROM openresty/openresty:1.25.3.1-0-buster
 WORKDIR /app
-COPY ./packages/frontend/core/dist/index.html ./dist/index.html
+COPY ./packages/frontend/core/dist ./dist
 COPY ./.github/deployment/front/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
 COPY ./.github/deployment/front/affine.nginx.conf /etc/nginx/conf.d/affine.nginx.conf
 

.github/deployment/node/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:18-bookworm-slim
+FROM node:20-bookworm-slim
 
 COPY ./packages/backend/server /app
 COPY ./packages/frontend/core/dist /app/static
@@ -8,4 +8,4 @@ RUN apt-get update && \
   apt-get install -y --no-install-recommends openssl && \
   rm -rf /var/lib/apt/lists/*
 
-CMD ["node", "--es-module-specifier-resolution=node", "./dist/index.js"]
+CMD ["node", "--import", "./scripts/register.js", "./dist/index.js"]

.github/deployment/self-host/compose.yaml

@@ -1,6 +1,6 @@
 services:
   affine:
-    image: ghcr.io/toeverything/affine-graphql:beta
+    image: ghcr.io/toeverything/affine-graphql:stable
     container_name: affine_selfhosted
     command:
       ['sh', '-c', 'node ./scripts/self-host-predeploy && node ./dist/index.js']
@@ -23,13 +23,11 @@ services:
         max-size: '1000m'
     restart: unless-stopped
     environment:
-      - NODE_OPTIONS=--es-module-specifier-resolution node
+      - NODE_OPTIONS="--import=./scripts/register.js"
       - AFFINE_CONFIG_PATH=/root/.affine/config
       - REDIS_SERVER_HOST=redis
       - DATABASE_URL=postgres://affine:affine@postgres:5432/affine
-      - DISABLE_TELEMETRY=true
       - NODE_ENV=production
-      - SERVER_FLAVOR=selfhosted
       - AFFINE_ADMIN_EMAIL=${AFFINE_ADMIN_EMAIL}
       - AFFINE_ADMIN_PASSWORD=${AFFINE_ADMIN_PASSWORD}
   redis:

.github/helm/affine/charts/graphql/templates/deployment.yaml

@@ -39,6 +39,8 @@ spec:
             value: "--max-old-space-size=4096"
           - name: NO_COLOR
             value: "1"
+          - name: DEPLOYMENT_TYPE
+            value: "affine"
           - name: SERVER_FLAVOR
             value: "graphql"
           - name: AFFINE_ENV
@@ -81,31 +83,33 @@ spec:
             value: "{{ .Values.app.captcha.enabled }}"
           - name: FEATURES_EARLY_ACCESS_PREVIEW
             value: "{{ .Values.app.features.earlyAccessPreview }}"
-          - name: OAUTH_EMAIL_SENDER
+          - name: FEATURES_SYNC_CLIENT_VERSION_CHECK
+            value: "{{ .Values.app.features.syncClientVersionCheck }}"
+          - name: MAILER_HOST
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.oauth.email.secretName }}"
-                key: sender
-          - name: OAUTH_EMAIL_LOGIN
+                name: "{{ .Values.app.mailer.secretName }}"
+                key: host
+          - name: MAILER_PORT
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.oauth.email.secretName }}"
-                key: login
-          - name: OAUTH_EMAIL_SERVER
-            valueFrom:
-              secretKeyRef:
-                name: "{{ .Values.app.oauth.email.secretName }}"
-                key: server
-          - name: OAUTH_EMAIL_PORT
-            valueFrom:
-              secretKeyRef:
-                name: "{{ .Values.app.oauth.email.secretName }}"
+                name: "{{ .Values.app.mailer.secretName }}"
                 key: port
-          - name: OAUTH_EMAIL_PASSWORD
+          - name: MAILER_USER
             valueFrom:
               secretKeyRef:
-                name: "{{ .Values.app.oauth.email.secretName }}"
+                name: "{{ .Values.app.mailer.secretName }}"
+                key: user
+          - name: MAILER_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.app.mailer.secretName }}"
                 key: password
+          - name: MAILER_SENDER
+            valueFrom:
+              secretKeyRef:
+                name: "{{ .Values.app.mailer.secretName }}"
+                key: sender
           - name: STRIPE_API_KEY
             valueFrom:
               secretKeyRef:

.github/helm/affine/charts/graphql/templates/mailer.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.app.mailer.secretName -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: "{{ .Values.app.mailer.secretName }}"
+type: Opaque
+data:
+  host: "{{ .Values.app.mailer.host | b64enc }}"
+  port: "{{ .Values.app.mailer.port | b64enc }}"
+  user: "{{ .Values.app.mailer.user | b64enc }}"
+  password: "{{ .Values.app.mailer.password | b64enc }}"
+  sender: "{{ .Values.app.mailer.sender | b64enc }}"
+{{- end }}

.github/helm/affine/charts/graphql/templates/oauth.yaml

@@ -1,15 +1,3 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: "{{ .Values.app.oauth.email.secretName }}"
-type: Opaque
-data:
-  sender: "{{ .Values.app.oauth.email.sender | b64enc }}"
-  login: "{{ .Values.app.oauth.email.login | b64enc }}"
-  password: "{{ .Values.app.oauth.email.password | b64enc }}"
-  server: "{{ .Values.app.oauth.email.server | b64enc }}"
-  port: "{{ .Values.app.oauth.email.port | b64enc }}"
----
 {{- if .Values.app.oauth.google.enabled -}}
 apiVersion: v1
 kind: Secret

.github/helm/affine/charts/graphql/values.yaml

@@ -35,14 +35,7 @@ app:
       accountId: ''
       accessKeyId: ''
       secretAccessKey: ''
-  oauth:
-    email:
-      secretName: 'oauth-email'
-      sender: 'noreply@toeverything.info'
-      login: ''
-      password: ''
-      server: 'smtp.gmail.com'
-      port: '465'
+  oauth: 
     google:
       enabled: false
       secretName: oauth-google
@@ -53,6 +46,13 @@ app:
       secretName: oauth-github
       clientId: ''
       clientSecret: ''
+  mailer:
+    secretName: 'mailer'
+    host: 'smtp.gmail.com'
+    port: '465'
+    user: ''
+    password: ''
+    sender: 'noreply@toeverything.info'
   payment:
     stripe:
       secretName: 'stripe'
@@ -60,6 +60,7 @@ app:
       webhookKey: ''
   features:
     earlyAccessPreview: false
+    syncClientVersionCheck: false
 
 serviceAccount:
   create: true

.github/helm/affine/charts/sync/templates/deployment.yaml

@@ -36,6 +36,8 @@ spec:
             value: "{{ .Values.env }}"
           - name: NO_COLOR
             value: "1"
+          - name: DEPLOYMENT_TYPE
+            value: "affine"
           - name: SERVER_FLAVOR
             value: "sync"
           - name: NEXTAUTH_URL

.github/labeler.yml

@@ -29,11 +29,6 @@ mod:plugin-cli:
       - any-glob-to-any-file:
           - 'tools/plugin-cli/**/*'
 
-mod:workspace:
-  - changed-files:
-      - any-glob-to-any-file:
-          - 'packages/common/workspace/**/*'
-
 mod:workspace-impl:
   - changed-files:
       - any-glob-to-any-file:

.github/renovate.json

@@ -47,17 +47,22 @@
       "groupName": "electron-forge"
     },
     {
-      "groupName": "blocksuite-nightly",
+      "matchPackageNames": ["oxlint"],
+      "rangeStrategy": "replace",
+      "groupName": "oxlint"
+    },
+    {
+      "groupName": "blocksuite-canary",
       "matchPackagePatterns": ["^@blocksuite"],
       "excludePackageNames": ["@blocksuite/icons"],
       "rangeStrategy": "replace",
-      "followTag": "nightly"
+      "followTag": "canary"
     },
     {
       "groupName": "all non-major dependencies",
       "groupSlug": "all-minor-patch",
       "matchPackagePatterns": ["*"],
-      "excludePackagePatterns": ["^@blocksuite/"],
+      "excludePackagePatterns": ["^@blocksuite/", "oxlint"],
       "matchUpdateTypes": ["minor", "patch"]
     },
     {

.github/workflows/build-test.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - canary
+      - beta
+      - stable
       - v[0-9]+.[0-9]+.x-staging
       - v[0-9]+.[0-9]+.x
     paths-ignore:
@@ -19,7 +21,7 @@ env:
   MACOSX_DEPLOYMENT_TARGET: '10.13'
   NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
   PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/node_modules/.cache/ms-playwright
-  DISABLE_TELEMETRY: true
+  DEPLOYMENT_TYPE: affine
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -116,6 +118,7 @@ jobs:
     runs-on: ubuntu-latest
     env:
       DISTRIBUTION: browser
+      IN_CI_TEST: true
     strategy:
       fail-fast: false
       matrix:
@@ -190,7 +193,7 @@ jobs:
         run: yarn nx test:coverage @affine/monorepo
 
       - name: Upload unit test coverage results
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./.coverage/store/lcov.info
@@ -209,8 +212,8 @@ jobs:
         spec:
           - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
           - { os: windows-latest, target: x86_64-pc-windows-msvc }
-          - { os: macos-latest, target: x86_64-apple-darwin }
-          - { os: macos-latest, target: aarch64-apple-darwin }
+          - { os: macos-14, target: x86_64-apple-darwin }
+          - { os: macos-14, target: aarch64-apple-darwin }
 
     steps:
       - uses: actions/checkout@v4
@@ -291,6 +294,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build-storage
     env:
+      NODE_ENV: test
       DISTRIBUTION: browser
     services:
       postgres:
@@ -353,7 +357,7 @@ jobs:
           DATABASE_URL: postgresql://affine:affine@localhost:5432/affine
 
       - name: Upload server test coverage results
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./packages/backend/server/.coverage/lcov.info
@@ -367,6 +371,7 @@ jobs:
     env:
       DISTRIBUTION: browser
       DATABASE_URL: postgresql://affine:affine@localhost:5432/affine
+      IN_CI_TEST: true
     strategy:
       fail-fast: false
       matrix:
@@ -447,7 +452,6 @@ jobs:
           ${{ matrix.tests.script }}
         env:
           DEV_SERVER_URL: http://localhost:8080
-          ENABLE_LOCAL_EMAIL: true
 
       - name: Upload test results
         if: ${{ failure() }}
@@ -462,22 +466,21 @@ jobs:
     runs-on: ${{ matrix.spec.os }}
     strategy:
       fail-fast: false
-      # all combinations: macos-latest x64, macos-latest arm64, windows-latest x64, ubuntu-latest x64
       matrix:
         spec:
           - {
-              os: macos-latest,
+              os: macos-14,
               platform: macos,
               arch: x64,
               target: x86_64-apple-darwin,
-              test: true,
+              test: false,
             }
           - {
-              os: macos-latest,
+              os: macos-14,
               platform: macos,
               arch: arm64,
               target: aarch64-apple-darwin,
-              test: false,
+              test: true,
             }
           - {
               os: ubuntu-latest,
@@ -534,7 +537,7 @@ jobs:
         run: yarn workspace @affine/electron build
 
       - name: Run desktop tests
-        if: ${{ matrix.spec.test && matrix.spec.os == 'ubuntu-latest' }}
+        if: ${{ matrix.spec.os == 'ubuntu-latest' }}
         run: xvfb-run --auto-servernum --server-args="-screen 0 1280x960x24" -- yarn workspace @affine-test/affine-desktop e2e
 
       - name: Run desktop tests
@@ -542,15 +545,23 @@ jobs:
         run: yarn workspace @affine-test/affine-desktop e2e
 
       - name: Make bundle
-        if: ${{ matrix.spec.os == 'macos-latest' && matrix.spec.arch == 'arm64' }}
+        if: ${{ matrix.spec.target == 'aarch64-apple-darwin' }}
         env:
           SKIP_BUNDLE: true
           SKIP_WEB_BUILD: true
           HOIST_NODE_MODULES: 1
         run: yarn workspace @affine/electron package --platform=darwin --arch=arm64
 
+      - name: Make AppImage
+        run: yarn workspace @affine/electron make --platform=linux --arch=x64
+        if: ${{ matrix.spec.target == 'x86_64-unknown-linux-gnu' }}
+        env:
+          SKIP_PLUGIN_BUILD: 1
+          SKIP_WEB_BUILD: 1
+          HOIST_NODE_MODULES: 1
+
       - name: Output check
-        if: ${{ matrix.spec.os == 'macos-latest' && matrix.spec.arch == 'arm64' }}
+        if: ${{ matrix.spec.os == 'macos-14' && matrix.spec.arch == 'arm64' }}
         run: |
           yarn workspace @affine/electron exec node --loader ts-node/esm/transpile-only ./scripts/macos-arm64-output-check.ts
 
@@ -561,3 +572,22 @@ jobs:
           name: test-results-e2e-${{ matrix.spec.os }}-${{ matrix.spec.arch }}
           path: ./test-results
           if-no-files-found: ignore
+
+  test-done:
+    needs:
+      - analyze
+      - lint
+      - check-yarn-binary
+      - e2e-test
+      - e2e-migration-test
+      - unit-test
+      - server-test
+      - server-e2e-test
+      - desktop-test
+    if: always()
+    runs-on: ubuntu-latest
+    name: 3, 2, 1 Launch
+    steps:
+      - run: exit 1
+        # Thank you, next https://github.com/vercel/next.js/blob/canary/.github/workflows/build_and_test.yml#L379
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}

.github/workflows/deploy.yml

@@ -72,7 +72,7 @@ jobs:
           if-no-files-found: error
 
   build-core-selfhost:
-    name: Build @affine/core
+    name: Build @affine/core selfhost
     runs-on: ubuntu-latest
     environment: ${{ github.event.inputs.flavor }}
     steps:
@@ -88,6 +88,7 @@ jobs:
           BUILD_TYPE: ${{ github.event.inputs.flavor }}
           SHOULD_REPORT_TRACE: false
           PUBLIC_PATH: '/'
+          SELF_HOSTED: true
       - name: Download selfhost fonts
         run: node ./scripts/download-blocksuite-fonts.mjs
       - name: Upload core artifact
@@ -275,9 +276,9 @@ jobs:
           R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
           ENABLE_CAPTCHA: true
           CAPTCHA_TURNSTILE_SECRET: ${{ secrets.CAPTCHA_TURNSTILE_SECRET }}
-          OAUTH_EMAIL_SENDER: ${{ secrets.OAUTH_EMAIL_SENDER }}
-          OAUTH_EMAIL_LOGIN: ${{ secrets.OAUTH_EMAIL_LOGIN }}
-          OAUTH_EMAIL_PASSWORD: ${{ secrets.OAUTH_EMAIL_PASSWORD }}
+          MAILER_SENDER: ${{ secrets.OAUTH_EMAIL_SENDER }}
+          MAILER_USER: ${{ secrets.OAUTH_EMAIL_LOGIN }}
+          MAILER_PASSWORD: ${{ secrets.OAUTH_EMAIL_PASSWORD }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           AFFINE_GOOGLE_CLIENT_ID: ${{ secrets.AFFINE_GOOGLE_CLIENT_ID }}
           AFFINE_GOOGLE_CLIENT_SECRET: ${{ secrets.AFFINE_GOOGLE_CLIENT_SECRET }}

.github/workflows/helm-releaser.yml

@@ -24,7 +24,7 @@ jobs:
           token: ${{ secrets.HELM_RELEASER_TOKEN }}
 
       - name: Install Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@v4
 
       - name: Install chart releaser
         run: |

.github/workflows/pr-auto-assign.yml

@@ -9,4 +9,4 @@ jobs:
   add-reviews:
     runs-on: ubuntu-latest
     steps:
-      - uses: kentaro-m/auto-assign-action@v1.2.5
+      - uses: kentaro-m/auto-assign-action@v2.0.0

.github/workflows/release-desktop-automatically.yml

@@ -7,6 +7,10 @@ on:
   schedule:
     - cron: '0 9 * * *'
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   dispatch-release-desktop:
     runs-on: ubuntu-latest

.github/workflows/release-desktop.yml

@@ -68,15 +68,13 @@ jobs:
 
   make-distribution:
     strategy:
-      # all combinations: macos-latest x64, macos-latest arm64, ubuntu-latest x64
-      # For windows, we need a separate approach
       matrix:
         spec:
-          - runner: macos-latest
+          - runner: macos-14
             platform: darwin
             arch: x64
             target: x86_64-apple-darwin
-          - runner: macos-latest
+          - runner: macos-14
             platform: darwin
             arch: arm64
             target: aarch64-apple-darwin
@@ -132,18 +130,23 @@ jobs:
           SKIP_WEB_BUILD: 1
           HOIST_NODE_MODULES: 1
 
+      - name: signing DMG
+        if: ${{ matrix.spec.platform == 'darwin' }}
+        run: |
+          codesign --force --sign "Developer ID Application: TOEVERYTHING PTE. LTD." packages/frontend/electron/out/${{ env.BUILD_TYPE }}/make/AFFiNE.dmg
+
       - name: Save artifacts (mac)
         if: ${{ matrix.spec.platform == 'darwin' }}
         run: |
           mkdir -p builds
-          mv packages/frontend/electron/out/*/make/*.dmg ./builds/affine-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.dmg
-          mv packages/frontend/electron/out/*/make/zip/darwin/${{ matrix.spec.arch }}/*.zip ./builds/affine-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.zip
+          mv packages/frontend/electron/out/*/make/*.dmg ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.dmg
+          mv packages/frontend/electron/out/*/make/zip/darwin/${{ matrix.spec.arch }}/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-macos-${{ matrix.spec.arch }}.zip
       - name: Save artifacts (linux)
         if: ${{ matrix.spec.platform == 'linux' }}
         run: |
           mkdir -p builds
-          mv packages/frontend/electron/out/*/make/zip/linux/x64/*.zip ./builds/affine-${{ env.BUILD_TYPE }}-linux-x64.zip
-          mv packages/frontend/electron/out/*/make/AppImage/x64/*.AppImage ./builds/affine-${{ env.BUILD_TYPE }}-linux-x64.AppImage
+          mv packages/frontend/electron/out/*/make/zip/linux/x64/*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.zip
+          mv packages/frontend/electron/out/*/make/*.AppImage ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-linux-x64.appimage
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
@@ -153,8 +156,6 @@ jobs:
 
   package-distribution-windows:
     strategy:
-      # all combinations: macos-latest x64, macos-latest arm64, ubuntu-latest x64
-      # For windows, we need a separate approach
       matrix:
         spec:
           - runner: windows-latest
@@ -228,8 +229,6 @@ jobs:
   make-windows-installer:
     needs: sign-packaged-artifacts-windows
     strategy:
-      # all combinations: macos-latest x64, macos-latest arm64, ubuntu-latest x64
-      # For windows, we need a separate approach
       matrix:
         spec:
           - runner: windows-latest
@@ -279,10 +278,8 @@ jobs:
       artifact-name: installer-win32-x64
 
   finalize-installer-windows:
-    needs: sign-installer-artifacts-windows
+    needs: [sign-installer-artifacts-windows, before-make]
     strategy:
-      # all combinations: macos-latest x64, macos-latest arm64, ubuntu-latest x64
-      # For windows, we need a separate approach
       matrix:
         spec:
           - runner: windows-latest
@@ -302,9 +299,9 @@ jobs:
       - name: Save artifacts
         run: |
           mkdir -p builds
-          mv packages/frontend/electron/out/*/make/zip/win32/x64/AFFiNE*-win32-x64-*.zip ./builds/affine-${{ env.BUILD_TYPE }}-windows-x64.zip
-          mv packages/frontend/electron/out/*/make/squirrel.windows/x64/*.exe ./builds/affine-${{ env.BUILD_TYPE }}-windows-x64.exe
-          mv packages/frontend/electron/out/*/make/squirrel.windows/x64/*.msi ./builds/affine-${{ env.BUILD_TYPE }}-windows-x64.msi
+          mv packages/frontend/electron/out/*/make/zip/win32/x64/AFFiNE*-win32-x64-*.zip ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.zip
+          mv packages/frontend/electron/out/*/make/squirrel.windows/x64/*.exe ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.exe
+          mv packages/frontend/electron/out/*/make/squirrel.windows/x64/*.msi ./builds/affine-${{ needs.before-make.outputs.RELEASE_VERSION }}-${{ env.BUILD_TYPE }}-windows-x64.msi
 
       - name: Upload Artifact
         uses: actions/upload-artifact@v4
@@ -365,7 +362,7 @@ jobs:
             ./*.zip
             ./*.dmg
             ./*.exe
-            ./*.AppImage
+            ./*.appimage
             ./*.apk
             ./*.yml
       - name: Create Nightly Release Draft
@@ -387,6 +384,6 @@ jobs:
             ./*.zip
             ./*.dmg
             ./*.exe
-            ./*.AppImage
+            ./*.appimage
             ./*.apk
             ./*.yml

.github/workflows/workers.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Publish
-        uses: cloudflare/wrangler-action@v3.4.0
+        uses: cloudflare/wrangler-action@v3.4.1
         with:
           apiToken: ${{ secrets.CF_API_TOKEN }}
           accountId: ${{ secrets.CF_ACCOUNT_ID }}

.gitignore

@@ -79,3 +79,6 @@ lib
 affine.db
 apps/web/next-routes.conf
 .nx
+
+packages/frontend/templates/edgeless
+packages/frontend/core/public/static/templates

.nvmrc

@@ -1 +1 @@
-18
+20

.prettierignore

@@ -16,6 +16,7 @@ packages/frontend/i18n/src/i18n-generated.ts
 packages/frontend/graphql/src/graphql/index.ts
 tests/affine-legacy/**/static
 .yarnrc.yml
+packages/frontend/templates/edgeless-templates.gen.ts
 packages/frontend/templates/templates.gen.ts
 packages/frontend/templates/onboarding
 

.yarnrc.yml

@@ -12,4 +12,4 @@ npmPublishAccess: public
 
 npmPublishRegistry: "https://registry.npmjs.org"
 
-yarnPath: .yarn/releases/yarn-4.0.2.cjs
+yarnPath: .yarn/releases/yarn-4.1.1.cjs

README.md

@@ -5,86 +5,89 @@
     Write, Draw and Plan All at Once
     <br>
 </h1>
-
-<p>
-  One hyper-fused platform for wildly creative minds. <br />
-  A privacy-focussed, local-first, open-source, and ready-to-use alternative for Notion & Miro.
+<a href="https://affine.pro/download">
+    <img alt="affine logo" src="https://cdn.affine.pro/Github_hero_image1.png" style="width: 100%">
+</a>
+<br/>
+<p align="center">
+  A privacy-focussed, local-first, open-source, and ready-to-use alternative for Notion & Miro. <br />
+  One hyper-fused platform for wildly creative minds.
 </p>
 
-</div>
+<br/>
+
+<br/>
+<a href="https://www.producthunt.com/posts/affine-3?utm_source=badge-featured&utm_medium=badge&utm_souce=badge-affine&#0045;3" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=440671&theme=light" alt="AFFiNE - One&#0032;app&#0032;for&#0032;all&#0032;&#0045;&#0032;Where&#0032;Notion&#0032;meets&#0032;Miro | Product Hunt" style="width: 250px; height: 54px;" width="250" height="54" /></a>
+<br/>
+<br/>
 
 <div align="center">
-
-[![AFFiNE Web](<https://img.shields.io/badge/-Try%20It%20Online%20%E2%86%92-rgb(84,56,255)?style=flat-square&logoColor=white&logo=affine>)](https://app.affine.pro)
-[![AFFiNE macOS M1/M2 Chip](https://img.shields.io/badge/-macOS_M_Chip%20%E2%86%92-black?style=flat-square&logo=apple&logoColor=white)](https://affine.pro/download)
-[![AFFiNE macOS x64](https://img.shields.io/badge/-macOS_x86%20%E2%86%92-black?style=flat-square&logo=apple&logoColor=white)](https://affine.pro/download)
-[![AFFiNE Window x64](https://img.shields.io/badge/-Windows%20%E2%86%92-blue?style=flat-square&logo=windows&logoColor=white)](https://affine.pro/download)
-[![AFFiNE Linux](https://img.shields.io/badge/-Linux%20%E2%86%92-yellow?style=flat-square&logo=linux&logoColor=white)](https://affine.pro/download)
+    <a href="https://affine.pro">Home Page</a> |
+    <a href="https://discord.com/invite/yz6tGVsf5p">Discord</a> |
+    <a href="https://app.affine.pro">Live Demo</a> |
+    <a href="https://affine.pro/blog/">Blog</a> |
+    <a href="https://docs.affine.pro/docs/">Documentation</a>
+</div>
+<br/>
 
 [![Releases](https://img.shields.io/github/downloads/toeverything/AFFiNE/total)](https://github.com/toeverything/AFFiNE/releases/latest)
-[![stars-icon]](https://github.com/toeverything/AFFiNE)
 [![All Contributors][all-contributors-badge]](#contributors)
-[![codecov]](https://codecov.io/gh/toeverything/AFFiNE)
-[![Node-version-icon]](https://nodejs.org/)
 [![TypeScript-version-icon]](https://www.typescriptlang.org/)
-[![React-version-icon]](https://reactjs.org/)
-[![blocksuite-icon]](https://github.com/toeverything/blocksuite)
 [![Rust-version-icon]](https://www.rust-lang.org/)
-[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Ftoeverything%2FAFFiNE.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Ftoeverything%2FAFFiNE?ref=badge_shield)
-[![Deploy](https://github.com/toeverything/AFFiNE/actions/workflows/deploy.yml/badge.svg)](https://github.com/toeverything/AFFiNE/actions/workflows/deploy.yml)
 
 </div>
 
----
-
-<div align="center">
-    <a href="http://affine.pro"><img src="https://img.shields.io/badge/-AFFiNE-06449d?style=social&logo=affine" height=25></a>
-    &nbsp;
-    <a href="https://community.affine.pro"><img src="https://img.shields.io/badge/-Community-424549?style=social&logo=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAXNJREFUWEftlitLRUEURtdVEVExWUx2qxgNVouoXYtNDP4Tw20WtftAsItZrHaTYBJREZ98MAc248wcZxi4CGfSeezHmm/23kyPAa/egPPTAXQK/FsFBP7ldVDRZoqcgO9I+2bHy3ZIJBfTCPCZM1tqAxwBmzUBrNQNbEx+5b0B5oEN4NCBrAMnMaiUAuPAs3HU82TLEZwBqwGbaJ4UgKQ8CFR6SoEl4LIWwCJwZQCegKkWBWLHVKSActvdzgG3DqitDf3/VQBskBDALrDnAKXUo3ueAF5KinAf2DKOmnzD7l214bdbA6hC1XHZNQa8hSBC0hwDa57xDHDvvvWB7ciOZoE79+8CWPbsBGc769eFxJdWIKcuyIdRoG3W7AAC1dJkHDIOo8B78+4rEBo8r4AkLFk6Jk3HaeDBBTgHVmIAfpJUz+cAFXVBreQCvQYW/lqEjV1NAMUMqpAaxQMHyDnjYtuS+0BxstwaqJooFqxToFPgB5FuPCEB6XK2AAAAAElFTkSuQmCC" height=25></a>
-    &nbsp;
-    <a href="https://discord.com/invite/yz6tGVsf5p"><img src="https://img.shields.io/badge/-Discord-424549?style=social&logo=discord" height=25></a>
-    &nbsp;
-    <a href="https://t.me/affineworkos"><img src="https://img.shields.io/badge/-Telegram-red?style=social&logo=telegram" height=25></a>
-    &nbsp;
-    <a href="https://twitter.com/AffineOfficial"><img src="https://img.shields.io/badge/-Twitter-red?style=social&logo=twitter" height=25></a>
-    &nbsp;
-    <a href="https://medium.com/@affineworkos"><img src="https://img.shields.io/badge/-Medium-red?style=social&logo=medium" height=25></a>
-</div>
-
 <br />
 <div align="center">
 <em>Docs, canvas and tables are hyper-merged with AFFiNE - just like the word affine (əˈfʌɪn | a-fine).</em>
 </div>
 <br />
 
-![img_v2_37a7cc04-ab3f-4405-ae9a-f84ceb4c948g](https://user-images.githubusercontent.com/79301703/230892907-5fd5c0c5-1665-4d75-8a35-744e0afc36a5.gif)
-
-## Join our community
-
-Before we tell you how to get started with AFFiNE, we'd like to shamelessly plug our awesome user and developer communities across [official social platforms](https://community.affine.pro/c/start-here/)! Once you’re familiar with using the software, maybe you will share your wisdom with others and even consider joining the [AFFiNE Ambassador program](https://community.affine.pro/c/start-here/affine-ambassador) to help spread AFFiNE to the world.
+<div align="center">
+<img src="https://github.com/toeverything/AFFiNE/assets/79301703/49a426bb-8d2b-4216-891a-fa5993642253" style="width: 100%"/>
+</div>
 
 ## Getting started & staying tuned with us.
 
-⚠️ Please note that AFFiNE is still under active development and is not yet ready for production use. ⚠️
-
-[![affine.pro](https://img.shields.io/static/v1?label=Try%20it%20Online&logo=affine&message=%E2%86%92&style=for-the-badge)](https://app.affine.pro) No installation or registration required! Head over to our website and try it out now.
-
-[![community.affine.pro](https://img.shields.io/static/v1?label=Join%20the%20community&message=%E2%86%92&style=for-the-badge)](https://community.affine.pro) Our wonderful community, where you can meet and engage with the team, developers and other like-minded enthusiastic user of AFFiNE.
-
 Star us, and you will receive all releases notifications from GitHub without any delay!
-![rbU3YmmsQT](https://user-images.githubusercontent.com/79301703/230891830-0110681e-8c7e-483b-b6d9-9e42b291b9ef.gif)
+
+<img src="https://user-images.githubusercontent.com/79301703/230891830-0110681e-8c7e-483b-b6d9-9e42b291b9ef.gif" style="width: 100%"/>
+
+## What is AFFiNE
+
+AFFiNE is an open-source, all-in-one workspace and an operating system for all the building blocks that assemble your knowledge base and much more -- wiki, knowledge management, presentation and digital assets. It's a better alternative to Notion and Miro.
 
 ## Features
 
-- **Hyper merged** — Write, draw and plan all at once. Assemble any blocks you love on any canvas you like to enjoy seamless transitions between workflows with AFFiNE.
-- **Privacy focussed** — AFFiNE is built with your privacy in mind and is one of our key concerns. We want you to keep control of your data, allowing you to store it as you like, where you like while still being able to freely edit and view your data on-demand.
-- **Offline-first** — With your privacy in mind we also decided to go offline-first. This means that AFFiNE can be used offline, whether you want to view or edit, with support for conflict-free merging when you are back online.
-- **Clean, intuitive design** — With AFFiNE you can concentrate on editing with a clean and modern interface. Which is responsive, so it looks great on tablets too, and mobile support is coming in the future.
-- **Modern Block Editor with Markdown support** — A modern block editor can help you not only for docs, but slides and tables as well. When you write in AFFiNE you can use Markdown syntax which helps create an easier editing experience, that can be experienced with just a keyboard. And this allows you to export your data cleanly into Markdown.
-- **Collaboration** — Whether you want to collaborate with yourself across multiple devices, or work together with others, support for collaboration and multiplayer is out-of-the-box, which makes it easy for teams to get started with AFFiNE.
-- **Choice of multiple languages** — Thanks to community contributions AFFiNE offers support for multiple languages. If you don't find your language or would like to suggest some changes we welcome your contributions.
+**A true canvas for blocks in any form. Docs and whiteboard are now fully merged.**
 
-![img_v2_3a4ee0da-6dd7-48cb-8f19-5411f86768ag](https://user-images.githubusercontent.com/79301703/230893796-dc707955-e4e5-4a42-a3c9-18d1ea754f6f.gif)
+- Many editor apps claim to be a canvas for productivity, but AFFiNE is one of the very few which allows you to put any building block on an edgeless canvas -- rich text, sticky notes, any embedded web pages, multi-view databases, linked pages, shapes and even slides. We have it all.
+
+**Multimodal AI partner ready to kick in any work**
+
+- Write up professional work report? Turn an outline into expressive and presentable slides? Summary an article into a well-structured mindmap? Sorting your job plan and backlog for tasks? Or....draw and code prototype apps and web pages directly all with one prompt? With you, AFFiNE AI pushes your creativity to the edge of your imagination.
+
+**Local-first & Real-time collaborative**
+
+- We love the idea of local-first that you always own your data on your disk, in spite of the cloud. Furthermore, AFFiNE supports real-time sync and collaborations on web and cross-platform clients.
+
+**Self-host & Shape your own AFFiNE**
+
+- You have the freedom to manage, self-host, fork and build your own AFFiNE. Plugin community and third-party blocks is coming soon. More tractions on [Blocksuite](block-suite.com). Check there to learn how to [self-host AFFiNE](https://docs.affine.pro/docs/self-host-affine-).
+
+## Acknowledgement
+
+“We shape our tools and thereafter our tools shape us”. A lot of pioneers have inspired us along the way, e.g.:
+
+- Quip & Notion with their great concept of “everything is a block”
+- Trello with their Kanban
+- Airtable & Miro with their no-code programable datasheets
+- Miro & Whimiscal with their edgeless visual whiteboard
+- Remnote & Capacities with their object-based tag system
+
+There is a large overlap of their atomic “building blocks” between these apps. They are not open source, nor do they have a plugin system like Vscode for contributors to customize. We want to have something that contains all the features we love and also goes one step even further.
+
+Thanks for checking us out, we appreciate your interest and sincerely hope that AFFiNE resonates with you! 🎵 Checking https://affine.pro/ for more details ions.
 
 ## Contributing
 
@@ -117,7 +120,7 @@ If you have questions, you are welcome to contact us. One of the best places to
 
 We would also like to give thanks to open-source projects that make AFFiNE possible:
 
-- [blocksuite](https://github.com/toeverything/BlockSuite) - 💠 BlockSuite is the open-source collaborative editor project behind AFFiNE.
+- [Blocksuite](https://github.com/toeverything/BlockSuite) - 💠 BlockSuite is the open-source collaborative editor project behind AFFiNE.
 - [OctoBase](https://github.com/toeverything/OctoBase) - 🐙 OctoBase is the open-source database behind AFFiNE, local-first, yet collaborative. A light-weight, scalable, data engine written in Rust.
 - [yjs](https://github.com/yjs/yjs) - Fundamental support of CRDTs for our implementation on state management and data sync.
 - [electron](https://github.com/electron/electron) - Build cross-platform desktop apps with JavaScript, HTML, and CSS.
@@ -140,20 +143,11 @@ We would like to express our gratitude to all the individuals who have already c
 
 ## Self-Host
 
-> We know that the self-host version has been out of date for a long time.
->
-> We are working hard to get this updated to the latest version, you can try our desktop version first.
-
-Get started with Docker and deploy your own feature-rich, restriction-free deployment of AFFiNE.
-We are working hard to get this updated to the latest version, you can keep an eye on the [latest packages].
+Begin with Docker to deploy your own feature-rich, unrestricted version of AFFiNE. Our team is diligently updating to the latest version. For more information on how to self-host AFFiNE, please refer to our [documentation](https://docs.affine.pro/docs/self-host-affine-).
 
 ## Hiring
 
-Some amazing companies including AFFiNE are looking for developers! Are you interested in helping build with AFFiNE and/or its partners? Check out some of the latest [jobs available].
-
-## Upgrading
-
-For upgrading information, please see our [update page].
+Some amazing companies including AFFiNE are looking for developers! Are you interesgo to iour discord channel AFFiNE and/or its partners? Check out some of the latest [jobs available].
 
 ## Feature Request
 
@@ -185,8 +179,6 @@ Thanks to [Chromatic](https://www.chromatic.com/) for providing the visual testi
 
 See [LICENSE] for details.
 
-[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Ftoeverything%2FAFFiNE.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Ftoeverything%2FAFFiNE?ref=badge_large)
-
 [all-contributors-badge]: https://img.shields.io/github/contributors/toeverything/AFFiNE
 [license]: ./LICENSE
 [building.md]: ./docs/BUILDING.md
@@ -194,7 +186,7 @@ See [LICENSE] for details.
 [jobs available]: ./docs/jobs.md
 [latest packages]: https://github.com/toeverything/AFFiNE/pkgs/container/affine-self-hosted
 [contributor license agreement]: https://github.com/toeverything/affine/edit/canary/.github/CLA.md
-[rust-version-icon]: https://img.shields.io/badge/Rust-1.75.0-dea584
+[rust-version-icon]: https://img.shields.io/badge/Rust-1.76.0-dea584
 [stars-icon]: https://img.shields.io/github/stars/toeverything/AFFiNE.svg?style=flat&logo=github&colorB=red&label=stars
 [codecov]: https://codecov.io/gh/toeverything/affine/branch/canary/graphs/badge.svg?branch=canary
 [node-version-icon]: https://img.shields.io/badge/node-%3E=18.16.1-success

SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+We recommend users to always use the latest major version. Security updates will be provided for the current major version until the next major version is released.
+
+| Version         | Supported          |
+| --------------- | ------------------ |
+| 0.12.x (stable) | :white_check_mark: |
+| < 0.12.x        | :x:                |
+
+## Reporting a Vulnerability
+
+We welcome you to provide us with bug reports via and email at [security@toeverything.info](mailto:security@toeverything.info). We expect your report to contain at least the following for us to evaluate and reproduce:
+
+1. Using platform and version, for example:
+
+   - macos arm64 0.12.0-canary-202402220729-0868ac6
+   - app.affine.pro 0.12.0-canary-202402220729-0868ac6
+
+2. A sets of video or screenshot containing the reproduce steps that proves you successfully exploited the vulnerability, preferably including the time and software version of the successful exploit.
+
+3. Your classification or analysis of the vulnerability (optional)
+
+Since we are an open source project, we also welcome you to provide corresponding fix PRs.
+
+We will provide bounties for vulnerabilities involving user information leakage, permission leakage, and unauthorized code execution. For other types of vulnerabilities, we will determine specific rewards based on the evaluation results.
+
+If the vulnerability is caused by a library we depend on, we encourage you to submit a security report to the corresponding dependent library at the same time to benefit more users.

docs/contributing/tutorial.md

@@ -29,7 +29,7 @@ It includes the global constants, browser and system check.
 
 This package should be imported at the very beginning of the entry point.
 
-### `@affine/workspace`
+### `@affine/workspace-impl`
 
 Current we have two workspace plugin:
 

docs/developing-server.md

@@ -59,9 +59,9 @@ You may need additional env for auth login. You may want to put your own one if
 For email login & password, please refer to https://nodemailer.com/usage/using-gmail/
 
 ```
-OAUTH_EMAIL_SENDER=
-OAUTH_EMAIL_LOGIN=
-OAUTH_EMAIL_PASSWORD=
+MAILER_SENDER=
+MAILER_USER=
+MAILER_PASSWORD=
 OAUTH_GOOGLE_ENABLED="true"
 OAUTH_GOOGLE_CLIENT_ID=
 OAUTH_GOOGLE_CLIENT_SECRET=

docs/reference/package.json

@@ -7,9 +7,9 @@
     "dev": "nodemon --exec 'typedoc --options ../../typedoc.json' & serve dist/"
   },
   "devDependencies": {
-    "nodemon": "^3.0.1",
+    "nodemon": "^3.1.0",
     "serve": "^14.2.1",
-    "typedoc": "^0.25.4"
+    "typedoc": "^0.25.8"
   },
   "nodemonConfig": {
     "watch": [

package.json

@@ -14,7 +14,7 @@
     "tests/affine-legacy/*"
   ],
   "engines": {
-    "node": ">=18.16.1 <19.0.0"
+    "node": "<21.0.0"
   },
   "scripts": {
     "dev": "dev-core",
@@ -36,7 +36,7 @@
     "test": "vitest --run",
     "test:ui": "vitest --ui",
     "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc -b tsconfig.json --diagnostics",
+    "typecheck": "tsc -b tsconfig.json",
     "postinstall": "node ./scripts/check-version.mjs && yarn i18n-codegen gen && yarn husky install",
     "prepare": "husky"
   },
@@ -56,61 +56,60 @@
   "devDependencies": {
     "@affine-test/kit": "workspace:*",
     "@affine/cli": "workspace:*",
-    "@commitlint/cli": "^18.4.3",
-    "@commitlint/config-conventional": "^18.4.3",
-    "@faker-js/faker": "^8.3.1",
+    "@commitlint/cli": "^19.0.0",
+    "@commitlint/config-conventional": "^19.0.0",
+    "@faker-js/faker": "^8.4.1",
     "@istanbuljs/schema": "^0.1.3",
     "@magic-works/i18n-codegen": "^0.5.0",
-    "@nx/vite": "17.2.8",
-    "@playwright/test": "^1.41.0",
-    "@taplo/cli": "^0.5.2",
-    "@testing-library/react": "^14.1.2",
+    "@nx/vite": "18.0.7",
+    "@playwright/test": "^1.41.2",
+    "@taplo/cli": "^0.7.0",
+    "@testing-library/react": "^14.2.1",
     "@toeverything/infra": "workspace:*",
     "@types/affine__env": "workspace:*",
-    "@types/eslint": "^8.44.7",
-    "@types/node": "^20.9.3",
-    "@typescript-eslint/eslint-plugin": "^6.13.1",
-    "@typescript-eslint/parser": "^6.13.1",
-    "@vanilla-extract/vite-plugin": "^3.9.2",
-    "@vanilla-extract/webpack-plugin": "^2.3.1",
-    "@vitejs/plugin-react-swc": "^3.5.0",
-    "@vitest/coverage-istanbul": "1.1.3",
-    "@vitest/ui": "1.1.3",
-    "electron": "^28.1.4",
-    "eslint": "^8.54.0",
-    "eslint-config-prettier": "^9.0.0",
-    "eslint-plugin-i": "^2.29.0",
+    "@types/eslint": "^8.56.3",
+    "@types/node": "^20.11.20",
+    "@typescript-eslint/eslint-plugin": "^7.0.2",
+    "@typescript-eslint/parser": "^7.0.2",
+    "@vanilla-extract/vite-plugin": "^4.0.4",
+    "@vanilla-extract/webpack-plugin": "^2.3.6",
+    "@vitejs/plugin-react-swc": "^3.6.0",
+    "@vitest/coverage-istanbul": "1.3.1",
+    "@vitest/ui": "1.3.1",
+    "electron": "^29.0.1",
+    "eslint": "^8.56.0",
+    "eslint-config-prettier": "^9.1.0",
+    "eslint-plugin-i": "^2.29.1",
     "eslint-plugin-react": "^7.33.2",
     "eslint-plugin-react-hooks": "^4.6.0",
-    "eslint-plugin-simple-import-sort": "^10.0.0",
-    "eslint-plugin-sonarjs": "^0.23.0",
-    "eslint-plugin-unicorn": "^50.0.0",
-    "eslint-plugin-unused-imports": "^3.0.0",
-    "eslint-plugin-vue": "^9.18.1",
+    "eslint-plugin-simple-import-sort": "^12.0.0",
+    "eslint-plugin-sonarjs": "^0.24.0",
+    "eslint-plugin-unicorn": "^51.0.1",
+    "eslint-plugin-unused-imports": "^3.1.0",
+    "eslint-plugin-vue": "^9.22.0",
     "fake-indexeddb": "5.0.2",
-    "happy-dom": "^13.0.0",
-    "husky": "^9.0.6",
-    "lint-staged": "^15.1.0",
-    "msw": "^2.0.8",
-    "nanoid": "^5.0.3",
-    "nx": "^17.2.8",
+    "happy-dom": "^13.4.1",
+    "husky": "^9.0.11",
+    "lint-staged": "^15.2.2",
+    "msw": "^2.2.1",
+    "nanoid": "^5.0.6",
+    "nx": "^18.0.4",
     "nyc": "^15.1.0",
     "oxlint": "0.0.22",
-    "prettier": "^3.1.0",
-    "semver": "^7.5.4",
+    "prettier": "^3.2.5",
+    "semver": "^7.6.0",
     "serve": "^14.2.1",
-    "string-width": "^7.0.0",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.3.2",
-    "vite": "^5.0.6",
+    "string-width": "^7.1.0",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.3.3",
+    "vite": "^5.1.4",
     "vite-plugin-istanbul": "^5.0.0",
-    "vite-plugin-static-copy": "^1.0.0",
-    "vite-tsconfig-paths": "^4.2.1",
-    "vitest": "1.1.3",
+    "vite-plugin-static-copy": "^1.0.1",
+    "vitest": "1.3.1",
     "vitest-fetch-mock": "^0.2.2",
     "vitest-mock-extended": "^1.3.1"
   },
-  "packageManager": "yarn@4.0.2",
+  "packageManager": "yarn@4.1.1",
   "resolutions": {
     "vite": "^5.0.6",
     "array-buffer-byte-length": "npm:@nolyfill/array-buffer-byte-length@latest",
@@ -169,8 +168,8 @@
     "which-boxed-primitive": "npm:@nolyfill/which-boxed-primitive@latest",
     "which-typed-array": "npm:@nolyfill/which-typed-array@latest",
     "next-auth@^4.24.5": "patch:next-auth@npm%3A4.24.5#~/.yarn/patches/next-auth-npm-4.24.5-8428e11927.patch",
-    "@reforged/maker-appimage/@electron-forge/maker-base": "7.2.0",
-    "macos-alias": "npm:macos-alias-building@latest",
+    "@reforged/maker-appimage/@electron-forge/maker-base": "7.3.0",
+    "macos-alias": "npm:@napi-rs/macos-alias@latest",
     "fs-xattr": "npm:@napi-rs/xattr@latest",
     "@radix-ui/react-dialog": "npm:@radix-ui/react-dialog@latest"
   }

packages/backend/server/package.json

@@ -9,57 +9,57 @@
   },
   "scripts": {
     "build": "tsc",
-    "start": "node --loader ts-node/esm/transpile-only.mjs --es-module-specifier-resolution node ./src/index.ts",
+    "start": "node --loader ts-node/esm/transpile-only.mjs ./src/index.ts",
     "dev": "nodemon ./src/index.ts",
     "test": "ava --concurrency 1 --serial",
     "test:coverage": "c8 ava --concurrency 1 --serial",
     "postinstall": "prisma generate",
-    "data-migration": "node --loader ts-node/esm/transpile-only.mjs --es-module-specifier-resolution node ./src/data/index.ts",
-    "predeploy": "yarn prisma migrate deploy && node --es-module-specifier-resolution node ./dist/data/index.js run"
+    "data-migration": "node --loader ts-node/esm/transpile-only.mjs ./src/data/index.ts",
+    "predeploy": "yarn prisma migrate deploy && node --import ./scripts/register.js ./dist/data/index.js run"
   },
   "dependencies": {
-    "@apollo/server": "^4.9.5",
-    "@auth/prisma-adapter": "^1.0.7",
-    "@aws-sdk/client-s3": "^3.499.0",
+    "@apollo/server": "^4.10.0",
+    "@auth/prisma-adapter": "^1.4.0",
+    "@aws-sdk/client-s3": "^3.515.0",
     "@google-cloud/opentelemetry-cloud-monitoring-exporter": "^0.17.0",
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^2.1.0",
     "@google-cloud/opentelemetry-resource-util": "^2.1.0",
-    "@keyv/redis": "^2.8.0",
-    "@nestjs/apollo": "^12.0.11",
-    "@nestjs/common": "^10.2.10",
-    "@nestjs/core": "^10.2.10",
-    "@nestjs/event-emitter": "^2.0.3",
-    "@nestjs/graphql": "^12.0.11",
-    "@nestjs/platform-express": "^10.2.10",
-    "@nestjs/platform-socket.io": "^10.2.10",
-    "@nestjs/schedule": "^4.0.0",
-    "@nestjs/serve-static": "^4.0.0",
+    "@keyv/redis": "^2.8.4",
+    "@nestjs/apollo": "^12.1.0",
+    "@nestjs/common": "^10.3.3",
+    "@nestjs/core": "^10.3.3",
+    "@nestjs/event-emitter": "^2.0.4",
+    "@nestjs/graphql": "^12.1.1",
+    "@nestjs/platform-express": "^10.3.3",
+    "@nestjs/platform-socket.io": "^10.3.3",
+    "@nestjs/schedule": "^4.0.1",
+    "@nestjs/serve-static": "^4.0.1",
     "@nestjs/throttler": "^5.0.1",
-    "@nestjs/websockets": "^10.2.10",
-    "@node-rs/argon2": "^1.5.2",
-    "@node-rs/crc32": "^1.7.2",
-    "@node-rs/jsonwebtoken": "^0.3.0",
+    "@nestjs/websockets": "^10.3.3",
+    "@node-rs/argon2": "^1.7.2",
+    "@node-rs/crc32": "^1.9.2",
+    "@node-rs/jsonwebtoken": "^0.5.0",
     "@opentelemetry/api": "^1.7.0",
-    "@opentelemetry/core": "^1.20.0",
-    "@opentelemetry/exporter-prometheus": "^0.47.0",
-    "@opentelemetry/exporter-zipkin": "^1.20.0",
-    "@opentelemetry/host-metrics": "^0.34.0",
-    "@opentelemetry/instrumentation": "^0.47.0",
-    "@opentelemetry/instrumentation-graphql": "^0.36.0",
-    "@opentelemetry/instrumentation-http": "^0.47.0",
-    "@opentelemetry/instrumentation-ioredis": "^0.36.0",
-    "@opentelemetry/instrumentation-nestjs-core": "^0.33.3",
-    "@opentelemetry/instrumentation-socket.io": "^0.35.0",
-    "@opentelemetry/resources": "^1.20.0",
-    "@opentelemetry/sdk-metrics": "^1.20.0",
-    "@opentelemetry/sdk-node": "^0.47.0",
-    "@opentelemetry/sdk-trace-node": "^1.20.0",
-    "@opentelemetry/semantic-conventions": "^1.20.0",
-    "@prisma/client": "^5.7.1",
-    "@prisma/instrumentation": "^5.7.1",
+    "@opentelemetry/core": "^1.21.0",
+    "@opentelemetry/exporter-prometheus": "^0.49.0",
+    "@opentelemetry/exporter-zipkin": "^1.21.0",
+    "@opentelemetry/host-metrics": "^0.35.0",
+    "@opentelemetry/instrumentation": "^0.49.0",
+    "@opentelemetry/instrumentation-graphql": "^0.37.0",
+    "@opentelemetry/instrumentation-http": "^0.49.0",
+    "@opentelemetry/instrumentation-ioredis": "^0.37.0",
+    "@opentelemetry/instrumentation-nestjs-core": "^0.34.0",
+    "@opentelemetry/instrumentation-socket.io": "^0.36.0",
+    "@opentelemetry/resources": "^1.21.0",
+    "@opentelemetry/sdk-metrics": "^1.21.0",
+    "@opentelemetry/sdk-node": "^0.49.0",
+    "@opentelemetry/sdk-trace-node": "^1.21.0",
+    "@opentelemetry/semantic-conventions": "^1.21.0",
+    "@prisma/client": "^5.10.2",
+    "@prisma/instrumentation": "^5.10.2",
     "@socket.io/redis-adapter": "^8.2.1",
     "cookie-parser": "^1.4.6",
-    "dotenv": "^16.3.1",
+    "dotenv": "^16.4.5",
     "dotenv-cli": "^7.3.0",
     "express": "^4.18.2",
     "file-type": "^19.0.0",
@@ -71,50 +71,50 @@
     "ioredis": "^5.3.2",
     "keyv": "^4.5.4",
     "lodash-es": "^4.17.21",
-    "nanoid": "^5.0.3",
-    "nest-commander": "^3.12.2",
+    "nanoid": "^5.0.6",
+    "nest-commander": "^3.12.5",
     "nestjs-throttler-storage-redis": "^0.4.1",
     "next-auth": "^4.24.5",
-    "nodemailer": "^6.9.7",
+    "nodemailer": "^6.9.10",
     "on-headers": "^1.0.2",
     "parse-duration": "^1.1.0",
     "pretty-time": "^1.1.0",
-    "prisma": "^5.7.1",
-    "prom-client": "^15.0.0",
-    "reflect-metadata": "^0.2.0",
+    "prisma": "^5.10.2",
+    "prom-client": "^15.1.0",
+    "reflect-metadata": "^0.2.1",
     "rxjs": "^7.8.1",
-    "semver": "^7.5.4",
-    "socket.io": "^4.7.2",
-    "stripe": "^14.5.0",
-    "ws": "^8.14.2",
-    "yjs": "^13.6.10",
+    "semver": "^7.6.0",
+    "socket.io": "^4.7.4",
+    "stripe": "^14.18.0",
+    "ts-node": "^10.9.2",
+    "typescript": "^5.3.3",
+    "ws": "^8.16.0",
+    "yjs": "^13.6.12",
     "zod": "^3.22.4"
   },
   "devDependencies": {
     "@affine-test/kit": "workspace:*",
     "@affine/storage": "workspace:*",
-    "@napi-rs/image": "^1.7.0",
-    "@nestjs/testing": "^10.2.10",
+    "@napi-rs/image": "^1.9.1",
+    "@nestjs/testing": "^10.3.3",
     "@types/cookie-parser": "^1.4.6",
     "@types/engine.io": "^3.1.10",
     "@types/express": "^4.17.21",
-    "@types/graphql-upload": "^16.0.5",
+    "@types/graphql-upload": "^16.0.7",
     "@types/keyv": "^4.2.0",
-    "@types/lodash-es": "^4.17.11",
-    "@types/node": "^20.9.3",
+    "@types/lodash-es": "^4.17.12",
+    "@types/node": "^20.11.20",
     "@types/nodemailer": "^6.4.14",
     "@types/on-headers": "^1.0.3",
     "@types/pretty-time": "^1.1.5",
-    "@types/sinon": "^17.0.2",
-    "@types/supertest": "^6.0.0",
+    "@types/sinon": "^17.0.3",
+    "@types/supertest": "^6.0.2",
     "@types/ws": "^8.5.10",
-    "ava": "^6.0.0",
-    "c8": "^9.0.0",
-    "nodemon": "^3.0.1",
+    "ava": "^6.1.1",
+    "c8": "^9.1.0",
+    "nodemon": "^3.1.0",
     "sinon": "^17.0.1",
-    "supertest": "^6.3.3",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.3.2"
+    "supertest": "^6.3.4"
   },
   "ava": {
     "timeout": "1m",
@@ -126,8 +126,7 @@
       "--trace-sigint",
       "--loader",
       "ts-node/esm/transpile-only.mjs",
-      "--es-module-specifier-resolution",
-      "node"
+      "--es-module-specifier-resolution=node"
     ],
     "files": [
       "tests/**/*.spec.ts",
@@ -139,10 +138,11 @@
     "environmentVariables": {
       "TS_NODE_PROJECT": "./tests/tsconfig.json",
       "NODE_ENV": "test",
-      "ENABLE_LOCAL_EMAIL": "true",
-      "OAUTH_EMAIL_LOGIN": "noreply@toeverything.info",
-      "OAUTH_EMAIL_PASSWORD": "affine",
-      "OAUTH_EMAIL_SENDER": "noreply@toeverything.info",
+      "MAILER_HOST": "0.0.0.0",
+      "MAILER_PORT": "1025",
+      "MAILER_USER": "noreply@toeverything.info",
+      "MAILER_PASSWORD": "affine",
+      "MAILER_SENDER": "noreply@toeverything.info",
       "FEATURES_EARLY_ACCESS_PREVIEW": "false"
     }
   },
@@ -152,8 +152,7 @@
     "nodeArgs": [
       "--loader",
       "ts-node/esm.mjs",
-      "--es-module-specifier-resolution",
-      "node"
+      "--es-module-specifier-resolution=node"
     ],
     "ignore": [
       "**/__tests__/**",
@@ -162,7 +161,6 @@
     "env": {
       "TS_NODE_TRANSPILE_ONLY": true,
       "TS_NODE_PROJECT": "./tsconfig.json",
-      "NODE_ENV": "development",
       "DEBUG": "affine:*",
       "FORCE_COLOR": true,
       "DEBUG_COLORS": true

packages/backend/server/schema.prisma

@@ -265,7 +265,9 @@ model Snapshot {
   seq         Int      @default(0) @db.Integer
   state       Bytes?   @db.ByteA
   createdAt   DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
-  updatedAt   DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+  // the `updated_at` field will not record the time of record changed,
+  // but the created time of last seen update that has been merged into snapshot.
+  updatedAt   DateTime @map("updated_at") @db.Timestamptz(6)
 
   @@id([id, workspaceId])
   @@map("snapshots")

packages/backend/server/scripts/loader.js

@@ -0,0 +1,11 @@
+import { create, createEsmHooks } from 'ts-node';
+
+const service = create({
+  experimentalSpecifierResolution: 'node',
+  transpileOnly: true,
+  logError: true,
+  skipProject: true,
+});
+const hooks = createEsmHooks(service);
+
+export const resolve = hooks.resolve;

packages/backend/server/scripts/register.js

@@ -0,0 +1,4 @@
+import { register } from 'node:module';
+import { pathToFileURL } from 'node:url';
+
+register('./scripts/loader.js', pathToFileURL('./'));

packages/backend/server/scripts/self-host-predeploy.js

@@ -13,7 +13,10 @@ const configFiles = [
 ];
 
 function configCleaner(content) {
-  return content.replace(/(\/\/#.*$)|(\/\/\s+TODO.*$)/gm, '');
+  return content.replace(
+    /(^\/\/#.*$)|(^\/\/\s+TODO.*$)|("use\sstrict";?)|(^.*eslint-disable.*$)/gm,
+    ''
+  );
 }
 
 function prepare() {
@@ -39,11 +42,9 @@ function prepare() {
 function runPredeployScript() {
   console.log('running predeploy script.');
   execSync('yarn predeploy', {
-    env: {
-      ...process.env,
-      NODE_OPTIONS:
-        (process.env.NODE_OPTIONS ?? '') + ' --import ./dist/prelude.js',
-    },
+    encoding: 'utf-8',
+    env: process.env,
+    stdio: 'inherit',
   });
 }
 

packages/backend/server/src/app.controller.ts

@@ -11,6 +11,7 @@ export class AppController {
     return {
       compatibility: this.config.version,
       message: `AFFiNE ${this.config.version} Server`,
+      type: this.config.type,
       flavor: this.config.flavor,
     };
   }

packages/backend/server/src/app.module.ts

@@ -29,6 +29,7 @@ import { MailModule } from './fundamentals/mailer';
 import { MetricsModule } from './fundamentals/metrics';
 import { PrismaModule } from './fundamentals/prisma';
 import { SessionModule } from './fundamentals/session';
+import { StorageProviderModule } from './fundamentals/storage';
 import { RateLimiterModule } from './fundamentals/throttler';
 import { WebSocketModule } from './fundamentals/websocket';
 import { pluginsMap } from './plugins';
@@ -43,6 +44,7 @@ export const FunctionalityModules = [
   RateLimiterModule,
   SessionModule,
   MailModule,
+  StorageProviderModule,
 ];
 
 export class AppModuleBuilder {
@@ -109,7 +111,7 @@ export class AppModuleBuilder {
         },
       ],
       imports: this.modules,
-      controllers: this.config.flavor.selfhosted ? [] : [AppController],
+      controllers: this.config.isSelfhosted ? [] : [AppController],
     })
     class AppModule {}
 
@@ -132,9 +134,9 @@ function buildAppModule() {
     // sync server only
     .useIf(config => config.flavor.sync, SyncModule)
 
-    // main server only
+    // graphql server only
     .useIf(
-      config => config.flavor.main,
+      config => config.flavor.graphql,
       ServerConfigModule,
       WebSocketModule,
       GqlModule,
@@ -147,7 +149,7 @@ function buildAppModule() {
 
     // self hosted server only
     .useIf(
-      config => config.flavor.selfhosted,
+      config => config.isSelfhosted,
       ServeStaticModule.forRoot({
         rootPath: join('/app', 'static'),
       })

packages/backend/server/src/app.ts

@@ -4,9 +4,8 @@ import type { NestExpressApplication } from '@nestjs/platform-express';
 import cookieParser from 'cookie-parser';
 import graphqlUploadExpress from 'graphql-upload/graphqlUploadExpress.mjs';
 
-import { SocketIoAdapter } from './fundamentals';
-import { SocketIoAdapterImpl } from './fundamentals/websocket';
-import { ExceptionLogger } from './middleware/exception-logger';
+import { GlobalExceptionFilter } from './fundamentals';
+import { SocketIoAdapter, SocketIoAdapterImpl } from './fundamentals/websocket';
 import { serverTimingAndCache } from './middleware/timing';
 
 export async function createApp() {
@@ -29,7 +28,7 @@ export async function createApp() {
     })
   );
 
-  app.useGlobalFilters(new ExceptionLogger());
+  app.useGlobalFilters(new GlobalExceptionFilter(app.getHttpAdapter()));
   app.use(cookieParser());
 
   if (AFFiNE.flavor.sync) {

packages/backend/server/src/config/affine.env.ts

@@ -3,8 +3,7 @@ AFFiNE.ENV_MAP = {
   AFFINE_SERVER_PORT: ['port', 'int'],
   AFFINE_SERVER_HOST: 'host',
   AFFINE_SERVER_SUB_PATH: 'path',
-  AFFIHE_SERVER_HTTPS: ['https', 'boolean'],
-  AFFINE_ENV: 'affineEnv',
+  AFFINE_SERVER_HTTPS: ['https', 'boolean'],
   DATABASE_URL: 'db.url',
   ENABLE_CAPTCHA: ['auth.captcha.enable', 'boolean'],
   CAPTCHA_TURNSTILE_SECRET: ['auth.captcha.turnstile.secret', 'string'],
@@ -14,11 +13,12 @@ AFFiNE.ENV_MAP = {
   OAUTH_GITHUB_ENABLED: ['auth.oauthProviders.github.enabled', 'boolean'],
   OAUTH_GITHUB_CLIENT_ID: 'auth.oauthProviders.github.clientId',
   OAUTH_GITHUB_CLIENT_SECRET: 'auth.oauthProviders.github.clientSecret',
-  OAUTH_EMAIL_LOGIN: 'auth.email.login',
-  OAUTH_EMAIL_SENDER: 'auth.email.sender',
-  OAUTH_EMAIL_SERVER: 'auth.email.server',
-  OAUTH_EMAIL_PORT: ['auth.email.port', 'int'],
-  OAUTH_EMAIL_PASSWORD: 'auth.email.password',
+  MAILER_HOST: 'mailer.host',
+  MAILER_PORT: ['mailer.port', 'int'],
+  MAILER_USER: 'mailer.auth.user',
+  MAILER_PASSWORD: 'mailer.auth.pass',
+  MAILER_SENDER: 'mailer.from.address',
+  MAILER_SECURE: ['mailer.secure', 'boolean'],
   THROTTLE_TTL: ['rateLimiter.ttl', 'int'],
   THROTTLE_LIMIT: ['rateLimiter.limit', 'int'],
   REDIS_SERVER_HOST: 'plugins.redis.host',
@@ -28,13 +28,14 @@ AFFiNE.ENV_MAP = {
   REDIS_SERVER_DATABASE: ['plugins.redis.db', 'int'],
   DOC_MERGE_INTERVAL: ['doc.manager.updatePollInterval', 'int'],
   DOC_MERGE_USE_JWST_CODEC: [
-    'doc.manager.experimentalMergeWithJwstCodec',
+    'doc.manager.experimentalMergeWithYOcto',
     'boolean',
   ],
-  ENABLE_LOCAL_EMAIL: ['auth.localEmail', 'boolean'],
   STRIPE_API_KEY: 'plugins.payment.stripe.keys.APIKey',
   STRIPE_WEBHOOK_KEY: 'plugins.payment.stripe.keys.webhookKey',
   FEATURES_EARLY_ACCESS_PREVIEW: ['featureFlags.earlyAccessPreview', 'boolean'],
+  FEATURES_SYNC_CLIENT_VERSION_CHECK: [
+    'featureFlags.syncClientVersionCheck',
+    'boolean',
+  ],
 };
-
-export default AFFiNE;

packages/backend/server/src/config/affine.self.ts

@@ -0,0 +1,54 @@
+/* eslint-disable @typescript-eslint/no-non-null-assertion */
+// Custom configurations for AFFiNE Cloud
+// ====================================================================================
+// Q: WHY THIS FILE EXISTS?
+// A: AFFiNE deployment environment may have a lot of custom environment variables,
+//    which are not suitable to be put in the `affine.ts` file.
+//    For example, AFFiNE Cloud Clusters are deployed on Google Cloud Platform.
+//    We need to enable the `gcloud` plugin to make sure the nodes working well,
+//    but the default selfhost version may not require it.
+//    So it's not a good idea to put such logic in the common `affine.ts` file.
+//
+//    ```
+//    if (AFFiNE.deploy) {
+//      AFFiNE.plugins.use('gcloud');
+//    }
+//    ```
+// ====================================================================================
+const env = process.env;
+
+AFFiNE.metrics.enabled = !AFFiNE.node.test;
+
+if (env.R2_OBJECT_STORAGE_ACCOUNT_ID) {
+  AFFiNE.plugins.use('cloudflare-r2', {
+    accountId: env.R2_OBJECT_STORAGE_ACCOUNT_ID,
+    credentials: {
+      accessKeyId: env.R2_OBJECT_STORAGE_ACCESS_KEY_ID!,
+      secretAccessKey: env.R2_OBJECT_STORAGE_SECRET_ACCESS_KEY!,
+    },
+  });
+  AFFiNE.storage.storages.avatar.provider = 'cloudflare-r2';
+  AFFiNE.storage.storages.avatar.bucket = 'account-avatar';
+  AFFiNE.storage.storages.avatar.publicLinkFactory = key =>
+    `https://avatar.affineassets.com/${key}`;
+
+  AFFiNE.storage.storages.blob.provider = 'cloudflare-r2';
+  AFFiNE.storage.storages.blob.bucket = `workspace-blobs-${
+    AFFiNE.affine.canary ? 'canary' : 'prod'
+  }`;
+}
+
+AFFiNE.plugins.use('redis');
+AFFiNE.plugins.use('payment');
+
+if (AFFiNE.deploy) {
+  AFFiNE.mailer = {
+    service: 'gmail',
+    auth: {
+      user: env.MAILER_USER,
+      pass: env.MAILER_PASSWORD,
+    },
+  };
+
+  AFFiNE.plugins.use('gcloud');
+}

packages/backend/server/src/config/affine.ts

@@ -1,39 +1,117 @@
 /* eslint-disable @typescript-eslint/no-non-null-assertion */
-// Custom configurations
-const env = process.env;
-
-// TODO(@forehalo): detail explained
-// Storage
-if (env.R2_OBJECT_STORAGE_ACCOUNT_ID) {
-  AFFiNE.storage.providers.r2 = {
-    accountId: env.R2_OBJECT_STORAGE_ACCOUNT_ID,
-    credentials: {
-      accessKeyId: env.R2_OBJECT_STORAGE_ACCESS_KEY_ID!,
-      secretAccessKey: env.R2_OBJECT_STORAGE_SECRET_ACCESS_KEY!,
-    },
-  };
-  AFFiNE.storage.storages.avatar.provider = 'r2';
-  AFFiNE.storage.storages.avatar.bucket = 'account-avatar';
-  AFFiNE.storage.storages.avatar.publicLinkFactory = key =>
-    `https://avatar.affineassets.com/${key}`;
-
-  AFFiNE.storage.storages.blob.provider = 'r2';
-  AFFiNE.storage.storages.blob.bucket = `workspace-blobs-${
-    AFFiNE.affine.canary ? 'canary' : 'prod'
-  }`;
-}
-
-// Metrics
-AFFiNE.metrics.enabled = true;
-
-// Plugins Section Start
-AFFiNE.plugins.use('payment', {
-  stripe: {
-    keys: {},
-    apiVersion: '2023-10-16',
-  },
+//
+// ###############################################################
+// ##                AFFiNE Configuration System                ##
+// ###############################################################
+// Here is the file of all AFFiNE configurations that will affect runtime behavior.
+// Override any configuration here and it will be merged when starting the server.
+// Any changes in this file won't take effect before server restarted.
+//
+//
+// > Configurations merge order
+//   1. load environment variables (`.env` if provided, and from system)
+//   2. load `src/fundamentals/config/default.ts` for all default settings
+//   3. apply `./affine.ts` patches (this file)
+//   4. apply `./affine.env.ts` patches
+//
+//
+// ###############################################################
+// ##                       General settings                    ##
+// ###############################################################
+//
+// /* The unique identity of the server */
+// AFFiNE.serverId = 'some-randome-uuid';
+//
+// /* The name of AFFiNE Server, may show on the UI */
+// AFFiNE.serverName = 'Your Cool AFFiNE Selfhosted Cloud';
+//
+// /* Whether the server is deployed behind a HTTPS proxied environment */
+AFFiNE.https = false;
+// /* Domain of your server that your server will be available at */
+AFFiNE.host = 'localhost';
+// /* The local port of your server that will listen on */
+AFFiNE.port = 3010;
+// /* The sub path of your server */
+// /* For example, if you set `AFFiNE.path = '/affine'`, then the server will be available at `${domain}/affine` */
+// AFFiNE.path = '/affine';
+//
+//
+// ###############################################################
+// ##                       Database settings                   ##
+// ###############################################################
+//
+// /* The URL of the database where most of AFFiNE server data will be stored in */
+// AFFiNE.db.url = 'postgres://user:passsword@localhost:5432/affine';
+//
+//
+// ###############################################################
+// ##                   Server Function settings                ##
+// ###############################################################
+//
+// /* Whether enable metrics and tracing while running the server */
+// /* The metrics will be available at `http://localhost:9464/metrics` with [Prometheus] format exported */
+// AFFiNE.metrics.enabled = true;
+//
+// /* GraphQL configurations that control the behavior of the Apollo Server behind */
+// /* @see https://www.apollographql.com/docs/apollo-server/api/apollo-server */
+// AFFiNE.graphql = {
+//   /* Path to mount GraphQL API */
+//   path: '/graphql',
+//   buildSchemaOptions: {
+//     numberScalarMode: 'integer',
+//   },
+//   /* Whether allow client to query the schema introspection */
+//   introspection: true,
+//   /* Whether enable GraphQL Playground UI */
+//   playground: true,
+// }
+//
+// /* Doc Store & Collaberation */
+// /* How long the buffer time of creating a new history snapshot when doc get updated */
+// AFFiNE.doc.history.interval = 1000 * 60 * 10; // 10 minutes
+//
+// /* Use `y-octo` to merge updates at the same time when merging using Yjs */
+// AFFiNE.doc.manager.experimentalMergeWithYOcto = true;
+//
+// /* How often the manager will start a new turn of merging pending updates into doc snapshot */
+// AFFiNE.doc.manager.updatePollInterval = 1000 * 3;
+//
+//
+// ###############################################################
+// ##                        Plugins settings                   ##
+// ###############################################################
+//
+// /* Redis Plugin */
+// /* Provide caching and session storing backed by Redis. */
+// /* Useful when you deploy AFFiNE server in a cluster. */
+AFFiNE.plugins.use('redis', {
+  /* override options */
 });
-AFFiNE.plugins.use('redis');
-// Plugins Section end
-
-export default AFFiNE;
+//
+//
+// /* Payment Plugin */
+AFFiNE.plugins.use('payment', {
+  stripe: { keys: {}, apiVersion: '2023-10-16' },
+});
+//
+//
+// /* Cloudflare R2 Plugin */
+// /* Enable if you choose to store workspace blobs or user avatars in Cloudflare R2 Storage Service */
+// AFFiNE.plugins.use('cloudflare-r2', {
+//   accountId: '',
+//   credentials: {
+//     accessKeyId: '',
+//     secretAccessKey: '',
+//   },
+// });
+//
+// /* AWS S3 Plugin */
+// /* Enable if you choose to store workspace blobs or user avatars in AWS S3 Storage Service */
+// AFFiNE.plugins.use('aws-s3', {
+//  credentials: {
+//    accessKeyId: '',
+//    secretAccessKey: '',
+// })
+// /* Update the provider of storages */
+// AFFiNE.storage.storages.blob.provider = 'r2';
+// AFFiNE.storage.storages.avatar.provider = 'r2';

packages/backend/server/src/core/auth/guard.ts

@@ -4,16 +4,15 @@ import {
   Inject,
   Injectable,
   SetMetadata,
+  UnauthorizedException,
   UseGuards,
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import { PrismaClient } from '@prisma/client';
 import type { NextAuthOptions } from 'next-auth';
 import { AuthHandler } from 'next-auth/core';
 
-import {
-  getRequestResponseFromContext,
-  PrismaService,
-} from '../../fundamentals';
+import { getRequestResponseFromContext } from '../../fundamentals';
 import { NextAuthOptionsProvide } from './next-auth-options';
 import { AuthService } from './service';
 
@@ -56,7 +55,7 @@ class AuthGuard implements CanActivate {
     @Inject(NextAuthOptionsProvide)
     private readonly nextAuthOptions: NextAuthOptions,
     private readonly auth: AuthService,
-    private readonly prisma: PrismaService,
+    private readonly prisma: PrismaClient,
     private readonly reflector: Reflector
   ) {}
 
@@ -69,6 +68,10 @@ class AuthGuard implements CanActivate {
       'isPublic',
       context.getHandler()
     );
+
+    // FIXME(@forehalo): @Publicable() is duplicated with @CurrentUser() user?: User
+    //                                                                       ^ optional
+    //   we can prefetch user session in each request even before this `Guard`
     // api can be public, but if user is logged in, we can get user info
     const isPublicable = this.reflector.get<boolean>(
       'isPublicable',
@@ -94,7 +97,7 @@ class AuthGuard implements CanActivate {
 
       const { body = {}, cookies, status = 200 } = session;
       if (!body && !isPublicable) {
-        return false;
+        throw new UnauthorizedException('You are not signed in.');
       }
 
       // @ts-expect-error body is user here

packages/backend/server/src/core/auth/next-auth-options.ts

@@ -1,6 +1,7 @@
 import { PrismaAdapter } from '@auth/prisma-adapter';
 import { FactoryProvider, Logger } from '@nestjs/common';
 import { verify } from '@node-rs/argon2';
+import { PrismaClient } from '@prisma/client';
 import { assign, omit } from 'lodash-es';
 import { NextAuthOptions } from 'next-auth';
 import Credentials from 'next-auth/providers/credentials';
@@ -8,12 +9,7 @@ import Email from 'next-auth/providers/email';
 import Github from 'next-auth/providers/github';
 import Google from 'next-auth/providers/google';
 
-import {
-  Config,
-  MailService,
-  PrismaService,
-  SessionService,
-} from '../../fundamentals';
+import { Config, MailService, SessionService } from '../../fundamentals';
 import { FeatureType } from '../features';
 import { Quota_FreePlanV1_1 } from '../quota';
 import {
@@ -31,7 +27,7 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
   provide: NextAuthOptionsProvide,
   useFactory(
     config: Config,
-    prisma: PrismaService,
+    prisma: PrismaClient,
     mailer: MailService,
     session: SessionService
   ) {
@@ -64,6 +60,7 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
       if (data.image) {
         userData.avatarUrl = data.image;
       }
+      // @ts-expect-error third part library type mismatch
       return createUser(userData);
     };
     // linkAccount exists in the adapter
@@ -96,28 +93,29 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
       }
       return result;
     };
+
+    prismaAdapter.createVerificationToken = async data => {
+      await session.set(
+        `${data.identifier}:${data.token}`,
+        Date.now() + session.sessionTtl
+      );
+      return data;
+    };
+
+    prismaAdapter.useVerificationToken = async ({ identifier, token }) => {
+      const expires = await session.get(`${identifier}:${token}`);
+      if (expires) {
+        return { identifier, token, expires: new Date(expires) };
+      } else {
+        return null;
+      }
+    };
+
     const nextAuthOptions: NextAuthOptions = {
-      providers: [
-        // @ts-expect-error esm interop issue
-        Email.default({
-          server: {
-            host: config.auth.email.server,
-            port: config.auth.email.port,
-            auth: {
-              user: config.auth.email.login,
-              pass: config.auth.email.password,
-            },
-          },
-          from: config.auth.email.sender,
-          sendVerificationRequest: (params: SendVerificationRequestParams) =>
-            sendVerificationRequest(config, logger, mailer, session, params),
-        }),
-      ],
+      providers: [],
+      // @ts-expect-error Third part library type mismatch
       adapter: prismaAdapter,
       debug: !config.node.prod,
-      session: {
-        strategy: 'database',
-      },
       logger: {
         debug(code, metadata) {
           logger.debug(`${code}: ${JSON.stringify(metadata)}`);
@@ -170,6 +168,16 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
       })
     );
 
+    if (config.mailer && mailer) {
+      nextAuthOptions.providers.push(
+        // @ts-expect-error esm interop issue
+        Email.default({
+          sendVerificationRequest: (params: SendVerificationRequestParams) =>
+            sendVerificationRequest(config, logger, mailer, session, params),
+        })
+      );
+    }
+
     if (config.auth.oauthProviders.github) {
       nextAuthOptions.providers.push(
         // @ts-expect-error esm interop issue
@@ -196,6 +204,11 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
       );
     }
 
+    if (nextAuthOptions.providers.length > 1) {
+      // not only credentials provider
+      nextAuthOptions.session = { strategy: 'database' };
+    }
+
     nextAuthOptions.jwt = {
       encode: async ({ token, maxAge }) =>
         encode(config, prisma, token, maxAge),
@@ -244,7 +257,10 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
             .count({
               where: {
                 user: {
-                  email,
+                  email: {
+                    equals: email,
+                    mode: 'insensitive',
+                  },
                 },
                 feature: {
                   feature: FeatureType.EarlyAccess,
@@ -266,5 +282,5 @@ export const NextAuthOptionsProvider: FactoryProvider<NextAuthOptions> = {
     };
     return nextAuthOptions;
   },
-  inject: [Config, PrismaService, MailService, SessionService],
+  inject: [Config, PrismaClient, MailService, SessionService],
 };

packages/backend/server/src/core/auth/next-auth.controller.ts

@@ -15,7 +15,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { hash, verify } from '@node-rs/argon2';
-import type { User } from '@prisma/client';
+import { PrismaClient, type User } from '@prisma/client';
 import type { NextFunction, Request, Response } from 'express';
 import { pick } from 'lodash-es';
 import { nanoid } from 'nanoid';
@@ -26,7 +26,6 @@ import {
   AuthThrottlerGuard,
   Config,
   metrics,
-  PrismaService,
   SessionService,
   Throttle,
 } from '../../fundamentals';
@@ -45,7 +44,7 @@ export class NextAuthController {
 
   constructor(
     readonly config: Config,
-    readonly prisma: PrismaService,
+    readonly prisma: PrismaClient,
     private readonly authService: AuthService,
     @Inject(NextAuthOptionsProvide)
     private readonly nextAuthOptions: NextAuthOptions,
@@ -107,7 +106,10 @@ export class NextAuthController {
       if (email) {
         const user = await this.prisma.user.findFirst({
           where: {
-            email,
+            email: {
+              equals: email,
+              mode: 'insensitive',
+            },
           },
         });
         if (!user) {

packages/backend/server/src/core/auth/service.ts

@@ -8,13 +8,12 @@ import {
 } from '@nestjs/common';
 import { hash, verify } from '@node-rs/argon2';
 import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
-import type { User } from '@prisma/client';
+import { PrismaClient, type User } from '@prisma/client';
 import { nanoid } from 'nanoid';
 
 import {
   Config,
   MailService,
-  PrismaService,
   verifyChallengeResponse,
 } from '../../fundamentals';
 import { Quota_FreePlanV1_1 } from '../quota';
@@ -32,7 +31,7 @@ export const getUtcTimestamp = () => Math.floor(Date.now() / 1000);
 export class AuthService {
   constructor(
     private readonly config: Config,
-    private readonly prisma: PrismaService,
+    private readonly prisma: PrismaClient,
     private readonly mailer: MailService
   ) {}
 
@@ -136,7 +135,7 @@ export class AuthService {
     return (
       !!outcome.success &&
       // skip hostname check in dev mode
-      (this.config.affineEnv === 'dev' || outcome.hostname === this.config.host)
+      (this.config.node.dev || outcome.hostname === this.config.host)
     );
   }
 
@@ -151,7 +150,10 @@ export class AuthService {
   async signIn(email: string, password: string): Promise<User> {
     const user = await this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
       },
     });
 
@@ -179,7 +181,10 @@ export class AuthService {
   async signUp(name: string, email: string, password: string): Promise<User> {
     const user = await this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
       },
     });
 
@@ -213,7 +218,10 @@ export class AuthService {
   async createAnonymousUser(email: string): Promise<User> {
     const user = await this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
       },
     });
 
@@ -241,9 +249,12 @@ export class AuthService {
   }
 
   async getUserByEmail(email: string): Promise<User | null> {
-    return this.prisma.user.findUnique({
+    return this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
       },
     });
   }
@@ -251,7 +262,10 @@ export class AuthService {
   async isUserHasPassword(email: string): Promise<boolean> {
     const user = await this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
       },
     });
     if (!user) {
@@ -261,9 +275,12 @@ export class AuthService {
   }
 
   async changePassword(email: string, newPassword: string): Promise<User> {
-    const user = await this.prisma.user.findUnique({
+    const user = await this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
         emailVerified: {
           not: null,
         },

packages/backend/server/src/core/auth/utils/jwt.ts

@@ -2,14 +2,15 @@ import { randomUUID } from 'node:crypto';
 
 import { BadRequestException } from '@nestjs/common';
 import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
+import { PrismaClient } from '@prisma/client';
 import { JWT } from 'next-auth/jwt';
 
-import { Config, PrismaService } from '../../../fundamentals';
+import { Config } from '../../../fundamentals';
 import { getUtcTimestamp, UserClaim } from '../service';
 
 export const jwtEncode = async (
   config: Config,
-  prisma: PrismaService,
+  prisma: PrismaClient,
   token: JWT | undefined,
   maxAge: number | undefined
 ) => {

packages/backend/server/src/core/auth/utils/send-mail.ts

@@ -11,7 +11,7 @@ export async function sendVerificationRequest(
   session: SessionService,
   params: SendVerificationRequestParams
 ) {
-  const { identifier, url, provider } = params;
+  const { identifier, url } = params;
   const urlWithToken = new URL(url);
   const callbackUrl = urlWithToken.searchParams.get('callbackUrl') || '';
   if (!callbackUrl) {
@@ -28,7 +28,6 @@ export async function sendVerificationRequest(
 
   const result = await mailer.sendSignInEmail(urlWithToken.toString(), {
     to: identifier,
-    from: provider.from,
   });
   logger.log(`send verification email success: ${result.accepted.join(', ')}`);
 

packages/backend/server/src/core/config.ts

@@ -1,6 +1,8 @@
 import { Module } from '@nestjs/common';
 import { Field, ObjectType, Query, registerEnumType } from '@nestjs/graphql';
 
+import { DeploymentType } from '../fundamentals';
+
 export enum ServerFeature {
   Payment = 'payment',
 }
@@ -9,6 +11,10 @@ registerEnumType(ServerFeature, {
   name: 'ServerFeature',
 });
 
+registerEnumType(DeploymentType, {
+  name: 'ServerDeploymentType',
+});
+
 const ENABLED_FEATURES: ServerFeature[] = [];
 export function ADD_ENABLED_FEATURES(feature: ServerFeature) {
   ENABLED_FEATURES.push(feature);
@@ -28,6 +34,9 @@ export class ServerConfigType {
   @Field({ description: 'server base url' })
   baseUrl!: string;
 
+  @Field(() => DeploymentType, { description: 'server type' })
+  type!: DeploymentType;
+
   /**
    * @deprecated
    */
@@ -37,6 +46,7 @@ export class ServerConfigType {
   @Field(() => [ServerFeature], { description: 'enabled server features' })
   features!: ServerFeature[];
 }
+
 export class ServerConfigResolver {
   @Query(() => ServerConfigType, {
     description: 'server config',
@@ -46,7 +56,11 @@ export class ServerConfigResolver {
       name: AFFiNE.serverName,
       version: AFFiNE.version,
       baseUrl: AFFiNE.baseUrl,
-      flavor: AFFiNE.flavor.type,
+      type: AFFiNE.type,
+      // BACKWARD COMPATIBILITY
+      // the old flavors contains `selfhosted` but it actually not flavor but deployment type
+      // this field should be removed after frontend feature flags implemented
+      flavor: AFFiNE.type,
       features: ENABLED_FEATURES,
     };
   }

packages/backend/server/src/core/doc/history.ts

@@ -2,13 +2,13 @@ import { isDeepStrictEqual } from 'node:util';
 
 import { Injectable, Logger } from '@nestjs/common';
 import { Cron, CronExpression } from '@nestjs/schedule';
+import { PrismaClient } from '@prisma/client';
 
 import {
   Config,
   type EventPayload,
   metrics,
   OnEvent,
-  PrismaService,
 } from '../../fundamentals';
 import { QuotaService } from '../quota';
 import { Permission } from '../workspaces/types';
@@ -19,7 +19,7 @@ export class DocHistoryManager {
   private readonly logger = new Logger(DocHistoryManager.name);
   constructor(
     private readonly config: Config,
-    private readonly db: PrismaService,
+    private readonly db: PrismaClient,
     private readonly quota: QuotaService
   ) {}
 

packages/backend/server/src/core/doc/manager.ts

@@ -5,12 +5,11 @@ import {
   OnModuleInit,
 } from '@nestjs/common';
 import { Cron, CronExpression } from '@nestjs/schedule';
-import { Snapshot, Update } from '@prisma/client';
+import { PrismaClient, Snapshot, Update } from '@prisma/client';
 import { chunk } from 'lodash-es';
 import { defer, retry } from 'rxjs';
 import {
   applyUpdate,
-  decodeStateVector,
   Doc,
   encodeStateAsUpdate,
   encodeStateVector,
@@ -19,13 +18,13 @@ import {
 
 import {
   Cache,
+  CallTimer,
   Config,
   EventEmitter,
   type EventPayload,
   mergeUpdatesInApplyWay as jwstMergeUpdates,
   metrics,
   OnEvent,
-  PrismaService,
 } from '../../fundamentals';
 
 function compare(yBinary: Buffer, jwstBinary: Buffer, strict = false): boolean {
@@ -45,36 +44,6 @@ function compare(yBinary: Buffer, jwstBinary: Buffer, strict = false): boolean {
   return compare(yBinary, yBinary2, true);
 }
 
-/**
- * Detect whether rhs state is newer than lhs state.
- *
- * How could we tell a state is newer:
- *
- *   i. if the state vector size is larger, it's newer
- *  ii. if the state vector size is same, compare each client's state
- */
-function isStateNewer(lhs: Buffer, rhs: Buffer): boolean {
-  const lhsVector = decodeStateVector(lhs);
-  const rhsVector = decodeStateVector(rhs);
-
-  if (lhsVector.size < rhsVector.size) {
-    return true;
-  }
-
-  for (const [client, state] of lhsVector) {
-    const rstate = rhsVector.get(client);
-    if (!rstate) {
-      return false;
-    }
-
-    if (state < rstate) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
 export function isEmptyBuffer(buf: Buffer): boolean {
   return (
     buf.length === 0 ||
@@ -102,7 +71,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
   private busy = false;
 
   constructor(
-    private readonly db: PrismaService,
+    private readonly db: PrismaClient,
     private readonly config: Config,
     private readonly cache: Cache,
     private readonly event: EventEmitter
@@ -119,6 +88,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
     this.destroy();
   }
 
+  @CallTimer('doc', 'yjs_recover_updates_to_doc')
   private recoverDoc(...updates: Buffer[]): Promise<Doc> {
     const doc = new Doc();
     const chunks = chunk(updates, 10);
@@ -154,11 +124,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
     const doc = await this.recoverDoc(...updates);
 
     // test jwst codec
-    if (
-      this.config.affine.canary &&
-      this.config.doc.manager.experimentalMergeWithJwstCodec &&
-      updates.length < 100 /* avoid overloading */
-    ) {
+    if (this.config.doc.manager.experimentalMergeWithYOcto) {
       metrics.jwst.counter('codec_merge_counter').add(1);
       const yjsResult = Buffer.from(encodeStateAsUpdate(doc));
       let log = false;
@@ -209,7 +175,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
     }, this.config.doc.manager.updatePollInterval);
 
     this.logger.log('Automation started');
-    if (this.config.doc.manager.experimentalMergeWithJwstCodec) {
+    if (this.config.doc.manager.experimentalMergeWithYOcto) {
       this.logger.warn(
         'Experimental feature enabled: merge updates with jwst codec is enabled'
       );
@@ -382,7 +348,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
     const updates = await this.getUpdates(workspaceId, guid);
 
     if (updates.length) {
-      const doc = await this.squash(updates, snapshot);
+      const doc = await this.squash(snapshot, updates);
       return Buffer.from(encodeStateVector(doc));
     }
 
@@ -415,7 +381,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
       // take it ease, we don't want to overload db and or cpu
       // if we limit the taken number here,
       // user will never see the latest doc if there are too many updates pending to be merged.
-      take: 100,
+      take: this.config.doc.manager.maxUpdatesPullCount,
     });
 
     // perf(memory): avoid sorting in db
@@ -463,80 +429,92 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
     });
   }
 
+  /**
+   * @returns whether the snapshot is updated to the latest, `undefined` means the doc to be upserted is outdated.
+   */
+  @CallTimer('doc', 'upsert')
   private async upsert(
     workspaceId: string,
     guid: string,
     doc: Doc,
     // we always delay the snapshot update to avoid db overload,
-    // so the value of `updatedAt` will not be accurate to user's real action time
+    // so the value of auto updated `updatedAt` by db will never be accurate to user's real action time
     updatedAt: Date,
-    initialSeq?: number
+    seq: number
   ) {
-    return this.lockSnapshotForUpsert(workspaceId, guid, async () => {
-      const blob = Buffer.from(encodeStateAsUpdate(doc));
+    const blob = Buffer.from(encodeStateAsUpdate(doc));
 
-      if (isEmptyBuffer(blob)) {
-        return false;
+    if (isEmptyBuffer(blob)) {
+      return undefined;
+    }
+
+    const state = Buffer.from(encodeStateVector(doc));
+
+    // CONCERNS:
+    //   i. Because we save the real user's last seen action time as `updatedAt`,
+    //      it's possible to simply compare the `updatedAt` to determine if the snapshot is older than the one we are going to save.
+    //
+    //  ii. Prisma doesn't support `upsert` with additional `where` condition along side unique constraint.
+    //      In our case, we need to manually check the `updatedAt` to avoid overriding the newer snapshot.
+    //      where: { id_workspaceId: {}, updatedAt: { lt: updatedAt } }
+    //                                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+    //
+    // iii. Only set the seq number when creating the snapshot.
+    //      For updating scenario, the seq number will be updated when updates pushed to db.
+    try {
+      const result: { updatedAt: Date }[] = await this.db.$queryRaw`
+        INSERT INTO "snapshots" ("workspace_id", "guid", "blob", "state", "seq", "created_at", "updated_at")
+        VALUES (${workspaceId}, ${guid}, ${blob}, ${state}, ${seq}, DEFAULT, ${updatedAt})
+        ON CONFLICT ("workspace_id", "guid")
+        DO UPDATE SET "blob" = ${blob}, "state" = ${state}, "updated_at" = ${updatedAt}, "seq" = ${seq}
+        WHERE "snapshots"."workspace_id" = ${workspaceId} AND "snapshots"."guid" = ${guid} AND "snapshots"."updated_at" <= ${updatedAt}
+        RETURNING "snapshots"."workspace_id" as "workspaceId", "snapshots"."guid" as "id", "snapshots"."updated_at" as "updatedAt"
+      `;
+
+      // const result = await this.db.snapshot.upsert({
+      //   select: {
+      //     updatedAt: true,
+      //     seq: true,
+      //   },
+      //   where: {
+      //     id_workspaceId: {
+      //       workspaceId,
+      //       id: guid,
+      //     },
+      //     ⬇️ NOT SUPPORTED BY PRISMA YET
+      //     updatedAt: {
+      //       lt: updatedAt,
+      //     },
+      //   },
+      //   update: {
+      //     blob,
+      //     state,
+      //     updatedAt,
+      //   },
+      //   create: {
+      //     workspaceId,
+      //     id: guid,
+      //     blob,
+      //     state,
+      //     updatedAt,
+      //     seq,
+      //   },
+      // });
+
+      // if the condition `snapshot.updatedAt > updatedAt` is true, by which means the snapshot has already been updated by other process,
+      // the updates has been applied to current `doc` must have been seen by the other process as well.
+      // The `updatedSnapshot` will be `undefined` in this case.
+      const updatedSnapshot = result.at(0);
+
+      if (!updatedSnapshot) {
+        return undefined;
       }
 
-      const state = Buffer.from(encodeStateVector(doc));
-
-      return await this.db.$transaction(async db => {
-        const snapshot = await db.snapshot.findUnique({
-          where: {
-            id_workspaceId: {
-              id: guid,
-              workspaceId,
-            },
-          },
-        });
-
-        // update
-        if (snapshot) {
-          // only update if state is newer
-          if (isStateNewer(snapshot.state ?? Buffer.from([0]), state)) {
-            await db.snapshot.update({
-              select: {
-                seq: true,
-              },
-              where: {
-                id_workspaceId: {
-                  workspaceId,
-                  id: guid,
-                },
-              },
-              data: {
-                blob,
-                state,
-                updatedAt,
-              },
-            });
-
-            return true;
-          } else {
-            return false;
-          }
-        } else {
-          // create
-          await db.snapshot.create({
-            select: {
-              seq: true,
-            },
-            data: {
-              id: guid,
-              workspaceId,
-              blob,
-              state,
-              seq: initialSeq,
-              createdAt: updatedAt,
-              updatedAt,
-            },
-          });
-
-          return true;
-        }
-      });
-    });
+      return true;
+    } catch (e) {
+      this.logger.error('Failed to upsert snapshot', e);
+      return false;
+    }
   }
 
   private async _get(
@@ -548,7 +526,7 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
 
     if (updates.length) {
       return {
-        doc: await this.squash(updates, snapshot),
+        doc: await this.squash(snapshot, updates),
       };
     }
 
@@ -559,17 +537,17 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
    * Squash updates into a single update and save it as snapshot,
    * and delete the updates records at the same time.
    */
-  private async squash(updates: Update[], snapshot: Snapshot | null) {
+  @CallTimer('doc', 'squash')
+  private async squash(snapshot: Snapshot | null, updates: Update[]) {
     if (!updates.length) {
       throw new Error('No updates to squash');
     }
-    const first = updates[0];
-    const last = updates[updates.length - 1];
 
-    const { id, workspaceId } = first;
+    const last = updates[updates.length - 1];
+    const { id, workspaceId } = last;
 
     const doc = await this.applyUpdates(
-      first.id,
+      id,
       snapshot ? snapshot.blob : Buffer.from([0, 0]),
       ...updates.map(u => u.blob)
     );
@@ -600,19 +578,24 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
       );
     }
 
-    // always delete updates
-    // the upsert will return false if the state is not newer, so we don't need to worry about it
-    const { count } = await this.db.update.deleteMany({
-      where: {
-        id,
-        workspaceId,
-        seq: {
-          in: updates.map(u => u.seq),
+    // we will keep the updates only if the upsert failed on unknown reason
+    // `done === undefined` means the updates is outdated(have already been merged by other process), safe to be deleted
+    // `done === true` means the upsert is successful, safe to be deleted
+    if (done !== false) {
+      // always delete updates
+      // the upsert will return false if the state is not newer, so we don't need to worry about it
+      const { count } = await this.db.update.deleteMany({
+        where: {
+          id,
+          workspaceId,
+          seq: {
+            in: updates.map(u => u.seq),
+          },
         },
-      },
-    });
+      });
 
-    await this.updateCachedUpdatesCount(workspaceId, id, -count);
+      await this.updateCachedUpdatesCount(workspaceId, id, -count);
+    }
 
     return doc;
   }
@@ -761,18 +744,6 @@ export class DocManager implements OnModuleInit, OnModuleDestroy {
     );
   }
 
-  async lockSnapshotForUpsert<T>(
-    workspaceId: string,
-    guid: string,
-    job: () => Promise<T>
-  ) {
-    return this.doWithLock(
-      'doc:manager:snapshot',
-      `${workspaceId}::${guid}`,
-      job
-    );
-  }
-
   @Cron(CronExpression.EVERY_MINUTE)
   async reportUpdatesQueueCount() {
     metrics.doc

packages/backend/server/src/core/features/management.ts

@@ -1,6 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
 
-import { Config, PrismaService } from '../../fundamentals';
+import { Config } from '../../fundamentals';
 import { FeatureService } from './service';
 import { FeatureType } from './types';
 
@@ -12,7 +13,7 @@ export class FeatureManagementService {
 
   constructor(
     private readonly feature: FeatureService,
-    private readonly prisma: PrismaService,
+    private readonly prisma: PrismaClient,
     private readonly config: Config
   ) {}
 
@@ -50,7 +51,10 @@ export class FeatureManagementService {
   async isEarlyAccessUser(email: string) {
     const user = await this.prisma.user.findFirst({
       where: {
-        email,
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
       },
     });
     if (user) {

packages/backend/server/src/core/features/service.ts

@@ -1,6 +1,6 @@
 import { Injectable } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
 
-import { PrismaService } from '../../fundamentals';
 import { UserType } from '../users/types';
 import { WorkspaceType } from '../workspaces/types';
 import { FeatureConfigType, getFeature } from './feature';
@@ -8,7 +8,7 @@ import { FeatureKind, FeatureType } from './types';
 
 @Injectable()
 export class FeatureService {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(private readonly prisma: PrismaClient) {}
 
   async getFeaturesVersion() {
     const features = await this.prisma.features.findMany({

packages/backend/server/src/core/quota/quota.ts

@@ -1,4 +1,5 @@
-import { PrismaService } from '../../fundamentals';
+import { PrismaClient } from '@prisma/client';
+
 import { formatDate, formatSize, Quota, QuotaSchema } from './types';
 
 const QuotaCache = new Map<number, QuotaConfig>();
@@ -6,7 +7,7 @@ const QuotaCache = new Map<number, QuotaConfig>();
 export class QuotaConfig {
   readonly config: Quota;
 
-  static async get(prisma: PrismaService, featureId: number) {
+  static async get(prisma: PrismaClient, featureId: number) {
     const cachedQuota = QuotaCache.get(featureId);
 
     if (cachedQuota) {

packages/backend/server/src/core/quota/service.ts

@@ -1,15 +1,16 @@
 import { Injectable } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
 
-import { type EventPayload, OnEvent, PrismaService } from '../../fundamentals';
+import { type EventPayload, OnEvent } from '../../fundamentals';
 import { FeatureKind } from '../features';
 import { QuotaConfig } from './quota';
 import { QuotaType } from './types';
 
-type Transaction = Parameters<Parameters<PrismaService['$transaction']>[0]>[0];
+type Transaction = Parameters<Parameters<PrismaClient['$transaction']>[0]>[0];
 
 @Injectable()
 export class QuotaService {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(private readonly prisma: PrismaClient) {}
 
   // get activated user quota
   async getUserQuota(userId: string) {

packages/backend/server/src/core/quota/storage.ts

@@ -1,4 +1,4 @@
-import { Injectable, NotFoundException } from '@nestjs/common';
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
 
 import { FeatureService, FeatureType } from '../features';
 import { WorkspaceBlobStorage } from '../storage';
@@ -11,6 +11,8 @@ type QuotaBusinessType = QuotaQueryType & { businessBlobLimit: number };
 
 @Injectable()
 export class QuotaManagementService {
+  protected logger = new Logger(QuotaManagementService.name);
+
   constructor(
     private readonly feature: FeatureService,
     private readonly quota: QuotaService,
@@ -38,11 +40,22 @@ export class QuotaManagementService {
   async getUserUsage(userId: string) {
     const workspaces = await this.permissions.getOwnedWorkspaces(userId);
 
-    const sizes = await Promise.all(
+    const sizes = await Promise.allSettled(
       workspaces.map(workspace => this.storage.totalSize(workspace))
     );
 
-    return sizes.reduce((total, size) => total + size, 0);
+    return sizes.reduce((total, size) => {
+      if (size.status === 'fulfilled') {
+        if (Number.isSafeInteger(size.value)) {
+          return total + size.value;
+        } else {
+          this.logger.error(`Workspace size is invalid: ${size.value}`);
+        }
+      } else {
+        this.logger.error(`Failed to get workspace size: ${size.reason}`);
+      }
+      return total;
+    }, 0);
   }
 
   // get workspace's owner quota and total size of used

packages/backend/server/src/core/storage/wrappers/avatar.ts

@@ -6,15 +6,18 @@ import type {
   PutObjectMetadata,
   StorageProvider,
 } from '../../../fundamentals';
-import { Config, createStorageProvider, OnEvent } from '../../../fundamentals';
+import { Config, OnEvent, StorageProviderFactory } from '../../../fundamentals';
 
 @Injectable()
 export class AvatarStorage {
   public readonly provider: StorageProvider;
   private readonly storageConfig: Config['storage']['storages']['avatar'];
 
-  constructor(private readonly config: Config) {
-    this.provider = createStorageProvider(this.config.storage, 'avatar');
+  constructor(
+    private readonly config: Config,
+    private readonly storageFactory: StorageProviderFactory
+  ) {
+    this.provider = this.storageFactory.create('avatar');
     this.storageConfig = this.config.storage.storages.avatar;
   }
 

packages/backend/server/src/core/storage/wrappers/blob.ts

@@ -6,10 +6,9 @@ import type {
   StorageProvider,
 } from '../../../fundamentals';
 import {
-  Config,
-  createStorageProvider,
   EventEmitter,
   OnEvent,
+  StorageProviderFactory,
 } from '../../../fundamentals';
 
 @Injectable()
@@ -18,9 +17,9 @@ export class WorkspaceBlobStorage {
 
   constructor(
     private readonly event: EventEmitter,
-    private readonly config: Config
+    private readonly storageFactory: StorageProviderFactory
   ) {
-    this.provider = createStorageProvider(this.config.storage, 'blob');
+    this.provider = this.storageFactory.create('blob');
   }
 
   async put(workspaceId: string, key: string, blob: BlobInputType) {

packages/backend/server/src/core/sync/events/error.ts

@@ -1,4 +1,4 @@
-enum EventErrorCode {
+export enum EventErrorCode {
   WORKSPACE_NOT_FOUND = 'WORKSPACE_NOT_FOUND',
   DOC_NOT_FOUND = 'DOC_NOT_FOUND',
   NOT_IN_WORKSPACE = 'NOT_IN_WORKSPACE',

packages/backend/server/src/core/sync/events/events.gateway.ts

@@ -22,6 +22,7 @@ import {
   AccessDeniedError,
   DocNotFoundError,
   EventError,
+  EventErrorCode,
   InternalError,
   NotInWorkspaceError,
 } from './error';
@@ -112,13 +113,42 @@ export class EventsGateway implements OnGatewayConnection, OnGatewayDisconnect {
     metrics.socketio.gauge('realtime_connections').record(this.connectionCount);
   }
 
+  checkVersion(client: Socket, version?: string) {
+    if (
+      // @todo(@darkskygit): remove this flag after 0.12 goes stable
+      AFFiNE.featureFlags.syncClientVersionCheck &&
+      version !== AFFiNE.version
+    ) {
+      client.emit('server-version-rejected', {
+        currentVersion: version,
+        requiredVersion: AFFiNE.version,
+        reason: `Client version${
+          version ? ` ${version}` : ''
+        } is outdated, please update to ${AFFiNE.version}`,
+      });
+      return {
+        error: new EventError(
+          EventErrorCode.VERSION_REJECTED,
+          `Client version ${version} is outdated, please update to ${AFFiNE.version}`
+        ),
+      };
+    }
+    return null;
+  }
+
   @Auth()
   @SubscribeMessage('client-handshake-sync')
   async handleClientHandshakeSync(
     @CurrentUser() user: UserType,
-    @MessageBody() workspaceId: string,
+    @MessageBody('workspaceId') workspaceId: string,
+    @MessageBody('version') version: string | undefined,
     @ConnectedSocket() client: Socket
   ): Promise<EventResponse<{ clientId: string }>> {
+    const versionError = this.checkVersion(client, version);
+    if (versionError) {
+      return versionError;
+    }
+
     const canWrite = await this.permissions.tryCheckWorkspace(
       workspaceId,
       user.id,
@@ -143,9 +173,15 @@ export class EventsGateway implements OnGatewayConnection, OnGatewayDisconnect {
   @SubscribeMessage('client-handshake-awareness')
   async handleClientHandshakeAwareness(
     @CurrentUser() user: UserType,
-    @MessageBody() workspaceId: string,
+    @MessageBody('workspaceId') workspaceId: string,
+    @MessageBody('version') version: string | undefined,
     @ConnectedSocket() client: Socket
   ): Promise<EventResponse<{ clientId: string }>> {
+    const versionError = this.checkVersion(client, version);
+    if (versionError) {
+      return versionError;
+    }
+
     const canWrite = await this.permissions.tryCheckWorkspace(
       workspaceId,
       user.id,
@@ -172,29 +208,17 @@ export class EventsGateway implements OnGatewayConnection, OnGatewayDisconnect {
   @Auth()
   @SubscribeMessage('client-handshake')
   async handleClientHandShake(
-    @CurrentUser() user: UserType,
-    @MessageBody()
-    workspaceId: string,
+    @MessageBody() workspaceId: string,
     @ConnectedSocket() client: Socket
   ): Promise<EventResponse<{ clientId: string }>> {
-    const canWrite = await this.permissions.tryCheckWorkspace(
-      workspaceId,
-      user.id,
-      Permission.Write
-    );
-
-    if (canWrite) {
-      await client.join([`${workspaceId}:sync`, `${workspaceId}:awareness`]);
-      return {
-        data: {
-          clientId: client.id,
-        },
-      };
-    } else {
-      return {
-        error: new AccessDeniedError(workspaceId),
-      };
+    const versionError = this.checkVersion(client);
+    if (versionError) {
+      return versionError;
     }
+    // should unreachable
+    return {
+      error: new AccessDeniedError(workspaceId),
+    };
   }
 
   @SubscribeMessage('client-leave-sync')
@@ -227,118 +251,6 @@ export class EventsGateway implements OnGatewayConnection, OnGatewayDisconnect {
     }
   }
 
-  /**
-   * @deprecated use `client-leave-sync` and `client-leave-awareness` instead
-   */
-  @SubscribeMessage('client-leave')
-  async handleClientLeave(
-    @MessageBody() workspaceId: string,
-    @ConnectedSocket() client: Socket
-  ): Promise<EventResponse> {
-    if (client.rooms.has(`${workspaceId}:sync`)) {
-      await client.leave(`${workspaceId}:sync`);
-    }
-    if (client.rooms.has(`${workspaceId}:awareness`)) {
-      await client.leave(`${workspaceId}:awareness`);
-    }
-    return {};
-  }
-
-  /**
-   * This is the old version of the `client-update` event without any data protocol.
-   * It only exists for backwards compatibility to adapt older clients.
-   *
-   * @deprecated
-   */
-  @SubscribeMessage('client-update')
-  async handleClientUpdateV1(
-    @MessageBody()
-    {
-      workspaceId,
-      guid,
-      update,
-    }: {
-      workspaceId: string;
-      guid: string;
-      update: string;
-    },
-    @ConnectedSocket() client: Socket
-  ) {
-    if (!client.rooms.has(`${workspaceId}:sync`)) {
-      this.logger.verbose(
-        `Client ${client.id} tried to push update to workspace ${workspaceId} without joining it first`
-      );
-      return;
-    }
-
-    const docId = new DocID(guid, workspaceId);
-
-    client
-      .to(`${docId.workspace}:sync`)
-      .emit('server-update', { workspaceId, guid, update });
-
-    // broadcast to all clients with newer version that only listen to `server-updates`
-    client
-      .to(`${docId.workspace}:sync`)
-      .emit('server-updates', { workspaceId, guid, updates: [update] });
-
-    const buf = Buffer.from(update, 'base64');
-    await this.docManager.push(docId.workspace, docId.guid, buf);
-  }
-
-  /**
-   * This is the old version of the `doc-load` event without any data protocol.
-   * It only exists for backwards compatibility to adapt older clients.
-   *
-   * @deprecated
-   */
-  @Auth()
-  @SubscribeMessage('doc-load')
-  async loadDocV1(
-    @ConnectedSocket() client: Socket,
-    @CurrentUser() user: UserType,
-    @MessageBody()
-    {
-      workspaceId,
-      guid,
-      stateVector,
-    }: {
-      workspaceId: string;
-      guid: string;
-      stateVector?: string;
-    }
-  ): Promise<{ missing: string; state?: string } | false> {
-    if (!client.rooms.has(`${workspaceId}:sync`)) {
-      const canRead = await this.permissions.tryCheckWorkspace(
-        workspaceId,
-        user.id
-      );
-      if (!canRead) {
-        return false;
-      }
-    }
-
-    const docId = new DocID(guid, workspaceId);
-    const doc = await this.docManager.get(docId.workspace, docId.guid);
-
-    if (!doc) {
-      return false;
-    }
-
-    const missing = Buffer.from(
-      encodeStateAsUpdate(
-        doc,
-        stateVector ? Buffer.from(stateVector, 'base64') : undefined
-      )
-    ).toString('base64');
-    const state = Buffer.from(encodeStateVector(doc)).toString('base64');
-
-    return {
-      missing,
-      state,
-    };
-  }
-
   @SubscribeMessage('client-update-v2')
   async handleClientUpdateV2(
     @MessageBody()

packages/backend/server/src/core/users/resolver.ts

@@ -1,4 +1,4 @@
-import { BadRequestException, HttpStatus, UseGuards } from '@nestjs/common';
+import { BadRequestException, UseGuards } from '@nestjs/common';
 import {
   Args,
   Int,
@@ -7,15 +7,14 @@ import {
   ResolveField,
   Resolver,
 } from '@nestjs/graphql';
-import type { User } from '@prisma/client';
-import { GraphQLError } from 'graphql';
+import { PrismaClient, type User } from '@prisma/client';
 import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 
 import {
   CloudThrottlerGuard,
   EventEmitter,
   type FileUpload,
-  PrismaService,
+  PaymentRequiredException,
   Throttle,
 } from '../../fundamentals';
 import { Auth, CurrentUser, Public, Publicable } from '../auth/guard';
@@ -40,7 +39,7 @@ import { UsersService } from './users';
 @Resolver(() => UserType)
 export class UserResolver {
   constructor(
-    private readonly prisma: PrismaService,
+    private readonly prisma: PrismaClient,
     private readonly storage: AvatarStorage,
     private readonly users: UsersService,
     private readonly feature: FeatureManagementService,
@@ -97,14 +96,8 @@ export class UserResolver {
     @Args('email') email?: string
   ) {
     if (!email || !(await this.feature.canEarlyAccess(email))) {
-      return new GraphQLError(
-        `You don't have early access permission\nVisit https://community.affine.pro/c/insider-general/ for more information`,
-        {
-          extensions: {
-            status: HttpStatus[HttpStatus.PAYMENT_REQUIRED],
-            code: HttpStatus.PAYMENT_REQUIRED,
-          },
-        }
+      throw new PaymentRequiredException(
+        `You don't have early access permission\nVisit https://community.affine.pro/c/insider-general/ for more information`
       );
     }
 

packages/backend/server/src/core/users/users.ts

@@ -1,19 +1,19 @@
 import { Injectable } from '@nestjs/common';
-
-import { PrismaService } from '../../fundamentals';
+import { PrismaClient } from '@prisma/client';
 
 @Injectable()
 export class UsersService {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(private readonly prisma: PrismaClient) {}
 
   async findUserByEmail(email: string) {
-    return this.prisma.user
-      .findUnique({
-        where: { email },
-      })
-      .catch(() => {
-        return null;
-      });
+    return this.prisma.user.findFirst({
+      where: {
+        email: {
+          equals: email,
+          mode: 'insensitive',
+        },
+      },
+    });
   }
 
   async findUserById(id: string) {

packages/backend/server/src/core/workspaces/controller.ts

@@ -7,9 +7,10 @@ import {
   Param,
   Res,
 } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
 import type { Response } from 'express';
 
-import { CallTimer, PrismaService } from '../../fundamentals';
+import { CallTimer } from '../../fundamentals';
 import { Auth, CurrentUser, Publicable } from '../auth';
 import { DocHistoryManager, DocManager } from '../doc';
 import { WorkspaceBlobStorage } from '../storage';
@@ -26,7 +27,7 @@ export class WorkspacesController {
     private readonly permission: PermissionService,
     private readonly docManager: DocManager,
     private readonly historyManager: DocHistoryManager,
-    private readonly prisma: PrismaService
+    private readonly prisma: PrismaClient
   ) {}
 
   // get workspace blob
@@ -56,7 +57,7 @@ export class WorkspacesController {
       this.logger.warn(`Blob ${workspaceId}/${name} has no metadata`);
     }
 
-    res.setHeader('cache-control', 'public, max-age=31536000, immutable');
+    res.setHeader('cache-control', 'public, max-age=2592000, immutable');
     body.pipe(res);
   }
 
@@ -106,6 +107,7 @@ export class WorkspacesController {
     }
 
     res.setHeader('content-type', 'application/octet-stream');
+    res.setHeader('cache-control', 'no-cache');
     res.send(update);
   }
 
@@ -142,6 +144,7 @@ export class WorkspacesController {
 
     if (history) {
       res.setHeader('content-type', 'application/octet-stream');
+      res.setHeader('cache-control', 'public, max-age=2592000, immutable');
       res.send(history.blob);
     } else {
       throw new NotFoundException('Doc history not found');

packages/backend/server/src/core/workspaces/permission.ts

@@ -1,7 +1,6 @@
 import { ForbiddenException, Injectable } from '@nestjs/common';
-import { Prisma } from '@prisma/client';
+import { type Prisma, PrismaClient } from '@prisma/client';
 
-import { PrismaService } from '../../fundamentals';
 import { Permission } from './types';
 
 export enum PublicPageMode {
@@ -11,7 +10,7 @@ export enum PublicPageMode {
 
 @Injectable()
 export class PermissionService {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(private readonly prisma: PrismaClient) {}
 
   /// Start regin: workspace permission
   async get(ws: string, user: string) {
@@ -299,6 +298,18 @@ export class PermissionService {
     return this.tryCheckWorkspace(ws, user, permission);
   }
 
+  async isPublicPage(ws: string, page: string) {
+    return this.prisma.workspacePage
+      .count({
+        where: {
+          workspaceId: ws,
+          pageId: page,
+          public: true,
+        },
+      })
+      .then(count => count > 0);
+  }
+
   async publishPage(ws: string, page: string, mode = PublicPageMode.Page) {
     return this.prisma.workspacePage.upsert({
       where: {
@@ -321,26 +332,19 @@ export class PermissionService {
   }
 
   async revokePublicPage(ws: string, page: string) {
-    const workspacePage = await this.prisma.workspacePage.findUnique({
+    return this.prisma.workspacePage.upsert({
       where: {
         workspaceId_pageId: {
           workspaceId: ws,
           pageId: page,
         },
       },
-    });
-    if (!workspacePage) {
-      throw new Error('Page is not public');
-    }
-
-    return this.prisma.workspacePage.update({
-      where: {
-        workspaceId_pageId: {
-          workspaceId: ws,
-          pageId: page,
-        },
+      update: {
+        public: false,
       },
-      data: {
+      create: {
+        workspaceId: ws,
+        pageId: page,
         public: false,
       },
     });

packages/backend/server/src/core/workspaces/resolvers/blob.ts

@@ -1,4 +1,9 @@
-import { HttpStatus, Logger, UseGuards } from '@nestjs/common';
+import {
+  ForbiddenException,
+  Logger,
+  PayloadTooLargeException,
+  UseGuards,
+} from '@nestjs/common';
 import {
   Args,
   Int,
@@ -8,7 +13,6 @@ import {
   ResolveField,
   Resolver,
 } from '@nestjs/graphql';
-import { GraphQLError } from 'graphql';
 import { SafeIntResolver } from 'graphql-scalars';
 import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 
@@ -138,12 +142,7 @@ export class WorkspaceBlobResolver {
 
     const checkExceeded = (recvSize: number) => {
       if (!storageQuota) {
-        throw new GraphQLError('cannot find user quota', {
-          extensions: {
-            status: HttpStatus[HttpStatus.FORBIDDEN],
-            code: HttpStatus.FORBIDDEN,
-          },
-        });
+        throw new ForbiddenException('Cannot find user quota.');
       }
       const total = usedSize + recvSize;
       // only skip total storage check if workspace has unlimited feature
@@ -163,12 +162,9 @@ export class WorkspaceBlobResolver {
     };
 
     if (checkExceeded(0)) {
-      throw new GraphQLError('storage or blob size limit exceeded', {
-        extensions: {
-          status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
-          code: HttpStatus.PAYLOAD_TOO_LARGE,
-        },
-      });
+      throw new PayloadTooLargeException(
+        'Storage or blob size limit exceeded.'
+      );
     }
     const buffer = await new Promise<Buffer>((resolve, reject) => {
       const stream = blob.createReadStream();
@@ -180,12 +176,7 @@ export class WorkspaceBlobResolver {
         const bufferSize = chunks.reduce((acc, cur) => acc + cur.length, 0);
         if (checkExceeded(bufferSize)) {
           reject(
-            new GraphQLError('storage or blob size limit exceeded', {
-              extensions: {
-                status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
-                code: HttpStatus.PAYLOAD_TOO_LARGE,
-              },
-            })
+            new PayloadTooLargeException('Storage or blob size limit exceeded.')
           );
         }
       });
@@ -194,14 +185,7 @@ export class WorkspaceBlobResolver {
         const buffer = Buffer.concat(chunks);
 
         if (checkExceeded(buffer.length)) {
-          reject(
-            new GraphQLError('storage limit exceeded', {
-              extensions: {
-                status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
-                code: HttpStatus.PAYLOAD_TOO_LARGE,
-              },
-            })
-          );
+          reject(new PayloadTooLargeException('Storage limit exceeded.'));
         } else {
           resolve(buffer);
         }

packages/backend/server/src/core/workspaces/resolvers/page.ts

@@ -1,4 +1,4 @@
-import { ForbiddenException, UseGuards } from '@nestjs/common';
+import { BadRequestException, UseGuards } from '@nestjs/common';
 import {
   Args,
   Field,
@@ -9,9 +9,12 @@ import {
   ResolveField,
   Resolver,
 } from '@nestjs/graphql';
-import type { WorkspacePage as PrismaWorkspacePage } from '@prisma/client';
+import {
+  PrismaClient,
+  type WorkspacePage as PrismaWorkspacePage,
+} from '@prisma/client';
 
-import { CloudThrottlerGuard, PrismaService } from '../../../fundamentals';
+import { CloudThrottlerGuard } from '../../../fundamentals';
 import { Auth, CurrentUser } from '../../auth';
 import { UserType } from '../../users';
 import { DocID } from '../../utils/doc';
@@ -43,7 +46,7 @@ class WorkspacePage implements Partial<PrismaWorkspacePage> {
 @Resolver(() => WorkspaceType)
 export class PagePermissionResolver {
   constructor(
-    private readonly prisma: PrismaService,
+    private readonly prisma: PrismaClient,
     private readonly permission: PermissionService
   ) {}
 
@@ -111,7 +114,7 @@ export class PagePermissionResolver {
     const docId = new DocID(pageId, workspaceId);
 
     if (docId.isWorkspace) {
-      throw new ForbiddenException('Expect page not to be workspace');
+      throw new BadRequestException('Expect page not to be workspace');
     }
 
     await this.permission.checkWorkspace(
@@ -148,7 +151,7 @@ export class PagePermissionResolver {
     const docId = new DocID(pageId, workspaceId);
 
     if (docId.isWorkspace) {
-      throw new ForbiddenException('Expect page not to be workspace');
+      throw new BadRequestException('Expect page not to be workspace');
     }
 
     await this.permission.checkWorkspace(
@@ -157,6 +160,15 @@ export class PagePermissionResolver {
       Permission.Read
     );
 
+    const isPublic = await this.permission.isPublicPage(
+      docId.workspace,
+      docId.guid
+    );
+
+    if (!isPublic) {
+      throw new BadRequestException('Page is not public');
+    }
+
     return this.permission.revokePublicPage(docId.workspace, docId.guid);
   }
 }

packages/backend/server/src/core/workspaces/resolvers/workspace.ts

@@ -1,8 +1,9 @@
 import {
   ForbiddenException,
-  HttpStatus,
+  InternalServerErrorException,
   Logger,
   NotFoundException,
+  PayloadTooLargeException,
   UseGuards,
 } from '@nestjs/common';
 import {
@@ -14,9 +15,8 @@ import {
   ResolveField,
   Resolver,
 } from '@nestjs/graphql';
-import type { User } from '@prisma/client';
+import { PrismaClient, type User } from '@prisma/client';
 import { getStreamAsBuffer } from 'get-stream';
-import { GraphQLError } from 'graphql';
 import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 import { applyUpdate, Doc } from 'yjs';
 
@@ -25,7 +25,6 @@ import {
   EventEmitter,
   type FileUpload,
   MailService,
-  PrismaService,
   Throttle,
 } from '../../../fundamentals';
 import { Auth, CurrentUser, Public } from '../../auth';
@@ -57,7 +56,7 @@ export class WorkspaceResolver {
   constructor(
     private readonly auth: AuthService,
     private readonly mailer: MailService,
-    private readonly prisma: PrismaService,
+    private readonly prisma: PrismaClient,
     private readonly permissions: PermissionService,
     private readonly quota: QuotaManagementService,
     private readonly users: UsersService,
@@ -277,6 +276,7 @@ export class WorkspaceResolver {
             id: workspace.id,
             workspaceId: workspace.id,
             blob: buffer,
+            updatedAt: new Date(),
           },
         });
       }
@@ -344,12 +344,7 @@ export class WorkspaceResolver {
       this.quota.getWorkspaceUsage(workspaceId),
     ]);
     if (memberCount >= quota.memberLimit) {
-      throw new GraphQLError('Workspace member limit reached', {
-        extensions: {
-          status: HttpStatus[HttpStatus.PAYLOAD_TOO_LARGE],
-          code: HttpStatus.PAYLOAD_TOO_LARGE,
-        },
-      });
+      throw new PayloadTooLargeException('Workspace member limit reached.');
     }
 
     let target = await this.users.findUserByEmail(email);
@@ -401,14 +396,8 @@ export class WorkspaceResolver {
             `failed to send ${workspaceId} invite email to ${email}, but successfully revoked permission: ${e}`
           );
         }
-        return new GraphQLError(
-          'failed to send invite email, please try again',
-          {
-            extensions: {
-              status: HttpStatus[HttpStatus.INTERNAL_SERVER_ERROR],
-              code: HttpStatus.INTERNAL_SERVER_ERROR,
-            },
-          }
+        return new InternalServerErrorException(
+          'Failed to send invite email. Please try again.'
         );
       }
     }

packages/backend/server/src/data/migrations/1605053000403-self-host-admin.ts

@@ -8,7 +8,7 @@ export class SelfHostAdmin1605053000403 {
   // do the migration
   static async up(db: PrismaClient, ref: ModuleRef) {
     const config = ref.get(Config, { strict: false });
-    if (config.flavor.selfhosted) {
+    if (config.isSelfhosted) {
       if (
         !process.env.AFFINE_ADMIN_EMAIL ||
         !process.env.AFFINE_ADMIN_PASSWORD

packages/backend/server/src/data/migrations/1708321519830-refresh-unlimited-workspace-feature.ts

@@ -0,0 +1,15 @@
+import { PrismaClient } from '@prisma/client';
+
+import { FeatureType } from '../../core/features';
+import { upsertLatestFeatureVersion } from './utils/user-features';
+
+export class RefreshUnlimitedWorkspaceFeature1708321519830 {
+  // do the migration
+  static async up(db: PrismaClient) {
+    // add unlimited workspace feature
+    await upsertLatestFeatureVersion(db, FeatureType.UnlimitedWorkspace);
+  }
+
+  // revert the migration
+  static async down(_db: PrismaClient) {}
+}

packages/backend/server/src/data/migrations/utils/user-features.ts

@@ -3,6 +3,7 @@ import { Prisma, PrismaClient } from '@prisma/client';
 import {
   CommonFeature,
   FeatureKind,
+  Features,
   FeatureType,
 } from '../../../core/features';
 
@@ -33,6 +34,16 @@ export async function upsertFeature(
   }
 }
 
+export async function upsertLatestFeatureVersion(
+  db: PrismaClient,
+  type: FeatureType
+) {
+  const feature = Features.filter(f => f.feature === type);
+  feature.sort((a, b) => b.version - a.version);
+  const latestFeature = feature[0];
+  await upsertFeature(db, latestFeature);
+}
+
 export async function migrateNewFeatureTable(prisma: PrismaClient) {
   const waitingList = await prisma.newFeaturesWaitingList.findMany();
   for (const oldUser of waitingList) {

packages/backend/server/src/fundamentals/config/def.ts

@@ -1,4 +1,5 @@
 import type { ApolloDriverConfig } from '@nestjs/apollo';
+import SMTPTransport from 'nodemailer/lib/smtp-transport';
 
 import type { LeafPaths } from '../utils/types';
 import { EnvConfigType } from './env';
@@ -18,18 +19,22 @@ export enum ExternalAccount {
   firebase = 'firebase',
 }
 
-export type ServerFlavor =
-  | 'allinone'
-  | 'main'
-  // @deprecated
-  | 'graphql'
-  | 'sync'
-  | 'selfhosted';
+export type ServerFlavor = 'allinone' | 'graphql' | 'sync';
+export type AFFINE_ENV = 'dev' | 'beta' | 'production';
+export type NODE_ENV = 'development' | 'test' | 'production';
+
+export enum DeploymentType {
+  Affine = 'affine',
+  Selfhosted = 'selfhosted',
+}
+
 export type ConfigPaths = LeafPaths<
   Omit<
     AFFiNEConfig,
     | 'ENV_MAP'
     | 'version'
+    | 'type'
+    | 'isSelfhosted'
     | 'flavor'
     | 'env'
     | 'affine'
@@ -63,27 +68,36 @@ export interface AFFiNEConfig {
    */
   readonly version: string;
 
+  /**
+   * Deployment type, AFFiNE Cloud, or Selfhosted
+   */
+  get type(): DeploymentType;
+
+  /**
+   * Fast detect whether currently deployed in a selfhosted environment
+   */
+  get isSelfhosted(): boolean;
+
   /**
    * Server flavor
    */
   get flavor(): {
     type: string;
-    main: boolean;
+    graphql: boolean;
     sync: boolean;
-    selfhosted: boolean;
   };
 
   /**
    * Deployment environment
    */
-  readonly affineEnv: 'dev' | 'beta' | 'production';
+  readonly AFFINE_ENV: AFFINE_ENV;
   /**
    * alias to `process.env.NODE_ENV`
    *
-   * @default 'production'
+   * @default 'development'
    * @env NODE_ENV
    */
-  readonly env: string;
+  readonly NODE_ENV: NODE_ENV;
 
   /**
    * fast AFFiNE environment judge
@@ -101,6 +115,7 @@ export interface AFFiNEConfig {
     dev: boolean;
     test: boolean;
   };
+
   get deploy(): boolean;
 
   /**
@@ -159,6 +174,7 @@ export interface AFFiNEConfig {
    */
   featureFlags: {
     earlyAccessPreview: boolean;
+    syncClientVersionCheck: boolean;
   };
 
   /**
@@ -249,18 +265,6 @@ export interface AFFiNEConfig {
         }
       >
     >;
-    /**
-     * whether to use local email service to send email
-     * local debug only
-     */
-    localEmail: boolean;
-    email: {
-      server: string;
-      port: number;
-      login: string;
-      sender: string;
-      password: string;
-    };
     captcha: {
       /**
        * whether to enable captcha
@@ -284,6 +288,13 @@ export interface AFFiNEConfig {
     };
   };
 
+  /**
+   * Configurations for mail service used to post auth or bussiness mails.
+   *
+   * @see https://nodemailer.com/smtp/
+   */
+  mailer?: SMTPTransport.Options;
+
   doc: {
     manager: {
       /**
@@ -302,11 +313,17 @@ export interface AFFiNEConfig {
       updatePollInterval: number;
 
       /**
-       * Use JwstCodec to merge updates at the same time when merging using Yjs.
+       * The maximum number of updates that will be pulled from the server at once.
+       * Existing for avoiding the server to be overloaded when there are too many updates for one doc.
+       */
+      maxUpdatesPullCount: number;
+
+      /**
+       * Use `y-octo` to merge updates at the same time when merging using Yjs.
        *
        * This is an experimental feature, and aimed to check the correctness of JwstCodec.
        */
-      experimentalMergeWithJwstCodec: boolean;
+      experimentalMergeWithYOcto: boolean;
     };
     history: {
       /**

packages/backend/server/src/fundamentals/config/default.ts

@@ -6,7 +6,14 @@ import { merge } from 'lodash-es';
 import parse from 'parse-duration';
 
 import pkg from '../../../package.json' assert { type: 'json' };
-import type { AFFiNEConfig, ServerFlavor } from './def';
+import {
+  type AFFINE_ENV,
+  AFFiNEConfig,
+  DeploymentType,
+  type NODE_ENV,
+  type ServerFlavor,
+} from './def';
+import { readEnv } from './env';
 import { getDefaultAFFiNEStorageConfig } from './storage';
 
 // Don't use this in production
@@ -46,40 +53,62 @@ const jwtKeyPair = (function () {
 })();
 
 export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
-  let isHttps: boolean | null = null;
-  let flavor = (process.env.SERVER_FLAVOR ?? 'allinone') as ServerFlavor;
+  const NODE_ENV = readEnv<NODE_ENV>('NODE_ENV', 'development', [
+    'development',
+    'test',
+    'production',
+  ]);
+  const AFFINE_ENV = readEnv<AFFINE_ENV>('AFFINE_ENV', 'dev', [
+    'dev',
+    'beta',
+    'production',
+  ]);
+  const flavor = readEnv<ServerFlavor>('SERVER_FLAVOR', 'allinone', [
+    'allinone',
+    'graphql',
+    'sync',
+  ]);
+  const deploymentType = readEnv<DeploymentType>(
+    'DEPLOYMENT_TYPE',
+    NODE_ENV === 'development'
+      ? DeploymentType.Affine
+      : DeploymentType.Selfhosted,
+    Object.values(DeploymentType)
+  );
+  const isSelfhosted = deploymentType === DeploymentType.Selfhosted;
+
   const defaultConfig = {
     serverId: 'affine-nestjs-server',
-    serverName: flavor === 'selfhosted' ? 'Self-Host Cloud' : 'AFFiNE Cloud',
+    serverName: isSelfhosted ? 'Self-Host Cloud' : 'AFFiNE Cloud',
     version: pkg.version,
+    get type() {
+      return deploymentType;
+    },
+    get isSelfhosted() {
+      return isSelfhosted;
+    },
     get flavor() {
-      if (flavor === 'graphql') {
-        flavor = 'main';
-      }
       return {
         type: flavor,
-        main: flavor === 'main' || flavor === 'allinone',
+        graphql: flavor === 'graphql' || flavor === 'allinone',
         sync: flavor === 'sync' || flavor === 'allinone',
-        selfhosted: flavor === 'selfhosted',
       };
     },
     ENV_MAP: {},
-    affineEnv: 'dev',
+    AFFINE_ENV,
     get affine() {
-      const env = this.affineEnv;
       return {
-        canary: env === 'dev',
-        beta: env === 'beta',
-        stable: env === 'production',
+        canary: AFFINE_ENV === 'dev',
+        beta: AFFINE_ENV === 'beta',
+        stable: AFFINE_ENV === 'production',
       };
     },
-    env: process.env.NODE_ENV ?? 'development',
+    NODE_ENV,
     get node() {
-      const env = this.env;
       return {
-        prod: env === 'production',
-        dev: env === 'development',
-        test: env === 'test',
+        prod: NODE_ENV === 'production',
+        dev: NODE_ENV === 'development',
+        test: NODE_ENV === 'test',
       };
     },
     get deploy() {
@@ -87,13 +116,9 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
     },
     featureFlags: {
       earlyAccessPreview: false,
+      syncClientVersionCheck: false,
     },
-    get https() {
-      return isHttps ?? !this.node.dev;
-    },
-    set https(value: boolean) {
-      isHttps = value;
-    },
+    https: false,
     host: 'localhost',
     port: 3010,
     path: '',
@@ -142,14 +167,6 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
         return this.privateKey;
       },
       oauthProviders: {},
-      localEmail: false,
-      email: {
-        server: 'smtp.gmail.com',
-        port: 465,
-        login: '',
-        sender: '',
-        password: '',
-      },
     },
     storage: getDefaultAFFiNEStorageConfig(),
     rateLimiter: {
@@ -160,7 +177,8 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
       manager: {
         enableUpdateAutoMerging: flavor !== 'sync',
         updatePollInterval: 3000,
-        experimentalMergeWithJwstCodec: false,
+        maxUpdatesPullCount: 500,
+        experimentalMergeWithYOcto: false,
       },
       history: {
         interval: 1000 * 60 * 10 /* 10 mins */,

packages/backend/server/src/fundamentals/config/env.ts

@@ -48,3 +48,24 @@ export function applyEnvToConfig(rawConfig: AFFiNEConfig) {
     }
   }
 }
+
+export function readEnv<T>(
+  env: string,
+  defaultValue: T,
+  availableValues?: T[]
+) {
+  const value = process.env[env];
+  if (value === undefined) {
+    return defaultValue;
+  }
+
+  if (availableValues && !availableValues.includes(value as any)) {
+    throw new Error(
+      `Invalid value '${value}' for environment variable ${env}, expected one of [${availableValues.join(
+        ', '
+      )}]`
+    );
+  }
+
+  return value as T;
+}

packages/backend/server/src/fundamentals/config/storage/index.ts

@@ -1,37 +1,34 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 
-import { S3ClientConfigType } from '@aws-sdk/client-s3';
-
-export type StorageProviderType = 'fs' | 'r2' | 's3';
 export interface FsStorageConfig {
   path: string;
 }
-export type R2StorageConfig = S3ClientConfigType & {
-  accountId: string;
-};
-export type S3StorageConfig = S3ClientConfigType;
 
-export type StorageTargetConfig<Ext = unknown> = {
+export interface StorageProvidersConfig {
+  fs: FsStorageConfig;
+}
+
+export type StorageProviderType = keyof StorageProvidersConfig;
+
+export type StorageConfig<Ext = unknown> = {
   provider: StorageProviderType;
   bucket: string;
 } & Ext;
 
+export interface StoragesConfig {
+  avatar: StorageConfig<{ publicLinkFactory: (key: string) => string }>;
+  blob: StorageConfig;
+}
+
 export interface AFFiNEStorageConfig {
   /**
    * All providers for object storage
    *
    * Support different providers for different usage at the same time.
    */
-  providers: {
-    fs?: FsStorageConfig;
-    s3?: S3StorageConfig;
-    r2?: R2StorageConfig;
-  };
-  storages: {
-    avatar: StorageTargetConfig<{ publicLinkFactory: (key: string) => string }>;
-    blob: StorageTargetConfig;
-  };
+  providers: StorageProvidersConfig;
+  storages: StoragesConfig;
 }
 
 export type StorageProviders = AFFiNEStorageConfig['providers'];

packages/backend/server/src/fundamentals/error/index.ts

@@ -0,0 +1 @@
+export * from './payment-required';

packages/backend/server/src/fundamentals/error/payment-required.ts

@@ -0,0 +1,10 @@
+import { HttpException, HttpStatus } from '@nestjs/common';
+
+export class PaymentRequiredException extends HttpException {
+  constructor(desc?: string, code: string = 'Payment Required') {
+    super(
+      HttpException.createBody(desc ?? code, code, HttpStatus.PAYMENT_REQUIRED),
+      HttpStatus.PAYMENT_REQUIRED
+    );
+  }
+}

packages/backend/server/src/fundamentals/event/types.ts

@@ -17,17 +17,19 @@ export type PathType<T, Path extends string> = string extends Path
         : unknown
       : unknown;
 
-export type Leaves<T, P extends string = ''> = T extends Payload<any>
-  ? P
-  : T extends Record<string, any>
-    ? {
-        [K in keyof T]: K extends string ? Leaves<T[K], Join<P, K>> : never;
-      }[keyof T]
-    : never;
+export type Leaves<T, P extends string = ''> =
+  T extends Payload<any>
+    ? P
+    : T extends Record<string, any>
+      ? {
+          [K in keyof T]: K extends string ? Leaves<T[K], Join<P, K>> : never;
+        }[keyof T]
+      : never;
 
-export type Flatten<T> = Leaves<T> extends infer R
-  ? {
-      // @ts-expect-error yo, ts can't make it
-      [K in R]: PathType<T, K> extends Payload<infer U> ? U : never;
-    }
-  : never;
+export type Flatten<T> =
+  Leaves<T> extends infer R
+    ? {
+        // @ts-expect-error yo, ts can't make it
+        [K in R]: PathType<T, K> extends Payload<infer U> ? U : never;
+      }
+    : never;

packages/backend/server/src/fundamentals/graphql/index.ts

@@ -3,9 +3,10 @@ import { fileURLToPath } from 'node:url';
 
 import type { ApolloDriverConfig } from '@nestjs/apollo';
 import { ApolloDriver } from '@nestjs/apollo';
-import { Global, Module } from '@nestjs/common';
+import { Global, HttpException, HttpStatus, Module } from '@nestjs/common';
 import { GraphQLModule } from '@nestjs/graphql';
 import { Request, Response } from 'express';
+import { GraphQLError } from 'graphql';
 
 import { Config } from '../config';
 import { GQLLoggerPlugin } from './logger-plugin';
@@ -34,7 +35,37 @@ import { GQLLoggerPlugin } from './logger-plugin';
             res,
             isAdminQuery: false,
           }),
+          includeStacktraceInErrorResponses: !config.node.prod,
           plugins: [new GQLLoggerPlugin()],
+          formatError: (formattedError, error) => {
+            // @ts-expect-error allow assign
+            formattedError.extensions ??= {};
+
+            if (
+              error instanceof GraphQLError &&
+              error.originalError instanceof HttpException
+            ) {
+              const statusCode = error.originalError.getStatus();
+              const statusName = HttpStatus[statusCode];
+
+              // originally be 'INTERNAL_SERVER_ERROR'
+              formattedError.extensions['code'] = statusCode;
+              formattedError.extensions['status'] = statusName;
+              delete formattedError.extensions['originalError'];
+
+              return formattedError;
+            } else {
+              // @ts-expect-error allow assign
+              formattedError.message = 'Internal Server Error';
+
+              formattedError.extensions['code'] =
+                HttpStatus.INTERNAL_SERVER_ERROR;
+              formattedError.extensions['status'] =
+                HttpStatus[HttpStatus.INTERNAL_SERVER_ERROR];
+            }
+
+            return formattedError;
+          },
         };
       },
       inject: [Config],

packages/backend/server/src/fundamentals/graphql/logger-plugin.ts

@@ -4,7 +4,7 @@ import {
   GraphQLRequestListener,
 } from '@apollo/server';
 import { Plugin } from '@nestjs/apollo';
-import { Logger } from '@nestjs/common';
+import { HttpException, Logger } from '@nestjs/common';
 import { Response } from 'express';
 
 import { metrics } from '../metrics/metrics';
@@ -27,28 +27,44 @@ export class GQLLoggerPlugin implements ApolloServerPlugin {
 
     metrics.gql.counter('query_counter').add(1, { operation });
     const start = Date.now();
+    function endTimer() {
+      return Date.now() - start;
+    }
 
     return Promise.resolve({
       willSendResponse: () => {
-        const costInMilliseconds = Date.now() - start;
-        res.setHeader(
-          'Server-Timing',
-          `gql;dur=${costInMilliseconds};desc="GraphQL"`
-        );
-        metrics.gql
-          .histogram('query_duration')
-          .record(costInMilliseconds, { operation });
+        const time = endTimer();
+        res.setHeader('Server-Timing', `gql;dur=${time};desc="GraphQL"`);
+        metrics.gql.histogram('query_duration').record(time, { operation });
         return Promise.resolve();
       },
-      didEncounterErrors: () => {
-        const costInMilliseconds = Date.now() - start;
-        res.setHeader(
-          'Server-Timing',
-          `gql;dur=${costInMilliseconds};desc="GraphQL ${operation}"`
-        );
-        metrics.gql
-          .histogram('query_duration')
-          .record(costInMilliseconds, { operation });
+      didEncounterErrors: ctx => {
+        metrics.gql.counter('query_error_counter').add(1, { operation });
+
+        ctx.errors.forEach(err => {
+          // only log non-user errors
+          let msg: string | undefined;
+
+          if (!err.originalError) {
+            msg = err.toString();
+          } else {
+            const originalError = err.originalError;
+
+            // do not log client errors, and put more information in the error extensions.
+            if (!(originalError instanceof HttpException)) {
+              if (originalError.cause && originalError.cause instanceof Error) {
+                msg = originalError.cause.stack ?? originalError.cause.message;
+              } else {
+                msg = originalError.stack ?? originalError.message;
+              }
+            }
+          }
+
+          if (msg) {
+            this.logger.error('GraphQL Unhandled Error', msg);
+          }
+        });
+
         return Promise.resolve();
       },
     });

packages/backend/server/src/fundamentals/index.ts

@@ -9,15 +9,21 @@ export {
   applyEnvToConfig,
   Config,
   type ConfigPaths,
+  DeploymentType,
   getDefaultAFFiNEStorageConfig,
 } from './config';
+export * from './error';
 export { EventEmitter, type EventPayload, OnEvent } from './event';
 export { MailService } from './mailer';
 export { CallCounter, CallTimer, metrics } from './metrics';
-export { getOptionalModuleMetadata, OptionalModule } from './nestjs';
-export { PrismaService } from './prisma';
+export {
+  getOptionalModuleMetadata,
+  GlobalExceptionFilter,
+  OptionalModule,
+} from './nestjs';
 export { SessionService } from './session';
 export * from './storage';
+export { type StorageProvider, StorageProviderFactory } from './storage';
 export { AuthThrottlerGuard, CloudThrottlerGuard, Throttle } from './throttler';
 export {
   getRequestFromHost,
@@ -25,4 +31,3 @@ export {
   getRequestResponseFromHost,
 } from './utils/request';
 export type * from './utils/types';
-export { SocketIoAdapter } from './websocket';

packages/backend/server/src/fundamentals/mailer/index.ts

@@ -1,11 +1,21 @@
 import { Global, Module } from '@nestjs/common';
 
+import { OptionalModule } from '../nestjs';
 import { MailService } from './mail.service';
 import { MAILER } from './mailer';
 
+@Global()
+@OptionalModule({
+  providers: [MAILER],
+  exports: [MAILER],
+  requires: ['mailer.auth.user', 'mailer.auth.pass'],
+})
+class MailerModule {}
+
 @Global()
 @Module({
-  providers: [MAILER, MailService],
+  imports: [MailerModule],
+  providers: [MailService],
   exports: [MailService],
 })
 export class MailModule {}

packages/backend/server/src/fundamentals/mailer/mail.service.ts

@@ -1,30 +1,28 @@
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, Optional } from '@nestjs/common';
 
 import { Config } from '../config';
-import {
-  MAILER_SERVICE,
-  type MailerService,
-  type Options,
-  type Response,
-} from './mailer';
+import { MAILER_SERVICE, type MailerService, type Options } from './mailer';
 import { emailTemplate } from './template';
 @Injectable()
 export class MailService {
   constructor(
-    @Inject(MAILER_SERVICE) private readonly mailer: MailerService,
-    private readonly config: Config
+    private readonly config: Config,
+    @Optional() @Inject(MAILER_SERVICE) private readonly mailer?: MailerService
   ) {}
 
-  async sendMail(options: Options): Promise<Response> {
-    return this.mailer.sendMail(options);
+  async sendMail(options: Options) {
+    if (!this.mailer) {
+      throw new Error('Mailer service is not configured.');
+    }
+
+    return this.mailer.sendMail({
+      from: this.config.mailer?.from,
+      ...options,
+    });
   }
 
   hasConfigured() {
-    return (
-      !!this.config.auth.email.login &&
-      !!this.config.auth.email.password &&
-      !!this.config.auth.email.sender
-    );
+    return !!this.mailer;
   }
 
   async sendInviteEmail(
@@ -80,7 +78,6 @@ export class MailService {
     });
 
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: `${invitationInfo.user.name} invited you to join ${invitationInfo.workspace.name}`,
       html,
@@ -119,7 +116,6 @@ export class MailService {
       buttonUrl: url,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: `Modify your AFFiNE password`,
       html,
@@ -135,7 +131,6 @@ export class MailService {
       buttonUrl: url,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: `Set your AFFiNE password`,
       html,
@@ -150,7 +145,6 @@ export class MailService {
       buttonUrl: url,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: `Verify your current email for AFFiNE`,
       html,
@@ -165,7 +159,6 @@ export class MailService {
       buttonUrl: url,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: `Verify your new email for AFFiNE`,
       html,
@@ -177,7 +170,6 @@ export class MailService {
       content: `As per your request, we have changed your email. Please make sure you're using ${to} when you log in the next time. `,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: `Your email has been changed`,
       html,
@@ -200,7 +192,6 @@ export class MailService {
       content: `${inviteeName} has joined ${workspaceName}`,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: title,
       html,
@@ -223,7 +214,6 @@ export class MailService {
       content: `${inviteeName} has left your workspace`,
     });
     return this.sendMail({
-      from: this.config.auth.email.sender,
       to,
       subject: title,
       html,

packages/backend/server/src/fundamentals/mailer/mailer.ts

@@ -11,28 +11,11 @@ export type Response = SMTPTransport.SentMessageInfo;
 export type Options = SMTPTransport.Options;
 
 export const MAILER: FactoryProvider<
-  Transporter<SMTPTransport.SentMessageInfo>
+  Transporter<SMTPTransport.SentMessageInfo> | undefined
 > = {
   provide: MAILER_SERVICE,
   useFactory: (config: Config) => {
-    if (config.auth.localEmail) {
-      return createTransport({
-        host: '0.0.0.0',
-        port: 1025,
-        secure: false,
-        auth: {
-          user: config.auth.email.login,
-          pass: config.auth.email.password,
-        },
-      });
-    }
-    return createTransport({
-      service: 'gmail',
-      auth: {
-        user: config.auth.email.login,
-        pass: config.auth.email.password,
-      },
-    });
+    return config.mailer ? createTransport(config.mailer) : undefined;
   },
   inject: [Config],
 };

packages/backend/server/src/fundamentals/metrics/index.ts

@@ -1,28 +1,48 @@
-import { Global, Module, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import {
+  Global,
+  Module,
+  OnModuleDestroy,
+  OnModuleInit,
+  Provider,
+} from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 
-import { Config, parseEnvValue } from '../config';
-import { createSDK, registerCustomMetrics } from './opentelemetry';
+import { Config } from '../config';
+import {
+  LocalOpentelemetryFactory,
+  OpentelemetryFactory,
+  registerCustomMetrics,
+} from './opentelemetry';
+
+const factorProvider: Provider = {
+  provide: OpentelemetryFactory,
+  useFactory: (config: Config) => {
+    return config.metrics.enabled ? new LocalOpentelemetryFactory() : null;
+  },
+  inject: [Config],
+};
 
 @Global()
-@Module({})
+@Module({
+  providers: [factorProvider],
+  exports: [factorProvider],
+})
 export class MetricsModule implements OnModuleInit, OnModuleDestroy {
   private sdk: NodeSDK | null = null;
-  constructor(private readonly config: Config) {}
+  constructor(private readonly ref: ModuleRef) {}
 
   onModuleInit() {
-    if (
-      this.config.metrics.enabled &&
-      !parseEnvValue(process.env.DISABLE_TELEMETRY, 'boolean')
-    ) {
-      this.sdk = createSDK();
+    const factor = this.ref.get(OpentelemetryFactory, { strict: false });
+    if (factor) {
+      this.sdk = factor.create();
       this.sdk.start();
       registerCustomMetrics();
     }
   }
 
   async onModuleDestroy() {
-    if (this.config.metrics.enabled && this.sdk) {
+    if (this.sdk) {
       await this.sdk.shutdown();
     }
   }
@@ -30,3 +50,4 @@ export class MetricsModule implements OnModuleInit, OnModuleDestroy {
 
 export * from './metrics';
 export * from './utils';
+export { OpentelemetryFactory };

packages/backend/server/src/fundamentals/metrics/opentelemetry.ts

@@ -1,6 +1,4 @@
-import { MetricExporter } from '@google-cloud/opentelemetry-cloud-monitoring-exporter';
-import { TraceExporter } from '@google-cloud/opentelemetry-cloud-trace-exporter';
-import { GcpDetectorSync } from '@google-cloud/opentelemetry-resource-util';
+import { OnModuleDestroy } from '@nestjs/common';
 import { metrics } from '@opentelemetry/api';
 import {
   CompositePropagator,
@@ -18,16 +16,13 @@ import { NestInstrumentation } from '@opentelemetry/instrumentation-nestjs-core'
 import { SocketIoInstrumentation } from '@opentelemetry/instrumentation-socket.io';
 import { Resource } from '@opentelemetry/resources';
 import {
-  ConsoleMetricExporter,
   type MeterProvider,
   MetricProducer,
   MetricReader,
-  PeriodicExportingMetricReader,
 } from '@opentelemetry/sdk-metrics';
 import { NodeSDK } from '@opentelemetry/sdk-node';
 import {
   BatchSpanProcessor,
-  ConsoleSpanExporter,
   SpanExporter,
   TraceIdRatioBasedSampler,
 } from '@opentelemetry/sdk-trace-node';
@@ -38,7 +33,7 @@ import { PrismaMetricProducer } from './prisma';
 
 const { PrismaInstrumentation } = prismaInstrument;
 
-abstract class OpentelemetryFactor {
+export abstract class OpentelemetryFactory {
   abstract getMetricReader(): MetricReader;
   abstract getSpanExporter(): SpanExporter;
 
@@ -59,7 +54,7 @@ abstract class OpentelemetryFactor {
 
   getResource() {
     return new Resource({
-      [SemanticResourceAttributes.K8S_NAMESPACE_NAME]: AFFiNE.affineEnv,
+      [SemanticResourceAttributes.K8S_NAMESPACE_NAME]: AFFiNE.AFFINE_ENV,
       [SemanticResourceAttributes.SERVICE_NAME]: AFFiNE.flavor.type,
       [SemanticResourceAttributes.SERVICE_VERSION]: AFFiNE.version,
     });
@@ -85,32 +80,20 @@ abstract class OpentelemetryFactor {
   }
 }
 
-class GCloudOpentelemetryFactor extends OpentelemetryFactor {
-  override getResource(): Resource {
-    return super.getResource().merge(new GcpDetectorSync().detect());
+export class LocalOpentelemetryFactory
+  extends OpentelemetryFactory
+  implements OnModuleDestroy
+{
+  private readonly metricsExporter = new PrometheusExporter({
+    metricProducers: this.getMetricsProducers(),
+  });
+
+  async onModuleDestroy() {
+    await this.metricsExporter.shutdown();
   }
 
   override getMetricReader(): MetricReader {
-    return new PeriodicExportingMetricReader({
-      exportIntervalMillis: 30000,
-      exportTimeoutMillis: 10000,
-      exporter: new MetricExporter({
-        prefix: 'custom.googleapis.com',
-      }),
-      metricProducers: this.getMetricsProducers(),
-    });
-  }
-
-  override getSpanExporter(): SpanExporter {
-    return new TraceExporter();
-  }
-}
-
-class LocalOpentelemetryFactor extends OpentelemetryFactor {
-  override getMetricReader(): MetricReader {
-    return new PrometheusExporter({
-      metricProducers: this.getMetricsProducers(),
-    });
+    return this.metricsExporter;
   }
 
   override getSpanExporter(): SpanExporter {
@@ -118,33 +101,6 @@ class LocalOpentelemetryFactor extends OpentelemetryFactor {
   }
 }
 
-class DebugOpentelemetryFactor extends OpentelemetryFactor {
-  override getMetricReader(): MetricReader {
-    return new PeriodicExportingMetricReader({
-      exporter: new ConsoleMetricExporter(),
-      metricProducers: this.getMetricsProducers(),
-    });
-  }
-
-  override getSpanExporter(): SpanExporter {
-    return new ConsoleSpanExporter();
-  }
-}
-
-// TODO(@forehalo): make it configurable
-export function createSDK() {
-  let factor: OpentelemetryFactor | null = null;
-  if (process.env.NODE_ENV === 'production') {
-    factor = new GCloudOpentelemetryFactor();
-  } else if (process.env.DEBUG_METRICS) {
-    factor = new DebugOpentelemetryFactor();
-  } else {
-    factor = new LocalOpentelemetryFactor();
-  }
-
-  return factor?.create();
-}
-
 function getMeterProvider() {
   return metrics.getMeterProvider();
 }

packages/backend/server/src/fundamentals/nestjs/exception.ts

@@ -0,0 +1,25 @@
+import { ArgumentsHost, Catch, HttpException } from '@nestjs/common';
+import { BaseExceptionFilter } from '@nestjs/core';
+import { GqlContextType } from '@nestjs/graphql';
+import { Response } from 'express';
+
+@Catch()
+export class GlobalExceptionFilter extends BaseExceptionFilter {
+  override catch(exception: Error, host: ArgumentsHost) {
+    // with useGlobalFilters, the context is always HTTP
+
+    if (host.getType<GqlContextType>() === 'graphql') {
+      // let Graphql LoggerPlugin handle it
+      // see '../graphql/logger-plugin.ts'
+      throw exception;
+    } else {
+      if (exception instanceof HttpException) {
+        const res = host.switchToHttp().getResponse<Response>();
+        res.status(exception.getStatus()).send(exception.getResponse());
+        return;
+      } else {
+        super.catch(exception, host);
+      }
+    }
+  }
+}

packages/backend/server/src/fundamentals/nestjs/index.ts

@@ -1 +1,2 @@
+export * from './exception';
 export * from './optional-module';

packages/backend/server/src/fundamentals/nestjs/optional-module.ts

@@ -52,6 +52,7 @@ export function OptionalModule(metadata: OptionalModuleMetadata) {
       metadata.providers = (metadata.providers ?? []).concat(
         metadata.overrides
       );
+      // eslint-disable-next-line @typescript-eslint/no-floating-promises
       metadata.exports = (metadata.exports ?? []).concat(metadata.overrides);
     }
 

packages/backend/server/src/fundamentals/prisma/index.ts

@@ -3,16 +3,16 @@ import { PrismaClient } from '@prisma/client';
 
 import { PrismaService } from './service';
 
-// both `PrismaService` and `PrismaClient` can be injected
+// only `PrismaClient` can be injected
 const clientProvider: Provider = {
   provide: PrismaClient,
-  useExisting: PrismaService,
+  useClass: PrismaService,
 };
 
 @Global()
 @Module({
-  providers: [PrismaService, clientProvider],
-  exports: [PrismaService, clientProvider],
+  providers: [clientProvider],
+  exports: [clientProvider],
 })
 export class PrismaModule {}
 export { PrismaService } from './service';

packages/backend/server/src/fundamentals/session/index.ts

@@ -5,7 +5,7 @@ import { SessionCache } from '../cache';
 @Injectable()
 export class SessionService {
   private readonly prefix = 'session:';
-  private readonly sessionTtl = 30 * 60 * 1000; // 30 min
+  public readonly sessionTtl = 30 * 60 * 1000; // 30 min
 
   constructor(private readonly cache: SessionCache) {}
 

packages/backend/server/src/fundamentals/storage/index.ts

@@ -1,38 +1,24 @@
-import { createRequire } from 'node:module';
+import { Global, Module } from '@nestjs/common';
 
-export const StorageProvide = Symbol('Storage');
+import { registerStorageProvider, StorageProviderFactory } from './providers';
+import { FsStorageProvider } from './providers/fs';
 
-let storageModule: typeof import('@affine/storage');
-try {
-  storageModule = await import('@affine/storage');
-} catch {
-  const require = createRequire(import.meta.url);
-  storageModule =
-    process.arch === 'arm64'
-      ? require('../../../storage.arm64.node')
-      : process.arch === 'arm'
-        ? require('../../../storage.armv7.node')
-        : require('../../../storage.node');
-}
+registerStorageProvider('fs', (config, bucket) => {
+  if (!config.storage.providers.fs) {
+    throw new Error('Missing fs storage provider configuration');
+  }
 
-export { storageModule as OctoBaseStorageModule };
+  return new FsStorageProvider(config.storage.providers.fs, bucket);
+});
 
-export const mergeUpdatesInApplyWay = storageModule.mergeUpdatesInApplyWay;
-
-export const verifyChallengeResponse = async (
-  response: any,
-  bits: number,
-  resource: string
-) => {
-  if (typeof response !== 'string' || !response || !resource) return false;
-  return storageModule.verifyChallengeResponse(response, bits, resource);
-};
-
-export const mintChallengeResponse = async (resource: string, bits: number) => {
-  if (!resource) return null;
-  return storageModule.mintChallengeResponse(resource, bits);
-};
+@Global()
+@Module({
+  providers: [StorageProviderFactory],
+  exports: [StorageProviderFactory],
+})
+export class StorageProviderModule {}
 
+export * from './native';
 export type {
   BlobInputType,
   BlobOutputType,
@@ -41,5 +27,5 @@ export type {
   PutObjectMetadata,
   StorageProvider,
 } from './providers';
-export { createStorageProvider } from './providers';
-export { toBuffer } from './providers/utils';
+export { registerStorageProvider, StorageProviderFactory } from './providers';
+export { autoMetadata, toBuffer } from './providers/utils';

packages/backend/server/src/fundamentals/storage/native.ts

@@ -0,0 +1,30 @@
+import { createRequire } from 'node:module';
+
+let storageModule: typeof import('@affine/storage');
+try {
+  storageModule = await import('@affine/storage');
+} catch {
+  const require = createRequire(import.meta.url);
+  storageModule =
+    process.arch === 'arm64'
+      ? require('../../../storage.arm64.node')
+      : process.arch === 'arm'
+        ? require('../../../storage.armv7.node')
+        : require('../../../storage.node');
+}
+
+export const mergeUpdatesInApplyWay = storageModule.mergeUpdatesInApplyWay;
+
+export const verifyChallengeResponse = async (
+  response: any,
+  bits: number,
+  resource: string
+) => {
+  if (typeof response !== 'string' || !response || !resource) return false;
+  return storageModule.verifyChallengeResponse(response, bits, resource);
+};
+
+export const mintChallengeResponse = async (resource: string, bits: number) => {
+  if (!resource) return null;
+  return storageModule.mintChallengeResponse(resource, bits);
+};