feat(infra): improve ci perf (#14503)

#### PR Dependency Tree


* **PR #14503** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Improved CI efficiency with targeted Rust test detection and
workspace-scoped builds for faster, more focused runs.
* Added workflow static-analysis configuration and refined
Node/Playwright/Electron build flags and platform controls.
* Added a new test workspace dependency and TypeScript project reference
for blocksuite tests; updated workspace wiring for focused builds.
  * Cleaned CI environment handling for server test orchestration.

* **Bug Fixes**
* Hardened mobile release steps (safer credential handling and quoting)
to improve iOS/Android publish reliability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.docker/selfhost/schema.json

@@ -222,7 +222,7 @@
         },
         "SMTP.sender": {
           "type": "string",
-          "description": "Sender of all the emails (e.g. \"AFFiNE Self Hosted <noreply@example.com>\")\n@default \"AFFiNE Self Hosted <noreply@example.com>\"\n@environment `MAILER_SENDER`",
+          "description": "Sender of all the emails (e.g. \"AFFiNE Self Hosted &lt;noreply@example.com&gt;\")\n@default \"AFFiNE Self Hosted <noreply@example.com>\"\n@environment `MAILER_SENDER`",
           "default": "AFFiNE Self Hosted <noreply@example.com>"
         },
         "SMTP.ignoreTLS": {
@@ -262,7 +262,7 @@
         },
         "fallbackSMTP.sender": {
           "type": "string",
-          "description": "Sender of all the emails (e.g. \"AFFiNE Self Hosted <noreply@example.com>\")\n@default \"\"",
+          "description": "Sender of all the emails (e.g. \"AFFiNE Self Hosted &lt;noreply@example.com&gt;\")\n@default \"\"",
           "default": ""
         },
         "fallbackSMTP.ignoreTLS": {

.github/ISSUE_TEMPLATE/config.yml

@@ -3,6 +3,6 @@ contact_links:
   - name: Something else?
     url: https://github.com/toeverything/AFFiNE/discussions
     about: Feel free to ask and answer questions over in GitHub Discussions
-  - name: AFFiNE Community Support
-    url: https://community.affine.pro
+  - name: AFFiNE Community Support (Discord)
+    url: https://affine.pro/redirect/discord
     about: AFFiNE Community - a place to ask, learn and engage with others

.github/actionlint.yaml

@@ -0,0 +1,20 @@
+self-hosted-runner:
+  # Labels of self-hosted runner in array of strings.
+  labels:
+    - win-signer
+
+# Configuration variables in array of strings defined in your repository or
+# organization. `null` means disabling configuration variables check.
+# Empty array means no configuration variable is allowed.
+config-variables: null
+
+# Configuration for file paths. The keys are glob patterns to match to file
+# paths relative to the repository root. The values are the configurations for
+# the file paths. Note that the path separator is always '/'.
+# The following configurations are available.
+#
+# "ignore" is an array of regular expression patterns. Matched error messages
+# are ignored. This is similar to the "-ignore" command line option.
+paths:
+#  .github/workflows/**/*.yml:
+#    ignore: []

.github/actions/setup-version/action.yml

@@ -7,7 +7,6 @@ inputs:
   ios-app-version:
     description: 'iOS App Store Version (Optional, use App version if empty)'
     required: false
-    type: string
 runs:
   using: 'composite'
   steps:

.github/workflows/build-test.yml

@@ -68,9 +68,26 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - uses: actions/checkout@v4
+      - name: Setup Go (for actionlint)
+        uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: Install actionlint
+        shell: bash
+        run: |
+          set -euo pipefail
+          go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
+      - name: Run actionlint
+        shell: bash
+        run: |
+          set -euo pipefail
+          "$(go env GOPATH)/bin/actionlint"
       - name: Run oxlint
         # oxlint is fast, so wrong code will fail quickly
-        run: yarn dlx $(node -e "console.log(require('./package.json').scripts['lint:ox'].replace('oxlint', 'oxlint@' + require('./package.json').devDependencies.oxlint))")
+        run: |
+          set -euo pipefail
+          oxlint_version="$(node -e "console.log(require('./package.json').devDependencies.oxlint)")"
+          yarn dlx "oxlint@${oxlint_version}" --deny-warnings
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
@@ -108,20 +125,45 @@ jobs:
         run: |
           yarn affine bs-docs build
           git checkout packages/frontend/i18n/src/i18n-completenesses.json
-          git status --porcelain | grep . && {
+          if git status --porcelain | grep -q .; then
             echo "Run 'yarn typecheck && yarn affine bs-docs build' and make sure all changes are submitted"
             exit 1
-          } || {
+          else
             echo "All changes are submitted"
-          }
+          fi
+
+  rust-test-filter:
+    name: Rust test filter
+    runs-on: ubuntu-latest
+    outputs:
+      run-rust: ${{ steps.rust-filter.outputs.rust }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dorny/paths-filter@v3
+        id: rust-filter
+        with:
+          filters: |
+            rust:
+              - '**/*.rs'
+              - '**/Cargo.toml'
+              - '**/Cargo.lock'
+              - '.cargo/**'
+              - 'rust-toolchain*'
+              - '.github/actions/build-rust/**'
 
   lint-rust:
     name: Lint Rust
+    if: ${{ needs.rust-test-filter.outputs.run-rust == 'true' }}
     runs-on: ubuntu-latest
+    needs:
+      - rust-test-filter
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/build-rust
         with:
+          target: x86_64-unknown-linux-gnu
+          package: 'affine'
           no-build: 'true'
       - name: fmt check
         run: |
@@ -159,12 +201,12 @@ jobs:
           yarn affine i18n build
           yarn affine server genconfig
           git checkout packages/frontend/i18n/src/i18n-completenesses.json
-          git status --porcelain | grep . && {
+          if git status --porcelain | grep -q .; then
             echo "Run 'yarn affine init && yarn affine gql build && yarn affine i18n build && yarn affine server genconfig' and make sure all changes are submitted"
             exit 1
-          } || {
+          else
             echo "All changes are submitted"
-          }
+          fi
 
   check-yarn-binary:
     name: Check yarn binary
@@ -173,7 +215,9 @@ jobs:
       - uses: actions/checkout@v4
       - name: Run check
         run: |
-          yarn set version $(node -e "console.log(require('./package.json').packageManager.split('@')[1])")
+          set -euo pipefail
+          yarn_version="$(node -e "console.log(require('./package.json').packageManager.split('@')[1])")"
+          yarn set version "$yarn_version"
           git diff --exit-code
 
   e2e-blocksuite-test:
@@ -188,6 +232,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine-test/blocksuite @blocksuite/playground @blocksuite/integration-test
           playwright-install: true
           playwright-platform: 'chromium'
           electron-install: false
@@ -215,6 +260,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine-test/blocksuite @blocksuite/playground @blocksuite/integration-test
           playwright-install: true
           playwright-platform: 'chromium,firefox,webkit'
           electron-install: false
@@ -298,6 +344,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine-test/affine-local @affine/web @affine/server
           playwright-install: true
           playwright-platform: 'chromium'
           electron-install: false
@@ -329,6 +376,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine-test/affine-mobile @affine/mobile
           playwright-install: true
           electron-install: false
           full-cache: true
@@ -400,7 +448,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         shell: bash
         run: |
-          export PLATFORM_ARCH_ABI=$(node -e "console.log(require('@napi-rs/cli').parseTriple('x86_64-unknown-linux-gnu').platformArchABI)")
+          PLATFORM_ARCH_ABI="$(node -e "console.log(require('@napi-rs/cli').parseTriple('x86_64-unknown-linux-gnu').platformArchABI)")"
           echo "filename=affine.$PLATFORM_ARCH_ABI.node" >> "$GITHUB_OUTPUT"
       - name: Build AFFiNE native
         uses: ./.github/actions/build-rust
@@ -439,7 +487,7 @@ jobs:
         working-directory: ${{ github.workspace }}
         shell: bash
         run: |
-          export PLATFORM_ARCH_ABI=$(node -e "console.log(require('@napi-rs/cli').parseTriple('${{ matrix.spec.target }}').platformArchABI)")
+          PLATFORM_ARCH_ABI="$(node -e "console.log(require('@napi-rs/cli').parseTriple('${{ matrix.spec.target }}').platformArchABI)")"
           echo "filename=affine.$PLATFORM_ARCH_ABI.node" >> "$GITHUB_OUTPUT"
       - name: Build AFFiNE native
         uses: ./.github/actions/build-rust
@@ -488,7 +536,7 @@ jobs:
         working-directory: ${{ env.DEV_DRIVE_WORKSPACE }}
         shell: bash
         run: |
-          export PLATFORM_ARCH_ABI=$(node -e "console.log(require('@napi-rs/cli').parseTriple('${{ matrix.spec.target }}').platformArchABI)")
+          PLATFORM_ARCH_ABI="$(node -e "console.log(require('@napi-rs/cli').parseTriple('${{ matrix.spec.target }}').platformArchABI)")"
           echo "filename=affine.$PLATFORM_ARCH_ABI.node" >> "$GITHUB_OUTPUT"
       - name: Build AFFiNE native
         uses: ./.github/actions/build-rust
@@ -536,6 +584,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine/electron-renderer @affine/nbstore @toeverything/infra
           electron-install: false
           full-cache: true
       - name: Build Electron renderer
@@ -617,6 +666,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine/server
           electron-install: false
           full-cache: true
 
@@ -697,6 +747,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine/server
           electron-install: false
           full-cache: true
 
@@ -713,8 +764,6 @@ jobs:
         run: yarn affine @affine/server test:coverage "**/*/*elasticsearch.spec.ts" --forbid-only
         env:
           CARGO_TARGET_DIR: '${{ github.workspace }}/target'
-          CI_NODE_INDEX: ${{ matrix.node_index }}
-          CI_NODE_TOTAL: ${{ matrix.total_nodes }}
 
       - name: Upload server test coverage results
         uses: codecov/codecov-action@v5
@@ -761,6 +810,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine/server
           electron-install: false
           full-cache: true
 
@@ -787,7 +837,10 @@ jobs:
 
   miri:
     name: miri code check
+    if: ${{ needs.rust-test-filter.outputs.run-rust == 'true' }}
     runs-on: ubuntu-latest
+    needs:
+      - rust-test-filter
     env:
       RUST_BACKTRACE: full
       CARGO_TERM_COLOR: always
@@ -812,7 +865,10 @@ jobs:
 
   loom:
     name: loom thread test
+    if: ${{ needs.rust-test-filter.outputs.run-rust == 'true' }}
     runs-on: ubuntu-latest
+    needs:
+      - rust-test-filter
     env:
       RUSTFLAGS: --cfg loom
       RUST_BACKTRACE: full
@@ -835,7 +891,10 @@ jobs:
 
   fuzzing:
     name: fuzzing
+    if: ${{ needs.rust-test-filter.outputs.run-rust == 'true' }}
     runs-on: ubuntu-latest
+    needs:
+      - rust-test-filter
     env:
       CARGO_TERM_COLOR: always
     steps:
@@ -871,7 +930,10 @@ jobs:
 
   rust-test:
     name: Run native tests
+    if: ${{ needs.rust-test-filter.outputs.run-rust == 'true' }}
     runs-on: ubuntu-latest
+    needs:
+      - rust-test-filter
     env:
       CARGO_TERM_COLOR: always
     steps:
@@ -879,6 +941,7 @@ jobs:
       - name: Setup Rust
         uses: ./.github/actions/build-rust
         with:
+          target: x86_64-unknown-linux-gnu
           package: 'affine'
           no-build: 'true'
 
@@ -971,6 +1034,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine/server
           electron-install: false
           full-cache: true
 
@@ -1043,6 +1107,7 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine-test/affine-cloud-copilot @affine/web @affine/server
           playwright-install: true
           playwright-platform: 'chromium'
           electron-install: false
@@ -1125,7 +1190,10 @@ jobs:
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         with:
+          extra-flags: workspaces focus @affine/monorepo @affine-test/affine-cloud @affine-test/affine-desktop-cloud @affine/web @affine/server @affine/electron @affine/electron-renderer @affine/nbstore @toeverything/infra
           playwright-install: true
+          playwright-platform: 'chromium'
+          electron-install: ${{ matrix.tests.shard == 'desktop' && 'true' || 'false' }}
           hard-link-nm: false
 
       - name: Download server-native.node
@@ -1204,7 +1272,8 @@ jobs:
         timeout-minutes: 10
         with:
           extra-flags: workspaces focus @affine/electron @affine/monorepo @affine-test/affine-desktop @affine/nbstore @toeverything/infra
-          playwright-install: true
+          playwright-install: ${{ matrix.spec.test && 'true' || 'false' }}
+          playwright-platform: 'chromium'
           hard-link-nm: false
           enableScripts: false
 
@@ -1212,7 +1281,7 @@ jobs:
         id: filename
         shell: bash
         run: |
-          export PLATFORM_ARCH_ABI=$(node -e "console.log(require('@napi-rs/cli').parseTriple('${{ matrix.spec.target }}').platformArchABI)")
+          PLATFORM_ARCH_ABI="$(node -e "console.log(require('@napi-rs/cli').parseTriple('${{ matrix.spec.target }}').platformArchABI)")"
           echo "filename=affine.$PLATFORM_ARCH_ABI.node" >> "$GITHUB_OUTPUT"
 
       - name: Download ${{ steps.filename.outputs.filename }}
@@ -1319,6 +1388,7 @@ jobs:
       - server-test
       - server-e2e-test
       - rust-test
+      - rust-test-filter
       - copilot-test-filter
       - copilot-api-test
       - copilot-e2e-test

.github/workflows/release-desktop.yml

@@ -201,13 +201,44 @@ jobs:
           nmHoistingLimits: workspaces
         env:
           npm_config_arch: ${{ matrix.spec.arch }}
-      - name: Download and overwrite packaged artifacts
+      - name: Download packaged artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
+          path: packaged-unsigned
+      - name: unzip packaged artifacts
+        run: Expand-Archive -Path packaged-unsigned/archive.zip -DestinationPath packages/frontend/apps/electron/out
+      - name: Download signed packaged file diff
         uses: actions/download-artifact@v4
         with:
           name: signed-packaged-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
-          path: .
-      - name: unzip file
-        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/apps/electron/out
+          path: signed-packaged-diff
+      - name: Apply signed packaged file diff
+        shell: pwsh
+        run: |
+          $DiffRoot = 'signed-packaged-diff/files'
+          $TargetRoot = 'packages/frontend/apps/electron/out'
+          if (!(Test-Path -LiteralPath $DiffRoot)) {
+            throw "Signed diff directory not found: $DiffRoot"
+          }
+
+          Copy-Item -Path (Join-Path $DiffRoot '*') -Destination $TargetRoot -Recurse -Force
+
+          $ManifestPath = 'signed-packaged-diff/manifest.json'
+          if (Test-Path -LiteralPath $ManifestPath) {
+            $ManifestEntries = @(Get-Content -LiteralPath $ManifestPath | ConvertFrom-Json)
+            foreach ($Entry in $ManifestEntries) {
+              $TargetPath = Join-Path $TargetRoot $Entry.path
+              if (!(Test-Path -LiteralPath $TargetPath -PathType Leaf)) {
+                throw "Applied signed file not found: $($Entry.path)"
+              }
+
+              $TargetHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $TargetPath).Hash
+              if ($TargetHash -ne $Entry.sha256) {
+                throw "Signed file hash mismatch: $($Entry.path)"
+              }
+            }
+          }
 
       - name: Make squirrel.windows installer
         run: yarn affine @affine/electron make-squirrel --platform=${{ matrix.spec.platform }} --arch=${{ matrix.spec.arch }}
@@ -267,13 +298,44 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.spec.runner }}
     steps:
-      - name: Download and overwrite installer artifacts
+      - name: Download installer artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
+          path: installer-unsigned
+      - name: unzip installer artifacts
+        run: Expand-Archive -Path installer-unsigned/archive.zip -DestinationPath packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make
+      - name: Download signed installer file diff
         uses: actions/download-artifact@v4
         with:
           name: signed-installer-${{ matrix.spec.platform }}-${{ matrix.spec.arch }}
-          path: .
-      - name: unzip file
-        run: Expand-Archive -Path signed.zip -DestinationPath packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make
+          path: signed-installer-diff
+      - name: Apply signed installer file diff
+        shell: pwsh
+        run: |
+          $DiffRoot = 'signed-installer-diff/files'
+          $TargetRoot = 'packages/frontend/apps/electron/out/${{ env.BUILD_TYPE }}/make'
+          if (!(Test-Path -LiteralPath $DiffRoot)) {
+            throw "Signed diff directory not found: $DiffRoot"
+          }
+
+          Copy-Item -Path (Join-Path $DiffRoot '*') -Destination $TargetRoot -Recurse -Force
+
+          $ManifestPath = 'signed-installer-diff/manifest.json'
+          if (Test-Path -LiteralPath $ManifestPath) {
+            $ManifestEntries = @(Get-Content -LiteralPath $ManifestPath | ConvertFrom-Json)
+            foreach ($Entry in $ManifestEntries) {
+              $TargetPath = Join-Path $TargetRoot $Entry.path
+              if (!(Test-Path -LiteralPath $TargetPath -PathType Leaf)) {
+                throw "Applied signed file not found: $($Entry.path)"
+              }
+
+              $TargetHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $TargetPath).Hash
+              if ($TargetHash -ne $Entry.sha256) {
+                throw "Signed file hash mismatch: $($Entry.path)"
+              }
+            }
+          }
 
       - name: Save artifacts
         run: |

.github/workflows/release-mobile.yml

@@ -128,9 +128,9 @@ jobs:
       - name: Testflight
         working-directory: packages/frontend/apps/ios/App
         run: |
-          echo -n "${{ env.BUILD_PROVISION_PROFILE }}" | base64 --decode -o $PP_PATH
-          mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
-          cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles
+          printf '%s' "$BUILD_PROVISION_PROFILE" | base64 --decode -o "$PP_PATH"
+          mkdir -p "$HOME/Library/MobileDevice/Provisioning Profiles"
+          cp "$PP_PATH" "$HOME/Library/MobileDevice/Provisioning Profiles"
           fastlane beta
         env:
           BUILD_TARGET: distribution
@@ -160,7 +160,9 @@ jobs:
       - name: Load Google Service file
         env:
           DATA: ${{ secrets.FIREBASE_ANDROID_GOOGLE_SERVICE_JSON }}
-        run: echo $DATA | base64 -di > packages/frontend/apps/android/App/app/google-services.json
+        run: |
+          set -euo pipefail
+          printf '%s' "$DATA" | base64 -di > packages/frontend/apps/android/App/app/google-services.json
       - name: Setup Node.js
         uses: ./.github/actions/setup-node
         timeout-minutes: 10

.github/workflows/release.yml

@@ -148,7 +148,7 @@ jobs:
         name: Wait for approval
         with:
           secret: ${{ secrets.GITHUB_TOKEN }}
-          approvers: darkskygit,pengx17,L-Sun,EYHN
+          approvers: darkskygit
           minimum-approvals: 1
           fail-on-denial: true
           issue-title: Please confirm to release docker image

.github/workflows/windows-signer.yml

@@ -30,13 +30,43 @@ jobs:
         run: |
           cd ${{ env.ARCHIVE_DIR }}/out
           signtool sign /tr http://timestamp.globalsign.com/tsa/r6advanced1 /td sha256 /fd sha256 /a ${{ inputs.files }}
-      - name: zip file
-        shell: cmd
+      - name: collect signed file diff
+        shell: powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File {0}
         run: |
-          cd ${{ env.ARCHIVE_DIR }}
-          7za a signed.zip .\out\*
+          $OutDir = Join-Path '${{ env.ARCHIVE_DIR }}' 'out'
+          $DiffDir = Join-Path '${{ env.ARCHIVE_DIR }}' 'signed-diff'
+          $FilesDir = Join-Path $DiffDir 'files'
+          New-Item -ItemType Directory -Path $FilesDir -Force | Out-Null
+
+          $SignedFiles = [regex]::Matches('${{ inputs.files }}', '"([^"]+)"') | ForEach-Object { $_.Groups[1].Value }
+          if ($SignedFiles.Count -eq 0) {
+            throw 'No files to sign were provided.'
+          }
+
+          $Manifest = @()
+          foreach ($RelativePath in $SignedFiles) {
+            $SourcePath = Join-Path $OutDir $RelativePath
+            if (!(Test-Path -LiteralPath $SourcePath -PathType Leaf)) {
+              throw "Signed file not found: $RelativePath"
+            }
+
+            $TargetPath = Join-Path $FilesDir $RelativePath
+            $TargetDir = Split-Path -Parent $TargetPath
+            if ($TargetDir) {
+              New-Item -ItemType Directory -Path $TargetDir -Force | Out-Null
+            }
+
+            Copy-Item -LiteralPath $SourcePath -Destination $TargetPath -Force
+            $Manifest += [PSCustomObject]@{
+              path = $RelativePath
+              sha256 = (Get-FileHash -Algorithm SHA256 -LiteralPath $TargetPath).Hash
+            }
+          }
+
+          $Manifest | ConvertTo-Json -Depth 4 | Out-File -FilePath (Join-Path $DiffDir 'manifest.json') -Encoding utf8
+          Write-Host "Collected $($SignedFiles.Count) signed files."
       - name: upload
         uses: actions/upload-artifact@v4
         with:
           name: signed-${{ inputs.artifact-name }}
-          path: ${{ env.ARCHIVE_DIR }}/signed.zip
+          path: ${{ env.ARCHIVE_DIR }}/signed-diff

.oxlintrc.json

@@ -5,6 +5,10 @@
     "correctness": "error",
     "perf": "error"
   },
+  "env": {
+    "builtin": true,
+    "es2026": true
+  },
   "ignorePatterns": [
     "**/node_modules",
     ".yarn",
@@ -44,6 +48,34 @@
     "**/test-blocks.json"
   ],
   "rules": {
+    "no-empty-static-block": "error",
+    "no-misleading-character-class": "error",
+    "no-new-native-nonconstructor": "error",
+    "no-unused-private-class-members": "error",
+    "no-useless-backreference": "error",
+    "react/display-name": "error",
+    "react/rules-of-hooks": "error",
+    "react/exhaustive-deps": "warn",
+    "@typescript-eslint/prefer-for-of": "error",
+    "@typescript-eslint/no-unsafe-function-type": "error",
+    "@typescript-eslint/no-wrapper-object-types": "error",
+    "no-restricted-imports": [
+      "error",
+      {
+        "patterns": [
+          {
+            "group": ["**/dist"],
+            "message": "Don't import from dist",
+            "allowTypeImports": false
+          },
+          {
+            "group": ["**/src"],
+            "message": "Don't import from src",
+            "allowTypeImports": false
+          }
+        ]
+      }
+    ],
     "no-await-in-loop": "allow",
     "no-redeclare": "allow",
     "promise/no-callback-in-promise": "allow",
@@ -70,6 +102,14 @@
     "no-func-assign": "error",
     "no-global-assign": "error",
     "no-unused-vars": "error",
+    "no-unused-expressions": [
+      "error",
+      {
+        "allowShortCircuit": true,
+        "allowTernary": true,
+        "allowTaggedTemplates": true
+      }
+    ],
     "no-ex-assign": "error",
     "no-loss-of-precision": "error",
     "no-fallthrough": "error",
@@ -126,6 +166,7 @@
     "react/no-render-return-value": "error",
     "react/jsx-no-target-blank": "error",
     "react/jsx-no-comment-textnodes": "error",
+    "react/no-array-index-key": "off",
     "typescript/consistent-type-imports": "error",
     "typescript/no-non-null-assertion": "error",
     "typescript/triple-slash-reference": "error",
@@ -241,6 +282,42 @@
         "typescript/consistent-type-imports": "off",
         "import/no-cycle": "off"
       }
+    },
+    {
+      "files": [
+        "packages/**/*.{ts,tsx}",
+        "tools/**/*.{ts,tsx}",
+        "blocksuite/**/*.{ts,tsx}"
+      ],
+      "rules": {
+        "react/exhaustive-deps": [
+          "warn",
+          {
+            "additionalHooks": "(useAsyncCallback|useCatchEventCallback|useDraggable|useDropTarget|useRefEffect)"
+          }
+        ]
+      }
+    },
+    {
+      "files": [
+        "**/__tests__/**/*",
+        "**/*.stories.tsx",
+        "**/*.spec.ts",
+        "**/tests/**/*",
+        "scripts/**/*",
+        "**/benchmark/**/*",
+        "**/__debug__/**/*",
+        "**/e2e/**/*"
+      ],
+      "rules": {
+        "no-restricted-imports": "off"
+      }
+    },
+    {
+      "files": ["**/*.{ts,js,mjs}"],
+      "rules": {
+        "react/rules-of-hooks": "off"
+      }
     }
   ]
 }

.vscode/settings.template.json

@@ -17,7 +17,7 @@
 	"explorer.fileNesting.enabled": true,
   "explorer.fileNesting.patterns": {
     "*.js": "${capture}.js.map, ${capture}.min.js, ${capture}.d.ts, ${capture}.d.ts.map",
-    "package.json": ".browserslist*, .circleci*, .codecov, .commitlint*, .cz-config.js, .czrc, .dlint.json, .dprint.json, .editorconfig, .eslint*, eslint.*, .firebase*, .flowconfig, .github*, .gitlab*, .gitpod*, .huskyrc*, .jslint*, .lighthouserc.*, .lintstagedrc*, .markdownlint*, .mocha*, .node-version, .nodemon*, .npm*, .nvmrc, .pm2*, .pnp.*, .pnpm*, .prettier*, .releaserc*, .sentry*, .stackblitz*, .styleci*, .stylelint*, .tazerc*, .textlint*, .tool-versions, .travis*, .versionrc*, .vscode*, .watchman*, .xo-config*, .yamllint*, .yarnrc*, Procfile, api-extractor.json, apollo.config.*, appveyor*, ava.config.*, azure-pipelines*, bower.json, build.config.*, commitlint*, dangerfile*, dlint.json, dprint.json, firebase.json, grunt*, gulp*, histoire.config.*, jasmine.*, jenkins*, jest.config.*, jsconfig.*, karma*, lerna*, lighthouserc.*, lint-staged*, nest-cli.*, netlify*, nodemon*, nx.*, package-lock.json, package.nls*.json, phpcs.xml, playwright.config.*, pm2.*, pnpm*, prettier*, pullapprove*, puppeteer.config.*, pyrightconfig.json, release-tasks.sh, renovate*, rollup.config.*, stylelint*, tsconfig.*, tsdoc.*, tslint*, tsup.config.*, turbo*, typedoc*, unlighthouse*, vercel*, vetur.config.*, vitest.*, webpack*, workspace.json, xo.config.*, yarn*, babel.*, .babelrc, project.json, oxlint.json, nyc.config.*",
+    "package.json": ".browserslist*, .circleci*, .codecov, .commitlint*, .cz-config.js, .czrc, .dlint.json, .dprint.json, .editorconfig, .eslint*, eslint.*, .firebase*, .flowconfig, .github*, .gitlab*, .gitpod*, .huskyrc*, .jslint*, .lighthouserc.*, .lintstagedrc*, .markdownlint*, .mocha*, .node-version, .nodemon*, .npm*, .nvmrc, .pm2*, .pnp.*, .pnpm*, .prettier*, .releaserc*, .sentry*, .stackblitz*, .styleci*, .stylelint*, .tazerc*, .textlint*, .tool-versions, .travis*, .versionrc*, .vscode*, .watchman*, .xo-config*, .yamllint*, .yarnrc*, Procfile, api-extractor.json, apollo.config.*, appveyor*, ava.config.*, azure-pipelines*, bower.json, build.config.*, commitlint*, dangerfile*, dlint.json, dprint.json, firebase.json, grunt*, gulp*, histoire.config.*, jasmine.*, jenkins*, jest.config.*, jsconfig.*, karma*, lerna*, lighthouserc.*, lint-staged*, nest-cli.*, netlify*, nodemon*, nx.*, package-lock.json, package.nls*.json, phpcs.xml, playwright.config.*, pm2.*, pnpm*, prettier*, pullapprove*, puppeteer.config.*, pyrightconfig.json, release-tasks.sh, renovate*, rollup.config.*, stylelint*, tsconfig.*, tsdoc.*, tslint*, tsup.config.*, turbo*, typedoc*, unlighthouse*, vercel*, vetur.config.*, vitest.*, webpack*, workspace.json, xo.config.*, yarn*, babel.*, .babelrc, project.json, .oxlintrc.json, oxlint.json, nyc.config.*",
     "Cargo.toml": "Cargo.lock, rust-toolchain*, rustfmt.toml, .taplo.toml",
     "README.md": "LICENSE*, CHANGELOG.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, README.*",
     ".gitignore": ".gitattributes, .dockerignore, .eslintignore, .prettierignore, .stylelintignore, .tslintignore, .yarnignore"

Cargo.lock

@@ -111,10 +111,12 @@ dependencies = [
  "base64-simd",
  "chrono",
  "homedir",
+ "lru",
  "objc2",
  "objc2-foundation",
  "sqlx",
  "thiserror 2.0.17",
+ "tokio",
  "uniffi",
 ]
 
@@ -2572,6 +2574,15 @@ dependencies = [
  "weezl",
 ]
 
+[[package]]
+name = "lru"
+version = "0.16.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
+dependencies = [
+ "hashbrown 0.16.1",
+]
+
 [[package]]
 name = "mac"
 version = "0.1.1"

Cargo.toml

@@ -46,6 +46,7 @@ resolver = "3"
   libc = "0.2"
   log = "0.4"
   loom = { version = "0.7", features = ["checkpoint"] }
+  lru = "0.16"
   memory-indexer = "0.3.0"
   mimalloc = "0.1"
   mp4parse = "0.17"

README.md

@@ -90,10 +90,10 @@ Thanks for checking us out, we appreciate your interest and sincerely hope that
 
 ## Contributing
 
-| Bug Reports                                                                                                                                         | Feature Requests                                                                                                                                               | Questions/Discussions                                                         | AFFiNE Community                                           |
-| --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ---------------------------------------------------------- |
-| [Create a bug report](https://github.com/toeverything/AFFiNE/issues/new?assignees=&labels=bug%2Cproduct-review&template=BUG-REPORT.yml&title=TITLE) | [Submit a feature request](https://github.com/toeverything/AFFiNE/issues/new?assignees=&labels=feat%2Cproduct-review&template=FEATURE-REQUEST.yml&title=TITLE) | [Check GitHub Discussion](https://github.com/toeverything/AFFiNE/discussions) | [Visit the AFFiNE Community](https://community.affine.pro) |
-| Something isn't working as expected                                                                                                                 | An idea for a new feature, or improvements                                                                                                                     | Discuss and ask questions                                                     | A place to ask, learn and engage with others               |
+| Bug Reports                                                                                                                                         | Feature Requests                                                                                                                                               | Questions/Discussions                                                         | AFFiNE Community                                                  |
+| --------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| [Create a bug report](https://github.com/toeverything/AFFiNE/issues/new?assignees=&labels=bug%2Cproduct-review&template=BUG-REPORT.yml&title=TITLE) | [Submit a feature request](https://github.com/toeverything/AFFiNE/issues/new?assignees=&labels=feat%2Cproduct-review&template=FEATURE-REQUEST.yml&title=TITLE) | [Check GitHub Discussion](https://github.com/toeverything/AFFiNE/discussions) | [Visit the AFFiNE's Discord](https://affine.pro/redirect/discord) |
+| Something isn't working as expected                                                                                                                 | An idea for a new feature, or improvements                                                                                                                     | Discuss and ask questions                                                     | A place to ask, learn and engage with others                      |
 
 Calling all developers, testers, tech writers and more! Contributions of all types are more than welcome, you can read more in [docs/types-of-contributions.md](docs/types-of-contributions.md). If you are interested in contributing code, read our [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md) and feel free to check out our GitHub issues to get stuck in to show us what you’re made of.
 
@@ -101,11 +101,9 @@ Calling all developers, testers, tech writers and more! Contributions of all typ
 
 For **bug reports**, **feature requests** and other **suggestions** you can also [create a new issue](https://github.com/toeverything/AFFiNE/issues/new/choose) and choose the most appropriate template for your feedback.
 
-For **translation** and **language support** you can visit our [i18n General Space](https://community.affine.pro/c/i18n-general).
+For **translation** and **language support** you can visit our [Discord](https://affine.pro/redirect/discord).
 
-Looking for **other ways to contribute** and wondering where to start? Check out the [AFFiNE Ambassador program](https://community.affine.pro/c/start-here/affine-ambassador), we work closely with passionate community members and provide them with a wide range of support and resources.
-
-If you have questions, you are welcome to contact us. One of the best places to get more info and learn more is in the [AFFiNE Community](https://community.affine.pro) where you can engage with other like-minded individuals.
+If you have questions, you are welcome to contact us. One of the best places to get more info and learn more is in the [Discord](https://affine.pro/redirect/discord) where you can engage with other like-minded individuals.
 
 ## Templates
 
@@ -182,20 +180,16 @@ Begin with Docker to deploy your own feature-rich, unrestricted version of AFFiN
 
 [![Run on ClawCloud](https://raw.githubusercontent.com/ClawCloud/Run-Template/refs/heads/main/Run-on-ClawCloud.svg)](https://template.run.claw.cloud/?openapp=system-fastdeploy%3FtemplateName%3Daffine)
 
-## Hiring
-
-Some amazing companies, including AFFiNE, are looking for developers! Are you interested in joining AFFiNE or its partners? Check out our [Discord channel](https://affine.pro/redirect/discord) for some of the latest jobs available.
-
 ## Feature Request
 
-For feature requests, please see [community.affine.pro](https://community.affine.pro/c/feature-requests/).
+For feature requests, please see [discussions](https://github.com/toeverything/AFFiNE/discussions/categories/ideas).
 
 ## Building
 
 ### Codespaces
 
 From the GitHub repo main page, click the green "Code" button and select "Create codespace on master". This will open a new Codespace with the (supposedly auto-forked
-AFFiNE repo cloned, built, and ready to go.
+AFFiNE repo cloned, built, and ready to go).
 
 ### Local
 

blocksuite/affine/blocks/callout/src/callout-block.ts

@@ -216,9 +216,13 @@ export class CalloutBlockComponent extends CaptionedBlockComponent<CalloutBlockM
   override renderBlock() {
     const icon = this.model.props.icon$.value;
     const backgroundColorName = this.model.props.backgroundColorName$.value;
+    const normalizedBackgroundName =
+      backgroundColorName === 'default' || backgroundColorName === ''
+        ? 'grey'
+        : backgroundColorName;
     const backgroundColor = (
       cssVarV2.block.callout.background as Record<string, string>
-    )[backgroundColorName ?? ''];
+    )[normalizedBackgroundName ?? 'grey'];
 
     const iconContent = getIcon(icon);
 

blocksuite/affine/blocks/callout/src/configs/toolbar.ts

@@ -68,14 +68,14 @@ const backgroundColorAction = {
           ${repeat(colors, color => {
             const isDefault = color === 'default';
             const value = isDefault
-              ? null
+              ? cssVarV2.block.callout.background.grey
               : `var(--affine-text-highlight-${color})`;
             const displayName = `${color} Background`;
 
             return html`
               <editor-menu-action
                 data-testid="background-${color}"
-                @click=${() => updateBackground(color)}
+                @click=${() => updateBackground(isDefault ? 'grey' : color)}
               >
                 <affine-text-duotone-icon
                   style=${styleMap({

blocksuite/affine/blocks/code/src/styles.ts

@@ -27,6 +27,16 @@ export const codeBlockStyles = css`
 
   ${scrollbarStyle('.affine-code-block-container rich-text')}
 
+  /* In Chromium 121+, non-auto scrollbar-width/color override ::-webkit-scrollbar styles. */
+  @supports not selector(::-webkit-scrollbar) {
+    .affine-code-block-container rich-text {
+      scrollbar-width: thin;
+      scrollbar-color: ${unsafeCSSVarV2('icon/secondary', '#b1b1b1')}
+        transparent;
+      scrollbar-gutter: stable both-edges;
+    }
+  }
+
   .affine-code-block-container .inline-editor {
     font-family: var(--affine-font-code-family);
     font-variant-ligatures: none;

blocksuite/affine/data-view/src/__tests__/kanban.unit.spec.ts

@@ -4,6 +4,7 @@ import { describe, expect, it, vi } from 'vitest';
 import type { GroupBy } from '../core/common/types.js';
 import type { DataSource } from '../core/data-source/base.js';
 import { DetailSelection } from '../core/detail/selection.js';
+import type { FilterGroup } from '../core/filter/types.js';
 import { groupByMatchers } from '../core/group-by/define.js';
 import { t } from '../core/logical/type-presets.js';
 import type { DataViewCellLifeCycle } from '../core/property/index.js';
@@ -17,7 +18,10 @@ import {
   pickKanbanGroupColumn,
   resolveKanbanGroupBy,
 } from '../view-presets/kanban/group-by-utils.js';
-import { materializeKanbanColumns } from '../view-presets/kanban/kanban-view-manager.js';
+import {
+  KanbanSingleView,
+  materializeKanbanColumns,
+} from '../view-presets/kanban/kanban-view-manager.js';
 import type { KanbanCard } from '../view-presets/kanban/pc/card.js';
 import { KanbanDragController } from '../view-presets/kanban/pc/controller/drag.js';
 import type { KanbanGroup } from '../view-presets/kanban/pc/group.js';
@@ -270,6 +274,73 @@ describe('kanban', () => {
     });
   });
 
+  describe('filtering', () => {
+    const sharedFilter: FilterGroup = {
+      type: 'group',
+      op: 'and',
+      conditions: [
+        {
+          type: 'filter',
+          left: {
+            type: 'ref',
+            name: 'status',
+          },
+          function: 'is',
+          args: [{ type: 'literal', value: 'Done' }],
+        },
+      ],
+    };
+
+    const sharedTitleProperty = {
+      id: 'title',
+      cellGetOrCreate: () => ({
+        jsonValue$: {
+          value: 'Task 1',
+        },
+      }),
+    };
+
+    it('evaluates filters with hidden columns', () => {
+      const statusProperty = {
+        id: 'status',
+        cellGetOrCreate: () => ({
+          jsonValue$: {
+            value: 'Done',
+          },
+        }),
+      };
+
+      const view = {
+        filter$: { value: sharedFilter },
+        // Simulate status being hidden in current view.
+        properties$: { value: [sharedTitleProperty] },
+        propertiesRaw$: { value: [sharedTitleProperty, statusProperty] },
+      } as unknown as KanbanSingleView;
+
+      expect(KanbanSingleView.prototype.isShow.call(view, 'row-1')).toBe(true);
+    });
+
+    it('returns false when hidden filtered column does not match', () => {
+      const statusProperty = {
+        id: 'status',
+        cellGetOrCreate: () => ({
+          jsonValue$: {
+            value: 'In Progress',
+          },
+        }),
+      };
+
+      const view = {
+        filter$: { value: sharedFilter },
+        // Simulate status being hidden in current view.
+        properties$: { value: [sharedTitleProperty] },
+        propertiesRaw$: { value: [sharedTitleProperty, statusProperty] },
+      } as unknown as KanbanSingleView;
+
+      expect(KanbanSingleView.prototype.isShow.call(view, 'row-1')).toBe(false);
+    });
+  });
+
   describe('drag indicator', () => {
     it('shows drop preview when insert position exists', () => {
       const controller = createDragController();

blocksuite/affine/data-view/src/__tests__/table.unit.spec.ts

@@ -1,15 +1,21 @@
 import { describe, expect, test } from 'vitest';
 
+import type { FilterGroup } from '../core/filter/types.js';
 import { numberFormats } from '../property-presets/number/utils/formats.js';
 import {
   formatNumber,
   NumberFormatSchema,
   parseNumber,
 } from '../property-presets/number/utils/formatter.js';
+import { DEFAULT_COLUMN_WIDTH } from '../view-presets/table/consts.js';
 import { mobileEffects } from '../view-presets/table/mobile/effect.js';
 import type { MobileTableGroup } from '../view-presets/table/mobile/group.js';
 import { pcEffects } from '../view-presets/table/pc/effect.js';
 import type { TableGroup } from '../view-presets/table/pc/group.js';
+import {
+  materializeTableColumns,
+  TableSingleView,
+} from '../view-presets/table/table-view-manager.js';
 
 /** @vitest-environment happy-dom */
 
@@ -41,6 +47,146 @@ describe('TableGroup', () => {
   });
 });
 
+describe('table column materialization', () => {
+  test('appends missing properties while preserving existing order and state', () => {
+    const columns = [
+      { id: 'status', width: 240, hide: true },
+      { id: 'title', width: 320 },
+    ];
+
+    const next = materializeTableColumns(columns, ['title', 'status', 'date']);
+
+    expect(next).toEqual([
+      { id: 'status', width: 240, hide: true },
+      { id: 'title', width: 320 },
+      { id: 'date', width: DEFAULT_COLUMN_WIDTH },
+    ]);
+  });
+
+  test('drops stale columns that no longer exist in data source', () => {
+    const columns = [
+      { id: 'title', width: 320 },
+      { id: 'removed', width: 200, hide: true },
+    ];
+
+    const next = materializeTableColumns(columns, ['title']);
+
+    expect(next).toEqual([{ id: 'title', width: 320 }]);
+  });
+
+  test('returns original reference when columns are already materialized', () => {
+    const columns = [
+      { id: 'title', width: 320 },
+      { id: 'status', width: 240, hide: true },
+    ];
+
+    const next = materializeTableColumns(columns, ['title', 'status']);
+
+    expect(next).toBe(columns);
+  });
+
+  test('supports type-aware default width when materializing missing columns', () => {
+    const next = materializeTableColumns([], ['title', 'status'], id =>
+      id === 'title' ? 260 : DEFAULT_COLUMN_WIDTH
+    );
+
+    expect(next).toEqual([
+      { id: 'title', width: 260 },
+      { id: 'status', width: DEFAULT_COLUMN_WIDTH },
+    ]);
+  });
+});
+
+describe('table filtering', () => {
+  test('evaluates filters with hidden columns', () => {
+    const filter: FilterGroup = {
+      type: 'group',
+      op: 'and',
+      conditions: [
+        {
+          type: 'filter',
+          left: {
+            type: 'ref',
+            name: 'status',
+          },
+          function: 'is',
+          args: [{ type: 'literal', value: 'Done' }],
+        },
+      ],
+    };
+
+    const titleProperty = {
+      id: 'title',
+      cellGetOrCreate: () => ({
+        jsonValue$: {
+          value: 'Task 1',
+        },
+      }),
+    };
+    const statusProperty = {
+      id: 'status',
+      cellGetOrCreate: () => ({
+        jsonValue$: {
+          value: 'Done',
+        },
+      }),
+    };
+
+    const view = {
+      filter$: { value: filter },
+      // Simulate status being hidden in current view.
+      properties$: { value: [titleProperty] },
+      propertiesRaw$: { value: [titleProperty, statusProperty] },
+    } as unknown as TableSingleView;
+
+    expect(TableSingleView.prototype.isShow.call(view, 'row-1')).toBe(true);
+  });
+
+  test('returns false when hidden filtered column does not match', () => {
+    const filter: FilterGroup = {
+      type: 'group',
+      op: 'and',
+      conditions: [
+        {
+          type: 'filter',
+          left: {
+            type: 'ref',
+            name: 'status',
+          },
+          function: 'is',
+          args: [{ type: 'literal', value: 'Done' }],
+        },
+      ],
+    };
+
+    const titleProperty = {
+      id: 'title',
+      cellGetOrCreate: () => ({
+        jsonValue$: {
+          value: 'Task 1',
+        },
+      }),
+    };
+    const statusProperty = {
+      id: 'status',
+      cellGetOrCreate: () => ({
+        jsonValue$: {
+          value: 'In Progress',
+        },
+      }),
+    };
+
+    const view = {
+      filter$: { value: filter },
+      // Simulate status being hidden in current view.
+      properties$: { value: [titleProperty] },
+      propertiesRaw$: { value: [titleProperty, statusProperty] },
+    } as unknown as TableSingleView;
+
+    expect(TableSingleView.prototype.isShow.call(view, 'row-1')).toBe(false);
+  });
+});
+
 describe('number formatter', () => {
   test('number format menu should expose all schema formats', () => {
     const menuFormats = numberFormats.map(format => format.type);

blocksuite/affine/data-view/src/core/utils/auto-scroll.ts

@@ -67,7 +67,7 @@ export const autoScrollOnBoundary = (
   };
 
   const cancelBoxListen = effect(() => {
-    box.value;
+    void box.value;
     startUpdate();
   });
 

blocksuite/affine/data-view/src/view-presets/kanban/kanban-view-manager.ts

@@ -349,7 +349,7 @@ export class KanbanSingleView extends SingleViewBase<KanbanViewData> {
   isShow(rowId: string): boolean {
     if (this.filter$.value?.conditions.length) {
       const rowMap = Object.fromEntries(
-        this.properties$.value.map(column => [
+        this.propertiesRaw$.value.map(column => [
           column.id,
           column.cellGetOrCreate(rowId).jsonValue$.value,
         ])

blocksuite/affine/data-view/src/view-presets/table/pc-virtual/row/cell.ts

@@ -54,7 +54,9 @@ export class DatabaseCellContainer extends SignalWatcher(
     const selectionView = this.selectionView;
     if (selectionView) {
       const selection = selectionView.selection;
-      if (selection && this.isSelected(selection) && editing) {
+      const shouldEnterEditMode =
+        editing && this.cell?.beforeEnterEditMode() !== false;
+      if (selection && this.isSelected(selection) && shouldEnterEditMode) {
         selectionView.selection = TableViewAreaSelection.create({
           groupKey: this.groupKey,
           focus: {

blocksuite/affine/data-view/src/view-presets/table/pc-virtual/table-view-ui-logic.ts

@@ -24,12 +24,12 @@ import {
   DataViewUIBase,
   DataViewUILogicBase,
 } from '../../../core/view/data-view-base.js';
+import { LEFT_TOOL_BAR_WIDTH } from '../consts.js';
 import {
-  type TableSingleView,
   TableViewRowSelection,
   type TableViewSelectionWithType,
-} from '../../index.js';
-import { LEFT_TOOL_BAR_WIDTH } from '../consts.js';
+} from '../selection.js';
+import type { TableSingleView } from '../table-view-manager.js';
 import { TableClipboardController } from './controller/clipboard.js';
 import { TableDragController } from './controller/drag.js';
 import { TableHotkeysController } from './controller/hotkeys.js';

blocksuite/affine/data-view/src/view-presets/table/pc/cell.ts

@@ -57,7 +57,9 @@ export class TableViewCellContainer extends SignalWatcher(
     const selectionView = this.selectionController;
     if (selectionView) {
       const selection = selectionView.selection;
-      if (selection && this.isSelected(selection) && editing) {
+      const shouldEnterEditMode =
+        editing && this.cell?.beforeEnterEditMode() !== false;
+      if (selection && this.isSelected(selection) && shouldEnterEditMode) {
         selectionView.selection = TableViewAreaSelection.create({
           groupKey: this.groupKey,
           focus: {

blocksuite/affine/data-view/src/view-presets/table/table-view-manager.ts

@@ -26,6 +26,52 @@ import type { ViewManager } from '../../core/view-manager/view-manager.js';
 import { DEFAULT_COLUMN_MIN_WIDTH, DEFAULT_COLUMN_WIDTH } from './consts.js';
 import type { TableViewData } from './define.js';
 
+export const materializeColumnsByPropertyIds = (
+  columns: TableColumnData[],
+  propertyIds: string[],
+  getDefaultWidth: (id: string) => number = () => DEFAULT_COLUMN_WIDTH
+) => {
+  const needShow = new Set(propertyIds);
+  const orderedColumns: TableColumnData[] = [];
+
+  for (const column of columns) {
+    if (needShow.has(column.id)) {
+      orderedColumns.push(column);
+      needShow.delete(column.id);
+    }
+  }
+
+  for (const id of needShow) {
+    orderedColumns.push({ id, width: getDefaultWidth(id), hide: undefined });
+  }
+
+  return orderedColumns;
+};
+
+export const materializeTableColumns = (
+  columns: TableColumnData[],
+  propertyIds: string[],
+  getDefaultWidth?: (id: string) => number
+) => {
+  const nextColumns = materializeColumnsByPropertyIds(
+    columns,
+    propertyIds,
+    getDefaultWidth
+  );
+  const unchanged =
+    columns.length === nextColumns.length &&
+    columns.every((column, index) => {
+      const nextColumn = nextColumns[index];
+      return (
+        nextColumn != null &&
+        column.id === nextColumn.id &&
+        column.hide === nextColumn.hide
+      );
+    });
+
+  return unchanged ? columns : nextColumns;
+};
+
 export class TableSingleView extends SingleViewBase<TableViewData> {
   propertiesRaw$ = computed(() => {
     const needShow = new Set(this.dataSource.properties$.value);
@@ -220,14 +266,10 @@ export class TableSingleView extends SingleViewBase<TableViewData> {
     return this.data$.value?.mode ?? 'table';
   }
 
-  constructor(viewManager: ViewManager, viewId: string) {
-    super(viewManager, viewId);
-  }
-
   isShow(rowId: string): boolean {
     if (this.filter$.value?.conditions.length) {
       const rowMap = Object.fromEntries(
-        this.properties$.value.map(column => [
+        this.propertiesRaw$.value.map(column => [
           column.id,
           column.cellGetOrCreate(rowId).jsonValue$.value,
         ])
@@ -290,6 +332,33 @@ export class TableSingleView extends SingleViewBase<TableViewData> {
       });
     }
   );
+
+  private materializeColumns() {
+    const data = this.data$.value;
+    if (!data) {
+      return;
+    }
+
+    const nextColumns = materializeTableColumns(
+      data.columns,
+      this.dataSource.properties$.value,
+      id => this.propertyGetOrCreate(id).width$.value
+    );
+    if (nextColumns === data.columns) {
+      return;
+    }
+
+    this.dataUpdate(() => ({ columns: nextColumns }));
+  }
+
+  constructor(viewManager: ViewManager, viewId: string) {
+    super(viewManager, viewId);
+    // Materialize view columns on view activation so newly added properties
+    // can participate in hide/order operations in table.
+    queueMicrotask(() => {
+      this.materializeColumns();
+    });
+  }
 }
 
 type TableColumnData = TableViewData['columns'][number];

blocksuite/affine/ext-loader/src/base-provider.ts

@@ -60,10 +60,9 @@ export class BaseExtensionProvider<
    * @param context - The context object containing scope and registration function
    * @param option - Optional configuration options for the provider
    */
-  setup(context: Context<Scope>, option?: Options) {
+  setup(_context: Context<Scope>, option?: Options) {
     if (option) {
       this.schema.parse(option);
     }
-    context;
   }
 }

blocksuite/affine/gfx/connector/src/connector-manager.ts

@@ -884,7 +884,7 @@ export class ConnectionOverlay extends Overlay {
   private _setupThemeListener(): void {
     const themeService = this.gfx.std.get(ThemeProvider);
     this._themeDisposer = effect(() => {
-      themeService.theme$;
+      void themeService.theme$.value;
       this._emphasisColor = this._getEmphasisColor();
     });
   }

blocksuite/affine/gfx/template/src/toolbar/builtin-templates.ts

@@ -1,3 +1,4 @@
+/* eslint-disable @typescript-eslint/await-thenable */
 import type {
   Template,
   TemplateCategory,

blocksuite/affine/shared/src/adapters/markdown/delta-converter.ts

@@ -9,7 +9,7 @@ import rehypeParse from 'rehype-parse';
 import { unified } from 'unified';
 
 import type { AffineTextAttributes } from '../../types/index.js';
-import { HtmlDeltaConverter } from '../html/delta-converter.js';
+import type { HtmlDeltaConverter } from '../html/delta-converter.js';
 import {
   rehypeInlineToBlock,
   rehypeWrapInlineElements,

blocksuite/affine/shared/src/adapters/pdf/pdf.ts

@@ -873,7 +873,7 @@ export class PdfAdapter extends BaseAdapter<PdfAdapterFile> {
     return {
       table: {
         headerRows: 0,
-        widths: Array(sortedColumns.length).fill('*'),
+        widths: Array.from({ length: sortedColumns.length }, () => '*'),
         body: tableBody,
       },
       margin: [0, 5, 0, 5],

blocksuite/affine/shared/src/styles/scrollbar-style.ts

@@ -1,5 +1,7 @@
 import { css, unsafeCSS } from 'lit';
 
+import { unsafeCSSVarV2 } from '../theme/css-variables';
+
 /**
  * You should add a container before the scrollbar style to prevent the style pollution of the whole doc.
  */
@@ -28,7 +30,7 @@ export const scrollbarStyle = (container: string) => {
     }
     ${unsafeCSS(container)}::-webkit-scrollbar-thumb {
       border-radius: 2px;
-      background-color: #b1b1b1;
+      background-color: ${unsafeCSSVarV2('icon/secondary', '#b1b1b1')};
     }
     ${unsafeCSS(container)}::-webkit-scrollbar-corner {
       display: none;

blocksuite/affine/shared/src/utils/print-to-pdf.ts

@@ -115,12 +115,9 @@ export async function printToPdf(
       ) as HTMLDivElement;
 
       // force light theme in print iframe
-      iframe.contentWindow.document.documentElement.setAttribute(
-        'data-theme',
-        'light'
-      );
-      iframe.contentWindow.document.body.setAttribute('data-theme', 'light');
-      importedRoot.setAttribute('data-theme', 'light');
+      iframe.contentWindow.document.documentElement.dataset.theme = 'light';
+      iframe.contentWindow.document.body.dataset.theme = 'light';
+      importedRoot.dataset.theme = 'light';
 
       // draw saved canvas image to canvas
       const allImportedCanvas = importedRoot.getElementsByTagName('canvas');

blocksuite/affine/widgets/edgeless-zoom-toolbar/src/zoom-toolbar.ts

@@ -126,7 +126,7 @@ export class EdgelessZoomToolbar extends WithDisposable(LitElement) {
 
     this.disposables.add(
       effect(() => {
-        this.gfx.tool.currentToolName$.value;
+        void this.gfx.tool.currentToolName$.value;
         this.requestUpdate();
       })
     );

blocksuite/affine/widgets/keyboard-toolbar/src/keyboard-toolbar.ts

@@ -289,7 +289,7 @@ export class AffineKeyboardToolbar extends SignalWatcher(
     this.disposables.add(
       effect(() => {
         const std = this.rootComponent.std;
-        std.selection.value;
+        void std.selection.value;
         // wait cursor updated
         requestAnimationFrame(() => {
           this._scrollCurrentBlockIntoView();

blocksuite/affine/widgets/linked-doc/src/import-doc/import-doc.ts

@@ -220,9 +220,7 @@ export class ImportDoc extends WithDisposable(LitElement) {
         </header>
         <div>
           AFFiNE will gradually support more file formats for import.
-          <a
-            href="https://community.affine.pro/c/feature-requests/import-export"
-            target="_blank"
+          <a href="https://affine.pro/redirect/discord" target="_blank"
             >Provide feedback.</a
           >
         </div>

blocksuite/affine/widgets/linked-doc/src/transformers/docx.ts

@@ -1,5 +1,5 @@
 import type { ExtensionType, Schema, Workspace } from '@blocksuite/store';
-// @ts-ignore
+// @ts-expect-error -- mammoth.browser has no compatible type declaration for this subpath.
 import { convertToHtml } from 'mammoth/mammoth.browser';
 
 import { HtmlTransformer } from './html';

blocksuite/affine/widgets/linked-doc/src/transformers/markdown.ts

@@ -10,12 +10,12 @@ import { Container } from '@blocksuite/global/di';
 import { BlockSuiteError, ErrorCode } from '@blocksuite/global/exceptions';
 import { sha } from '@blocksuite/global/utils';
 import type {
+  DocMeta,
   ExtensionType,
   Schema,
   Store,
   Workspace,
 } from '@blocksuite/store';
-import type { DocMeta } from '@blocksuite/store';
 import { extMimeMap, Transformer } from '@blocksuite/store';
 
 import type { AssetMap, ImportedFileEntry, PathBlobIdMap } from './type.js';

blocksuite/affine/widgets/linked-doc/src/transformers/utils.ts

@@ -171,9 +171,11 @@ export class Unzip {
       const fileExt =
         fileName.lastIndexOf('.') === -1 ? '' : fileName.split('.').at(-1);
       const mime = extMimeMap.get(fileExt ?? '');
-      const content = new File([this.unzipped![path]], fileName, {
-        type: mime ?? '',
-      }) as Blob;
+      const content = new File(
+        [new Uint8Array(this.unzipped![path]).buffer],
+        fileName,
+        mime ? { type: mime } : undefined
+      ) as Blob;
 
       const fixedPath = this.fixFileNameEncoding(path);
 

blocksuite/affine/widgets/linked-doc/src/transformers/zip.ts

@@ -27,10 +27,10 @@ async function exportDocs(
       titleMiddleware(collection.meta.docMetas),
     ],
   });
-  const snapshots = await Promise.all(docs.map(job.docToSnapshot));
 
   await Promise.all(
-    snapshots
+    docs
+      .map(job.docToSnapshot)
       .filter((snapshot): snapshot is DocSnapshot => !!snapshot)
       .map(async snapshot => {
         // Use the title and id as the snapshot file name

blocksuite/framework/std/src/__tests__/keymap.unit.spec.ts

@@ -0,0 +1,119 @@
+import { describe, expect, test } from 'vitest';
+
+import { bindKeymap } from '../event/keymap.js';
+
+const createKeyboardEvent = (options: {
+  key: string;
+  keyCode: number;
+  altKey?: boolean;
+  ctrlKey?: boolean;
+  metaKey?: boolean;
+  shiftKey?: boolean;
+}): KeyboardEvent => {
+  const event = new KeyboardEvent('keydown', {
+    key: options.key,
+    altKey: options.altKey ?? false,
+    ctrlKey: options.ctrlKey ?? false,
+    metaKey: options.metaKey ?? false,
+    shiftKey: options.shiftKey ?? false,
+  });
+
+  Object.defineProperty(event, 'keyCode', {
+    configurable: true,
+    get: () => options.keyCode,
+  });
+  Object.defineProperty(event, 'which', {
+    configurable: true,
+    get: () => options.keyCode,
+  });
+
+  return event;
+};
+
+const createCtx = (event: KeyboardEvent) => {
+  return {
+    get(name: string) {
+      if (name === 'keyboardState') {
+        return { raw: event };
+      }
+      return undefined;
+    },
+  } as any;
+};
+
+describe('bindKeymap', () => {
+  test('falls back to physical key for ctrl shortcuts on non-US layouts', () => {
+    let handled = false;
+    const handler = bindKeymap({
+      'Ctrl-f': () => {
+        handled = true;
+        return true;
+      },
+    });
+
+    const event = createKeyboardEvent({
+      key: 'а',
+      keyCode: 70,
+      ctrlKey: true,
+    });
+
+    expect(handler(createCtx(event))).toBe(true);
+    expect(handled).toBe(true);
+  });
+
+  test('does not fallback for Alt+locale-character letter input', () => {
+    let handled = false;
+    const handler = bindKeymap({
+      'Alt-s': () => {
+        handled = true;
+        return true;
+      },
+    });
+
+    const event = createKeyboardEvent({
+      key: 'ś',
+      keyCode: 83,
+      altKey: true,
+    });
+
+    expect(handler(createCtx(event))).toBe(false);
+    expect(handled).toBe(false);
+  });
+
+  test('keeps Alt+digit fallback for non-ASCII key outputs', () => {
+    let handled = false;
+    const handler = bindKeymap({
+      'Alt-0': () => {
+        handled = true;
+        return true;
+      },
+    });
+
+    const event = createKeyboardEvent({
+      key: 'º',
+      keyCode: 48,
+      altKey: true,
+    });
+
+    expect(handler(createCtx(event))).toBe(true);
+    expect(handled).toBe(true);
+  });
+
+  test('does not fallback on non-ASCII input without modifiers', () => {
+    let handled = false;
+    const handler = bindKeymap({
+      '[': () => {
+        handled = true;
+        return true;
+      },
+    });
+
+    const event = createKeyboardEvent({
+      key: 'х',
+      keyCode: 219,
+    });
+
+    expect(handler(createCtx(event))).toBe(false);
+    expect(handled).toBe(false);
+  });
+});

blocksuite/framework/std/src/clipboard/clipboard.ts

@@ -190,7 +190,7 @@ export class Clipboard extends LifeCycleWatcher {
         );
       }
       return slice;
-    } catch (error) {
+    } catch {
       const getDataByType = this._getDataByType(data);
       const slice = await this._getSnapshotByPriority(
         type => getDataByType(type),

blocksuite/framework/std/src/event/keymap.ts

@@ -90,9 +90,21 @@ export function bindKeymap(
     // Do NOT fallback when the key produces a non-ASCII character (e.g., Cyrillic 'х' on Russian keyboard),
     // because the user intends to type that character, not trigger a shortcut bound to the physical key.
     // See: https://github.com/toeverything/AFFiNE/issues/14059
-    const hasModifier = event.shiftKey || event.altKey || event.metaKey;
+    const hasModifier =
+      event.shiftKey || event.altKey || event.ctrlKey || event.metaKey;
     const baseName = base[event.keyCode];
-    if (hasModifier && baseName && baseName !== name) {
+    const isSingleAscii = name.length === 1 && name.charCodeAt(0) <= 0x7e;
+    const isAltInputChar = event.altKey && !event.ctrlKey && !isSingleAscii;
+    // Keep supporting existing Alt+digit shortcuts (e.g. Alt-0/1/2 in edgeless)
+    // while preventing Alt-based locale input characters from triggering letter shortcuts.
+    const isDigitBaseKey =
+      baseName != null && baseName.length === 1 && /[0-9]/.test(baseName);
+    if (
+      hasModifier &&
+      baseName &&
+      baseName !== name &&
+      !(isAltInputChar && !isDigitBaseKey)
+    ) {
       const fromCode = map[modifiers(baseName, event)];
       if (fromCode && fromCode(ctx)) {
         return true;

blocksuite/framework/std/src/extension/service-manager.ts

@@ -1,5 +1,5 @@
-import { LifeCycleWatcher } from '../extension/index.js';
 import { BlockServiceIdentifier } from '../identifier.js';
+import { LifeCycleWatcher } from './lifecycle-watcher.js';
 
 export class ServiceManager extends LifeCycleWatcher {
   static override readonly key = 'serviceManager';

blocksuite/framework/std/src/utils/tree.ts

@@ -87,6 +87,7 @@ export function batchRemoveChildren(
   }
 
   uniqueElements.forEach(element => {
+    // oxlint-disable-next-line unicorn/prefer-dom-node-remove
     container.removeChild(element);
   });
 }
@@ -114,7 +115,9 @@ function traverse(
       });
     }
 
-    postCallBack && postCallBack(element);
+    if (postCallBack) {
+      postCallBack(element);
+    }
   };
 
   innerTraverse(element);

blocksuite/framework/std/src/view/element/lit-host.ts

@@ -170,10 +170,10 @@ export class EditorHost extends SignalWatcher(
         ...Object.values(widgetTags),
       ];
       await Promise.all(
-        elementsTags.map(tag => {
+        elementsTags.map(async tag => {
           const element = this.renderRoot.querySelector(tag._$litStatic$);
           if (element instanceof LitElement) {
-            return element.updateComplete;
+            return await element.updateComplete;
           }
           return null;
         })

blocksuite/framework/store/src/__tests__/collection.unit.spec.ts

@@ -382,6 +382,7 @@ describe('addBlock', () => {
 
     const doc0 = collection.createDoc('doc:home');
     const doc1 = collection.createDoc('space:doc1');
+    // eslint-disable-next-line @typescript-eslint/await-thenable
     await Promise.all([doc0.load(), doc1.load()]);
     assert.equal(collection.docs.size, 2);
     const store0 = doc0.getStore({

blocksuite/framework/store/src/schema/schema.ts

@@ -1,7 +1,7 @@
 import { minimatch } from 'minimatch';
 
 import { SCHEMA_NOT_FOUND_MESSAGE } from '../consts.js';
-import { BlockSchema, type BlockSchemaType } from '../model/index.js';
+import { BlockSchema, type BlockSchemaType } from '../model/block/zod.js';
 import { SchemaValidateError } from './error.js';
 
 /**

blocksuite/framework/store/src/transformer/slice.ts

@@ -1,9 +1,6 @@
-import {
-  BlockModel,
-  type DraftModel,
-  type Store,
-  toDraftModel,
-} from '../model/index';
+import { BlockModel } from '../model/block/block-model.js';
+import { type DraftModel, toDraftModel } from '../model/block/draft.js';
+import type { Store } from '../model/store/store.js';
 
 type SliceData = {
   content: DraftModel[];

blocksuite/framework/store/src/transformer/transformer.ts

@@ -3,14 +3,11 @@ import { BlockSuiteError, ErrorCode } from '@blocksuite/global/exceptions';
 import { nextTick } from '@blocksuite/global/utils';
 import { Subject } from 'rxjs';
 
-import {
-  BlockModel,
-  type BlockSchemaType,
-  type DraftModel,
-  type Store,
-  toDraftModel,
-} from '../model/index.js';
-import type { Schema } from '../schema/index.js';
+import { BlockModel } from '../model/block/block-model.js';
+import { type DraftModel, toDraftModel } from '../model/block/draft.js';
+import type { BlockSchemaType } from '../model/block/zod.js';
+import type { Store } from '../model/store/store.js';
+import type { Schema } from '../schema/schema.js';
 import { AssetsManager } from './assets.js';
 import { BaseBlockTransformer } from './base.js';
 import type {

docs/CONTRIBUTING.md

@@ -1 +1 @@
-# Please visit https://docs.affine.pro/docs/contributing
+# Please visit https://docs.affine.pro/contributing

docs/contributor-add.md

@@ -1,10 +0,0 @@
-# Contributor Add
-
-- https://allcontributors.org/docs/en/cli/usage
-- https://allcontributors.org/docs/en/emoji-key
-
-```shell
-all-contributors check
-all-contributors add tzhangchi code,doc
-all-contributors generate
-```

docs/types-of-contributions.md

@@ -26,4 +26,4 @@ You may be able to find additional help and information on our social media plat
 
 ### :earth_asia: Translations
 
-AFFiNE is internationalized and available in multiple languages. The source content in this repository is written in English. We integrate with an external localization platform to work with the community in localizing the English content. You can find more info on our community page, in our [i18n General Space ](https://community.affine.pro/c/i18n-general).
+AFFiNE is internationalized and available in multiple languages. The source content in this repository is written in English. We integrate with an external localization platform to work with the community in localizing the English content. You can find more info on our community page, in our [Discord](https://affine.pro/redirect/discord).

eslint.config.mjs

@@ -5,6 +5,7 @@ import eslint from '@eslint/js';
 import tsParser from '@typescript-eslint/parser';
 import eslintConfigPrettier from 'eslint-config-prettier';
 import importX from 'eslint-plugin-import-x';
+import oxlint from 'eslint-plugin-oxlint';
 import react from 'eslint-plugin-react';
 import reactHooks from 'eslint-plugin-react-hooks';
 import simpleImportSort from 'eslint-plugin-simple-import-sort';
@@ -16,7 +17,10 @@ const __require = createRequire(import.meta.url);
 
 const rxjs = __require('@smarttools/eslint-plugin-rxjs');
 
-const ignoreList = readFileSync('.prettierignore', 'utf-8')
+const ignoreList = readFileSync(
+  new URL('.prettierignore', import.meta.url),
+  'utf-8'
+)
   .split('\n')
   .filter(line => line.trim() && !line.startsWith('#'));
 
@@ -60,105 +64,51 @@ export default tseslint.config(
       'simple-import-sort': simpleImportSort,
       rxjs,
       unicorn,
+      oxlint,
     },
     rules: {
       ...eslint.configs.recommended.rules,
       ...react.configs.recommended.rules,
       ...react.configs['jsx-runtime'].rules,
       ...reactHooks.configs.recommended.rules,
+      ...oxlint.configs.recommended.rules,
       // covered by TypeScript
       'no-dupe-args': 'off',
       // the following rules are disabled because they are covered by oxlint
       'array-callback-return': 'off',
-      'constructor-super': 'off',
       eqeqeq: 'off',
       'getter-return': 'off',
-      'for-direction': 'off',
-      'require-yield': 'off',
-      'use-isnan': 'off',
-      'valid-typeof': 'off',
       'no-self-compare': 'off',
       'no-empty': 'off',
-      'no-constant-binary-expression': 'off',
       'no-constructor-return': 'off',
-      'no-func-assign': 'off',
-      'no-global-assign': 'off',
-      'no-ex-assign': 'off',
       'no-fallthrough': 'off',
-      'no-irregular-whitespace': 'off',
-      'no-control-regex': 'off',
-      'no-with': 'off',
-      'no-debugger': 'off',
-      'no-const-assign': 'off',
-      'no-import-assign': 'off',
-      'no-setter-return': 'off',
-      'no-obj-calls': 'off',
-      'no-unsafe-negation': 'off',
-      'no-dupe-class-members': 'off',
-      'no-dupe-keys': 'off',
-      'no-this-before-super': 'off',
-      'no-empty-character-class': 'off',
-      'no-useless-catch': 'off',
-      'no-async-promise-executor': 'off',
       'no-unreachable': 'off',
-      'no-duplicate-case': 'off',
-      'no-empty-pattern': 'off',
-      'no-unused-labels': 'off',
-      'no-sparse-arrays': 'off',
-      'no-delete-var': 'off',
-      'no-compare-neg-zero': 'off',
       'no-redeclare': 'off',
       'no-case-declarations': 'off',
-      'no-class-assign': 'off',
       'no-var': 'off',
-      'no-self-assign': 'off',
       'no-inner-declarations': 'off',
-      'no-dupe-else-if': 'off',
-      'no-invalid-regexp': 'off',
-      'no-unsafe-finally': 'off',
       'no-prototype-builtins': 'off',
-      'no-shadow-restricted-names': 'off',
-      'no-nonoctal-decimal-escape': 'off',
-      'no-constant-condition': 'off',
-      'no-useless-escape': 'off',
-      'no-unsafe-optional-chaining': 'off',
-      'no-extra-boolean-cast': 'off',
       'no-regex-spaces': 'off',
       'no-unused-vars': 'off',
       'no-undef': 'off',
-      'no-cond-assign': 'off',
       'react/jsx-no-useless-fragment': 'off',
       'react/no-unknown-property': 'off',
-      'react/no-string-refs': 'off',
-      'react/no-direct-mutation-state': 'off',
       'react/require-render-return': 'off',
-      'react/jsx-no-undef': 'off',
-      'react/jsx-no-duplicate-props': 'off',
-      'react/jsx-key': 'off',
-      'react/no-danger-with-children': 'off',
       'react/no-unescaped-entities': 'off',
-      'react/no-is-mounted': 'off',
-      'react/no-find-dom-node': 'off',
-      'react/no-children-prop': 'off',
-      'react/no-render-return-value': 'off',
       'react/jsx-no-target-blank': 'off',
       'react/jsx-no-comment-textnodes': 'off',
       'react/prop-types': 'off',
+      'react-hooks/immutability': 'off',
+      'react-hooks/refs': 'off',
+      'react-hooks/set-state-in-effect': 'off',
+      'react-hooks/static-components': 'off',
+      'react-hooks/use-memo': 'off',
       'sonarjs/no-useless-catch': 'off',
       '@typescript-eslint/consistent-type-imports': 'off',
       '@typescript-eslint/no-unused-vars': 'off',
       '@typescript-eslint/no-non-null-assertion': 'off',
-      '@typescript-eslint/no-loss-of-precision': 'off',
       '@typescript-eslint/ban-ts-comment': 'off',
-      '@typescript-eslint/triple-slash-reference': 'off',
-      '@typescript-eslint/no-non-null-asserted-optional-chain': 'off',
-      '@typescript-eslint/no-duplicate-enum-values': 'off',
-      '@typescript-eslint/no-extra-non-null-assertion': 'off',
-      '@typescript-eslint/no-misused-new': 'off',
       '@typescript-eslint/prefer-for-of': 'error',
-      '@typescript-eslint/no-unsafe-declaration-merging': 'off',
-      '@typescript-eslint/no-this-alias': 'off',
-      '@typescript-eslint/prefer-as-const': 'off',
       '@typescript-eslint/no-var-requires': 'off',
       '@typescript-eslint/no-namespace': 'off',
       '@typescript-eslint/no-unnecessary-type-constraint': 'off',
@@ -167,30 +117,13 @@ export default tseslint.config(
       '@typescript-eslint/no-empty-function': 'off',
 
       // rules that are not supported by oxlint
+      'no-unreachable-loop': 'error',
       '@typescript-eslint/no-unsafe-function-type': 'error',
-      '@typescript-eslint/no-wrapper-object-types': 'error',
       '@typescript-eslint/unified-signatures': 'error',
       '@typescript-eslint/return-await': [
         'error',
         'error-handling-correctness-only',
       ],
-      '@typescript-eslint/no-restricted-imports': [
-        'error',
-        {
-          patterns: [
-            {
-              group: ['**/dist'],
-              message: "Don't import from dist",
-              allowTypeImports: false,
-            },
-            {
-              group: ['**/src'],
-              message: "Don't import from src",
-              allowTypeImports: false,
-            },
-          ],
-        },
-      ],
       'sonarjs/no-all-duplicated-branches': 'error',
       'sonarjs/no-element-overwrite': 'error',
       'sonarjs/no-empty-collection': 'error',
@@ -198,7 +131,6 @@ export default tseslint.config(
       'sonarjs/no-identical-conditions': 'error',
       'sonarjs/no-identical-expressions': 'error',
       'sonarjs/no-ignored-return': 'error',
-      'sonarjs/no-one-iteration-loop': 'error',
       'sonarjs/no-use-of-empty-return-value': 'error',
       'sonarjs/non-existent-operator': 'error',
       'sonarjs/no-collapsible-if': 'error',
@@ -234,13 +166,6 @@ export default tseslint.config(
         'error',
         { includeInternal: true },
       ],
-      'react-hooks/exhaustive-deps': [
-        'warn',
-        {
-          additionalHooks:
-            '(useAsyncCallback|useCatchEventCallback|useDraggable|useDropTarget|useRefEffect)',
-        },
-      ],
       'rxjs/finnish': [
         'error',
         {
@@ -304,7 +229,6 @@ export default tseslint.config(
         { ignoreVoid: true },
       ],
       '@typescript-eslint/no-misused-promises': 0,
-      '@typescript-eslint/no-restricted-imports': 0,
     },
   },
   {

package.json

@@ -26,9 +26,10 @@
     "lint:eslint:fix": "yarn lint:eslint --fix --fix-type problem,suggestion,layout",
     "lint:prettier": "prettier --ignore-unknown --cache --check .",
     "lint:prettier:fix": "prettier --ignore-unknown --cache --write .",
-    "lint:ox": "oxlint -c oxlint.json --deny-warnings",
-    "lint": "yarn lint:eslint && yarn lint:prettier",
-    "lint:fix": "yarn lint:eslint:fix && yarn lint:prettier:fix",
+    "lint:ox": "oxlint --deny-warnings",
+    "lint:ox:fix": "yarn lint:ox --fix",
+    "lint": "yarn lint:ox && yarn lint:eslint && yarn lint:prettier",
+    "lint:fix": "yarn lint:ox:fix && yarn lint:eslint:fix && yarn lint:prettier:fix",
     "test": "vitest --run",
     "test:ui": "vitest --ui",
     "test:coverage": "vitest run --coverage",
@@ -51,7 +52,7 @@
   "devDependencies": {
     "@affine-tools/cli": "workspace:*",
     "@capacitor/cli": "^7.0.0",
-    "@eslint/js": "^9.16.0",
+    "@eslint/js": "^9.39.2",
     "@faker-js/faker": "^10.1.0",
     "@istanbuljs/schema": "^0.1.3",
     "@magic-works/i18n-codegen": "^0.6.1",
@@ -61,32 +62,33 @@
     "@toeverything/infra": "workspace:*",
     "@types/eslint": "^9.6.1",
     "@types/node": "^22.0.0",
-    "@typescript-eslint/parser": "^8.18.0",
+    "@typescript-eslint/parser": "^8.55.0",
     "@vanilla-extract/vite-plugin": "^5.0.0",
     "@vitest/browser": "^3.2.4",
     "@vitest/coverage-istanbul": "^3.2.4",
     "@vitest/ui": "^3.2.4",
     "cross-env": "^10.1.0",
     "electron": "^39.0.0",
-    "eslint": "^9.16.0",
-    "eslint-config-prettier": "^10.0.0",
-    "eslint-import-resolver-typescript": "^4.0.0",
-    "eslint-plugin-import-x": "^4.5.0",
-    "eslint-plugin-react": "^7.37.2",
-    "eslint-plugin-react-hooks": "^5.1.0",
+    "eslint": "^9.39.2",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-import-resolver-typescript": "^4.4.4",
+    "eslint-plugin-import-x": "^4.16.1",
+    "eslint-plugin-oxlint": "^1.46.0",
+    "eslint-plugin-react": "^7.37.5",
+    "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-simple-import-sort": "^12.1.1",
-    "eslint-plugin-sonarjs": "^3.0.1",
-    "eslint-plugin-unicorn": "^59.0.0",
+    "eslint-plugin-sonarjs": "^3.0.7",
+    "eslint-plugin-unicorn": "^63.0.0",
     "happy-dom": "^20.0.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.0.0",
     "msw": "^2.12.4",
-    "oxlint": "~1.18.0",
+    "oxlint": "^1.47.0",
     "prettier": "^3.7.4",
     "semver": "^7.7.3",
     "serve": "^14.2.4",
     "typescript": "^5.7.2",
-    "typescript-eslint": "^8.18.0",
+    "typescript-eslint": "^8.55.0",
     "unplugin-swc": "^1.5.9",
     "vite": "^7.2.7",
     "vitest": "^3.2.4"

packages/backend/native/benchmark/index.js

@@ -31,7 +31,7 @@ assert.strictEqual(
 bench
   .add('tiktoken', () => {
     const encoder = encoding_for_model('gpt-4o');
-    encoder.encode_ordinary(FIXTURE).length;
+    void encoder.encode_ordinary(FIXTURE).length;
   })
   .add('native', () => {
     fromModelName('gpt-4o').count(FIXTURE);

packages/backend/server/package.json

@@ -39,18 +39,18 @@
     "@google-cloud/opentelemetry-cloud-trace-exporter": "^3.0.0",
     "@google-cloud/opentelemetry-resource-util": "^3.0.0",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "@nestjs-cls/transactional": "^2.6.1",
-    "@nestjs-cls/transactional-adapter-prisma": "^1.2.19",
+    "@nestjs-cls/transactional": "^2.7.0",
+    "@nestjs-cls/transactional-adapter-prisma": "^1.2.24",
     "@nestjs/apollo": "^13.0.4",
-    "@nestjs/bullmq": "^11.0.2",
-    "@nestjs/common": "^11.0.12",
-    "@nestjs/core": "^11.0.12",
+    "@nestjs/bullmq": "^11.0.4",
+    "@nestjs/common": "^11.0.21",
+    "@nestjs/core": "^11.1.14",
     "@nestjs/graphql": "^13.0.4",
-    "@nestjs/platform-express": "^11.0.12",
-    "@nestjs/platform-socket.io": "^11.1.9",
-    "@nestjs/schedule": "^6.0.0",
-    "@nestjs/throttler": "^6.4.0",
-    "@nestjs/websockets": "^11.0.12",
+    "@nestjs/platform-express": "^11.1.14",
+    "@nestjs/platform-socket.io": "^11.1.14",
+    "@nestjs/schedule": "^6.1.1",
+    "@nestjs/throttler": "^6.5.0",
+    "@nestjs/websockets": "^11.1.14",
     "@node-rs/argon2": "^2.0.2",
     "@node-rs/crc32": "^1.10.6",
     "@opentelemetry/api": "^1.9.0",
@@ -71,7 +71,7 @@
     "@opentelemetry/semantic-conventions": "^1.38.0",
     "@prisma/client": "^6.6.0",
     "@prisma/instrumentation": "^6.7.0",
-    "@queuedash/api": "^3.14.0",
+    "@queuedash/api": "^3.16.0",
     "@react-email/components": "0.0.38",
     "@socket.io/redis-adapter": "^8.3.0",
     "ai": "^5.0.118",
@@ -81,7 +81,7 @@
     "date-fns": "^4.0.0",
     "dotenv": "^16.4.7",
     "eventemitter2": "^6.4.9",
-    "exa-js": "^1.6.13",
+    "exa-js": "^2.4.0",
     "express": "^5.0.1",
     "fast-xml-parser": "^5.3.4",
     "get-stream": "^9.0.1",

packages/backend/server/src/__tests__/app/selfhost.e2e.ts

@@ -97,7 +97,7 @@ test('should always return static asset files', async t => {
   t.is(res.text, "const name = 'affine'");
 
   res = await request(t.context.app.getHttpServer())
-    .get('/main.b.js')
+    .get('/admin/main.b.js')
     .expect(200);
   t.is(res.text, "const name = 'affine-admin'");
 
@@ -119,7 +119,7 @@ test('should always return static asset files', async t => {
   t.is(res.text, "const name = 'affine'");
 
   res = await request(t.context.app.getHttpServer())
-    .get('/main.b.js')
+    .get('/admin/main.b.js')
     .expect(200);
   t.is(res.text, "const name = 'affine-admin'");
 

packages/backend/server/src/__tests__/e2e/storage/r2-proxy.spec.ts

@@ -43,7 +43,6 @@ class MockR2Provider extends R2StorageProvider {
 
   destroy() {}
 
-  // @ts-ignore expect override
   override async proxyPutObject(
     key: string,
     body: any,

packages/backend/server/src/__tests__/worker.e2e.ts

@@ -1,6 +1,7 @@
+import { LookupAddress } from 'node:dns';
+
 import type { ExecutionContext, TestFn } from 'ava';
 import ava from 'ava';
-import { LookupAddress } from 'dns';
 import Sinon from 'sinon';
 import type { Response } from 'supertest';
 
@@ -14,7 +15,6 @@ import { createTestingApp, TestingApp } from './utils';
 type TestContext = {
   app: TestingApp;
 };
-
 const test = ava as TestFn<TestContext>;
 
 const LookupAddressStub = (async (_hostname, options) => {

packages/backend/server/src/base/cors.ts

@@ -0,0 +1,99 @@
+import { URLHelper } from './helpers';
+
+const DEV_LOOPBACK_PROTOCOLS = new Set(['http:', 'https:']);
+const DEV_LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1']);
+const MOBILE_CLIENT_ORIGINS = new Set([
+  'https://localhost',
+  'capacitor://localhost',
+  'ionic://localhost',
+]);
+const DESKTOP_CLIENT_ORIGINS = new Set(['assets://.', 'assets://another-host']);
+
+export const CORS_ALLOWED_METHODS = [
+  'GET',
+  'HEAD',
+  'PUT',
+  'PATCH',
+  'POST',
+  'DELETE',
+  'OPTIONS',
+];
+
+export const CORS_ALLOWED_HEADERS = [
+  'accept',
+  'authorization',
+  'content-type',
+  'x-affine-version',
+  'x-operation-name',
+  'x-request-id',
+  'x-captcha-token',
+  'x-captcha-challenge',
+  'x-affine-csrf-token',
+  'x-requested-with',
+  'range',
+];
+
+export const CORS_EXPOSED_HEADERS = [
+  'content-length',
+  'content-range',
+  'x-request-id',
+];
+
+function normalizeHostname(hostname: string) {
+  return hostname.toLowerCase().replace(/^\[/, '').replace(/\]$/, '');
+}
+
+function isDevLoopbackOrigin(origin: string) {
+  try {
+    const parsed = new URL(origin);
+    return (
+      DEV_LOOPBACK_PROTOCOLS.has(parsed.protocol) &&
+      DEV_LOOPBACK_HOSTS.has(normalizeHostname(parsed.hostname))
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function buildCorsAllowedOrigins(url: URLHelper) {
+  return new Set<string>([
+    ...url.allowedOrigins,
+    ...MOBILE_CLIENT_ORIGINS,
+    ...DESKTOP_CLIENT_ORIGINS,
+  ]);
+}
+
+export function isCorsOriginAllowed(
+  origin: string | undefined | null,
+  allowedOrigins: Set<string>
+) {
+  if (!origin) {
+    return true;
+  }
+
+  if (allowedOrigins.has(origin)) {
+    return true;
+  }
+
+  if ((env.dev || env.testing) && isDevLoopbackOrigin(origin)) {
+    return true;
+  }
+
+  return false;
+}
+
+export function corsOriginCallback(
+  origin: string | undefined,
+  allowedOrigins: Set<string>,
+  onBlocked: (origin: string) => void,
+  callback: (error: Error | null, allow?: boolean) => void
+) {
+  if (isCorsOriginAllowed(origin, allowedOrigins)) {
+    callback(null, true);
+    return;
+  }
+
+  const blockedOrigin = origin ?? '<empty>';
+  onBlocked(blockedOrigin);
+  callback(null, false);
+}

packages/backend/server/src/base/helpers/crypto.ts

@@ -51,10 +51,10 @@ function parseKey(privateKey: string) {
   let priv: KeyObject;
   try {
     priv = createPrivateKey({ key: keyBuf, format: 'pem', type: 'pkcs8' });
-  } catch (e1) {
+  } catch {
     try {
       priv = createPrivateKey({ key: keyBuf, format: 'pem', type: 'sec1' });
-    } catch (e2) {
+    } catch {
       // As a last resort rely on auto-detection
       priv = createPrivateKey(keyBuf);
     }

packages/backend/server/src/base/index.ts

@@ -11,6 +11,7 @@ export {
   defineModuleConfig,
   type JSONSchema,
 } from './config';
+export * from './cors';
 export * from './error';
 export { EventBus, OnEvent } from './event';
 export {

packages/backend/server/src/base/storage/providers/r2.ts

@@ -175,7 +175,7 @@ export class R2StorageProvider extends S3StorageProvider {
     body: Readable | Buffer | Uint8Array | string,
     options: { contentType?: string; contentLength?: number } = {}
   ) {
-    return this.client.putObject(key, body as any, {
+    return this.client.putObject(key, this.normalizeBody(body), {
       contentType: options.contentType,
       contentLength: options.contentLength,
     });
@@ -192,13 +192,24 @@ export class R2StorageProvider extends S3StorageProvider {
       key,
       uploadId,
       partNumber,
-      body as any,
+      this.normalizeBody(body),
       { contentLength: options.contentLength }
     );
 
     return result.etag;
   }
 
+  private normalizeBody(body: Readable | Buffer | Uint8Array | string) {
+    // s3mini does not accept Node.js Readable directly.
+    // Convert it to Web ReadableStream for compatibility.
+    if (body instanceof Readable) {
+      return Readable.toWeb(body);
+    } else if (typeof body === 'string') {
+      return this.encoder.encode(body);
+    }
+    return body;
+  }
+
   override async get(
     key: string,
     signedUrl?: boolean

packages/backend/server/src/base/storage/providers/s3.ts

@@ -281,7 +281,7 @@ export class S3StorageProvider implements StorageProvider {
 
       this.logger.verbose(`Read object \`${key}\``);
       return {
-        body: Readable.fromWeb(obj.body as any),
+        body: Readable.fromWeb(obj.body),
         metadata: {
           contentType: contentType ?? 'application/octet-stream',
           contentLength: contentLength ?? 0,

packages/backend/server/src/base/utils/request-tracker.ts

@@ -22,12 +22,14 @@ function firstNonEmpty(...values: Array<string | undefined>) {
 }
 
 export function getRequestClientIp(req: Request) {
-  return firstNonEmpty(
-    req.get('CF-Connecting-IP'),
-    firstForwardedForIp(req.get('X-Forwarded-For')),
-    req.get('X-Real-IP'),
-    req.ip
-  )!;
+  return (
+    firstNonEmpty(
+      req.get('CF-Connecting-IP'),
+      firstForwardedForIp(req.get('X-Forwarded-For')),
+      req.get('X-Real-IP'),
+      req.ip
+    ) ?? ''
+  );
 }
 
 export function getRequestTrackerId(req: Request) {
@@ -39,6 +41,7 @@ export function getRequestTrackerId(req: Request) {
       req.get('X-Real-IP'),
       req.get('CF-Ray'),
       req.ip
-    )!
+    ) ??
+    ''
   );
 }

packages/backend/server/src/base/utils/ssrf.ts

@@ -180,7 +180,7 @@ export async function assertSsrFSafeUrl(
   let addresses: string[];
   try {
     addresses = await resolveHostAddresses(hostname);
-  } catch (error) {
+  } catch {
     throw createSsrfBlockedError('unresolvable_hostname', {
       url: url.toString(),
       hostname,

packages/backend/server/src/base/websocket/adapter.ts

@@ -4,7 +4,15 @@ import { createAdapter } from '@socket.io/redis-adapter';
 import { Server, Socket } from 'socket.io';
 
 import { Config } from '../config';
+import {
+  buildCorsAllowedOrigins,
+  CORS_ALLOWED_HEADERS,
+  CORS_ALLOWED_METHODS,
+  corsOriginCallback,
+} from '../cors';
 import { AuthenticationRequired } from '../error';
+import { URLHelper } from '../helpers';
+import { AFFiNELogger } from '../logger';
 import { SocketIoRedis } from '../redis';
 import { WEBSOCKET_OPTIONS } from './options';
 
@@ -14,17 +22,34 @@ export class SocketIoAdapter extends IoAdapter {
   }
 
   override createIOServer(port: number, options?: any): Server {
+    const logger = this.app.get(AFFiNELogger);
     const config = this.app.get(WEBSOCKET_OPTIONS) as Config['websocket'] & {
       canActivate: (socket: Socket) => Promise<boolean>;
     };
+    const url = this.app.get(URLHelper);
+    const allowedOrigins = buildCorsAllowedOrigins(url);
+
     const server: Server = super.createIOServer(port, {
       ...config,
       ...options,
-      // Enable CORS for Socket.IO
       cors: {
-        origin: true, // Allow all origins
-        credentials: true, // Allow credentials (cookies, auth headers)
-        methods: ['GET', 'POST'],
+        origin: (
+          origin: string | undefined,
+          callback: (error: Error | null, allow?: boolean) => void
+        ) => {
+          corsOriginCallback(
+            origin,
+            allowedOrigins,
+            blockedOrigin =>
+              logger.warn(
+                `Blocked WebSocket CORS request from origin: ${blockedOrigin}`
+              ),
+            callback
+          );
+        },
+        credentials: true,
+        methods: CORS_ALLOWED_METHODS,
+        allowedHeaders: CORS_ALLOWED_HEADERS,
       },
     });
 

packages/backend/server/src/core/doc-renderer/__tests__/controller.spec.ts

@@ -109,3 +109,45 @@ test('should record page view when rendering shared page', async t => {
   docContent.restore();
   record.restore();
 });
+
+test('should return markdown content and skip page view when accept is text/markdown', async t => {
+  const docId = randomUUID();
+  const { app, adapter, models, docReader } = t.context;
+
+  const doc = new YDoc();
+  const text = doc.getText('content');
+  const updates: Buffer[] = [];
+
+  doc.on('update', update => {
+    updates.push(Buffer.from(update));
+  });
+
+  text.insert(0, 'markdown');
+  await adapter.pushDocUpdates(workspace.id, docId, updates, user.id);
+  await models.doc.publish(workspace.id, docId);
+
+  const markdown = Sinon.stub(docReader, 'getDocMarkdown').resolves({
+    title: 'markdown-doc',
+    markdown: '# markdown-doc',
+  });
+  const docContent = Sinon.stub(docReader, 'getDocContent');
+  const record = Sinon.stub(
+    models.workspaceAnalytics,
+    'recordDocView'
+  ).resolves();
+
+  const res = await app
+    .GET(`/workspace/${workspace.id}/${docId}`)
+    .set('accept', 'text/markdown')
+    .expect(200);
+
+  t.true(markdown.calledOnceWithExactly(workspace.id, docId, false));
+  t.is(res.text, '# markdown-doc');
+  t.true((res.headers['content-type'] as string).startsWith('text/markdown'));
+  t.true(docContent.notCalled);
+  t.true(record.notCalled);
+
+  markdown.restore();
+  docContent.restore();
+  record.restore();
+});

packages/backend/server/src/core/doc-renderer/controller.ts

@@ -44,6 +44,12 @@ const staticPaths = new Set([
   'trash',
 ]);
 
+const markdownType = new Set([
+  'text/markdown',
+  'application/markdown',
+  'text/x-markdown',
+]);
+
 @Controller('/workspace')
 export class DocRendererController {
   private readonly logger = new Logger(DocRendererController.name);
@@ -68,6 +74,21 @@ export class DocRendererController {
       .digest('hex');
   }
 
+  private async allowDocPreview(workspaceId: string, docId: string) {
+    const allowSharing = await this.models.workspace.allowSharing(workspaceId);
+    if (!allowSharing) return false;
+
+    let allowUrlPreview = await this.models.doc.isPublic(workspaceId, docId);
+
+    if (!allowUrlPreview) {
+      // if page is private, but workspace url preview is on
+      allowUrlPreview =
+        await this.models.workspace.allowUrlPreview(workspaceId);
+    }
+
+    return allowUrlPreview;
+  }
+
   @Public()
   @Get('/*path')
   async render(@Req() req: Request, @Res() res: Response) {
@@ -81,28 +102,55 @@ export class DocRendererController {
 
     let opts: RenderOptions | null = null;
     // /workspace/:workspaceId/{:docId | staticPaths}
-    const [, , workspaceId, subPath, ...restPaths] = req.path.split('/');
+    const [, , workspaceId, sub, ...rest] = req.path.split('/');
+    const isWorkspace =
+      workspaceId && sub && !staticPaths.has(sub) && rest.length === 0;
+    const isDocPath = isWorkspace && workspaceId !== sub;
+
+    if (
+      isDocPath &&
+      req.accepts().some(t => markdownType.has(t.toLowerCase()))
+    ) {
+      try {
+        const allowPreview = await this.allowDocPreview(workspaceId, sub);
+        if (!allowPreview) {
+          res.status(404).end();
+          return;
+        }
+
+        const markdown = await this.doc.getDocMarkdown(workspaceId, sub, false);
+        if (markdown) {
+          res.setHeader('Content-Type', 'text/markdown; charset=utf-8');
+          res.send(markdown.markdown);
+          return;
+        }
+      } catch (e) {
+        this.logger.error('failed to render markdown page', e);
+      }
+
+      res.status(404).end();
+      return;
+    }
 
     // /:workspaceId/:docId
-    if (workspaceId && !staticPaths.has(subPath) && restPaths.length === 0) {
+    if (isWorkspace) {
       try {
-        opts =
-          workspaceId === subPath
-            ? await this.getWorkspaceContent(workspaceId)
-            : await this.getPageContent(workspaceId, subPath);
+        opts = isDocPath
+          ? await this.getPageContent(workspaceId, sub)
+          : await this.getWorkspaceContent(workspaceId);
         metrics.doc.counter('render').add(1);
 
-        if (opts && workspaceId !== subPath) {
+        if (opts && isDocPath) {
           void this.models.workspaceAnalytics
             .recordDocView({
               workspaceId,
-              docId: subPath,
-              visitorId: this.buildVisitorId(req, workspaceId, subPath),
+              docId: sub,
+              visitorId: this.buildVisitorId(req, workspaceId, sub),
               isGuest: true,
             })
             .catch(error => {
               this.logger.warn(
-                `Failed to record shared page view: ${workspaceId}/${subPath}`,
+                `Failed to record shared page view: ${workspaceId}/${sub}`,
                 error as Error
               );
             });
@@ -124,20 +172,7 @@ export class DocRendererController {
     workspaceId: string,
     docId: string
   ): Promise<RenderOptions | null> {
-    const allowSharing = await this.models.workspace.allowSharing(workspaceId);
-    if (!allowSharing) {
-      return null;
-    }
-
-    let allowUrlPreview = await this.models.doc.isPublic(workspaceId, docId);
-
-    if (!allowUrlPreview) {
-      // if page is private, but workspace url preview is on
-      allowUrlPreview =
-        await this.models.workspace.allowUrlPreview(workspaceId);
-    }
-
-    if (allowUrlPreview) {
+    if (await this.allowDocPreview(workspaceId, docId)) {
       return this.doc.getDocContent(workspaceId, docId);
     }
 

packages/backend/server/src/core/doc/adapters/workspace.ts

@@ -276,22 +276,16 @@ export class PgWorkspaceDocStorageAdapter extends DocStorageAdapter {
         return false;
       }
 
-      try {
-        await this.models.history.create(
-          {
-            spaceId: snapshot.spaceId,
-            docId: snapshot.docId,
-            timestamp: snapshot.timestamp,
-            blob: Buffer.from(snapshot.bin),
-            editorId: snapshot.editor,
-          },
-          historyMaxAge
-        );
-      } catch (e) {
-        // safe to ignore
-        // only happens when duplicated history record created in multi processes
-        this.logger.error('Failed to create history record', e);
-      }
+      await this.models.history.create(
+        {
+          spaceId: snapshot.spaceId,
+          docId: snapshot.docId,
+          timestamp: snapshot.timestamp,
+          blob: Buffer.from(snapshot.bin),
+          editorId: snapshot.editor,
+        },
+        historyMaxAge
+      );
 
       metrics.doc
         .counter('history_created_counter', {

packages/backend/server/src/core/mail/config.ts

@@ -56,7 +56,7 @@ defineModuleConfig('mailer', {
     env: 'MAILER_PASSWORD',
   },
   'SMTP.sender': {
-    desc: 'Sender of all the emails (e.g. "AFFiNE Self Hosted \<noreply@example.com\>")',
+    desc: 'Sender of all the emails (e.g. "AFFiNE Self Hosted &lt;noreply@example.com&gt;")',
     default: 'AFFiNE Self Hosted <noreply@example.com>',
     env: 'MAILER_SENDER',
   },
@@ -92,7 +92,7 @@ defineModuleConfig('mailer', {
     default: '',
   },
   'fallbackSMTP.sender': {
-    desc: 'Sender of all the emails (e.g. "AFFiNE Self Hosted \<noreply@example.com\>")',
+    desc: 'Sender of all the emails (e.g. "AFFiNE Self Hosted &lt;noreply@example.com&gt;")',
     default: '',
   },
   'fallbackSMTP.ignoreTLS': {

packages/backend/server/src/core/selfhost/static.ts

@@ -52,7 +52,7 @@ export class StaticFilesResolver implements OnModuleInit {
 
     // serve all static files
     app.use(
-      basePath,
+      basePath + '/admin',
       serveStatic(join(staticPath, 'admin'), {
         redirect: false,
         index: false,

packages/backend/server/src/core/telemetry/controller.ts

@@ -2,9 +2,11 @@ import { Body, Controller, Options, Post, Req, Res } from '@nestjs/common';
 import type { Request, Response } from 'express';
 
 import { BadRequest, Throttle, UseNamedGuard } from '../../base';
-import type { CurrentUser as CurrentUserType } from '../auth';
-import { Public } from '../auth';
-import { CurrentUser } from '../auth';
+import {
+  CurrentUser,
+  type CurrentUser as CurrentUserType,
+  Public,
+} from '../auth';
 import { TelemetryService } from './service';
 import { TelemetryAck, type TelemetryBatch } from './types';
 

packages/backend/server/src/core/workspaces/resolvers/admin.ts

@@ -2,6 +2,7 @@ import { Injectable, NotFoundException } from '@nestjs/common';
 import {
   Args,
   Field,
+  Info,
   InputType,
   Int,
   Mutation,
@@ -14,6 +15,12 @@ import {
   ResolveField,
   Resolver,
 } from '@nestjs/graphql';
+import {
+  type FragmentDefinitionNode,
+  type GraphQLResolveInfo,
+  Kind,
+  type SelectionNode,
+} from 'graphql';
 import { SafeIntResolver } from 'graphql-scalars';
 
 import { PaginationInput, URLHelper } from '../../../base';
@@ -53,6 +60,44 @@ registerEnumType(AdminSharedLinksOrder, {
   name: 'AdminSharedLinksOrder',
 });
 
+function hasSelectedField(
+  selections: readonly SelectionNode[],
+  fieldName: string,
+  fragments: Record<string, FragmentDefinitionNode>
+): boolean {
+  for (const selection of selections) {
+    if (selection.kind === Kind.FIELD) {
+      if (selection.name.value === fieldName) {
+        return true;
+      }
+      continue;
+    }
+
+    if (selection.kind === Kind.INLINE_FRAGMENT) {
+      if (
+        hasSelectedField(
+          selection.selectionSet.selections,
+          fieldName,
+          fragments
+        )
+      ) {
+        return true;
+      }
+      continue;
+    }
+
+    const fragment = fragments[selection.name.value];
+    if (
+      fragment &&
+      hasSelectedField(fragment.selectionSet.selections, fieldName, fragments)
+    ) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 @InputType()
 class ListWorkspaceInput {
   @Field(() => Int, { defaultValue: 20 })
@@ -471,22 +516,40 @@ export class AdminWorkspaceResolver {
   })
   async adminDashboard(
     @Args('input', { nullable: true, type: () => AdminDashboardInput })
-    input?: AdminDashboardInput
+    input?: AdminDashboardInput,
+    @Info() info?: GraphQLResolveInfo
   ) {
     this.assertCloudOnly();
+    const includeTopSharedLinks = Boolean(
+      info?.fieldNodes.some(
+        node =>
+          node.selectionSet &&
+          hasSelectedField(
+            node.selectionSet.selections,
+            'topSharedLinks',
+            info.fragments
+          )
+      )
+    );
+
     const dashboard = await this.models.workspaceAnalytics.adminGetDashboard({
       timezone: input?.timezone,
       storageHistoryDays: input?.storageHistoryDays,
       syncHistoryHours: input?.syncHistoryHours,
       sharedLinkWindowDays: input?.sharedLinkWindowDays,
+      includeTopSharedLinks,
     });
 
     return {
       ...dashboard,
-      topSharedLinks: dashboard.topSharedLinks.map(link => ({
-        ...link,
-        shareUrl: this.url.link(`/workspace/${link.workspaceId}/${link.docId}`),
-      })),
+      topSharedLinks: includeTopSharedLinks
+        ? dashboard.topSharedLinks.map(link => ({
+            ...link,
+            shareUrl: this.url.link(
+              `/workspace/${link.workspaceId}/${link.docId}`
+            ),
+          }))
+        : [],
     };
   }
 

packages/backend/server/src/env.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from 'node:url';
 import pkg from '../package.json' with { type: 'json' };
 
 declare global {
+  // oxlint-disable-next-line no-shadow-restricted-names
   namespace globalThis {
     // oxlint-disable-next-line no-var
     var env: Readonly<Env>;

packages/backend/server/src/models/__tests__/history.spec.ts

@@ -74,6 +74,27 @@ test('should create a history record', async t => {
   });
 });
 
+test('should not fail on duplicated history record', async t => {
+  const snapshot = {
+    spaceId: workspace.id,
+    docId: randomUUID(),
+    blob: Uint8Array.from([1, 2, 3]),
+    timestamp: Date.now(),
+    editorId: user.id,
+  };
+
+  const created1 = await t.context.history.create(snapshot, 1000);
+  const created2 = await t.context.history.create(snapshot, 1000);
+  t.deepEqual(created1.timestamp, snapshot.timestamp);
+  t.deepEqual(created2.timestamp, snapshot.timestamp);
+
+  const histories = await t.context.history.findMany(
+    snapshot.spaceId,
+    snapshot.docId
+  );
+  t.is(histories.length, 1);
+});
+
 test('should return null when history timestamp not match', async t => {
   const snapshot = {
     spaceId: workspace.id,

packages/backend/server/src/models/calendar-account.ts

@@ -110,10 +110,10 @@ export class CalendarAccountModel extends BaseModel {
       refreshIntervalMinutes: data.refreshIntervalMinutes,
     };
 
-    if (!!accessToken) {
+    if (accessToken) {
       updateData.accessToken = accessToken;
     }
-    if (!!refreshToken) {
+    if (refreshToken) {
       updateData.refreshToken = refreshToken;
     }
 

packages/backend/server/src/models/copilot-session.ts

@@ -117,7 +117,7 @@ export class CopilotSessionModel extends BaseModel {
     if (typeof value !== 'string') {
       return value;
     }
-    return value.replace(/\u0000/g, '') as T;
+    return value.replaceAll('\0', '') as T;
   }
 
   private sanitizeJsonValue<T>(value: T): T {

packages/backend/server/src/models/history.ts

@@ -33,22 +33,33 @@ export class HistoryModel extends BaseModel {
    * Create a doc history with a max age.
    */
   async create(snapshot: Doc, maxAge: number): Promise<DocHistorySimple> {
-    const row = await this.db.snapshotHistory.create({
-      select: {
-        timestamp: true,
-        createdByUser: { select: publicUserSelect },
+    const timestamp = new Date(snapshot.timestamp);
+    const expiredAt = new Date(Date.now() + maxAge);
+
+    // This method may be called concurrently by multiple processes for the same
+    // (workspaceId, docId, timestamp). Using upsert avoids duplicate key errors
+    // that would otherwise abort the surrounding transaction.
+    const row = await this.db.snapshotHistory.upsert({
+      where: {
+        workspaceId_id_timestamp: {
+          workspaceId: snapshot.spaceId,
+          id: snapshot.docId,
+          timestamp,
+        },
       },
-      data: {
+      select: { timestamp: true, createdByUser: { select: publicUserSelect } },
+      create: {
         workspaceId: snapshot.spaceId,
         id: snapshot.docId,
-        timestamp: new Date(snapshot.timestamp),
+        timestamp,
         blob: snapshot.blob,
         createdBy: snapshot.editorId,
-        expiredAt: new Date(Date.now() + maxAge),
+        expiredAt,
       },
+      update: { expiredAt },
     });
     this.logger.debug(
-      `Created history ${row.timestamp} for ${snapshot.docId} in ${snapshot.spaceId}`
+      `Upserted history ${row.timestamp} for ${snapshot.docId} in ${snapshot.spaceId}`
     );
     return {
       timestamp: row.timestamp.getTime(),

packages/backend/server/src/models/workspace-analytics.ts

@@ -51,6 +51,7 @@ export type AdminDashboardOptions = {
   storageHistoryDays?: number;
   syncHistoryHours?: number;
   sharedLinkWindowDays?: number;
+  includeTopSharedLinks?: boolean;
 };
 
 export type AdminAllSharedLinksOptions = {
@@ -262,6 +263,7 @@ export class WorkspaceAnalyticsModel extends BaseModel {
       90,
       DEFAULT_SHARED_LINK_WINDOW_DAYS
     );
+    const includeTopSharedLinks = options.includeTopSharedLinks ?? true;
 
     const now = new Date();
 
@@ -274,6 +276,66 @@ export class WorkspaceAnalyticsModel extends BaseModel {
     const storageFrom = addUtcDays(currentDay, -(storageHistoryDays - 1));
     const sharedFrom = addUtcDays(currentDay, -(sharedLinkWindowDays - 1));
 
+    const topSharedLinksPromise = includeTopSharedLinks
+      ? this.db.$queryRaw<
+          {
+            workspaceId: string;
+            docId: string;
+            title: string | null;
+            publishedAt: Date | null;
+            docUpdatedAt: Date | null;
+            workspaceOwnerId: string | null;
+            lastUpdaterId: string | null;
+            views: bigint | number;
+            uniqueViews: bigint | number;
+            guestViews: bigint | number;
+            lastAccessedAt: Date | null;
+          }[]
+        >`
+          WITH view_agg AS (
+            SELECT
+              workspace_id,
+              doc_id,
+              COALESCE(SUM(total_views), 0) AS views,
+              COALESCE(SUM(unique_views), 0) AS unique_views,
+              COALESCE(SUM(guest_views), 0) AS guest_views,
+              MAX(last_accessed_at) AS last_accessed_at
+            FROM workspace_doc_view_daily
+            WHERE date BETWEEN ${sharedFrom}::date AND ${currentDay}::date
+            GROUP BY workspace_id, doc_id
+          )
+          SELECT
+            wp.workspace_id AS "workspaceId",
+            wp.page_id AS "docId",
+            wp.title AS title,
+            wp.published_at AS "publishedAt",
+            sn.updated_at AS "docUpdatedAt",
+            owner.user_id AS "workspaceOwnerId",
+            sn.updated_by AS "lastUpdaterId",
+            COALESCE(v.views, 0) AS views,
+            COALESCE(v.unique_views, 0) AS "uniqueViews",
+            COALESCE(v.guest_views, 0) AS "guestViews",
+            v.last_accessed_at AS "lastAccessedAt"
+          FROM workspace_pages wp
+          LEFT JOIN snapshots sn
+            ON sn.workspace_id = wp.workspace_id AND sn.guid = wp.page_id
+          LEFT JOIN view_agg v
+            ON v.workspace_id = wp.workspace_id AND v.doc_id = wp.page_id
+          LEFT JOIN LATERAL (
+            SELECT user_id
+            FROM workspace_user_permissions
+            WHERE workspace_id = wp.workspace_id
+            AND type = ${WorkspaceRole.Owner}
+            AND status = 'Accepted'::"WorkspaceMemberStatus"
+            ORDER BY created_at ASC
+            LIMIT 1
+          ) owner ON TRUE
+          WHERE wp.public = TRUE
+          ORDER BY views DESC, "uniqueViews" DESC, "workspaceId" ASC, "docId" ASC
+          LIMIT 10
+        `
+      : Promise.resolve([]);
+
     const [
       syncCurrent,
       syncTimeline,
@@ -350,63 +412,7 @@ export class WorkspaceAnalyticsModel extends BaseModel {
           AND created_at >= ${sharedFrom}
           AND created_at <= ${now}
         `,
-      this.db.$queryRaw<
-        {
-          workspaceId: string;
-          docId: string;
-          title: string | null;
-          publishedAt: Date | null;
-          docUpdatedAt: Date | null;
-          workspaceOwnerId: string | null;
-          lastUpdaterId: string | null;
-          views: bigint | number;
-          uniqueViews: bigint | number;
-          guestViews: bigint | number;
-          lastAccessedAt: Date | null;
-        }[]
-      >`
-          WITH view_agg AS (
-            SELECT
-              workspace_id,
-              doc_id,
-              COALESCE(SUM(total_views), 0) AS views,
-              COALESCE(SUM(unique_views), 0) AS unique_views,
-              COALESCE(SUM(guest_views), 0) AS guest_views,
-              MAX(last_accessed_at) AS last_accessed_at
-            FROM workspace_doc_view_daily
-            WHERE date BETWEEN ${sharedFrom}::date AND ${currentDay}::date
-            GROUP BY workspace_id, doc_id
-          )
-          SELECT
-            wp.workspace_id AS "workspaceId",
-            wp.page_id AS "docId",
-            wp.title AS title,
-            wp.published_at AS "publishedAt",
-            sn.updated_at AS "docUpdatedAt",
-            owner.user_id AS "workspaceOwnerId",
-            sn.updated_by AS "lastUpdaterId",
-            COALESCE(v.views, 0) AS views,
-            COALESCE(v.unique_views, 0) AS "uniqueViews",
-            COALESCE(v.guest_views, 0) AS "guestViews",
-            v.last_accessed_at AS "lastAccessedAt"
-          FROM workspace_pages wp
-          LEFT JOIN snapshots sn
-            ON sn.workspace_id = wp.workspace_id AND sn.guid = wp.page_id
-          LEFT JOIN view_agg v
-            ON v.workspace_id = wp.workspace_id AND v.doc_id = wp.page_id
-          LEFT JOIN LATERAL (
-            SELECT user_id
-            FROM workspace_user_permissions
-            WHERE workspace_id = wp.workspace_id
-            AND type = ${WorkspaceRole.Owner}
-            AND status = 'Accepted'::"WorkspaceMemberStatus"
-            ORDER BY created_at ASC
-            LIMIT 1
-          ) owner ON TRUE
-          WHERE wp.public = TRUE
-          ORDER BY views DESC, "uniqueViews" DESC, "workspaceId" ASC, "docId" ASC
-          LIMIT 10
-        `,
+      topSharedLinksPromise,
     ]);
 
     const storageHistorySeries = storageHistory.map(row => ({

packages/backend/server/src/plugins/calendar/providers/caldav.ts

@@ -22,8 +22,8 @@ import {
   CalendarProviderListCalendarsParams,
   CalendarProviderListEventsParams,
   CalendarProviderListEventsResult,
-  CalendarProviderName,
 } from './def';
+import { CalendarProviderName } from './factory';
 import { CalendarSyncTokenInvalid } from './google';
 
 const XML_PARSER = new XMLParser({
@@ -113,7 +113,7 @@ const isRedirectStatus = (status: number) =>
 
 const splitHeaderTokens = (value: string) =>
   value
-    .split(/,(?=(?:[^\"]*\"[^\"]*\")*[^\"]*$)/)
+    .split(/,(?=(?:[^"]*"[^"]*")*[^"]*$)/)
     .map(token => token.trim())
     .filter(Boolean);
 

packages/backend/server/src/plugins/calendar/providers/def.ts

@@ -2,12 +2,7 @@ import { Inject, Injectable, Logger } from '@nestjs/common';
 import type { CalendarAccount } from '@prisma/client';
 
 import { CalendarProviderRequestError, Config, OnEvent } from '../../../base';
-import { CalendarProviderFactory } from './factory';
-
-export enum CalendarProviderName {
-  Google = 'google',
-  CalDAV = 'caldav',
-}
+import { CalendarProviderFactory, CalendarProviderName } from './factory';
 
 export interface CalendarProviderTokens {
   accessToken: string;

packages/backend/server/src/plugins/calendar/providers/factory.ts

@@ -1,12 +1,20 @@
 import { Injectable, Logger } from '@nestjs/common';
 
-import type { CalendarProvider } from './def';
-import { CalendarProviderName } from './def';
+export enum CalendarProviderName {
+  Google = 'google',
+  CalDAV = 'caldav',
+}
+
+export interface CalendarProviderRef {
+  provider: CalendarProviderName;
+}
 
 @Injectable()
-export class CalendarProviderFactory {
+export class CalendarProviderFactory<
+  TProvider extends CalendarProviderRef = CalendarProviderRef,
+> {
   private readonly logger = new Logger(CalendarProviderFactory.name);
-  readonly #providers = new Map<CalendarProviderName, CalendarProvider>();
+  readonly #providers = new Map<CalendarProviderName, TProvider>();
 
   get providers() {
     return Array.from(this.#providers.keys());
@@ -16,12 +24,12 @@ export class CalendarProviderFactory {
     return this.#providers.get(name);
   }
 
-  register(provider: CalendarProvider) {
+  register(provider: TProvider) {
     this.#providers.set(provider.provider, provider);
     this.logger.log(`Calendar provider [${provider.provider}] registered.`);
   }
 
-  unregister(provider: CalendarProvider) {
+  unregister(provider: TProvider) {
     this.#providers.delete(provider.provider);
     this.logger.log(`Calendar provider [${provider.provider}] unregistered.`);
   }

packages/backend/server/src/plugins/calendar/providers/google.ts

@@ -1,17 +1,17 @@
 import { Injectable } from '@nestjs/common';
 
 import { CalendarProviderRequestError } from '../../../base';
-import { CalendarProvider } from './def';
 import {
+  CalendarProvider,
   CalendarProviderEvent,
   CalendarProviderListCalendarsParams,
   CalendarProviderListEventsParams,
   CalendarProviderListEventsResult,
-  CalendarProviderName,
   CalendarProviderTokens,
   CalendarProviderWatchParams,
   CalendarProviderWatchResult,
 } from './def';
+import { CalendarProviderName } from './factory';
 
 export class CalendarSyncTokenInvalid extends Error {
   readonly code = 'calendar_sync_token_invalid';

packages/backend/server/src/plugins/calendar/providers/index.ts

@@ -14,9 +14,8 @@ export type {
   CalendarProviderWatchParams,
   CalendarProviderWatchResult,
 } from './def';
-export { CalendarProviderName } from './def';
 export { CalendarProvider } from './def';
-export { CalendarProviderFactory } from './factory';
+export { CalendarProviderFactory, CalendarProviderName } from './factory';
 export { CalendarSyncTokenInvalid, GoogleCalendarProvider } from './google';
 
 export const CalendarProviders = [GoogleCalendarProvider, CalDAVProvider];

packages/backend/server/src/plugins/calendar/service.ts

@@ -18,10 +18,10 @@ import {
   CalendarProvider,
   CalendarProviderEvent,
   CalendarProviderEventTime,
+  CalendarProviderFactory,
   CalendarProviderName,
   CalendarSyncTokenInvalid,
 } from './providers';
-import { CalendarProviderFactory } from './providers';
 import type { LinkCalDAVAccountInput } from './types';
 
 const TOKEN_REFRESH_SKEW_MS = 60 * 1000;
@@ -35,7 +35,7 @@ export class CalendarService {
 
   constructor(
     private readonly models: Models,
-    private readonly providerFactory: CalendarProviderFactory,
+    private readonly providerFactory: CalendarProviderFactory<CalendarProvider>,
     private readonly mutex: Mutex,
     private readonly config: Config,
     private readonly url: URLHelper
@@ -105,11 +105,11 @@ export class CalendarService {
       const accessToken = accountTokens.accessToken;
       if (accessToken) {
         await Promise.allSettled(
-          needToStopChannel.map(s => {
+          needToStopChannel.map(async s => {
             if (!s.customChannelId || !s.customResourceId) {
-              return Promise.resolve();
+              return;
             }
-            return provider.stopChannel?.({
+            return await provider.stopChannel?.({
               accessToken,
               channelId: s.customChannelId,
               resourceId: s.customResourceId,
@@ -654,8 +654,11 @@ export class CalendarService {
     }
 
     const zone = time.timeZone ?? fallbackTimezone ?? 'UTC';
+    if (!time.date) {
+      throw new Error('Calendar provider returned all-day event without date');
+    }
     return {
-      date: this.convertDateToUtc(time.date!, zone),
+      date: this.convertDateToUtc(time.date, zone),
       allDay: true,
     };
   }

packages/backend/server/src/plugins/copilot/context/resolver.ts

@@ -49,7 +49,7 @@ import {
   FileChunkSimilarity,
   Models,
 } from '../../../models';
-import { CopilotEmbeddingJob } from '../embedding';
+import { CopilotEmbeddingJob } from '../embedding/job';
 import { COPILOT_LOCKER, CopilotType } from '../resolver';
 import { ChatSessionService } from '../session';
 import { CopilotStorage } from '../storage';

packages/backend/server/src/plugins/copilot/context/service.ts

@@ -15,7 +15,8 @@ import {
   ContextFile,
   Models,
 } from '../../../models';
-import { type EmbeddingClient, getEmbeddingClient } from '../embedding';
+import { getEmbeddingClient } from '../embedding/client';
+import type { EmbeddingClient } from '../embedding/types';
 import { ContextSession } from './session';
 
 const CONTEXT_SESSION_KEY = 'context-session';

packages/backend/server/src/plugins/copilot/context/session.ts

@@ -11,7 +11,7 @@ import {
   FileChunkSimilarity,
   Models,
 } from '../../../models';
-import { EmbeddingClient } from '../embedding';
+import { EmbeddingClient } from '../embedding/types';
 
 export class ContextSession implements AsyncDisposable {
   constructor(

packages/backend/server/src/plugins/copilot/controller.ts

@@ -47,14 +47,14 @@ import {
 } from '../../base';
 import { ServerFeature, ServerService } from '../../core';
 import { CurrentUser, Public } from '../../core/auth';
-import { CopilotContextService } from './context';
+import { CopilotContextService } from './context/service';
+import { CopilotProviderFactory } from './providers/factory';
+import type { CopilotProvider } from './providers/provider';
 import {
-  CopilotProvider,
-  CopilotProviderFactory,
   ModelInputType,
   ModelOutputType,
-  StreamObject,
-} from './providers';
+  type StreamObject,
+} from './providers/types';
 import { StreamObjectParser } from './providers/utils';
 import { ChatSession, ChatSessionService } from './session';
 import { CopilotStorage } from './storage';
@@ -560,7 +560,7 @@ export class CopilotController implements BeforeApplicationShutdown {
                         status: data.status,
                         id: data.node.id,
                         type: data.node.config.nodeType,
-                      } as any,
+                      },
                     };
                 }
               })

packages/backend/server/src/plugins/copilot/embedding/client.ts

@@ -12,14 +12,14 @@ import {
   Embedding,
   EMBEDDING_DIMENSIONS,
 } from '../../../models';
-import { PromptService } from '../prompt';
+import { PromptService } from '../prompt/service';
+import { CopilotProviderFactory } from '../providers/factory';
+import type { CopilotProvider } from '../providers/provider';
 import {
-  type CopilotProvider,
-  CopilotProviderFactory,
   type ModelFullConditions,
   ModelInputType,
   ModelOutputType,
-} from '../providers';
+} from '../providers/types';
 import { EmbeddingClient, type ReRankResult } from './types';
 
 const EMBEDDING_MODEL = 'gemini-embedding-001';

packages/backend/server/src/plugins/copilot/mcp/provider.ts

@@ -8,7 +8,7 @@ import { DocReader, DocWriter } from '../../../core/doc';
 import { AccessController } from '../../../core/permission';
 import { clearEmbeddingChunk } from '../../../models';
 import { IndexerService } from '../../indexer';
-import { CopilotContextService } from '../context';
+import { CopilotContextService } from '../context/service';
 
 @Injectable()
 export class WorkspaceMcpProvider {

packages/backend/server/src/plugins/copilot/prompt/chat-prompt.ts

@@ -4,7 +4,11 @@ import { AiPrompt } from '@prisma/client';
 import Mustache from 'mustache';
 
 import { getTokenEncoder } from '../../../native';
-import { PromptConfig, PromptMessage, PromptParams } from '../providers';
+import type {
+  PromptConfig,
+  PromptMessage,
+  PromptParams,
+} from '../providers/types';
 
 // disable escaping
 Mustache.escape = (text: string) => text;

packages/backend/server/src/plugins/copilot/prompt/prompts.ts

@@ -1,7 +1,7 @@
 import { Logger } from '@nestjs/common';
 import { AiPrompt, PrismaClient } from '@prisma/client';
 
-import { PromptConfig, PromptMessage } from '../providers';
+import type { PromptConfig, PromptMessage } from '../providers/types';
 
 type Prompt = Omit<
   AiPrompt,

packages/backend/server/src/plugins/copilot/prompt/service.ts

@@ -8,7 +8,7 @@ import {
   PromptConfigSchema,
   PromptMessage,
   PromptMessageSchema,
-} from '../providers';
+} from '../providers/types';
 import { ChatPrompt } from './chat-prompt';
 import {
   CopilotPromptScenario,

packages/backend/server/src/plugins/copilot/providers/provider.ts

@@ -13,8 +13,8 @@ import { DocReader, DocWriter } from '../../../core/doc';
 import { AccessController } from '../../../core/permission';
 import { Models } from '../../../models';
 import { IndexerService } from '../../indexer';
-import { CopilotContextService } from '../context';
-import { PromptService } from '../prompt';
+import { CopilotContextService } from '../context/service';
+import { PromptService } from '../prompt/service';
 import {
   buildBlobContentGetter,
   buildContentGetter,

packages/backend/server/src/plugins/copilot/resolver.ts

@@ -42,9 +42,9 @@ import { AccessController, DocAction } from '../../core/permission';
 import { UserType } from '../../core/user';
 import type { ListSessionOptions, UpdateChatSession } from '../../models';
 import { CopilotCronJobs } from './cron';
-import { PromptService } from './prompt';
-import { PromptMessage, StreamObject } from './providers';
+import { PromptService } from './prompt/service';
 import { CopilotProviderFactory } from './providers/factory';
+import type { PromptMessage, StreamObject } from './providers/types';
 import { ChatSessionService } from './session';
 import { CopilotStorage } from './storage';
 import { type ChatHistory, type ChatMessage, SubmittedMessage } from './types';

packages/backend/server/src/plugins/copilot/session.ts

@@ -28,13 +28,14 @@ import {
 import { SubscriptionService } from '../payment/service';
 import { SubscriptionPlan, SubscriptionStatus } from '../payment/types';
 import { ChatMessageCache } from './message';
-import { ChatPrompt, PromptService } from './prompt';
+import { ChatPrompt } from './prompt/chat-prompt';
+import { PromptService } from './prompt/service';
+import { CopilotProviderFactory } from './providers/factory';
 import {
-  CopilotProviderFactory,
   ModelOutputType,
-  PromptMessage,
-  PromptParams,
-} from './providers';
+  type PromptMessage,
+  type PromptParams,
+} from './providers/types';
 import {
   type ChatHistory,
   type ChatMessage,
@@ -322,7 +323,7 @@ export class ChatSessionService {
 
   private stripNullBytes(value?: string | null): string {
     if (!value) return '';
-    return value.replace(/\u0000/g, '');
+    return value.replaceAll('\0', '');
   }
 
   private isNullByteError(error: unknown): boolean {

packages/backend/server/src/plugins/copilot/tools/blob-read.ts

@@ -3,9 +3,8 @@ import { tool } from 'ai';
 import { z } from 'zod';
 
 import { AccessController } from '../../../core/permission';
-import type { ContextSession } from '../context/session';
-import type { CopilotChatOptions } from '../providers';
 import { toolError } from './error';
+import type { ContextSession, CopilotChatOptions } from './types';
 
 const logger = new Logger('ContextBlobReadTool');
 

packages/backend/server/src/plugins/copilot/tools/code-artifact.ts

@@ -2,9 +2,9 @@ import { Logger } from '@nestjs/common';
 import { tool } from 'ai';
 import { z } from 'zod';
 
-import type { PromptService } from '../prompt';
-import type { CopilotProviderFactory } from '../providers';
 import { toolError } from './error';
+import type { CopilotProviderFactory, PromptService } from './types';
+
 const logger = new Logger('CodeArtifactTool');
 /**
  * A copilot tool that produces a completely self-contained HTML artifact.