fix: remove client compression script

* rework filtering behaviour

* fix classification bug

Dockerfile

@@ -1,7 +1,7 @@
 FROM node:26-slim AS base
 LABEL org.opencontainers.image.source="https://github.com/docmost/docmost"
 
-RUN npm install -g pnpm@11.15.1
+RUN npm install -g pnpm@11.23.0
 
 FROM base AS builder
 
@@ -18,6 +18,15 @@ RUN apt-get update \
   && apt-get install -y --no-install-recommends curl bash \
   && rm -rf /var/lib/apt/lists/*
 
+# drop npm and corepack
+RUN rm -rf /usr/local/lib/node_modules/npm \
+  && rm -rf /usr/local/lib/node_modules/corepack \
+  && rm -rf /usr/local/bin/npm \
+  && rm -rf /usr/local/bin/npx \
+  && rm -rf /usr/local/bin/corepack \
+  && rm -rf /root/.npm \
+  && rm -rf /root/.node-gyp
+
 WORKDIR /app
 
 # Copy apps

apps/client/package.json

@@ -52,7 +52,7 @@
     "mantine-form-zod-resolver": "1.3.0",
     "mermaid": "11.16.1",
     "mitt": "3.0.1",
-    "nanoid": "3.3.17",
+    "nanoid": "3.3.18",
     "posthog-js": "1.391.2",
     "react": "19.2.7",
     "react-clear-modal": "^2.0.18",
@@ -64,6 +64,7 @@
     "react-router-dom": "7.18.2",
     "semver": "7.7.4",
     "socket.io-client": "4.8.3",
+    "yet-another-react-lightbox": "^3.32.2",
     "zod": "4.3.6"
   },
   "devDependencies": {

apps/client/public/locales/de-DE/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Upgrade Ihres Plans",
   "Available with a paid license": "Verfügbar mit einer kostenpflichtigen Lizenz",
   "Upgrade your license tier.": "Stufen Sie Ihre Lizenz hoch.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "KI ist nur in der Docmost Enterprise-Edition verfügbar. Kontaktieren Sie sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "KI ist in den kostenpflichtigen Docmost-Editionen verfügbar. Kontaktieren Sie sales@docmost.com.",
   "AI & MCP": "KI & MCP",
   "AI": "KI",
   "MCP": "MCP",

apps/client/public/locales/en-US/translation.json

@@ -294,6 +294,7 @@
   "Export space": "Export space",
   "Export {{type}}": "Export {{type}}",
   "File exceeds the {{limit}} attachment limit": "File exceeds the {{limit}} attachment limit",
+  "Media": "Media",
   "Align left": "Align left",
   "Align right": "Align right",
   "Align center": "Align center",
@@ -698,7 +699,7 @@
   "Upgrade your plan": "Upgrade your plan",
   "Available with a paid license": "Available with a paid license",
   "Upgrade your license tier.": "Upgrade your license tier.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI is available in the Docmost paid editions. Contact sales@docmost.com.",
   "AI & MCP": "AI & MCP",
   "AI": "AI",
   "MCP": "MCP",
@@ -1302,5 +1303,13 @@
   "Error loading attachments.": "Error loading attachments.",
   "No attachments on this page yet.": "No attachments on this page yet.",
   "Uploaded by {{name}}": "Uploaded by {{name}}",
-  "Download {{name}}": "Download {{name}}"
+  "Download {{name}}": "Download {{name}}",
+  "Workspace knowledge only": "Workspace knowledge only",
+  "Restrict AI Chat to answering from your workspace pages and uploaded files only. It will not use outside knowledge.": "Restrict AI Chat to answering from your workspace pages and uploaded files only. It will not use outside knowledge.",
+  "Toggle workspace knowledge only": "Toggle workspace knowledge only",
+  "Read-only mode": "Read-only mode",
+  "AI Chat can search and read workspace content, but cannot create or edit pages.": "AI Chat can search and read workspace content, but cannot create or edit pages.",
+  "Toggle AI Chat read-only mode": "Toggle AI Chat read-only mode",
+  "Title only": "Title only",
+  "you": "you"
 }

apps/client/public/locales/es-ES/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Mejora tu plan",
   "Available with a paid license": "Disponible con una licencia de pago",
   "Upgrade your license tier.": "Mejora el nivel de tu licencia.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "La IA solo está disponible en la edición empresarial de Docmost. Contacte con sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "La IA está disponible en las ediciones de pago de Docmost. Contacte con sales@docmost.com.",
   "AI & MCP": "IA y MCP",
   "AI": "IA",
   "MCP": "MCP",

apps/client/public/locales/fr-FR/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Mettez à niveau votre forfait",
   "Available with a paid license": "Disponible avec une licence payante",
   "Upgrade your license tier.": "Mettez à niveau votre niveau de licence.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "L'IA n'est disponible que dans l'édition Entreprise de Docmost. Contactez sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "L'IA est disponible dans les éditions payantes de Docmost. Contactez sales@docmost.com.",
   "AI & MCP": "IA & MCP",
   "AI": "IA",
   "MCP": "MCP",

apps/client/public/locales/it-IT/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Aggiorna il tuo piano",
   "Available with a paid license": "Disponibile con una licenza a pagamento",
   "Upgrade your license tier.": "Aggiorna il livello della tua licenza.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "L'IA è disponibile solo nell'edizione Enterprise di Docmost. Contatta sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "L'IA è disponibile nelle edizioni a pagamento di Docmost. Contatta sales@docmost.com.",
   "AI & MCP": "IA e MCP",
   "AI": "IA",
   "MCP": "MCP",

apps/client/public/locales/ja-JP/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "プランをアップグレードする",
   "Available with a paid license": "有料ライセンスで利用可能",
   "Upgrade your license tier.": "ライセンスタイアをアップグレードしてください。",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI は Docmost のエンタープライズ版でのみ利用可能です。sales@docmost.com までお問い合わせください。",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI は Docmost の有料版で利用可能です。sales@docmost.com までお問い合わせください。",
   "AI & MCP": "AI と MCP",
   "AI": "AI",
   "MCP": "MCP",

apps/client/public/locales/ko-KR/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "요금제를 업그레이드하세요",
   "Available with a paid license": "유료 라이선스에서만 사용 가능합니다",
   "Upgrade your license tier.": "라이선스 등급을 업그레이드하세요.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI는 Docmost 엔터프라이즈 에디션에서만 제공됩니다. sales@docmost.com으로 문의하세요.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI는 Docmost 유료 에디션에서 제공됩니다. sales@docmost.com으로 문의하세요.",
   "AI & MCP": "AI 및 MCP",
   "AI": "AI",
   "MCP": "MCP",

apps/client/public/locales/nl-NL/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Upgrade je abonnement",
   "Available with a paid license": "Beschikbaar met een betaalde licentie",
   "Upgrade your license tier.": "Upgrade je licentieniveau.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI is alleen beschikbaar in de Docmost Enterprise-editie. Neem contact op met sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI is beschikbaar in de betaalde edities van Docmost. Neem contact op met sales@docmost.com.",
   "AI & MCP": "AI & MCP",
   "AI": "AI",
   "MCP": "MCP",

apps/client/public/locales/pt-BR/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Faça upgrade do seu plano",
   "Available with a paid license": "Disponível com uma licença paga",
   "Upgrade your license tier.": "Faça upgrade do seu nível de licença.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "A IA está disponível apenas na edição empresarial do Docmost. Contate sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "A IA está disponível nas edições pagas do Docmost. Contate sales@docmost.com.",
   "AI & MCP": "IA e MCP",
   "AI": "IA",
   "MCP": "MCP",

apps/client/public/locales/ru-RU/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Обновите свой тарифный план",
   "Available with a paid license": "Доступно с платной лицензией",
   "Upgrade your license tier.": "Обновите уровень вашей лицензии.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "ИИ доступен только в корпоративной версии Docmost. Свяжитесь по адресу sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "ИИ доступен в платных версиях Docmost. Свяжитесь по адресу sales@docmost.com.",
   "AI & MCP": "ИИ и MCP",
   "AI": "ИИ",
   "MCP": "MCP",

apps/client/public/locales/uk-UA/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "Оновіть свій тарифний план",
   "Available with a paid license": "Доступно за платною ліцензією",
   "Upgrade your license tier.": "Оновіть рівень своєї ліцензії.",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "ШІ доступний лише в корпоративній редакції Docmost. Зверніться до sales@docmost.com.",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "ШІ доступний у платних редакціях Docmost. Зверніться до sales@docmost.com.",
   "AI & MCP": "ШІ та MCP",
   "AI": "ШІ",
   "MCP": "MCP",

apps/client/public/locales/zh-CN/translation.json

@@ -696,7 +696,7 @@
   "Upgrade your plan": "升级您的方案",
   "Available with a paid license": "需付费许可才可用",
   "Upgrade your license tier.": "升级您的许可等级。",
-  "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.": "AI 仅在 Docmost 企业版中提供。请联系 sales@docmost.com。",
+  "AI is available in the Docmost paid editions. Contact sales@docmost.com.": "AI 在 Docmost 付费版中提供。请联系 sales@docmost.com。",
   "AI & MCP": "AI 与 MCP",
   "AI": "AI",
   "MCP": "MCP",

apps/client/src/App.tsx

@@ -1,60 +1,92 @@
+import { lazy, Suspense, useEffect } from "react";
 import { Navigate, Route, Routes } from "react-router-dom";
-import SetupWorkspace from "@/pages/auth/setup-workspace.tsx";
-import LoginPage from "@/pages/auth/login";
-import Home from "@/pages/dashboard/home";
-import Page from "@/pages/page/page";
-import AccountSettings from "@/pages/settings/account/account-settings";
-import WorkspaceMembers from "@/pages/settings/workspace/workspace-members";
-import WorkspaceSettings from "@/pages/settings/workspace/workspace-settings";
-import Groups from "@/pages/settings/group/groups";
-import GroupInfo from "./pages/settings/group/group-info";
-import Spaces from "@/pages/settings/space/spaces.tsx";
-import { Error404 } from "@/components/ui/error-404.tsx";
-import AccountPreferences from "@/pages/settings/account/account-preferences.tsx";
-import SpaceHome from "@/pages/space/space-home.tsx";
-import PageRedirect from "@/pages/page/page-redirect.tsx";
 import Layout from "@/components/layouts/global/layout.tsx";
-import InviteSignup from "@/pages/auth/invite-signup.tsx";
+import { Error404 } from "@/components/ui/error-404.tsx";
-import ForgotPassword from "@/pages/auth/forgot-password.tsx";
-import PasswordReset from "./pages/auth/password-reset";
-import Billing from "@/ee/billing/pages/billing.tsx";
-import CloudLogin from "@/ee/pages/cloud-login.tsx";
-import CreateWorkspace from "@/ee/pages/create-workspace.tsx";
 import { isCloud } from "@/lib/config.ts";
 import { useTranslation } from "react-i18next";
-import Security from "@/ee/security/pages/security.tsx";
-import License from "@/ee/licence/pages/license.tsx";
 import { useRedirectToCloudSelect } from "@/ee/hooks/use-redirect-to-cloud-select.tsx";
-import SharedPage from "@/pages/share/shared-page.tsx";
-import PdfRenderPage from "@/ee/pdf-export/pdf-render-page.tsx";
-import Shares from "@/pages/settings/shares/shares.tsx";
-import ShareLayout from "@/features/share/components/share-layout.tsx";
-import ShareRedirect from "@/pages/share/share-redirect.tsx";
 import { useTrackOrigin } from "@/hooks/use-track-origin";
-import SpacesPage from "@/pages/spaces/spaces.tsx";
+
-import { MfaChallengePage } from "@/ee/mfa/pages/mfa-challenge-page";
+const SetupWorkspace = lazy(() => import("@/pages/auth/setup-workspace.tsx"));
-import { MfaSetupRequiredPage } from "@/ee/mfa/pages/mfa-setup-required-page";
+const LoginPage = lazy(() => import("@/pages/auth/login"));
-import SpaceTrash from "@/pages/space/space-trash.tsx";
+const Home = lazy(() => import("@/pages/dashboard/home"));
-import UserApiKeys from "@/ee/api-key/pages/user-api-keys";
+const Page = lazy(() => import("@/pages/page/page"));
-import WorkspaceApiKeys from "@/ee/api-key/pages/workspace-api-keys";
+const AccountSettings = lazy(
-import AiSettings from "@/ee/ai/pages/ai-settings.tsx";
+  () => import("@/pages/settings/account/account-settings"),
-import BasePage from "@/ee/base/pages/base-page.tsx";
+);
-import AuditLogs from "@/ee/audit/pages/audit-logs.tsx";
+const WorkspaceMembers = lazy(
-import VerifiedPages from "@/ee/page-verification/pages/verified-pages.tsx";
+  () => import("@/pages/settings/workspace/workspace-members"),
-import TemplateList from "@/ee/template/pages/template-list";
+);
-import TemplateEditor from "@/ee/template/pages/template-editor";
+const WorkspaceSettings = lazy(
-import FavoritesPage from "@/pages/favorites/favorites-page";
+  () => import("@/pages/settings/workspace/workspace-settings"),
-import AiChat from "@/ee/ai-chat/pages/ai-chat.tsx";
+);
-import VerifyEmail from "@/ee/pages/verify-email.tsx";
+const Groups = lazy(() => import("@/pages/settings/group/groups"));
-import LabelPage from "@/pages/label/label-page";
+const GroupInfo = lazy(() => import("./pages/settings/group/group-info"));
+const Spaces = lazy(() => import("@/pages/settings/space/spaces.tsx"));
+const AccountPreferences = lazy(
+  () => import("@/pages/settings/account/account-preferences.tsx"),
+);
+const SpaceHome = lazy(() => import("@/pages/space/space-home.tsx"));
+const PageRedirect = lazy(() => import("@/pages/page/page-redirect.tsx"));
+const InviteSignup = lazy(() => import("@/pages/auth/invite-signup.tsx"));
+const ForgotPassword = lazy(() => import("@/pages/auth/forgot-password.tsx"));
+const PasswordReset = lazy(() => import("./pages/auth/password-reset"));
+const Billing = lazy(() => import("@/ee/billing/pages/billing.tsx"));
+const CloudLogin = lazy(() => import("@/ee/pages/cloud-login.tsx"));
+const CreateWorkspace = lazy(() => import("@/ee/pages/create-workspace.tsx"));
+const Security = lazy(() => import("@/ee/security/pages/security.tsx"));
+const License = lazy(() => import("@/ee/licence/pages/license.tsx"));
+const SharedPage = lazy(() => import("@/pages/share/shared-page.tsx"));
+const PdfRenderPage = lazy(() => import("@/ee/pdf-export/pdf-render-page.tsx"));
+const Shares = lazy(() => import("@/pages/settings/shares/shares.tsx"));
+const ShareLayout = lazy(
+  () => import("@/features/share/components/share-layout.tsx"),
+);
+const ShareRedirect = lazy(() => import("@/pages/share/share-redirect.tsx"));
+const SpacesPage = lazy(() => import("@/pages/spaces/spaces.tsx"));
+const MfaChallengePage = lazy(() =>
+  import("@/ee/mfa/pages/mfa-challenge-page").then((m) => ({
+    default: m.MfaChallengePage,
+  })),
+);
+const MfaSetupRequiredPage = lazy(() =>
+  import("@/ee/mfa/pages/mfa-setup-required-page").then((m) => ({
+    default: m.MfaSetupRequiredPage,
+  })),
+);
+const SpaceTrash = lazy(() => import("@/pages/space/space-trash.tsx"));
+const UserApiKeys = lazy(() => import("@/ee/api-key/pages/user-api-keys"));
+const WorkspaceApiKeys = lazy(
+  () => import("@/ee/api-key/pages/workspace-api-keys"),
+);
+const AiSettings = lazy(() => import("@/ee/ai/pages/ai-settings.tsx"));
+const BasePage = lazy(() => import("@/ee/base/pages/base-page.tsx"));
+const AuditLogs = lazy(() => import("@/ee/audit/pages/audit-logs.tsx"));
+const VerifiedPages = lazy(
+  () => import("@/ee/page-verification/pages/verified-pages.tsx"),
+);
+const TemplateList = lazy(() => import("@/ee/template/pages/template-list"));
+const TemplateEditor = lazy(
+  () => import("@/ee/template/pages/template-editor"),
+);
+const FavoritesPage = lazy(() => import("@/pages/favorites/favorites-page"));
+const AiChat = lazy(() => import("@/ee/ai-chat/pages/ai-chat.tsx"));
+const VerifyEmail = lazy(() => import("@/ee/pages/verify-email.tsx"));
+const LabelPage = lazy(() => import("@/pages/label/label-page"));
 
 export default function App() {
   const { t } = useTranslation();
   useRedirectToCloudSelect();
   useTrackOrigin();
 
+  useEffect(() => {
+    // warm the editor chunk so opening a page doesn't wait on the network
+    const timer = setTimeout(() => import("@/pages/page/page"), 3000);
+    return () => clearTimeout(timer);
+  }, []);
+
   return (
-    <>
+    <Suspense fallback={null}>
       <Routes>
         <Route index element={<Navigate to="/home" />} />
         <Route path={"/login"} element={<LoginPage />} />
@@ -135,6 +167,6 @@ export default function App() {
 
         <Route path="*" element={<Error404 />} />
       </Routes>
-    </>
+    </Suspense>
   );
 }

apps/client/src/components/layouts/global/aside.tsx

@@ -1,17 +1,30 @@
 import { ActionIcon, Box, Group, ScrollArea, Title, Tooltip } from "@mantine/core";
 import { IconX } from "@tabler/icons-react";
-import CommentListWithTabs from "@/features/comment/components/comment-list-with-tabs.tsx";
 import { useAtom } from "jotai";
 import { asideStateAtom } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
-import React, { ReactNode, useEffect } from "react";
+import React, { lazy, ReactNode, Suspense, useEffect } from "react";
 import { useTranslation } from "react-i18next";
-import { TableOfContents } from "@/features/editor/components/table-of-contents/table-of-contents.tsx";
 import { useAtomValue } from "jotai";
 import { pageEditorAtom } from "@/features/editor/atoms/editor-atoms.ts";
-import AsideChatPanel from "@/ee/ai-chat/components/aside-chat-panel";
-import { PageDetailsAside } from "@/features/page-details/components/page-details-aside.tsx";
 import { ASIDE_PANEL_ID } from "@/hooks/use-toggle-aside.tsx";
 
+const CommentListWithTabs = lazy(
+  () => import("@/features/comment/components/comment-list-with-tabs.tsx"),
+);
+const TableOfContents = lazy(() =>
+  import(
+    "@/features/editor/components/table-of-contents/table-of-contents.tsx"
+  ).then((m) => ({ default: m.TableOfContents })),
+);
+const AsideChatPanel = lazy(
+  () => import("@/ee/ai-chat/components/aside-chat-panel"),
+);
+const PageDetailsAside = lazy(() =>
+  import("@/features/page-details/components/page-details-aside.tsx").then(
+    (m) => ({ default: m.PageDetailsAside }),
+  ),
+);
+
 export default function Aside() {
   const [{ tab, isAsideOpen }, setAsideState] = useAtom(asideStateAtom);
   const { t } = useTranslation();
@@ -68,6 +81,7 @@ export default function Aside() {
             </Group>
           )}
 
+          <Suspense fallback={null}>
             {tab === "comments" || tab === "chat" ? (
               component
             ) : (
@@ -79,6 +93,7 @@ export default function Aside() {
                 <div style={{ paddingBottom: "200px" }}>{component}</div>
               </ScrollArea>
             )}
+          </Suspense>
         </>
       )}
     </Box>

apps/client/src/components/layouts/global/global-app-shell.tsx

@@ -11,7 +11,10 @@ import {
   sidebarWidthAtom,
 } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
 import { SpaceSidebar } from "@/features/space/components/sidebar/space-sidebar.tsx";
-import AiChatSidebar from "@/ee/ai-chat/components/ai-chat-sidebar.tsx";
+
+const AiChatSidebar = React.lazy(
+  () => import("@/ee/ai-chat/components/ai-chat-sidebar.tsx"),
+);
 import { AppHeader } from "@/components/layouts/global/app-header.tsx";
 import Aside from "@/components/layouts/global/aside.tsx";
 import classes from "./app-shell.module.css";
@@ -126,7 +129,11 @@ export default function GlobalAppShell({
         )}
         {isSpaceRoute && <SpaceSidebar />}
         {isSettingsRoute && <SettingsSidebar />}
-        {isAiRoute && <AiChatSidebar />}
+        {isAiRoute && (
+          <React.Suspense fallback={null}>
+            <AiChatSidebar />
+          </React.Suspense>
+        )}
         {showGlobalSidebar && <GlobalSidebar />}
       </AppShell.Navbar>
       <AppShell.Main id={MAIN_CONTENT_ID} tabIndex={-1}>

apps/client/src/components/ui/checkbox-menu-item.tsx

@@ -0,0 +1,12 @@
+import { UnstyledButton } from "@mantine/core";
+import { type ComponentPropsWithoutRef, forwardRef } from "react";
+
+// Menu.Item hard-codes role="menuitem"; use as its `component` to restore role="menuitemcheckbox" so aria-checked works.
+export const CheckboxMenuItem = forwardRef<
+  HTMLButtonElement,
+  ComponentPropsWithoutRef<"button">
+>((props, ref) => (
+  <UnstyledButton ref={ref} {...props} role="menuitemcheckbox" />
+));
+
+CheckboxMenuItem.displayName = "CheckboxMenuItem";

apps/client/src/ee/ai-chat/components/ai-chat-read-only.tsx

@@ -0,0 +1,74 @@
+import { Badge, Group, Text, Switch, Tooltip } from "@mantine/core";
+import { useAtom } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { updateWorkspace } from "@/features/workspace/services/workspace-service.ts";
+import { notifications } from "@mantine/notifications";
+import { useHasFeature } from "@/ee/hooks/use-feature";
+import { Feature } from "@/ee/features";
+import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
+
+export default function AiChatReadOnly() {
+  const { t } = useTranslation();
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+
+  return (
+    <Group justify="space-between" wrap="nowrap" gap="xl">
+      <div>
+        <Group gap="xs" align="center">
+          <Text size="md">{t("Read-only mode")}</Text>
+          {!hasAccess && (
+            <Badge variant="light" size="sm" radius="sm">
+              {t("Enterprise")}
+            </Badge>
+          )}
+        </Group>
+        <Text size="sm" c="dimmed">
+          {t(
+            "AI Chat can search and read workspace content, but cannot create or edit pages.",
+          )}
+        </Text>
+      </div>
+
+      <AiChatReadOnlyToggle />
+    </Group>
+  );
+}
+
+function AiChatReadOnlyToggle() {
+  const { t } = useTranslation();
+  const [workspace, setWorkspace] = useAtom(workspaceAtom);
+  const [checked, setChecked] = useState(
+    workspace?.settings?.ai?.chatReadOnly,
+  );
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+  const upgradeLabel = useUpgradeLabel();
+
+  const handleChange = async (event: React.ChangeEvent<HTMLInputElement>) => {
+    const value = event.currentTarget.checked;
+    try {
+      const updatedWorkspace = await updateWorkspace({
+        aiChatReadOnly: value,
+      });
+      setChecked(value);
+      setWorkspace(updatedWorkspace);
+    } catch (err: any) {
+      notifications.show({
+        message: err?.response?.data?.message,
+        color: "red",
+      });
+    }
+  };
+
+  return (
+    <Tooltip label={upgradeLabel} disabled={hasAccess} refProp="rootRef">
+      <Switch
+        defaultChecked={checked}
+        onChange={handleChange}
+        disabled={!hasAccess}
+        aria-label={t("Toggle AI Chat read-only mode")}
+      />
+    </Tooltip>
+  );
+}

apps/client/src/ee/ai-chat/components/ai-chat-workspace-knowledge-only.tsx

@@ -0,0 +1,74 @@
+import { Badge, Group, Text, Switch, Tooltip } from "@mantine/core";
+import { useAtom } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import { updateWorkspace } from "@/features/workspace/services/workspace-service.ts";
+import { notifications } from "@mantine/notifications";
+import { useHasFeature } from "@/ee/hooks/use-feature";
+import { Feature } from "@/ee/features";
+import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
+
+export default function AiChatWorkspaceKnowledgeOnly() {
+  const { t } = useTranslation();
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+
+  return (
+    <Group justify="space-between" wrap="nowrap" gap="xl">
+      <div>
+        <Group gap="xs" align="center">
+          <Text size="md">{t("Workspace knowledge only")}</Text>
+          {!hasAccess && (
+            <Badge variant="light" size="sm" radius="sm">
+              {t("Enterprise")}
+            </Badge>
+          )}
+        </Group>
+        <Text size="sm" c="dimmed">
+          {t(
+            "Restrict AI Chat to answering from your workspace pages and uploaded files only. It will not use outside knowledge.",
+          )}
+        </Text>
+      </div>
+
+      <AiChatWorkspaceKnowledgeOnlyToggle />
+    </Group>
+  );
+}
+
+function AiChatWorkspaceKnowledgeOnlyToggle() {
+  const { t } = useTranslation();
+  const [workspace, setWorkspace] = useAtom(workspaceAtom);
+  const [checked, setChecked] = useState(
+    workspace?.settings?.ai?.chatWorkspaceKnowledgeOnly,
+  );
+  const hasAccess = useHasFeature(Feature.AI_CONTROLS);
+  const upgradeLabel = useUpgradeLabel();
+
+  const handleChange = async (event: React.ChangeEvent<HTMLInputElement>) => {
+    const value = event.currentTarget.checked;
+    try {
+      const updatedWorkspace = await updateWorkspace({
+        aiChatWorkspaceKnowledgeOnly: value,
+      });
+      setChecked(value);
+      setWorkspace(updatedWorkspace);
+    } catch (err: any) {
+      notifications.show({
+        message: err?.response?.data?.message,
+        color: "red",
+      });
+    }
+  };
+
+  return (
+    <Tooltip label={upgradeLabel} disabled={hasAccess} refProp="rootRef">
+      <Switch
+        defaultChecked={checked}
+        onChange={handleChange}
+        disabled={!hasAccess}
+        aria-label={t("Toggle workspace knowledge only")}
+      />
+    </Tooltip>
+  );
+}

apps/client/src/ee/ai-chat/components/chat-empty-state.tsx

@@ -6,7 +6,10 @@ import {
   IconFileText,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
-import ChatInput from "./chat-input";
+import { useAtomValue } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { useRef } from "react";
+import ChatInput, { ChatInputHandle } from "./chat-input";
 import type { ChatAttachment, PageMention } from "../types/ai-chat.types";
 import classes from "../styles/ai-chat.module.css";
 
@@ -14,6 +17,7 @@ type Suggestion = {
   icon: React.ReactNode;
   text: string;
   prompt: string;
+  write?: boolean;
 };
 
 const SUGGESTIONS: Suggestion[] = [
@@ -26,6 +30,7 @@ const SUGGESTIONS: Suggestion[] = [
     icon: <IconFilePlus size={16} />,
     text: "Create a new page",
     prompt: "Create a new page titled ",
+    write: true,
   },
   {
     icon: <IconFileText size={16} />,
@@ -36,6 +41,7 @@ const SUGGESTIONS: Suggestion[] = [
     icon: <IconEdit size={16} />,
     text: "Update page content",
     prompt: "Update the page @",
+    write: true,
   },
 ];
 
@@ -47,9 +53,13 @@ type Props = {
 
 export default function ChatEmptyState({ isStreaming, onSend, onStop }: Props) {
   const { t } = useTranslation();
+  const workspace = useAtomValue(workspaceAtom);
+  const writesDisabled = workspace?.settings?.ai?.chatReadOnly === true;
+
+  const inputRef = useRef<ChatInputHandle>(null);
 
   const handleSuggestionClick = (prompt: string) => {
-    onSend(prompt, [], []);
+    inputRef.current?.prefill(prompt);
   };
 
   return (
@@ -62,6 +72,7 @@ export default function ChatEmptyState({ isStreaming, onSend, onStop }: Props) {
 
       <div className={classes.emptyStateInput}>
         <ChatInput
+          ref={inputRef}
           isStreaming={isStreaming}
           onSend={onSend}
           onStop={onStop}
@@ -73,7 +84,7 @@ export default function ChatEmptyState({ isStreaming, onSend, onStop }: Props) {
       <div className={classes.suggestionsSection}>
         <h2 className={classes.suggestionsLabel}>{t("Get started")}</h2>
         <div className={classes.suggestionsGrid}>
-          {SUGGESTIONS.map((s) => (
+          {SUGGESTIONS.filter((s) => !writesDisabled || !s.write).map((s) => (
             <button
               key={s.text}
               type="button"

apps/client/src/ee/ai-chat/components/chat-input.tsx

@@ -1,4 +1,12 @@
-import { useCallback, useId, useRef, useEffect, useState } from "react";
+import {
+  forwardRef,
+  useCallback,
+  useId,
+  useImperativeHandle,
+  useRef,
+  useEffect,
+  useState,
+} from "react";
 import { useTranslation } from "react-i18next";
 import { IconArrowUp, IconPaperclip, IconPlayerStopFilled, IconX, IconFile, IconPhoto, IconPlus, IconAt, IconFileText } from "@tabler/icons-react";
 import { Popover } from "@mantine/core";
@@ -35,6 +43,10 @@ type Props = {
   chatId?: string;
 };
 
+export type ChatInputHandle = {
+  prefill: (text: string) => void;
+};
+
 function extractMentions(json: any): PageMention[] {
   const mentions: PageMention[] = [];
   const seen = new Set<string>();
@@ -89,7 +101,7 @@ function editorJsonToText(json: any): string {
   return text;
 }
 
-export default function ChatInput({
+const ChatInput = forwardRef<ChatInputHandle, Props>(function ChatInput({
   isStreaming,
   onSend,
   onStop,
@@ -100,7 +112,7 @@ export default function ChatInput({
   variant = "card",
   showDisclaimer = true,
   chatId,
-}: Props) {
+}: Props, ref) {
   const chatIdRef = useRef(chatId);
   chatIdRef.current = chatId;
   const { t } = useTranslation();
@@ -270,6 +282,19 @@ export default function ChatInput({
     }
   }, [editor]);
 
+  useImperativeHandle(
+    ref,
+    () => ({
+      prefill: (text: string) => {
+        if (!editor || editor.isDestroyed) return;
+        editor.commands.clearContent();
+        editor.commands.insertContent(text);
+        editor.commands.focus();
+      },
+    }),
+    [editor],
+  );
+
   const hasContent = !isEmpty || pendingAttachments.some((a) => !a.uploading) || (contextPages?.length ?? 0) > 0;
 
   const wrapperClass = variant === "flat" ? classes.inputWrapperFlat : classes.inputWrapper;
@@ -429,4 +454,6 @@ export default function ChatInput({
     )}
     </>
   );
-}
+});
+
+export default ChatInput;

apps/client/src/ee/ai/pages/ai-settings.tsx

@@ -5,8 +5,10 @@ import { useTranslation } from "react-i18next";
 import EnableAiSearch from "@/ee/ai/components/enable-ai-search.tsx";
 import EnableGenerativeAi from "@/ee/ai/components/enable-generative-ai.tsx";
 import EnableAiChat from "@/ee/ai-chat/components/enable-ai-chat.tsx";
+import AiChatReadOnly from "@/ee/ai-chat/components/ai-chat-read-only.tsx";
+import AiChatWorkspaceKnowledgeOnly from "@/ee/ai-chat/components/ai-chat-workspace-knowledge-only.tsx";
 import McpSettings from "@/ee/ai/components/mcp-settings.tsx";
-import { Alert, Stack, Tabs } from "@mantine/core";
+import { Alert, Collapse, Stack, Tabs } from "@mantine/core";
 import { IconInfoCircle } from "@tabler/icons-react";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
@@ -14,12 +16,16 @@ import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { isCloud } from "@/lib/config.ts";
 import { useLocation, useNavigate } from "react-router-dom";
 import { DocumentTitle } from "@/components/ui/document-title.tsx";
+import { useAtomValue } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
 
 export default function AiSettings() {
   const { t } = useTranslation();
   const { isAdmin } = useUserRole();
   const hasAccess = useHasFeature(Feature.AI);
   const upgradeLabel = useUpgradeLabel();
+  const workspace = useAtomValue(workspaceAtom);
+  const aiChatEnabled = workspace?.settings?.ai?.chat === true;
   const location = useLocation();
   const navigate = useNavigate();
 
@@ -61,7 +67,7 @@ export default function AiSettings() {
               mb="lg"
             >
               {t(
-                "AI is only available in the Docmost enterprise edition. Contact sales@docmost.com.",
+                "AI is available in the Docmost paid editions. Contact sales@docmost.com.",
               )}
             </Alert>
           )}
@@ -70,6 +76,20 @@ export default function AiSettings() {
             {!isCloud() && <EnableAiSearch />}
             <EnableGenerativeAi />
             <EnableAiChat />
+            <Collapse expanded={aiChatEnabled}>
+              <Stack
+                gap="md"
+                pl="md"
+                ml="xs"
+                style={{
+                  borderLeft:
+                    "2px solid light-dark(var(--mantine-color-gray-3), var(--mantine-color-dark-4))",
+                }}
+              >
+                <AiChatReadOnly />
+                <AiChatWorkspaceKnowledgeOnly />
+              </Stack>
+            </Collapse>
           </Stack>
         </Tabs.Panel>
 

apps/client/src/ee/ai/services/ai-search-service.ts

@@ -15,6 +15,14 @@ export interface IAiSearchResponse {
   }>;
 }
 
+export async function hintVectorCache(): Promise<void> {
+  try {
+    await api.post("/ai/vector-cache-hint");
+  } catch {
+    // best-effort cache hint
+  }
+}
+
 export async function aiAnswers(
   params: IPageSearchParams,
   onChunk?: (chunk: { content?: string; sources?: any[] }) => void,

apps/client/src/ee/base/components/views/view-filter-config.tsx

@@ -9,6 +9,7 @@ import {
   Text,
   UnstyledButton,
   Button,
+  MultiSelect,
 } from "@mantine/core";
 import { IconPlus, IconTrash } from "@tabler/icons-react";
 import {
@@ -52,6 +53,9 @@ const NO_VALUE_OPERATORS: FilterOperator[] = ["isEmpty", "isNotEmpty"];
 // stored value so a stale shape isn't sent to the engine.
 function valueClass(op: FilterOperator, inputKind: string): string {
   if (NO_VALUE_OPERATORS.includes(op)) return "none";
+  if (inputKind === "choices") {
+    return op === "any" || op === "none" ? "choicesMulti" : "choicesSingle";
+  }
   if (inputKind === "person") {
     return op === "any" || op === "none" ? "personMulti" : "personSingle";
   }
@@ -70,6 +74,10 @@ function getOperatorsForType(type: string): FilterOperator[] {
     DEFAULT_FILTER_OPERATORS) as FilterOperator[];
 }
 
+function isMultiChoice(op: FilterCondition["op"]): boolean {
+  return op === "any" || op === "none";
+}
+
 function FilterValueInput({
   condition,
   property,
@@ -121,6 +129,32 @@ function FilterValueInput({
     const typeOptions = property.typeOptions as SelectTypeOptions | undefined;
     const choices = typeOptions?.choices ?? [];
     const choiceOptions = choices.map((c) => ({ value: c.id, label: c.name }));
+
+    if (isMultiChoice(condition.op)) {
+      const { value } = condition;
+      const selected = (
+        Array.isArray(value) ? value : value ? [value] : []
+      ).filter((id) => choices.some((c) => c.id === id));
+
+      return (
+        <MultiSelect
+          size="xs"
+          data={choiceOptions}
+          comboboxProps={{ withinPortal: false }}
+          value={selected}
+          onChange={(values) => onChange(values)}
+          w={160}
+          styles={{
+            pillsList: {
+              maxHeight: 70,
+              overflowY: "auto",
+            },
+          }}
+          maxDropdownHeight={220}
+        />
+      );
+    }
+
     return (
       <Select
         size="xs"
@@ -199,11 +233,18 @@ export function ViewFilterConfigPopover({
     label: p.name,
   }));
 
+  const [unSaved, setUnSaved] = useState(false)
   const [draft, setDraft] = useState<FilterCondition | null>(null);
+  const [draftConditions, setDraftConditions] =
+    useState<FilterCondition[]>(conditions);
 
   useEffect(() => {
-    if (!opened) setDraft(null);
+    if (opened) {
-  }, [opened]);
+      setDraftConditions(conditions);
+      setDraft(null);
+      setUnSaved(false)
+    }
+  }, [opened, conditions]);
 
   const handleStartDraft = useCallback(() => {
     const firstProperty = properties[0];
@@ -216,14 +257,21 @@ export function ViewFilterConfigPopover({
   }, [properties]);
 
   const handleSaveDraft = useCallback(() => {
-    if (!draft) return;
+    const nextConditions = draft
-    onChange([...conditions, draft]);
+      ? [...draftConditions, draft]
+      : draftConditions;
+
+    onChange(nextConditions);
     setDraft(null);
-  }, [draft, conditions, onChange]);
+    setUnSaved(false)
+
+  }, [draft, draftConditions, onChange]);
 
   const handleCancelDraft = useCallback(() => {
+    setDraftConditions(conditions)
     setDraft(null);
-  }, []);
+    setUnSaved(false)
+  }, [conditions]);
 
   const handleDraftPropertyChange = useCallback(
     (propertyId: string | null) => {
@@ -272,17 +320,19 @@ export function ViewFilterConfigPopover({
 
   const handleRemove = useCallback(
     (index: number) => {
-      onChange(conditions.filter((_, i) => i !== index));
+      setUnSaved(true);
+      setDraftConditions((current) => current.filter((_, i) => i !== index));
     },
-    [conditions, onChange],
+    [],
   );
 
   const handlePropertyChange = useCallback(
     (index: number, propertyId: string | null) => {
       if (!propertyId) return;
       const newProperty = properties.find((p) => p.id === propertyId);
-      onChange(
+      setUnSaved(true)
-        conditions.map((f, i) => {
+      setDraftConditions((current) =>
+        current.map((f, i) => {
           if (i !== index) return f;
           if (newProperty) {
             const validOperators = getOperatorsForType(newProperty.type);
@@ -302,15 +352,16 @@ export function ViewFilterConfigPopover({
         }),
       );
     },
-    [conditions, properties, onChange],
+    [properties],
   );
 
   const handleOperatorChange = useCallback(
     (index: number, operator: string | null) => {
       if (!operator) return;
       const op = operator as FilterOperator;
-      onChange(
+      setUnSaved(true)
-        conditions.map((f, i) => {
+      setDraftConditions((current) =>
+        current.map((f, i) => {
           if (i !== index) return f;
           const kind = inputKindForProperty(
             properties.find((p) => p.id === f.propertyId),
@@ -320,16 +371,17 @@ export function ViewFilterConfigPopover({
         }),
       );
     },
-    [conditions, properties, onChange],
+    [properties],
   );
 
   const handleValueChange = useCallback(
     (index: number, value: unknown) => {
-      onChange(
+      setUnSaved(true)
-        conditions.map((f, i) => (i === index ? { ...f, value } : f)),
+      setDraftConditions((current) =>
+        current.map((f, i) => (i === index ? { ...f, value } : f)),
       );
     },
-    [conditions, onChange],
+    [],
   );
 
   return (
@@ -362,13 +414,13 @@ export function ViewFilterConfigPopover({
             {t("Filter by")}
           </Text>
 
-          {conditions.length === 0 && !draft && (
+          {draftConditions.length === 0 && !draft && (
             <Text size="xs" c="dimmed">
               {t("No filters applied")}
             </Text>
           )}
 
-          {conditions.map((condition, index) => {
+          {draftConditions.map((condition, index) => {
             const needsValue = !NO_VALUE_OPERATORS.includes(condition.op);
             const property = properties.find(
               (p) => p.id === condition.propertyId,
@@ -471,14 +523,6 @@ export function ViewFilterConfigPopover({
                     />
                   )}
                 </Group>
-                <Group justify="flex-end" gap="xs">
-                  <Button variant="default" size="xs" onClick={handleCancelDraft}>
-                    {t("Cancel")}
-                  </Button>
-                  <Button size="xs" onClick={handleSaveDraft}>
-                    {t("Save")}
-                  </Button>
-                </Group>
               </Stack>
             );
           })()}
@@ -492,6 +536,20 @@ export function ViewFilterConfigPopover({
               {t("Add filter")}
             </UnstyledButton>
           )}
+          <Group justify="flex-end" gap="xs">
+            <Button
+              variant="default"
+              size="xs"
+              onClick={handleCancelDraft}
+              disabled={!draft && !unSaved}
+            >
+              {t("Cancel")}
+            </Button>
+
+            <Button size="xs" onClick={handleSaveDraft} disabled={!draft && !unSaved}>
+              {t("Save")}
+            </Button>
+          </Group>
         </Stack>
       </Popover.Dropdown>
     </Popover>

apps/client/src/ee/features.ts

@@ -22,4 +22,5 @@ export const Feature = {
   PERSONAL_SPACES: 'spaces:personal',
   DOCX_EXPORT: 'export:docx',
   BASES: 'bases',
+  AI_CONTROLS: 'ai:controls',
 } as const;

apps/client/src/features/editor/atoms/editor-atoms.ts

@@ -16,6 +16,14 @@ export const showAiMenuAtom = atom(false);
 
 export const showLinkMenuAtom = atom(false);
 
+export type LightboxRequest = {
+  src: string;
+  type: "image" | "video";
+} | null;
+
+const initialLightboxRequest: LightboxRequest = null;
+export const lightboxRequestAtom = atom(initialLightboxRequest);
+
 // Current page's edit mode — initialized from the user's saved preference on
 // first load, can be toggled locally without persisting to the server.
 export const currentPageEditModeAtom = atom<PageEditMode>(PageEditMode.Edit);

apps/client/src/features/editor/components/bubble-menu/bubble-menu.tsx

@@ -23,11 +23,21 @@ import {
 } from "@/features/comment/atoms/comment-atom";
 import { useAtom, useAtomValue } from "jotai";
 import { v7 as uuid7 } from "uuid";
-import { isCellSelection, isEditorReady, isTextSelected } from "@docmost/editor-ext";
+import {
+  isCellSelection,
+  isEditorReady,
+  isTextSelected,
+} from "@docmost/editor-ext";
 import { LinkSelector } from "@/features/editor/components/bubble-menu/link-selector.tsx";
 import { useTranslation } from "react-i18next";
-import { showAiMenuAtom, showLinkMenuAtom } from "@/features/editor/atoms/editor-atoms";
+import {
-import { userAtom, workspaceAtom } from "@/features/user/atoms/current-user-atom";
+  showAiMenuAtom,
+  showLinkMenuAtom,
+} from "@/features/editor/atoms/editor-atoms";
+import {
+  userAtom,
+  workspaceAtom,
+} from "@/features/user/atoms/current-user-atom";
 
 export interface BubbleMenuItem {
   name: string;
@@ -217,7 +227,12 @@ export const EditorBubbleMenu: FC<EditorBubbleMenuProps> = (props) => {
 
             <ActionIcon.Group>
               {items.map((item, index) => (
-                <Tooltip key={index} label={t(item.name)} withArrow>
+                <Tooltip
+                  key={index}
+                  label={t(item.name)}
+                  withArrow
+                  withinPortal={false}
+                >
                   <ActionIcon
                     key={index}
                     variant="default"
@@ -226,7 +241,9 @@ export const EditorBubbleMenu: FC<EditorBubbleMenuProps> = (props) => {
                     aria-label={t(item.name)}
                     className={clsx({ [classes.active]: item.isActive() })}
                     style={{ border: "none" }}
-                    onClick={() => isEditorReady(props.editor) && item.command()}
+                    onClick={() =>
+                      isEditorReady(props.editor) && item.command()
+                    }
                   >
                     <item.icon style={{ width: rem(16) }} stroke={2} />
                   </ActionIcon>
@@ -256,7 +273,9 @@ export const EditorBubbleMenu: FC<EditorBubbleMenuProps> = (props) => {
               radius="6px"
               aria-label={t(commentItem.name)}
               style={{ border: "none" }}
-              onClick={() => isEditorReady(props.editor) && commentItem.command()}
+              onClick={() =>
+                isEditorReady(props.editor) && commentItem.command()
+              }
             >
               <IconMessage size={16} stroke={2} />
             </ActionIcon>

apps/client/src/features/editor/components/bubble-menu/color-selector.tsx

@@ -129,8 +129,7 @@ function handleColorKeyNav(
   grid: "text" | "highlight",
 ) {
   const cols = COLOR_GRID_COLS;
-  const total =
+  const total = grid === "text" ? TEXT_COLORS.length : HIGHLIGHT_COLORS.length;
-    grid === "text" ? TEXT_COLORS.length : HIGHLIGHT_COLORS.length;
   const col = index % cols;
 
   if (e.key === "ArrowRight") {
@@ -163,8 +162,7 @@ function handleColorKeyNav(
     if (prev >= 0) {
       focusSwatch(grid, prev);
     } else if (grid === "highlight") {
-      const lastRowStart =
+      const lastRowStart = Math.floor((TEXT_COLORS.length - 1) / cols) * cols;
-        Math.floor((TEXT_COLORS.length - 1) / cols) * cols;
       focusSwatch("text", Math.min(lastRowStart + col, TEXT_COLORS.length - 1));
     }
     return;
@@ -222,7 +220,7 @@ export const ColorSelector: FC<ColorSelectorProps> = ({
       withArrow
     >
       <Popover.Target>
-        <Tooltip label={t("Text color")} withArrow>
+        <Tooltip label={t("Text color")} withArrow withinPortal={false}>
           <Button
             variant="default"
             radius="0"
@@ -399,9 +397,8 @@ export const ColorSelector: FC<ColorSelectorProps> = ({
               if (e.key === "ArrowUp") {
                 e.preventDefault();
                 const lastRowStart =
-                    Math.floor(
+                  Math.floor((HIGHLIGHT_COLORS.length - 1) / COLOR_GRID_COLS) *
-                      (HIGHLIGHT_COLORS.length - 1) / COLOR_GRID_COLS,
+                  COLOR_GRID_COLS;
-                    ) * COLOR_GRID_COLS;
                 focusSwatch("highlight", lastRowStart);
               }
             }}

apps/client/src/features/editor/components/bubble-menu/link-selector.tsx

@@ -10,7 +10,7 @@ export const LinkSelector: FC = () => {
   const setShowLinkMenu = useSetAtom(showLinkMenuAtom);
 
   return (
-    <Tooltip label={t("Add link")} withArrow>
+    <Tooltip label={t("Add link")} withArrow withinPortal={false}>
       <ActionIcon
         variant="default"
         size="lg"

apps/client/src/features/editor/components/bubble-menu/text-alignment-selector.tsx

@@ -91,7 +91,12 @@ export const TextAlignmentSelector: FC<TextAlignmentProps> = ({
       onChange={setIsOpen}
     >
       <Menu.Target>
-        <Tooltip label={t("Text align")} withArrow disabled={isOpen}>
+        <Tooltip
+          label={t("Text align")}
+          withArrow
+          disabled={isOpen}
+          withinPortal={false}
+        >
           <Button
             variant="default"
             style={{ border: "none", height: "34px" }}

apps/client/src/features/editor/components/common/lightbox-view.tsx

@@ -0,0 +1,176 @@
+import type { Editor } from "@tiptap/react";
+import type { Node as PMNode } from "@tiptap/pm/model";
+import Lightbox, { type Slide } from "yet-another-react-lightbox";
+import type { LightboxRequest } from "@/features/editor/atoms/editor-atoms";
+import { getFileUrl } from "@/lib/config.ts";
+import "yet-another-react-lightbox/styles.css";
+import "yet-another-react-lightbox/plugins/captions.css";
+import Captions from "yet-another-react-lightbox/plugins/captions";
+import Download from "yet-another-react-lightbox/plugins/download";
+import Fullscreen from "yet-another-react-lightbox/plugins/fullscreen";
+import Video from "yet-another-react-lightbox/plugins/video";
+import Zoom from "yet-another-react-lightbox/plugins/zoom";
+import { useEffect, useMemo, useState } from "react";
+import i18n from "@/i18n.ts";
+import { useTranslation } from "react-i18next";
+
+type LightboxViewProps = {
+  editor: Editor;
+  open: boolean;
+  src: string;
+  type: "image" | "video";
+  onClose: () => void;
+};
+
+function getVideoMimeType(src: string) {
+  const extension = src.split(/[?#]/, 1)[0].split(".").pop()?.toLowerCase();
+
+  switch (extension) {
+    case "webm":
+      return "video/webm";
+    case "ogv":
+      return "video/ogg";
+    case "mov":
+      return "video/quicktime";
+    case "m4v":
+      return "video/x-m4v";
+    default:
+      return "video/mp4";
+  }
+}
+
+function getFilename(src: string) {
+  const filename = src.split(/[?#]/, 1)[0].split("/").pop();
+  if (!filename) return i18n.t("Media");
+
+  try {
+    return decodeURIComponent(filename);
+  } catch {
+    return filename;
+  }
+}
+
+function getMedia(rawSrc: string, type?: string, alt?: string): Slide {
+  const src = getFileUrl(rawSrc);
+  const filename = getFilename(rawSrc);
+  const caption = alt || filename;
+
+  if (type === "video") {
+    return {
+      type: "video",
+      sources: [{ src, type: getVideoMimeType(rawSrc) }],
+      title: caption,
+      download: { url: src, filename },
+    };
+  } else {
+    return {
+      type: "image",
+      src,
+      alt: alt || undefined,
+      title: caption,
+      download: { url: src, filename },
+    };
+  }
+}
+
+const LIGHTBOX_NODE_TYPES: Record<string, "image" | "video"> = {
+  image: "image",
+  video: "video",
+  drawio: "image",
+  excalidraw: "image",
+};
+
+// video is excluded: clicks there operate the native controls
+const CLICK_TO_EXPAND_NODE_TYPES = new Set(["image", "drawio", "excalidraw"]);
+
+export function getLightboxClickRequest(node: PMNode): LightboxRequest {
+  if (!CLICK_TO_EXPAND_NODE_TYPES.has(node.type.name)) return null;
+
+  const src = typeof node.attrs.src === "string" ? node.attrs.src : "";
+  if (!src) return null;
+
+  return { src: getFileUrl(src), type: "image" };
+}
+
+function getPageMedia(editor: Editor): Slide[] {
+  const media: Slide[] = [];
+
+  editor.state.doc.descendants((node) => {
+    const type = LIGHTBOX_NODE_TYPES[node.type.name];
+    if (!type) return;
+
+    const rawSrc = typeof node.attrs.src === "string" ? node.attrs.src : "";
+    if (!rawSrc) return;
+
+    media.push(getMedia(rawSrc, type, node.attrs.alt));
+  });
+
+  return media;
+}
+
+export default function LightboxView({
+  editor,
+  open,
+  src,
+  type,
+  onClose,
+}: LightboxViewProps) {
+  const { i18n: i18nInstance } = useTranslation();
+
+  const selectedSlide = useMemo(
+    () => getMedia(src, type),
+    [src, type, i18nInstance.language]
+  );
+
+  const [pageSlides, setPageSlides] = useState<Slide[]>([]);
+  const [loadedMediaKey, setLoadedMediaKey] = useState<string | null>(null);
+
+  useEffect(() => {
+    if (!open) return;
+
+    setLoadedMediaKey(null);
+
+    const frame = requestAnimationFrame(() => {
+      const slides = getPageMedia(editor);
+
+      setPageSlides(slides);
+      setLoadedMediaKey(`${type}:${src}`);
+    });
+
+    return () => cancelAnimationFrame(frame);
+  }, [editor, open, type, src]);
+
+  const slides = loadedMediaKey === `${type}:${src}` ? pageSlides : [selectedSlide];
+
+  const index = useMemo(() => {
+    if (!(pageSlides.length > 0)) {
+      return 0;
+    }
+
+    const idx = slides.findIndex((slide) =>
+      type === "video"
+        ? "sources" in slide && slide.sources.some((s) => s.src === src)
+        : "src" in slide && slide.src === src
+    );
+    return idx >= 0 ? idx : 0;
+  }, [slides, src, type]);
+
+  return (
+    <Lightbox
+      open={open}
+      close={onClose}
+      index={index}
+      slides={slides}
+      plugins={[Captions, Download, Fullscreen, Video, Zoom]}
+      styles={{ container: { backgroundColor: "rgba(0, 0, 0, 0.8)" } }}
+      captions={{ descriptionTextAlign: "center" }}
+      video={{ controls: true, playsInline: true }}
+      zoom={{
+        scrollToZoom: true,
+        maxZoomPixelRatio: 4,
+        maxZoom: 4,
+        supports: ["video"],
+      }}
+    />
+  );
+}

apps/client/src/features/editor/components/drawio/drawio-menu.tsx

@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import { useCallback, useEffect, useRef, useState } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -24,6 +25,7 @@ import {
   IconDownload,
   IconEdit,
   IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getDrawioUrl, getFileUrl } from "@/lib/config.ts";
@@ -39,10 +41,12 @@ import { decodeBase64ToSvgString, svgStringToFile } from "@/lib/utils";
 import { IAttachment } from "@/features/attachments/types/attachment.types";
 import { modals } from "@mantine/modals";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";
 
 export function DrawioMenu({ editor }: EditorMenuProps) {
   const { t } = useTranslation();
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);
   const [opened, { open, close }] = useDisclosure(false);
   const [initialXML, setInitialXML] = useState<string>("");
   const drawioRef = useRef<DrawIoEmbedRef>(null);
@@ -328,6 +332,23 @@ export function DrawioMenu({ editor }: EditorMenuProps) {
 
           <div className={classes.divider} />
 
+          <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+            <ActionIcon
+              onClick={() =>
+                editorState?.src &&
+                setLightboxRequest({
+                  src: getFileUrl(editorState.src),
+                  type: "image",
+                })
+              }
+              size="lg"
+              aria-label={t("Expand")}
+              variant="subtle"
+            >
+              <IconZoomIn size={18} />
+            </ActionIcon>
+          </Tooltip>
+
           <Tooltip position="top" label={t("Edit")} withinPortal={false}>
             <ActionIcon
               onClick={handleOpen}

apps/client/src/features/editor/components/excalidraw/excalidraw-menu.tsx

@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import { lazy, Suspense, useCallback, useEffect, useRef, useState } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -25,6 +26,7 @@ import {
   IconDownload,
   IconEdit,
   IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getFileUrl } from "@/lib/config.ts";
@@ -37,6 +39,7 @@ import ReactClearModal from "react-clear-modal";
 import { useHandleLibrary } from "@excalidraw/excalidraw";
 import { localStorageLibraryAdapter } from "@/features/editor/components/excalidraw/excalidraw-utils.ts";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";
 
 const ExcalidrawComponent = lazy(() =>
@@ -47,6 +50,7 @@ const ExcalidrawComponent = lazy(() =>
 
 export function ExcalidrawMenu({ editor }: EditorMenuProps) {
   const { t } = useTranslation();
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);
   const [opened, { open, close }] = useDisclosure(false);
   const [excalidrawAPI, setExcalidrawAPI] =
     useState<ExcalidrawImperativeAPI>(null);
@@ -359,6 +363,23 @@ export function ExcalidrawMenu({ editor }: EditorMenuProps) {
 
           <div className={classes.divider} />
 
+          <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+            <ActionIcon
+              onClick={() =>
+                editorState?.src &&
+                setLightboxRequest({
+                  src: getFileUrl(editorState.src),
+                  type: "image",
+                })
+              }
+              size="lg"
+              aria-label={t("Expand")}
+              variant="subtle"
+            >
+              <IconZoomIn size={18} />
+            </ActionIcon>
+          </Tooltip>
+
           <Tooltip position="top" label={t("Edit")} withinPortal={false}>
             <ActionIcon
               onClick={handleOpen}

apps/client/src/features/editor/components/image/image-menu.tsx

@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import React, { useCallback, useRef } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -16,16 +17,19 @@ import {
   IconDownload,
   IconRefresh,
   IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getFileUrl } from "@/lib/config.ts";
 import { uploadImageAction } from "@/features/editor/components/image/upload-image-action.tsx";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";
 
 export function ImageMenu({ editor }: EditorMenuProps) {
   const { t } = useTranslation();
   const fileInputRef = useRef<HTMLInputElement>(null);
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);
 
   const editorState = useEditorState({
     editor,
@@ -207,6 +211,23 @@ export function ImageMenu({ editor }: EditorMenuProps) {
 
         <div className={classes.divider} />
 
+        <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+          <ActionIcon
+            onClick={() =>
+              editorState?.src &&
+              setLightboxRequest({
+                src: getFileUrl(editorState.src),
+                type: "image",
+              })
+            }
+            size="lg"
+            aria-label={t("Expand")}
+            variant="subtle"
+          >
+            <IconZoomIn size={18} />
+          </ActionIcon>
+        </Tooltip>
+
         <Tooltip position="top" label={t("Download")} withinPortal={false}>
           <ActionIcon
             onClick={handleDownload}

apps/client/src/features/editor/components/subpages/subpages-view.tsx

@@ -13,14 +13,21 @@ import {
 import { useTranslation } from "react-i18next";
 import { sortPositionKeys } from "@/features/page/tree/utils/utils";
 import { useSharedPageSubpages } from "@/features/share/hooks/use-shared-page-subpages";
+import { extractPageSlugId } from "@/lib";
 
 export default function SubpagesView(props: NodeViewProps) {
   const { editor } = props;
-  const { spaceSlug, shareId } = useParams();
+  const { spaceSlug, shareId, pageSlug } = useParams();
   const { t } = useTranslation();
 
   // @ts-ignore
-  const currentPageId = editor.storage.pageId;
+  const storagePageId = editor.storage.pageId;
+  const routePageId = extractPageSlugId(pageSlug);
+  let currentPageId = storagePageId;
+
+  if (shareId){
+    currentPageId = routePageId;
+  }
 
   // Get subpages from shared tree if we're in a shared context
   const sharedSubpages = useSharedPageSubpages(currentPageId);

apps/client/src/features/editor/components/video/video-menu.tsx

@@ -1,6 +1,7 @@
 import { BubbleMenu as BaseBubbleMenu } from "@tiptap/react/menus";
 import { findParentNode, posToDOMRect, useEditorState } from "@tiptap/react";
 import { useCallback } from "react";
+import { useSetAtom } from "jotai";
 import { Node as PMNode } from "@tiptap/pm/model";
 import { isEditorReady } from "@docmost/editor-ext";
 import {
@@ -15,14 +16,17 @@ import {
   IconLayoutAlignRight,
   IconDownload,
   IconTrash,
+  IconZoomIn,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { getFileUrl } from "@/lib/config.ts";
 import { useAltTextControl } from "@/features/editor/components/common/use-alt-text-control.tsx";
+import { lightboxRequestAtom } from "@/features/editor/atoms/editor-atoms";
 import classes from "../common/toolbar-menu.module.css";
 
 export function VideoMenu({ editor }: EditorMenuProps) {
   const { t } = useTranslation();
+  const setLightboxRequest = useSetAtom(lightboxRequestAtom);
 
   const editorState = useEditorState({
     editor,
@@ -183,6 +187,23 @@ export function VideoMenu({ editor }: EditorMenuProps) {
 
         <div className={classes.divider} />
 
+        <Tooltip position="top" label={t("Expand")} withinPortal={false}>
+          <ActionIcon
+            onClick={() =>
+              editorState?.src &&
+              setLightboxRequest({
+                src: getFileUrl(editorState.src),
+                type: "video",
+              })
+            }
+            size="lg"
+            aria-label={t("Expand")}
+            variant="subtle"
+          >
+            <IconZoomIn size={18} />
+          </ActionIcon>
+        </Tooltip>
+
         <Tooltip position="top" label={t("Download")} withinPortal={false}>
           <ActionIcon
             onClick={handleDownload}

apps/client/src/features/editor/page-editor.tsx

@@ -33,6 +33,7 @@ import { useAtom, useAtomValue } from "jotai";
 import { currentUserAtom } from "@/features/user/atoms/current-user-atom";
 import {
   currentPageEditModeAtom,
+  lightboxRequestAtom,
   pageEditorAtom,
   yjsConnectionStatusAtom,
   yjsSyncedAtom,
@@ -53,6 +54,9 @@ import CalloutMenu from "@/features/editor/components/callout/callout-menu.tsx";
 import VideoMenu from "@/features/editor/components/video/video-menu.tsx";
 import PdfMenu from "@/features/editor/components/pdf/pdf-menu.tsx";
 import SubpagesMenu from "@/features/editor/components/subpages/subpages-menu.tsx";
+import LightboxView, {
+  getLightboxClickRequest,
+} from "@/features/editor/components/common/lightbox-view";
 import {
   handleFileDrop,
   handlePaste,
@@ -184,6 +188,7 @@ function CollabPageEditor({
   const [, setActiveCommentId] = useAtom(activeCommentIdAtom);
   const [showCommentPopup, setShowCommentPopup] = useAtom(showCommentPopupAtom);
   const [showReadOnlyCommentPopup] = useAtom(showReadOnlyCommentPopupAtom);
+  const [lightboxRequest, setLightboxRequest] = useAtom(lightboxRequestAtom);
   const [isLocalSynced, setIsLocalSynced] = useState(false);
   const [isRemoteSynced, setIsRemoteSynced] = useState(false);
   const [yjsConnectionStatus, setYjsConnectionStatus] = useAtom(
@@ -245,6 +250,17 @@ function CollabPageEditor({
     return [...mainExtensions, ...collabExtensions(provider, currentUser.user)];
   }, [provider, currentUser?.user]);
 
+  const debouncedUpdateContent = useDebouncedCallback((newContent: any) => {
+    const pageData = queryClient.getQueryData<IPage>(["pages", slugId]);
+
+    if (pageData) {
+      queryClient.setQueryData(["pages", slugId], {
+        ...pageData,
+        content: newContent,
+      });
+    }
+  }, 3000);
+
   const editor = useEditor(
     {
       extensions,
@@ -305,6 +321,22 @@ function CollabPageEditor({
 
           return handleFileDrop(editorRef.current, event, moved, pageId);
         },
+        handleClickOn: (view, _pos, node) => {
+          if (view.editable) return false;
+
+          const request = getLightboxClickRequest(node);
+          if (!request) return false;
+
+          setLightboxRequest(request);
+          return true;
+        },
+        handleDoubleClickOn: (_view, _pos, node) => {
+          const request = getLightboxClickRequest(node);
+          if (!request) return false;
+
+          setLightboxRequest(request);
+          return true;
+        },
       },
       onCreate({ editor }) {
         if (editor) {
@@ -343,17 +375,6 @@ function CollabPageEditor({
     },
   });
 
-  const debouncedUpdateContent = useDebouncedCallback((newContent: any) => {
-    const pageData = queryClient.getQueryData<IPage>(["pages", slugId]);
-
-    if (pageData) {
-      queryClient.setQueryData(["pages", slugId], {
-        ...pageData,
-        content: newContent,
-      });
-    }
-  }, 3000);
-
   const handleActiveCommentEvent = (event) => {
     const { commentId, resolved } = event.detail;
 
@@ -386,6 +407,7 @@ function CollabPageEditor({
     setActiveCommentId(null);
     setShowCommentPopup(false);
     setAsideState({ tab: "", isAsideOpen: false });
+    setLightboxRequest(null);
   }, [pageId]);
 
   const isSynced = isLocalSynced && isRemoteSynced;
@@ -459,6 +481,15 @@ function CollabPageEditor({
         {editor && !editorIsEditable && (editable || canComment) && (
           <ReadonlyBubbleMenu editor={editor} />
         )}
+        {editor && (
+          <LightboxView
+            editor={editor}
+            open={!!lightboxRequest}
+            src={lightboxRequest?.src ?? ""}
+            type={lightboxRequest?.type ?? "image"}
+            onClose={() => setLightboxRequest(null)}
+          />
+        )}
         {showCommentPopup && <CommentDialog editor={editor} pageId={pageId} />}
         {showReadOnlyCommentPopup && (
           <CommentDialog editor={editor} pageId={pageId} readOnly />

apps/client/src/features/editor/readonly-page-editor.tsx

@@ -1,15 +1,27 @@
 import "@/features/editor/styles/index.css";
-import React, { useCallback, useEffect, useMemo, useRef } from "react";
+import React, {
-import { EditorProvider } from "@tiptap/react";
+  useCallback,
+  useEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
+import { Editor, EditorProvider } from "@tiptap/react";
 import { mainExtensions } from "@/features/editor/extensions/extensions";
 import { Document } from "@tiptap/extension-document";
 import { Heading, UniqueID } from "@docmost/editor-ext";
 import { Text } from "@tiptap/extension-text";
 import { Placeholder } from "@tiptap/extension-placeholder";
 import { useAtom } from "jotai";
-import { readOnlyEditorAtom } from "@/features/editor/atoms/editor-atoms.ts";
+import {
+  lightboxRequestAtom,
+  readOnlyEditorAtom,
+} from "@/features/editor/atoms/editor-atoms.ts";
 import { useEditorScroll } from "./hooks/use-editor-scroll";
 import { TransclusionLookupProvider } from "@/features/editor/components/transclusion/transclusion-lookup-context";
+import LightboxView, {
+  getLightboxClickRequest,
+} from "@/features/editor/components/common/lightbox-view";
 
 interface PageEditorProps {
   title: string;
@@ -33,6 +45,8 @@ export default function ReadonlyPageEditor({
   shareId,
 }: PageEditorProps) {
   const [, setReadOnlyEditor] = useAtom(readOnlyEditorAtom);
+  const [lightboxRequest, setLightboxRequest] = useAtom(lightboxRequestAtom);
+  const [contentEditor, setContentEditor] = useState<Editor | null>(null);
   const isComponentMounted = useRef(false);
   const editorCreated = useRef(false);
 
@@ -49,6 +63,11 @@ export default function ReadonlyPageEditor({
     isComponentMounted.current = true;
   }, []);
 
+  useEffect(() => {
+    if (!shareId) return;
+    setLightboxRequest(null);
+  }, [pageId, shareId]);
+
   const extensions = useMemo(() => {
     const excludedExtensions = new Set([
       "uniqueID",
@@ -97,6 +116,19 @@ export default function ReadonlyPageEditor({
         textDirection="auto"
         extensions={extensions}
         content={content}
+        editorProps={
+          shareId
+            ? {
+                handleClickOn: (_view, _pos, node) => {
+                  const request = getLightboxClickRequest(node);
+                  if (!request) return false;
+
+                  setLightboxRequest(request);
+                  return true;
+                },
+              }
+            : undefined
+        }
         onCreate={({ editor }) => {
           if (editor) {
             if (pageId) {
@@ -105,12 +137,22 @@ export default function ReadonlyPageEditor({
             }
             // @ts-ignore
             setReadOnlyEditor(editor);
+            setContentEditor(editor);
 
             handleScrollTo(editor);
             editorCreated.current = true;
           }
         }}
       ></EditorProvider>
+      {shareId && contentEditor && (
+        <LightboxView
+          editor={contentEditor}
+          open={!!lightboxRequest}
+          src={lightboxRequest?.src ?? ""}
+          type={lightboxRequest?.type ?? "image"}
+          onClose={() => setLightboxRequest(null)}
+        />
+      )}
       <div style={{ paddingBottom: "20vh" }}></div>
     </TransclusionLookupProvider>
   );

apps/client/src/features/label/queries/label-query.ts

@@ -39,6 +39,7 @@ export function useWorkspaceLabelsQuery(query: string, enabled: boolean) {
     queryFn: () => getWorkspaceLabels({ type: "page", query, limit: 50 }),
     enabled,
     staleTime: 30 * 1000,
+    placeholderData: keepPreviousData
   });
 }
 

apps/client/src/features/search/components/creator-filter-menu.tsx

@@ -0,0 +1,152 @@
+import { ReactNode, useMemo, useState } from "react";
+import { Divider, Group, Menu, ScrollArea, Text, TextInput } from "@mantine/core";
+import { useDebouncedValue } from "@mantine/hooks";
+import { IconCheck, IconSearch } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { useSearchSuggestionsQuery } from "@/features/search/queries/search-query";
+import { RadioMenuItem } from "@/components/ui/radio-menu-item";
+import { CustomAvatar } from "@/components/ui/custom-avatar.tsx";
+import { IUser } from "@/features/user/types/user.types.ts";
+import { useAtomValue } from "jotai";
+import { userAtom } from "@/features/user/atoms/current-user-atom.ts";
+
+type CreatorFilterMenuProps = {
+  value: string | null;
+  onChange: (user: IUser | null) => void;
+  children: ReactNode;
+  width?: number;
+  position?:
+    | "bottom-start"
+    | "bottom-end"
+    | "bottom"
+    | "top-start"
+    | "top-end"
+    | "top";
+  zIndex?: number;
+  opened?: boolean;
+  onOpenChange?: (opened: boolean) => void;
+};
+
+export function CreatorFilterMenu({
+  value,
+  onChange,
+  children,
+  width = 280,
+  position = "bottom-end",
+  zIndex,
+  opened,
+  onOpenChange,
+}: CreatorFilterMenuProps) {
+  const { t } = useTranslation();
+  const [searchQuery, setSearchQuery] = useState("");
+  const [debouncedQuery] = useDebouncedValue(searchQuery, 300);
+
+  const { data: suggestion, isLoading } = useSearchSuggestionsQuery({
+    query: debouncedQuery,
+    includeUsers: true,
+    includeGroups: false,
+    includePages: false,
+    preload: true,
+  });
+
+  const users: IUser[] = (suggestion?.users as IUser[]) ?? [];
+  const currentUser = useAtomValue(userAtom);
+
+  // pin the signed-in user on top so they never have to search themselves
+  const displayUsers = useMemo(() => {
+    if (!currentUser) return users;
+    const others = users.filter((user) => user.id !== currentUser.id);
+    const q = debouncedQuery.trim().toLowerCase();
+    const matchesQuery =
+      !q ||
+      currentUser.name?.toLowerCase().includes(q) ||
+      currentUser.email?.toLowerCase().includes(q);
+    return matchesQuery ? [currentUser as IUser, ...others] : users;
+  }, [users, currentUser, debouncedQuery]);
+
+  return (
+    <Menu
+      shadow="md"
+      width={width}
+      position={position}
+      zIndex={zIndex}
+      opened={opened}
+      onChange={onOpenChange}
+    >
+      <Menu.Target>{children}</Menu.Target>
+      <Menu.Dropdown>
+        <TextInput
+          placeholder={t("Find a user")}
+          data-autofocus
+          autoFocus
+          leftSection={<IconSearch size={16} />}
+          value={searchQuery}
+          onChange={(e) => setSearchQuery(e.target.value)}
+          size="sm"
+          variant="filled"
+          radius="sm"
+          styles={{ input: { marginBottom: 8 } }}
+        />
+
+        <ScrollArea.Autosize mah={280}>
+          <Menu.Item
+            component={RadioMenuItem}
+            aria-checked={!value}
+            onClick={() => onChange(null)}
+          >
+            <Group flex="1" gap="xs">
+              <div style={{ flex: 1 }}>
+                <Text size="sm" fw={500}>
+                  {t("Anyone")}
+                </Text>
+              </div>
+              {!value && <IconCheck size={20} aria-hidden />}
+            </Group>
+          </Menu.Item>
+
+          <Divider my="xs" />
+
+          {displayUsers.length === 0 && (
+            <Text size="xs" c="dimmed" px="xs" py="sm">
+              {isLoading ? t("Loading...") : t("No users found")}
+            </Text>
+          )}
+
+          {displayUsers.map((user) => (
+            <Menu.Item
+              key={user.id}
+              component={RadioMenuItem}
+              aria-checked={value === user.id}
+              onClick={() => onChange(user)}
+            >
+              <Group flex="1" gap="xs">
+                <CustomAvatar
+                  avatarUrl={user.avatarUrl}
+                  size={20}
+                  name={user.name}
+                />
+                <div style={{ flex: 1, minWidth: 0 }}>
+                  <Text size="sm" fw={500} truncate>
+                    {user.name}
+                    {user.id === currentUser?.id && (
+                      <Text span size="sm" c="dimmed" fw={400}>
+                        {" "}
+                        ({t("you")})
+                      </Text>
+                    )}
+                  </Text>
+                  {user.email && (
+                    <Text size="xs" c="dimmed" truncate>
+                      {user.email}
+                    </Text>
+                  )}
+                </div>
+                {value === user.id && <IconCheck size={20} aria-hidden />}
+              </Group>
+            </Menu.Item>
+          ))}
+        </ScrollArea.Autosize>
+      </Menu.Dropdown>
+    </Menu>
+  );
+}

apps/client/src/features/search/components/label-filter-menu.tsx

@@ -0,0 +1,127 @@
+import { ReactNode, useMemo, useState } from "react";
+import {
+  Group,
+  Menu,
+  ScrollArea,
+  Text,
+  TextInput,
+  useComputedColorScheme,
+} from "@mantine/core";
+import { useDebouncedValue } from "@mantine/hooks";
+import { IconCheck, IconSearch } from "@tabler/icons-react";
+import { useTranslation } from "react-i18next";
+import { useWorkspaceLabelsQuery } from "@/features/label/queries/label-query.ts";
+import { getLabelColor } from "@/features/label/utils/label-colors.ts";
+import { CheckboxMenuItem } from "@/components/ui/checkbox-menu-item";
+
+type LabelFilterMenuProps = {
+  value: string[];
+  onChange: (labelIds: string[]) => void;
+  children: ReactNode;
+  width?: number;
+  position?:
+    | "bottom-start"
+    | "bottom-end"
+    | "bottom"
+    | "top-start"
+    | "top-end"
+    | "top";
+  zIndex?: number;
+  opened?: boolean;
+  onOpenChange?: (opened: boolean) => void;
+};
+
+export function LabelFilterMenu({
+  value,
+  onChange,
+  children,
+  width = 280,
+  position = "bottom-end",
+  zIndex,
+  opened,
+  onOpenChange,
+}: LabelFilterMenuProps) {
+  const { t } = useTranslation();
+  const scheme = useComputedColorScheme("light");
+  const [searchQuery, setSearchQuery] = useState("");
+  const [debouncedQuery] = useDebouncedValue(searchQuery, 300);
+
+  const { data, isLoading } = useWorkspaceLabelsQuery(debouncedQuery, true);
+  const labels = data?.items ?? [];
+
+  const selectedSet = useMemo(() => new Set(value), [value]);
+
+  const toggleLabel = (labelId: string) => {
+    if (selectedSet.has(labelId)) {
+      onChange(value.filter((id) => id !== labelId));
+    } else {
+      onChange([...value, labelId]);
+    }
+  };
+
+  return (
+    <Menu
+      shadow="md"
+      width={width}
+      position={position}
+      zIndex={zIndex}
+      opened={opened}
+      onChange={onOpenChange}
+      closeOnItemClick={false}
+    >
+      <Menu.Target>{children}</Menu.Target>
+      <Menu.Dropdown>
+        <TextInput
+          placeholder={t("Find a label")}
+          data-autofocus
+          autoFocus
+          leftSection={<IconSearch size={16} />}
+          value={searchQuery}
+          onChange={(e) => setSearchQuery(e.target.value)}
+          size="sm"
+          variant="filled"
+          radius="sm"
+          styles={{ input: { marginBottom: 8 } }}
+        />
+
+        <ScrollArea.Autosize mah={280}>
+          {labels.length === 0 && (
+            <Text size="xs" c="dimmed" px="xs" py="sm">
+              {isLoading ? t("Loading...") : t("No labels found")}
+            </Text>
+          )}
+
+          {labels.map((label) => {
+            const isChecked = selectedSet.has(label.id);
+            const color = getLabelColor(label.name, scheme);
+            return (
+              <Menu.Item
+                key={label.id}
+                type="button"
+                component={CheckboxMenuItem}
+                aria-checked={isChecked}
+                onClick={() => toggleLabel(label.id)}
+              >
+                <Group flex="1" gap="xs">
+                  <span
+                    style={{
+                      width: 8,
+                      height: 8,
+                      borderRadius: "50%",
+                      background: color.dot,
+                      flexShrink: 0,
+                    }}
+                  />
+                  <Text size="sm" fw={500} style={{ flex: 1 }} truncate>
+                    {label.name}
+                  </Text>
+                  {isChecked && <IconCheck size={20} aria-hidden />}
+                </Group>
+              </Menu.Item>
+            );
+          })}
+        </ScrollArea.Autosize>
+      </Menu.Dropdown>
+    </Menu>
+  );
+}

apps/client/src/features/search/components/search-result-item.tsx

@@ -19,6 +19,7 @@ import {
 } from "@/features/search/types/search.types";
 import DOMPurify from "dompurify";
 import { useTranslation } from "react-i18next";
+import { timeAgo } from "@/lib/time.ts";
 
 interface SearchResultItemProps {
   result: IPageSearch | IAttachmentSearch;
@@ -26,6 +27,14 @@ interface SearchResultItemProps {
   showSpace?: boolean;
 }
 
+// Spotlight hardcodes tabIndex={-1} after spreading props; a ref wins and
+// React never writes -1 back because the prop value never changes
+const makeActionTabbable = (el: HTMLElement | null) => {
+  if (el) {
+    el.tabIndex = 0;
+  }
+};
+
 export function SearchResultItem({
   result,
   isAttachmentResult,
@@ -46,6 +55,7 @@ export function SearchResultItem({
     return (
       <Spotlight.Action
         component={Link}
+        ref={makeActionTabbable}
         //@ts-ignore
         to={buildPageUrl(
           attachmentResult.space.slug,
@@ -59,8 +69,13 @@ export function SearchResultItem({
             <IconFile size={16} />
           </Center>
 
-          <div style={{ flex: 1 }}>
+          <div style={{ flex: 1, minWidth: 0 }}>
-            <Text>{attachmentResult.fileName}</Text>
+            <Group justify="space-between" wrap="nowrap" gap="xs">
+              <Text truncate>{attachmentResult.fileName}</Text>
+              <Text size="xs" c="dimmed" style={{ flexShrink: 0 }}>
+                {timeAgo(attachmentResult.updatedAt)}
+              </Text>
+            </Group>
             <Text size="xs" opacity={0.6}>
               {attachmentResult.space.name} • {attachmentResult.page.title}
             </Text>
@@ -96,6 +111,7 @@ export function SearchResultItem({
     return (
       <Spotlight.Action
         component={Link}
+        ref={makeActionTabbable}
         //@ts-ignore
         to={buildPageUrl(
           pageResult.space.slug,
@@ -107,8 +123,13 @@ export function SearchResultItem({
         <Group wrap="nowrap" w="100%">
           <Center>{getPageIcon(pageResult?.icon)}</Center>
 
-          <div style={{ flex: 1 }}>
+          <div style={{ flex: 1, minWidth: 0 }}>
-            <Text>{pageResult.title}</Text>
+            <Group justify="space-between" wrap="nowrap" gap="xs">
+              <Text truncate>{pageResult.title || t("Untitled")}</Text>
+              <Text size="xs" c="dimmed" style={{ flexShrink: 0 }}>
+                {timeAgo(pageResult.updatedAt)}
+              </Text>
+            </Group>
 
             {showSpace && pageResult.space && (
               <Badge variant="light" size="xs" color="gray">

apps/client/src/features/search/components/search-spotlight-filters.module.css

@@ -17,3 +17,10 @@
     color: light-dark(var(--mantine-color-gray-7), var(--mantine-color-gray-6));
   }
 }
+
+.filterButtonActive {
+  color: var(--mantine-color-blue-light-color);
+  &:hover {
+    color: var(--mantine-color-blue-light-color);
+  }
+}

apps/client/src/features/search/components/search-spotlight-filters.tsx

@@ -1,4 +1,5 @@
 import React, { useState, useEffect } from "react";
+import cx from "clsx";
 import {
   Button,
   Menu,
@@ -11,18 +12,24 @@ import {
 import {
   IconChevronDown,
   IconBuilding,
+  IconPlus,
   IconFileDescription,
   IconCheck,
+  IconUser,
+  IconTag,
+  IconLetterCase,
 } from "@tabler/icons-react";
 import { useTranslation } from "react-i18next";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query";
 import { SpaceFilterMenu } from "@/features/space/components/space-filter-menu";
+import { CreatorFilterMenu } from "@/features/search/components/creator-filter-menu";
 import { RadioMenuItem } from "@/components/ui/radio-menu-item";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
 import classes from "./search-spotlight-filters.module.css";
 import { useAtom } from "jotai";
 import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { LabelFilterMenu } from "./label-filter-menu";
 
 interface SearchSpotlightFiltersProps {
   onFiltersChange?: (filters: any) => void;
@@ -40,9 +47,17 @@ export function SearchSpotlightFilters({
   const { t } = useTranslation();
   const hasAttachmentIndexing = useHasFeature(Feature.ATTACHMENT_INDEXING);
   const [selectedSpaceId, setSelectedSpaceId] = useState<string | null>(
-    spaceId || null,
+    spaceId || null
   );
   const [contentType, setContentType] = useState<string | null>("page");
+  const [selectedCreatorId, setSelectedCreatorId] = useState<string | null>(null);
+  const [selectedCreatorName, setSelectedCreatorName] = useState<string | null>(
+    null
+  );
+  const [selectedLabelIds, setSelectedLabelIds] = useState<string[]>([]);
+  const [titleOnly, setTitleOnly] = useState(false);
+  const [openedFilter, setOpenedFilter] = useState<string | null>(null);
+  const [visibleFilters, setVisibleFilters] = useState<string[]>([]);
   const [workspace] = useAtom(workspaceAtom);
 
   const { data: spacesData } = useGetSpacesQuery({ limit: 100 });
@@ -50,15 +65,6 @@ export function SearchSpotlightFilters({
     ? spacesData?.items.find((space) => space.id === selectedSpaceId)
     : null;
 
-  useEffect(() => {
-    if (onFiltersChange) {
-      onFiltersChange({
-        spaceId: selectedSpaceId,
-        contentType,
-      });
-    }
-  }, []);
-
   const contentTypeOptions = [
     { value: "page", label: t("Pages") },
     {
@@ -68,38 +74,70 @@ export function SearchSpotlightFilters({
     },
   ];
 
+  useEffect(() => {
+    onFiltersChange?.({
+      spaceId: selectedSpaceId,
+      contentType,
+      creatorId: selectedCreatorId,
+      labelIds: selectedLabelIds,
+      titleOnly,
+    });
+  }, [
+    selectedSpaceId,
+    contentType,
+    selectedCreatorId,
+    selectedLabelIds,
+    titleOnly,
+    onFiltersChange,
+  ]);
+
   const handleSpaceSelect = (spaceId: string | null) => {
     setSelectedSpaceId(spaceId);
+  };
 
-    if (onFiltersChange) {
+  const handleCreatorSelect = (user: { id: string; name: string } | null) => {
-      onFiltersChange({
+    setSelectedCreatorId(user?.id ?? null);
-        spaceId: spaceId,
+    setSelectedCreatorName(user?.name ?? null);
-        contentType,
+  };
-      });
+
+  const handleLabelsSelect = (labelIds: string[]) => {
+    setSelectedLabelIds(labelIds);
+  };
+
+  const handleChangeContentType = (value: string) => {
+    setContentType(value);
+
+    if (value === "attachment") {
+      setSelectedLabelIds([]);
     }
   };
 
-  const handleFilterChange = (filterType: string, value: any) => {
+  const onDemandFilters = [
-    let newSelectedSpaceId = selectedSpaceId;
+    { key: "creator", label: t("Created by"), icon: IconUser, available: true },
-    let newContentType = contentType;
+    {
+      key: "labels",
+      label: t("Labels"),
+      icon: IconTag,
+      available: contentType !== "attachment",
+    },
+  ];
 
-    switch (filterType) {
+  const isFilterVisible = (key: string) => {
-      case "spaceId":
+    if (openedFilter === key) return true;
-        newSelectedSpaceId = value;
+    if (key === "creator") return !!selectedCreatorId;
-        setSelectedSpaceId(value);
+    if (key === "labels")
-        break;
+      return contentType !== "attachment" && selectedLabelIds.length > 0;
-      case "contentType":
+    return false;
-        newContentType = value;
+  };
-        setContentType(value);
-        break;
-    }
 
-    if (onFiltersChange) {
+  const orderedVisibleFilters = visibleFilters.filter(isFilterVisible);
-      onFiltersChange({
+  const addableFilters = onDemandFilters.filter(
-        spaceId: newSelectedSpaceId,
+    (filter) => filter.available && !isFilterVisible(filter.key),
-        contentType: newContentType,
+  );
-      });
+
-    }
+  const revealFilter = (key: string) => {
+    setVisibleFilters((prev) => [...prev.filter((k) => k !== key), key]);
+    setOpenedFilter(key);
   };
 
   return (
@@ -122,8 +160,17 @@ export function SearchSpotlightFilters({
             color="blue"
             labelPosition="left"
             styles={{
-              root: { display: "flex", alignItems: "center" },
+              root: {
-              label: { paddingRight: "8px", fontSize: "13px", fontWeight: 500 },
+                display: "flex",
+                alignItems: "center",
+                flexShrink: 0,
+              },
+              label: {
+                whiteSpace: "nowrap",
+                paddingRight: "8px",
+                fontSize: "13px",
+                fontWeight: 500,
+              },
             }}
           />
         </div>
@@ -181,7 +228,7 @@ export function SearchSpotlightFilters({
               onClick={() =>
                 !option.disabled &&
                 contentType !== option.value &&
-                handleFilterChange("contentType", option.value)
+                handleChangeContentType(option.value)
               }
               disabled={
                 option.disabled || (isAiMode && option.value === "attachment")
@@ -195,9 +242,7 @@ export function SearchSpotlightFilters({
                       {t("Enterprise")}
                     </Badge>
                   )}
-                  {!option.disabled &&
+                  {!option.disabled && isAiMode && option.value === "attachment" && (
-                    isAiMode &&
-                    option.value === "attachment" && (
                     <Text size="xs" mt={4}>
                       {t("AI Answers not available for attachments")}
                     </Text>
@@ -209,6 +254,126 @@ export function SearchSpotlightFilters({
           ))}
         </Menu.Dropdown>
       </Menu>
+
+      {!isAiMode && (
+        <Button
+          variant={titleOnly ? "light" : "subtle"}
+          color={titleOnly ? "blue" : "gray"}
+          size="sm"
+          radius="xl"
+          leftSection={<IconLetterCase size={16} />}
+          className={cx(
+            classes.filterButton,
+            titleOnly && classes.filterButtonActive,
+          )}
+          fw={500}
+          aria-pressed={titleOnly}
+          onClick={() => setTitleOnly(!titleOnly)}
+        >
+          {t("Title only")}
+        </Button>
+      )}
+
+      {!isAiMode &&
+        orderedVisibleFilters.map((filterKey) => {
+        if (filterKey === "creator") {
+          return (
+            <CreatorFilterMenu
+              key="creator"
+              value={selectedCreatorId}
+              onChange={handleCreatorSelect}
+              position="bottom-start"
+              width={250}
+              zIndex={getDefaultZIndex("max")}
+              opened={openedFilter === "creator"}
+              onOpenChange={(opened) =>
+                setOpenedFilter(opened ? "creator" : null)
+              }
+            >
+              <Button
+                variant="subtle"
+                color="gray"
+                size="sm"
+                rightSection={<IconChevronDown size={14} />}
+                leftSection={<IconUser size={16} />}
+                className={classes.filterButton}
+                fw={500}
+              >
+                {selectedCreatorId
+                  ? `${t("Created by")}: ${selectedCreatorName || t("Unknown")}`
+                  : `${t("Created by")}: ${t("Anyone")}`}
+              </Button>
+            </CreatorFilterMenu>
+          );
+        }
+
+        if (filterKey === "labels") {
+          return (
+            <LabelFilterMenu
+              key="labels"
+              value={selectedLabelIds}
+              onChange={handleLabelsSelect}
+              position="bottom-start"
+              width={250}
+              zIndex={getDefaultZIndex("max")}
+              opened={openedFilter === "labels"}
+              onOpenChange={(opened) =>
+                setOpenedFilter(opened ? "labels" : null)
+              }
+            >
+              <Button
+                variant="subtle"
+                color="gray"
+                size="sm"
+                rightSection={<IconChevronDown size={14} />}
+                leftSection={<IconTag size={16} />}
+                className={classes.filterButton}
+                fw={500}
+              >
+                {selectedLabelIds.length > 0
+                  ? `${t("Labels")} (${selectedLabelIds.length})`
+                  : t("Labels")}
+              </Button>
+            </LabelFilterMenu>
+          );
+        }
+
+        return null;
+      })}
+
+      {!isAiMode && addableFilters.length > 0 && (
+        <Menu
+          shadow="md"
+          width={200}
+          position="bottom-end"
+          zIndex={getDefaultZIndex("max")}
+        >
+          <Menu.Target>
+            <Button
+              variant="subtle"
+              color="gray"
+              size="sm"
+              leftSection={<IconPlus size={16} />}
+              className={classes.filterButton}
+              style={{ marginLeft: "auto" }}
+              fw={500}
+            >
+              {t("Filter")}
+            </Button>
+          </Menu.Target>
+          <Menu.Dropdown>
+            {addableFilters.map((filter) => (
+              <Menu.Item
+                key={filter.key}
+                leftSection={<filter.icon size={16} />}
+                onClick={() => revealFilter(filter.key)}
+              >
+                {filter.label}
+              </Menu.Item>
+            ))}
+          </Menu.Dropdown>
+        </Menu>
+      )}
     </div>
   );
 }

apps/client/src/features/search/components/search-spotlight.tsx

@@ -1,7 +1,7 @@
 import { Spotlight } from "@mantine/spotlight";
 import { IconSearch, IconSparkles } from "@tabler/icons-react";
-import { Group, Button, VisuallyHidden } from "@mantine/core";
+import { Group, Button, VisuallyHidden, Text } from "@mantine/core";
-import React, { useState, useMemo, useEffect } from "react";
+import React, { useState, useMemo, useEffect, useCallback } from "react";
 import { useDebouncedValue } from "@mantine/hooks";
 import { useTranslation } from "react-i18next";
 import { notifications } from "@mantine/notifications";
@@ -13,11 +13,16 @@ import { SearchResultItem } from "./search-result-item.tsx";
 import { AiSearchResult } from "../../../ee/ai/components/ai-search-result.tsx";
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { Feature } from "@/ee/features";
+import { useAtomValue } from "jotai";
+import { workspaceAtom } from "@/features/user/atoms/current-user-atom.ts";
+import { hintVectorCache } from "@/ee/ai/services/ai-search-service.ts";
+import { getAiVectorDriver } from "@/lib/config.ts";
 
 interface SearchSpotlightProps {
   spaceId?: string;
 }
 export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
+  const workspace = useAtomValue(workspaceAtom);
   const { t } = useTranslation();
   const hasAiFeature = useHasFeature(Feature.AI);
   const hasAttachmentIndexing = useHasFeature(Feature.ATTACHMENT_INDEXING);
@@ -26,6 +31,9 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
   const [filters, setFilters] = useState<{
     spaceId?: string | null;
     contentType?: string;
+    creatorId?: string | null;
+    labelIds?: string[];
+    titleOnly?: boolean;
   }>({
     contentType: "page",
   });
@@ -43,10 +51,25 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
       params.spaceId = filters.spaceId;
     }
 
+    if (filters.creatorId) {
+      params.creatorId = filters.creatorId;
+    }
+
+    if (filters.labelIds?.length) {
+      params.labelIds = filters.labelIds;
+    }
+
+    if (filters.titleOnly) {
+      params.titleOnly = true;
+    }
+
     return params;
   }, [debouncedSearchQuery, filters]);
 
-  const { data: searchResults, isLoading } = useUnifiedSearch(
+  const {
+    data: searchResults,
+    isFetching,
+  } = useUnifiedSearch(
     searchParams,
     !isAiMode // Disable regular search when in AI mode
   );
@@ -83,6 +106,11 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
     }
   }, [aiSearchError, t]);
 
+  const isFilterBrowse =
+    (filters.labelIds?.length ?? 0) > 0 || !!filters.creatorId;
+  // while the debounce is pending the empty list is not a settled "no results"
+  const isQuerySettled = query === debouncedSearchQuery;
+
   // Determine result type for rendering
   const isAttachmentSearch =
     filters.contentType === "attachment" && hasAttachmentIndexing;
@@ -96,10 +124,19 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
     />
   ));
 
-  const handleFiltersChange = (newFilters: any) => {
+  const handleSpotlightOpen = () => {
-    setFilters(newFilters);
+    if (
+      workspace?.settings?.ai?.search === true &&
+      getAiVectorDriver() === "turbopuffer"
+    ) {
+      hintVectorCache();
+    }
   };
 
+  const handleFiltersChange = useCallback((newFilters: any) => {
+    setFilters(newFilters);
+  }, [setFilters]);
+
   const handleAskClick = () => {
     setIsAiMode(!isAiMode);
   };
@@ -115,6 +152,7 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
       <Spotlight.Root
         size="xl"
         maxHeight={600}
+        onSpotlightOpen={handleSpotlightOpen}
         store={searchSpotlightStore}
         query={query}
         onQueryChange={setQuery}
@@ -167,7 +205,7 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
             ? query.length > 0 && !isAiLoading && !aiSearchResult
               ? t("No answer available")
               : ""
-            : query.length > 0 && !isLoading
+            : (query.length > 0 || isFilterBrowse) && !isFetching
               ? resultItems.length === 0
                 ? t("No results found")
                 : t("{{count}} results found", { count: resultItems.length })
@@ -194,15 +232,28 @@ export function SearchSpotlight({ spaceId }: SearchSpotlightProps) {
             </>
           ) : (
             <>
-              {query.length === 0 && resultItems.length === 0 && (
+              {query.length === 0 && !isFilterBrowse && resultItems.length === 0 && (
                 <Spotlight.Empty>{t("Start typing to search...")}</Spotlight.Empty>
               )}
 
-              {query.length > 0 && !isLoading && resultItems.length === 0 && (
+              {(query.length > 0 || isFilterBrowse) &&
+                !isFetching &&
+                isQuerySettled &&
+                resultItems.length === 0 && (
                   <Spotlight.Empty>{t("No results found...")}</Spotlight.Empty>
                 )}
 
               {resultItems.length > 0 && <>{resultItems}</>}
+
+              {(query.length > 0 || isFilterBrowse) &&
+                isFetching &&
+                resultItems.length === 0 && (
+                <Spotlight.Empty>
+                  <Text size="sm" style={{ marginTop: 10 }}>
+                    {t("Searching...")}
+                  </Text>
+                </Spotlight.Empty>
+              )}
             </>
           )}
         </Spotlight.ActionsList>

apps/client/src/features/search/hooks/use-unified-search.ts

@@ -39,6 +39,20 @@ export function useUnifiedSearch(
         return await searchPage(backendParams);
       }
     },
-    enabled: !!params.query && enabled,
+    enabled:
+      (!!params.query ||
+        (params.labelIds?.length ?? 0) > 0 ||
+        !!params.creatorId) &&
+      enabled,
+    // keep previous results only within the same search type; page results
+    // rendered as attachments (or vice versa) crash on missing fields
+    placeholderData: (previousData, previousQuery) => {
+      if (!params.query && !params.labelIds?.length && !params.creatorId)
+        return undefined;
+      if (previousQuery && previousQuery.queryKey[1] !== searchType) {
+        return undefined;
+      }
+      return previousData;
+    },
   });
 }

apps/client/src/features/search/types/search.types.ts

@@ -36,6 +36,9 @@ export interface IPageSearchParams {
   query: string;
   spaceId?: string;
   shareId?: string;
+  creatorId?: string;
+  labelIds?: string[];
+  titleOnly?: boolean;
 }
 
 export interface IAttachmentSearch {

apps/client/src/features/space/components/sidebar/space-select.tsx

@@ -1,4 +1,4 @@
-import React, { useEffect, useState } from "react";
+import React, { useEffect, useRef, useState } from "react";
 import { useDebouncedValue } from "@mantine/hooks";
 import { Group, Select, SelectProps, Text } from "@mantine/core";
 import { useGetSpacesQuery } from "@/features/space/queries/space-query.ts";
@@ -14,6 +14,7 @@ interface SpaceSelectProps {
   width?: number;
   opened?: boolean;
   clearable?: boolean;
+  withinPortal?: boolean;
 }
 
 const renderSelectOption: SelectProps["renderOption"] = ({ option }) => (
@@ -41,6 +42,7 @@ export function SpaceSelect({
   width,
   opened,
   clearable,
+  withinPortal = true,
 }: SpaceSelectProps) {
   const { t } = useTranslation();
   const [searchValue, setSearchValue] = useState("");
@@ -50,9 +52,13 @@ export function SpaceSelect({
     limit: 50,
   });
   const [data, setData] = useState([]);
+  const fetchedSpaces = useRef(new Map<string, ISpace>());
 
   useEffect(() => {
     if (spaces) {
+      spaces.items.forEach((space: ISpace) =>
+        fetchedSpaces.current.set(space.slug, space),
+      );
       const spaceData = spaces?.items
         .filter((space: ISpace) => space.slug !== value)
         .map((space: ISpace) => {
@@ -83,14 +89,19 @@ export function SpaceSelect({
       onSearchChange={setSearchValue}
       clearable={clearable}
       variant="filled"
-      onChange={(slug) =>
+      onChange={(slug) => {
-        onChange(spaces.items?.find((item) => item.slug === slug))
+        // options accumulate across fetches; resolve against everything
+        // fetched, not just the latest query result
+        const space = slug && fetchedSpaces.current.get(slug);
+        if (space) {
+          onChange(space);
         }
+      }}
       onClick={(e) => e.stopPropagation()}
       nothingFoundMessage={t("No space found")}
       limit={50}
       checkIconPosition="right"
-      comboboxProps={{ width, withinPortal: true, position: "bottom", keepMounted: false, dropdownPadding: 0 }}
+      comboboxProps={{ width, withinPortal, position: "bottom", keepMounted: false, dropdownPadding: 0 }}
       dropdownOpened={opened}
     />
   );

apps/client/src/features/space/components/sidebar/space-sidebar.tsx

@@ -54,7 +54,9 @@ import {
 import { mobileSidebarAtom } from "@/components/layouts/global/hooks/atoms/sidebar-atom.ts";
 import { useToggleSidebar } from "@/components/layouts/global/hooks/hooks/use-toggle-sidebar.ts";
 import { searchSpotlight } from "@/features/search/constants";
-import TemplatePickerModal from "@/ee/template/components/template-picker-modal";
+const TemplatePickerModal = React.lazy(
+  () => import("@/ee/template/components/template-picker-modal"),
+);
 import { useHasFeature } from "@/ee/hooks/use-feature";
 import { useUpgradeLabel } from "@/ee/hooks/use-upgrade-label";
 import { Feature } from "@/ee/features";
@@ -406,11 +408,13 @@ function SpaceMenu({
 
       {hasTemplates && templatePickerOpened && (
         <ErrorBoundary fallbackRender={() => null}>
+          <React.Suspense fallback={null}>
             <TemplatePickerModal
               opened={templatePickerOpened}
               onClose={closeTemplatePicker}
               initialSpaceId={spaceId}
             />
+          </React.Suspense>
         </ErrorBoundary>
       )}
     </>

apps/client/src/features/space/components/sidebar/switch-space.tsx

@@ -70,6 +70,7 @@ export function SwitchSpace({
           onChange={(space) => handleSelect(space.slug)}
           width={300}
           opened={true}
+          withinPortal={false}
         />
       </Popover.Dropdown>
     </Popover>

apps/client/src/features/workspace/types/workspace.types.ts

@@ -25,6 +25,8 @@ export interface IWorkspace {
   generativeAi?: boolean;
   disablePublicSharing?: boolean;
   mcpEnabled?: boolean;
+  aiChatReadOnly?: boolean;
+  aiChatWorkspaceKnowledgeOnly?: boolean;
   trashRetentionDays?: number;
   restrictApiToAdmins?: boolean;
   allowMemberTemplates?: boolean;
@@ -51,6 +53,8 @@ export interface IWorkspaceAiSettings {
   generative?: boolean;
   mcp?: boolean;
   chat?: boolean;
+  chatReadOnly?: boolean;
+  chatWorkspaceKnowledgeOnly?: boolean;
 }
 
 export interface IWorkspaceSharingSettings {

apps/client/src/lib/config.ts

@@ -43,6 +43,10 @@ export function isCloud(): boolean {
   return castToBoolean(getConfigValue("CLOUD"));
 }
 
+export function getAiVectorDriver(): string {
+  return getConfigValue("AI_VECTOR_DRIVER");
+}
+
 export function getAvatarUrl(
   avatarUrl: string,
   type: AvatarIconType = AvatarIconType.AVATAR,

apps/client/src/styles/a11y-overrides.css

@@ -33,3 +33,31 @@
   color: var(--mantine-color-dimmed);
   -webkit-text-fill-color: var(--mantine-color-dimmed);
 }
+
+/* Spotlight's selected action ships as primary-filled blue with white text,
+ * but our custom action children (gray badge, dimmed snippet, gray icons)
+ * keep their light-surface colors on it and drop below WCAG AA 4.5:1
+ * (WCAG 1.4.3). Use a gray selection one step above the gray-0/dark-6
+ * hover instead - it matches the app's selection styling (we use no blue
+ * fills) and keeps every child at its already-passing resting contrast.
+ */
+.mantine-Spotlight-action[data-selected] {
+  background-color: light-dark(
+    var(--mantine-color-gray-1),
+    var(--mantine-color-dark-5)
+  );
+  color: var(--mantine-color-text);
+  --action-description-color: var(--mantine-color-dimmed);
+  --action-description-opacity: 1;
+}
+
+/* Result actions are tab stops (tabIndex restored via ref); give keyboard
+ * focus the same gray treatment as arrow-key selection so both navigation
+ * modes read identically (WCAG 2.4.7 focus visible).
+ */
+.mantine-Spotlight-action:focus-visible {
+  background-color: light-dark(
+    var(--mantine-color-gray-1),
+    var(--mantine-color-dark-5)
+  );
+}

apps/client/vite.config.ts

@@ -16,6 +16,7 @@ export default defineConfig(({ mode }) => {
     BILLING_TRIAL_DAYS,
     POSTHOG_HOST,
     POSTHOG_KEY,
+    AI_VECTOR_DRIVER,
   } = loadEnv(mode, envPath, "");
 
   return {
@@ -31,6 +32,7 @@ export default defineConfig(({ mode }) => {
         BILLING_TRIAL_DAYS,
         POSTHOG_HOST,
         POSTHOG_KEY,
+        AI_VECTOR_DRIVER,
       },
       APP_VERSION: JSON.stringify(process.env.npm_package_version),
     },

apps/server/package.json

@@ -40,32 +40,33 @@
     "@clickhouse/client": "1.18.2",
     "@docmost/base-formula": "workspace:*",
     "@docmost/pdf-inspector": "1.9.6",
-    "@fastify/cookie": "11.0.2",
+    "@fastify/cookie": "11.1.2",
-    "@fastify/multipart": "10.0.0",
+    "@fastify/multipart": "10.1.1",
-    "@fastify/static": "10.1.2",
+    "@fastify/static": "10.1.3",
     "@keyv/redis": "5.1.6",
     "@langchain/core": "1.1.46",
     "@langchain/textsplitters": "1.0.1",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@nest-lab/throttler-storage-redis": "1.2.0",
     "@nestjs-labs/nestjs-ioredis": "11.0.4",
-    "@nestjs/bullmq": "11.0.4",
+    "@nestjs/bullmq": "11.0.5",
     "@nestjs/cache-manager": "3.1.3",
-    "@nestjs/common": "11.1.28",
+    "@nestjs/common": "11.2.1",
     "@nestjs/config": "4.0.4",
-    "@nestjs/core": "11.1.27",
+    "@nestjs/core": "11.2.1",
     "@nestjs/event-emitter": "3.1.0",
     "@nestjs/jwt": "11.0.2",
     "@nestjs/mapped-types": "2.1.1",
     "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-fastify": "11.1.28",
+    "@nestjs/platform-fastify": "11.2.1",
-    "@nestjs/platform-socket.io": "11.1.28",
+    "@nestjs/platform-socket.io": "11.2.1",
     "@nestjs/schedule": "6.1.3",
     "@nestjs/terminus": "11.1.1",
     "@nestjs/throttler": "6.5.0",
-    "@nestjs/websockets": "11.1.28",
+    "@nestjs/websockets": "11.2.1",
     "@node-saml/passport-saml": "5.1.0",
     "@socket.io/redis-adapter": "8.3.0",
+    "@turbopuffer/turbopuffer": "^2.8.0",
     "ai": "6.0.134",
     "ai-sdk-ollama": "3.8.1",
     "bcrypt": "6.0.0",
@@ -119,7 +120,7 @@
     "tmp-promise": "3.0.3",
     "typesense": "3.0.5",
     "undici": "7.29.0",
-    "ws": "8.21.0",
+    "ws": "8.21.3",
     "yauzl": "3.4.0",
     "zod": "4.3.6"
   },

apps/server/src/app.module.ts

@@ -22,11 +22,13 @@ import { TelemetryModule } from './integrations/telemetry/telemetry.module';
 import { RedisModule } from '@nestjs-labs/nestjs-ioredis';
 import { RedisConfigService } from './integrations/redis/redis-config.service';
 import { CacheModule } from '@nestjs/cache-manager';
-import KeyvRedis from '@keyv/redis';
+import KeyvRedis, { defaultReconnectStrategy } from '@keyv/redis';
+import { parseRedisUrl } from './common/helpers';
 import { LoggerModule } from './common/logger/logger.module';
 import { ClsModule } from 'nestjs-cls';
 import { NoopAuditModule } from './integrations/audit/audit.module';
 import { ThrottleModule } from './integrations/throttle/throttle.module';
+import { EncryptionModule } from './integrations/encryption/encryption.module';
 
 const enterpriseModules = [];
 try {
@@ -53,6 +55,7 @@ try {
     CoreModule,
     DatabaseModule,
     EnvironmentModule,
+    EncryptionModule,
     RedisModule.forRootAsync({
       useClass: RedisConfigService,
     }),
@@ -60,10 +63,20 @@ try {
       isGlobal: true,
       useFactory: async (environmentService: EnvironmentService) => {
         const redisUrl = environmentService.getRedisUrl();
+        const { family, tls } = parseRedisUrl(redisUrl);
 
         return {
           ttl: 5 * 1000,
-          stores: [new KeyvRedis(redisUrl)],
+          stores: [
+            new KeyvRedis({
+              url: redisUrl,
+              socket: {
+                family,
+                reconnectStrategy: defaultReconnectStrategy,
+                ...tls,
+              },
+            }),
+          ],
         };
       },
       inject: [EnvironmentService],

apps/server/src/collaboration/collaboration.gateway.ts

@@ -66,6 +66,7 @@ export class CollaborationGateway {
           password: this.redisConfig.password,
           db: this.redisConfig.db,
           family: this.redisConfig.family,
+          tls: this.redisConfig.tls,
           retryStrategy: createRetryStrategy(),
         }),
         serverId: `collab-${os?.hostname()}-${nanoid(10)}`,

apps/server/src/collaboration/collaboration.util.ts

@@ -57,6 +57,7 @@ import {
   JSONContent,
 } from '@tiptap/core';
 import { generateHTML, generateJSON } from '../common/helpers/prosemirror/html';
+import { collapseBlankLines } from '../common/helpers';
 // @tiptap/html library works best for generating prosemirror json state but not HTML
 // see: https://github.com/ueberdosis/tiptap/issues/5352
 // see:https://github.com/ueberdosis/tiptap/issues/4089
@@ -146,7 +147,7 @@ export function htmlToJson(html: string) {
 }
 
 export function jsonToText(tiptapJson: JSONContent) {
-  return generateText(tiptapJson, tiptapExtensions);
+  return collapseBlankLines(generateText(tiptapJson, tiptapExtensions));
 }
 
 export function jsonToNode(tiptapJson: JSONContent) {

apps/server/src/common/features.ts

@@ -23,6 +23,7 @@ export const Feature = {
   PERSONAL_SPACES: 'spaces:personal',
   DOCX_EXPORT: 'export:docx',
   BASES: 'bases',
+  AI_CONTROLS: 'ai:controls',
 } as const;
 
 export type FeatureKey = (typeof Feature)[keyof typeof Feature];

apps/server/src/common/helpers/index.ts

@@ -1,4 +1,5 @@
 export * from './utils';
+export * from './text.utils';
 export * from './nanoid.utils';
 export * from './file.helper';
 export * from './constants';

apps/server/src/common/helpers/text.utils.spec.ts

@@ -0,0 +1,14 @@
+import { collapseBlankLines } from './text.utils';
+
+describe('collapseBlankLines', () => {
+  it.each([
+    ['a\n\n\n\nb', 'a\n\nb'],
+    ['a\n\nb', 'a\n\nb'],
+    ['a\nb', 'a\nb'],
+    ['\n\n\n\na\n\n\n', '\n\na\n\n'],
+    ['no newlines', 'no newlines'],
+    ['', ''],
+  ])('collapses %j to %j', (input, expected) => {
+    expect(collapseBlankLines(input)).toBe(expected);
+  });
+});

apps/server/src/common/helpers/text.utils.ts

@@ -0,0 +1,3 @@
+export function collapseBlankLines(text: string): string {
+  return text.replace(/\n{2,}/g, '\n\n');
+}

apps/server/src/common/helpers/utils.ts

@@ -30,13 +30,14 @@ export type RedisConfig = {
   db: number;
   password?: string;
   family?: number;
+  tls?: { rejectUnauthorized?: boolean };
 };
 
 export function parseRedisUrl(redisUrl: string): RedisConfig {
-  // format - redis[s]://[[username][:password]@][host][:port][/db-number][?family=4|6]
+  // format - redis[s]://[[username][:password]@][host][:port][/db-number][?family=4|6][&rejectUnauthorized=false]
   const url = new URL(redisUrl);
-  const { hostname, port, password, pathname, searchParams } = url;
+  const { hostname, port, password, pathname, protocol, searchParams } = url;
-  const portInt = parseInt(port, 10);
+  const portInt = port ? parseInt(port, 10) : 6379;
 
   let db: number = 0;
   // extract db value if present
@@ -54,7 +55,14 @@ export function parseRedisUrl(redisUrl: string): RedisConfig {
     family = parseInt(familyParam, 10);
   }
 
-  return { host: hostname, port: portInt, password, db, family };
+  const tls =
+    protocol === 'rediss:'
+      ? searchParams.get('rejectUnauthorized') === 'false'
+        ? { rejectUnauthorized: false }
+        : {}
+      : undefined;
+
+  return { host: hostname, port: portInt, password: password || undefined, db, family, tls };
 }
 
 export function createRetryStrategy() {

apps/server/src/core/attachment/services/attachment.service.ts

@@ -116,8 +116,8 @@ export class AttachmentService {
         });
       }
 
-      // Only index PDFs and DOCX files
+      // Only index PDF, DOCX and TXT files
-      if (['.pdf', '.docx'].includes(attachment.fileExt.toLowerCase())) {
+      if (['.pdf', '.docx', '.txt'].includes(attachment.fileExt.toLowerCase())) {
         await this.attachmentQueue.add(
           QueueJob.ATTACHMENT_INDEX_CONTENT,
           {

apps/server/src/core/comment/comment.controller.ts

@@ -54,7 +54,7 @@ export class CommentController {
     @AuthWorkspace() workspace: Workspace,
   ) {
     const page = await this.pageRepo.findById(createCommentDto.pageId);
-    if (!page || page.deletedAt) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
       throw new NotFoundException('Page not found');
     }
 
@@ -89,9 +89,10 @@ export class CommentController {
     @Body()
     pagination: PaginationOptions,
     @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
   ) {
     const page = await this.pageRepo.findById(input.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
       throw new NotFoundException('Page not found');
     }
 
@@ -102,14 +103,18 @@ export class CommentController {
 
   @HttpCode(HttpStatus.OK)
   @Post('info')
-  async findOne(@Body() input: CommentIdDto, @AuthUser() user: User) {
+  async findOne(
+    @Body() input: CommentIdDto,
+    @AuthUser() user: User,
+    @AuthWorkspace() workspace: Workspace,
+  ) {
     const comment = await this.commentRepo.findById(input.commentId);
     if (!comment) {
       throw new NotFoundException('Comment not found');
     }
 
     const page = await this.pageRepo.findById(comment.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
       throw new NotFoundException('Page not found');
     }
 
@@ -130,7 +135,7 @@ export class CommentController {
     }
 
     const page = await this.pageRepo.findById(comment.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
       throw new NotFoundException('Page not found');
     }
 
@@ -148,7 +153,7 @@ export class CommentController {
     }
 
     const page = await this.pageRepo.findById(comment.pageId);
-    if (!page) {
+    if (!page || page.workspaceId !== workspace.id || page.deletedAt) {
       throw new NotFoundException('Page not found');
     }
 

apps/server/src/core/label/label.service.ts

@@ -7,12 +7,15 @@ import { executeTx } from '@docmost/db/utils';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PagePermissionRepo } from '@docmost/db/repos/page/page-permission.repo';
 import { normalizeLabelName } from './utils';
+import { EventEmitter2 } from "@nestjs/event-emitter";
+import { EventName } from "src/common/events/event.contants";
 
 @Injectable()
 export class LabelService {
   constructor(
     private readonly labelRepo: LabelRepo,
     private readonly pagePermissionRepo: PagePermissionRepo,
+    private readonly eventEmitter: EventEmitter2,
     @InjectKysely() private readonly db: KyselyDB,
   ) {}
 
@@ -34,6 +37,12 @@ export class LabelService {
         attached.push(label);
       }
     });
+
+    this.eventEmitter.emit(EventName.PAGE_UPDATED, {
+      pageIds: [pageId],
+      workspaceId: workspaceId,
+    });
+    
     return attached;
   }
 
@@ -64,6 +73,11 @@ export class LabelService {
         await this.labelRepo.deleteLabel(labelId, workspaceId, trx);
       }
     });
+
+    this.eventEmitter.emit(EventName.PAGE_UPDATED, {
+      pageIds: [pageId],
+      workspaceId: workspaceId,
+    });
   }
 
   async getPageLabels(pageId: string, pagination: PaginationOptions) {

apps/server/src/core/page/services/page.service.ts

@@ -496,10 +496,21 @@ export class PageService {
           },
         );
 
-        await this.aiQueue.add(QueueJob.PAGE_MOVED_TO_SPACE, {
+        await this.aiQueue.add(
+          QueueJob.PAGE_MOVED_TO_SPACE,
+          {
             pageIds: pageIdsToMove,
+            spaceId,
             workspaceId: rootPage.workspaceId,
-        });
+          },
+          {
+            attempts: 2,
+            backoff: {
+              type: 'fixed',
+              delay: 2 * 60 * 1000,
+            },
+          },
+        );
       }
     });
 

apps/server/src/core/search/dto/search.dto.ts

@@ -1,4 +1,5 @@
 import {
+  IsArray,
   IsBoolean,
   IsNotEmpty,
   IsNumber,
@@ -8,9 +9,9 @@ import {
 } from 'class-validator';
 
 export class SearchDTO {
-  @IsNotEmpty()
+  @IsOptional()
   @IsString()
-  query: string;
+  query?: string;
 
   @IsOptional()
   @IsUUID()
@@ -24,6 +25,15 @@ export class SearchDTO {
   @IsUUID()
   creatorId?: string;
 
+  @IsOptional()
+  @IsArray()
+  @IsUUID('all', { each: true })
+  labelIds?: string[];
+
+  @IsOptional()
+  @IsBoolean()
+  titleOnly?: boolean;
+
   @IsOptional()
   @IsNumber()
   limit?: number;

apps/server/src/core/search/search.service.ts

@@ -29,12 +29,36 @@ export class SearchService {
       workspaceId: string;
     },
   ): Promise<{ items: SearchResponseDto[] }> {
-    const { query } = searchParams;
+    const query = searchParams.query?.trim() ?? '';
+    const labelIds = [...new Set(searchParams.labelIds ?? [])];
+    // selected filters (labels, creator) are browsable without a query
+    const browseByFilters =
+      query.length < 1 &&
+      (labelIds.length > 0 || Boolean(searchParams.creatorId));
 
-    if (query.length < 1) {
+    if (query.length < 1 && !browseByFilters) {
       return { items: [] };
     }
-    const searchQuery = tsquery(query.trim() + '*');
+    const searchQuery = tsquery(query + '*');
+    const titleOnly = searchParams.titleOnly === true;
+    const titleQuery = query;
+    // escape LIKE wildcards; ranking keeps the raw query
+    const titleLikeQuery = query.replace(/[\\%_]/g, '\\$&');
+
+    const rankColumn = browseByFilters
+      ? sql<number>`0`.as('rank')
+      : titleOnly
+        ? sql<number>`word_similarity(lower(${titleQuery}), lower(pages.title))`.as(
+            'rank',
+          )
+        : sql<number>`ts_rank(tsv, to_tsquery('english', f_unaccent(${searchQuery})))`.as(
+            'rank',
+          );
+    const highlightColumn = browseByFilters || titleOnly
+      ? sql<string>`''`.as('highlight')
+      : sql<string>`ts_headline('english', text_content, to_tsquery('english', f_unaccent(${searchQuery})),'MinWords=9, MaxWords=10, MaxFragments=3')`.as(
+          'highlight',
+        );
 
     let queryResults = this.db
       .selectFrom('pages')
@@ -47,23 +71,41 @@ export class SearchService {
         'creatorId',
         'createdAt',
         'updatedAt',
-        sql<number>`ts_rank(tsv, to_tsquery('english', f_unaccent(${searchQuery})))`.as(
+        rankColumn,
-          'rank',
+        highlightColumn,
-        ),
-        sql<string>`ts_headline('english', text_content, to_tsquery('english', f_unaccent(${searchQuery})),'MinWords=9, MaxWords=10, MaxFragments=3')`.as(
-          'highlight',
-        ),
       ])
-      .where(
+      .$if(!browseByFilters && !titleOnly, (qb) =>
+        qb.where(
           'tsv',
           '@@',
           sql<string>`to_tsquery('english', f_unaccent(${searchQuery}))`,
+        ),
+      )
+      .$if(!browseByFilters && titleOnly, (qb) =>
+        qb.where((eb) =>
+          eb(
+            sql`lower(pages.title)`,
+            'like',
+            sql`lower(${`%${titleLikeQuery}%`})`,
+          ),
+        ),
       )
       .$if(Boolean(searchParams.creatorId), (qb) =>
         qb.where('creatorId', '=', searchParams.creatorId),
       )
+      .$if(labelIds?.length > 0, (qb) =>
+        qb.where(
+          'id',
+          'in',
+          this.db
+            .selectFrom('pageLabels')
+            .select('pageId')
+            .where('labelId', 'in', labelIds),
+        ),
+      )
       .where('deletedAt', 'is', null)
-      .orderBy('rank', 'desc')
+      .$if(browseByFilters, (qb) => qb.orderBy('updatedAt', 'desc'))
+      .$if(!browseByFilters, (qb) => qb.orderBy('rank', 'desc'))
       .limit(searchParams.limit || 25)
       .offset(searchParams.offset || 0);
 
@@ -71,8 +113,7 @@ export class SearchService {
       queryResults = queryResults.select((eb) => this.pageRepo.withSpace(eb));
     }
 
-    if (searchParams.spaceId) {
+    if (searchParams.spaceId && opts.userId) {
-      // search by spaceId
       queryResults = queryResults.where('spaceId', '=', searchParams.spaceId);
     } else if (opts.userId && !searchParams.spaceId) {
       // only search spaces the user is a member of

apps/server/src/core/share/share.service.ts

@@ -46,8 +46,9 @@ export class ShareService {
       throw new NotFoundException('Share not found');
     }
 
-    const isRestricted =
+    const isRestricted = await this.pagePermissionRepo.hasRestrictedAncestor(
-      await this.pagePermissionRepo.hasRestrictedAncestor(share.pageId);
+      share.pageId,
+    );
     if (isRestricted) {
       throw new NotFoundException('Share not found');
     }
@@ -110,6 +111,9 @@ export class ShareService {
   }
 
   async getSharedPage(dto: ShareInfoDto, workspaceId: string) {
+    //TODO: we should resolve the page from the share id
+    if (!dto.pageId) throw new NotFoundException('Shared page not found');
+
     const share = await this.getShareForPage(dto.pageId, workspaceId);
 
     if (!share) {
@@ -126,8 +130,9 @@ export class ShareService {
     }
 
     // Block access to restricted pages
-    const isRestricted =
+    const isRestricted = await this.pagePermissionRepo.hasRestrictedAncestor(
-      await this.pagePermissionRepo.hasRestrictedAncestor(page.id);
+      page.id,
+    );
     if (isRestricted) {
       throw new NotFoundException('Shared page not found');
     }

apps/server/src/core/space/services/space-member.service.ts

@@ -339,15 +339,25 @@ export class SpaceMemberService {
       return;
     }
 
+    await executeTx(this.db, async (trx) => {
+      await trx
+        .selectFrom('spaces')
+        .select('id')
+        .where('id', '=', dto.spaceId)
+        .forUpdate()
+        .executeTakeFirst();
+
       if (spaceMember.role === SpaceRole.ADMIN) {
-      await this.validateLastAdmin(dto.spaceId);
+        await this.validateLastAdmin(dto.spaceId, trx);
       }
 
       await this.spaceMemberRepo.updateSpaceMember(
         { role: dto.role },
         spaceMember.id,
         dto.spaceId,
+        trx,
       );
+    });
 
     this.auditService.log({
       event: AuditEvent.SPACE_MEMBER_ROLE_CHANGED,
@@ -368,10 +378,14 @@ export class SpaceMemberService {
     });
   }
 
-  async validateLastAdmin(spaceId: string): Promise<void> {
+  async validateLastAdmin(
+    spaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<void> {
     const spaceOwnerCount = await this.spaceMemberRepo.roleCountBySpaceId(
       SpaceRole.ADMIN,
       spaceId,
+      trx,
     );
     if (spaceOwnerCount === 1) {
       throw new BadRequestException(

apps/server/src/core/workspace/dto/update-workspace.dto.ts

@@ -68,4 +68,12 @@ export class UpdateWorkspaceDto extends PartialType(CreateWorkspaceDto) {
   @IsString()
   @IsIn(['read', 'edit'])
   defaultPageEditMode: string;
+
+  @IsOptional()
+  @IsBoolean()
+  aiChatReadOnly: boolean;
+
+  @IsOptional()
+  @IsBoolean()
+  aiChatWorkspaceKnowledgeOnly: boolean;
 }

apps/server/src/core/workspace/services/workspace.service.ts

@@ -334,7 +334,9 @@ export class WorkspaceService {
       typeof updateWorkspaceDto.restrictApiToAdmins !== 'undefined' ||
       typeof updateWorkspaceDto.allowMemberTemplates !== 'undefined' ||
       typeof updateWorkspaceDto.isScimEnabled !== 'undefined' ||
-      typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined'
+      typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined' ||
+      typeof updateWorkspaceDto.aiChatReadOnly !== 'undefined' ||
+      typeof updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly !== 'undefined'
     ) {
       const ws = await this.db
         .selectFrom('workspaces')
@@ -374,6 +376,21 @@ export class WorkspaceService {
         }
       }
 
+      if (
+        typeof updateWorkspaceDto.aiChatReadOnly !== 'undefined' ||
+        typeof updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly !== 'undefined'
+      ) {
+        if (
+          !this.licenseCheckService.hasFeature(
+            ws.licenseKey,
+            Feature.AI_CONTROLS,
+            ws.plan,
+          )
+        ) {
+          throw new ForbiddenException('This feature requires a valid license');
+        }
+      }
+
       if (
         typeof updateWorkspaceDto.disablePublicSharing !== 'undefined' ||
         typeof updateWorkspaceDto.trashRetentionDays !== 'undefined' ||
@@ -396,7 +413,10 @@ export class WorkspaceService {
       }
     }
 
-    if (updateWorkspaceDto.aiSearch) {
+    if (
+      updateWorkspaceDto.aiSearch &&
+      this.environmentService.getAiVectorDriver() !== 'turbopuffer'
+    ) {
       const tableExists = await isPageEmbeddingsTableExists(this.db);
       if (!tableExists) {
         throw new BadRequestException(
@@ -513,6 +533,34 @@ export class WorkspaceService {
         );
       }
 
+      if (typeof updateWorkspaceDto.aiChatReadOnly !== 'undefined') {
+        const prev = settingsBefore?.ai?.chatReadOnly ?? false;
+        if (prev !== updateWorkspaceDto.aiChatReadOnly) {
+          before.aiChatReadOnly = prev;
+          after.aiChatReadOnly = updateWorkspaceDto.aiChatReadOnly;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'chatReadOnly',
+          updateWorkspaceDto.aiChatReadOnly,
+          trx,
+        );
+      }
+
+      if (typeof updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly !== 'undefined') {
+        const prev = settingsBefore?.ai?.chatWorkspaceKnowledgeOnly ?? false;
+        if (prev !== updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly) {
+          before.aiChatWorkspaceKnowledgeOnly = prev;
+          after.aiChatWorkspaceKnowledgeOnly = updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly;
+        }
+        await this.workspaceRepo.updateAiSettings(
+          workspaceId,
+          'chatWorkspaceKnowledgeOnly',
+          updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly,
+          trx,
+        );
+      }
+
       if (typeof updateWorkspaceDto.allowPersonalSpaces !== 'undefined') {
         const prev = settingsBefore?.spaces?.allowPersonal ?? false;
         if (prev !== updateWorkspaceDto.allowPersonalSpaces) {
@@ -550,6 +598,8 @@ export class WorkspaceService {
       delete updateWorkspaceDto.aiChat;
       delete updateWorkspaceDto.allowPersonalSpaces;
       delete updateWorkspaceDto.defaultPageEditMode;
+      delete updateWorkspaceDto.aiChatReadOnly;
+      delete updateWorkspaceDto.aiChatWorkspaceKnowledgeOnly;
 
       await this.workspaceRepo.updateWorkspace(
         updateWorkspaceDto,

apps/server/src/database/listeners/space.listener.ts

@@ -8,6 +8,7 @@ import { EnvironmentService } from '../../integrations/environment/environment.s
 
 export class SpaceEvent {
   spaceId: string;
+  workspaceId: string;
 }
 
 @Injectable()
@@ -22,12 +23,12 @@ export class SpaceListener {
 
   @OnEvent(EventName.SPACE_DELETED)
   async handleSpaceDeleted(event: SpaceEvent) {
-    const { spaceId } = event;
+    const { spaceId, workspaceId } = event;
     if (this.isTypesense()) {
       await this.searchQueue.add(QueueJob.SPACE_DELETED, { spaceId });
     }
 
-    await this.aiQueue.add(QueueJob.SPACE_DELETED, { spaceId });
+    await this.aiQueue.add(QueueJob.SPACE_DELETED, { spaceId, workspaceId });
   }
 
   isTypesense(): boolean {

apps/server/src/database/migrations/20260824T211732-page-title-trgm-index.ts

@@ -0,0 +1,17 @@
+import { type Kysely, sql } from 'kysely';
+
+export async function up(db: Kysely<any>): Promise<void> {
+  await sql`CREATE INDEX IF NOT EXISTS pages_title_trgm_idx ON pages USING gin (lower(title) gin_trgm_ops)`.execute(
+    db,
+  );
+
+  // separators normalized to spaces so space-typed queries match How_to_export.pdf
+  await sql`CREATE INDEX IF NOT EXISTS attachments_file_name_trgm_idx ON attachments USING gin (lower(translate(file_name, '_.-', '   ')) gin_trgm_ops)`.execute(
+    db,
+  );
+}
+
+export async function down(db: Kysely<any>): Promise<void> {
+  await sql`DROP INDEX IF EXISTS attachments_file_name_trgm_idx`.execute(db);
+  await sql`DROP INDEX IF EXISTS pages_title_trgm_idx`.execute(db);
+}

apps/server/src/database/repos/space/space-member.repo.ts

@@ -46,8 +46,10 @@ export class SpaceMemberRepo {
     updatableSpaceMember: UpdatableSpaceMember,
     spaceMemberId: string,
     spaceId: string,
+    trx?: KyselyTransaction,
   ): Promise<void> {
-    await this.db
+    const db = dbOrTx(this.db, trx);
+    await db
       .updateTable('spaceMembers')
       .set(updatableSpaceMember)
       .where('id', '=', spaceMemberId)
@@ -92,8 +94,13 @@ export class SpaceMemberRepo {
       .execute();
   }
 
-  async roleCountBySpaceId(role: string, spaceId: string): Promise<number> {
+  async roleCountBySpaceId(
-    const { count } = await this.db
+    role: string,
+    spaceId: string,
+    trx?: KyselyTransaction,
+  ): Promise<number> {
+    const db = dbOrTx(this.db, trx);
+    const { count } = await db
       .selectFrom('spaceMembers')
       .select((eb) => eb.fn.count('role').as('count'))
       .where('role', '=', role)

apps/server/src/database/repos/space/space.repo.ts

@@ -230,6 +230,7 @@ export class SpaceRepo {
 
     this.eventEmitter.emit(EventName.SPACE_DELETED, {
       spaceId,
+      workspaceId,
     });
   }
 }

apps/server/src/database/repos/workspace/workspace.repo.ts

@@ -211,6 +211,24 @@ export class WorkspaceRepo {
       .executeTakeFirst();
   }
 
+  async updateAiEmbeddingFingerprint(
+    workspaceId: string,
+    fingerprint: { driver: string; model: string; dimensions: number },
+    trx?: KyselyTransaction,
+  ) {
+    const db = dbOrTx(this.db, trx);
+    return db
+      .updateTable('workspaces')
+      .set({
+        settings: sql`COALESCE(settings, '{}'::jsonb)
+                || jsonb_build_object('ai', COALESCE(settings->'ai', '{}'::jsonb)
+                || jsonb_build_object('embedding', ${JSON.stringify(fingerprint)}::text::jsonb))`,
+        updatedAt: new Date(),
+      })
+      .where('id', '=', workspaceId)
+      .execute();
+  }
+
   async updateSharingSettings(
     workspaceId: string,
     prefKey: string,

apps/server/src/integrations/encryption/encryption.errors.ts

@@ -0,0 +1,13 @@
+export class UnableToInitialize extends Error {
+  constructor(message: string) {
+    super(`Unable to initialize the encryption service: ${message}`);
+    this.name = 'UnableToInitialize';
+  }
+}
+
+export class UnableToDecrypt extends Error {
+  constructor(reason: string) {
+    super(`Unable to decrypt the ciphertext: ${reason}`);
+    this.name = 'UnableToDecrypt';
+  }
+}

apps/server/src/integrations/encryption/encryption.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { EncryptionService } from './encryption.service';
+
+@Global()
+@Module({
+  providers: [EncryptionService],
+  exports: [EncryptionService],
+})
+export class EncryptionModule {}

apps/server/src/integrations/encryption/encryption.service.spec.ts

@@ -0,0 +1,184 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { EncryptionService } from './encryption.service';
+import { UnableToDecrypt, UnableToInitialize } from './encryption.errors';
+import { EnvironmentService } from '../environment/environment.service';
+
+const APP_SECRET = 'test-app-secret-with-plenty-of-entropy-1234567890';
+
+const buildService = (appSecret: string | undefined) => {
+  const env = { getAppSecret: () => appSecret } as EnvironmentService;
+  return new EncryptionService(env);
+};
+
+const decodeEnvelope = (encrypted: string) =>
+  JSON.parse(Buffer.from(encrypted, 'base64').toString()) as {
+    iv: string;
+    authTag: string;
+    cipherText: string;
+  };
+
+const encodeEnvelope = (envelope: {
+  iv: string;
+  authTag: string;
+  cipherText: string;
+}) => Buffer.from(JSON.stringify(envelope)).toString('base64');
+
+describe('EncryptionService', () => {
+  let service: EncryptionService;
+
+  beforeEach(async () => {
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        EncryptionService,
+        {
+          provide: EnvironmentService,
+          useValue: { getAppSecret: () => APP_SECRET },
+        },
+      ],
+    }).compile();
+
+    service = module.get<EncryptionService>(EncryptionService);
+  });
+
+  describe('initialization', () => {
+    it('compiles via Nest DI', () => {
+      expect(service).toBeDefined();
+    });
+
+    it('throws UnableToInitialize when APP_SECRET is missing', () => {
+      expect(() => buildService(undefined)).toThrow(UnableToInitialize);
+      expect(() => buildService('')).toThrow(UnableToInitialize);
+    });
+  });
+
+  describe('encrypt + decrypt round-trip', () => {
+    it('decrypts back to the original plaintext', () => {
+      const plaintext = 'hello world';
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('handles empty string', () => {
+      const encrypted = service.encrypt('');
+      expect(service.decrypt(encrypted)).toBe('');
+    });
+
+    it('handles unicode (multi-byte UTF-8)', () => {
+      const plaintext = 'héllo 🔐 世界';
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('handles long plaintext (>1 block)', () => {
+      const plaintext = 'a'.repeat(10_000);
+      const encrypted = service.encrypt(plaintext);
+      expect(service.decrypt(encrypted)).toBe(plaintext);
+    });
+
+    it('produces distinct ciphertexts for the same plaintext (random IV)', () => {
+      const plaintext = 'same input';
+      const a = service.encrypt(plaintext);
+      const b = service.encrypt(plaintext);
+      expect(a).not.toBe(b);
+      expect(service.decrypt(a)).toBe(plaintext);
+      expect(service.decrypt(b)).toBe(plaintext);
+    });
+  });
+
+  describe('cross-key isolation', () => {
+    it('cannot decrypt ciphertext produced under a different APP_SECRET', () => {
+      const other = buildService('totally-different-secret-value-9876543210');
+      const encrypted = service.encrypt('secret');
+      expect(() => other.decrypt(encrypted)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('tamper detection', () => {
+    it('rejects modified ciphertext', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedCipher = Buffer.from(env.cipherText, 'base64');
+      tamperedCipher[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        cipherText: tamperedCipher.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects modified auth tag', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedTag = Buffer.from(env.authTag, 'base64');
+      tamperedTag[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        authTag: tamperedTag.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects modified IV', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const tamperedIV = Buffer.from(env.iv, 'base64');
+      tamperedIV[0] ^= 0x01;
+      const tampered = encodeEnvelope({
+        ...env,
+        iv: tamperedIV.toString('base64'),
+      });
+      expect(() => service.decrypt(tampered)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('malformed payloads', () => {
+    it('rejects non-base64 garbage', () => {
+      expect(() => service.decrypt('!!!not-valid-base64!!!')).toThrow(
+        UnableToDecrypt,
+      );
+    });
+
+    it('rejects base64 of non-JSON', () => {
+      const garbage = Buffer.from('not json at all').toString('base64');
+      expect(() => service.decrypt(garbage)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects JSON missing required fields', () => {
+      const partial = encodeEnvelope({
+        iv: Buffer.alloc(12).toString('base64'),
+        authTag: Buffer.alloc(16).toString('base64'),
+      } as never);
+      expect(() => service.decrypt(partial)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects wrong-length IV', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const bad = encodeEnvelope({
+        ...env,
+        iv: Buffer.alloc(8).toString('base64'),
+      });
+      expect(() => service.decrypt(bad)).toThrow(UnableToDecrypt);
+    });
+
+    it('rejects wrong-length auth tag', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      const bad = encodeEnvelope({
+        ...env,
+        authTag: Buffer.alloc(8).toString('base64'),
+      });
+      expect(() => service.decrypt(bad)).toThrow(UnableToDecrypt);
+    });
+  });
+
+  describe('envelope format', () => {
+    it('returns base64 of JSON envelope with iv (12B), authTag (16B), cipherText', () => {
+      const encrypted = service.encrypt('hello');
+      const env = decodeEnvelope(encrypted);
+      expect(Buffer.from(env.iv, 'base64')).toHaveLength(12);
+      expect(Buffer.from(env.authTag, 'base64')).toHaveLength(16);
+      expect(Buffer.from(env.cipherText, 'base64').length).toBeGreaterThan(0);
+    });
+  });
+});

apps/server/src/integrations/encryption/encryption.service.ts

@@ -0,0 +1,108 @@
+// https://github.com/nhedger/nestjs-encryption - MIT
+import { Injectable } from '@nestjs/common';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from 'node:crypto';
+import { UnableToDecrypt, UnableToInitialize } from './encryption.errors';
+import { EnvironmentService } from '../environment/environment.service';
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_DOMAIN = 'docmost:encryption:v1';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+
+type AEADPayload<TFormat = string | Buffer> = {
+  iv: TFormat;
+  authTag: TFormat;
+  cipherText: TFormat;
+};
+
+@Injectable()
+export class EncryptionService {
+  private readonly key: Buffer;
+
+  constructor(environmentService: EnvironmentService) {
+    const appSecret = environmentService.getAppSecret();
+    if (!appSecret) {
+      throw new UnableToInitialize('APP_SECRET is not set.');
+    }
+    this.key = createHash('sha256')
+      .update(KEY_DOMAIN)
+      .update(appSecret)
+      .digest();
+  }
+
+  public encrypt(plaintext: string): string {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.key, iv);
+    const cipherText = Buffer.concat([
+      cipher.update(plaintext, 'utf8'),
+      cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+
+    const aead: AEADPayload<string> = {
+      iv: iv.toString('base64'),
+      authTag: authTag.toString('base64'),
+      cipherText: cipherText.toString('base64'),
+    };
+
+    return Buffer.from(JSON.stringify(aead)).toString('base64');
+  }
+
+  public decrypt(encrypted: string): string {
+    try {
+      const { iv, authTag, cipherText } = this.decodeAEADPayload(encrypted);
+      const decipher = createDecipheriv(ALGORITHM, this.key, iv);
+      decipher.setAuthTag(authTag);
+      const decrypted = Buffer.concat([
+        decipher.update(cipherText),
+        decipher.final(),
+      ]);
+      return decrypted.toString('utf8');
+    } catch (e: unknown) {
+      throw new UnableToDecrypt((e as Error).message);
+    }
+  }
+
+  private decodeAEADPayload(encodedPayload: string): AEADPayload<Buffer> {
+    const payload = Buffer.from(encodedPayload, 'base64');
+
+    let deserializedPkg: Record<string, unknown>;
+    try {
+      deserializedPkg = JSON.parse(payload.toString());
+    } catch {
+      throw new Error('The decoded AEAD payload is not a valid JSON string.');
+    }
+
+    for (const field of ['iv', 'authTag', 'cipherText']) {
+      if (!Object.prototype.hasOwnProperty.call(deserializedPkg, field)) {
+        throw new Error(`The AEAD payload is missing the ${field} field.`);
+      }
+    }
+
+    const iv = Buffer.from(deserializedPkg.iv as string, 'base64');
+    if (iv.length !== IV_LENGTH) {
+      throw new Error(
+        `The decoded IV is not the correct length. Expected ${IV_LENGTH} bytes, got ${iv.length} bytes.`,
+      );
+    }
+
+    const authTag = Buffer.from(deserializedPkg.authTag as string, 'base64');
+    if (authTag.length !== AUTH_TAG_LENGTH) {
+      throw new Error(
+        `The decoded auth tag is not the correct length. Expected ${AUTH_TAG_LENGTH} bytes, got ${authTag.length} bytes.`,
+      );
+    }
+
+    const cipherText = Buffer.from(
+      deserializedPkg.cipherText as string,
+      'base64',
+    );
+
+    return { iv, authTag, cipherText };
+  }
+}

apps/server/src/integrations/environment/environment.service.ts

@@ -310,6 +310,31 @@ export class EnvironmentService {
     return val === 'true';
   }
 
+  getAiVectorDriver(): string {
+    return this.configService
+      .get<string>('AI_VECTOR_DRIVER', 'pgvector')
+      .toLowerCase();
+  }
+
+  getTurbopufferApiKey(): string {
+    return this.configService.get<string>('TURBOPUFFER_API_KEY');
+  }
+
+  getTurbopufferRegion(): string {
+    return this.configService.get<string>('TURBOPUFFER_REGION');
+  }
+
+  getTurbopufferBaseUrl(): string {
+    return this.configService.get<string>('TURBOPUFFER_BASE_URL');
+  }
+
+  getTurbopufferNamespacePrefix(): string {
+    return this.configService.get<string>(
+      'TURBOPUFFER_NAMESPACE_PREFIX',
+      'docmost',
+    );
+  }
+
   getOpenAiApiKey(): string {
     return this.configService.get<string>('OPENAI_API_KEY');
   }

apps/server/src/integrations/environment/environment.validation.ts

@@ -5,6 +5,7 @@ import {
   IsOptional,
   IsString,
   IsUrl,
+  Matches,
   MinLength,
   ValidateIf,
   validateSync,
@@ -108,6 +109,41 @@ export class EnvironmentVariables {
   @IsString()
   AI_DRIVER: string;
 
+  @IsOptional()
+  @ValidateIf((obj) => obj.AI_VECTOR_DRIVER)
+  @IsIn(['pgvector', 'turbopuffer'])
+  @IsString()
+  AI_VECTOR_DRIVER: string;
+
+  @ValidateIf((obj) => obj.AI_VECTOR_DRIVER === 'turbopuffer')
+  @IsNotEmpty()
+  @IsString()
+  TURBOPUFFER_API_KEY: string;
+
+  @ValidateIf(
+    (obj) =>
+      obj.AI_VECTOR_DRIVER === 'turbopuffer' && !obj.TURBOPUFFER_BASE_URL,
+  )
+  @IsNotEmpty({
+    message:
+      'TURBOPUFFER_REGION is required when AI_VECTOR_DRIVER is turbopuffer, unless TURBOPUFFER_BASE_URL is set',
+  })
+  @IsString()
+  TURBOPUFFER_REGION: string;
+
+  @IsOptional()
+  @ValidateIf((obj) => obj.TURBOPUFFER_BASE_URL != '' && obj.TURBOPUFFER_BASE_URL != null)
+  @IsUrl({ protocols: ['http', 'https'], require_tld: false })
+  TURBOPUFFER_BASE_URL: string;
+
+  @IsOptional()
+  @IsString()
+  @Matches(/^[A-Za-z0-9\-_.]{1,90}$/, {
+    message:
+      'TURBOPUFFER_NAMESPACE_PREFIX may only contain letters, digits, dot, dash, underscore (max 90 chars)',
+  })
+  TURBOPUFFER_NAMESPACE_PREFIX: string;
+
   @IsOptional()
   @IsString()
   AI_EMBEDDING_MODEL: string;

apps/server/src/integrations/health/redis.health.ts

@@ -5,6 +5,7 @@ import {
 import { Injectable, Logger } from '@nestjs/common';
 import { EnvironmentService } from '../environment/environment.service';
 import { Redis } from 'ioredis';
+import { parseRedisUrl } from '../../common/helpers';
 
 @Injectable()
 export class RedisHealthIndicator {
@@ -19,8 +20,10 @@ export class RedisHealthIndicator {
     const indicator = this.healthIndicatorService.check(key);
 
     try {
-      const redis = new Redis(this.environmentService.getRedisUrl(), {
+      const redisUrl = this.environmentService.getRedisUrl();
+      const redis = new Redis(redisUrl, {
         maxRetriesPerRequest: 15,
+        tls: parseRedisUrl(redisUrl).tls,
       });
 
       await redis.ping();

apps/server/src/integrations/queue/constants/queue.constants.ts

@@ -61,6 +61,7 @@ export enum QueueJob {
   WORKSPACE_DELETED = 'workspace-deleted',
   WORKSPACE_CREATE_EMBEDDINGS = 'workspace-create-embeddings',
   WORKSPACE_DELETE_EMBEDDINGS = 'workspace-delete-embeddings',
+  WORKSPACE_RESET_EMBEDDINGS = 'workspace-reset-embeddings',
 
   GENERATE_PAGE_EMBEDDINGS = 'generate-page-embeddings',
   DELETE_PAGE_EMBEDDINGS = 'delete-page-embeddings',

apps/server/src/integrations/queue/queue.module.ts

@@ -18,6 +18,7 @@ import { GeneralQueueProcessor } from './processors/general-queue.processor';
             password: redisConfig.password,
             db: redisConfig.db,
             family: redisConfig.family,
+            tls: redisConfig.tls,
             retryStrategy: createRetryStrategy(),
           },
           defaultJobOptions: {

apps/server/src/integrations/redis/redis-config.service.ts

@@ -19,6 +19,7 @@ export class RedisConfigService implements RedisOptionsFactory {
         password: redisConfig.password,
         db: redisConfig.db,
         family: redisConfig.family,
+        tls: redisConfig.tls,
         retryStrategy: createRetryStrategy(),
       },
     };

apps/server/src/integrations/static/static.module.ts

@@ -49,6 +49,10 @@ export class StaticModule implements OnModuleInit {
           : undefined,
         POSTHOG_HOST: this.environmentService.getPostHogHost(),
         POSTHOG_KEY: this.environmentService.getPostHogKey(),
+        AI_VECTOR_DRIVER:
+          this.environmentService.getAiVectorDriver() === 'turbopuffer'
+            ? 'turbopuffer'
+            : undefined,
       };
 
       const windowScriptContent = `<script>window.CONFIG=${JSON.stringify(configString)};</script>`;
@@ -67,6 +71,15 @@ export class StaticModule implements OnModuleInit {
       await app.register(fastifyStatic, {
         root: clientDistPath,
         wildcard: false,
+        setHeaders: (reply: any, pathName: string) => {
+          // Vite content-hashes everything under /assets, so they can be cached forever
+          if (/[\\/]assets[\\/]/.test(pathName)) {
+            reply.header(
+              'Cache-Control',
+              'public, max-age=31536000, immutable',
+            );
+          }
+        },
       });
 
       app.get(RENDER_PATH, (req: any, res: any) => {

apps/server/src/integrations/throttle/throttle.module.ts

@@ -3,7 +3,7 @@ import { ThrottlerModule } from '@nestjs/throttler';
 import { ThrottlerStorageRedisService } from '@nest-lab/throttler-storage-redis';
 import { EnvironmentService } from '../environment/environment.service';
 import { EnvironmentModule } from '../environment/environment.module';
-import { parseRedisUrl } from '../../common/helpers';
+import { createRetryStrategy, parseRedisUrl } from '../../common/helpers';
 import { AUTH_THROTTLER, AI_CHAT_THROTTLER } from './throttler-names';
 import Redis from 'ioredis';
 
@@ -27,6 +27,8 @@ import Redis from 'ioredis';
               password: redisConfig.password,
               db: redisConfig.db,
               family: redisConfig.family,
+              tls: redisConfig.tls,
+              retryStrategy: createRetryStrategy(),
               keyPrefix: 'throttle:',
             }),
           ),

apps/server/src/ws/adapter/ws-redis.adapter.ts

@@ -17,6 +17,7 @@ export class WsRedisIoAdapter extends IoAdapter {
 
     const options: RedisOptions = {
       family: this.redisConfig.family,
+      tls: this.redisConfig.tls,
       retryStrategy: createRetryStrategy(),
     };
 

package.json

@@ -95,5 +95,5 @@
       "packages/*"
     ]
   },
-  "packageManager": "pnpm@11.15.1"
+  "packageManager": "pnpm@11.23.0"
 }

packages/editor-ext/src/lib/embed-provider.ts

@@ -73,9 +73,13 @@ export const embedProviders: IEmbedProvider[] = [
     id: "vimeo",
     name: "Vimeo",
     regex:
-      /^(https:)?\/\/(?:www\.|player\.)?vimeo.com\/(?:channels\/(?:\w+\/)?|groups\/([^/]*)\/videos\/|album\/(\d+)\/video\/|video\/|)(\d+)/,
+      /^(https:)?\/\/(?:www\.|player\.)?vimeo.com\/(?:channels\/(?:\w+\/)?|groups\/([^/]*)\/videos\/|album\/(\d+)\/video\/|video\/|)(\d+)(?:\/([\da-zA-Z]+))?/,
-    getEmbedUrl: (match) => {
+    getEmbedUrl: (match, url: string) => {
-      return `https://player.vimeo.com/video/${match[4]}`;
+      // preserve ?h= hash for unlisted videos
+      const hash =
+        match[5] ?? new URL(url, "https://vimeo.com").searchParams.get("h");
+      const base = `https://player.vimeo.com/video/${match[4]}`;
+      return hash ? `${base}?h=${hash}` : base;
     },
   },
   {

pnpm-workspace.yaml

@@ -6,12 +6,12 @@ patchedDependencies:
 overrides:
   prosemirror-changeset: 2.4.0
   glob: 13.0.6
-  ws: 8.21.0
+  ws: 8.21.3
   dompurify: 3.4.13
   mermaid: 11.16.1
   undici: 7.29.0
   tmp: 0.2.7
-  nanoid@^3: 3.3.17
+  nanoid@^3: 3.3.18
   lodash-es: 4.18.1
   express-rate-limit: 8.2.2
   flatted: 3.4.2