docs: add views/serialisers split spec and implementation plan

Specifies splitting documents/views.py and documents/serialisers.py (5,395 and 3,532 lines) into per-domain-area packages, pure move/reorganize with no behavior change. Scoped as its own branch against dev, to land after the in-flight feature-ai-taxonomy-hints-v2 work merges rather than layering on top of it.
Auto translate strings
2026-08-15 07:13:18 +00:00 · 2026-08-13 13:35:06 -07:00 · 2026-08-13 19:48:40 +00:00 · 2026-08-13 12:46:57 -07:00 · 2026-08-13 18:29:33 +00:00 · 2026-08-13 10:57:16 -07:00
146 changed files with 10583 additions and 5203 deletions
@@ -1,49 +1,51 @@
 categories:
  - type: 'pre-include'
    when:
      - label: 'enhancement'
      - label: 'bug'
      - label: 'chore'
      - label: 'deployment'
      - label: 'translation'
      - label: 'dependencies'
      - label: 'documentation'
      - label: 'frontend'
      - label: 'backend'
      - label: 'ci-cd'
      - label: 'breaking-change'
      - label: 'notable'
  - type: 'pre-exclude'
    when:
      - label: 'skip-changelog'
  - title: 'Breaking Changes'
-    labels:
+    when:
-      - 'breaking-change'
+      - label: 'breaking-change'
  - title: 'Notable Changes'
-    labels:
+    when:
-      - 'notable'
+      - label: 'notable'
  - title: 'Features / Enhancements'
-    labels:
+    when:
-      - 'enhancement'
+      - label: 'enhancement'
  - title: 'Bug Fixes'
-    labels:
+    when:
-      - 'bug'
+      - label: 'bug'
  - title: 'Documentation'
-    labels:
+    when:
-      - 'documentation'
+      - label: 'documentation'
  - title: 'Maintenance'
-    labels:
+    when:
-      - 'chore'
+      - label: 'chore'
-      - 'deployment'
+      - label: 'deployment'
-      - 'translation'
+      - label: 'translation'
-      - 'ci-cd'
+      - label: 'ci-cd'
  - title: 'Dependencies'
    collapse-after: 3
-    labels:
+    when:
-      - 'dependencies'
+      - label: 'dependencies'
  - title: 'All App Changes'
    labels:
      - 'frontend'
      - 'backend'
    collapse-after: 1
-include-labels:
+    when:
-  - 'enhancement'
+      - label: 'frontend'
-  - 'bug'
+      - label: 'backend'
  - 'chore'
  - 'deployment'
  - 'translation'
  - 'dependencies'
  - 'documentation'
  - 'frontend'
  - 'backend'
  - 'ci-cd'
  - 'breaking-change'
  - 'notable'
 exclude-labels:
  - 'skip-changelog'
 filter-by-commitish: true
 category-template: '### $TITLE'
 change-template: '- $TITLE @$AUTHOR ([#$NUMBER]($URL))'
@@ -24,7 +24,7 @@ jobs:
      backend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.backend == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -63,7 +63,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -87,7 +87,7 @@ jobs:
      fail-fast: false
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Start containers
@@ -96,11 +96,11 @@ jobs:
          docker compose --file docker/compose/docker-compose.ci-test.yml up --detach
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "${{ matrix.python-version }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -169,16 +169,16 @@ jobs:
      PAPERLESS_SECRET_KEY: "ci-typing-not-a-real-secret"
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "${{ env.DEFAULT_PYTHON }}"
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -41,7 +41,7 @@ jobs:
      ref-name: ${{ steps.ref.outputs.name }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Determine ref name
@@ -106,9 +106,9 @@ jobs:
          echo "repository=${repo_name}"
          echo "name=${repo_name}" >> $GITHUB_OUTPUT
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -121,7 +121,7 @@ jobs:
          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
      - name: Docker metadata
        id: docker-meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ steps.repo.outputs.name }}
@@ -132,7 +132,7 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
      - name: Build and push by digest
        id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: ./Dockerfile
@@ -182,29 +182,29 @@ jobs:
          echo "Downloaded digests:"
          ls -la /tmp/digests/
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to Docker Hub
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: Login to Quay.io
        if: needs.build-arch.outputs.push-external == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        with:
          registry: quay.io
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_ROBOT_TOKEN }}
      - name: Docker metadata
        id: docker-meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ env.REGISTRY }}/${{ needs.build-arch.outputs.repository }}
@@ -21,7 +21,7 @@ jobs:
      docs_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.docs == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -50,7 +50,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -69,16 +69,16 @@ jobs:
    steps:
      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -21,7 +21,7 @@ jobs:
      frontend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.frontend == 'true' }}
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -60,7 +60,7 @@ jobs:
      - name: Detect changes
        id: filter
        if: steps.force.outputs.run_all != 'true'
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        with:
          base: ${{ steps.range.outputs.base }}
          ref: ${{ steps.range.outputs.ref }}
@@ -77,7 +77,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -85,7 +85,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -109,7 +109,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -117,7 +117,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -129,8 +129,8 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
+      - name: Install dependencies
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run lint
        run: cd src-ui && pnpm run lint
  unit-tests:
@@ -148,7 +148,7 @@ jobs:
        shard-count: [4]
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -156,7 +156,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -168,8 +168,8 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
+      - name: Install dependencies
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run Jest unit tests
        run: cd src-ui && pnpm run test --max-workers=2 --shard=${{ matrix.shard-index }}/${{ matrix.shard-count }}
      - name: Upload test results to Codecov
@@ -191,7 +191,7 @@ jobs:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
-    container: mcr.microsoft.com/playwright:v1.61.1-noble
+    container: mcr.microsoft.com/playwright:v1.62.0-noble
    env:
      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
      PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 1
@@ -203,7 +203,7 @@ jobs:
        shard-count: [2]
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install pnpm
@@ -211,7 +211,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -223,23 +223,20 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Re-link Angular CLI
        run: cd src-ui && pnpm link @angular/cli
      - name: Install dependencies
-        run: cd src-ui && pnpm install --no-frozen-lockfile
+        run: cd src-ui && pnpm install --frozen-lockfile
      - name: Run Playwright E2E tests
        run: cd src-ui && pnpm exec playwright test --shard ${{ matrix.shard-index }}/${{ matrix.shard-count }}
-  bundle-analysis:
+  frontend-build:
-    name: Bundle Analysis
+    name: Frontend Build
    needs: [changes, unit-tests, e2e-tests]
    if: needs.changes.outputs.frontend_changed == 'true'
    runs-on: ubuntu-24.04
    environment: bundle-analysis
    permissions:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2
          persist-credentials: false
@@ -248,7 +245,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -260,21 +257,19 @@ jobs:
            ~/.pnpm-store
            ~/.cache
          key: ${{ runner.os }}-frontend-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
-      - name: Re-link Angular CLI
+      - name: Install dependencies
-        run: cd src-ui && pnpm link @angular/cli
+        run: cd src-ui && pnpm install --frozen-lockfile
-      - name: Build and analyze
+      - name: Build
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
        run: cd src-ui && pnpm run build --configuration=production
  gate:
    name: Frontend CI Gate
-    needs: [changes, install-dependencies, lint, unit-tests, e2e-tests, bundle-analysis]
+    needs: [changes, install-dependencies, lint, unit-tests, e2e-tests, frontend-build]
    if: always()
    runs-on: ubuntu-slim
    steps:
      - name: Check gate
        env:
-          BUNDLE_ANALYSIS_RESULT: ${{ needs['bundle-analysis'].result }}
+          BUILD_RESULT: ${{ needs['frontend-build'].result }}
          E2E_RESULT: ${{ needs['e2e-tests'].result }}
          FRONTEND_CHANGED: ${{ needs.changes.outputs.frontend_changed }}
          INSTALL_RESULT: ${{ needs['install-dependencies'].result }}
@@ -306,8 +301,8 @@ jobs:
            exit 1
          fi
-          if [[ "${BUNDLE_ANALYSIS_RESULT}" != "success" ]]; then
+          if [[ "${BUILD_RESULT}" != "success" ]]; then
-            echo "::error::Frontend bundle-analysis job result: ${BUNDLE_ANALYSIS_RESULT}"
+            echo "::error::Frontend build job result: ${BUILD_RESULT}"
            exit 1
          fi
@@ -17,12 +17,12 @@ jobs:
    runs-on: ubuntu-slim
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - name: Run prek
-        uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2.0.4
+        uses: j178/prek-action@5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 # v2.0.6
@@ -20,7 +20,7 @@ jobs:
      statuses: read
    steps:
      - name: Wait for Docker build
-        uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e # v1.8.0
+        uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773 # v1.9.0
        with:
          ref: ${{ github.sha }}
          check-name: 'Merge and Push Manifest'
@@ -35,7 +35,7 @@ jobs:
      contents: read
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # ---- Frontend Build ----
@@ -44,7 +44,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          package-manager-cache: false
@@ -55,11 +55,11 @@ jobs:
      # ---- Backend Setup ----
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -171,7 +171,7 @@ jobs:
          fi
      - name: Create release and changelog
        id: create-release
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        with:
          name: Paperless-ngx ${{ steps.get-version.outputs.version }}
          tag: ${{ steps.get-version.outputs.version }}
@@ -202,17 +202,17 @@ jobs:
      pull-requests: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: main
          persist-credentials: true # for pushing changelog branch
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: false
@@ -22,11 +22,11 @@ jobs:
      security-events: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
  semgrep:
    name: Semgrep CE
    runs-on: ubuntu-24.04
@@ -38,13 +38,13 @@ jobs:
      security-events: write
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run Semgrep
        run: semgrep scan --config auto --sarif-output results.sarif
      - name: Upload results to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        if: always()
        with:
          sarif_file: results.sarif
@@ -34,12 +34,12 @@ jobs:
        # Learn more about CodeQL language support at https://git.io/codeql-language-support
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -47,4 +47,4 @@ jobs:
          # Prefix the list here with "+" to use these queries and those in the config file.
          # queries: ./path/to/local/query, your-org/your-repo/queries@main
      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
@@ -17,12 +17,12 @@ jobs:
    environment: translation-sync
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          token: ${{ secrets.PNGX_BOT_PAT }}
          persist-credentials: false
      - name: crowdin action
-        uses: crowdin/github-action@52aa776766211d83d975df51f3b9c53c2f8ba35f # v2.16.3
+        uses: crowdin/github-action@c7af9bc98b01694653031fef2a0dc6c7888ce9bc # v2.17.0
        with:
          upload_translations: false
          download_translations: true
@@ -31,7 +31,7 @@ jobs:
    steps:
      - name: Label PR by file path or branch name
        # see .github/labeler.yml for the labeler config
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
      - name: Label by size
@@ -19,6 +19,6 @@ jobs:
    if: github.event_name == 'pull_request_target' && (github.event.action == 'opened' || github.event.action == 'reopened') && github.event.pull_request.user.login != 'dependabot'
    steps:
      - name: Label PR with release-drafter
-        uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e # v7.5.1
+        uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7.6.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -14,7 +14,7 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
        with:
          days-before-stale: 7
          days-before-close: 14
@@ -14,7 +14,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        env:
          GH_REF: ${{ github.ref }} # sonar rule:githubactions:S7630 - avoid injection
        with:
@@ -23,13 +23,13 @@ jobs:
          persist-credentials: true # for pushing translation branch
      - name: Set up Python
        id: setup-python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      - name: Install system dependencies
        run: |
          sudo apt-get update -qq
          sudo apt-get install -qq --no-install-recommends gettext
      - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: ${{ env.DEFAULT_UV_VERSION }}
          enable-cache: true
@@ -47,7 +47,7 @@ jobs:
        with:
          version: 10
      - name: Use Node.js 24
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24.x
          cache: 'pnpm'
@@ -61,16 +61,13 @@ jobs:
            ~/.cache
          key: ${{ runner.os }}-frontenddeps-${{ hashFiles('src-ui/pnpm-lock.yaml') }}
      - name: Install frontend dependencies
-        if: steps.cache-frontend-deps.outputs.cache-hit != 'true'
+        run: cd src-ui && pnpm install --frozen-lockfile
        run: cd src-ui && pnpm install
      - name: Re-link Angular cli
        run: cd src-ui && pnpm link @angular/cli
      - name: Generate frontend translation strings
        run: |
          cd src-ui
          pnpm run ng extract-i18n
      - name: Commit changes
-        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
        with:
          file_pattern: 'src-ui/messages.xlf src/locale/en_US/LC_MESSAGES/django.po'
          commit_message: "Auto translate strings"
@@ -29,7 +29,7 @@ repos:
      - id: check-case-conflict
      - id: detect-private-key
  - repo: https://github.com/codespell-project/codespell
-    rev: v2.4.2
+    rev: v2.4.3
    hooks:
      - id: codespell
        additional_dependencies: [tomli]
@@ -38,7 +38,7 @@ repos:
          - json
  # See https://github.com/prettier/prettier/issues/15742 for the fork reason
  - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 'v3.9.4'
+    rev: 'v3.9.6'
    hooks:
      - id: prettier
        types_or:
@@ -46,16 +46,16 @@ repos:
          - ts
          - markdown
        additional_dependencies:
-          - prettier@3.9.4
+          - prettier@3.9.6
          - 'prettier-plugin-organize-imports@4.3.0'
  # Python hooks
  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.20
+    rev: v0.16.1
    hooks:
      - id: ruff-check
      - id: ruff-format
  - repo: https://github.com/tox-dev/pyproject-fmt
-    rev: "v2.25.1"
+    rev: "v2.26.0"
    hooks:
      - id: pyproject-fmt
        additional_dependencies: [tomli]
@@ -30,7 +30,7 @@ RUN set -eux \
 # Purpose: Installs s6-overlay and rootfs
 # Comments:
 #  - Don't leave anything extra in here either
-FROM ghcr.io/astral-sh/uv:0.11.28-python3.12-trixie-slim AS s6-overlay-base
+FROM ghcr.io/astral-sh/uv:0.11.32-python3.12-trixie-slim AS s6-overlay-base
 WORKDIR /usr/src/s6
@@ -24,7 +24,7 @@ services:
    network_mode: host
    restart: unless-stopped
  greenmail:
-    image: docker.io/greenmail/standalone:2.1.9
+    image: docker.io/greenmail/standalone:2.1.11
    hostname: greenmail
    container_name: greenmail
    environment:
@@ -35,7 +35,7 @@ services:
      - "3143:3143" # IMAP
    restart: unless-stopped
  nginx:
-    image: docker.io/nginx:1.31.2-alpine
+    image: docker.io/nginx:1.31.3-alpine
    hostname: nginx
    container_name: nginx
    ports:
@@ -299,6 +299,8 @@ optional arguments:
 -sm, --split-manifest
 -z,  --zip
 -zn, --zip-name
 --zip-compression
 --zip-compression-level
 --data-only
 --no-progress-bar
 --passphrase
@@ -361,6 +363,19 @@ If `-z` or `--zip` is provided, the export will be a zip file
 in the target directory, named according to the current local date or the
 value set in `-zn` or `--zip-name`.
 The compression method for the zip can be set with `--zip-compression`
 (`stored`, `deflated` (default), `bzip2`, `lzma`, or `zstd`) and tuned with
 `--zip-compression-level` (deflated: 0–9, bzip2: 1–9, zstd: -22–22; ignored
 for `stored` and `lzma`). Both options require `--zip`.
 !!! warning
    `zstd` compression requires Python 3.14 or newer on **both** the machine
    creating the export and any machine importing it. An archive compressed with
    `zstd` (or `lzma`/`bzip2` where those modules are unavailable) cannot be
    imported on a runtime that lacks the codec; the importer will refuse it with
    a clear error. The default `deflated` is universally readable.
 If `--data-only` is provided, only the database will be exported. This option is intended
 to facilitate database upgrades without needing to clean documents and thumbnails from the media directory.
@@ -699,6 +714,7 @@ document_fuzzy_match [--ratio] [--processes N]
 | --ratio     | No       | 85.0                | a number between 0 and 100, setting how similar a document must be for it to be reported. Higher numbers mean more similarity. |
 | --processes | No       | 1/4 of system cores | Number of processes to use for matching. Setting 1 disables multiple processes                                                 |
 | --delete    | No       | False               | If provided, one document of a matched pair above the ratio will be deleted.                                                   |
 | --url       | No       | blank               | If an instance URL is provided, the output table will show URLs to each documents instead of the document ID and name.         |
 !!! warning
@@ -1,5 +1,65 @@
 # Changelog
 ## paperless-ngx 3.0.5
 ### Bug Fixes
 - Fix: accept Whoosh-era abbreviated relative-date units (yrs, mos, wks, etc) in search queries [@stumpylog](https://github.com/stumpylog) ([#13486](https://github.com/paperless-ngx/paperless-ngx/pull/13486))
 - Fix: fix edit dialog error change detection [@shamoon](https://github.com/shamoon) ([#13483](https://github.com/paperless-ngx/paperless-ngx/pull/13483))
 - Fix: key the AI suggestion cache by model and endpoint [@lunetics](https://github.com/lunetics) ([#13449](https://github.com/paperless-ngx/paperless-ngx/pull/13449))
 - Fix: validate custom field values in bulk operations [@shamoon](https://github.com/shamoon) ([#13457](https://github.com/paperless-ngx/paperless-ngx/pull/13457))
 - Fixhancement: better handle empty fields from AI suggestions [@shamoon](https://github.com/shamoon) ([#13454](https://github.com/paperless-ngx/paperless-ngx/pull/13454))
 - Fix: normalize monetary decimal symbol by locale [@shamoon](https://github.com/shamoon) ([#13427](https://github.com/paperless-ngx/paperless-ngx/pull/13427))
 - Fix: fold overflowing path text in sanity checker [@stumpylog](https://github.com/stumpylog) ([#13426](https://github.com/paperless-ngx/paperless-ngx/pull/13426))
 - Fix: correct delayed add field button for custom fields [@shamoon](https://github.com/shamoon) ([#13424](https://github.com/paperless-ngx/paperless-ngx/pull/13424))
 - Fix: hide attributes collapse / show button without UI settings [@shamoon](https://github.com/shamoon) ([#13425](https://github.com/paperless-ngx/paperless-ngx/pull/13425))
 - Fix: consolidate born-digital PDF detection between archive decision and OCR [@stumpylog](https://github.com/stumpylog) ([#13409](https://github.com/paperless-ngx/paperless-ngx/pull/13409))
 - Fix: prevent scale vs page loop in pngx PDF viewer [@shamoon](https://github.com/shamoon) ([#13406](https://github.com/paperless-ngx/paperless-ngx/pull/13406))
 - Fix: handle hidden line breaks in email subjects when sending email [@shamoon](https://github.com/shamoon) ([#13402](https://github.com/paperless-ngx/paperless-ngx/pull/13402))
 - Fix: avoid NotSupportedError from document\_importer on MariaDB [@stumpylog](https://github.com/stumpylog) ([#13400](https://github.com/paperless-ngx/paperless-ngx/pull/13400))
 - Fix: exclude next-period start from relative date-range filters [@stumpylog](https://github.com/stumpylog) ([#13381](https://github.com/paperless-ngx/paperless-ngx/pull/13381))
 - Fix: close non-atomic db connections in before\_task\_publish [@shamoon](https://github.com/shamoon) ([#13366](https://github.com/paperless-ngx/paperless-ngx/pull/13366))
 - Chore/fix: refactor frontend task service [@shamoon](https://github.com/shamoon) ([#13365](https://github.com/paperless-ngx/paperless-ngx/pull/13365))
 - Fix: fix Enter selection in search autocomplete [@shamoon](https://github.com/shamoon) ([#13361](https://github.com/paperless-ngx/paperless-ngx/pull/13361))
 ### Documentation
 - Documentation: PAPERLESS\_CONSUMER\_IGNORE\_PATTERNS clarifications [@shamoon](https://github.com/shamoon) ([#13489](https://github.com/paperless-ngx/paperless-ngx/pull/13489))
 - Documentation: Add Password Removal workflow action documentation [@stumpylog](https://github.com/stumpylog) ([#13377](https://github.com/paperless-ngx/paperless-ngx/pull/13377))
 ### Dependencies
 - Chore(deps): Bump pymdown-extensions from 10.21.3 to 11.0 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13378](https://github.com/paperless-ngx/paperless-ngx/pull/13378))
 ### All App Changes
 <details>
 <summary>21 changes</summary>
 - Fix: accept Whoosh-era abbreviated relative-date units (yrs, mos, wks, etc) in search queries [@stumpylog](https://github.com/stumpylog) ([#13486](https://github.com/paperless-ngx/paperless-ngx/pull/13486))
 - Fix: fix edit dialog error change detection [@shamoon](https://github.com/shamoon) ([#13483](https://github.com/paperless-ngx/paperless-ngx/pull/13483))
 - Performance: sqlite-vec point-delete for document chunks [@stumpylog](https://github.com/stumpylog) ([#13438](https://github.com/paperless-ngx/paperless-ngx/pull/13438))
 - Fix: key the AI suggestion cache by model and endpoint [@lunetics](https://github.com/lunetics) ([#13449](https://github.com/paperless-ngx/paperless-ngx/pull/13449))
 - Fix: validate custom field values in bulk operations [@shamoon](https://github.com/shamoon) ([#13457](https://github.com/paperless-ngx/paperless-ngx/pull/13457))
 - Fixhancement: better handle empty fields from AI suggestions [@shamoon](https://github.com/shamoon) ([#13454](https://github.com/paperless-ngx/paperless-ngx/pull/13454))
 - Performance: Use server side iterators during LLM index updating [@stumpylog](https://github.com/stumpylog) ([#13430](https://github.com/paperless-ngx/paperless-ngx/pull/13430))
 - Fix: normalize monetary decimal symbol by locale [@shamoon](https://github.com/shamoon) ([#13427](https://github.com/paperless-ngx/paperless-ngx/pull/13427))
 - Fix: fold overflowing path text in sanity checker [@stumpylog](https://github.com/stumpylog) ([#13426](https://github.com/paperless-ngx/paperless-ngx/pull/13426))
 - Fix: correct delayed add field button for custom fields [@shamoon](https://github.com/shamoon) ([#13424](https://github.com/paperless-ngx/paperless-ngx/pull/13424))
 - Fix: hide attributes collapse / show button without UI settings [@shamoon](https://github.com/shamoon) ([#13425](https://github.com/paperless-ngx/paperless-ngx/pull/13425))
 - Fix: consolidate born-digital PDF detection between archive decision and OCR [@stumpylog](https://github.com/stumpylog) ([#13409](https://github.com/paperless-ngx/paperless-ngx/pull/13409))
 - Fix: prevent scale vs page loop in pngx PDF viewer [@shamoon](https://github.com/shamoon) ([#13406](https://github.com/paperless-ngx/paperless-ngx/pull/13406))
 - Fix: handle hidden line breaks in email subjects when sending email [@shamoon](https://github.com/shamoon) ([#13402](https://github.com/paperless-ngx/paperless-ngx/pull/13402))
 - Fix: avoid NotSupportedError from document\_importer on MariaDB [@stumpylog](https://github.com/stumpylog) ([#13400](https://github.com/paperless-ngx/paperless-ngx/pull/13400))
 - Tweak: adjust doc details button toolbar flow [@shamoon](https://github.com/shamoon) ([#13382](https://github.com/paperless-ngx/paperless-ngx/pull/13382))
 - Fix: exclude next-period start from relative date-range filters [@stumpylog](https://github.com/stumpylog) ([#13381](https://github.com/paperless-ngx/paperless-ngx/pull/13381))
 - Chore(deps): Bump pymdown-extensions from 10.21.3 to 11.0 in the uv group across 1 directory @[dependabot[bot]](https://github.com/apps/dependabot) ([#13378](https://github.com/paperless-ngx/paperless-ngx/pull/13378))
 - Fix: close non-atomic db connections in before\_task\_publish [@shamoon](https://github.com/shamoon) ([#13366](https://github.com/paperless-ngx/paperless-ngx/pull/13366))
 - Chore/fix: refactor frontend task service [@shamoon](https://github.com/shamoon) ([#13365](https://github.com/paperless-ngx/paperless-ngx/pull/13365))
 - Fix: fix Enter selection in search autocomplete [@shamoon](https://github.com/shamoon) ([#13361](https://github.com/paperless-ngx/paperless-ngx/pull/13361))
 </details>
 ## paperless-ngx 3.0.4
 ### Bug Fixes
@@ -948,10 +948,11 @@ for display in the web interface.
    !!! note
-        The **remote OCR parser** (Azure AI) always produces a searchable
+        The **remote OCR parser** (Azure AI) also honors this setting: when
-        PDF and stores it as the archive copy, regardless of this setting.
+        no archive is requested (`never`, or `auto` with a born-digital PDF),
-        `ARCHIVE_FILE_GENERATION=never` has no effect when the remote
+        the remote engine is skipped entirely and locally-extracted text is
-        parser handles a document.
+        used instead, avoiding an unnecessary API call and a duplicate text
        layer.
 #### [`PAPERLESS_OCR_CLEAN=<mode>`](#PAPERLESS_OCR_CLEAN) {#PAPERLESS_OCR_CLEAN}
@@ -187,10 +187,11 @@ PAPERLESS_ARCHIVE_FILE_GENERATION=auto
 ### Remote OCR parser
-If you use the **remote OCR parser** (Azure AI), note that it always produces a
+If you use the **remote OCR parser** (Azure AI), `ARCHIVE_FILE_GENERATION` is
-searchable PDF and stores it as the archive copy. `ARCHIVE_FILE_GENERATION=never`
+honored the same way as for the local engine: when no archive is requested
-has no effect for documents handled by the remote parser - the archive is produced
+(`never`, or `auto` with a born-digital PDF), the remote engine is skipped
-unconditionally by the remote engine.
+entirely and locally-extracted text is used instead, avoiding an unnecessary
 API call and a duplicate text layer.
 ## Search Index (Whoosh -> Tantivy)
@@ -0,0 +1,428 @@
 # Split views.py and serialisers.py Implementation Plan
 > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
 **Goal:** Split `src/documents/views.py` (5,395 lines) and `src/documents/serialisers.py` (3,532 lines) into domain-based module packages, with zero behavior change.
 **Architecture:** Both files become packages (`documents/views/`, `documents/serialisers/`), one module per domain area. Serialisers split first (views depend on serialisers, never the reverse), then views, then the three external call sites (`paperless/urls.py`, `paperless_mail/views.py`, `paperless_mail/serialisers.py`) are pointed at the new submodules. No `__init__.py` re-exports in either package — every internal and external consumer imports the exact submodule.
 **Tech Stack:** Django REST Framework (viewsets/serializers), ruff (lint/format), pytest via the project's VM test runner.
 **Spec:** `docs/superpowers/specs/2026-08-13-views-serialisers-split-design.md`
 ## Global Constraints
 - No behavior change: class/function bodies, names, and public API responses are unchanged — pure move/reorganize. (spec: Non-goals)
 - Domain module names are identical across both packages (`bulk_edit.py` exists in both, etc.). (spec: Import direction)
 - Import direction is one-way: `documents/views/*` may import from `documents/serialisers/*`; `documents/serialisers/*` must never import from `documents/views/*`. (spec: Import direction)
 - Neither package's `__init__.py` re-exports submodule contents — every consumer, internal or external, imports the specific submodule (e.g. `from documents.views.workflows import WorkflowViewSet`). (spec: Architecture)
 - `src/documents/tests/test_views.py` and `src/documents/tests/test_api_documents.py` are not modified — they must pass unchanged, proving the move didn't alter behavior. (spec: Non-goals, Testing)
 - This branch targets `dev` and is separate from `feature-ai-taxonomy-hints-v2`. (spec: Non-goals)
 - Backend tests run on the Linux VM via the helper script, never locally: `bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "<pytest targets>"`. `ruff check` / `ruff format` run locally (global binary, not `uv run ruff`).
 ---
 ## Reference: symbol-to-module maps
 These tables (from the spec) are the authoritative source for which class/function goes to which new file. Copy them exactly — do not improvise groupings.
 ### `documents/serialisers/` map
 | Module           | Symbols                                                                                                                                                                                                                                                                                                                                                                                            |
 | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer` |
 | `metadata.py`    | `CorrespondentSerializer`, `DocumentTypeSerializer`, `DeprecatedColors`, `ColorField`, `TagSerializer`, `CorrespondentField`, `TagsField`, `DocumentTypeField`, `StoragePathField`, `StoragePathSerializer`, `StoragePathTestSerializer`, `CustomFieldSerializer`, `CustomFieldInstanceSerializer`, `validate_documentlink_targets`                                                                |
 | `documents.py`   | `DocumentSerializer`, `SearchResultListSerializer`, `SearchResultSerializer`, `DuplicateDocumentSummarySerializer`, `_DocumentVersionInfo`, `DocumentVersionInfoSerializer`, `DocumentVersionSerializer`, `DocumentVersionLabelSerializer`, `_get_viewable_duplicates`                                                                                                                             |
 | `upload.py`      | `PostDocumentSerializer`                                                                                                                                                                                                                                                                                                                                                                           |
 | `saved_views.py` | `SavedViewFilterRuleSerializer`, `SavedViewSerializer`                                                                                                                                                                                                                                                                                                                                             |
 | `bulk_edit.py`   | `RotateDocumentsSerializer`, `MergeDocumentsSerializer`, `EditPdfDocumentsSerializer`, `RemovePasswordDocumentsSerializer`, `DeleteDocumentsSerializer`, `ReprocessDocumentsSerializer`, `BulkEditSerializer`, `BulkDownloadSerializer`, `BulkEditObjectsSerializer`                                                                                                                               |
 | `sharing.py`     | `EmailSerializer`, `ShareLinkSerializer`, `ShareLinkBundleSerializer`                                                                                                                                                                                                                                                                                                                              |
 | `tasks.py`       | `TaskSerializerV10`, `TaskSerializerV9`, `TaskSummarySerializer`, `RunTaskSerializer`, `AcknowledgeTasksViewSerializer`                                                                                                                                                                                                                                                                            |
 | `workflows.py`   | `WorkflowTriggerSerializer`, `WorkflowActionEmailSerializer`, `WorkflowActionWebhookSerializer`, `WorkflowActionSerializer`, `WorkflowSerializer`                                                                                                                                                                                                                                                  |
 | `system.py`      | `UiSettingsViewSerializer`, `TrashSerializer`                                                                                                                                                                                                                                                                                                                                                      |
 Extraction order matters (later modules reference earlier ones): `base` → `metadata` → `documents` → `upload` → `saved_views` → `bulk_edit` → `sharing` → `tasks` → `workflows` → `system`.
 ### `documents/views/` map
 | Module           | Symbols                                                                                                                                                                                                                                                                 |
 | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`, `SearchResultPage`, `ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file` |
 | `index.py`       | `IndexView`, `serve_logo`                                                                                                                                                                                                                                               |
 | `metadata.py`    | `CorrespondentViewSet`, `TagViewSet`, `DocumentTypeViewSet`, `StoragePathViewSet`, `CustomFieldViewSet`, `_get_llm_output_language`                                                                                                                                     |
 | `documents.py`   | `EmailDocumentDetailSchema`, `DocumentViewSet`, `UnifiedSearchViewSet`                                                                                                                                                                                                  |
 | `upload.py`      | `PostDocumentView`                                                                                                                                                                                                                                                      |
 | `chat.py`        | `ChatStreamingSerializer`, `ChatStreamingView`                                                                                                                                                                                                                          |
 | `search.py`      | `SearchAutoCompleteView`, `GlobalSearchView`, `SelectionDataView`, `StatisticsView`                                                                                                                                                                                     |
 | `bulk_edit.py`   | `BulkEditView`, `RotateDocumentsView`, `MergeDocumentsView`, `DeleteDocumentsView`, `ReprocessDocumentsView`, `EditPdfDocumentsView`, `RemovePasswordDocumentsView`, `BulkEditObjectsView`, `BulkDownloadView`                                                          |
 | `sharing.py`     | `ShareLinkViewSet`, `ShareLinkBundleViewSet`, `SharedLinkView`                                                                                                                                                                                                          |
 | `saved_views.py` | `SavedViewViewSet`                                                                                                                                                                                                                                                      |
 | `tasks.py`       | `_TasksViewSetSchema`, `TasksViewSet`                                                                                                                                                                                                                                   |
 | `workflows.py`   | `WorkflowTriggerViewSet`, `WorkflowActionViewSet`, `WorkflowViewSet`                                                                                                                                                                                                    |
 | `system.py`      | `UiSettingsView`, `RemoteVersionView`, `SystemStatusView`, `TrashView`                                                                                                                                                                                                  |
 | `logs.py`        | `LogViewSet`                                                                                                                                                                                                                                                            |
 Extraction order: `base` → `index` → `metadata` → `documents` → `upload` → `chat` → `search` → `bulk_edit` → `sharing` → `saved_views` → `tasks` → `workflows` → `system` → `logs`. Note `ChatStreamingSerializer` is defined in `views.py` today, directly above `ChatStreamingView` — it moves with it into `views/chat.py`, not into the serialisers package.
 ### Mechanical extraction recipe (applies to every task below)
 For each module being created:
 1. `grep -n "^class |^def " src/documents/<serialisers|views>.py` to get current line numbers for every symbol still in the monolith (numbers shift as earlier modules are extracted, so re-run this each time, don't reuse stale numbers).
 2. Create the new file. Start it by copying the **entire top-of-file import block** from the monolith verbatim, plus a relative `from .base import ...` line if the module isn't `base.py` itself.
 3. Cut each listed symbol (including any decorators/comments immediately above it) from the monolith and paste it into the new file, preserving original order.
 4. Remove the cut symbols from the monolith.
 5. Run `ruff check --select F401,F811,F821 <new file> <monolith file>` and fix everything reported:
   - `F401` (unused import) → delete the import line.
   - `F821` (undefined name) → the symbol lives in a sibling module already extracted; add `from .<sibling> import <Symbol>`. If it hasn't been extracted yet, that's an ordering bug — stop and re-check the extraction order table.
   - `F811` (redefinition) → duplicate import, delete one.
 6. Run `ruff format <new file> <monolith file>`.
 ## Task 1: Scaffold `documents/serialisers/` and extract `base.py`
 **Agent:** django-expert — **Model:** sonnet (mechanical extraction, but sets the foundation every later serialiser module imports from — get the base set right or every later task inherits the mistake)
 **Files:**
 - Create: `src/documents/serialisers/__init__.py` (empty — no re-exports, per Global Constraints)
 - Create: `src/documents/serialisers/base.py`
 - Modify: `src/documents/serialisers.py` (shrinks; stays in place as the monolith for the remaining tasks in this phase — it is only deleted in Task 2 once empty)
 - Test: `src/documents/tests/` (full app suite), `src/paperless_mail/tests/`
 **Interfaces:**
 - Produces: `documents.serialisers.base` exporting `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer` — every later serialiser/view module that needs one of these imports `from documents.serialisers.base import <Symbol>`.
 - [ ] **Step 1: Create the package directory and empty `__init__.py`**
 ```bash
 mkdir -p src/documents/serialisers
 touch src/documents/serialisers/__init__.py
 ```
 - [ ] **Step 2: Extract `base.py` per the mechanical extraction recipe above**
 Move exactly these 14 symbols (in their current relative order) out of `src/documents/serialisers.py` into `src/documents/serialisers/base.py`: `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer`.
 Run the ruff fix-up (`ruff check --select F401,F811,F821 src/documents/serialisers/base.py src/documents/serialisers.py` then `ruff format` both files) as described in the recipe.
 - [ ] **Step 3: Verify `documents.serialisers` (the monolith module, still at `src/documents/serialisers.py`) still imports cleanly and the app still boots**
 Note: at this point Python resolves `documents.serialisers` to the package `src/documents/serialisers/__init__.py` (empty), **not** to `src/documents/serialisers.py` — having both a `serialisers.py` file and a `serialisers/` directory in the same parent package is invalid and Python will pick the package. So before running anything, rename the monolith out of the way so it's importable as a submodule of the new package for the rest of Phase A:
 ```bash
 git mv src/documents/serialisers.py src/documents/serialisers/_monolith.py
 ```
 Everywhere else in this phase, "the monolith file" now means `src/documents/serialisers/_monolith.py`. Because nothing outside this package imports the monolith directly by its old dotted path (`documents.serialisers` resolved to the file before; now it's the package), you must update every consumer of `documents.serialisers` symbols still owned by the monolith to import from `documents.serialisers._monolith` for the remainder of this phase. Concretely, in `src/documents/views.py`, change every `from documents.serialisers import <Symbol>` line for a symbol _not yet extracted_ (i.e., not one of the 14 `base.py` symbols) to `from documents.serialisers._monolith import <Symbol>`, and change the 14 now-extracted symbols' import lines to `from documents.serialisers.base import <Symbol>`. Do the same in `src/paperless_mail/serialisers.py` for `OwnedObjectSerializer` (→ `documents.serialisers.base`); its other three imports (`CorrespondentField`, `DocumentTypeField`, `TagsField`) stay pointed at `documents.serialisers._monolith` until Task 2 moves them into `metadata.py`.
 This `_monolith` re-pointing is scaffolding only — Task 2 finishes emptying and deletes `_monolith.py`, and every import that currently says `._monolith` gets its final home then.
 - [ ] **Step 4: Run the full test suite for this app boundary**
 ```bash
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS, no collection errors (a collection error here almost always means a missed import update in `views.py` or `paperless_mail/serialisers.py`).
 - [ ] **Step 5: Commit**
 ```bash
 git add src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 git commit -m "refactor: extract documents/serialisers/base.py from the serialisers monolith"
 ```
 ## Task 2: Extract the remaining 8 serialiser domain modules and delete the monolith
 **Agent:** django-expert — **Model:** sonnet (repetitive but each of the 8 modules needs its own cross-reference check against `base.py` and previously-extracted siblings; DocumentSerializer in particular is large and central)
 **Files:**
 - Create: `src/documents/serialisers/metadata.py`, `src/documents/serialisers/documents.py`, `src/documents/serialisers/upload.py`, `src/documents/serialisers/saved_views.py`, `src/documents/serialisers/bulk_edit.py`, `src/documents/serialisers/sharing.py`, `src/documents/serialisers/tasks.py`, `src/documents/serialisers/workflows.py`, `src/documents/serialisers/system.py`
 - Delete: `src/documents/serialisers/_monolith.py` (once empty)
 - Modify: `src/documents/views.py` (finish re-pointing every `from documents.serialisers._monolith import X` line at the correct new submodule), `src/paperless_mail/serialisers.py` (re-point `CorrespondentField`, `DocumentTypeField`, `TagsField` at `documents.serialisers.metadata`)
 - Test: `src/documents/tests/` (full app suite), `src/paperless_mail/tests/`
 **Interfaces:**
 - Consumes: `documents.serialisers.base` from Task 1 (relative import `.base` within the package).
 - Produces: the full `documents/serialisers/` package as specified in the Reference map above — this is what Task 3/4 (views split) and Task 5 (external call sites) import from.
 - [ ] **Step 1: Extract the 8 remaining domain modules in order**
 Following the mechanical extraction recipe, and in this exact order (each may depend on symbols extracted earlier in this same order, plus anything in `base.py`):
 1. `metadata.py` — `CorrespondentSerializer`, `DocumentTypeSerializer`, `DeprecatedColors`, `ColorField`, `TagSerializer`, `CorrespondentField`, `TagsField`, `DocumentTypeField`, `StoragePathField`, `StoragePathSerializer`, `StoragePathTestSerializer`, `CustomFieldSerializer`, `CustomFieldInstanceSerializer`, `validate_documentlink_targets`
 2. `documents.py` — `DocumentSerializer`, `SearchResultListSerializer`, `SearchResultSerializer`, `DuplicateDocumentSummarySerializer`, `_DocumentVersionInfo`, `DocumentVersionInfoSerializer`, `DocumentVersionSerializer`, `DocumentVersionLabelSerializer`, `_get_viewable_duplicates`
 3. `upload.py` — `PostDocumentSerializer`
 4. `saved_views.py` — `SavedViewFilterRuleSerializer`, `SavedViewSerializer`
 5. `bulk_edit.py` — `RotateDocumentsSerializer`, `MergeDocumentsSerializer`, `EditPdfDocumentsSerializer`, `RemovePasswordDocumentsSerializer`, `DeleteDocumentsSerializer`, `ReprocessDocumentsSerializer`, `BulkEditSerializer`, `BulkDownloadSerializer`, `BulkEditObjectsSerializer`
 6. `sharing.py` — `EmailSerializer`, `ShareLinkSerializer`, `ShareLinkBundleSerializer`
 7. `tasks.py` — `TaskSerializerV10`, `TaskSerializerV9`, `TaskSummarySerializer`, `RunTaskSerializer`, `AcknowledgeTasksViewSerializer`
 8. `workflows.py` — `WorkflowTriggerSerializer`, `WorkflowActionEmailSerializer`, `WorkflowActionWebhookSerializer`, `WorkflowActionSerializer`, `WorkflowSerializer`
 9. `system.py` — `UiSettingsViewSerializer`, `TrashSerializer`
 After each individual module extraction, run the ruff fix-up from the recipe against that new file and `_monolith.py` before moving to the next module (don't batch all 8 and fix imports once at the end — F821 errors compound and get harder to attribute to the right module).
 - [ ] **Step 2: Confirm the monolith is empty and delete it**
 ```bash
 grep -n "^class |^def " src/documents/serialisers/_monolith.py
 ```
 Expected: no output. If anything remains, it wasn't in the Reference map — stop and reconcile with the spec rather than deleting a symbol.
 ```bash
 git rm src/documents/serialisers/_monolith.py
 ```
 - [ ] **Step 3: Re-point every remaining `._monolith` import**
 Search for any import left pointing at the now-deleted module:
 ```bash
 grep -rn "serialisers\._monolith\|serialisers/_monolith" src/
 ```
 Expected: no output. Fix any that remain by pointing them at the correct submodule per the Reference map (e.g. `from documents.serialisers._monolith import DocumentSerializer` → `from documents.serialisers.documents import DocumentSerializer`).
 - [ ] **Step 4: Update `paperless_mail/serialisers.py`'s remaining imports**
 ```python
 # was: from documents.serialisers import CorrespondentField, DocumentTypeField, OwnedObjectSerializer, TagsField
 from documents.serialisers.base import OwnedObjectSerializer
 from documents.serialisers.metadata import CorrespondentField, DocumentTypeField, TagsField
 ```
 - [ ] **Step 5: Ruff and full test suite**
 ```bash
 ruff check src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 ruff format src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 ```
 ```bash
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS.
 - [ ] **Step 6: Commit**
 ```bash
 git add src/documents/serialisers src/documents/views.py src/paperless_mail/serialisers.py
 git commit -m "refactor: finish splitting serialisers.py into documents/serialisers/"
 ```
 ## Task 3: Scaffold `documents/views/` and extract `base.py`
 **Agent:** django-expert — **Model:** sonnet (same shape as Task 1, one level up — views/base.py is imported by every other view module)
 **Files:**
 - Create: `src/documents/views/__init__.py` (empty), `src/documents/views/base.py`
 - Modify: `src/documents/views.py` → `src/documents/views/_monolith.py` (renamed, same reasoning as Task 1 Step 3)
 - Modify: `src/paperless/urls.py`, `src/paperless_mail/views.py` (re-point the 1 symbol each currently pulls from `documents.views` that now lives in `base.py`, if any — see step 3)
 - Test: `src/documents/tests/` (full app suite, includes URL-resolution-dependent tests), `src/paperless_mail/tests/`
 **Interfaces:**
 - Consumes: `documents.serialisers.*` submodules from Tasks 1–2 (already at final locations — import these directly, e.g. `from documents.serialisers.documents import DocumentSerializer`, never through a monolith or shim).
 - Produces: `documents.views.base` exporting `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`, `SearchResultPage`, `ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file`.
 - [ ] **Step 1: Create the package directory, empty `__init__.py`, and rename the monolith**
 ```bash
 mkdir -p src/documents/views
 touch src/documents/views/__init__.py
 git mv src/documents/views.py src/documents/views/_monolith.py
 ```
 - [ ] **Step 2: Extract `base.py` per the mechanical extraction recipe**
 Move exactly these 11 symbols out of `_monolith.py` into `views/base.py`: `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`, `SearchResultPage`, `ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file`.
 Within `_monolith.py`, every reference to these 11 symbols needs `from .base import <Symbol>` added (they're used throughout the rest of the file by the not-yet-extracted viewsets).
 - [ ] **Step 3: Re-point external consumers of the now-moved symbol**
 ```bash
 grep -n "from documents.views import PassUserMixin" src/paperless_mail/views.py
 ```
 Update it to `from documents.views.base import PassUserMixin`.
 `paperless/urls.py` doesn't import any of the 11 `base.py` symbols directly (it only imports viewsets/views, which are all still in `_monolith.py` at this point) — confirm with:
 ```bash
 grep -nE "from documents\.views import (PassUserMixin|BulkPermissionMixin|PermissionsAwareDocumentCountMixin|DocumentSelectionMixin|DocumentOperationPermissionMixin|serve_file)" src/paperless/urls.py
 ```
 Expected: no output. If something does match, re-point it at `documents.views.base` the same way.
 - [ ] **Step 4: Ruff and test**
 ```bash
 ruff check src/documents/views src/paperless_mail/views.py
 ruff format src/documents/views src/paperless_mail/views.py
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS.
 - [ ] **Step 5: Commit**
 ```bash
 git add src/documents/views src/paperless_mail/views.py
 git commit -m "refactor: extract documents/views/base.py from the views monolith"
 ```
 ## Task 4: Extract the remaining 13 view domain modules and delete the monolith
 **Agent:** django-expert — **Model:** opus (highest blast radius in the plan — `DocumentViewSet` alone is ~1,300 lines and central to the whole API; this task also rewires `paperless/urls.py`'s ~34 import lines that drive URL routing for the entire backend, where a mistake breaks the app at startup, not just in one test)
 **Files:**
 - Create: `src/documents/views/index.py`, `src/documents/views/metadata.py`, `src/documents/views/documents.py`, `src/documents/views/upload.py`, `src/documents/views/chat.py`, `src/documents/views/search.py`, `src/documents/views/bulk_edit.py`, `src/documents/views/sharing.py`, `src/documents/views/saved_views.py`, `src/documents/views/tasks.py`, `src/documents/views/workflows.py`, `src/documents/views/system.py`, `src/documents/views/logs.py`
 - Delete: `src/documents/views/_monolith.py` (once empty)
 - Modify: `src/paperless/urls.py` (all ~34 `from documents.views import X` lines)
 - Test: `src/documents/tests/` (full app suite — includes `test_views.py`, `test_api_documents.py`), `src/paperless_mail/tests/`
 **Interfaces:**
 - Consumes: `documents.serialisers.*` (Tasks 1–2) and `documents.views.base` (Task 3).
 - Produces: the full `documents/views/` package as specified in the Reference map above.
 - [ ] **Step 1: Extract the 13 remaining domain modules in order**
 Following the mechanical extraction recipe, in this exact order:
 1. `index.py` — `IndexView`, `serve_logo`
 2. `metadata.py` — `CorrespondentViewSet`, `TagViewSet`, `DocumentTypeViewSet`, `StoragePathViewSet`, `CustomFieldViewSet`, `_get_llm_output_language`
 3. `documents.py` — `EmailDocumentDetailSchema`, `DocumentViewSet`, `UnifiedSearchViewSet`
 4. `upload.py` — `PostDocumentView`
 5. `chat.py` — `ChatStreamingSerializer`, `ChatStreamingView`
 6. `search.py` — `SearchAutoCompleteView`, `GlobalSearchView`, `SelectionDataView`, `StatisticsView`
 7. `bulk_edit.py` — `BulkEditView`, `RotateDocumentsView`, `MergeDocumentsView`, `DeleteDocumentsView`, `ReprocessDocumentsView`, `EditPdfDocumentsView`, `RemovePasswordDocumentsView`, `BulkEditObjectsView`, `BulkDownloadView`
 8. `sharing.py` — `ShareLinkViewSet`, `ShareLinkBundleViewSet`, `SharedLinkView`
 9. `saved_views.py` — `SavedViewViewSet`
 10. `tasks.py` — `_TasksViewSetSchema`, `TasksViewSet`
 11. `workflows.py` — `WorkflowTriggerViewSet`, `WorkflowActionViewSet`, `WorkflowViewSet`
 12. `system.py` — `UiSettingsView`, `RemoteVersionView`, `SystemStatusView`, `TrashView`
 13. `logs.py` — `LogViewSet`
 After each module, run the ruff fix-up from the recipe before continuing to the next (same rationale as Task 2 Step 1 — attribute F821s to the right module while context is fresh). `documents.py` is the biggest single extraction in this whole plan (`DocumentViewSet` is ~1,300 lines) — expect the most F821 fix-ups here, mostly resolved by adding `from documents.serialisers.documents import ...`, `from documents.serialisers.metadata import ...`, and `from .base import ...` as needed.
 - [ ] **Step 2: Confirm the monolith is empty and delete it**
 ```bash
 grep -n "^class |^def " src/documents/views/_monolith.py
 ```
 Expected: no output.
 ```bash
 git rm src/documents/views/_monolith.py
 ```
 - [ ] **Step 3: Re-point every remaining `._monolith` import**
 ```bash
 grep -rn "views\._monolith\|views/_monolith" src/
 ```
 Expected: no output. Fix any stragglers per the Reference map.
 - [ ] **Step 4: Update `paperless/urls.py`**
 Replace each of the ~34 `from documents.views import X` lines with `from documents.views.<domain> import X` per the Reference map. For example:
 ```python
 # was:
 from documents.views import CorrespondentViewSet
 from documents.views import WorkflowViewSet
 from documents.views import serve_logo
 # becomes:
 from documents.views.metadata import CorrespondentViewSet
 from documents.views.workflows import WorkflowViewSet
 from documents.views.index import serve_logo
 ```
 Do this for every import in that block — check off against the full symbol list in the Reference map above so none are missed.
 - [ ] **Step 5: Ruff and test**
 ```bash
 ruff check src/documents/views src/paperless/urls.py
 ruff format src/documents/views src/paperless/urls.py
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "src/documents/tests src/paperless_mail/tests -v"
 ```
 Expected: PASS, including `test_views.py` and `test_api_documents.py` — these exercise URL routing end-to-end, so a broken `urls.py` import shows up here as a collection error.
 - [ ] **Step 6: Commit**
 ```bash
 git add src/documents/views src/paperless/urls.py
 git commit -m "refactor: finish splitting views.py into documents/views/"
 ```
 ## Task 5: Repo-wide verification sweep
 **Agent:** general-purpose — **Model:** sonnet (an audit/verification pass: run targeted checks, read the output, fix anything found — moderate judgment, not novel design work)
 **Files:**
 - Modify: any file a grep in this task turns up beyond the ones already handled in Tasks 1–4 (expected: none, per the spec's stated blast radius of exactly `paperless/urls.py`, `paperless_mail/views.py`, `paperless_mail/serialisers.py` — this task exists to confirm that, not to find new work)
 - Test: full backend suite (all apps, not just `documents`/`paperless_mail`)
 **Interfaces:**
 - Consumes: the finished `documents/views/` and `documents/serialisers/` packages from Tasks 1–4.
 - [ ] **Step 1: Grep the whole repo for any remaining bare-module reference**
 ```bash
 grep -rn "from documents\.views import\|from documents\.serialisers import\|documents\.views\.\_monolith\|documents\.serialisers\.\_monolith\|import documents\.views$\|import documents\.serialisers$" src/
 ```
 Expected: no output. `documents/views/__init__.py` and `documents/serialisers/__init__.py` should still be empty (`0` bytes or a single blank line) — confirm with:
 ```bash
 wc -l src/documents/views/__init__.py src/documents/serialisers/__init__.py
 ```
 - [ ] **Step 2: Confirm import direction was never violated**
 ```bash
 grep -rln "from documents\.views" src/documents/serialisers/
 ```
 Expected: no output (no file in `serialisers/` imports from `views/`).
 - [ ] **Step 3: Full ruff pass**
 ```bash
 ruff check src/documents/views src/documents/serialisers src/paperless/urls.py src/paperless_mail/views.py src/paperless_mail/serialisers.py
 ruff format --check src/documents/views src/documents/serialisers src/paperless/urls.py src/paperless_mail/views.py src/paperless_mail/serialisers.py
 ```
 Expected: clean.
 - [ ] **Step 4: Full backend test suite**
 ```bash
 bash /c/Users/tholmes/Documents/Coding/paperless/vmtest.sh "-v"
 ```
 (No path filter — this runs the whole backend suite, confirming nothing outside `documents`/`paperless_mail` was quietly relying on the old module shape, e.g. a management command or a script under `scripts/`.)
 Expected: PASS.
 - [ ] **Step 5: If Steps 1–4 found nothing to fix, commit is a no-op — skip it. If they found strays, fix and commit**
 ```bash
 git add -A
 git commit -m "refactor: fix stray documents.views/serialisers references found in repo sweep"
 ```
@@ -0,0 +1,158 @@
 # Split `documents/views.py` and `documents/serialisers.py` into modules
 ## Problem
 `src/documents/views.py` (5,395 lines) and `src/documents/serialisers.py`
 (3,532 lines) have grown into monolithic files covering every REST resource
 in the `documents` app: correspondents, tags, document types, storage paths,
 custom fields, the core document viewset and search, chat, bulk-edit
 operations, sharing, saved views, tasks, workflows, and system/UI settings.
 Their size makes them hard to navigate, hard to review incrementally, and
 increases the chance of unrelated changes colliding in the same file.
 This document specifies splitting both files into packages, one module per
 domain area, with no behavior change.
 ## Non-goals
 - No behavior change. Class names, method bodies, and public API responses
  are unchanged — this is a pure move/reorganize.
 - No change to `test_views.py` or `test_api_documents.py`. They exercise the
  moved classes via imports or via the live API; class names and behavior
  don't change, so they need no edits. Splitting those test files is a
  separate, later task if desired.
 - No change to the frontend, migrations, or any other app beyond the three
  files that import from `documents.views` / `documents.serialisers`
  (`paperless/urls.py`, `paperless_mail/views.py`,
  `paperless_mail/serialisers.py`).
 - This work happens as its own branch/PR against `dev`, after the in-flight
  `feature-ai-taxonomy-hints-v2` work merges — not layered on top of it.
 ## Architecture
 `documents/views.py` becomes the package `documents/views/`, and
 `documents/serialisers.py` becomes `documents/serialisers/`. Each gets one
 module per domain area (table below). Neither package's `__init__.py`
 re-exports its submodules' contents — it stays empty (or a short docstring
 only). The three external call sites that currently do
 `from documents.views import X` / `from documents.serialisers import X` are
 updated to import from the specific submodule instead
 (`from documents.views.workflows import WorkflowViewSet`, etc.). This avoids
 adding an indirection layer that could quietly regrow into a second dumping
 ground, at the cost of touching those three files.
 ### Import direction
 `views/*` modules may import from `serialisers/*` modules; `serialisers/*`
 modules never import from `views/*`. This keeps the dependency graph acyclic
 by construction — there is no case in the current code where a serializer
 needs a view.
 Domain module names are the same across both packages (e.g. `bulk_edit.py`
 exists in both), which makes the natural import `from documents.serialisers.bulk_edit import BulkEditSerializer`
 inside `documents/views/bulk_edit.py` easy to find, but a view is free to
 import a serializer from a different domain module when needed (e.g. a
 `documents.py` view using a `metadata.py` field serializer) — that's a plain
 cross-module import, not a cycle risk, since the reverse direction never
 happens.
 ## Module breakdown — `documents/views/`
 | Module           | Contents                                                                                                                                                                                                                                                                                     |
 | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | Shared mixins/helpers: `PassUserMixin`, `BulkPermissionMixin`, `PermissionsAwareDocumentCountMixin`, `DocumentSelectionMixin`, `DocumentOperationPermissionMixin`, `SearchParams`/`SearchResultPage`/`ResolvedRequestDocs`, `_get_tantivy_query_and_mode`, `_get_more_like_id`, `serve_file` |
 | `index.py`       | `IndexView`, `serve_logo`                                                                                                                                                                                                                                                                    |
 | `metadata.py`    | `CorrespondentViewSet`, `TagViewSet`, `DocumentTypeViewSet`, `StoragePathViewSet`, `CustomFieldViewSet`, `_get_llm_output_language`                                                                                                                                                          |
 | `documents.py`   | `EmailDocumentDetailSchema`, `DocumentViewSet`, `UnifiedSearchViewSet`                                                                                                                                                                                                                       |
 | `upload.py`      | `PostDocumentView`                                                                                                                                                                                                                                                                           |
 | `chat.py`        | `ChatStreamingSerializer`, `ChatStreamingView`                                                                                                                                                                                                                                               |
 | `search.py`      | `SearchAutoCompleteView`, `GlobalSearchView`, `SelectionDataView`, `StatisticsView`                                                                                                                                                                                                          |
 | `bulk_edit.py`   | `BulkEditView`, `RotateDocumentsView`, `MergeDocumentsView`, `DeleteDocumentsView`, `ReprocessDocumentsView`, `EditPdfDocumentsView`, `RemovePasswordDocumentsView`, `BulkEditObjectsView`, `BulkDownloadView`                                                                               |
 | `sharing.py`     | `ShareLinkViewSet`, `ShareLinkBundleViewSet`, `SharedLinkView`                                                                                                                                                                                                                               |
 | `saved_views.py` | `SavedViewViewSet`                                                                                                                                                                                                                                                                           |
 | `tasks.py`       | `_TasksViewSetSchema`, `TasksViewSet`                                                                                                                                                                                                                                                        |
 | `workflows.py`   | `WorkflowTriggerViewSet`, `WorkflowActionViewSet`, `WorkflowViewSet`                                                                                                                                                                                                                         |
 | `system.py`      | `UiSettingsView`, `RemoteVersionView`, `SystemStatusView`, `TrashView`                                                                                                                                                                                                                       |
 | `logs.py`        | `LogViewSet`                                                                                                                                                                                                                                                                                 |
 `documents.py` remains the largest module at roughly 1,600 lines
 (`DocumentViewSet` alone is ~1,300 lines in the current file); every other
 module is well under 500 lines.
 ## Module breakdown — `documents/serialisers/`
 | Module           | Contents                                                                                                                                                                                                                                                                                                                                                                                           |
 | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `base.py`        | `DynamicFieldsModelSerializer`, `DocumentUpdateFieldsModelSerializer`, `MatchingModelSerializer`, `SetPermissionsMixin`, `SerializerWithPerms`, `SetPermissionsSerializer`, `OwnedObjectSerializer`, `OwnedObjectListSerializer`, `ReadWriteSerializerMethodField`, `DocumentListSerializer`, `DocumentSelectionSerializer`, `SourceModeValidationMixin`, `BasicUserSerializer`, `NotesSerializer` |
 | `metadata.py`    | `CorrespondentSerializer`, `DocumentTypeSerializer`, `DeprecatedColors`, `ColorField`, `TagSerializer`, `CorrespondentField`, `TagsField`, `DocumentTypeField`, `StoragePathField`, `StoragePathSerializer`, `StoragePathTestSerializer`, `CustomFieldSerializer`, `CustomFieldInstanceSerializer`, `validate_documentlink_targets`                                                                |
 | `documents.py`   | `DocumentSerializer`, `SearchResultListSerializer`, `SearchResultSerializer`, `DuplicateDocumentSummarySerializer`, `_DocumentVersionInfo`, `DocumentVersionInfoSerializer`, `DocumentVersionSerializer`, `DocumentVersionLabelSerializer`, `_get_viewable_duplicates`                                                                                                                             |
 | `upload.py`      | `PostDocumentSerializer`                                                                                                                                                                                                                                                                                                                                                                           |
 | `saved_views.py` | `SavedViewFilterRuleSerializer`, `SavedViewSerializer`                                                                                                                                                                                                                                                                                                                                             |
 | `bulk_edit.py`   | `RotateDocumentsSerializer`, `MergeDocumentsSerializer`, `EditPdfDocumentsSerializer`, `RemovePasswordDocumentsSerializer`, `DeleteDocumentsSerializer`, `ReprocessDocumentsSerializer`, `BulkEditSerializer`, `BulkDownloadSerializer`, `BulkEditObjectsSerializer`                                                                                                                               |
 | `sharing.py`     | `EmailSerializer`, `ShareLinkSerializer`, `ShareLinkBundleSerializer`                                                                                                                                                                                                                                                                                                                              |
 | `tasks.py`       | `TaskSerializerV10`, `TaskSerializerV9`, `TaskSummarySerializer`, `RunTaskSerializer`, `AcknowledgeTasksViewSerializer`                                                                                                                                                                                                                                                                            |
 | `workflows.py`   | `WorkflowTriggerSerializer`, `WorkflowActionEmailSerializer`, `WorkflowActionWebhookSerializer`, `WorkflowActionSerializer`, `WorkflowSerializer`                                                                                                                                                                                                                                                  |
 | `system.py`      | `UiSettingsViewSerializer`, `TrashSerializer`                                                                                                                                                                                                                                                                                                                                                      |
 Note: `ChatStreamingSerializer` is defined in `views.py` today (not
 `serialisers.py`), directly above `ChatStreamingView`. It moves with
 `ChatStreamingView` into `documents/views/chat.py` rather than into the
 serialisers package, preserving its current co-location.
 ## External call sites to update
 Only three files import from these two modules today, and all move to
 importing from the specific new submodule:
 - `src/paperless/urls.py` — ~34 `from documents.views import X` lines, one
  per viewset/view used in URL routing. Each becomes
  `from documents.views.<domain> import X`.
 - `src/paperless_mail/views.py` — `from documents.views import PassUserMixin`
  becomes `from documents.views.base import PassUserMixin`.
 - `src/paperless_mail/serialisers.py` — `CorrespondentField`,
  `DocumentTypeField`, `OwnedObjectSerializer`, `TagsField` move to
  `from documents.serialisers.metadata import CorrespondentField, DocumentTypeField, TagsField`
  and `from documents.serialisers.base import OwnedObjectSerializer`.
 ## Migration order
 1. Split `serialisers.py` into `documents/serialisers/` first — serializers
   have no dependency on views, so this half can be verified in isolation.
   Run the full backend test suite after this step.
 2. Split `views.py` into `documents/views/`, importing from the new
   `documents/serialisers/*` modules per the table above. Run the full
   backend test suite.
 3. Update the three external call sites (`paperless/urls.py`,
   `paperless_mail/views.py`, `paperless_mail/serialisers.py`).
 4. Run `ruff check` / `ruff format` and the full backend test suite once
   more end to end.
 Splitting serialisers before views (rather than in parallel) means step 2
 can immediately import finished, correctly-located serializer modules
 instead of guessing at not-yet-final paths.
 ## Risks / error handling
 - **Circular imports**: prevented by construction (serialisers never import
  from views — see Import direction above). If a genuine cross-domain need
  is discovered during implementation that seems to require a
  views→views import cycle (e.g. `UnifiedSearchViewSet` extending
  `DocumentViewSet` from a different module — both already live in
  `documents.py` so this doesn't arise), resolve it by moving the shared
  piece to `base.py` rather than introducing a cycle.
 - **Missed re-export consumers**: verified via a full-repo grep for
  `from documents.views import` / `from documents.serialisers import` /
  `documents.views.` / `documents.serialisers.` before considering the split
  complete, in case something beyond the three known call sites appears
  (e.g. in a management command or a rarely-run script).
 - **Silent behavior drift during move**: since this is a pure reorganization,
  the full test suite passing after each step (rather than only at the end)
  is the primary safety net; no new tests are required for this refactor
  itself.
 ## Testing
 No new tests. Existing coverage (`test_views.py`, `test_api_documents.py`,
 and the rest of the `documents` test suite) is run after each migration step
 per the ordering above, and must pass unchanged — a failure indicates the
 move altered behavior, not that new coverage is needed.
@@ -576,7 +576,9 @@ The following workflow action types are available:
 - Tags, correspondent, document type and storage path
 - Document owner
 - View and / or edit permissions to users or groups
- Custom fields. Note that no value for the field will be set
+- Custom fields, optionally with a value. If no value is set, the field is only added to the
  document and any value it may already have is left untouched. If a value is set, it will
  overwrite an existing value of that field on the document.
 ##### Removal {#workflow-action-removal}
@@ -21,7 +21,7 @@ dependencies = [
  "channels~=4.2",
  "channels-redis~=4.2",
  "concurrent-log-handler~=0.9.25",
-  "dateparser~=1.2",
+  "dateparser~=1.4",
  # WARNING: django does not use semver.
  #          Only patch versions are guaranteed to not introduce breaking changes.
  "django~=5.2.13",
@@ -32,33 +32,32 @@ dependencies = [
  "django-cors-headers~=4.9.0",
  "django-extensions~=4.1",
  "django-filter~=25.1",
-  "django-guardian~=3.3.0",
+  "django-guardian~=3.3.3",
  "django-multiselectfield~=1.0.1",
  "django-rich~=2.2.0",
  "django-soft-delete~=1.0.18",
  "django-treenode>=0.24",
  "djangorestframework~=3.16",
-  "djangorestframework-guardian~=0.4.0",
+  "drf-spectacular~=0.30",
-  "drf-spectacular~=0.28",
+  "drf-spectacular-sidecar~=2026.7.1",
  "drf-spectacular-sidecar~=2026.5.1",
  "drf-writable-nested~=0.7.1",
-  "filelock~=3.29.0",
+  "filelock~=3.32.0",
  "flower~=2.0.1",
  "gotenberg-client~=0.14.0",
-  "httpx-oauth~=0.16",
+  "httpx-oauth~=0.17",
-  "ijson>=3.2",
+  "ijson>=3.5.1",
-  "imap-tools~=1.13.0",
+  "imap-tools~=1.14.0",
  "jinja2~=3.1.5",
  "langdetect~=1.0.9",
-  "llama-index-core>=0.14.22",
+  "llama-index-core>=0.14.23",
  "llama-index-embeddings-huggingface>=0.6.1",
  "llama-index-embeddings-ollama>=0.9",
  "llama-index-embeddings-openai-like>=0.2.2",
  "llama-index-llms-ollama>=0.9.1",
  "llama-index-llms-openai-like>=0.7.1",
  "nltk~=3.10.0",
-  "ocrmypdf~=17.4.2",
+  "ocrmypdf~=17.7.0",
-  "openai>=2.32",
+  "openai>=2.48",
  "pathvalidate~=3.3.1",
  "pdf2image~=1.17.0",
  "python-dateutil~=2.9.0",
@@ -68,17 +67,17 @@ dependencies = [
  "python-magic~=0.4.27",
  "rapidfuzz~=3.14.5",
  "redis[hiredis]~=5.2.1",
-  "regex>=2026.4.4",
+  "regex>=2026.7.19",
-  "scikit-learn~=1.8.0",
+  "scikit-learn~=1.9.0",
-  "sentence-transformers>=5.4.1",
+  "sentence-transformers>=5.6.1",
  "setproctitle~=1.3.4",
  "sqlite-vec==0.1.9",
  "tantivy~=0.26.0",
  "tika-client~=0.11.0",
  "torch~=2.13.0",
-  "watchfiles>=1.1.1",
+  "watchfiles>=1.2",
  "whitenoise~=6.11",
-  "zxing-cpp~=3.0.0",
+  "zxing-cpp~=3.1.0",
 ]
 [project.optional-dependencies]
 mariadb = [
@@ -101,25 +100,25 @@ dev = [
  { include-group = "testing" },
 ]
 docs = [
-  "zensical>=0.0.47",
+  "zensical>=0.0.51",
 ]
 lint = [
-  "prek~=0.3.10",
+  "prek~=0.4.11",
-  "ruff~=0.15.20",
+  "ruff~=0.16.1",
 ]
 testing = [
  "daphne",
  "factory-boy~=3.3.1",
-  "faker~=40.15.0",
+  "faker~=40.36.0",
  "imagehash",
-  "pytest~=9.0.3",
+  "pytest~=9.1.1",
  "pytest-cov~=7.1.0",
  "pytest-django~=4.12.0",
-  "pytest-env~=1.6.0",
+  "pytest-env~=1.7.0",
  "pytest-httpx",
  "pytest-mock~=3.15.1",
  # "pytest-randomly~=4.0.1",
-  "pytest-rerunfailures~=16.1",
+  "pytest-rerunfailures~=16.4",
  "pytest-sugar",
  "pytest-xdist~=3.8.0",
  "time-machine>=2.13",
@@ -183,6 +182,7 @@ output-format = "grouped"
 line-ending = "lf"
 [tool.ruff.lint]
 # https://docs.astral.sh/ruff/rules/
 select = [ "E4", "E7", "E9", "F" ]
 extend-select = [
  "COM",  # https://docs.astral.sh/ruff/rules/#flake8-commas-com
  "DJ",   # https://docs.astral.sh/ruff/rules/#flake8-django-dj
@@ -56,13 +56,13 @@
      },
      "architect": {
        "build": {
-          "builder": "@angular-builders/custom-webpack:browser",
+          "builder": "@angular/build:application",
          "options": {
-            "customWebpackConfig": {
+            "outputPath": {
-                "path": "./extra-webpack.config.ts"
+              "base": "dist/paperless-ui",
              "browser": ""
            },
-            "outputPath": "dist/paperless-ui",
+            "browser": "src/main.ts",
            "main": "src/main.ts",
            "outputHashing": "none",
            "index": "src/index.html",
            "polyfills": [
@@ -97,6 +97,7 @@
            "scripts": [],
            "allowedCommonJsDependencies": [
              "file-saver",
              "mime-names",
              "utif"
            ],
            "extractLicenses": false,
@@ -117,11 +118,13 @@
                  "with": "src/environments/environment.prod.ts"
                }
              ],
-              "outputPath": "../src/documents/static/frontend/",
+              "outputPath": {
                "base": "../src/documents/static/frontend/",
                "browser": ""
              },
              "optimization": true,
              "outputHashing": "none",
              "sourceMap": false,
              "namedChunks": false,
              "extractLicenses": true,
              "budgets": [
                {
@@ -145,7 +148,7 @@
          "defaultConfiguration": ""
        },
        "serve": {
-          "builder": "@angular-builders/custom-webpack:dev-server",
+          "builder": "@angular/build:dev-server",
          "options": {
            "buildTarget": "paperless-ui:build:en-US"
          },
@@ -156,7 +159,7 @@
          }
        },
        "extract-i18n": {
-          "builder": "@angular-builders/custom-webpack:extract-i18n",
+          "builder": "@angular/build:extract-i18n",
          "options": {
            "buildTarget": "paperless-ui:build"
          }
@@ -1,24 +0,0 @@
 import {
  CustomWebpackBrowserSchema,
  TargetOptions,
 } from '@angular-builders/custom-webpack'
 import * as webpack from 'webpack'
 const { codecovWebpackPlugin } = require('@codecov/webpack-plugin')
 export default (
  config: webpack.Configuration,
  options: CustomWebpackBrowserSchema,
  targetOptions: TargetOptions
 ) => {
  if (config.plugins) {
    config.plugins.push(
      codecovWebpackPlugin({
        enableBundleAnalysis: process.env.CODECOV_TOKEN !== undefined,
        bundleName: 'paperless-ngx',
        uploadToken: process.env.CODECOV_TOKEN,
      })
    )
  }
  return config
 }
@@ -11,16 +11,16 @@
  },
  "private": true,
  "dependencies": {
-    "@angular/cdk": "^22.0.3",
+    "@angular/cdk": "^22.0.6",
-    "@angular/common": "~22.0.5",
+    "@angular/common": "~22.1.0",
-    "@angular/compiler": "~22.0.5",
+    "@angular/compiler": "~22.1.0",
-    "@angular/core": "~22.0.5",
+    "@angular/core": "~22.1.0",
-    "@angular/forms": "~22.0.5",
+    "@angular/forms": "~22.1.0",
-    "@angular/localize": "~22.0.5",
+    "@angular/localize": "~22.1.0",
-    "@angular/platform-browser": "~22.0.5",
+    "@angular/platform-browser": "~22.1.0",
-    "@angular/router": "~22.0.5",
+    "@angular/router": "~22.1.0",
    "@ng-bootstrap/ng-bootstrap": "^21.0.0",
-    "@ng-select/ng-select": "^23.2.0",
+    "@ng-select/ng-select": "^23.5.0",
    "@ngneat/dirty-check-forms": "^3.0.3",
    "@popperjs/core": "^2.11.8",
    "bootstrap": "^5.3.8",
@@ -32,33 +32,31 @@
    "ngx-device-detector": "^12.0.0",
    "ngx-ui-tour-ng-bootstrap": "^19.0.0",
    "normalize-diacritics": "^5.0.0",
-    "pdfjs-dist": "^6.0.227",
+    "pdfjs-dist": "^6.2.108",
    "rxjs": "^7.8.2",
    "tslib": "^2.8.1",
    "utif": "^3.1.0",
    "uuid": "^14.0.1"
  },
  "devDependencies": {
    "@angular-builders/custom-webpack": "^22.0.1",
    "@angular-builders/jest": "^22.0.1",
-    "@angular-devkit/core": "^22.0.5",
+    "@angular-devkit/core": "^22.1.2",
-    "@angular-devkit/schematics": "^22.0.5",
+    "@angular-devkit/schematics": "^22.1.2",
-    "@angular-eslint/builder": "22.0.0",
+    "@angular-eslint/builder": "22.1.0",
-    "@angular-eslint/eslint-plugin": "22.0.0",
+    "@angular-eslint/eslint-plugin": "22.1.0",
-    "@angular-eslint/eslint-plugin-template": "22.0.0",
+    "@angular-eslint/eslint-plugin-template": "22.1.0",
-    "@angular-eslint/schematics": "22.0.0",
+    "@angular-eslint/schematics": "22.1.0",
-    "@angular-eslint/template-parser": "22.0.0",
+    "@angular-eslint/template-parser": "22.1.0",
-    "@angular/build": "^22.0.5",
+    "@angular/build": "22.1.2",
-    "@angular/cli": "~22.0.5",
+    "@angular/cli": "22.1.2",
-    "@angular/compiler-cli": "~22.0.5",
+    "@angular/compiler-cli": "~22.1.0",
-    "@codecov/webpack-plugin": "^2.0.1",
+    "@playwright/test": "^1.62.0",
    "@playwright/test": "^1.61.1",
    "@types/jest": "^30.0.0",
-    "@types/node": "^26.0.0",
+    "@types/node": "^26.1.1",
-    "@typescript-eslint/eslint-plugin": "^8.62.0",
+    "@typescript-eslint/eslint-plugin": "^8.65.0",
-    "@typescript-eslint/parser": "^8.62.0",
+    "@typescript-eslint/parser": "^8.65.0",
-    "@typescript-eslint/utils": "^8.62.0",
+    "@typescript-eslint/utils": "^8.65.0",
-    "eslint": "^10.5.0",
+    "eslint": "^10.8.0",
    "jest": "30.4.2",
    "jest-environment-jsdom": "^30.4.1",
    "jest-junit": "^17.0.0",
@@ -66,8 +64,7 @@
    "jest-websocket-mock": "^2.5.0",
    "prettier-plugin-organize-imports": "^4.3.0",
    "ts-node": "~10.9.1",
-    "typescript": "^6.0.3",
+    "typescript": "^6.0.3"
    "webpack": "^5.107.2"
  },
-  "packageManager": "pnpm@10.26.0"
+  "packageManager": "pnpm@11.15.1"
 }
@@ -5,6 +5,7 @@ trustPolicy: no-downgrade
 trustPolicyExclude:
  - "chokidar@4.0.3"
  - "semver@6.3.1 || 5.7.2"
 blockExoticSubdeps: true
 allowBuilds:
  "@parcel/watcher": true
  canvas: true
@@ -576,7 +576,7 @@ describe('TasksComponent', () => {
    expect(dismissSpy).toHaveBeenCalledWith(new Set([tasks[0].id, tasks[1].id]))
    expect(toastSpy).toHaveBeenCalledWith('Error dismissing tasks', error)
-    expect(modal.componentInstance.buttonsEnabled).toBe(true)
+    expect(modal.componentInstance.buttonsEnabled()).toBe(true)
    expect(component.selectedTasks.size).toBe(0)
  })
@@ -642,7 +642,7 @@ describe('TasksComponent', () => {
    expect(dismissSpy).toHaveBeenCalled()
    expect(toastSpy).toHaveBeenCalledWith('Error dismissing tasks', error)
-    expect(modal.componentInstance.buttonsEnabled).toBe(true)
+    expect(modal.componentInstance.buttonsEnabled()).toBe(true)
  })
  it('should dismiss the currently visible scoped and filtered tasks', () => {
@@ -316,7 +316,7 @@ export class TasksComponent
      modal.componentInstance.btnClass = 'btn-warning'
      modal.componentInstance.btnCaption = $localize`Dismiss`
      modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        modal.close()
        this.tasksService.dismissTasks(tasks).subscribe({
          next: () => {
@@ -324,7 +324,7 @@ export class TasksComponent
          },
          error: (e) => {
            this.toastService.showError($localize`Error dismissing tasks`, e)
-            modal.componentInstance.buttonsEnabled = true
+            modal.componentInstance.buttonsEnabled.set(true)
          },
        })
        this.clearSelection()
@@ -350,7 +350,7 @@ export class TasksComponent
    modal.componentInstance.btnClass = 'btn-warning'
    modal.componentInstance.btnCaption = $localize`Dismiss`
    modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      modal.close()
      this.tasksService.dismissAllTasks().subscribe({
        next: () => {
@@ -358,7 +358,7 @@ export class TasksComponent
        },
        error: (e) => {
          this.toastService.showError($localize`Error dismissing tasks`, e)
-          modal.componentInstance.buttonsEnabled = true
+          modal.componentInstance.buttonsEnabled.set(true)
        },
      })
      this.clearSelection()
@@ -82,7 +82,7 @@ export class TrashComponent
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        this.trashService.emptyTrash([document.id]).subscribe({
          next: () => {
            this.toastService.showInfo(
@@ -146,7 +146,7 @@ export class UsersAndGroupsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.usersService.delete(user).subscribe({
        next: () => {
          modal.close()
@@ -199,7 +199,7 @@ export class UsersAndGroupsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.groupsService.delete(group).subscribe({
        next: () => {
          modal.close()
@@ -104,14 +104,14 @@
            </h6>
            <ul class="nav flex-column mb-2" cdkDropList (cdkDropListDropped)="onDrop($event)">
              @for (view of savedViewService.sidebarViews; track view.id) {
-                <li class="nav-item w-100 app-link" cdkDrag [cdkDragDisabled]="!settingsService.organizingSidebarSavedViews()"
+                <li class="nav-item w-100 app-link" cdkDrag [cdkDragDisabled]="!settingsService.organizingSidebarSavedViews() || !canSaveSettings"
                  cdkDragPreviewContainer="parent" cdkDragPreviewClass="navItemDrag" (cdkDragStarted)="onDragStart($event)"
                  (cdkDragEnded)="onDragEnd($event)">
                  <a class="nav-link" routerLink="view/{{view.id}}"
                    routerLinkActive="active" (click)="closeMenu()" [ngbPopover]="view.name"
                    [disablePopover]="!slimSidebarEnabled" placement="end" container="body" triggers="mouseenter:mouseleave"
                    popoverClass="popover-slim">
-                    <i-bs class="me-2" name="funnel"></i-bs><span><div class="d-inline-flex view-name"><span class="overflow-hidden" [class.text-wrap]="!slimSidebarEnabled">{{view.name}}</span></div>
+                    <i-bs class="me-2" [name]="view.icon || 'funnel'"></i-bs><span><div class="d-inline-flex view-name"><span class="overflow-hidden" [class.text-wrap]="!slimSidebarEnabled">{{view.name}}</span></div>
                        @if (showSidebarCounts && !slimSidebarEnabled) {
                          <span class="badge bg-info text-dark ms-2 d-inline">{{ savedViewService.getDocumentCount(view) }}</span>
                        }
@@ -120,7 +120,7 @@
                      <span class="badge bg-info text-dark position-absolute top-0 end-0 d-none d-md-block">{{ savedViewService.getDocumentCount(view) }}</span>
                    }
                  </a>
-                  @if (settingsService.organizingSidebarSavedViews()) {
+                  @if (settingsService.organizingSidebarSavedViews() && canSaveSettings) {
                    <div class="position-absolute end-0 top-0 px-3 py-2" [class.me-n3]="slimSidebarEnabled" cdkDragHandle>
                      <i-bs name="grip-vertical"></i-bs>
                    </div>
@@ -47,11 +47,12 @@
  .search-container {
    max-height: 4.5rem;
-    overflow: hidden;
+    overflow: visible;
    transition: max-height .2s ease, opacity .2s ease, padding-top .2s ease, padding-bottom .2s ease;
    &.mobile-hidden {
      max-height: 0;
      overflow: hidden;
      opacity: 0;
      padding-top: 0 !important;
      padding-bottom: 0 !important;
@@ -12,10 +12,10 @@
  }
 </div>
 <div class="modal-footer">
-  <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+  <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">
        <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
      </button>
-  <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled">
+  <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled()">
    <span>
      {{btnCaption}}
      <span class="visually-hidden">{{ seconds | number: '1.0-0' }} seconds</span>
@@ -25,7 +25,7 @@
    }
  </button>
  @if (alternativeBtnCaption) {
-    <button type="button" class="btn" [class]="alternativeBtnClass" (click)="alternative()" [disabled]="!alternativeButtonEnabled || !buttonsEnabled">
+    <button type="button" class="btn" [class]="alternativeBtnClass" (click)="alternative()" [disabled]="!alternativeButtonEnabled || !buttonsEnabled()">
      {{alternativeBtnCaption}}
    </button>
  }
@@ -64,6 +64,22 @@ describe('ConfirmDialogComponent', () => {
    expect(confirmSubjectResult).toBeTruthy()
  })
  it('should re-render the buttons when they are toggled from outside', async () => {
    const confirmButton: HTMLButtonElement =
      fixture.nativeElement.querySelectorAll('.modal-footer button')[1]
    expect(confirmButton.disabled).toBeFalsy()
    // Deliberately no detectChanges: a request callback toggling this is all
    // that happens, and nothing else schedules a render for the modal
    component.buttonsEnabled.set(false)
    await fixture.whenStable()
    expect(confirmButton.disabled).toBeTruthy()
    component.buttonsEnabled.set(true)
    await fixture.whenStable()
    expect(confirmButton.disabled).toBeFalsy()
  })
  it('should support cancel & close modal', () => {
    let confirmSubjectResult
    const closeModalSpy = jest.spyOn(modal, 'close')
@@ -1,5 +1,12 @@
 import { DecimalPipe } from '@angular/common'
-import { Component, EventEmitter, Input, Output, inject } from '@angular/core'
+import {
  Component,
  EventEmitter,
  Input,
  Output,
  inject,
  signal,
 } from '@angular/core'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import { Subject } from 'rxjs'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
@@ -46,8 +53,7 @@ export class ConfirmDialogComponent extends LoadingComponentWithPermissions {
  @Input()
  cancelBtnCaption = $localize`Cancel`
-  @Input()
+  readonly buttonsEnabled = signal(true)
  buttonsEnabled = true
  confirmButtonEnabled = true
  alternativeButtonEnabled = true
@@ -56,10 +56,10 @@
    }
 </div>
 <div class="modal-footer">
-    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">
        <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
    </button>
-    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled">
+    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled()">
        {{btnCaption}}
    </button>
 </div>
@@ -57,7 +57,7 @@
    class="btn"
    [class]="cancelBtnClass"
    (click)="cancel()"
-    [disabled]="!buttonsEnabled"
+    [disabled]="!buttonsEnabled()"
  >
    <span class="d-inline-block" style="padding-bottom: 1px;">
      {{cancelBtnCaption}}
@@ -68,7 +68,7 @@
    class="btn"
    [class]="btnClass"
    (click)="confirm()"
-    [disabled]="!confirmButtonEnabled || !buttonsEnabled"
+    [disabled]="!confirmButtonEnabled || !buttonsEnabled()"
  >
    {{btnCaption}}
  </button>
@@ -34,10 +34,10 @@
          <p class="mb-0 small"><b>{{messageBold}}</b></p>
        }
    </div>
-    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">
+    <button type="button" class="btn" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">
        <span class="d-inline-block" style="padding-bottom: 1px;">{{cancelBtnCaption}}</span>
    </button>
-    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled || degrees === 0">
+    <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="!confirmButtonEnabled || !buttonsEnabled() || degrees === 0">
      {{btnCaption}}
      @if (!confirmButtonEnabled) {
          <ngb-progressbar style="height: 1px;" type="dark" [max]="secondsTotal" [value]="seconds"></ngb-progressbar>
@@ -1019,4 +1019,28 @@ describe('WorkflowEditDialogComponent', () => {
      'pass3',
    ])
  })
  it('should parse passwords again when retrying a failed save', () => {
    component.object = {
      name: 'Workflow with blank Passwords',
      id: 1,
      order: null,
      enabled: true,
      triggers: [],
      actions: [
        {
          id: 1,
          type: WorkflowActionType.PasswordRemoval,
          passwords: [],
        },
      ],
    }
    component.ngOnInit()
    component.save()
    component.objectForm.get('order').setValue(1)
    expect(() => component.save()).not.toThrow()
    expect(component.objectForm.get('actions').value[0].passwords).toEqual([])
  })
 })
@@ -1207,9 +1207,8 @@ export class WorkflowEditDialogComponent
    return passwords.join('\n')
  }
-  private parsePasswords(value: string = ''): string[] {
+  private parsePasswords(value: string | string[] = ''): string[] {
-    return value
+    return (Array.isArray(value) ? value : value.split(/[\n,]+/))
      .split(/[\n,]+/)
      .map((entry) => entry.trim())
      .filter((entry) => entry.length > 0)
  }
@@ -52,10 +52,10 @@ describe('CustomFieldsValuesComponent', () => {
  })
  it('should set selectedFields and map values correctly', () => {
-    component.value = { 1: 'value1' }
+    component.value = { 1: 'value1', 3: 0, 4: false }
-    component.selectedFields = [1, 2]
+    component.selectedFields = [1, 2, 3, 4]
-    expect(component.selectedFields).toEqual([1, 2])
+    expect(component.selectedFields).toEqual([1, 2, 3, 4])
-    expect(component.value).toEqual({ 1: 'value1', 2: null })
+    expect(component.value).toEqual({ 1: 'value1', 2: null, 3: 0, 4: false })
  })
  it('should return the correct custom field by id', () => {
@@ -77,7 +77,7 @@ export class CustomFieldsValuesComponent extends AbstractInputComponent<Object>
    this._selectedFields = newFields
    // map the selected fields to an object with field_id as key and value as value
    this.value = newFields.reduce((acc, fieldId) => {
-      acc[fieldId] = this.value?.[fieldId] || null
+      acc[fieldId] = this.value?.[fieldId] ?? null
      return acc
    }, {})
    this.onChange(this.value)
@@ -36,7 +36,16 @@
          (focus)="clearLastSearchTerm()"
          (clear)="clearLastSearchTerm()"
          (blur)="onBlur()">
          <ng-template ng-label-tmp let-item="item">
            @if (iconField && item[iconField]) {
              <i-bs class="me-2" [name]="item[iconField]"></i-bs>
            }
            <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
          </ng-template>
          <ng-template ng-option-tmp let-item="item">
              @if (iconField && item[iconField]) {
                <i-bs class="me-2" [name]="item[iconField]"></i-bs>
              }
              <span [title]="item[bindLabel]">{{item[bindLabel]}}</span>
          </ng-template>
        </ng-select>
@@ -35,7 +35,7 @@ import { AbstractInputComponent } from '../abstract-input'
    NgxBootstrapIconsModule,
  ],
 })
-export class SelectComponent extends AbstractInputComponent<number> {
+export class SelectComponent extends AbstractInputComponent<number | string> {
  constructor() {
    super()
    this.addItemRef = this.addItem.bind(this)
@@ -100,6 +100,9 @@ export class SelectComponent extends AbstractInputComponent<number> {
  @Input()
  bindLabel: string = 'name'
  @Input()
  iconField: string
  public searchFn = (term: string, item: any): boolean =>
    matchesSearchText(item?.[this.bindLabel], term)
@@ -100,7 +100,7 @@
      </div>
    }
    <div class="form-group ms-md-auto">
-      <button type="button" class="btn me-2" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled">{{ cancelBtnCaption }}</button>
+      <button type="button" class="btn me-2" [class]="cancelBtnClass" (click)="cancel()" [disabled]="!buttonsEnabled()">{{ cancelBtnCaption }}</button>
      <button type="button" class="btn" [class]="btnClass" (click)="confirm()" [disabled]="pages.length === 0">{{ btnCaption }}</button>
    </div>
  </div>
@@ -151,6 +151,13 @@
  inset: 0;
  pointer-events: none;
  & section {
    position: absolute;
    text-align: initial;
    box-sizing: border-box;
    transform-origin: 0 0;
  }
  & .annotationTextContent {
    opacity: 0;
  }
@@ -90,6 +90,7 @@ describe('PngxPdfViewerComponent', () => {
    }
    expect(viewer).toBeInstanceOf(PDFSinglePageViewer)
    expect(viewer.options.textLayerMode).toBe(0)
    expect(viewer.options.enableSelectionRendering).toBe(false)
  })
  it('applies zoom, rotation, and page changes', async () => {
@@ -13,6 +13,7 @@ import {
  ViewChild,
 } from '@angular/core'
 import {
  AnnotationMode,
  getDocument,
  GlobalWorkerOptions,
  PDFDocumentLoadingTask,
@@ -221,6 +222,8 @@ export class PngxPdfViewerComponent
      linkService: this.linkService,
      findController: this.findController,
      textLayerMode,
      annotationMode: AnnotationMode.ENABLE,
      enableSelectionRendering: false,
      removePageBorders: true,
    }
@@ -17,6 +17,10 @@ const permissions = [
  'view_document',
  'change_document',
  'delete_document',
  'add_sharelinkbundle',
  'view_sharelinkbundle',
  'change_sharelinkbundle',
  'delete_sharelinkbundle',
  'change_tag',
  'view_documenttype',
 ]
@@ -75,6 +79,7 @@ describe('PermissionsSelectComponent', () => {
    component.ngOnInit()
    component.writeValue(permissions)
    expect(component.typesWithAllActions).toContain('Document')
    expect(component.typesWithAllActions).toContain('ShareLinkBundle')
  })
  it('should update checkboxes on permissions set', () => {
@@ -85,6 +90,10 @@ describe('PermissionsSelectComponent', () => {
    expect(input1.nativeElement.checked).toBeTruthy()
    const input2 = fixture.debugElement.query(By.css('input#Tag_Change'))
    expect(input2.nativeElement.checked).toBeTruthy()
    const bundleInput = fixture.debugElement.query(
      By.css('input#ShareLinkBundle_Add')
    )
    expect(bundleInput.nativeElement.checked).toBeTruthy()
  })
  it('disable checkboxes when permissions are inherited', () => {
@@ -119,7 +119,7 @@
        type="button"
        class="btn btn-primary btn-sm d-inline-flex align-items-center gap-2 text-nowrap"
        (click)="submit()"
-        [disabled]="loading() || !buttonsEnabled">
+        [disabled]="loading() || !buttonsEnabled()">
        @if (loading()) {
          <span class="spinner-border spinner-border-sm" role="status" aria-hidden="true"></span>
        }
@@ -69,7 +69,7 @@ describe('ShareLinkBundleDialogComponent', () => {
      file_version: FileVersion.Original,
      expiration_days: 3,
    })
-    expect(component.buttonsEnabled).toBe(false)
+    expect(component.buttonsEnabled()).toBe(false)
    expect(confirmSpy).toHaveBeenCalled()
    component.form.setValue({
@@ -78,7 +78,7 @@ export class ShareLinkBundleDialogComponent extends ConfirmDialogComponent {
        : FileVersion.Original,
      expiration_days: this.form.value.expirationDays,
    }
-    this.buttonsEnabled = false
+    this.buttonsEnabled.set(false)
    super.confirm()
  }
@@ -2,10 +2,16 @@
  <button type="button" class="btn btn-sm btn-outline-primary" (click)="clickSuggest()" [disabled]="disabled() || loading() || (suggestions() && !aiEnabled())">
    @if (loading()) {
      <div class="spinner-border spinner-border-sm" role="status"></div>
    } @else if (noSuggestions) {
      <i-bs width="1.2em" height="1.2em" name="check-circle"></i-bs>
    } @else {
      <i-bs width="1.2em" height="1.2em" name="stars"></i-bs>
    }
-    <span class="d-none d-lg-inline ps-1" i18n>Suggest</span>
+    @if (noSuggestions) {
      <span class="d-none d-lg-inline ps-1" i18n>No suggestions</span>
    } @else {
      <span class="d-none d-lg-inline ps-1" i18n>Suggest</span>
    }
    @if (totalSuggestions > 0) {
      <span class="badge bg-primary ms-2">{{ totalSuggestions }}</span>
    }
@@ -19,7 +25,7 @@
      <div ngbDropdownMenu aria-labelledby="suggestionsDropdown" class="shadow suggestions-dropdown">
        <div class="list-group list-group-flush small pb-0">
-          @if (!suggestions()?.suggested_tags && !suggestions()?.suggested_document_types && !suggestions()?.suggested_correspondents) {
+          @if (totalSuggestions === 0) {
            <div class="list-group-item text-muted fst-italic">
              <small class="text-muted small fst-italic" i18n>No novel suggestions</small>
            </div>
@@ -30,6 +30,34 @@ describe('SuggestionsDropdownComponent', () => {
    expect(component.totalSuggestions).toBe(4)
  })
  it('should show when a completed request returned no suggestions', () => {
    fixture.componentRef.setInput('suggestions', {
      correspondents: [],
      tags: [],
      document_types: [],
      storage_paths: [],
      dates: [],
    })
    fixture.detectChanges()
    expect(component.noSuggestions).toBeTruthy()
    expect(fixture.nativeElement.textContent).toContain('No suggestions')
  })
  it('should not show the empty state before a request or with suggestions', () => {
    expect(component.noSuggestions).toBeFalsy()
    fixture.componentRef.setInput('suggestions', {
      correspondents: [],
      tags: [42],
      document_types: [],
      storage_paths: [],
      dates: [],
    })
    expect(component.noSuggestions).toBeFalsy()
  })
  it('should emit getSuggestions when clickSuggest is called and suggestions are null', () => {
    jest.spyOn(component.getSuggestions, 'emit')
    fixture.componentRef.setInput('suggestions', null)
@@ -59,5 +87,6 @@ describe('SuggestionsDropdownComponent', () => {
    })
    component.clickSuggest()
    expect(component.dropdown.open).toBeTruthy()
    expect(fixture.nativeElement.textContent).toContain('No novel suggestions')
  })
 })
@@ -61,4 +61,21 @@ export class SuggestionsDropdownComponent {
        this.suggestions()?.suggested_document_types?.length || 0
    )
  }
  get noSuggestions(): boolean {
    const suggestions = this.suggestions()
    return (
      suggestions != null &&
      !suggestions.title &&
      !suggestions.tags?.length &&
      !suggestions.suggested_tags?.length &&
      !suggestions.correspondents?.length &&
      !suggestions.suggested_correspondents?.length &&
      !suggestions.document_types?.length &&
      !suggestions.suggested_document_types?.length &&
      !suggestions.storage_paths?.length &&
      !suggestions.suggested_storage_paths?.length &&
      !suggestions.dates?.length
    )
  }
 }
@@ -1,6 +1,7 @@
 <pngx-widget-frame
  *pngxIfPermissions="{ action: PermissionAction.View, type: PermissionType.Document }"
  [title]="savedView.name"
  [titleIcon]="savedView.icon || 'funnel'"
  [loading]="false"
  [draggable]="savedView"
  >
@@ -8,7 +8,12 @@
              <i-bs name="grip-vertical"></i-bs>
            </div>
          }
-          <h6 class="card-title mb-0">{{title()}}</h6>
+          <h6 class="card-title mb-0">
            @if (titleIcon()) {
              <i-bs class="me-2" [name]="titleIcon()"></i-bs>
            }
            {{title()}}
          </h6>
          <ng-content select="[title-badge]"></ng-content>
          @if (badge() !== null && badge() !== undefined) {
            <span class="badge bg-info text-dark ms-2">{{badge()}}</span>
@@ -16,6 +16,8 @@ export class WidgetFrameComponent implements AfterViewInit {
  title = input<string>()
  titleIcon = input<string>()
  draggable = input<any>()
  cardless = input(false)
@@ -1564,7 +1564,7 @@ describe('DocumentDetailComponent', () => {
    dialog.confirmClicked.next()
    await openModal.result
-    expect(dialog.buttonsEnabled).toBe(false)
+    expect(dialog.buttonsEnabled()).toBe(false)
    expect(reloadSpy).toHaveBeenCalled()
    expect((component as any).incomingUpdateModal).toBeNull()
  })
@@ -1789,7 +1789,7 @@ describe('DocumentDetailComponent', () => {
    expect(errorSpy).toHaveBeenCalled()
    expect(component.networkActive()).toBe(false)
-    expect(dialog.buttonsEnabled).toBe(true)
+    expect(dialog.buttonsEnabled()).toBe(true)
  })
  it('should refresh the document when removing password in update mode', () => {
@@ -2161,8 +2161,14 @@ describe('DocumentDetailComponent', () => {
  it('should support open share links and email modals', () => {
    const modalSpy = jest.spyOn(modalService, 'open')
    initNormally()
    component.selectedVersionId.set(10)
    component.openShareLinks()
    expect(modalSpy).toHaveBeenCalled()
    expect(
      (
        modalSpy.mock.results[0].value as NgbModalRef
      ).componentInstance.documentId()
    ).toBe(10)
    component.openEmailDocument()
    expect(modalSpy).toHaveBeenCalled()
  })
@@ -2191,9 +2197,6 @@ describe('DocumentDetailComponent', () => {
    const appendChildSpy = jest
      .spyOn(document.body, 'appendChild')
      .mockImplementation((node: Node) => node)
    const removeChildSpy = jest
      .spyOn(document.body, 'removeChild')
      .mockImplementation((node: Node) => node)
    const createObjectURLSpy = jest
      .spyOn(URL, 'createObjectURL')
      .mockReturnValue('blob:mock-url')
@@ -2212,6 +2215,7 @@ describe('DocumentDetailComponent', () => {
      src: '',
      onload: null,
      contentWindow: mockContentWindow,
      remove: jest.fn(),
    }
    const createElementSpy = jest
@@ -2255,12 +2259,11 @@ describe('DocumentDetailComponent', () => {
      mockContentWindow.onafterprint(new Event('afterprint'))
    }
-    expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
+    expect(mockIframe.remove).toHaveBeenCalled()
    expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
    createElementSpy.mockRestore()
    appendChildSpy.mockRestore()
    removeChildSpy.mockRestore()
    createObjectURLSpy.mockRestore()
    revokeObjectURLSpy.mockRestore()
  })
@@ -2307,9 +2310,6 @@ describe('DocumentDetailComponent', () => {
      const appendChildSpy = jest
        .spyOn(document.body, 'appendChild')
        .mockImplementation((node: Node) => node)
      const removeChildSpy = jest
        .spyOn(document.body, 'removeChild')
        .mockImplementation((node: Node) => node)
      const createObjectURLSpy = jest
        .spyOn(URL, 'createObjectURL')
        .mockReturnValue('blob:mock-url')
@@ -2332,6 +2332,7 @@ describe('DocumentDetailComponent', () => {
        src: '',
        onload: null,
        contentWindow: mockContentWindow,
        remove: jest.fn(),
      }
      const createElementSpy = jest
@@ -2354,15 +2355,21 @@ describe('DocumentDetailComponent', () => {
      if (expectToast) {
        expect(toastSpy).toHaveBeenCalled()
        expect(mockIframe.remove).toHaveBeenCalled()
        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      } else {
        expect(toastSpy).not.toHaveBeenCalled()
        expect(mockIframe.remove).not.toHaveBeenCalled()
        expect(revokeObjectURLSpy).not.toHaveBeenCalled()
        component.ngOnDestroy()
        expect(mockIframe.remove).toHaveBeenCalled()
        expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      }
      expect(removeChildSpy).toHaveBeenCalledWith(mockIframe)
      expect(revokeObjectURLSpy).toHaveBeenCalledWith('blob:mock-url')
      createElementSpy.mockRestore()
      appendChildSpy.mockRestore()
      removeChildSpy.mockRestore()
      createObjectURLSpy.mockRestore()
      revokeObjectURLSpy.mockRestore()
    })
@@ -289,6 +289,8 @@ export class DocumentDetailComponent
  private incomingUpdateModal: NgbModalRef
  private pendingIncomingUpdate: IncomingDocumentUpdate
  private lastLocalSaveModified: string | null = null
  private printIframe: HTMLIFrameElement | null = null
  private printBlobUrl: string | null = null
  requiresPassword: boolean = false
  password: string
@@ -657,7 +659,7 @@ export class DocumentDetailComponent
    modal.componentInstance.cancelBtnCaption = $localize`Dismiss`
    modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      modal.close()
      this.reloadRemoteVersion()
    })
@@ -868,6 +870,7 @@ export class DocumentDetailComponent
  }
  ngOnDestroy(): void {
    this.cleanupPrintDocument()
    this.unsubscribeNotifier.next(this)
    this.unsubscribeNotifier.complete()
  }
@@ -1371,7 +1374,7 @@ export class DocumentDetailComponent
    modal.componentInstance.confirmClicked
      .pipe(
        switchMap(() => {
-          modal.componentInstance.buttonsEnabled = false
+          modal.componentInstance.buttonsEnabled.set(false)
          return this.documentsService.delete(this.document())
        })
      )
@@ -1383,7 +1386,7 @@ export class DocumentDetailComponent
        },
        error: (error) => {
          this.toastService.showError($localize`Error deleting document`, error)
-          modal.componentInstance.buttonsEnabled = true
+          modal.componentInstance.buttonsEnabled.set(true)
          this.subscribeModalDelete(modal)
        },
      })
@@ -1408,7 +1411,7 @@ export class DocumentDetailComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.documentsService
        .reprocessDocuments({ documents: [this.document().id] })
        .subscribe({
@@ -1422,7 +1425,7 @@ export class DocumentDetailComponent
          },
          error: (error) => {
            if (modal) {
-              modal.componentInstance.buttonsEnabled = true
+              modal.componentInstance.buttonsEnabled.set(true)
            }
            this.toastService.showError(
              $localize`Error executing operation`,
@@ -1795,7 +1798,7 @@ export class DocumentDetailComponent
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        this.documentsService
          .editPdfDocuments([sourceDocumentId], {
            operations: modal.componentInstance.getOperations(),
@@ -1818,7 +1821,7 @@ export class DocumentDetailComponent
            },
            error: (error) => {
              if (modal) {
-                modal.componentInstance.buttonsEnabled = true
+                modal.componentInstance.buttonsEnabled.set(true)
              }
              this.toastService.showError(
                $localize`Error executing PDF edit operation`,
@@ -1852,7 +1855,7 @@ export class DocumentDetailComponent
        const sourceDocumentId = this.selectedVersionId() ?? this.document().id
        const dialog =
          modal.componentInstance as PasswordRemovalConfirmDialogComponent
-        dialog.buttonsEnabled = false
+        dialog.buttonsEnabled.set(false)
        this.networkActive.set(true)
        this.documentsService
          .removePasswordDocuments([sourceDocumentId], {
@@ -1877,7 +1880,7 @@ export class DocumentDetailComponent
              }
            },
            error: (error) => {
-              dialog.buttonsEnabled = true
+              dialog.buttonsEnabled.set(true)
              this.networkActive.set(false)
              this.toastService.showError(
                $localize`Error executing password removal operation`,
@@ -1889,6 +1892,7 @@ export class DocumentDetailComponent
  }
  printDocument() {
    this.cleanupPrintDocument()
    const selectedVersionId = this.getSelectedNonLatestVersionId()
    const printUrl = this.documentsService.getDownloadUrl(
      this.document().id,
@@ -1902,6 +1906,8 @@ export class DocumentDetailComponent
        next: (blob) => {
          const blobUrl = URL.createObjectURL(blob)
          const iframe = document.createElement('iframe')
          this.printIframe = iframe
          this.printBlobUrl = blobUrl
          iframe.style.position = 'fixed'
          iframe.style.right = '0'
          iframe.style.bottom = '0'
@@ -1917,22 +1923,19 @@ export class DocumentDetailComponent
                iframe.contentWindow.focus()
                iframe.contentWindow.print()
                iframe.contentWindow.onafterprint = () => {
-                  document.body.removeChild(iframe)
+                  this.cleanupPrintDocument()
                  URL.revokeObjectURL(blobUrl)
                }
              } catch (err) {
                // FF throws cross-origin error on onafterprint
                const isCrossOriginAfterPrintError =
                  err instanceof DOMException &&
                  err.message.includes('onafterprint')
                // FF throws here while print preview is still reading the iframe
                // so keep it alive until the next print or teardown
                if (!isCrossOriginAfterPrintError) {
                  this.toastService.showError($localize`Print failed.`, err)
                  timer(100).subscribe(() => this.cleanupPrintDocument())
                }
                timer(100).subscribe(() => {
                  // delay to avoid FF print failure
                  document.body.removeChild(iframe)
                  URL.revokeObjectURL(blobUrl)
                })
              }
            })
          }
@@ -1945,9 +1948,20 @@ export class DocumentDetailComponent
      })
  }
  private cleanupPrintDocument() {
    if (this.printIframe) this.printIframe.remove()
    this.printIframe = null
    if (this.printBlobUrl) {
      URL.revokeObjectURL(this.printBlobUrl)
      this.printBlobUrl = null
    }
  }
  public openShareLinks() {
    const modal = this.modalService.open(ShareLinksDialogComponent)
-    modal.componentInstance.documentId.set(this.document().id)
+    modal.componentInstance.documentId.set(
      this.selectedVersionId() ?? this.document().id
    )
    modal.componentInstance.hasArchiveVersion.set(
      this.metadata()?.has_archive_version ??
        !!this.document()?.archived_file_name
@@ -1683,7 +1683,7 @@ describe('BulkEditorComponent', () => {
          expiration_days: 7,
        },
        loading: signal(false),
-        buttonsEnabled: true,
+        buttonsEnabled: signal(true),
        copied: signal(false),
      },
    }
@@ -1715,7 +1715,7 @@ describe('BulkEditorComponent', () => {
      expiration_days: 7,
    })
    expect(dialogInstance.loading()).toBe(false)
-    expect(dialogInstance.buttonsEnabled).toBe(false)
+    expect(dialogInstance.buttonsEnabled()).toBe(false)
    expect(dialogInstance.createdBundle).toEqual({ id: 42 })
    expect(typeof dialogInstance.onOpenManage).toBe('function')
    expect(toastInfoSpy).toHaveBeenCalledWith(
@@ -1755,7 +1755,7 @@ describe('BulkEditorComponent', () => {
          expiration_days: null,
        },
        loading: signal(false),
-        buttonsEnabled: true,
+        buttonsEnabled: signal(true),
      },
    }
@@ -1777,7 +1777,7 @@ describe('BulkEditorComponent', () => {
      expect.any(Error)
    )
    expect(dialogInstance.loading()).toBe(false)
-    expect(dialogInstance.buttonsEnabled).toBe(true)
+    expect(dialogInstance.buttonsEnabled()).toBe(true)
    openSpy.mockRestore()
  })
@@ -273,7 +273,7 @@ export class BulkEditorComponent
    overrideSelection?: DocumentSelectionQuery
  ) {
    if (modal) {
-      this.setModalButtonsEnabled(modal, false)
+      modal.componentInstance.buttonsEnabled.set(false)
    }
    this.documentService
      .bulkEdit(overrideSelection ?? this.getSelectionQuery(), method, args)
@@ -290,7 +290,7 @@ export class BulkEditorComponent
    options: { deleteOriginals?: boolean } = {}
  ) {
    if (modal) {
-      this.setModalButtonsEnabled(modal, false)
+      modal.componentInstance.buttonsEnabled.set(false)
    }
    request.pipe(first()).subscribe({
      next: () => {
@@ -320,7 +320,7 @@ export class BulkEditorComponent
  private handleOperationError(modal: NgbModalRef, error: any) {
    if (modal) {
-      this.setModalButtonsEnabled(modal, true)
+      modal.componentInstance.buttonsEnabled.set(true)
    }
    this.toastService.showError(
      $localize`Error executing bulk operation`,
@@ -328,15 +328,6 @@ export class BulkEditorComponent
    )
  }
  private setModalButtonsEnabled(modal: NgbModalRef, enabled: boolean) {
    const buttonsEnabled = modal.componentInstance.buttonsEnabled
    if (typeof buttonsEnabled?.set === 'function') {
      buttonsEnabled.set(enabled)
    } else {
      modal.componentInstance.buttonsEnabled = enabled
    }
  }
  private applySelectionData(
    items: SelectionDataItem[],
    selectionModel: FilterableDropdownSelectionModel
@@ -872,7 +863,7 @@ export class BulkEditorComponent
      modal.componentInstance.confirmClicked
        .pipe(takeUntil(this.unsubscribeNotifier))
        .subscribe(() => {
-          modal.componentInstance.buttonsEnabled = false
+          modal.componentInstance.buttonsEnabled.set(false)
          this.executeDocumentAction(
            modal,
            this.documentService.deleteDocuments(this.getSelectionQuery())
@@ -920,7 +911,7 @@ export class BulkEditorComponent
    modal.componentInstance.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        this.executeDocumentAction(
          modal,
          this.documentService.reprocessDocuments(this.getSelectionQuery())
@@ -957,7 +948,7 @@ export class BulkEditorComponent
    rotateDialog.confirmClicked
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
-        rotateDialog.buttonsEnabled = false
+        rotateDialog.buttonsEnabled.set(false)
        this.executeDocumentAction(
          modal,
          this.documentService.rotateDocuments(
@@ -990,7 +981,7 @@ export class BulkEditorComponent
        if (mergeDialog.archiveFallback()) {
          args.archive_fallback = true
        }
-        mergeDialog.buttonsEnabled = false
+        mergeDialog.buttonsEnabled.set(false)
        this.executeDocumentAction(
          modal,
          this.documentService.mergeDocuments(mergeDialog.documentIDs(), args),
@@ -1063,14 +1054,14 @@ export class BulkEditorComponent
      .pipe(takeUntil(this.unsubscribeNotifier))
      .subscribe(() => {
        dialog.loading.set(true)
-        dialog.buttonsEnabled = false
+        dialog.buttonsEnabled.set(false)
        this.shareLinkBundleService
          .createBundle(dialog.payload)
          .pipe(first())
          .subscribe({
            next: (result) => {
              dialog.loading.set(false)
-              dialog.buttonsEnabled = false
+              dialog.buttonsEnabled.set(false)
              dialog.createdBundle = result
              dialog.copied.set(false)
              dialog.payload = null
@@ -1084,7 +1075,7 @@ export class BulkEditorComponent
            },
            error: (error) => {
              dialog.loading.set(false)
-              dialog.buttonsEnabled = true
+              dialog.buttonsEnabled.set(true)
              this.toastService.showError(
                $localize`Share link bundle creation is not available yet.`,
                error
@@ -97,7 +97,9 @@
    <div class="dropdown-menu shadow dropdown-menu-right" ngbDropdownMenu>
      @if (!list.activeSavedViewId) {
        @for (view of savedViewService.allViews; track view) {
-          <button ngbDropdownItem (click)="loadViewConfig(view.id)">{{view.name}}</button>
+          <button ngbDropdownItem (click)="loadViewConfig(view.id)">
            <i-bs class="me-2" [name]="view.icon || 'funnel'"></i-bs>{{view.name}}
          </button>
        }
        @if (savedViewService.allViews.length > 0) {
          <div class="dropdown-divider"></div>
@@ -457,6 +457,7 @@ export class DocumentListComponent
      modal.componentInstance.buttonsEnabled.set(false)
      let savedView: SavedView = {
        name: formValue.name,
        icon: formValue.icon,
        filter_rules: this.list.filterRules,
        sort_reverse: this.list.sortReverse,
        sort_field: this.list.sortField,
@@ -1697,6 +1697,24 @@ describe('FilterEditorComponent', () => {
    ])
  })
  it('should carry over text filtering once with created and added relative dates', () => {
    component.textFilter = 'foo'
    const datesDropdown = fixture.debugElement.query(
      By.directive(DatesDropdownComponent)
    )
    component.dateCreatedRelativeDate = RelativeDate.WITHIN_1_WEEK
    component.dateAddedRelativeDate = RelativeDate.WITHIN_1_MONTH
    datesDropdown.triggerEventHandler('datesSet')
    fixture.detectChanges()
    tick(400)
    expect(component.filterRules).toEqual([
      {
        rule_type: FILTER_FULLTEXT_QUERY,
        value: 'foo,created:[-1 week to now],added:[-1 month to now]',
      },
    ])
  })
  it('should convert legacy title filters into full text query when adding a created relative date', () => {
    component.filterRules = [
      {
@@ -2195,6 +2213,20 @@ describe('FilterEditorComponent', () => {
    expect(blurSpy).toHaveBeenCalled()
  })
  it('should only dismiss open autocomplete suggestions on Escape, keeping the query', () => {
    component.textFilter = 'foo bar'
    component.textFilterInput.nativeElement.value = 'foo bar'
    jest.spyOn(component.searchTypeahead, 'isPopupOpen').mockReturnValue(true)
    const dismissSpy = jest
      .spyOn(component.searchTypeahead, 'dismissPopup')
      .mockImplementation(() => {})
    component.textFilterInput.nativeElement.dispatchEvent(
      new KeyboardEvent('keydown', { key: 'Escape' })
    )
    expect(dismissSpy).toHaveBeenCalled()
    expect(component.textFilter).toEqual('foo bar')
  })
  it('should adjust text filter targets if more like search', () => {
    const TEXT_FILTER_TARGET_FULLTEXT_MORELIKE = 'fulltext-morelike' // private const
    component.textFilterTarget = TEXT_FILTER_TARGET_FULLTEXT_MORELIKE
@@ -15,6 +15,7 @@ import {
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import {
  NgbDropdownModule,
  NgbTypeahead,
  NgbTypeaheadModule,
 } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
@@ -351,6 +352,9 @@ export class FilterEditorComponent
  @ViewChild('textFilterInput')
  textFilterInput: ElementRef
  @ViewChild(NgbTypeahead)
  searchTypeahead: NgbTypeahead
  readonly customFields = signal<CustomField[]>([])
  tagDocumentCounts: SelectionDataItem[]
@@ -1016,7 +1020,6 @@ export class FilterEditorComponent
      this.dateAddedRelativeDate !== null ||
      this.dateCreatedRelativeDate !== null
    ) {
      let queryArgs: Array<string> = []
      let existingRule = filterRules.find(
        (fr) => fr.rule_type == FILTER_FULLTEXT_QUERY
      )
@@ -1038,32 +1041,28 @@ export class FilterEditorComponent
        existingRule.rule_type = FILTER_FULLTEXT_QUERY
      }
-      let existingRuleArgs = existingRule?.value.split(',')
+      let queryArgs = existingRule?.value.split(',') ?? []
      if (this.dateCreatedRelativeDate !== null) {
        const rd = RELATIVE_DATE_QUERYSTRINGS.find(
          (qS) => qS.relativeDate == this.dateCreatedRelativeDate
        )
        queryArgs = queryArgs.filter(
          (arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_CREATED)
        )
        queryArgs.push(
          `created:${rd.isRange ? `[${rd.dateQuery}]` : `"${rd.dateQuery}"`}`
        )
        if (existingRule) {
          queryArgs = existingRuleArgs
            .filter((arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_CREATED))
            .concat(queryArgs)
        }
      }
      if (this.dateAddedRelativeDate !== null) {
        const rd = RELATIVE_DATE_QUERYSTRINGS.find(
          (qS) => qS.relativeDate == this.dateAddedRelativeDate
        )
        queryArgs = queryArgs.filter(
          (arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_ADDED)
        )
        queryArgs.push(
          `added:${rd.isRange ? `[${rd.dateQuery}]` : `"${rd.dateQuery}"`}`
        )
        if (existingRule) {
          queryArgs = existingRuleArgs
            .filter((arg) => !arg.match(RELATIVE_DATE_QUERY_REGEXP_ADDED))
            .concat(queryArgs)
        }
      }
      if (existingRule) {
@@ -1155,6 +1154,7 @@ export class FilterEditorComponent
  }
  set textFilter(value) {
    this._textFilter = value // set immediately to prevent loss of keystrokes
    this.textFilterDebounce.next(value)
  }
@@ -1247,9 +1247,9 @@ export class FilterEditorComponent
        distinctUntilChanged(),
        filter((query) => !query.length || query.length > 2)
      )
-      .subscribe((text) =>
+      .subscribe(() =>
        this.updateTextFilter(
-          text,
+          this._textFilter, // use the current value, not the debounced (possibly stale) one
          this.textFilterTarget !== TEXT_FILTER_TARGET_FULLTEXT_QUERY
        )
      )
@@ -1325,6 +1325,11 @@ export class FilterEditorComponent
        this.updateTextFilter(filterString)
      }
    } else if (event.key === 'Escape') {
      if (this.searchTypeahead?.isPopupOpen()) {
        // only dismiss the suggestions, so longer query can use Enter
        this.searchTypeahead.dismissPopup()
        return
      }
      if (this._textFilter?.length) {
        this.resetTextField()
      } else {
@@ -6,6 +6,14 @@
  </div>
  <div class="modal-body">
    <pngx-input-text i18n-title title="Name" formControlName="name" [error]="error()?.name" autocomplete="off"></pngx-input-text>
    <pngx-input-select
      i18n-title
      title="Icon"
      formControlName="icon"
      [items]="savedViewIcons"
      iconField="icon"
      [error]="error()?.icon">
    </pngx-input-select>
    <pngx-input-check i18n-title title="Show in sidebar" formControlName="showInSideBar"></pngx-input-check>
    <pngx-input-check i18n-title title="Show on dashboard" formControlName="showOnDashboard"></pngx-input-check>
    <pngx-permissions-form accordion="true" formControlName="permissions_form"></pngx-permissions-form>
@@ -9,6 +9,7 @@ import { CheckComponent } from '../../common/input/check/check.component'
 import { PermissionsFormComponent } from '../../common/input/permissions/permissions-form/permissions-form.component'
 import { PermissionsGroupComponent } from '../../common/input/permissions/permissions-group/permissions-group.component'
 import { PermissionsUserComponent } from '../../common/input/permissions/permissions-user/permissions-user.component'
 import { SelectComponent } from '../../common/input/select/select.component'
 import { TextComponent } from '../../common/input/text/text.component'
 import { SaveViewConfigDialogComponent } from './save-view-config-dialog.component'
@@ -40,6 +41,7 @@ describe('SaveViewConfigDialogComponent', () => {
        ReactiveFormsModule,
        SaveViewConfigDialogComponent,
        TextComponent,
        SelectComponent,
        CheckComponent,
        PermissionsFormComponent,
        PermissionsUserComponent,
@@ -63,6 +65,7 @@ describe('SaveViewConfigDialogComponent', () => {
    expect(component.defaultName()).toEqual(name)
    expect(result).toEqual({
      name,
      icon: 'funnel',
      showInSideBar: false,
      showOnDashboard: false,
    })
@@ -94,6 +97,7 @@ describe('SaveViewConfigDialogComponent', () => {
    component.save()
    expect(result).toEqual({
      name,
      icon: 'funnel',
      showInSideBar: true,
      showOnDashboard: true,
    })
@@ -113,6 +117,7 @@ describe('SaveViewConfigDialogComponent', () => {
    component.save()
    expect(result).toEqual({
      name: '',
      icon: 'funnel',
      showInSideBar: false,
      showOnDashboard: false,
      permissions_form: permissions,
@@ -13,9 +13,14 @@ import {
  ReactiveFormsModule,
 } from '@angular/forms'
 import { NgbActiveModal } from '@ng-bootstrap/ng-bootstrap'
 import {
  DEFAULT_SAVED_VIEW_ICON,
  SAVED_VIEW_ICONS,
 } from 'src/app/data/saved-view-icons'
 import { User } from 'src/app/data/user'
 import { CheckComponent } from '../../common/input/check/check.component'
 import { PermissionsFormComponent } from '../../common/input/permissions/permissions-form/permissions-form.component'
 import { SelectComponent } from '../../common/input/select/select.component'
 import { TextComponent } from '../../common/input/text/text.component'
@Component({
@@ -24,6 +29,7 @@ import { TextComponent } from '../../common/input/text/text.component'
  styleUrls: ['./save-view-config-dialog.component.scss'],
  imports: [
    CheckComponent,
    SelectComponent,
    TextComponent,
    PermissionsFormComponent,
    FormsModule,
@@ -41,6 +47,7 @@ export class SaveViewConfigDialogComponent implements OnInit {
  public saveClicked = new EventEmitter()
  users: User[]
  readonly savedViewIcons = SAVED_VIEW_ICONS
  setDefaultName(value: string) {
    this.defaultName.set(value)
@@ -49,6 +56,7 @@ export class SaveViewConfigDialogComponent implements OnInit {
  saveViewConfigForm = new FormGroup({
    name: new FormControl(''),
    icon: new FormControl(DEFAULT_SAVED_VIEW_ICON),
    showInSideBar: new FormControl(false),
    showOnDashboard: new FormControl(false),
    permissions_form: new FormControl(null),
@@ -65,6 +73,7 @@ export class SaveViewConfigDialogComponent implements OnInit {
    const formValue = this.saveViewConfigForm.value
    const saveViewConfig = {
      name: formValue.name,
      icon: formValue.icon,
      showInSideBar: formValue.showInSideBar,
      showOnDashboard: formValue.showOnDashboard,
    }
@@ -105,7 +105,7 @@ export class CustomFieldsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.customFieldsService.delete(field).subscribe({
        next: () => {
          modal.close()
@@ -88,7 +88,7 @@
      @if (depth > 0) {
        <div class="indicator"></div>
      }
-      <button class="btn btn-link ms-0 ps-0 text-start" (click)="userCanEdit(object) ? openEditDialog(object) : null; $event.stopPropagation()">{{ object.name }}</button>
+      <button class="btn btn-link ms-0 ps-0 text-start" style="user-select: text;" [disabled]="!userCanEdit(object)" (click)="userCanEdit(object) ? openEditDialog(object) : null; $event.stopPropagation()">{{ object.name }}</button>
    </td>
    <td class="d-none d-sm-table-cell">{{ getMatching(object) }}</td>
    <td>{{ getDocumentCount(object) }}</td>
@@ -274,7 +274,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
    activeModal.componentInstance.btnClass = 'btn-danger'
    activeModal.componentInstance.btnCaption = $localize`Delete`
    activeModal.componentInstance.confirmClicked.subscribe(() => {
-      activeModal.componentInstance.buttonsEnabled = false
+      activeModal.componentInstance.buttonsEnabled.set(false)
      this.service
        .delete(object)
        .pipe(takeUntil(this.unsubscribeNotifier))
@@ -284,7 +284,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
            this.reloadData()
          },
          error: (error) => {
-            activeModal.componentInstance.buttonsEnabled = true
+            activeModal.componentInstance.buttonsEnabled.set(true)
            this.toastService.showError(
              $localize`Error while deleting element`,
              error
@@ -455,7 +455,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.service
        .bulk_edit_objects(
          this.allSelectionActive ? [] : Array.from(this.selectedObjects),
@@ -472,7 +472,7 @@ export abstract class ManagementListComponent<T extends MatchingModel>
            this.reloadData()
          },
          error: (error) => {
-            modal.componentInstance.buttonsEnabled = true
+            modal.componentInstance.buttonsEnabled.set(true)
            this.toastService.showError(
              $localize`Error deleting objects`,
              error
@@ -196,7 +196,7 @@ export class MailComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.mailAccountService.delete(account).subscribe({
        next: () => {
          modal.close()
@@ -298,7 +298,7 @@ export class MailComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.mailRuleService.delete(rule).subscribe({
        next: () => {
          modal.close()
@@ -7,23 +7,34 @@
 </pngx-page-header>
 <form [formGroup]="savedViewsForm" (ngSubmit)="save()">
  <ul class="list-group mb-3" formGroupName="savedViews">
-    @for (view of savedViews(); track view) {
+    @for (view of pagedSavedViews(); track view) {
      <li class="list-group-item py-3">
      <div [formGroupName]="view.id">
        <div class="row">
-          <div class="col">
+          <div class="col-md">
            <pngx-input-text title="Name" formControlName="name"></pngx-input-text>
          </div>
-          <div class="col">
+          <div class="col-md">
-            <div class="form-check form-switch mt-3">
+            <pngx-input-select
-              <input type="checkbox" class="form-check-input" id="show_on_dashboard_{{view.id}}" formControlName="show_on_dashboard">
+            i18n-title
-              <label class="form-check-label" for="show_on_dashboard_{{view.id}}" i18n>Show on dashboard</label>
+            title="Icon"
-            </div>
+            formControlName="icon"
-            <div class="form-check form-switch">
+            [items]="savedViewIcons"
-              <input type="checkbox" class="form-check-input" id="show_in_sidebar_{{view.id}}" formControlName="show_in_sidebar">
+            iconField="icon">
-              <label class="form-check-label" for="show_in_sidebar_{{view.id}}" i18n>Show in sidebar</label>
+            </pngx-input-select>
            </div>
          </div>
          @if (canSaveSettings) {
            <div class="col-md">
              <div class="form-check form-switch mt-3">
                <input type="checkbox" class="form-check-input" id="show_on_dashboard_{{view.id}}" formControlName="show_on_dashboard">
                <label class="form-check-label" for="show_on_dashboard_{{view.id}}" i18n>Show on dashboard</label>
              </div>
              <div class="form-check form-switch">
                <input type="checkbox" class="form-check-input" id="show_in_sidebar_{{view.id}}" formControlName="show_in_sidebar">
                <label class="form-check-label" for="show_in_sidebar_{{view.id}}" i18n>Show in sidebar</label>
              </div>
            </div>
          }
          <div class="col-auto">
            @if (canDeleteSavedView(view)) {
              <label class="form-label" for="name_{{view.id}}" i18n>Actions</label>
@@ -79,6 +90,11 @@
    }
  </ul>
-  <button type="button" (click)="reset()" class="btn btn-outline-secondary mb-2" [disabled]="(isDirty$ | async) === false" i18n>Cancel</button>
+  <div class="d-flex align-items-center mb-3">
-  <button type="submit" class="btn btn-primary ms-2 mb-2" [disabled]="(isDirty$ | async) === false" i18n>Save</button>
+    <button type="button" (click)="reset()" class="btn btn-outline-secondary mb-2" [disabled]="(isDirty$ | async) === false" i18n>Cancel</button>
    <button type="submit" class="btn btn-primary ms-2 mb-2" [disabled]="(isDirty$ | async) === false" i18n>Save</button>
    @if (savedViews()?.length > pageSize) {
      <ngb-pagination class="ms-auto" [pageSize]="pageSize" [collectionSize]="savedViews().length" [page]="page()" [maxSize]="5" (pageChange)="page.set($event)" size="sm" aria-label="Pagination"></ngb-pagination>
    }
  </div>
 </form>
@@ -4,6 +4,7 @@ import { provideHttpClientTesting } from '@angular/common/http/testing'
 import { signal } from '@angular/core'
 import { ComponentFixture, TestBed } from '@angular/core/testing'
 import { FormsModule, ReactiveFormsModule } from '@angular/forms'
 import { By } from '@angular/platform-browser'
 import { NgbModal, NgbModule } from '@ng-bootstrap/ng-bootstrap'
 import { NgxBootstrapIconsModule, allIcons } from 'ngx-bootstrap-icons'
 import { Subject, of, throwError } from 'rxjs'
@@ -25,8 +26,20 @@ import { PageHeaderComponent } from '../../common/page-header/page-header.compon
 import { SavedViewsComponent } from './saved-views.component'
 const savedViews = [
-  { id: 1, name: 'view1', show_in_sidebar: true, show_on_dashboard: true },
+  {
-  { id: 2, name: 'view2', show_in_sidebar: false, show_on_dashboard: false },
+    id: 1,
    name: 'view1',
    icon: 'archive',
    show_in_sidebar: true,
    show_on_dashboard: true,
  },
  {
    id: 2,
    name: 'view2',
    icon: 'funnel',
    show_in_sidebar: false,
    show_on_dashboard: false,
  },
 ]
 describe('SavedViewsComponent', () => {
@@ -157,6 +170,24 @@ describe('SavedViewsComponent', () => {
    expect(patchBody.show_in_sidebar).toBeUndefined()
  })
  it('should persist a changed icon', () => {
    const patchSpy = jest.spyOn(savedViewService, 'patchMany')
    const view = savedViews[0]
    const iconControl = component.savedViewsForm
      .get('savedViews')
      .get(view.id.toString())
      .get('icon')
    iconControl.setValue('bell')
    iconControl.markAsDirty()
    component.save()
    expect(patchSpy.mock.calls[0][0][0]).toMatchObject({
      id: view.id,
      icon: 'bell',
    })
  })
  it('should persist visibility changes to user settings', () => {
    const patchSpy = jest.spyOn(savedViewService, 'patchMany')
    const updateVisibilitySpy = jest
@@ -222,6 +253,44 @@ describe('SavedViewsComponent', () => {
    ).toEqual(view.show_on_dashboard)
  })
  it('should page saved views, clamp the page if views are removed', () => {
    const manyViews = Array.from({ length: 30 }, (_, i) => ({
      id: i + 1,
      name: `view${i + 1}`,
    })) as SavedView[]
    const listSpy = jest.spyOn(savedViewService, 'list').mockReturnValue(
      of({
        all: manyViews.map((v) => v.id),
        count: manyViews.length,
        results: manyViews.concat([]),
      })
    )
    component.ngOnInit()
    fixture.detectChanges()
    expect(listSpy).toHaveBeenCalledWith(1, 100000, null, false, {
      full_perms: true,
    })
    expect(component.pagedSavedViews()).toHaveLength(25)
    expect(fixture.debugElement.query(By.css('ngb-pagination'))).not.toBeNull()
    // all views have controls, not just the current page
    expect(
      Object.keys(component.savedViewsForm.get('savedViews').value)
    ).toHaveLength(30)
    component.page.set(2)
    expect(component.pagedSavedViews()).toHaveLength(5)
    listSpy.mockReturnValue(
      of({
        all: manyViews.slice(0, 25).map((v) => v.id),
        count: 25,
        results: manyViews.slice(0, 25),
      })
    )
    component.ngOnInit()
    expect(component.page()).toEqual(1)
  })
  it('should support editing permissions', () => {
    const confirmClicked = new Subject<any>()
    const modalRef = {
@@ -1,22 +1,34 @@
 import { AsyncPipe } from '@angular/common'
-import { Component, OnDestroy, OnInit, inject, signal } from '@angular/core'
+import {
  Component,
  OnDestroy,
  OnInit,
  computed,
  inject,
  signal,
 } from '@angular/core'
 import {
  FormControl,
  FormGroup,
  FormsModule,
  ReactiveFormsModule,
 } from '@angular/forms'
-import { NgbModal } from '@ng-bootstrap/ng-bootstrap'
+import { NgbModal, NgbPaginationModule } from '@ng-bootstrap/ng-bootstrap'
 import { dirtyCheck } from '@ngneat/dirty-check-forms'
 import { NgxBootstrapIconsModule } from 'ngx-bootstrap-icons'
 import { BehaviorSubject, Observable, of, switchMap, takeUntil } from 'rxjs'
 import { PermissionsDialogComponent } from 'src/app/components/common/permissions-dialog/permissions-dialog.component'
 import { DisplayMode } from 'src/app/data/document'
 import { SavedView } from 'src/app/data/saved-view'
 import {
  DEFAULT_SAVED_VIEW_ICON,
  SAVED_VIEW_ICONS,
 } from 'src/app/data/saved-view-icons'
 import { IfPermissionsDirective } from 'src/app/directives/if-permissions.directive'
 import {
  PermissionAction,
  PermissionsService,
  PermissionType,
 } from 'src/app/services/permissions.service'
 import { SavedViewService } from 'src/app/services/rest/saved-view.service'
 import { SettingsService } from 'src/app/services/settings.service'
@@ -24,6 +36,7 @@ import { ToastService } from 'src/app/services/toast.service'
 import { ConfirmButtonComponent } from '../../common/confirm-button/confirm-button.component'
 import { DragDropSelectComponent } from '../../common/input/drag-drop-select/drag-drop-select.component'
 import { NumberComponent } from '../../common/input/number/number.component'
 import { SelectComponent } from '../../common/input/select/select.component'
 import { TextComponent } from '../../common/input/text/text.component'
 import { PageHeaderComponent } from '../../common/page-header/page-header.component'
 import { LoadingComponentWithPermissions } from '../../loading-component/loading.component'
@@ -35,12 +48,14 @@ import { LoadingComponentWithPermissions } from '../../loading-component/loading
    PageHeaderComponent,
    ConfirmButtonComponent,
    NumberComponent,
    SelectComponent,
    TextComponent,
    IfPermissionsDirective,
    DragDropSelectComponent,
    FormsModule,
    ReactiveFormsModule,
    AsyncPipe,
    NgbPaginationModule,
    NgxBootstrapIconsModule,
  ],
 })
@@ -55,8 +70,17 @@ export class SavedViewsComponent
  private readonly modalService = inject(NgbModal)
  DisplayMode = DisplayMode
  readonly savedViewIcons = SAVED_VIEW_ICONS
  readonly savedViews = signal<SavedView[]>(undefined)
  readonly page = signal(1)
  public readonly pageSize = 25
  // All views are loaded at init, so paging is only for display
  readonly pagedSavedViews = computed(() => {
    const start = (this.page() - 1) * this.pageSize
    return this.savedViews()?.slice(start, start + this.pageSize)
  })
  private savedViewsGroup = new FormGroup({})
  public savedViewsForm: FormGroup = new FormGroup({
    savedViews: this.savedViewsGroup,
@@ -71,7 +95,9 @@ export class SavedViewsComponent
  constructor() {
    super()
-    this.settings.organizingSidebarSavedViews.set(true)
+    if (this.canSaveSettings) {
      this.settings.organizingSidebarSavedViews.set(true)
    }
  }
  ngOnInit(): void {
@@ -81,15 +107,19 @@ export class SavedViewsComponent
  private reloadViews(): void {
    this.loading.set(true)
    this.savedViewService
-      .list(null, null, null, false, { full_perms: true })
+      .list(1, 100000, null, false, { full_perms: true })
      .subscribe((r) => {
        this.savedViews.set(r.results)
        const pageCount = Math.ceil(r.results.length / this.pageSize)
        this.page.update((page) => Math.min(page, Math.max(1, pageCount)))
        this.initialize()
      })
  }
  ngOnDestroy(): void {
-    this.settings.organizingSidebarSavedViews.set(false)
+    if (this.canSaveSettings) {
      this.settings.organizingSidebarSavedViews.set(false)
    }
    super.ngOnDestroy()
  }
@@ -105,6 +135,7 @@ export class SavedViewsComponent
      storeData.savedViews[view.id.toString()] = {
        id: view.id,
        name: view.name,
        icon: view.icon ?? DEFAULT_SAVED_VIEW_ICON,
        show_on_dashboard: view.show_on_dashboard,
        show_in_sidebar: view.show_in_sidebar,
        page_size: view.page_size,
@@ -117,6 +148,7 @@ export class SavedViewsComponent
        new FormGroup({
          id: new FormControl({ value: null, disabled: !canEdit }),
          name: new FormControl({ value: null, disabled: !canEdit }),
          icon: new FormControl({ value: null, disabled: !canEdit }),
          show_on_dashboard: new FormControl({
            value: null,
            disabled: false,
@@ -195,6 +227,7 @@ export class SavedViewsComponent
      const modelFieldsChanged =
        group.get('name')?.dirty ||
        group.get('icon')?.dirty ||
        group.get('page_size')?.dirty ||
        group.get('display_mode')?.dirty ||
        group.get('display_fields')?.dirty
@@ -216,7 +249,7 @@ export class SavedViewsComponent
        switchMap(() => this.savedViewService.patchMany(changed))
      )
    }
-    if (visibilityChanged) {
+    if (visibilityChanged && this.canSaveSettings) {
      saveOperation = saveOperation.pipe(
        switchMap(() =>
          this.settings.updateSavedViewsVisibility(
@@ -250,6 +283,19 @@ export class SavedViewsComponent
    return this.permissionsService.currentUserOwnsObject(view)
  }
  public get canSaveSettings(): boolean {
    return (
      this.permissionsService.currentUserCan(
        PermissionAction.Change,
        PermissionType.UISettings
      ) &&
      this.permissionsService.currentUserCan(
        PermissionAction.Add,
        PermissionType.UISettings
      )
    )
  }
  public editPermissions(savedView: SavedView): void {
    const modal = this.modalService.open(PermissionsDialogComponent, {
      backdrop: 'static',
@@ -134,7 +134,7 @@ export class WorkflowsComponent
    modal.componentInstance.btnClass = 'btn-danger'
    modal.componentInstance.btnCaption = $localize`Proceed`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      this.workflowService.delete(workflow).subscribe({
        next: () => {
          modal.close()
@@ -0,0 +1,89 @@
 export const DEFAULT_SAVED_VIEW_ICON = 'funnel'
 export const SAVED_VIEW_ICONS = [
  { id: 'archive', name: $localize`Archive`, icon: 'archive' },
  { id: 'bank', name: $localize`Bank`, icon: 'bank' },
  { id: 'basket', name: $localize`Basket`, icon: 'basket' },
  { id: 'bell', name: $localize`Bell`, icon: 'bell' },
  { id: 'bookmark', name: $localize`Bookmark`, icon: 'bookmark' },
  { id: 'boxes', name: $localize`Boxes`, icon: 'boxes' },
  { id: 'briefcase', name: $localize`Briefcase`, icon: 'briefcase' },
  { id: 'building', name: $localize`Building`, icon: 'building' },
  { id: 'calculator', name: $localize`Calculator`, icon: 'calculator' },
  { id: 'calendar', name: $localize`Calendar`, icon: 'calendar' },
  { id: 'camera', name: $localize`Camera`, icon: 'camera' },
  {
    id: 'card-checklist',
    name: $localize`Checklist`,
    icon: 'card-checklist',
  },
  { id: 'cash', name: $localize`Cash`, icon: 'cash' },
  { id: 'chat-left-text', name: $localize`Chat`, icon: 'chat-left-text' },
  { id: 'check-circle', name: $localize`Check`, icon: 'check-circle' },
  { id: 'clipboard', name: $localize`Clipboard`, icon: 'clipboard' },
  { id: 'clock-history', name: $localize`Clock`, icon: 'clock-history' },
  { id: 'credit-card', name: $localize`Credit card`, icon: 'credit-card' },
  { id: 'download', name: $localize`Download`, icon: 'download' },
  { id: 'envelope', name: $localize`Envelope`, icon: 'envelope' },
  {
    id: 'exclamation-triangle',
    name: $localize`Warning`,
    icon: 'exclamation-triangle',
  },
  { id: 'file-earmark', name: $localize`File`, icon: 'file-earmark' },
  {
    id: 'file-earmark-check',
    name: $localize`Checked file`,
    icon: 'file-earmark-check',
  },
  {
    id: 'file-earmark-lock',
    name: $localize`Locked file`,
    icon: 'file-earmark-lock',
  },
  {
    id: 'file-earmark-medical',
    name: $localize`Medical file`,
    icon: 'file-earmark-medical',
  },
  {
    id: 'file-earmark-person',
    name: $localize`Person file`,
    icon: 'file-earmark-person',
  },
  {
    id: 'file-earmark-spreadsheet',
    name: $localize`Spreadsheet`,
    icon: 'file-earmark-spreadsheet',
  },
  { id: 'file-text', name: $localize`Text file`, icon: 'file-text' },
  { id: 'files', name: $localize`Files`, icon: 'files' },
  { id: 'folder', name: $localize`Folder`, icon: 'folder' },
  { id: 'funnel', name: $localize`Filter`, icon: 'funnel' },
  { id: 'gear', name: $localize`Gear`, icon: 'gear' },
  { id: 'globe2', name: $localize`Globe`, icon: 'globe2' },
  { id: 'hash', name: $localize`Hash`, icon: 'hash' },
  { id: 'heart', name: $localize`Heart`, icon: 'heart' },
  { id: 'house', name: $localize`House`, icon: 'house' },
  { id: 'inbox', name: $localize`Inbox`, icon: 'inbox' },
  { id: 'journals', name: $localize`Journals`, icon: 'journals' },
  { id: 'list-task', name: $localize`Task list`, icon: 'list-task' },
  { id: 'newspaper', name: $localize`Newspaper`, icon: 'newspaper' },
  { id: 'paperclip', name: $localize`Attachment`, icon: 'paperclip' },
  { id: 'people', name: $localize`People`, icon: 'people' },
  { id: 'person', name: $localize`Person`, icon: 'person' },
  { id: 'printer', name: $localize`Printer`, icon: 'printer' },
  { id: 'receipt', name: $localize`Receipt`, icon: 'receipt' },
  { id: 'safe', name: $localize`Safe`, icon: 'safe' },
  { id: 'search', name: $localize`Search`, icon: 'search' },
  { id: 'send', name: $localize`Send`, icon: 'send' },
  { id: 'shop', name: $localize`Shop`, icon: 'shop' },
  { id: 'stack', name: $localize`Stack`, icon: 'stack' },
  { id: 'stars', name: $localize`Stars`, icon: 'stars' },
  { id: 'tag', name: $localize`Tag`, icon: 'tag' },
  { id: 'tags', name: $localize`Tags`, icon: 'tags' },
  { id: 'telephone', name: $localize`Telephone`, icon: 'telephone' },
  { id: 'truck', name: $localize`Truck`, icon: 'truck' },
  { id: 'upc-scan', name: $localize`Barcode`, icon: 'upc-scan' },
  { id: 'wallet2', name: $localize`Wallet`, icon: 'wallet2' },
 ]
@@ -5,6 +5,8 @@ import { ObjectWithPermissions } from './object-with-permissions'
 export interface SavedView extends ObjectWithPermissions {
  name?: string
  icon?: string
  show_on_dashboard?: boolean
  show_in_sidebar?: boolean
@@ -18,7 +18,7 @@ export class DirtyFormGuard extends DirtyCheckGuard {
    modal.componentInstance.btnClass = 'btn-warning'
    modal.componentInstance.btnCaption = $localize`Leave page`
    modal.componentInstance.confirmClicked.subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      modal.close()
    })
    const subject = new Subject<boolean>()
@@ -36,12 +36,12 @@ export class DirtySavedViewGuard {
    modal.componentInstance.alternativeBtnClass = 'btn-primary'
    modal.componentInstance.alternativeBtnCaption = $localize`Save and close`
    modal.componentInstance.alternativeClicked.pipe(first()).subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      component.saveViewConfig()
      modal.close()
    })
    modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-      modal.componentInstance.buttonsEnabled = false
+      modal.componentInstance.buttonsEnabled.set(false)
      modal.close()
    })
@@ -142,7 +142,7 @@ export class OpenDocumentsService {
      modal.componentInstance.btnClass = 'btn-warning'
      modal.componentInstance.btnCaption = $localize`Close document`
      modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        modal.close()
        this.openDocuments.splice(index, 1)
        this.dirtyDocuments.delete(doc.id)
@@ -165,7 +165,7 @@ export class OpenDocumentsService {
      modal.componentInstance.btnClass = 'btn-warning'
      modal.componentInstance.btnCaption = $localize`Close documents`
      modal.componentInstance.confirmClicked.pipe(first()).subscribe(() => {
-        modal.componentInstance.buttonsEnabled = false
+        modal.componentInstance.buttonsEnabled.set(false)
        modal.close()
        this.openDocuments.splice(0, this.openDocuments.length)
        this.dirtyDocuments.clear()
@@ -120,6 +120,12 @@ describe('PermissionsService', () => {
      actionKey: 'View', // PermissionAction.View
      typeKey: 'SystemMonitoring', // PermissionType.SystemMonitoring
    })
    expect(permissionsService.getPermissionKeys('add_sharelinkbundle')).toEqual(
      {
        actionKey: 'Add', // PermissionAction.Add
        typeKey: 'ShareLinkBundle', // PermissionType.ShareLinkBundle
      }
    )
  })
  it('correctly checks explicit global permissions', () => {
@@ -269,6 +275,10 @@ describe('PermissionsService', () => {
        'view_sharelink',
        'change_sharelink',
        'delete_sharelink',
        'add_sharelinkbundle',
        'view_sharelinkbundle',
        'change_sharelinkbundle',
        'delete_sharelinkbundle',
        'add_workflow',
        'view_workflow',
        'change_workflow',
@@ -26,6 +26,7 @@ export enum PermissionType {
  User = '%s_user',
  Group = '%s_group',
  ShareLink = '%s_sharelink',
  ShareLinkBundle = '%s_sharelinkbundle',
  CustomField = '%s_customfield',
  Workflow = '%s_workflow',
  ProcessedMail = '%s_processedmail',
@@ -57,6 +57,19 @@ describe('LocalizedDateParserFormatter', () => {
    expect(val).toEqual({ day: 4, month: 5, year: 2023 })
  })
  it('should parse yyyy-mm-dd input with unpadded month or day by locale', () => {
    let val = dateParserFormatter.parse('2023-5-4')
    expect(val).toEqual({ day: 4, month: 5, year: 2023 })
    settingsService.setLanguage('de-de') // dd.mm.yyyy
    val = dateParserFormatter.parse('2023-5-4')
    expect(val).toEqual({ day: 4, month: 5, year: 2023 })
    settingsService.setLanguage('tr-tr') // yyyy-mm-dd
    val = dateParserFormatter.parse('2023-5-4')
    expect(val).toEqual({ day: 4, month: 5, year: 2023 })
  })
  it('should parse date struct to string by locale', () => {
    const dateStruct = {
      day: 4,
@@ -52,15 +52,11 @@ export class LocalizedDateParserFormatter extends NgbDateParserFormatter {
      let segments = value.split(this.separatorRegExp)
      // always accept strict yyyy*mm*dd format even if that's not the input format since we can be certain its not yyyy*dd*mm
-      if (
+      if (segments.length == 3 && segments[0].length == 4) {
        value.length == 10 &&
        segments.length == 3 &&
        segments[0].length == 4
      ) {
        return inputFormat
          .replace('yyyy', segments[0])
-          .replace('mm', segments[1])
+          .replace('mm', segments[1].padStart(2, '0'))
-          .replace('dd', segments[2])
+          .replace('dd', segments[2].padStart(2, '0'))
      } else {
        // otherwise pad & re-join without separator
        value = segments.map((segment) => segment.padStart(2, '0')).join('')
@@ -35,19 +35,27 @@ import {
  arrowRightShort,
  arrowUpRight,
  asterisk,
  bank,
  basket,
  bell,
  bodyText,
  bookmark,
  boxArrowUp,
  boxArrowUpRight,
  boxes,
  braces,
  briefcase,
  building,
  calculator,
  calendar,
  calendarEvent,
  calendarEventFill,
  camera,
  cardChecklist,
  cardHeading,
  caretDown,
  caretUp,
  cash,
  chatLeftText,
  chatSquareDots,
  check,
@@ -65,6 +73,7 @@ import {
  clipboardCheckFill,
  clipboardFill,
  clockHistory,
  creditCard,
  dash,
  dashCircle,
  diagram3,
@@ -83,9 +92,12 @@ import {
  fileEarmarkDiff,
  fileEarmarkFill,
  fileEarmarkLock,
  fileEarmarkMedical,
  fileEarmarkMinus,
  fileEarmarkPerson,
  fileEarmarkPlus,
  fileEarmarkRichtext,
  fileEarmarkSpreadsheet,
  fileText,
  files,
  filter,
@@ -93,12 +105,15 @@ import {
  folderFill,
  funnel,
  gear,
  globe2,
  google,
  grid,
  gripVertical,
  hash,
  hddStack,
  heart,
  house,
  inbox,
  infoCircle,
  journals,
  link,
@@ -106,7 +121,9 @@ import {
  listTask,
  listUl,
  microsoft,
  newspaper,
  nodePlus,
  paperclip,
  pencil,
  people,
  peopleFill,
@@ -121,9 +138,12 @@ import {
  plusCircle,
  printer,
  questionCircle,
  receipt,
  safe,
  scissors,
  search,
  send,
  shop,
  slashCircle,
  sliders2Vertical,
  sortAlphaDown,
@@ -133,14 +153,17 @@ import {
  tag,
  tagFill,
  tags,
  telephone,
  textIndentLeft,
  textLeft,
  threeDots,
  threeDotsVertical,
  trash,
  truck,
  uiRadios,
  unlock,
  upcScan,
  wallet2,
  windowStack,
  x,
  xCircle,
@@ -258,15 +281,22 @@ const icons = {
  arrowRightShort,
  arrowUpRight,
  asterisk,
  bank,
  basket,
  bell,
  braces,
  bodyText,
  bookmark,
  boxArrowUp,
  boxArrowUpRight,
  boxes,
  briefcase,
  building,
  calculator,
  calendar,
  calendarEvent,
  calendarEventFill,
  camera,
  cardChecklist,
  cardHeading,
  caretDown,
@@ -288,6 +318,8 @@ const icons = {
  clipboardCheckFill,
  clipboardFill,
  clockHistory,
  cash,
  creditCard,
  dash,
  dashCircle,
  diagram3,
@@ -306,9 +338,12 @@ const icons = {
  fileEarmarkDiff,
  fileEarmarkFill,
  fileEarmarkLock,
  fileEarmarkMedical,
  fileEarmarkMinus,
  fileEarmarkPerson,
  fileEarmarkPlus,
  fileEarmarkRichtext,
  fileEarmarkSpreadsheet,
  files,
  fileText,
  filter,
@@ -316,12 +351,15 @@ const icons = {
  folderFill,
  funnel,
  gear,
  globe2,
  google,
  grid,
  gripVertical,
  hash,
  hddStack,
  heart,
  house,
  inbox,
  infoCircle,
  journals,
  link,
@@ -329,8 +367,10 @@ const icons = {
  listTask,
  listUl,
  microsoft,
  newspaper,
  nodePlus,
  pencil,
  paperclip,
  people,
  peopleFill,
  person,
@@ -344,10 +384,13 @@ const icons = {
  plusCircle,
  printer,
  questionCircle,
  receipt,
  safe,
  scissors,
  search,
  send,
  slashCircle,
  shop,
  sliders2Vertical,
  sortAlphaDown,
  sortAlphaUpAlt,
@@ -358,12 +401,15 @@ const icons = {
  tags,
  textIndentLeft,
  textLeft,
  telephone,
  threeDots,
  threeDotsVertical,
  trash,
  truck,
  uiRadios,
  unlock,
  upcScan,
  wallet2,
  windowStack,
  x,
  xCircle,
@@ -19,6 +19,13 @@ export const GlobalWorkerOptions = {
  workerSrc: '',
 }
 export const AnnotationMode = {
  DISABLE: 0,
  ENABLE: 1,
  ENABLE_FORMS: 2,
  ENABLE_STORAGE: 3,
 }
 export const getDocument = (_src: unknown): PDFDocumentLoadingTask => {
  return new PDFDocumentLoadingTask(Promise.resolve(new PDFDocumentProxy()))
 }
@@ -0,0 +1,106 @@
 from __future__ import annotations
 import importlib
 import zipfile
 # ZIP_ZSTANDARD exists only on Python 3.14+ (PEP 784). None elsewhere.
 ZSTD: int | None = getattr(zipfile, "ZIP_ZSTANDARD", None)
 # CLI choices are fixed across runtimes so argparse never hides zstd; runtime
 # availability is enforced separately in compression_available().
 COMPRESSION_CHOICES: tuple[str, ...] = (
    "stored",
    "deflated",
    "bzip2",
    "lzma",
    "zstd",
 )
 # Method name -> zipfile compression constant (zstd only when supported).
 COMPRESSION_METHODS: dict[str, int] = {
    "stored": zipfile.ZIP_STORED,
    "deflated": zipfile.ZIP_DEFLATED,
    "bzip2": zipfile.ZIP_BZIP2,
    "lzma": zipfile.ZIP_LZMA,
 }
 if ZSTD is not None:
    COMPRESSION_METHODS["zstd"] = ZSTD
 # Inclusive (min, max) level bounds per method; None => level not applicable.
 # Verified on CPython 3.14.3.
 #
 # zstd's raw library bounds are (-131072, 22)
 # (compression.zstd.CompressionParameter.compression_level.bounds()) — the
 # minimum is an internal implementation constant (-ZSTD_TARGETLENGTH_MAX),
 # not a meaningful distinct "level"; deeper negative values than -22 buy
 # nothing over -22 in practice. We expose the conventional zstd CLI range
 # instead of the raw library bounds.
 LEVEL_BOUNDS: dict[str, tuple[int, int] | None] = {
    "stored": None,
    "deflated": (0, 9),
    "bzip2": (1, 9),
    "lzma": None,
    "zstd": (-22, 22),
 }
 # zipfile compress_type id -> method name.
 _COMPRESS_TYPE_TO_METHOD: dict[int, str] = {
    zipfile.ZIP_STORED: "stored",
    zipfile.ZIP_DEFLATED: "deflated",
    zipfile.ZIP_BZIP2: "bzip2",
    zipfile.ZIP_LZMA: "lzma",
    93: "zstd",
 }
 def compression_available(method: str) -> bool:
    """Whether the running interpreter can actually use the given method."""
    if method in ("stored", "deflated"):
        # zlib is a hard CPython dependency; stored needs nothing.
        return True
    if method == "bzip2":
        return _module_importable("bz2")
    if method == "lzma":
        return _module_importable("lzma")
    if method == "zstd":
        return ZSTD is not None and _module_importable("compression.zstd")
    return False  # pragma: no cover -- method is always one of COMPRESSION_CHOICES
 def _module_importable(name: str) -> bool:
    try:
        importlib.import_module(name)
    except ImportError:
        return False
    return True
 def level_error(method: str, level: int | None) -> str | None:
    """Return a human message if (method, level) is invalid, else None."""
    if level is None:
        return None
    bounds = LEVEL_BOUNDS[method]
    if bounds is None:
        return f"--zip-compression-level has no effect for '{method}'"
    low, high = bounds
    if not (low <= level <= high):
        return (
            f"--zip-compression-level for '{method}' must be between {low} and {high}"
        )
    return None
 def compress_type_readable(compress_type: int) -> bool:
    """Whether this interpreter can decompress an entry of the given type."""
    method = _COMPRESS_TYPE_TO_METHOD.get(compress_type)
    if method is None:
        return False
    return compression_available(method)
 def unreadable_method_names(compress_types: set[int]) -> set[str]:
    """Map a set of compress_type ids to human method names for error messages."""
    names: set[str] = set()
    for ct in compress_types:
        names.add(_COMPRESS_TYPE_TO_METHOD.get(ct, f"method {ct}"))
    return names
@@ -0,0 +1,357 @@
 from __future__ import annotations
 import abc
 import hashlib
 import json
 import os
 import shutil
 import tempfile
 import zipfile
 from contextlib import AbstractContextManager
 from contextlib import contextmanager
 from pathlib import Path
 from pathlib import PurePosixPath
 from typing import TYPE_CHECKING
 from django.conf import settings
 from django.core.serializers.json import DjangoJSONEncoder
 from documents.file_handling import delete_empty_directories
 from documents.utils import compute_checksum
 from documents.utils import copy_file_with_basic_stats
 if TYPE_CHECKING:
    from collections.abc import Iterator
    from typing import TextIO
 def _dumps(content: list | dict) -> str:
    """Serialize export JSON consistently across all sinks."""
    return json.dumps(content, cls=DjangoJSONEncoder, indent=2, ensure_ascii=False)
 class StreamingManifestWriter:
    """Incrementally writes a JSON array to a text handle, one record at a time.
    Knows nothing about folders or zips: it writes the array framing and records
    to whatever handle the sink's ``stream()`` yields. The sink owns the handle's
    lifecycle (atomic rename, compare, spooling).
    """
    def __init__(self, handle: TextIO) -> None:
        self._file = handle
        self._first = True
        self._file.write("[")
    def write_record(self, record: dict) -> None:
        if not self._first:
            self._file.write(",\n")
        else:
            self._first = False
        self._file.write(_dumps(record))
    def write_batch(self, records: list[dict]) -> None:
        for record in records:
            self.write_record(record)
    def close(self) -> None:
        """Write the closing bracket. Does NOT close the handle (the sink owns it)."""
        self._file.write("\n]")
 class ExportSink(AbstractContextManager, abc.ABC):
    """Destination for a document export.
    The command declares export contents via three verbs; the sink decides how to
    persist each. ``arcname`` is always a relative POSIX path
    (e.g. ``"manifest.json"``, ``"originals/foo.pdf"``).
    Contract:
      * At most one ``stream()`` open at a time (it is the manifest);
        ``add_file``/``add_json`` may be called while it is open.
      * Context-manager: normal exit finalizes, an exception aborts. No partial or
        failed run leaves a complete-looking artifact.
    """
    @abc.abstractmethod
    def add_file(
        self,
        source: Path,
        arcname: str,
        *,
        checksum: str | None = None,
    ) -> None: ...
    @abc.abstractmethod
    def add_json(self, content: list | dict, arcname: str) -> None: ...
    @abc.abstractmethod
    def stream(self, arcname: str) -> AbstractContextManager[TextIO]: ...
    def _open(self) -> None:
        """Hook called on context entry. Override as needed."""
    @abc.abstractmethod
    def _finalize(self) -> None:
        """Commit on clean exit."""
    @abc.abstractmethod
    def _abort(self) -> None:
        """Roll back on exception."""
    def __enter__(self) -> ExportSink:
        self._open()
        return self
    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
        if exc_type is not None:
            self._abort()
        else:
            self._finalize()
 class DirectoryExportSink(ExportSink):
    """Writes loose files into a target directory, with incremental sync.
    Owns the snapshot/skip/compare/prune machinery that used to live in the
    command (``files_in_export_dir``, ``check_and_copy``, ``check_and_write_json``,
    and the ``--delete`` pass).
    """
    def __init__(
        self,
        target: Path,
        *,
        compare_checksums: bool,
        compare_json: bool,
        delete: bool,
    ) -> None:
        self._target = target.resolve()
        self._compare_checksums = compare_checksums
        self._compare_json = compare_json
        self._delete = delete
        self._snapshot: set[Path] = set()
        self._stream_open = False
    def _open(self) -> None:
        for x in self._target.glob("**/*"):
            if x.is_file():
                self._snapshot.add(x.resolve())
    def add_file(
        self,
        source: Path,
        arcname: str,
        *,
        checksum: str | None = None,
    ) -> None:
        target = (self._target / arcname).resolve()
        self._snapshot.discard(target)
        perform_copy = False
        if target.exists():
            source_stat = source.stat()
            target_stat = target.stat()
            if self._compare_checksums and checksum:
                perform_copy = compute_checksum(target) != checksum
            elif (
                source_stat.st_mtime != target_stat.st_mtime
                or source_stat.st_size != target_stat.st_size
            ):
                perform_copy = True
        else:
            perform_copy = True
        if perform_copy:
            target.parent.mkdir(parents=True, exist_ok=True)
            copy_file_with_basic_stats(source, target)
    @staticmethod
    def _content_unchanged(target: Path, new_bytes: bytes) -> bool:
        """True if ``target`` already holds byte-identical content (BLAKE2b)."""
        return (
            hashlib.blake2b(target.read_bytes()).hexdigest()
            == hashlib.blake2b(new_bytes).hexdigest()
        )
    def add_json(self, content: list | dict, arcname: str) -> None:
        target = (self._target / arcname).resolve()
        json_str = _dumps(content)
        perform_write = True
        if target in self._snapshot:
            self._snapshot.discard(target)
            if self._compare_json and self._content_unchanged(
                target,
                json_str.encode("utf-8"),
            ):
                perform_write = False
        if perform_write:
            target.parent.mkdir(parents=True, exist_ok=True)
            target.write_text(json_str, encoding="utf-8")
    @contextmanager
    def stream(self, arcname: str) -> Iterator[TextIO]:
        if self._stream_open:
            raise RuntimeError("A stream is already open on this sink")
        target = (self._target / arcname).resolve()
        tmp = target.with_suffix(target.suffix + ".tmp")
        target.parent.mkdir(parents=True, exist_ok=True)
        handle = tmp.open("w", encoding="utf-8")
        self._stream_open = True
        try:
            yield handle
        except BaseException:
            handle.close()
            tmp.unlink(missing_ok=True)
            raise
        else:
            handle.close()
            self._commit_streamed_file(target, tmp)
        finally:
            self._stream_open = False
    def _commit_streamed_file(self, target: Path, tmp: Path) -> None:
        if target in self._snapshot:
            self._snapshot.discard(target)
            if self._compare_json and self._content_unchanged(
                target,
                tmp.read_bytes(),
            ):
                tmp.unlink()
                return
        tmp.rename(target)
    def _finalize(self) -> None:
        if self._delete:
            for f in self._snapshot:
                if not f.is_relative_to(self._target):  # pragma: no cover
                    # Defense in depth: a symlink inside the export dir can
                    # resolve outside of it; never delete outside the target.
                    continue
                f.unlink()
                delete_empty_directories(f.parent, self._target)
    def _abort(self) -> None:
        # Folder mode is in-place/incremental: streamed .tmp files are already
        # cleaned in stream(); leave everything else intact and skip the prune.
        return None
 class ZipExportSink(ExportSink):
    """Writes a single zip archive, produced atomically only on success.
    Builds into ``<target>/<zip_name>.zip.tmp`` and renames to ``.zip`` on clean
    finalize. The manifest stream is spooled to a temp file in SCRATCH_DIR and
    added as an entry at finalize (a zip entry cannot be interleaved with others).
    """
    def __init__(
        self,
        target: Path,
        zip_name: str,
        *,
        delete: bool = False,
        compression: int = zipfile.ZIP_DEFLATED,
        compresslevel: int | None = None,
    ) -> None:
        self._target = target.resolve()
        self._zip_path = (self._target / zip_name).with_suffix(".zip")
        self._tmp_path = self._zip_path.with_name(self._zip_path.name + ".tmp")
        self._delete = delete
        self._compression = compression
        self._compresslevel = compresslevel
        self._zip: zipfile.ZipFile | None = None
        self._dirs: set[str] = set()
        self._pending_manifest: tuple[Path, str] | None = None
        self._stream_open = False
    def _open(self) -> None:
        settings.SCRATCH_DIR.mkdir(parents=True, exist_ok=True)
        self._zip = zipfile.ZipFile(
            self._tmp_path,
            "w",
            compression=self._compression,
            compresslevel=self._compresslevel,
            allowZip64=True,
        )
    def _ensure_dirs(self, arcname: str) -> None:
        assert self._zip is not None
        dir_arc = ""
        for part in PurePosixPath(arcname).parts[:-1]:
            dir_arc += f"{part}/"
            if dir_arc not in self._dirs:
                self._dirs.add(dir_arc)
                self._zip.mkdir(dir_arc)
    def add_file(
        self,
        source: Path,
        arcname: str,
        *,
        checksum: str | None = None,
    ) -> None:
        assert self._zip is not None
        self._ensure_dirs(arcname)
        self._zip.write(source, arcname=arcname)
    def add_json(self, content: list | dict, arcname: str) -> None:
        assert self._zip is not None
        self._ensure_dirs(arcname)
        self._zip.writestr(arcname, _dumps(content))
    @contextmanager
    def stream(self, arcname: str) -> Iterator[TextIO]:
        if self._stream_open:
            raise RuntimeError("A stream is already open on this sink")
        settings.SCRATCH_DIR.mkdir(parents=True, exist_ok=True)
        fd, tmp_name = tempfile.mkstemp(
            dir=settings.SCRATCH_DIR,
            prefix="export-manifest-",
            suffix=".json",
        )
        tmp = Path(tmp_name)
        handle = os.fdopen(fd, "w", encoding="utf-8")
        self._stream_open = True
        try:
            yield handle
        except BaseException:
            handle.close()
            tmp.unlink(missing_ok=True)
            raise
        else:
            handle.close()
            self._pending_manifest = (tmp, arcname)
        finally:
            self._stream_open = False
    def _finalize(self) -> None:
        assert self._zip is not None
        if self._pending_manifest is not None:
            tmp, arcname = self._pending_manifest
            self._ensure_dirs(arcname)
            self._zip.write(tmp, arcname=arcname)
            tmp.unlink(missing_ok=True)
            self._pending_manifest = None
        self._zip.close()
        self._zip = None
        if self._delete:
            self._wipe_destination()
        self._tmp_path.replace(self._zip_path)
    def _wipe_destination(self) -> None:
        skip = {self._zip_path.resolve(), self._tmp_path.resolve()}
        for item in self._target.glob("*"):
            if item.resolve() in skip:
                continue
            if item.is_dir():
                shutil.rmtree(item)
            else:
                item.unlink()
    def _abort(self) -> None:
        if self._zip is not None:
            self._zip.close()
            self._zip = None
        self._tmp_path.unlink(missing_ok=True)
        if self._pending_manifest is not None:
            self._pending_manifest[0].unlink(missing_ok=True)
            self._pending_manifest = None
@@ -39,7 +39,6 @@ from guardian.utils import get_user_obj_perms_model
 from rest_framework import serializers
 from rest_framework.filters import BaseFilterBackend
 from rest_framework.filters import OrderingFilter
 from rest_framework_guardian.filters import ObjectPermissionsFilter
 from documents.models import Correspondent
 from documents.models import CustomField
@@ -51,7 +50,7 @@ from documents.models import ShareLink
 from documents.models import ShareLinkBundle
 from documents.models import StoragePath
 from documents.models import Tag
-from documents.permissions import permitted_document_ids
+from documents.permissions import permitted_object_ids
 if TYPE_CHECKING:
    from collections.abc import Callable
@@ -725,9 +724,13 @@ class CustomFieldQueryParser:
            )
        # First we look up reverse links from the requested documents.
        # Scoped to this specific field (not just any document link field) and
        # excluding unset instances, which have a null value_document_ids and
        # are equivalent to having no reverse link at all.
        links = CustomFieldInstance.objects.filter(
            document_id__in=value,
-            field__data_type=CustomField.FieldDataType.DOCUMENTLINK,
+            field=custom_field,
            value_document_ids__isnull=False,
        )
        # Check if any of the requested IDs are missing.
@@ -1024,59 +1027,41 @@ class PaperlessTaskFilterSet(FilterSet):
        return queryset.exclude(status__in=PaperlessTask.COMPLETE_STATUSES)
-class ObjectOwnedOrGrantedPermissionsFilter(ObjectPermissionsFilter):
+class PermittedObjectsFilter(BaseFilterBackend):
    """
-    A filter backend that limits results to those where the requesting user
+    Filters a queryset down to objects the requesting user owns, are
-    has read object level permissions, owns the objects, or objects without
+    unowned, or (when ``include_granted`` is True) has an explicit
-    an owner (for backwards compat)
+    user/group guardian permission on. Backed by ``permitted_object_ids``
    -- a single ``id__in`` subquery, not a join -- so it can't produce
    duplicate rows even when the base queryset already carries independent
    joins (e.g. multi-value ``tags__id__all`` filtering), and stays
    index-friendly at scale instead of falling back to guardian's
    varchar-cast join.
    Set ``include_granted = False`` on a subclass for endpoints that
    intentionally only show owned/unowned objects regardless of explicit
    shares (e.g. ``TrashView``).
    """
    include_granted: bool = True
    perm_codename: str | None = None
    def filter_queryset(self, request, queryset, view):
        # Before the superuser and owner-only paths, neither of which consults
        # permitted_object_ids. Scoped to authenticated users so anonymous
        # access (AnonymousUser.is_active is False) keeps its existing
        # unowned-only behaviour.
        if request.user.is_authenticated and not request.user.is_active:
            return queryset.none()
        if request.user.is_superuser:
            return queryset
-        objects_with_perms = super().filter_queryset(request, queryset, view)
+        if not self.include_granted:
-        objects_owned = queryset.filter(owner=request.user)
+            return queryset.filter(Q(owner=request.user) | Q(owner__isnull=True))
-        objects_unowned = queryset.filter(owner__isnull=True)
+        model = queryset.model
-        return objects_with_perms | objects_owned | objects_unowned
+        perm = self.perm_codename or f"view_{model._meta.model_name}"
-
+        return queryset.filter(
-
+            id__in=permitted_object_ids(request.user, model, perm),
-class DocumentPermissionsFilter(BaseFilterBackend):
+        )
    """
    A filter backend limiting Document results to those the requesting user
    owns, are unowned, or has explicit (user- or group-level) view
    permission on.
    Unlike ``ObjectOwnedOrGrantedPermissionsFilter``, this does not build an
    ``objects_with_perms | objects_owned | objects_unowned`` union of
    querysets derived from the same base queryset. When that base queryset
    already carries independent joins on a multi-valued relation (e.g. two
    separate joins from ``tags__id__all`` filtering on two tags), each
    OR-ed branch can end up pairing those joins' aliases differently,
    letting more than one row out of the join's cross product satisfy the
    combined WHERE -- returning the same document more than once. Filtering
    via a single ``id__in`` against ``permitted_document_ids`` (a plain
    subquery, not a join) sidesteps that entirely and is also cheaper than
    guardian's join-based permission check.
    """
    def filter_queryset(self, request, queryset, view):
        if request.user.is_superuser:
            return queryset
        return queryset.filter(id__in=permitted_document_ids(request.user))
 class ObjectOwnedPermissionsFilter(ObjectPermissionsFilter):
    """
    A filter backend that limits results to those where the requesting user
    owns the objects or objects without an owner (for backwards compat)
    """
    def filter_queryset(self, request, queryset, view):
        if request.user.is_superuser:
            return queryset
        objects_owned = queryset.filter(owner=request.user)
        objects_unowned = queryset.filter(owner__isnull=True)
        return objects_owned | objects_unowned
 class DocumentsOrderingFilter(OrderingFilter):
@@ -632,8 +632,20 @@ class Command(BaseCommand):
                    # Process each change
                    for change_type, path in changes:
                        path = Path(path).resolve()
                        if change_type == Change.deleted:
                            # Consumed (or otherwise removed); a later file
                            # reusing this name must not be skipped as
                            # already-queued.
                            queued.discard(path)
                        if not path.is_file():
                            continue
                        if path in queued:
                            # Already queued and awaiting consumption; a stray
                            # event (NAS metadata touch, AV scan, etc.) while
                            # the file sits on disk mid-consumption must not
                            # cause it to be queued a second time (GH #13511).
                            logger.debug(f"Ignoring event for queued file: {path}")
                            continue
                        logger.debug(f"Event: {change_type.name} for {path}")
                        tracker.track(path, change_type)
@@ -1,8 +1,4 @@
 import hashlib
 import json
 import os
 import shutil
 import tempfile
 from itertools import islice
 from pathlib import Path
 from typing import TYPE_CHECKING
@@ -19,7 +15,6 @@ from django.contrib.auth.models import User
 from django.contrib.contenttypes.models import ContentType
 from django.core import serializers
 from django.core.management.base import CommandError
 from django.core.serializers.json import DjangoJSONEncoder
 from django.db import transaction
 from django.utils import timezone
 from filelock import FileLock
@@ -34,7 +29,15 @@ if TYPE_CHECKING:
 if settings.AUDIT_LOG_ENABLED:
    from auditlog.models import LogEntry
-from documents.file_handling import delete_empty_directories
+from documents.export.compression import COMPRESSION_CHOICES
 from documents.export.compression import COMPRESSION_METHODS
 from documents.export.compression import ZSTD
 from documents.export.compression import compression_available
 from documents.export.compression import level_error
 from documents.export.sinks import DirectoryExportSink
 from documents.export.sinks import ExportSink
 from documents.export.sinks import StreamingManifestWriter
 from documents.export.sinks import ZipExportSink
 from documents.file_handling import generate_filename
 from documents.management.commands.base import PaperlessCommand
 from documents.management.commands.mixins import CryptMixin
@@ -60,8 +63,7 @@ from documents.settings import EXPORTER_ARCHIVE_NAME
 from documents.settings import EXPORTER_FILE_NAME
 from documents.settings import EXPORTER_SHARE_LINK_BUNDLE_NAME
 from documents.settings import EXPORTER_THUMBNAIL_NAME
-from documents.utils import compute_checksum
+from documents.utils import QuerySetStream
 from documents.utils import copy_file_with_basic_stats
 from paperless import version
 from paperless.models import ApplicationConfiguration
 from paperless_mail.models import MailAccount
@@ -84,87 +86,6 @@ def serialize_queryset_batched(
        yield serializers.serialize("python", chunk)
 class StreamingManifestWriter:
    """Incrementally writes a JSON array to a file, one record at a time.
    Writes to <target>.tmp first; on close(), optionally BLAKE2b-compares
    with the existing file (--compare-json) and renames or discards accordingly.
    On exception, discard() deletes the tmp file and leaves the original intact.
    """
    def __init__(
        self,
        path: Path,
        *,
        compare_json: bool = False,
        files_in_export_dir: "set[Path] | None" = None,
    ) -> None:
        self._path = path.resolve()
        self._tmp_path = self._path.with_suffix(self._path.suffix + ".tmp")
        self._compare_json = compare_json
        self._files_in_export_dir: set[Path] = (
            files_in_export_dir if files_in_export_dir is not None else set()
        )
        self._file = None
        self._first = True
    def open(self) -> None:
        self._path.parent.mkdir(parents=True, exist_ok=True)
        self._file = self._tmp_path.open("w", encoding="utf-8")
        self._file.write("[")
        self._first = True
    def write_record(self, record: dict) -> None:
        if not self._first:
            self._file.write(",\n")
        else:
            self._first = False
        self._file.write(
            json.dumps(record, cls=DjangoJSONEncoder, indent=2, ensure_ascii=False),
        )
    def write_batch(self, records: list[dict]) -> None:
        for record in records:
            self.write_record(record)
    def close(self) -> None:
        if self._file is None:
            return
        self._file.write("\n]")
        self._file.close()
        self._file = None
        self._finalize()
    def discard(self) -> None:
        if self._file is not None:
            self._file.close()
            self._file = None
        if self._tmp_path.exists():
            self._tmp_path.unlink()
    def _finalize(self) -> None:
        """Compare with existing file (if --compare-json) then rename or discard tmp."""
        if self._path in self._files_in_export_dir:
            self._files_in_export_dir.remove(self._path)
            if self._compare_json:
                existing_hash = hashlib.blake2b(self._path.read_bytes()).hexdigest()
                new_hash = hashlib.blake2b(self._tmp_path.read_bytes()).hexdigest()
                if existing_hash == new_hash:
                    self._tmp_path.unlink()
                    return
        self._tmp_path.rename(self._path)
    def __enter__(self) -> "StreamingManifestWriter":
        self.open()
        return self
    def __exit__(self, exc_type, exc_val, exc_tb) -> None:
        if exc_type is not None:
            self.discard()
        else:
            self.close()
 class Command(CryptMixin, PaperlessCommand):
    help = (
        "Decrypt and rename all files in our collection into a given target "
@@ -276,6 +197,28 @@ class Command(CryptMixin, PaperlessCommand):
            help="Sets the export zip file name",
        )
        parser.add_argument(
            "--zip-compression",
            choices=COMPRESSION_CHOICES,
            default=None,
            help=(
                "Compression method for the export zip (requires --zip). "
                "Default: deflated. 'zstd' requires Python 3.14+ on both the "
                "exporting and importing machine."
            ),
        )
        parser.add_argument(
            "--zip-compression-level",
            type=int,
            default=None,
            help=(
                "Compression level for the export zip (requires --zip). "
                "deflated: 0-9, bzip2: 1-9, zstd: -22..22; ignored for "
                "stored/lzma."
            ),
        )
        parser.add_argument(
            "--data-only",
            default=False,
@@ -314,20 +257,13 @@ class Command(CryptMixin, PaperlessCommand):
        self.passphrase: str | None = options.get("passphrase")
        self.batch_size: int = options["batch_size"]
        self.files_in_export_dir: set[Path] = set()
        self.exported_files: set[str] = set()
-        # If zipping, save the original target for later and
+        if self.zip_export and (self.compare_checksums or self.compare_json):
-        # get a temporary directory for the target instead
+            raise CommandError(
-        temp_dir = None
+                "--compare-checksums and --compare-json have no effect when "
-        self.original_target = self.target
+                "used with --zip",
        if self.zip_export:
            settings.SCRATCH_DIR.mkdir(parents=True, exist_ok=True)
            temp_dir = tempfile.TemporaryDirectory(
                dir=settings.SCRATCH_DIR,
                prefix="paperless-export",
            )
            self.target = Path(temp_dir.name).resolve()
        if not self.target.exists():
            raise CommandError("That path doesn't exist")
@@ -338,33 +274,55 @@ class Command(CryptMixin, PaperlessCommand):
        if not os.access(self.target, os.W_OK):
            raise CommandError("That path doesn't appear to be writable")
-        try:
+        zip_compression: str | None = options["zip_compression"]
-            # Prevent any ongoing changes in the documents
+        zip_compression_level: int | None = options["zip_compression_level"]
            with FileLock(settings.MEDIA_LOCK):
                self.dump()
-                # We've written everything to the temporary directory in this case,
+        if not self.zip_export and (
-                # now make an archive in the original target, with all files stored
+            zip_compression is not None or zip_compression_level is not None
-                if self.zip_export and temp_dir is not None:
+        ):
-                    shutil.make_archive(
+            raise CommandError(
-                        self.original_target / options["zip_name"],
+                "--zip-compression and --zip-compression-level require --zip",
-                        format="zip",
+            )
-                        root_dir=temp_dir.name,
+
        compression_method = zip_compression or "deflated"
        if self.zip_export:
            if not compression_available(compression_method):
                if compression_method == "zstd" and ZSTD is None:
                    raise CommandError(
                        "zstd compression requires Python 3.14 or newer",
                    )
                raise CommandError(
                    f"Compression method '{compression_method}' is not "
                    f"available on this Python runtime",
                )
            level_msg = level_error(compression_method, zip_compression_level)
            if level_msg is not None:
                raise CommandError(level_msg)
-        finally:
+        sink: ExportSink
-            # Always cleanup the temporary directory, if one was created
+        if self.zip_export:
-            if self.zip_export and temp_dir is not None:
+            sink = ZipExportSink(
-                temp_dir.cleanup()
+                self.target,
                options["zip_name"],
                delete=self.delete,
                compression=COMPRESSION_METHODS[compression_method],
                compresslevel=zip_compression_level,
            )
        else:
            sink = DirectoryExportSink(
                self.target,
                compare_checksums=self.compare_checksums,
                compare_json=self.compare_json,
                delete=self.delete,
            )
-    def dump(self) -> None:
+        # Prevent any ongoing changes in the documents while exporting
-        # 1. Take a snapshot of what files exist in the current export folder
+        with FileLock(settings.MEDIA_LOCK), sink:
-        for x in self.target.glob("**/*"):
+            self.dump(sink)
            if x.is_file():
                self.files_in_export_dir.add(x.resolve())
-        # 2. Create manifest, containing all correspondents, types, tags, storage paths
+    def dump(self, sink: ExportSink) -> None:
-        # note, documents and ui_settings
+        # 1. Create manifest, containing all correspondents, types, tags, storage
        #    paths, note, documents and ui_settings
        _excluded_usernames = ["consumer", "AnonymousUser"]
        manifest_key_to_object_query: dict[str, QuerySet[Any]] = {
            "correspondents": Correspondent.objects.all(),
@@ -427,13 +385,9 @@ class Command(CryptMixin, PaperlessCommand):
        document_manifest: list[dict] = []
        share_link_bundle_manifest: list[dict] = []
        manifest_path = (self.target / "manifest.json").resolve()
-        with StreamingManifestWriter(
+        with sink.stream("manifest.json") as handle:
-            manifest_path,
+            writer = StreamingManifestWriter(handle)
            compare_json=self.compare_json,
            files_in_export_dir=self.files_in_export_dir,
        ) as writer:
            with transaction.atomic():
                for key, qs in manifest_key_to_object_query.items():
                    if key == "documents":
@@ -469,9 +423,6 @@ class Command(CryptMixin, PaperlessCommand):
                                self._encrypt_record_inline(record)
                            writer.write_batch(batch)
            document_map: dict[int, Document] = {
                d.pk: d for d in Document.global_objects.order_by("id")
            }
            share_link_bundle_map: dict[int, ShareLinkBundle] = {
                b.pk: b
                for b in ShareLinkBundle.objects.order_by("id").prefetch_related(
@@ -479,84 +430,72 @@ class Command(CryptMixin, PaperlessCommand):
                )
            }
-            # 3. Export files from each document
+            # 2. Export files from each document
-            for index, document_dict in enumerate(
+            # document_manifest and this stream are both ordered by id from the
-                self.track(
+            # same underlying rows, so zip them in lockstep instead of building
-                    document_manifest,
+            # a dict of every Document instance up front (QuerySetStream keeps
-                    description="Exporting documents...",
+            # only one batch of documents resident at a time).
-                    total=len(document_manifest),
+            documents_stream = QuerySetStream(
-                ),
+                Document.global_objects.order_by("id"),
                chunk_size=self.batch_size,
            )
            for document_dict, document in self.track(
                zip(document_manifest, documents_stream, strict=True),
                description="Exporting documents...",
                total=len(document_manifest),
            ):
-                document = document_map[document_dict["pk"]]
+                # Both document_manifest and documents_stream come from the same
                # Document.global_objects.order_by("id") query, taken while
                # MEDIA_LOCK is held, so this should be unreachable -- it guards
                # against silent data corruption if that invariant ever breaks.
                if document.pk != document_dict["pk"]:  # pragma: no cover
                    raise CommandError(
                        "Document export ordering mismatch: expected "
                        f"pk={document_dict['pk']}, got pk={document.pk}. "
                        "Documents may have changed during export.",
                    )
-                # 3.1. generate a unique filename
+                # generate a unique filename, then the arcnames for its files
                base_name = self.generate_base_name(document)
-
+                original_arc, thumbnail_arc, archive_arc = (
                # 3.2. write filenames into manifest
                original_target, thumbnail_target, archive_target = (
                    self.generate_document_targets(document, base_name, document_dict)
                )
                # 3.3. write files to target folder
                if not self.data_only:
                    self.copy_document_files(
                        document,
-                        original_target,
+                        sink,
-                        thumbnail_target,
+                        original_arc,
-                        archive_target,
+                        thumbnail_arc,
                        archive_arc,
                    )
                if self.split_manifest:
-                    self._write_split_manifest(document_dict, document, base_name)
+                    self._write_split_manifest(sink, document_dict, document, base_name)
                else:
                    writer.write_record(document_dict)
            for bundle_dict in share_link_bundle_manifest:
                bundle = share_link_bundle_map[bundle_dict["pk"]]
-
+                bundle_arc = self.generate_share_link_bundle_target(
                bundle_target = self.generate_share_link_bundle_target(
                    bundle,
                    bundle_dict,
                )
-
+                if not self.data_only and bundle_arc is not None:
-                if not self.data_only and bundle_target is not None:
+                    self.copy_share_link_bundle_file(bundle, sink, bundle_arc)
                    self.copy_share_link_bundle_file(bundle, bundle_target)
                writer.write_record(bundle_dict)
-        # 4.2 write version information to target folder
+            writer.close()
-        extra_metadata_path = (self.target / "metadata.json").resolve()
+
        # 3. Write version (and crypto params) to metadata.json
        # Django stores most crypto values in the field itself; we store
        # them once here for the whole export
        metadata: dict[str, str | int | dict[str, str | int]] = {
            "version": version.__full_version_str__,
        }
        # 4.2.1 If needed, write the crypto values into the metadata
        # Django stores most of these in the field itself, we store them once here
        if self.passphrase:
            metadata.update(self.get_crypt_params())
-
+        sink.add_json(metadata, "metadata.json")
        self.check_and_write_json(
            metadata,
            extra_metadata_path,
        )
        if self.delete:
            # 5. Remove files which we did not explicitly export in this run
            if not self.zip_export:
                for f in self.files_in_export_dir:
                    f.unlink()
                    delete_empty_directories(
                        f.parent,
                        self.target,
                    )
            else:
                # 5. Remove anything in the original location (before moving the zip)
                for item in self.original_target.glob("*"):
                    if item.is_dir():
                        shutil.rmtree(item)
                    else:
                        item.unlink()
    def generate_base_name(self, document: Document) -> Path:
        """
@@ -584,73 +523,69 @@ class Command(CryptMixin, PaperlessCommand):
        document: Document,
        base_name: Path,
        document_dict: dict,
-    ) -> tuple[Path, Path | None, Path | None]:
+    ) -> tuple[str, str | None, str | None]:
        """
-        Generates the targets for a given document, including the original file, archive file and thumbnail (depending on settings).
+        Generates the relative POSIX arcnames for a document's original, thumbnail
        and archive files (depending on settings), and records them in the manifest.
        """
        original_name = base_name
        if self.use_folder_prefix:
            original_name = Path("originals") / original_name
-        original_target = (self.target / original_name).resolve()
+        original_arc = original_name.as_posix()
-        document_dict[EXPORTER_FILE_NAME] = str(original_name)
+        document_dict[EXPORTER_FILE_NAME] = original_arc
        if not self.no_thumbnail:
            thumbnail_name = base_name.parent / (base_name.stem + "-thumbnail.webp")
            if self.use_folder_prefix:
                thumbnail_name = Path("thumbnails") / thumbnail_name
-            thumbnail_target = (self.target / thumbnail_name).resolve()
+            thumbnail_arc = thumbnail_name.as_posix()
-            document_dict[EXPORTER_THUMBNAIL_NAME] = str(thumbnail_name)
+            document_dict[EXPORTER_THUMBNAIL_NAME] = thumbnail_arc
        else:
-            thumbnail_target = None
+            thumbnail_arc = None
        if not self.no_archive and document.has_archive_version:
            archive_name = base_name.parent / (base_name.stem + "-archive.pdf")
            if self.use_folder_prefix:
                archive_name = Path("archive") / archive_name
-            archive_target = (self.target / archive_name).resolve()
+            archive_arc = archive_name.as_posix()
-            document_dict[EXPORTER_ARCHIVE_NAME] = str(archive_name)
+            document_dict[EXPORTER_ARCHIVE_NAME] = archive_arc
        else:
-            archive_target = None
+            archive_arc = None
-        return original_target, thumbnail_target, archive_target
+        return original_arc, thumbnail_arc, archive_arc
    def copy_document_files(
        self,
        document: Document,
-        original_target: Path,
+        sink: ExportSink,
-        thumbnail_target: Path | None,
+        original_arc: str,
-        archive_target: Path | None,
+        thumbnail_arc: str | None,
        archive_arc: str | None,
    ) -> None:
        """
-        Copies files from the document storage location to the specified target location.
+        Hands the document's files to the sink (original, thumbnail, archive).
        If the document is encrypted, the files are decrypted before copying them to the target location.
        """
-        self.check_and_copy(
+        sink.add_file(document.source_path, original_arc, checksum=document.checksum)
            document.source_path,
            document.checksum,
            original_target,
        )
-        if thumbnail_target:
+        if thumbnail_arc:
-            self.check_and_copy(document.thumbnail_path, None, thumbnail_target)
+            sink.add_file(document.thumbnail_path, thumbnail_arc)
-        if archive_target:
+        if archive_arc:
            if TYPE_CHECKING:
                assert isinstance(document.archive_path, Path)
-            self.check_and_copy(
+            sink.add_file(
                document.archive_path,
-                document.archive_checksum,
+                archive_arc,
-                archive_target,
+                checksum=document.archive_checksum,
            )
    def generate_share_link_bundle_target(
        self,
        bundle: ShareLinkBundle,
        bundle_dict: dict,
-    ) -> Path | None:
+    ) -> str | None:
        """
-        Generates the export target for a share link bundle file, when present.
+        Generates the relative POSIX arcname for a share link bundle file, if any.
        """
        if not bundle.file_path:
            return None
@@ -666,25 +601,22 @@ class Command(CryptMixin, PaperlessCommand):
        bundle_dict["fields"]["file_path"] = portable_bundle_path.as_posix()
        bundle_dict[EXPORTER_SHARE_LINK_BUNDLE_NAME] = export_bundle_path.as_posix()
-        return (self.target / export_bundle_path).resolve()
+        return export_bundle_path.as_posix()
    def copy_share_link_bundle_file(
        self,
        bundle: ShareLinkBundle,
-        bundle_target: Path,
+        sink: ExportSink,
        bundle_arc: str,
    ) -> None:
        """
-        Copies a share link bundle ZIP into the export directory.
+        Hands a share link bundle ZIP to the sink.
        """
        bundle_source_path = bundle.absolute_file_path
        if bundle_source_path is None:
            raise FileNotFoundError(f"Share link bundle {bundle.pk} has no file path")
-        self.check_and_copy(
+        sink.add_file(bundle_source_path, bundle_arc)
            bundle_source_path,
            None,
            bundle_target,
        )
    def _encrypt_record_inline(self, record: dict) -> None:
        """Encrypt sensitive fields in a single record, if passphrase is set."""
@@ -700,6 +632,7 @@ class Command(CryptMixin, PaperlessCommand):
    def _write_split_manifest(
        self,
        sink: ExportSink,
        document_dict: dict,
        document: Document,
        base_name: Path,
@@ -721,81 +654,4 @@ class Command(CryptMixin, PaperlessCommand):
        manifest_name = base_name.with_name(f"{base_name.stem}-manifest.json")
        if self.use_folder_prefix:
            manifest_name = Path("json") / manifest_name
-        manifest_name = (self.target / manifest_name).resolve()
+        sink.add_json(content, manifest_name.as_posix())
        manifest_name.parent.mkdir(parents=True, exist_ok=True)
        self.check_and_write_json(content, manifest_name)
    def check_and_write_json(
        self,
        content: list[dict] | dict,
        target: Path,
    ) -> None:
        """
        Writes the source content to the target json file.
        If --compare-json arg was used, don't write to target file if
        the file exists and checksum is identical to content checksum.
        This preserves the file timestamps when no changes are made.
        """
        target = target.resolve()
        perform_write = True
        if target in self.files_in_export_dir:
            self.files_in_export_dir.remove(target)
            if self.compare_json:
                target_checksum = hashlib.blake2b(target.read_bytes()).hexdigest()
                src_str = json.dumps(
                    content,
                    cls=DjangoJSONEncoder,
                    indent=2,
                    ensure_ascii=False,
                )
                src_checksum = hashlib.blake2b(src_str.encode("utf-8")).hexdigest()
                if src_checksum == target_checksum:
                    perform_write = False
        if perform_write:
            target.write_text(
                json.dumps(
                    content,
                    cls=DjangoJSONEncoder,
                    indent=2,
                    ensure_ascii=False,
                ),
                encoding="utf-8",
            )
    def check_and_copy(
        self,
        source: Path,
        source_checksum: str | None,
        target: Path,
    ) -> None:
        """
        Copies the source to the target, if target doesn't exist or the target doesn't seem to match
        the source attributes
        """
        target = target.resolve()
        if target in self.files_in_export_dir:
            self.files_in_export_dir.remove(target)
        perform_copy = False
        if target.exists():
            source_stat = source.stat()
            target_stat = target.stat()
            if self.compare_checksums and source_checksum:
                target_checksum = compute_checksum(target)
                perform_copy = target_checksum != source_checksum
            elif (
                source_stat.st_mtime != target_stat.st_mtime
                or source_stat.st_size != target_stat.st_size
            ):
                perform_copy = True
        else:
            # Copy if it does not exist
            perform_copy = True
        if perform_copy:
            target.parent.mkdir(parents=True, exist_ok=True)
            copy_file_with_basic_stats(source, target)
@@ -55,7 +55,7 @@ class Command(PaperlessCommand):
            "--ratio",
            default=85.0,
            type=float,
-            help="Ratio to consider documents a match",
+            help="Ratio to consider documents a match (0.0 - 100.0)",
        )
        parser.add_argument(
            "--delete",
@@ -69,6 +69,17 @@ class Command(PaperlessCommand):
            action="store_true",
            help="Skip the confirmation prompt when used with --delete",
        )
        parser.add_argument(
            "--url",
            default=None,
            type=str,
            help=(
                "Base URL of the Paperless instance (e.g. "
                "http://localhost:8000 or https://paperless.local). If set, matched "
                "documents are shown as clickable (usually ctrl+click) links to "
                "<url>/documents/<id>/details instead of by title."
            ),
        )
    def _render_results(
        self,
@@ -76,6 +87,7 @@ class Command(PaperlessCommand):
        *,
        opt_ratio: float,
        do_delete: bool,
        base_url: str | None = None,
    ) -> list[int]:
        """Render match results as a Rich table. Returns list of PKs to delete."""
        if not matches:
@@ -88,13 +100,22 @@ class Command(PaperlessCommand):
            )
            return []
-        # Fetch titles for matched documents in a single query.
+        # Fetch titles for matched documents in a single query, unless we're
-        all_pks = {pk for m in matches for pk in (m.doc_one_pk, m.doc_two_pk)}
+        # going to show URLs instead.
-        titles: dict[int, str] = dict(
+        titles: dict[int, str] = {}
-            Document.objects.filter(pk__in=all_pks)
+        if not base_url:
-            .only("pk", "title")
+            all_pks = {pk for m in matches for pk in (m.doc_one_pk, m.doc_two_pk)}
-            .values_list("pk", "title"),
+            titles = dict(
-        )
+                Document.objects.filter(pk__in=all_pks)
                .only("pk", "title")
                .values_list("pk", "title"),
            )
        def _cell(pk: int) -> str:
            if base_url:
                doc_url = f"{base_url.rstrip('/')}/documents/{pk}/details"
                return f"[link={doc_url}]{doc_url}[/link]"
            return f"[dim]#{pk}[/dim] {titles.get(pk, 'Unknown')}"
        table = Table(
            title=f"Fuzzy Matches (threshold: {opt_ratio:.1f}%)",
@@ -124,8 +145,8 @@ class Command(PaperlessCommand):
            table.add_row(
                str(i),
-                f"[dim]#{pk_a}[/dim] {titles.get(pk_a, 'Unknown')}",
+                _cell(pk_a),
-                f"[dim]#{pk_b}[/dim] {titles.get(pk_b, 'Unknown')}",
+                _cell(pk_b),
                Text(f"{ratio:.1f}%", style=ratio_style),
            )
            maybe_delete_ids.append(pk_b)
@@ -208,6 +229,7 @@ class Command(PaperlessCommand):
            matches,
            opt_ratio=opt_ratio,
            do_delete=options["delete"],
            base_url=options["url"],
        )
        if options["delete"] and maybe_delete_ids:
--- a/Show More
+++ b/Show More