[sync] feat(onboarding): redesign recommendation step as a sequential card deck (T6882)

apps/nestjs-backend/package.json

@@ -126,18 +126,18 @@
     "webpack": "5.91.0"
   },
   "dependencies": {
-    "@ai-sdk/amazon-bedrock": "4.0.97",
-    "@ai-sdk/anthropic": "3.0.72",
-    "@ai-sdk/azure": "3.0.55",
-    "@ai-sdk/cohere": "3.0.31",
-    "@ai-sdk/deepseek": "2.0.30",
-    "@ai-sdk/google": "3.0.65",
-    "@ai-sdk/mistral": "3.0.31",
-    "@ai-sdk/openai": "3.0.54",
-    "@ai-sdk/openai-compatible": "2.0.42",
-    "@ai-sdk/provider": "3.0.9",
-    "@ai-sdk/togetherai": "2.0.46",
-    "@ai-sdk/xai": "3.0.84",
+    "@ai-sdk/amazon-bedrock": "4.0.148",
+    "@ai-sdk/anthropic": "3.0.107",
+    "@ai-sdk/azure": "3.0.96",
+    "@ai-sdk/cohere": "3.0.51",
+    "@ai-sdk/deepseek": "2.0.52",
+    "@ai-sdk/google": "3.0.104",
+    "@ai-sdk/mistral": "3.0.54",
+    "@ai-sdk/openai": "3.0.91",
+    "@ai-sdk/openai-compatible": "2.0.64",
+    "@ai-sdk/provider": "3.0.14",
+    "@ai-sdk/togetherai": "2.0.70",
+    "@ai-sdk/xai": "3.0.115",
     "@an-epiphany/websocket-json-stream": "1.2.0",
     "@aws-sdk/client-s3": "3.609.0",
     "@aws-sdk/lib-storage": "3.609.0",
@@ -160,21 +160,21 @@
     "@nestjs/websockets": "10.3.5",
     "@openrouter/ai-sdk-provider": "2.8.1",
     "@opentelemetry/api": "1.9.0",
-    "@opentelemetry/context-async-hooks": "2.5.0",
-    "@opentelemetry/exporter-logs-otlp-http": "0.201.1",
-    "@opentelemetry/exporter-metrics-otlp-http": "0.201.1",
-    "@opentelemetry/exporter-trace-otlp-http": "0.201.1",
-    "@opentelemetry/instrumentation-express": "0.50.0",
-    "@opentelemetry/instrumentation-http": "0.201.1",
-    "@opentelemetry/instrumentation-ioredis": "0.49.0",
-    "@opentelemetry/instrumentation-nestjs-core": "0.49.0",
-    "@opentelemetry/instrumentation-pg": "0.49.0",
-    "@opentelemetry/instrumentation-pino": "0.54.0",
-    "@opentelemetry/instrumentation-runtime-node": "0.24.0",
-    "@opentelemetry/resources": "2.0.1",
-    "@opentelemetry/sdk-node": "0.201.1",
-    "@opentelemetry/sdk-trace-base": "2.0.1",
-    "@opentelemetry/semantic-conventions": "1.34.0",
+    "@opentelemetry/context-async-hooks": "2.10.0",
+    "@opentelemetry/exporter-logs-otlp-http": "0.221.0",
+    "@opentelemetry/exporter-metrics-otlp-http": "0.221.0",
+    "@opentelemetry/exporter-trace-otlp-http": "0.221.0",
+    "@opentelemetry/instrumentation-express": "0.69.0",
+    "@opentelemetry/instrumentation-http": "0.221.0",
+    "@opentelemetry/instrumentation-ioredis": "0.69.0",
+    "@opentelemetry/instrumentation-nestjs-core": "0.67.0",
+    "@opentelemetry/instrumentation-pg": "0.73.0",
+    "@opentelemetry/instrumentation-pino": "0.67.0",
+    "@opentelemetry/instrumentation-runtime-node": "0.34.0",
+    "@opentelemetry/resources": "2.10.0",
+    "@opentelemetry/sdk-node": "0.221.0",
+    "@opentelemetry/sdk-trace-base": "2.10.0",
+    "@opentelemetry/semantic-conventions": "1.43.0",
     "@orpc/nest": "1.13.0",
     "@prisma/client": "6.2.1",
     "@prisma/instrumentation": "6.2.1",
@@ -202,7 +202,7 @@
     "@teable/v2-table-query-ops": "workspace:*",
     "@teable/v2-utils": "workspace:*",
     "@valibot/to-json-schema": "1.3.0",
-    "ai": "6.0.169",
+    "ai": "6.0.246",
     "ajv": "8.12.0",
     "archiver": "7.0.1",
     "axios": "1.7.7",
@@ -239,7 +239,7 @@
     "minio": "7.1.3",
     "ms": "2.1.3",
     "multer": "1.4.5-lts.1",
-    "nanoid": "3.3.7",
+    "nanoid": "3.3.18",
     "nest-knexjs": "0.0.22",
     "nestjs-cls": "4.3.0",
     "nestjs-i18n": "10.5.1",
@@ -265,6 +265,7 @@
     "passport-openidconnect": "0.1.2",
     "pause": "0.1.0",
     "pdf-parse": "2.4.5",
+    "permessage-deflate": "0.1.7",
     "pg": "8.11.5",
     "pino-http": "10.5.0",
     "pino-pretty": "11.0.0",

apps/nestjs-backend/src/app.module.ts

@@ -40,6 +40,7 @@ import { PluginModule } from './features/plugin/plugin.module';
 import { PluginContextMenuModule } from './features/plugin-context-menu/plugin-context-menu.module';
 import { PluginPanelModule } from './features/plugin-panel/plugin-panel.module';
 import { RecordHistoryColdModule } from './features/record-history-cold/record-history-cold.module';
+import { RecordRemovalColdModule } from './features/record-removal-cold/record-removal-cold.module';
 import { SelectionModule } from './features/selection/selection.module';
 import { AdminOpenApiModule } from './features/setting/open-api/admin-open-api.module';
 import { SettingOpenApiModule } from './features/setting/open-api/setting-open-api.module';
@@ -102,10 +103,11 @@ export const appModules = {
     AiModule,
     PluginModule,
     PluginPanelModule,
-    // the ONLY mount of the cold queue CONSUMER: feature modules import
-    // RecordHistoryColdCoreModule (services only), so auxiliary entrypoints
-    // composing them never become competing cold-queue workers
+    // the ONLY mount of the cold queue CONSUMERS: feature modules import
+    // the Core modules (services only), so auxiliary entrypoints composing
+    // them never become competing cold-queue workers
     RecordHistoryColdModule,
+    RecordRemovalColdModule,
     PluginContextMenuModule,
     PluginChartModule,
     ObservabilityModule,

apps/nestjs-backend/src/bootstrap.ts

@@ -4,6 +4,7 @@ import type { INestApplication } from '@nestjs/common';
 import { ValidationPipe } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
+import { isDomainError, toError } from '@teable/v2-core';
 import { json, urlencoded } from 'express';
 import helmet from 'helmet';
 import isPortReachable from 'is-port-reachable';
@@ -84,9 +85,13 @@ export async function bootstrap() {
   logger.log(`> System Time Zone: ${timeZone}`);
   logger.log(`> Current System Time: ${now.toString()}`);
 
-  process.on('unhandledRejection', (reason: string, promise: Promise<unknown>) => {
-    logger.error(`Unhandled Rejection at: ${promise}, reason: ${reason}`);
-    throw reason;
+  process.on('unhandledRejection', (reason: unknown, promise: Promise<unknown>) => {
+    // DomainError is intentionally a POJO (Result-based, not thrown). If one
+    // still escapes as an unhandled rejection, wrap it so Sentry gets a real
+    // stack-bearing Error instead of collapsing into activeSpanWrapper.
+    const normalized = isDomainError(reason) ? toError(reason) : reason;
+    logger.error(`Unhandled Rejection at: ${promise}, reason: ${normalized}`);
+    throw normalized;
   });
 
   process.on('uncaughtException', (error) => {

apps/nestjs-backend/src/cache/redis-native.service.ts

@@ -323,6 +323,30 @@ export class RedisNativeService {
     });
   }
 
+  /**
+   * Batch ZCOUNT via pipeline — single network roundtrip for multiple sorted-set keys.
+   * @param keys - Array of Redis sorted set keys
+   * @param min - Minimum score (number or '-inf')
+   * @param max - Maximum score (number or '+inf')
+   * @returns Array of counts (0 for missing keys)
+   * @throws on any per-command error — unknown must not read as zero
+   */
+  async zcountMulti(keys: string[], min: number | string, max: number | string): Promise<number[]> {
+    if (keys.length === 0) return [];
+    const pipe = this.client.pipeline();
+    for (const key of keys) {
+      pipe.zcount(key, min, max);
+    }
+    const replies = await pipe.exec();
+    return keys.map((key, i) => {
+      const reply = replies?.[i];
+      if (!reply) throw new Error(`zcountMulti got no reply for ${key}`);
+      const [err, count] = reply;
+      if (err) throw err;
+      return (count as number) ?? 0;
+    });
+  }
+
   /**
    * Batch SCARD via pipeline — single network roundtrip for multiple set keys.
    * @param keys - Array of Redis set keys

apps/nestjs-backend/src/cache/types.ts

@@ -14,6 +14,10 @@ export interface ICacheStore {
   [key: `auth:session-store:${string}`]: ISessionData;
   [key: `auth:session-user:${string}`]: Record<string, number>;
   [key: `auth:session-expire:${string}`]: boolean;
+  // Epoch seconds of the user's last clearByUserId, kept for the session ttl:
+  // distinguishes "revoked by sign-out-everywhere" from "lost the concurrent
+  // read-modify-write on the per-user session map".
+  [key: `auth:session-user-cleared:${string}`]: number;
   [key: `oauth2:${string}`]: IOauth2State;
   [key: `reset-password-email:${string}`]: IResetPasswordEmailCache;
   [key: `workflow:running:${string}`]: string;
@@ -125,6 +129,7 @@ export enum OperationName {
   UpdateView = 'updateView',
   CreateRecords = 'createRecords',
   DeleteRecords = 'deleteRecords',
+  ArchiveRecords = 'archiveRecords',
   UpdateRecords = 'updateRecords',
   UpdateRecordsOrder = 'updateRecordsOrder',
   CreateFields = 'createFields',
@@ -191,6 +196,19 @@ export interface IDeleteRecordsOperation extends Omit<ICreateRecordsOperation, '
   name: OperationName.DeleteRecords;
 }
 
+// The archived snapshots stay in record_trash (write-ahead), so the stack entry only
+// carries ids: undo restores the rows matched by operationId, redo re-archives by id.
+export interface IArchiveRecordsOperation extends IUndoRedoOperationBase {
+  name: OperationName.ArchiveRecords;
+  params: {
+    tableId: string;
+  };
+  result: {
+    recordIds: string[];
+  };
+  operationId: string;
+}
+
 export interface IConvertFieldOperation extends IUndoRedoOperationBase {
   name: OperationName.ConvertField;
   params: {
@@ -294,6 +312,7 @@ export type IUndoRedoOperation =
   | IUpdateRecordsOperation
   | ICreateRecordsOperation
   | IDeleteRecordsOperation
+  | IArchiveRecordsOperation
   | IUpdateRecordsOrderOperation
   | ICreateFieldsOperation
   | IDeleteFieldsOperation

apps/nestjs-backend/src/configs/auth.config.ts

@@ -2,6 +2,9 @@
 import { Inject } from '@nestjs/common';
 import type { ConfigType } from '@nestjs/config';
 import { registerAs } from '@nestjs/config';
+import { resolveCipherEntries } from './secrets/resolve-cipher-entries';
+import { resolveSecret } from './secrets/resolve-secret';
+import { SECRET_SPECS } from './secrets/secret-specs';
 
 const getCookieSecure = (value: string | undefined) => {
   if (!value) {
@@ -13,17 +16,23 @@ const getCookieSecure = (value: string | undefined) => {
   return value === 'true';
 };
 
+// Secret resolution and policy live in ./secrets (secret-specs.ts is the
+// single source of truth; secrets-policy.ts enforces production policy).
 export const authConfig = registerAs('auth', () => ({
   jwt: {
-    secret:
-      process.env.BACKEND_JWT_SECRET ?? process.env.SECRET_KEY ?? '533Cr3tK3yF0rH4sh1nGJ4W773k3n$',
+    secret: resolveSecret(SECRET_SPECS.jwtSecret),
+    // Verify-only fallback for PLANNED rotations of BACKEND_JWT_SECRET:
+    // TeableJwtService signs with `secret` and verifies against both. A leaked
+    // secret must be hard-cut (never listed here) — see features/auth/jwt.
+    oldSecret: process.env.BACKEND_JWT_SECRET_OLD,
     expiresIn: process.env.BACKEND_JWT_EXPIRES_IN ?? '20d',
   },
   session: {
-    secret:
-      process.env.BACKEND_SESSION_SECRET ??
-      process.env.SECRET_KEY ??
-      'dafea6be69af1c1c3b8caf2b609342f6eb4540b554e19539f7643b75b480c932',
+    secret: resolveSecret(SECRET_SPECS.sessionSecret),
+    // Verify-only fallback accepted while rotating BACKEND_SESSION_SECRET.
+    // express-session validates a signed cookie against every secret in the
+    // array (first entry signs new cookies), so existing sessions survive.
+    oldSecret: process.env.BACKEND_SESSION_SECRET_OLD,
     expiresIn: process.env.BACKEND_SESSION_EXPIRES_IN ?? '7d',
     cookie: {
       secure: getCookieSecure(process.env.BACKEND_SESSION_COOKIE_SECURE),
@@ -32,9 +41,14 @@ export const authConfig = registerAs('auth', () => ({
   accessToken: {
     prefix: 'teable',
     encryption: {
-      algorithm: process.env.BACKEND_ACCESS_TOKEN_ENCRYPTION_ALGORITHM ?? 'aes-128-cbc',
-      key: process.env.BACKEND_ACCESS_TOKEN_ENCRYPTION_KEY ?? 'ie21hOKjlXUiGDx9',
-      iv: process.env.BACKEND_ACCESS_TOKEN_ENCRYPTION_IV ?? 'i0vKGXBWkzyAoGf4',
+      // Tokens are in users' hands and can never be re-encrypted: after a
+      // rotation the previous pair stays pinned in *_OLD until every token
+      // issued under it is expired or revoked.
+      entries: resolveCipherEntries({
+        algorithm: process.env.BACKEND_ACCESS_TOKEN_ENCRYPTION_ALGORITHM ?? 'aes-128-cbc',
+        keySpec: SECRET_SPECS.accessTokenEncryptionKey,
+        ivSpec: SECRET_SPECS.accessTokenEncryptionIv,
+      }),
     },
   },
   resetPasswordEmailExpiresIn:

apps/nestjs-backend/src/configs/base.config.ts

@@ -2,12 +2,20 @@
 import { Inject } from '@nestjs/common';
 import type { ConfigType } from '@nestjs/config';
 import { registerAs } from '@nestjs/config';
+import { resolveSecret } from './secrets/resolve-secret';
+import { SECRET_SPECS } from './secrets/secret-specs';
 
 export const baseConfig = registerAs('base', () => ({
   isCloud: process.env.NEXT_BUILD_ENV_EDITION?.toUpperCase() === 'CLOUD',
   publicOrigin: process.env.PUBLIC_ORIGIN,
   storagePrefix: process.env.STORAGE_PREFIX ?? process.env.PUBLIC_ORIGIN,
-  secretKey: process.env.SECRET_KEY ?? 'defaultSecretKey',
+  secretKey: resolveSecret(SECRET_SPECS.secretKey),
+  // HKDF root for EE app env-variable encryption (the one purpose with no
+  // dedicated var historically) — resolves dedicated var → SECRET_KEY
+  // umbrella → public dev default, exactly like jwtSecret. _OLD is
+  // decrypt-only while a rotation is in flight (jwt oldSecret pattern).
+  envVariableSecret: resolveSecret(SECRET_SPECS.envVariableSecret),
+  envVariableSecretOld: process.env.BACKEND_ENV_VARIABLE_SECRET_OLD || undefined,
   publicDatabaseProxy: process.env.PUBLIC_DATABASE_PROXY,
   defaultMaxBaseDBConnections: Number(process.env.DEFAULT_MAX_BASE_DB_CONNECTIONS ?? 20),
   templateSpaceId: process.env.TEMPLATE_SPACE_ID,

apps/nestjs-backend/src/configs/computed-outbox-trigger.config.ts

@@ -36,6 +36,25 @@ export const computedOutboxTriggerConfig = registerAs('computedOutboxTrigger', (
       process.env.V2_COMPUTED_OUTBOX_MONITOR_INTERVAL_MS,
       30_000
     ),
+    // Caps how many wakeups one redrive scan publishes per target. A resumed
+    // pause or long outage can leave weeks of backlog; draining it in a single
+    // sweep floods the claim path and the data-db pool. The remainder is
+    // picked up by the following reconcile cycles.
+    redriveMaxPublishPerTarget: readPositiveInteger(
+      process.env.V2_COMPUTED_OUTBOX_REDRIVE_MAX_PUBLISH_PER_TARGET,
+      1000
+    ),
+    // Cluster-wide outbox claim caps (active `processing` tasks per base / per
+    // base+seed-table before further claims defer). BYODB data pools are sized
+    // against these at deploy time — raise them deliberately.
+    claimConcurrencyPerBase: readPositiveInteger(
+      process.env.V2_COMPUTED_OUTBOX_MAX_CONCURRENT_PER_BASE,
+      2
+    ),
+    claimConcurrencyPerSeedTable: readPositiveInteger(
+      process.env.V2_COMPUTED_OUTBOX_MAX_CONCURRENT_PER_SEED_TABLE,
+      2
+    ),
   };
 });
 

apps/nestjs-backend/src/configs/config.module.ts

@@ -1,4 +1,5 @@
 /* eslint-disable @typescript-eslint/naming-convention */
+import fs from 'fs';
 import path from 'path';
 import type { DynamicModule } from '@nestjs/common';
 import { Logger, Module } from '@nestjs/common';
@@ -13,6 +14,7 @@ import { loggerConfig } from './logger.config';
 import { mailConfig } from './mail.config';
 import { oauthConfig } from './oauth.config';
 import { riskControlConfig } from './risk-control.config';
+import { enforceSecretsPolicy } from './secrets/secrets-policy';
 import { storageConfig } from './storage';
 import { thresholdConfig } from './threshold.config';
 import { trashConfig } from './trash.config';
@@ -32,24 +34,42 @@ const configurations = [
   riskControlConfig,
 ];
 
+// The env files live in the nextjs-app package. NEXTJS_DIR is relative to the
+// backend package dir, but the process may be started from the repo root (make,
+// IDE run configs) — probe the known anchors instead of trusting cwd, since a
+// silently unresolved path means the secrets policy would warn and fall back
+// to the legacy source-code defaults instead of using your .env values.
+const resolveEnvFileDir = (): string => {
+  const nextJsDir = nextJsConfig().dir;
+  const candidates = [
+    path.join(process.cwd(), nextJsDir),
+    path.join(process.cwd(), 'community/apps/nextjs-app'),
+  ];
+  return candidates.find((dir) => fs.existsSync(dir)) ?? candidates[0];
+};
+
 @Module({})
 export class ConfigModule {
   static register(): DynamicModule {
-    return BaseConfigModule.forRoot({
+    const envDir = resolveEnvFileDir();
+    const dynamicModule = BaseConfigModule.forRoot({
       isGlobal: true,
       cache: true,
       expandVariables: true,
       load: configurations,
       envFilePath: ['.env.development.local', '.env.development', '.env'].map((str) => {
-        const nextJsDir = nextJsConfig().dir;
-        const envDir = nextJsDir ? path.join(process.cwd(), nextJsDir, str) : str;
+        const envFile = path.join(envDir, str);
 
         Logger.attachBuffer();
-        Logger.log(`[Env File Path]: ${envDir}`);
+        Logger.log(`[Env File Path]: ${envFile}`);
         Logger.detachBuffer();
-        return envDir;
+        return envFile;
       }),
       validationSchema: envValidationSchema,
     });
+    // forRoot has synchronously merged the env files into process.env; enforce
+    // the secrets policy now, before any config factory resolves a secret.
+    enforceSecretsPolicy();
+    return dynamicModule;
   }
 }