Render source URL for plugins (#660)

Co-authored-by: Thorsten Sommer <SommerEngineering@users.noreply.github.com>

.github/workflows/build-and-release.yml

@@ -173,6 +173,9 @@ jobs:
           pdfium_version=$(sed -n '11p' metadata.txt)
           pdfium_version=$(echo $pdfium_version | cut -d'.' -f3)
           
+          # Next line is the Qdrant version:
+          qdrant_version="v$(sed -n '12p' metadata.txt)"
+          
           # Write the metadata to the environment:
           echo "APP_VERSION=${app_version}" >> $GITHUB_ENV
           echo "FORMATTED_APP_VERSION=${formatted_app_version}" >> $GITHUB_ENV
@@ -185,6 +188,7 @@ jobs:
           echo "TAURI_VERSION=${tauri_version}" >> $GITHUB_ENV
           echo "ARCHITECTURE=${{ matrix.dotnet_runtime }}" >> $GITHUB_ENV
           echo "PDFIUM_VERSION=${pdfium_version}" >> $GITHUB_ENV
+          echo "QDRANT_VERSION=${qdrant_version}" >> $GITHUB_ENV
 
           # Log the metadata:
           echo "App version: '${formatted_app_version}'"
@@ -197,6 +201,7 @@ jobs:
           echo "Tauri version: '${tauri_version}'"
           echo "Architecture: '${{ matrix.dotnet_runtime }}'"
           echo "PDFium version: '${pdfium_version}'"
+          echo "Qdrant version: '${qdrant_version}'"
           
       - name: Read and format metadata (Windows)
         if: matrix.platform == 'windows-latest'
@@ -241,6 +246,9 @@ jobs:
           $pdfium_version = $metadata[10]
           $pdfium_version = $pdfium_version.Split('.')[2]
           
+          # Next line is the necessary Qdrant version:
+          $qdrant_version = "v$($metadata[11])"
+          
           # Write the metadata to the environment:
           Write-Output "APP_VERSION=${app_version}" >> $env:GITHUB_ENV
           Write-Output "FORMATTED_APP_VERSION=${formatted_app_version}" >> $env:GITHUB_ENV
@@ -252,6 +260,7 @@ jobs:
           Write-Output "MUD_BLAZOR_VERSION=${mud_blazor_version}" >> $env:GITHUB_ENV
           Write-Output "ARCHITECTURE=${{ matrix.dotnet_runtime }}" >> $env:GITHUB_ENV
           Write-Output "PDFIUM_VERSION=${pdfium_version}" >> $env:GITHUB_ENV
+          Write-Output "QDRANT_VERSION=${qdrant_version}" >> $env:GITHUB_ENV
           
           # Log the metadata:
           Write-Output "App version: '${formatted_app_version}'"
@@ -264,6 +273,7 @@ jobs:
           Write-Output "Tauri version: '${tauri_version}'"
           Write-Output "Architecture: '${{ matrix.dotnet_runtime }}'"
           Write-Output "PDFium version: '${pdfium_version}'"
+          Write-Output "Qdrant version: '${qdrant_version}'"
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
@@ -334,7 +344,7 @@ jobs:
           echo "Cleaning up ..."
           rm -fr "$TMP"
           
-      - name: Install PDFium (Windows)
+      - name: Deploy PDFium (Windows)
         if: matrix.platform == 'windows-latest'
         env:
           PDFIUM_VERSION: ${{ env.PDFIUM_VERSION }}
@@ -385,6 +395,128 @@ jobs:
           Write-Host "Cleaning up ..."
           Remove-Item $ARCHIVE -Force -ErrorAction SilentlyContinue
 
+          # Try to remove the temporary directory, but ignore errors if files are still in use
+          try {
+            Remove-Item $TMP -Recurse -Force -ErrorAction Stop
+            Write-Host "Successfully cleaned up temporary directory: $TMP"
+          } catch {
+            Write-Warning "Could not fully clean up temporary directory: $TMP. This is usually harmless as Windows will clean it up later. Error: $($_.Exception.Message)"
+          }
+      - name: Deploy Qdrant (Unix)
+        if: matrix.platform != 'windows-latest'
+        env:
+          QDRANT_VERSION: ${{ env.QDRANT_VERSION }}
+          DOTNET_RUNTIME: ${{ matrix.dotnet_runtime }}
+          RUST_TARGET: ${{ matrix.rust_target }}
+        run: |
+          set -e
+
+          # Target directory:
+          TDB_DIR="runtime/target/databases/qdrant"
+          mkdir -p "$TDB_DIR"
+
+          case "${DOTNET_RUNTIME}" in
+            linux-x64)
+              QDRANT_FILE="x86_64-unknown-linux-gnu.tar.gz"
+              DB_SOURCE="qdrant"
+              DB_TARGET="qdrant-${RUST_TARGET}"
+              ;;
+            linux-arm64)
+              QDRANT_FILE="aarch64-unknown-linux-musl.tar.gz"
+              DB_SOURCE="qdrant"
+              DB_TARGET="qdrant-${RUST_TARGET}"
+              ;;
+            osx-x64)
+              QDRANT_FILE="x86_64-apple-darwin.tar.gz"
+              DB_SOURCE="qdrant"
+              DB_TARGET="qdrant-${RUST_TARGET}"
+              ;;
+            osx-arm64)
+              QDRANT_FILE="aarch64-apple-darwin.tar.gz"
+              DB_SOURCE="qdrant"
+              DB_TARGET="qdrant-${RUST_TARGET}"
+              ;;
+            *)
+              echo "Unknown platform: ${DOTNET_RUNTIME}"
+              exit 1
+              ;;
+          esac
+
+          QDRANT_URL="https://github.com/qdrant/qdrant/releases/download/${QDRANT_VERSION}/qdrant-${QDRANT_FILE}"
+
+          echo "Download Qdrant $QDRANT_URL ..."
+          TMP=$(mktemp -d)
+          ARCHIVE="${TMP}/qdrant.tgz"
+
+          curl -fsSL -o "$ARCHIVE" "$QDRANT_URL"
+
+          echo "Extracting Qdrant ..."
+          tar xzf "$ARCHIVE" -C "$TMP"
+          SRC="${TMP}/${DB_SOURCE}"
+
+          if [ ! -f "$SRC" ]; then
+            echo "Was not able to find Qdrant source: $SRC"
+            exit 1
+          fi
+
+          echo "Copy Qdrant from ${DB_TARGET} to ${TDB_DIR}/"
+          cp -f "$SRC" "$TDB_DIR/$DB_TARGET"
+
+          echo "Cleaning up ..."
+          rm -fr "$TMP"
+
+      - name: Deploy Qdrant (Windows)
+        if: matrix.platform == 'windows-latest'
+        env:
+          QDRANT_VERSION: ${{ env.QDRANT_VERSION }}
+          DOTNET_RUNTIME: ${{ matrix.dotnet_runtime }}
+          RUST_TARGET: ${{ matrix.rust_target }}
+        run: |
+          $TDB_DIR = "runtime\target\databases\qdrant"
+          New-Item -ItemType Directory -Force -Path $TDB_DIR | Out-Null
+          
+          switch ($env:DOTNET_RUNTIME) {
+            "win-x64" {
+              $QDRANT_FILE = "x86_64-pc-windows-msvc.zip"
+              $DB_SOURCE = "qdrant.exe"
+              $DB_TARGET = "qdrant-$($env:RUST_TARGET).exe"
+            }
+            "win-arm64" {
+              $QDRANT_FILE = "x86_64-pc-windows-msvc.zip"
+              $DB_SOURCE = "qdrant.exe"
+              $DB_TARGET = "qdrant-$($env:RUST_TARGET).exe"
+            }
+            default {
+              Write-Error "Unknown platform: $($env:DOTNET_RUNTIME)"
+              exit 1
+            }
+          }
+          
+          $QDRANT_URL = "https://github.com/qdrant/qdrant/releases/download/$($env:QDRANT_VERSION)/qdrant-$QDRANT_FILE"
+          Write-Host "Download $QDRANT_URL ..."
+
+          # Create a unique temporary directory (not just a file)
+          $TMP = Join-Path ([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName())
+          New-Item -ItemType Directory -Path $TMP -Force | Out-Null
+          $ARCHIVE = Join-Path $TMP "qdrant.tgz"
+          
+          Invoke-WebRequest -Uri $QDRANT_URL -OutFile $ARCHIVE
+          
+          Write-Host "Extracting Qdrant ..."
+          tar -xzf $ARCHIVE -C $TMP
+          
+          $SRC = Join-Path $TMP $DB_SOURCE
+          if (!(Test-Path $SRC)) {
+            Write-Error "Cannot find Qdrant source: $SRC"
+            exit 1
+          }
+          
+          $DEST = Join-Path $TDB_DIR $DB_TARGET
+          Copy-Item -Path $SRC -Destination $DEST -Force
+          
+          Write-Host "Cleaning up ..."
+          Remove-Item $ARCHIVE -Force -ErrorAction SilentlyContinue
+
           # Try to remove the temporary directory, but ignore errors if files are still in use
           try {
             Remove-Item $TMP -Recurse -Force -ErrorAction Stop

.gitignore

@@ -6,6 +6,13 @@ libpdfium.dylib
 libpdfium.so
 libpdfium.dll
 
+# Ignore qdrant database:
+qdrant-aarch64-apple-darwin
+qdrant-x86_64-apple-darwin
+qdrant-aarch64-unknown-linux-gnu
+qdrant-x86_64-unknown-linux-gnu
+qdrant-x86_64-pc-windows-msvc.exe
+
 # User-specific files
 *.rsuser
 *.suo

README.md

@@ -32,7 +32,7 @@ Since November 2024: Work on RAG (integration of your data and files) has begun.
 - [x] ~~App: Implement dialog for checking & handling [pandoc](https://pandoc.org/) installation ([PR #393](https://github.com/MindWorkAI/AI-Studio/pull/393), [PR #487](https://github.com/MindWorkAI/AI-Studio/pull/487))~~
 - [ ] App: Implement external embedding providers
 - [ ] App: Implement the process to vectorize one local file using embeddings
-- [ ] Runtime: Integration of the vector database [Qdrant](https://github.com/qdrant/qdrant)
+- [x] ~~Runtime: Integration of the vector database [Qdrant](https://github.com/qdrant/qdrant) ([PR #580](https://github.com/MindWorkAI/AI-Studio/pull/580))~~
 - [ ] App: Implement the continuous process of vectorizing data
 - [x] ~~App: Define a common retrieval context interface for the integration of RAG processes in chats (PR [#281](https://github.com/MindWorkAI/AI-Studio/pull/281), [#284](https://github.com/MindWorkAI/AI-Studio/pull/284), [#286](https://github.com/MindWorkAI/AI-Studio/pull/286), [#287](https://github.com/MindWorkAI/AI-Studio/pull/287))~~
 - [x] ~~App: Define a common augmentation interface for the integration of RAG processes in chats (PR [#288](https://github.com/MindWorkAI/AI-Studio/pull/288), [#289](https://github.com/MindWorkAI/AI-Studio/pull/289))~~

app/Build/Commands/Database.cs

@@ -0,0 +1,3 @@
+namespace Build.Commands;
+
+public record Database(string Path, string Filename);

app/Build/Commands/Qdrant.cs

@@ -0,0 +1,120 @@
+using System.Formats.Tar;
+using System.IO.Compression;
+
+using SharedTools;
+
+namespace Build.Commands;
+
+public static class Qdrant
+{
+    public static async Task InstallAsync(RID rid, string version)
+    {
+        Console.Write($"- Installing Qdrant {version} for {rid.ToUserFriendlyName()} ...");
+
+        var cwd = Environment.GetRustRuntimeDirectory();
+        var qdrantTmpDownloadPath = Path.GetTempFileName();
+        var qdrantTmpExtractPath = Directory.CreateTempSubdirectory();
+        var qdrantUrl = GetQdrantDownloadUrl(rid, version);
+
+        //
+        // Download the file:
+        //
+        Console.Write(" downloading ...");
+        using (var client = new HttpClient())
+        {
+            var response = await client.GetAsync(qdrantUrl);
+            if (!response.IsSuccessStatusCode)
+            {
+                Console.WriteLine($" failed to download Qdrant {version} for {rid.ToUserFriendlyName()} from {qdrantUrl}");
+                return;
+            }
+
+            await using var fileStream = File.Create(qdrantTmpDownloadPath);
+            await response.Content.CopyToAsync(fileStream);
+        }
+        
+        //
+        // Extract the downloaded file:
+        //
+        Console.Write(" extracting ...");
+        await using(var zStream = File.Open(qdrantTmpDownloadPath, FileMode.Open, FileAccess.Read, FileShare.Read))
+        {
+            if (rid == RID.WIN_X64)
+            {
+                using var archive = new ZipArchive(zStream, ZipArchiveMode.Read);
+                archive.ExtractToDirectory(qdrantTmpExtractPath.FullName, overwriteFiles: true);
+            }
+            else
+            {
+                await using var uncompressedStream = new GZipStream(zStream, CompressionMode.Decompress);
+                await TarFile.ExtractToDirectoryAsync(uncompressedStream, qdrantTmpExtractPath.FullName, true);   
+            }
+        }
+        
+        //
+        // Copy the database to the target directory:
+        //
+        Console.Write(" deploying ...");
+        var database = GetDatabasePath(rid);
+        if (string.IsNullOrWhiteSpace(database.Path))
+        {
+            Console.WriteLine($" failed to find the database path for {rid.ToUserFriendlyName()}");
+            return;
+        }
+        
+        var qdrantDbSourcePath = Path.Join(qdrantTmpExtractPath.FullName, database.Path);
+        var qdrantDbTargetPath = Path.Join(cwd, "target", "databases", "qdrant",database.Filename);
+        if (!File.Exists(qdrantDbSourcePath))
+        {
+            Console.WriteLine($" failed to find the database file '{qdrantDbSourcePath}'");
+            return;
+        }
+        
+        Directory.CreateDirectory(Path.Join(cwd, "target", "databases", "qdrant"));
+        if (File.Exists(qdrantDbTargetPath))
+            File.Delete(qdrantDbTargetPath);
+        
+        File.Copy(qdrantDbSourcePath, qdrantDbTargetPath);
+        
+        //
+        // Cleanup:
+        //
+        Console.Write(" cleaning up ...");
+        File.Delete(qdrantTmpDownloadPath);
+        Directory.Delete(qdrantTmpExtractPath.FullName, true);
+        
+        Console.WriteLine(" done.");
+    }
+    
+    private static Database GetDatabasePath(RID rid) => rid switch
+    {
+        RID.OSX_ARM64 => new("qdrant", "qdrant-aarch64-apple-darwin"),
+        RID.OSX_X64 => new("qdrant", "qdrant-x86_64-apple-darwin"),
+        
+        RID.LINUX_ARM64 => new("qdrant", "qdrant-aarch64-unknown-linux-gnu"),
+        RID.LINUX_X64 => new("qdrant", "qdrant-x86_64-unknown-linux-gnu"),
+        
+        RID.WIN_X64 => new("qdrant.exe", "qdrant-x86_64-pc-windows-msvc.exe"),
+        RID.WIN_ARM64 => new("qdrant.exe", "qdrant-aarch64-pc-windows-msvc.exe"),
+        
+        _ => new(string.Empty, string.Empty),
+    };
+
+    private static string GetQdrantDownloadUrl(RID rid, string version)
+    {
+        var baseUrl = $"https://github.com/qdrant/qdrant/releases/download/v{version}/qdrant-";
+        return rid switch
+        {
+            RID.LINUX_ARM64 => $"{baseUrl}aarch64-unknown-linux-musl.tar.gz",
+            RID.LINUX_X64 => $"{baseUrl}x86_64-unknown-linux-gnu.tar.gz",
+            
+            RID.OSX_ARM64 => $"{baseUrl}aarch64-apple-darwin.tar.gz",
+            RID.OSX_X64 => $"{baseUrl}x86_64-apple-darwin.tar.gz",
+            
+            RID.WIN_X64 => $"{baseUrl}x86_64-pc-windows-msvc.zip",
+            RID.WIN_ARM64 => $"{baseUrl}x86_64-pc-windows-msvc.zip",
+            
+            _ => string.Empty,
+        };
+    }
+}

app/Build/Commands/UpdateMetadataCommands.cs

@@ -151,6 +151,9 @@ public sealed partial class UpdateMetadataCommands
         var pdfiumVersion = await this.ReadPdfiumVersion();
         await Pdfium.InstallAsync(rid, pdfiumVersion);
 
+        var qdrantVersion = await this.ReadQdrantVersion();
+        await Qdrant.InstallAsync(rid, qdrantVersion);
+        
         Console.Write($"- Start .NET build for {rid.ToUserFriendlyName()} ...");
         await this.ReadCommandOutput(pathApp, "dotnet", $"clean --configuration release --runtime {rid.AsMicrosoftRid()}");
         var dotnetBuildOutput = await this.ReadCommandOutput(pathApp, "dotnet", $"publish --configuration release --runtime {rid.AsMicrosoftRid()} --disable-build-servers --force");
@@ -364,6 +367,16 @@ public sealed partial class UpdateMetadataCommands
         return shortVersion;
     }
 
+    private async Task<string> ReadQdrantVersion()
+    {
+        const int QDRANT_VERSION_INDEX = 11;
+        var pathMetadata = Environment.GetMetadataPath();
+        var lines = await File.ReadAllLinesAsync(pathMetadata, Encoding.UTF8);
+        var currentQdrantVersion = lines[QDRANT_VERSION_INDEX].Trim();
+        
+        return currentQdrantVersion;
+    }
+
     private async Task UpdateArchitecture(RID rid)
     {
         const int ARCHITECTURE_INDEX = 9;

app/MindWork AI Studio.sln.DotSettings

@@ -27,4 +27,6 @@
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=mime/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=mwais/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=ollama/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=Qdrant/@EntryIndexedValue">True</s:Boolean>
+	<s:Boolean x:Key="/Default/UserDictionary/Words/=qdrant/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/UserDictionary/Words/=tauri_0027s/@EntryIndexedValue">True</s:Boolean></wpf:ResourceDictionary>

app/MindWork AI Studio/Assistants/DocumentAnalysis/DocumentAnalysisAssistant.razor

@@ -136,6 +136,8 @@ else
 
                 <ReadFileContent Text="@T("Load output rules from document")" @bind-FileContent="@this.policyOutputRules" Disabled="@this.IsNoPolicySelectedOrProtected"/>
 
+                @if (this.SettingsManager.ConfigurationData.App.ShowAdminSettings)
+                {
                     <MudText Typo="Typo.h5" Class="mt-6 mb-1">
                         @T("Preparation for enterprise distribution")
                     </MudText>
@@ -144,6 +146,7 @@ else
                         @T("Export policy as configuration section")
                     </MudButton>
                 }
+            }
         </ExpansionPanel>
 
         <MudDivider Style="height: 0.25ch; margin: 1rem 0;" Class="mt-6" />

app/MindWork AI Studio/Assistants/I18N/allTexts.lua

@@ -2080,12 +2080,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T1898060643"]
 -- Select the language for the app.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T1907446663"] = "Select the language for the app."
 
+-- When enabled, additional administration options become visible. These options are intended for IT staff to manage organization-wide configuration, e.g. configuring and exporting providers for an entire organization.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2013281167"] = "When enabled, additional administration options become visible. These options are intended for IT staff to manage organization-wide configuration, e.g. configuring and exporting providers for an entire organization."
+
 -- The global keyboard shortcut for toggling voice recording. This shortcut works system-wide, even when the app is not focused.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2143741496"] = "The global keyboard shortcut for toggling voice recording. This shortcut works system-wide, even when the app is not focused."
 
 -- Disable dictation and transcription
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T215381891"] = "Disable dictation and transcription"
 
+-- Enterprise Administration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2277116008"] = "Enterprise Administration"
+
 -- Language behavior
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2341504363"] = "Language behavior"
 
@@ -2095,6 +2101,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T237706157"]
 -- Language
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2591284123"] = "Language"
 
+-- Administration settings are visible
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2591866808"] = "Administration settings are visible"
+
 -- Save energy?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3100928009"] = "Save energy?"
 
@@ -2104,9 +2113,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3165555978"]
 -- App Options
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3577148634"] = "App Options"
 
+-- Generate a 256-bit encryption secret for encrypting API keys in configuration plugins. Deploy this secret to client machines via Group Policy (Windows Registry) or environment variables. Providers can then be exported with encrypted API keys using the export buttons in the provider settings.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T362833"] = "Generate a 256-bit encryption secret for encrypting API keys in configuration plugins. Deploy this secret to client machines via Group Policy (Windows Registry) or environment variables. Providers can then be exported with encrypted API keys using the export buttons in the provider settings."
+
 -- When enabled, streamed content from the AI is updated once every third second. When disabled, streamed content will be updated as soon as it is available.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3652888444"] = "When enabled, streamed content from the AI is updated once every third second. When disabled, streamed content will be updated as soon as it is available."
 
+-- Show administration settings?
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3694781396"] = "Show administration settings?"
+
+-- Read the Enterprise IT documentation for details.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3705451321"] = "Read the Enterprise IT documentation for details."
+
 -- Enable spellchecking?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3914529369"] = "Enable spellchecking?"
 
@@ -2140,6 +2158,12 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T817101267"]
 -- Would you like to set one provider as the default for the entire app? When you configure a different provider for an assistant, it will always take precedence.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T844514734"] = "Would you like to set one provider as the default for the entire app? When you configure a different provider for an assistant, it will always take precedence."
 
+-- Generate an encryption secret and copy it to the clipboard
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T922066419"] = "Generate an encryption secret and copy it to the clipboard"
+
+-- Administration settings are not visible
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T929143445"] = "Administration settings are not visible"
+
 -- Delete
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T1469573738"] = "Delete"
 
@@ -2197,6 +2221,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T78223
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T900237532"] = "Provider"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T975426229"] = "Export configuration"
+
+-- Cannot export the encrypted API key: No enterprise encryption secret is configured.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T1832230847"] = "Cannot export the encrypted API key: No enterprise encryption secret is configured."
+
+-- This provider has an API key configured. Do you want to include the encrypted API key in the export? Note: The recipient will need the same encryption secret to use the API key.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T3368145670"] = "This provider has an API key configured. Do you want to include the encrypted API key in the export? Note: The recipient will need the same encryption secret to use the API key."
+
+-- Export API Key?
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T4010580285"] = "Export API Key?"
+
 -- Show provider's confidence level?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T1052533048"] = "Show provider's confidence level?"
 
@@ -2302,6 +2338,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T853225
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T900237532"] = "Provider"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T975426229"] = "Export configuration"
+
 -- No transcription provider configured yet.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T1079350363"] = "No transcription provider configured yet."
 
@@ -2356,6 +2395,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T78
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T900237532"] = "Provider"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T975426229"] = "Export configuration"
+
 -- Copy {0} to the clipboard
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::TEXTINFOLINE::T2206391442"] = "Copy {0} to the clipboard"
 
@@ -5011,9 +5053,18 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1282228996"] = "AI Studio runs w
 -- This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1388816916"] = "This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat."
 
+-- Database version
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1420062548"] = "Database version"
+
 -- This library is used to extend the MudBlazor library. It provides additional components that are not part of the MudBlazor library.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1421513382"] = "This library is used to extend the MudBlazor library. It provides additional components that are not part of the MudBlazor library."
 
+-- Encryption secret: is not configured
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1560776885"] = "Encryption secret: is not configured"
+
+-- Qdrant is a vector database and vector similarity search engine. We use it to realize local RAG—retrieval-augmented generation—within AI Studio. Thanks for the effort and great work that has been and is being put into Qdrant.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1619832053"] = "Qdrant is a vector database and vector similarity search engine. We use it to realize local RAG—retrieval-augmented generation—within AI Studio. Thanks for the effort and great work that has been and is being put into Qdrant."
+
 -- We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T162898512"] = "We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library."
 
@@ -5047,9 +5098,15 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1915240766"] = "In order to use
 -- This library is used to convert HTML to Markdown. This is necessary, e.g., when you provide a URL as input for an assistant.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1924365263"] = "This library is used to convert HTML to Markdown. This is necessary, e.g., when you provide a URL as input for an assistant."
 
+-- Encryption secret: is configured
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1931141322"] = "Encryption secret: is configured"
+
 -- We use Rocket to implement the runtime API. This is necessary because the runtime must be able to communicate with the user interface (IPC). Rocket is a great framework for implementing web APIs in Rust.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1943216839"] = "We use Rocket to implement the runtime API. This is necessary because the runtime must be able to communicate with the user interface (IPC). Rocket is a great framework for implementing web APIs in Rust."
 
+-- Copies the following to the clipboard
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2029659664"] = "Copies the following to the clipboard"
+
 -- Copies the server URL to the clipboard
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2037899437"] = "Copies the server URL to the clipboard"
 
@@ -5095,6 +5152,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2557066213"] = "Used Open Source
 -- Build time
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T260228112"] = "Build time"
 
+-- This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2619858133"] = "This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant."
+
 -- This crate provides derive macros for Rust enums, which we use to reduce boilerplate when implementing string conversions and metadata for runtime types. This is helpful for the communication between our Rust and .NET systems.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2635482790"] = "This crate provides derive macros for Rust enums, which we use to reduce boilerplate when implementing string conversions and metadata for runtime types. This is helpful for the communication between our Rust and .NET systems."
 
@@ -5212,6 +5272,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T566998575"] = "This is a library
 -- Used .NET SDK
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T585329785"] = "Used .NET SDK"
 
+-- This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T633932150"] = "This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated."
+
 -- Did you find a bug or are you experiencing issues? Report your concern here.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T639371534"] = "Did you find a bug or are you experiencing issues? Report your concern here."
 
@@ -5242,6 +5305,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T158493184"] = "Internal Plugins"
 -- Disabled Plugins
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T1724138133"] = "Disabled Plugins"
 
+-- Send a mail
+UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T1999487139"] = "Send a mail"
+
 -- Enable plugin
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T2057806005"] = "Enable plugin"
 
@@ -5254,6 +5320,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T2738444034"] = "Enabled Plugins"
 -- Actions
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T3865031940"] = "Actions"
 
+-- Open website
+UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T4239378936"] = "Open website"
+
 -- Settings
 UI_TEXT_CONTENT["AISTUDIO::PAGES::SETTINGS::T1258653480"] = "Settings"
 
@@ -5770,6 +5839,21 @@ UI_TEXT_CONTENT["AISTUDIO::TOOLS::CONFIDENCESCHEMESEXTENSIONS::T3893997203"] = "
 -- Trust all LLM providers
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::CONFIDENCESCHEMESEXTENSIONS::T4107860491"] = "Trust all LLM providers"
 
+-- Storage size
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T1230141403"] = "Storage size"
+
+-- HTTP port
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T1717573768"] = "HTTP port"
+
+-- Reported version
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T3556099842"] = "Reported version"
+
+-- gRPC port
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T757840040"] = "gRPC port"
+
+-- Number of collections
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T842647336"] = "Number of collections"
+
 -- The related data is not allowed to be sent to any LLM provider. This means that this data source cannot be used at the moment.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::ERICLIENT::DATAMODEL::PROVIDERTYPEEXTENSIONS::T1555790630"] = "The related data is not allowed to be sent to any LLM provider. This means that this data source cannot be used at the moment."
 
@@ -5959,15 +6043,18 @@ UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2262604281"] = "The
 -- The field DESCRIPTION does not exist or is not a valid string.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T229488255"] = "The field DESCRIPTION does not exist or is not a valid string."
 
--- The field SOURCE_URL is not a valid URL. The URL must start with 'http://' or 'https://'.
-UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2320984047"] = "The field SOURCE_URL is not a valid URL. The URL must start with 'http://' or 'https://'."
-
 -- The field VERSION is not a valid version number. The version number must be formatted as string in the major.minor.patch format (X.X.X).
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2538827536"] = "The field VERSION is not a valid version number. The version number must be formatted as string in the major.minor.patch format (X.X.X)."
 
+-- The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'.
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2892057533"] = "The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'."
+
 -- The table AUTHORS is empty. At least one author must be specified.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2981832540"] = "The table AUTHORS is empty. At least one author must be specified."
 
+-- The field SOURCE_URL is not a valid URL. When the URL starts with 'mailto:', it must contain a valid email address as recipient.
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T3165663073"] = "The field SOURCE_URL is not a valid URL. When the URL starts with 'mailto:', it must contain a valid email address as recipient."
+
 -- The field SUPPORT_CONTACT is empty. The support contact must be a non-empty string.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T3524814526"] = "The field SUPPORT_CONTACT is empty. The support contact must be a non-empty string."
 

app/MindWork AI Studio/Components/ChatComponent.razor

@@ -66,7 +66,7 @@
             @if (this.SettingsManager.ConfigurationData.Workspace.StorageBehavior is WorkspaceStorageBehavior.STORE_CHATS_MANUALLY)
             {
                 <MudTooltip Text="@T("Save chat")" Placement="@TOOLBAR_TOOLTIP_PLACEMENT">
-                    <MudIconButton Icon="@Icons.Material.Filled.Save" OnClick="@(() => this.SaveThread())" Disabled="@(!this.CanThreadBeSaved)"/>
+                    <MudIconButton Icon="@Icons.Material.Filled.Save" OnClick="@(() => this.SaveThread())" Disabled="@(!this.CanThreadBeSaved || this.isStreaming)"/>
                 </MudTooltip>
             }
 

app/MindWork AI Studio/Components/ChatComponent.razor.cs

@@ -912,6 +912,10 @@ public partial class ChatComponent : MSGComponentBase, IAsyncDisposable
                 break;
             
             case Event.CHAT_STREAMING_DONE:
+                // Streaming mutates the last AI block over time.
+                // In manual storage mode, a save during streaming must not
+                // mark the final streamed state as already persisted.
+                this.hasUnsavedChanges = true;
                 if(this.autoSaveEnabled)
                     await this.SaveThread();
                 break;

app/MindWork AI Studio/Components/Settings/SettingsPanelApp.razor

@@ -17,6 +17,7 @@
     <ConfigurationSelect OptionDescription="@T("Check for updates")" SelectedValue="@(() => this.SettingsManager.ConfigurationData.App.UpdateInterval)" Data="@ConfigurationSelectDataFactory.GetUpdateIntervalData()" SelectionUpdate="@(selectedValue => this.SettingsManager.ConfigurationData.App.UpdateInterval = selectedValue)" OptionHelp="@T("How often should we check for app updates?")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.UpdateInterval, out var meta) && meta.IsLocked"/>
     <ConfigurationSelect OptionDescription="@T("Update installation method")" SelectedValue="@(() => this.SettingsManager.ConfigurationData.App.UpdateInstallation)" Data="@ConfigurationSelectDataFactory.GetUpdateBehaviourData()" SelectionUpdate="@(selectedValue => this.SettingsManager.ConfigurationData.App.UpdateInstallation = selectedValue)" OptionHelp="@T("Should updates be installed automatically or manually?")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.UpdateInstallation, out var meta) && meta.IsLocked"/>
     <ConfigurationSelect OptionDescription="@T("Navigation bar behavior")" SelectedValue="@(() => this.SettingsManager.ConfigurationData.App.NavigationBehavior)" Data="@ConfigurationSelectDataFactory.GetNavBehaviorData()" SelectionUpdate="@(selectedValue => this.SettingsManager.ConfigurationData.App.NavigationBehavior = selectedValue)" OptionHelp="@T("Select the desired behavior for the navigation bar.")"/>
+    <ConfigurationOption OptionDescription="@T("Show administration settings?")" LabelOn="@T("Administration settings are visible")" LabelOff="@T("Administration settings are not visible")" State="@(() => this.SettingsManager.ConfigurationData.App.ShowAdminSettings)" StateUpdate="@(updatedState => this.SettingsManager.ConfigurationData.App.ShowAdminSettings = updatedState)" OptionHelp="@T("When enabled, additional administration options become visible. These options are intended for IT staff to manage organization-wide configuration, e.g. configuring and exporting providers for an entire organization.")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.ShowAdminSettings, out var meta) && meta.IsLocked"/>
     <ConfigurationSelect OptionDescription="@T("Preview feature visibility")" SelectedValue="@(() => this.SettingsManager.ConfigurationData.App.PreviewVisibility)" Data="@ConfigurationSelectDataFactory.GetPreviewVisibility()" SelectionUpdate="@this.UpdatePreviewFeatures" OptionHelp="@T("Do you want to show preview features in the app?")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.PreviewVisibility, out var meta) && meta.IsLocked"/>
 
     @if (this.SettingsManager.ConfigurationData.App.PreviewVisibility > PreviewVisibility.NONE)
@@ -36,4 +37,25 @@
         <ConfigurationSelect OptionDescription="@T("Select a transcription provider")" SelectedValue="@(() => this.SettingsManager.ConfigurationData.App.UseTranscriptionProvider)" Data="@this.GetFilteredTranscriptionProviders()" SelectionUpdate="@(selectedValue => this.SettingsManager.ConfigurationData.App.UseTranscriptionProvider = selectedValue)" OptionHelp="@T("Select a transcription provider for transcribing your voice. Without a selected provider, dictation and transcription features will be disabled.")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.UseTranscriptionProvider, out var meta) && meta.IsLocked"/>
         <ConfigurationShortcut ShortcutId="Shortcut.VOICE_RECORDING_TOGGLE" OptionDescription="@T("Voice recording shortcut")" Shortcut="@(() => this.SettingsManager.ConfigurationData.App.ShortcutVoiceRecording)" ShortcutUpdate="@(shortcut => this.SettingsManager.ConfigurationData.App.ShortcutVoiceRecording = shortcut)" OptionHelp="@T("The global keyboard shortcut for toggling voice recording. This shortcut works system-wide, even when the app is not focused.")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.ShortcutVoiceRecording, out var meta) && meta.IsLocked"/>
     }
+
+    @if (this.SettingsManager.ConfigurationData.App.ShowAdminSettings)
+    {
+        <MudText Typo="Typo.h5" Class="mt-6 mb-3">
+            @T("Enterprise Administration")
+        </MudText>
+
+        <MudText Typo="Typo.body2" Class="mb-3">
+            @T("Generate a 256-bit encryption secret for encrypting API keys in configuration plugins. Deploy this secret to client machines via Group Policy (Windows Registry) or environment variables. Providers can then be exported with encrypted API keys using the export buttons in the provider settings.")
+            <MudLink Href="https://github.com/MindWorkAI/AI-Studio/blob/main/documentation/Enterprise%20IT.md" Target="_blank">
+                @T("Read the Enterprise IT documentation for details.")
+            </MudLink>
+        </MudText>
+
+        <MudButton StartIcon="@Icons.Material.Filled.Key"
+                   Variant="Variant.Filled"
+                   Color="Color.Primary"
+                   OnClick="@this.GenerateEncryptionSecret">
+            @T("Generate an encryption secret and copy it to the clipboard")
+        </MudButton>
+    }
 </ExpansionPanel>

app/MindWork AI Studio/Components/Settings/SettingsPanelApp.razor.cs

@@ -6,6 +6,12 @@ namespace AIStudio.Components.Settings;
 
 public partial class SettingsPanelApp : SettingsPanelBase
 {
+    private async Task GenerateEncryptionSecret()
+    {
+        var secret = EnterpriseEncryption.GenerateSecret();
+        await this.RustService.CopyText2Clipboard(this.Snackbar, secret);
+    }
+
     private IEnumerable<ConfigurationSelectData<string>> GetFilteredTranscriptionProviders()
     {
         yield return new(T("Disable dictation and transcription"), string.Empty);

app/MindWork AI Studio/Components/Settings/SettingsPanelBase.cs

@@ -15,4 +15,7 @@ public abstract class SettingsPanelBase : MSGComponentBase
     
     [Inject]
     protected RustService RustService { get; init; } = null!;
+    
+    [Inject]
+    protected ISnackbar Snackbar { get; init; } = null!;
 }

app/MindWork AI Studio/Components/Settings/SettingsPanelEmbeddings.razor

@@ -1,6 +1,6 @@
 @using AIStudio.Provider
 @using AIStudio.Settings.DataModel
-@inherits SettingsPanelBase
+@inherits SettingsPanelProviderBase
 
 @if (PreviewFeatures.PRE_RAG_2024.IsEnabled(this.SettingsManager))
 {
@@ -22,7 +22,7 @@
                 <col style="width: 12em;"/>
                 <col style="width: 12em;"/>
                 <col/>
-                <col style="width: 16em;"/>
+                <col style="width: 22em;"/>
             </ColGroup>
             <HeaderContent>
                 <MudTh>#</MudTh>
@@ -53,6 +53,9 @@
                             <MudTooltip Text="@T("Edit")">
                                 <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Edit" OnClick="@(() => this.EditEmbeddingProvider(context))"/>
                             </MudTooltip>
+                            <MudTooltip Text="@T("Export configuration")">
+                                <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Dataset" OnClick="@(() => this.ExportEmbeddingProvider(context))"/>
+                            </MudTooltip>
                             <MudTooltip Text="@T("Delete")">
                                 <MudIconButton Color="Color.Error" Icon="@Icons.Material.Filled.Delete" OnClick="@(() => this.DeleteEmbeddingProvider(context))"/>
                             </MudTooltip>

app/MindWork AI Studio/Components/Settings/SettingsPanelEmbeddings.razor.cs

@@ -7,7 +7,7 @@ using DialogOptions = AIStudio.Dialogs.DialogOptions;
 
 namespace AIStudio.Components.Settings;
 
-public partial class SettingsPanelEmbeddings : SettingsPanelBase
+public partial class SettingsPanelEmbeddings : SettingsPanelProviderBase
 {
     [Parameter]
     public List<ConfigurationSelectData<string>> AvailableEmbeddingProviders { get; set; } = new();
@@ -115,6 +115,14 @@ public partial class SettingsPanelEmbeddings : SettingsPanelBase
         await this.MessageBus.SendMessage<bool>(this, Event.CONFIGURATION_CHANGED);
     }
 
+    private async Task ExportEmbeddingProvider(EmbeddingProvider provider)
+    {
+        if (provider == EmbeddingProvider.NONE)
+            return;
+
+        await this.ExportProvider(provider, SecretStoreType.EMBEDDING_PROVIDER, provider.ExportAsConfigurationSection);
+    }
+    
     private async Task UpdateEmbeddingProviders()
     {
         this.AvailableEmbeddingProviders.Clear();

app/MindWork AI Studio/Components/Settings/SettingsPanelProviderBase.cs

@@ -0,0 +1,61 @@
+using AIStudio.Dialogs;
+using AIStudio.Tools.PluginSystem;
+
+using DialogOptions = AIStudio.Dialogs.DialogOptions;
+
+namespace AIStudio.Components.Settings;
+
+public abstract class SettingsPanelProviderBase : SettingsPanelBase
+{
+    private static string TB(string fallbackEN) => I18N.I.T(fallbackEN, typeof(SettingsPanelProviderBase).Namespace, nameof(SettingsPanelProviderBase));
+
+    /// <summary>
+    /// Exports the provider configuration as Lua code, optionally including the encrypted API key if the provider has one
+    /// configured and the user agrees to include it. The exportFunc should generate the Lua code based on the provided
+    /// encrypted API key (which may be null if the user chose not to include it or if encryption is not available).
+    /// The generated Lua code is then copied to the clipboard for easy sharing.
+    /// </summary>
+    /// <param name="secretId">The secret ID of the provider to check for an API key.</param>
+    /// <param name="storeType">The type of secret store to check for the API key (e.g., LLM provider, transcription provider, etc.).</param>
+    /// <param name="exportFunc">The function that generates the Lua code for the provider configuration, given the optional encrypted API key.</param>
+    protected async Task ExportProvider(ISecretId secretId, SecretStoreType storeType, Func<string?, string> exportFunc)
+    {
+        string? encryptedApiKey = null;
+
+        // Check if the provider has an API key stored:
+        var apiKeyResponse = await this.RustService.GetAPIKey(secretId, storeType, isTrying: true);
+        if (apiKeyResponse.Success)
+        {
+            // Ask the user if they want to export the API key:
+            var dialogParameters = new DialogParameters<ConfirmDialog>
+            {
+                { x => x.Message, TB("This provider has an API key configured. Do you want to include the encrypted API key in the export? Note: The recipient will need the same encryption secret to use the API key.") },
+            };
+
+            var dialogReference = await this.DialogService.ShowAsync<ConfirmDialog>(TB("Export API Key?"), dialogParameters, DialogOptions.FULLSCREEN);
+            var dialogResult = await dialogReference.Result;
+            if (dialogResult is { Canceled: false })
+            {
+                // User wants to export the API key - encrypt it:
+                var encryption = PluginFactory.EnterpriseEncryption;
+                if (encryption?.IsAvailable == true)
+                {
+                    var decryptedApiKey = await apiKeyResponse.Secret.Decrypt(Program.ENCRYPTION);
+                    if (encryption.TryEncrypt(decryptedApiKey, out var encrypted))
+                        encryptedApiKey = encrypted;
+                }
+                else
+                {
+                    // No encryption secret available - inform the user:
+                    this.Snackbar.Add(TB("Cannot export the encrypted API key: No enterprise encryption secret is configured."), Severity.Warning);
+                }
+            }
+        }
+
+        var luaCode = exportFunc(encryptedApiKey);
+        if (string.IsNullOrWhiteSpace(luaCode))
+            return;
+
+        await this.RustService.CopyText2Clipboard(this.Snackbar, luaCode);
+    }
+}

app/MindWork AI Studio/Components/Settings/SettingsPanelProviders.razor

@@ -1,6 +1,6 @@
 @using AIStudio.Provider
 @using AIStudio.Settings
-@inherits SettingsPanelBase
+@inherits SettingsPanelProviderBase
 
 <ExpansionPanel HeaderIcon="@Icons.Material.Filled.Layers" HeaderText="@T("Configure LLM Providers")">
     <MudText Typo="Typo.h4" Class="mb-3">
@@ -15,7 +15,7 @@
             <col style="width: 12em;"/>
             <col style="width: 12em;"/>
             <col/>
-            <col style="width: 16em;"/>
+            <col style="width: 22em;"/>
         </ColGroup>
         <HeaderContent>
             <MudTh>#</MudTh>
@@ -45,6 +45,9 @@
                         <MudTooltip Text="@T("Edit")">
                             <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Edit" OnClick="@(() => this.EditLLMProvider(context))"/>
                         </MudTooltip>
+                        <MudTooltip Text="@T("Export configuration")">
+                            <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Dataset" OnClick="@(() => this.ExportLLMProvider(context))"/>
+                        </MudTooltip>
                         <MudTooltip Text="@T("Delete")">
                             <MudIconButton Color="Color.Error" Icon="@Icons.Material.Filled.Delete" OnClick="@(() => this.DeleteLLMProvider(context))"/>
                         </MudTooltip>

app/MindWork AI Studio/Components/Settings/SettingsPanelProviders.razor.cs

@@ -10,7 +10,7 @@ using DialogOptions = AIStudio.Dialogs.DialogOptions;
 
 namespace AIStudio.Components.Settings;
 
-public partial class SettingsPanelProviders : SettingsPanelBase
+public partial class SettingsPanelProviders : SettingsPanelProviderBase
 {
     [Parameter]
     public List<ConfigurationSelectData<string>> AvailableLLMProviders { get; set; } = new();
@@ -134,6 +134,14 @@ public partial class SettingsPanelProviders : SettingsPanelBase
         await this.MessageBus.SendMessage<bool>(this, Event.CONFIGURATION_CHANGED);
     }
 
+    private async Task ExportLLMProvider(AIStudio.Settings.Provider provider)
+    {
+        if (provider == AIStudio.Settings.Provider.NONE)
+            return;
+
+        await this.ExportProvider(provider, SecretStoreType.LLM_PROVIDER, provider.ExportAsConfigurationSection);
+    }
+
     private string GetLLMProviderModelName(AIStudio.Settings.Provider provider)
     {
         // For system models, return localized text:

app/MindWork AI Studio/Components/Settings/SettingsPanelTranscription.razor

@@ -1,6 +1,6 @@
 @using AIStudio.Provider
 @using AIStudio.Settings.DataModel
-@inherits SettingsPanelBase
+@inherits SettingsPanelProviderBase
 
 @if (PreviewFeatures.PRE_SPEECH_TO_TEXT_2026.IsEnabled(this.SettingsManager))
 {
@@ -19,7 +19,7 @@
                 <col style="width: 12em;"/>
                 <col style="width: 12em;"/>
                 <col/>
-                <col style="width: 16em;"/>
+                <col style="width: 22em;"/>
             </ColGroup>
             <HeaderContent>
                 <MudTh>#</MudTh>
@@ -50,6 +50,9 @@
                             <MudTooltip Text="@T("Edit")">
                                 <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Edit" OnClick="@(() => this.EditTranscriptionProvider(context))"/>
                             </MudTooltip>
+                            <MudTooltip Text="@T("Export configuration")">
+                                <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Dataset" OnClick="@(() => this.ExportTranscriptionProvider(context))"/>
+                            </MudTooltip>
                             <MudTooltip Text="@T("Delete")">
                                 <MudIconButton Color="Color.Error" Icon="@Icons.Material.Filled.Delete" OnClick="@(() => this.DeleteTranscriptionProvider(context))"/>
                             </MudTooltip>

app/MindWork AI Studio/Components/Settings/SettingsPanelTranscription.razor.cs

@@ -7,7 +7,7 @@ using DialogOptions = AIStudio.Dialogs.DialogOptions;
 
 namespace AIStudio.Components.Settings;
 
-public partial class SettingsPanelTranscription : SettingsPanelBase
+public partial class SettingsPanelTranscription : SettingsPanelProviderBase
 {
     [Parameter]
     public List<ConfigurationSelectData<string>> AvailableTranscriptionProviders { get; set; } = new();
@@ -115,6 +115,14 @@ public partial class SettingsPanelTranscription : SettingsPanelBase
         await this.MessageBus.SendMessage<bool>(this, Event.CONFIGURATION_CHANGED);
     }
 
+    private async Task ExportTranscriptionProvider(TranscriptionProvider provider)
+    {
+        if (provider == TranscriptionProvider.NONE)
+            return;
+
+        await this.ExportProvider(provider, SecretStoreType.TRANSCRIPTION_PROVIDER, provider.ExportAsConfigurationSection);
+    }
+    
     private async Task UpdateTranscriptionProviders()
     {
         this.AvailableTranscriptionProviders.Clear();

app/MindWork AI Studio/Components/Workspaces.razor

@@ -36,7 +36,7 @@
                                     </MudTooltip>
 
                                     <MudTooltip Text="@T("Delete")" Placement="@WORKSPACE_ITEM_TOOLTIP_PLACEMENT">
-                                        <MudIconButton Icon="@Icons.Material.Filled.Delete" Size="Size.Medium" Color="Color.Inherit" OnClick="@(() => this.DeleteChat(treeItem.Path))"/>
+                                        <MudIconButton Icon="@Icons.Material.Filled.Delete" Size="Size.Medium" Color="Color.Error" OnClick="@(() => this.DeleteChat(treeItem.Path))"/>
                                     </MudTooltip>
                                 </div>
                             </div>
@@ -57,7 +57,7 @@
                                     </MudTooltip>
 
                                     <MudTooltip Text="@T("Delete")" Placement="@WORKSPACE_ITEM_TOOLTIP_PLACEMENT">
-                                        <MudIconButton Icon="@Icons.Material.Filled.Delete" Size="Size.Medium" Color="Color.Inherit" OnClick="@(() => this.DeleteWorkspace(treeItem.Path))"/>
+                                        <MudIconButton Icon="@Icons.Material.Filled.Delete" Size="Size.Medium" Color="Color.Error" OnClick="@(() => this.DeleteWorkspace(treeItem.Path))"/>
                                     </MudTooltip>
                                 </div>
                             </div>

app/MindWork AI Studio/Layout/MainLayout.razor.cs

@@ -215,6 +215,9 @@ public partial class MainLayout : LayoutComponentBase, IMessageBusReceiver, ILan
                             if (enterpriseEnvironment != default)
                                 await PluginFactory.TryDownloadingConfigPluginAsync(enterpriseEnvironment.ConfigurationId, enterpriseEnvironment.ConfigurationServerUrl);
 
+                            // Initialize the enterprise encryption service for decrypting API keys:
+                            await PluginFactory.InitializeEnterpriseEncryption(this.RustService);
+
                             // Load (but not start) all plugins without waiting for them:
                             #if DEBUG
                             var pluginLoadingTimeout = new CancellationTokenSource();

app/MindWork AI Studio/MindWork AI Studio.csproj

@@ -52,6 +52,7 @@
       <PackageReference Include="Microsoft.Extensions.FileProviders.Embedded" Version="9.0.12" />
       <PackageReference Include="MudBlazor" Version="8.15.0" />
       <PackageReference Include="MudBlazor.Markdown" Version="8.11.0" />
+      <PackageReference Include="Qdrant.Client" Version="1.16.1" />
       <PackageReference Include="ReverseMarkdown" Version="5.0.0" />
       <PackageReference Include="LuaCSharp" Version="0.5.3" />
     </ItemGroup>
@@ -81,6 +82,7 @@
             <MetaAppCommitHash>$([System.String]::Copy( $(Metadata) ).Split( ';' )[ 8 ])</MetaAppCommitHash>
             <MetaArchitecture>$([System.String]::Copy( $(Metadata) ).Split( ';' )[ 9 ])</MetaArchitecture>
             <MetaPdfiumVersion>$([System.String]::Copy( $(Metadata) ).Split( ';' )[ 10 ])</MetaPdfiumVersion>
+            <MetaQdrantVersion>$([System.String]::Copy( $(Metadata) ).Split( ';' )[ 11 ])</MetaQdrantVersion>
             
             <GenerateAssemblyInfo>true</GenerateAssemblyInfo>
             
@@ -108,6 +110,9 @@
             <AssemblyAttribute Include="AIStudio.Tools.Metadata.MetaDataLibraries">
                 <_Parameter1>$(MetaPdfiumVersion)</_Parameter1>
             </AssemblyAttribute>
+            <AssemblyAttribute Include="AIStudio.Tools.Metadata.MetaDataDatabases">
+                <_Parameter1>$(MetaQdrantVersion)</_Parameter1>
+            </AssemblyAttribute>
         </ItemGroup>
         
     </Target>

app/MindWork AI Studio/Pages/Information.razor

@@ -1,4 +1,5 @@
 @attribute [Route(Routes.ABOUT)]
+@using AIStudio.Tools.PluginSystem
 @using AIStudio.Tools.Services
 @inherits MSGComponentBase
 
@@ -19,6 +20,29 @@
                     <MudListItem T="string" Icon="@Icons.Material.Outlined.Build" Text="@this.VersionDotnetSdk"/>
                     <MudListItem T="string" Icon="@Icons.Material.Outlined.Memory" Text="@this.VersionDotnetRuntime"/>
                     <MudListItem T="string" Icon="@Icons.Material.Outlined.Build" Text="@this.VersionRust"/>
+                    <MudListItem T="string" Icon="@Icons.Material.Outlined.Storage">
+                        <MudText Typo="Typo.body1">
+                            @this.VersionDatabase
+                        </MudText>
+                        <MudCollapse Expanded="@this.showDatabaseDetails">
+                            <MudText Typo="Typo.body1" Class="mt-2 mb-2">
+                                @foreach (var item in this.databaseDisplayInfo)
+                                {
+                                    <div style="display: flex; align-items: center; gap: 8px;">
+                                        <MudIcon Icon="@Icons.Material.Filled.ArrowRightAlt"/>
+                                        <span>@item.Label: @item.Value</span>
+                                        <MudCopyClipboardButton TooltipMessage="@(T("Copies the following to the clipboard")+": "+item.Value)" StringContent=@item.Value/>
+                                    </div>
+                                }
+                            </MudText>
+                        </MudCollapse>
+                        <MudButton StartIcon="@(this.showDatabaseDetails ? Icons.Material.Filled.ExpandLess : Icons.Material.Filled.ExpandMore)"
+                                   Size="Size.Small"
+                                   Variant="Variant.Text"
+                                   OnClick="@this.ToggleDatabaseDetails">
+                            @(this.showDatabaseDetails ? T("Hide Details") : T("Show Details"))
+                        </MudButton>
+                    </MudListItem>
                     <MudListItem T="string" Icon="@Icons.Material.Outlined.DocumentScanner" Text="@this.VersionPdfium"/>
                     <MudListItem T="string" Icon="@Icons.Material.Outlined.Article" Text="@this.versionPandoc"/>
                     <MudListItem T="string" Icon="@Icons.Material.Outlined.Widgets" Text="@MudBlazorVersion"/>
@@ -45,6 +69,21 @@
                                             <MudCopyClipboardButton TooltipMessage="@T("Copies the configuration plugin ID to the clipboard")" StringContent=@this.configPlug!.Id.ToString()/>
                                         </div>
                                     </MudText>
+                                    <MudText Typo="Typo.body1" Class="mt-2 mb-2">
+                                        <div style="display: flex; align-items: center; gap: 8px;">
+                                            <MudIcon Icon="@Icons.Material.Filled.ArrowRightAlt"/>
+                                            @if (PluginFactory.EnterpriseEncryption?.IsAvailable is true)
+                                            {
+                                                <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small"/>
+                                                <span>@T("Encryption secret: is configured")</span>
+                                            }
+                                            else
+                                            {
+                                                <MudIcon Icon="@Icons.Material.Filled.Cancel" Color="Color.Error" Size="Size.Small"/>
+                                                <span>@T("Encryption secret: is not configured")</span>
+                                            }
+                                        </div>
+                                    </MudText>
                                 </MudCollapse>
                                 break;
 
@@ -68,6 +107,21 @@
                                             <MudCopyClipboardButton TooltipMessage="@T("Copies the server URL to the clipboard")" StringContent=@EnterpriseEnvironmentService.CURRENT_ENVIRONMENT.ConfigurationServerUrl/>
                                         </div>
                                     </MudText>
+                                    <MudText Typo="Typo.body1" Class="mt-2 mb-2">
+                                        <div style="display: flex; align-items: center; gap: 8px;">
+                                            <MudIcon Icon="@Icons.Material.Filled.ArrowRightAlt"/>
+                                            @if (PluginFactory.EnterpriseEncryption?.IsAvailable is true)
+                                            {
+                                                <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small"/>
+                                                <span>@T("Encryption secret: is configured")</span>
+                                            }
+                                            else
+                                            {
+                                                <MudIcon Icon="@Icons.Material.Filled.Cancel" Color="Color.Error" Size="Size.Small"/>
+                                                <span>@T("Encryption secret: is not configured")</span>
+                                            }
+                                        </div>
+                                    </MudText>
                                 </MudCollapse>
                                 break;
 
@@ -99,6 +153,21 @@
                                             <MudCopyClipboardButton TooltipMessage="@T("Copies the configuration plugin ID to the clipboard")" StringContent=@this.configPlug!.Id.ToString()/>
                                         </div>
                                     </MudText>
+                                    <MudText Typo="Typo.body1" Class="mt-2 mb-2">
+                                        <div style="display: flex; align-items: center; gap: 8px;">
+                                            <MudIcon Icon="@Icons.Material.Filled.ArrowRightAlt"/>
+                                            @if (PluginFactory.EnterpriseEncryption?.IsAvailable is true)
+                                            {
+                                                <MudIcon Icon="@Icons.Material.Filled.CheckCircle" Color="Color.Success" Size="Size.Small"/>
+                                                <span>@T("Encryption secret: is configured")</span>
+                                            }
+                                            else
+                                            {
+                                                <MudIcon Icon="@Icons.Material.Filled.Cancel" Color="Color.Error" Size="Size.Small"/>
+                                                <span>@T("Encryption secret: is not configured")</span>
+                                            }
+                                        </div>
+                                    </MudText>
                                 </MudCollapse>
                                 break;
                         }
@@ -194,6 +263,7 @@
                     <ThirdPartyComponent Name="CodeBeam.MudBlazor.Extensions" Developer="Mehmet Can Karagöz & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/CodeBeamOrg/CodeBeam.MudBlazor.Extensions/blob/dev/LICENSE" RepositoryUrl="https://github.com/CodeBeamOrg/CodeBeam.MudBlazor.Extensions" UseCase="@T("This library is used to extend the MudBlazor library. It provides additional components that are not part of the MudBlazor library.")"/>
                     <ThirdPartyComponent Name="Rust" Developer="Graydon Hoare, Rust Foundation, Rust developers & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/rust-lang/rust/blob/master/LICENSE-MIT" RepositoryUrl="https://github.com/rust-lang/rust" UseCase="@T("The .NET backend cannot be started as a desktop app. Therefore, I use a second backend in Rust, which I call runtime. With Rust as the runtime, Tauri can be used to realize a typical desktop app. Thanks to Rust, this app can be offered for Windows, macOS, and Linux desktops. Rust is a great language for developing safe and high-performance software.")"/>
                     <ThirdPartyComponent Name="Tauri" Developer="Daniel Thompson-Yvetot, Lucas Nogueira, Tensor, Boscop, Serge Zaitsev, George Burton & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/tauri-apps/tauri/blob/dev/LICENSE_MIT" RepositoryUrl="https://github.com/tauri-apps/tauri" UseCase="@T("Tauri is used to host the Blazor user interface. It is a great project that allows the creation of desktop applications using web technologies. I love Tauri!")"/>
+                    <ThirdPartyComponent Name="Qdrant" Developer="Andrey Vasnetsov, Tim Visée, Arnaud Gourlay, Luis Cossío, Ivan Pleshkov, Roman Titov, xzfc, JojiiOfficial & Open Source Community" LicenseName="Apache-2.0" LicenseUrl="https://github.com/qdrant/qdrant/blob/master/LICENSE" RepositoryUrl="https://github.com/qdrant/qdrant" UseCase="@T("Qdrant is a vector database and vector similarity search engine. We use it to realize local RAG—retrieval-augmented generation—within AI Studio. Thanks for the effort and great work that has been and is being put into Qdrant.")"/>
                     <ThirdPartyComponent Name="Rocket" Developer="Sergio Benitez & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/rwf2/Rocket/blob/master/LICENSE-MIT" RepositoryUrl="https://github.com/rwf2/Rocket" UseCase="@T("We use Rocket to implement the runtime API. This is necessary because the runtime must be able to communicate with the user interface (IPC). Rocket is a great framework for implementing web APIs in Rust.")"/>
                     <ThirdPartyComponent Name="serde" Developer="Erick Tryzelaar, David Tolnay & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/serde-rs/serde/blob/master/LICENSE-MIT" RepositoryUrl="https://github.com/serde-rs/serde" UseCase="@T("Now we have multiple systems, some developed in .NET and others in Rust. The data format JSON is responsible for translating data between both worlds (called data serialization and deserialization). Serde takes on this task in the Rust world. The counterpart in the .NET world is an integral part of .NET and is located in System.Text.Json.")"/>
                     <ThirdPartyComponent Name="strum_macros" Developer="Peter Glotfelty & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/Peternator7/strum/blob/master/LICENSE" RepositoryUrl="https://github.com/Peternator7/strum" UseCase="@T("This crate provides derive macros for Rust enums, which we use to reduce boilerplate when implementing string conversions and metadata for runtime types. This is helpful for the communication between our Rust and .NET systems.")"/>
@@ -214,6 +284,8 @@
                     <ThirdPartyComponent Name="PDFium" Developer="Lei Zhang, Tom Sepez, Dan Sinclair, and Foxit, Google, Chromium, Collabora, Ada, DocsCorp, Dropbox, Microsoft, and PSPDFKit Teams & Open Source Community" LicenseName="Apache-2.0" LicenseUrl="https://pdfium.googlesource.com/pdfium/+/refs/heads/main/LICENSE" RepositoryUrl="https://pdfium.googlesource.com/pdfium" UseCase="@T("This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.")"/>
                     <ThirdPartyComponent Name="pdfium-render" Developer="Alastair Carey, Dorian Rudolph & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/ajrcarey/pdfium-render/blob/master/LICENSE.md" RepositoryUrl="https://github.com/ajrcarey/pdfium-render" UseCase="@T("This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.")"/>
                     <ThirdPartyComponent Name="sys-locale" Developer="1Password Team, ComplexSpaces & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/1Password/sys-locale/blob/main/LICENSE-MIT" RepositoryUrl="https://github.com/1Password/sys-locale" UseCase="@T("This library is used to determine the language of the operating system. This is necessary to set the language of the user interface.")"/>
+                    <ThirdPartyComponent Name="sysinfo" Developer="Guillaume Gomez & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/GuillaumeGomez/sysinfo/blob/main/LICENSE" RepositoryUrl="https://github.com/GuillaumeGomez/sysinfo" UseCase="@T("This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated.")"/>
+                    <ThirdPartyComponent Name="tempfile" Developer="Steven Allen, Ashley Mannix & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/Stebalien/tempfile/blob/master/LICENSE-MIT" RepositoryUrl="https://github.com/Stebalien/tempfile" UseCase="@T("This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant.")"/>
                     <ThirdPartyComponent Name="Lua-CSharp" Developer="Yusuke Nakada & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/nuskey8/Lua-CSharp/blob/main/LICENSE" RepositoryUrl="https://github.com/nuskey8/Lua-CSharp" UseCase="@T("We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library.")" />
                     <ThirdPartyComponent Name="HtmlAgilityPack" Developer="ZZZ Projects & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/zzzprojects/html-agility-pack/blob/master/LICENSE" RepositoryUrl="https://github.com/zzzprojects/html-agility-pack" UseCase="@T("We use the HtmlAgilityPack to extract content from the web. This is necessary, e.g., when you provide a URL as input for an assistant.")"/>
                     <ThirdPartyComponent Name="ReverseMarkdown" Developer="Babu Annamalai & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/mysticmind/reversemarkdown-net/blob/master/LICENSE" RepositoryUrl="https://github.com/mysticmind/reversemarkdown-net" UseCase="@T("This library is used to convert HTML to Markdown. This is necessary, e.g., when you provide a URL as input for an assistant.")"/>

app/MindWork AI Studio/Pages/Information.razor.cs

@@ -2,6 +2,7 @@ using System.Reflection;
 
 using AIStudio.Components;
 using AIStudio.Dialogs;
+using AIStudio.Tools.Databases;
 using AIStudio.Tools.Metadata;
 using AIStudio.Tools.PluginSystem;
 using AIStudio.Tools.Rust;
@@ -26,10 +27,14 @@ public partial class Information : MSGComponentBase
     [Inject]
     private ISnackbar Snackbar { get; init; } = null!;
     
+    [Inject]
+    private DatabaseClient DatabaseClient { get; init; } = null!;
+    
     private static readonly Assembly ASSEMBLY = Assembly.GetExecutingAssembly();
     private static readonly MetaDataAttribute META_DATA = ASSEMBLY.GetCustomAttribute<MetaDataAttribute>()!;
     private static readonly MetaDataArchitectureAttribute META_DATA_ARCH = ASSEMBLY.GetCustomAttribute<MetaDataArchitectureAttribute>()!;
     private static readonly MetaDataLibrariesAttribute META_DATA_LIBRARIES = ASSEMBLY.GetCustomAttribute<MetaDataLibrariesAttribute>()!;
+    private static readonly MetaDataDatabasesAttribute META_DATA_DATABASES = ASSEMBLY.GetCustomAttribute<MetaDataDatabasesAttribute>()!;
     
     private static string TB(string fallbackEN) => I18N.I.T(fallbackEN, typeof(Information).Namespace, nameof(Information));
 
@@ -53,6 +58,8 @@ public partial class Information : MSGComponentBase
     
     private string VersionPdfium => $"{T("Used PDFium version")}: v{META_DATA_LIBRARIES.PdfiumVersion}";
     
+    private string VersionDatabase => $"{T("Database version")}: {this.DatabaseClient.Name} v{META_DATA_DATABASES.DatabaseVersion}";
+    
     private string versionPandoc = TB("Determine Pandoc version, please wait...");
     private PandocInstallation pandocInstallation;
 
@@ -60,8 +67,14 @@ public partial class Information : MSGComponentBase
     
     private bool showEnterpriseConfigDetails;
 
+    private bool showDatabaseDetails;
+
     private IPluginMetadata? configPlug = PluginFactory.AvailablePlugins.FirstOrDefault(x => x.Type is PluginType.CONFIGURATION);
     
+    private sealed record DatabaseDisplayInfo(string Label, string Value);
+
+    private readonly List<DatabaseDisplayInfo> databaseDisplayInfo = new();
+
     /// <summary>
     /// Determines whether the enterprise configuration has details that can be shown/hidden.
     /// Returns true if there are details available, false otherwise.
@@ -96,6 +109,11 @@ public partial class Information : MSGComponentBase
         this.osLanguage = await this.RustService.ReadUserLanguage();
         this.logPaths = await this.RustService.GetLogPaths();
         
+        await foreach (var (label, value) in this.DatabaseClient.GetDisplayInfo())
+        {
+            this.databaseDisplayInfo.Add(new DatabaseDisplayInfo(label, value));
+        }
+        
         // Determine the Pandoc version may take some time, so we start it here
         // without waiting for the result:
         _ = this.DeterminePandocVersion();
@@ -171,6 +189,11 @@ public partial class Information : MSGComponentBase
         this.showEnterpriseConfigDetails = !this.showEnterpriseConfigDetails;
     }
     
+    private void ToggleDatabaseDetails()
+    {
+        this.showDatabaseDetails = !this.showDatabaseDetails;
+    }
+
     private async Task CopyStartupLogPath()
     {
         await this.RustService.CopyText2Clipboard(this.Snackbar, this.logPaths.LogStartupPath);

app/MindWork AI Studio/Pages/Plugins.razor

@@ -63,6 +63,7 @@
                     </MudStack>
                 </MudTd>
                 <MudTd>
+                    <MudStack Row="true" Spacing="1" AlignItems="AlignItems.Center">
                         @if (context is { IsInternal: false, Type: not PluginType.CONFIGURATION })
                         {
                             var isEnabled = this.SettingsManager.IsPluginEnabled(context);
@@ -70,6 +71,25 @@
                                 <MudSwitch T="bool" Value="@isEnabled" ValueChanged="@(_ => this.PluginActivationStateChanged(context))"/>
                             </MudTooltip>
                         }
+                        
+                        @if (context is { IsInternal: false } && !string.IsNullOrWhiteSpace(context.SourceURL))
+                        {
+                            var sourceUrl = context.SourceURL;
+                            var isSendingMail = IsSendingMail(sourceUrl);
+                            if(isSendingMail)
+                            {
+                                <MudTooltip Text="@T("Send a mail")">
+                                    <MudIconButton Icon="@Icons.Material.Filled.Email" Href="@sourceUrl" Target="_blank" Size="Size.Medium"/>
+                                </MudTooltip>
+                            }
+                            else
+                            {
+                                <MudTooltip Text="@T("Open website")">
+                                    <MudIconButton Icon="@Icons.Material.Filled.OpenInBrowser" Href="@sourceUrl" Target="_blank" Size="Size.Medium"/>
+                                </MudTooltip>
+                            }
+                        }
+                    </MudStack>
                 </MudTd>
             </RowTemplate>
         </MudTable>

app/MindWork AI Studio/Pages/Plugins.razor.cs

@@ -50,6 +50,8 @@ public partial class Plugins : MSGComponentBase
         await this.MessageBus.SendMessage<bool>(this, Event.CONFIGURATION_CHANGED);
     }
     
+    private static bool IsSendingMail(string sourceUrl) => sourceUrl.TrimStart().StartsWith("mailto:", StringComparison.OrdinalIgnoreCase);
+
     #region Overrides of MSGComponentBase
 
     protected override async Task ProcessIncomingMessage<T>(ComponentBase? sendingComponent, Event triggeredEvent, T? data) where T : default

app/MindWork AI Studio/Plugins/configuration/plugin.lua

@@ -30,7 +30,12 @@ AUTHORS = {"<Company Name>"}
 -- The support contact for the plugin:
 SUPPORT_CONTACT = "<IT Department of Company Name>"
 
--- The source URL for the plugin:
+-- The source URL for the plugin. Can be a HTTP(S) URL or an mailto link.
+-- You may link to an internal documentation page, a Git repository, or
+-- to a support or wiki page.
+--
+-- A mailto link could look like:
+-- SOURCE_URL = "mailto:helpdesk@company.org?subject=Help"
 SOURCE_URL = "<Any internal Git repository>"
 
 -- The categories for the plugin:
@@ -64,6 +69,20 @@ CONFIG["LLM_PROVIDERS"] = {}
 --     -- Could be something like ... \"temperature\": 0.5, \"max_tokens\": 1000 ... for multiple parameters.
 --     -- Please do not add the enclosing curly braces {} here. Also, no trailing comma is allowed.
 --     ["AdditionalJsonApiParameters"] = "",
+--
+--     -- Optional: Hugging Face inference provider. Only relevant for UsedLLMProvider = HUGGINGFACE.
+--     -- Allowed values are: CEREBRAS, NEBIUS_AI_STUDIO, SAMBANOVA, NOVITA, HYPERBOLIC, TOGETHER_AI, FIREWORKS, HF_INFERENCE_API
+--     -- ["HFInferenceProvider"] = "NOVITA",
+--
+--     -- Optional: Encrypted API key for cloud providers or secured on-premise models.
+--     -- The API key must be encrypted using the enterprise encryption secret.
+--     -- Format: "ENC:v1:<base64-encoded encrypted data>"
+--     -- The encryption secret must be configured via:
+--     --   Windows Registry: HKEY_CURRENT_USER\Software\github\MindWork AI Studio\Enterprise IT\config_encryption_secret
+--     --   Environment variable: MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_ENCRYPTION_SECRET
+--     -- You can export an encrypted API key from an existing provider using the export button in the settings.
+--     -- ["APIKey"] = "ENC:v1:<base64-encoded encrypted data>",
+--
 --     ["Model"] = {
 --         ["Id"] = "<the model ID>",
 --         ["DisplayName"] = "<user-friendly name of the model>",
@@ -82,6 +101,10 @@ CONFIG["TRANSCRIPTION_PROVIDERS"] = {}
 --     -- Allowed values for Host are: LM_STUDIO, LLAMACPP, OLLAMA, VLLM, and WHISPER_CPP
 --     ["Host"] = "WHISPER_CPP",
 --     ["Hostname"] = "<https address of the server>",
+--
+--     -- Optional: Encrypted API key (see LLM_PROVIDERS example for details)
+--     -- ["APIKey"] = "ENC:v1:<base64-encoded encrypted data>",
+--
 --     ["Model"] = {
 --         ["Id"] = "<the model ID>",
 --         ["DisplayName"] = "<user-friendly name of the model>",
@@ -100,6 +123,10 @@ CONFIG["EMBEDDING_PROVIDERS"] = {}
 --     -- Allowed values for Host are: LM_STUDIO, LLAMACPP, OLLAMA, and VLLM
 --     ["Host"] = "OLLAMA",
 --     ["Hostname"] = "<https address of the server>",
+--
+--     -- Optional: Encrypted API key (see LLM_PROVIDERS example for details)
+--     -- ["APIKey"] = "ENC:v1:<base64-encoded encrypted data>",
+--
 --     ["Model"] = {
 --         ["Id"] = "<the model ID, e.g., nomic-embed-text>",
 --         ["DisplayName"] = "<user-friendly name of the model>",
@@ -120,6 +147,10 @@ CONFIG["SETTINGS"] = {}
 -- Allowed values are: true, false
 -- CONFIG["SETTINGS"]["DataApp.AllowUserToAddProvider"] = false
 
+-- Configure whether administration settings are visible in the UI:
+-- Allowed values are: true, false
+-- CONFIG["SETTINGS"]["DataApp.ShowAdminSettings"] = true
+
 -- Configure the visibility of preview features:
 -- Allowed values are: NONE, RELEASE_CANDIDATE, BETA, ALPHA, PROTOTYPE, EXPERIMENTAL
 -- Please note:

app/MindWork AI Studio/Plugins/languages/de-de-43065dbc-78d0-45b7-92be-f14c2926e2dc/plugin.lua

@@ -2082,12 +2082,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T1898060643"]
 -- Select the language for the app.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T1907446663"] = "Wählen Sie die Sprache für die App aus."
 
+-- When enabled, additional administration options become visible. These options are intended for IT staff to manage organization-wide configuration, e.g. configuring and exporting providers for an entire organization.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2013281167"] = "Wenn diese Option aktiviert ist, werden zusätzliche Optionen für die Administration angezeigt. Diese Optionen sind für IT-Mitarbeitende vorgesehen, um organisationsweite Einstellungen zu verwalten, z. B. Anbieter für eine gesamte Organisation zu konfigurieren und zu exportieren."
+
 -- The global keyboard shortcut for toggling voice recording. This shortcut works system-wide, even when the app is not focused.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2143741496"] = "Der globale Tastaturkurzbefehl zum Ein- und Ausschalten der Sprachaufnahme. Dieser Kurzbefehl funktioniert systemweit, auch wenn die App nicht im Vordergrund ist."
 
 -- Disable dictation and transcription
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T215381891"] = "Diktieren und Transkribieren deaktivieren"
 
+-- Enterprise Administration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2277116008"] = "Unternehmensverwaltung"
+
 -- Language behavior
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2341504363"] = "Sprachverhalten"
 
@@ -2097,6 +2103,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T237706157"]
 -- Language
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2591284123"] = "Sprache"
 
+-- Administration settings are visible
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2591866808"] = "Die Optionen für die Administration sind sichtbar."
+
 -- Save energy?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3100928009"] = "Energie sparen?"
 
@@ -2106,9 +2115,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3165555978"]
 -- App Options
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3577148634"] = "App-Einstellungen"
 
+-- Generate a 256-bit encryption secret for encrypting API keys in configuration plugins. Deploy this secret to client machines via Group Policy (Windows Registry) or environment variables. Providers can then be exported with encrypted API keys using the export buttons in the provider settings.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T362833"] = "Generieren Sie ein 256‑Bit‑Geheimnis für die Verschlüsselung, um API‑Schlüssel in Konfigurations-Plugins zu verschlüsseln. Stellen Sie dieses Geheimnis über Gruppenrichtlinien (Windows-Registrierung) oder über Umgebungsvariablen auf Client-Geräten bereit. Anschließend können Anbieter über die Export-Schaltflächen in den Anbieter-Einstellungen mit verschlüsselten API‑Schlüsseln exportiert werden."
+
 -- When enabled, streamed content from the AI is updated once every third second. When disabled, streamed content will be updated as soon as it is available.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3652888444"] = "Wenn aktiviert, wird gestreamter Inhalt von der KI alle drei Sekunden aktualisiert. Wenn deaktiviert, wird gestreamter Inhalt sofort aktualisiert, sobald er verfügbar ist."
 
+-- Show administration settings?
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3694781396"] = "Optionen für die Administration anzeigen?"
+
+-- Read the Enterprise IT documentation for details.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3705451321"] = "Lesen Sie die Enterprise-IT-Dokumentation für die Details."
+
 -- Enable spellchecking?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3914529369"] = "Rechtschreibprüfung aktivieren?"
 
@@ -2142,6 +2160,12 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T817101267"]
 -- Would you like to set one provider as the default for the entire app? When you configure a different provider for an assistant, it will always take precedence.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T844514734"] = "Möchten Sie einen Anbieter als Standard für die gesamte App festlegen? Wenn Sie einen anderen Anbieter für einen Assistenten konfigurieren, hat dieser immer Vorrang."
 
+-- Generate an encryption secret and copy it to the clipboard
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T922066419"] = "Geheimnis für die Verschlüsselung generieren und in die Zwischenablage kopieren"
+
+-- Administration settings are not visible
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T929143445"] = "Die Optionen für die Administration sind nicht sichtbar."
+
 -- Delete
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T1469573738"] = "Löschen"
 
@@ -2199,6 +2223,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T78223
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T900237532"] = "Anbieter"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T975426229"] = "Konfiguration exportieren"
+
+-- Cannot export the encrypted API key: No enterprise encryption secret is configured.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T1832230847"] = "Der verschlüsselte API-Schlüssel kann nicht exportiert werden: Es ist kein Geheimnis für die Verschlüsselung konfiguriert."
+
+-- This provider has an API key configured. Do you want to include the encrypted API key in the export? Note: The recipient will need the same encryption secret to use the API key.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T3368145670"] = "Für diesen Anbieter ist ein API-Schlüssel konfiguriert. Möchten Sie den verschlüsselten API-Schlüssel in den Export aufnehmen? Hinweis: Der Empfänger benötigt dasselbe Geheimnis für die Verschlüsselung, um den API-Schlüssel verwenden zu können."
+
+-- Export API Key?
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T4010580285"] = "API-Schlüssel exportieren?"
+
 -- Show provider's confidence level?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T1052533048"] = "Anzeigen, wie sicher sich der Anbieter ist?"
 
@@ -2304,6 +2340,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T853225
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T900237532"] = "Anbieter"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T975426229"] = "Konfiguration exportieren"
+
 -- No transcription provider configured yet.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T1079350363"] = "Es ist bisher kein Anbieter für Transkriptionen konfiguriert."
 
@@ -2358,6 +2397,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T78
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T900237532"] = "Anbieter"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T975426229"] = "Konfiguration exportieren"
+
 -- Copy {0} to the clipboard
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::TEXTINFOLINE::T2206391442"] = "Kopiere {0} in die Zwischenablage"
 
@@ -5013,9 +5055,18 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1282228996"] = "AI Studio läuft
 -- This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1388816916"] = "Diese Bibliothek wird verwendet, um PDF-Dateien zu lesen. Das ist zum Beispiel notwendig, um PDFs als Datenquelle für einen Chat zu nutzen."
 
+-- Database version
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1420062548"] = "Datenbankversion"
+
 -- This library is used to extend the MudBlazor library. It provides additional components that are not part of the MudBlazor library.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1421513382"] = "Diese Bibliothek wird verwendet, um die MudBlazor-Bibliothek zu erweitern. Sie stellt zusätzliche Komponenten bereit, die nicht Teil der MudBlazor-Bibliothek sind."
 
+-- Encryption secret: is not configured
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1560776885"] = "Geheimnis für die Verschlüsselung: ist nicht konfiguriert"
+
+-- Qdrant is a vector database and vector similarity search engine. We use it to realize local RAG -— retrieval-augmented generation -— within AI Studio. Thanks for the effort and great work that has been and is being put into Qdrant.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1619832053"] = "Qdrant ist eine Vektordatenbank und Suchmaschine für Vektoren. Wir nutzen Qdrant, um lokales RAG (Retrieval-Augmented Generation) innerhalb von AI Studio zu realisieren. Vielen Dank für den Einsatz und die großartige Arbeit, die in Qdrant gesteckt wurde und weiterhin gesteckt wird."
+
 -- We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T162898512"] = "Wir verwenden Lua als Sprache für Plugins. Lua-CSharp ermöglicht die Kommunikation zwischen Lua-Skripten und AI Studio in beide Richtungen. Vielen Dank an Yusuke Nakada für diese großartige Bibliothek."
 
@@ -5049,9 +5100,15 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1915240766"] = "Um ein beliebige
 -- This library is used to convert HTML to Markdown. This is necessary, e.g., when you provide a URL as input for an assistant.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1924365263"] = "Diese Bibliothek wird verwendet, um HTML in Markdown umzuwandeln. Das ist zum Beispiel notwendig, wenn Sie eine URL als Eingabe für einen Assistenten angeben."
 
+-- Encryption secret: is configured
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1931141322"] = "Geheimnis für die Verschlüsselung: ist konfiguriert"
+
 -- We use Rocket to implement the runtime API. This is necessary because the runtime must be able to communicate with the user interface (IPC). Rocket is a great framework for implementing web APIs in Rust.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1943216839"] = "Wir verwenden Rocket zur Implementierung der Runtime-API. Dies ist notwendig, da die Runtime mit der Benutzeroberfläche (IPC) kommunizieren muss. Rocket ist ein ausgezeichnetes Framework zur Umsetzung von Web-APIs in Rust."
 
+-- Copies the following to the clipboard
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2029659664"] = "Kopiert Folgendes in die Zwischenablage"
+
 -- Copies the server URL to the clipboard
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2037899437"] = "Kopiert die Server-URL in die Zwischenablage"
 
@@ -5097,6 +5154,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2557066213"] = "Verwendete Open-
 -- Build time
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T260228112"] = "Build-Zeit"
 
+-- This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2619858133"] = "Diese Bibliothek wird verwendet, um temporäre Ordner zu erstellen, in denen das Zertifikat und der private Schlüssel für die Kommunikation mit Qdrant gespeichert werden."
+
 -- This crate provides derive macros for Rust enums, which we use to reduce boilerplate when implementing string conversions and metadata for runtime types. This is helpful for the communication between our Rust and .NET systems.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2635482790"] = "Dieses Crate stellt Derive-Makros für Rust-Enums bereit, die wir verwenden, um Boilerplate zu reduzieren, wenn wir String-Konvertierungen und Metadaten für Laufzeittypen implementieren. Das ist hilfreich für die Kommunikation zwischen unseren Rust- und .NET-Systemen."
 
@@ -5214,6 +5274,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T566998575"] = "Dies ist eine Bib
 -- Used .NET SDK
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T585329785"] = "Verwendetes .NET SDK"
 
+-- This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T633932150"] = "Diese Bibliothek wird verwendet, um Sidecar-Prozesse zu verwalten und sicherzustellen, dass veraltete oder Zombie-Sidecars erkannt und beendet werden."
+
 -- Did you find a bug or are you experiencing issues? Report your concern here.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T639371534"] = "Haben Sie einen Fehler gefunden oder Probleme festgestellt? Melden Sie Ihr Anliegen hier."
 
@@ -5244,6 +5307,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T158493184"] = "Interne Plugins"
 -- Disabled Plugins
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T1724138133"] = "Deaktivierte Plugins"
 
+-- Send a mail
+UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T1999487139"] = "E-Mail senden"
+
 -- Enable plugin
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T2057806005"] = "Plugin aktivieren"
 
@@ -5256,6 +5322,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T2738444034"] = "Aktivierte Plugins"
 -- Actions
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T3865031940"] = "Aktionen"
 
+-- Open website
+UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T4239378936"] = "Website öffnen"
+
 -- Settings
 UI_TEXT_CONTENT["AISTUDIO::PAGES::SETTINGS::T1258653480"] = "Einstellungen"
 
@@ -5772,6 +5841,21 @@ UI_TEXT_CONTENT["AISTUDIO::TOOLS::CONFIDENCESCHEMESEXTENSIONS::T3893997203"] = "
 -- Trust all LLM providers
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::CONFIDENCESCHEMESEXTENSIONS::T4107860491"] = "Allen LLM-Anbietern vertrauen"
 
+-- Storage size
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T1230141403"] = "Speichergröße"
+
+-- HTTP port
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T1717573768"] = "HTTP-Port"
+
+-- Reported version
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T3556099842"] = "Gemeldete Version"
+
+-- gRPC port
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T757840040"] = "gRPC-Port"
+
+-- Number of collections
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T842647336"] = "Anzahl der Collections"
+
 -- The related data is not allowed to be sent to any LLM provider. This means that this data source cannot be used at the moment.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::ERICLIENT::DATAMODEL::PROVIDERTYPEEXTENSIONS::T1555790630"] = "Die zugehörigen Daten dürfen an keinen LLM-Anbieter gesendet werden. Das bedeutet, dass diese Datenquelle momentan nicht verwendet werden kann."
 
@@ -5961,15 +6045,18 @@ UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2262604281"] = "Das
 -- The field DESCRIPTION does not exist or is not a valid string.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T229488255"] = "Das Feld DESCRIPTION existiert nicht oder ist keine gültige Zeichenkette."
 
--- The field SOURCE_URL is not a valid URL. The URL must start with 'http://' or 'https://'.
-UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2320984047"] = "Das Feld SOURCE_URL ist keine gültige URL. Die URL muss mit 'http://' oder 'https://' beginnen."
-
 -- The field VERSION is not a valid version number. The version number must be formatted as string in the major.minor.patch format (X.X.X).
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2538827536"] = "Das Feld VERSION ist keine gültige Versionsnummer. Die Versionsnummer muss als Zeichenkette im Format major.minor.patch (X.X.X) angegeben werden."
 
+-- The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'.
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2892057533"] = "Das Feld SOURCE_URL ist keine gültige URL. Die URL muss mit „http://“, „https://“ oder „mailto:“ beginnen."
+
 -- The table AUTHORS is empty. At least one author must be specified.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2981832540"] = "Die Tabelle AUTHORS ist leer. Es muss mindestens ein Autor angegeben werden."
 
+-- The field SOURCE_URL is not a valid URL. When the URL starts with 'mailto:', it must contain a valid email address as recipient.
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T3165663073"] = "Das Feld SOURCE_URL ist keine gültige URL. Wenn die URL mit „mailto:“ beginnt, muss sie eine gültige E-Mail-Adresse als Empfänger enthalten."
+
 -- The field SUPPORT_CONTACT is empty. The support contact must be a non-empty string.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T3524814526"] = "Das Feld SUPPORT_CONTACT ist leer. Der Support-Kontakt muss eine nicht-leere Zeichenkette sein."
 

app/MindWork AI Studio/Plugins/languages/en-us-97dfb1ba-50c4-4440-8dfa-6575daf543c8/plugin.lua

@@ -2082,12 +2082,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T1898060643"]
 -- Select the language for the app.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T1907446663"] = "Select the language for the app."
 
+-- When enabled, additional administration options become visible. These options are intended for IT staff to manage organization-wide configuration, e.g. configuring and exporting providers for an entire organization.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2013281167"] = "When enabled, additional administration options become visible. These options are intended for IT staff to manage organization-wide configuration, e.g. configuring and exporting providers for an entire organization."
+
 -- The global keyboard shortcut for toggling voice recording. This shortcut works system-wide, even when the app is not focused.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2143741496"] = "The global keyboard shortcut for toggling voice recording. This shortcut works system-wide, even when the app is not focused."
 
 -- Disable dictation and transcription
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T215381891"] = "Disable dictation and transcription"
 
+-- Enterprise Administration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2277116008"] = "Enterprise Administration"
+
 -- Language behavior
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2341504363"] = "Language behavior"
 
@@ -2097,6 +2103,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T237706157"]
 -- Language
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2591284123"] = "Language"
 
+-- Administration settings are visible
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T2591866808"] = "Administration settings are visible"
+
 -- Save energy?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3100928009"] = "Save energy?"
 
@@ -2106,9 +2115,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3165555978"]
 -- App Options
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3577148634"] = "App Options"
 
+-- Generate a 256-bit encryption secret for encrypting API keys in configuration plugins. Deploy this secret to client machines via Group Policy (Windows Registry) or environment variables. Providers can then be exported with encrypted API keys using the export buttons in the provider settings.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T362833"] = "Generate a 256-bit encryption secret for encrypting API keys in configuration plugins. Deploy this secret to client machines via Group Policy (Windows Registry) or environment variables. Providers can then be exported with encrypted API keys using the export buttons in the provider settings."
+
 -- When enabled, streamed content from the AI is updated once every third second. When disabled, streamed content will be updated as soon as it is available.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3652888444"] = "When enabled, streamed content from the AI is updated once every third second. When disabled, streamed content will be updated as soon as it is available."
 
+-- Show administration settings?
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3694781396"] = "Show administration settings?"
+
+-- Read the Enterprise IT documentation for details.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3705451321"] = "Read the Enterprise IT documentation for details."
+
 -- Enable spellchecking?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T3914529369"] = "Enable spellchecking?"
 
@@ -2142,6 +2160,12 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T817101267"]
 -- Would you like to set one provider as the default for the entire app? When you configure a different provider for an assistant, it will always take precedence.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T844514734"] = "Would you like to set one provider as the default for the entire app? When you configure a different provider for an assistant, it will always take precedence."
 
+-- Generate an encryption secret and copy it to the clipboard
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T922066419"] = "Generate an encryption secret and copy it to the clipboard"
+
+-- Administration settings are not visible
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELAPP::T929143445"] = "Administration settings are not visible"
+
 -- Delete
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T1469573738"] = "Delete"
 
@@ -2199,6 +2223,18 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T78223
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T900237532"] = "Provider"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELEMBEDDINGS::T975426229"] = "Export configuration"
+
+-- Cannot export the encrypted API key: No enterprise encryption secret is configured.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T1832230847"] = "Cannot export the encrypted API key: No enterprise encryption secret is configured."
+
+-- This provider has an API key configured. Do you want to include the encrypted API key in the export? Note: The recipient will need the same encryption secret to use the API key.
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T3368145670"] = "This provider has an API key configured. Do you want to include the encrypted API key in the export? Note: The recipient will need the same encryption secret to use the API key."
+
+-- Export API Key?
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERBASE::T4010580285"] = "Export API Key?"
+
 -- Show provider's confidence level?
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T1052533048"] = "Show provider's confidence level?"
 
@@ -2304,6 +2340,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T853225
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T900237532"] = "Provider"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELPROVIDERS::T975426229"] = "Export configuration"
+
 -- No transcription provider configured yet.
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T1079350363"] = "No transcription provider configured yet."
 
@@ -2358,6 +2397,9 @@ UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T78
 -- Provider
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T900237532"] = "Provider"
 
+-- Export configuration
+UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::SETTINGS::SETTINGSPANELTRANSCRIPTION::T975426229"] = "Export configuration"
+
 -- Copy {0} to the clipboard
 UI_TEXT_CONTENT["AISTUDIO::COMPONENTS::TEXTINFOLINE::T2206391442"] = "Copy {0} to the clipboard"
 
@@ -5013,9 +5055,18 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1282228996"] = "AI Studio runs w
 -- This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1388816916"] = "This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat."
 
+-- Database version
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1420062548"] = "Database version"
+
 -- This library is used to extend the MudBlazor library. It provides additional components that are not part of the MudBlazor library.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1421513382"] = "This library is used to extend the MudBlazor library. It provides additional components that are not part of the MudBlazor library."
 
+-- Encryption secret: is not configured
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1560776885"] = "Encryption secret: is not configured"
+
+-- Qdrant is a vector database and vector similarity search engine. We use it to realize local RAG -— retrieval-augmented generation -— within AI Studio. Thanks for the effort and great work that has been and is being put into Qdrant.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1619832053"] = "Qdrant is a vector database and vector similarity search engine. We use it to realize local RAG -— retrieval-augmented generation -— within AI Studio. Thanks for the effort and great work that has been and is being put into Qdrant."
+
 -- We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T162898512"] = "We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library."
 
@@ -5049,9 +5100,15 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1915240766"] = "In order to use
 -- This library is used to convert HTML to Markdown. This is necessary, e.g., when you provide a URL as input for an assistant.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1924365263"] = "This library is used to convert HTML to Markdown. This is necessary, e.g., when you provide a URL as input for an assistant."
 
+-- Encryption secret: is configured
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1931141322"] = "Encryption secret: is configured"
+
 -- We use Rocket to implement the runtime API. This is necessary because the runtime must be able to communicate with the user interface (IPC). Rocket is a great framework for implementing web APIs in Rust.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T1943216839"] = "We use Rocket to implement the runtime API. This is necessary because the runtime must be able to communicate with the user interface (IPC). Rocket is a great framework for implementing web APIs in Rust."
 
+-- Copies the following to the clipboard
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2029659664"] = "Copies the following to the clipboard"
+
 -- Copies the server URL to the clipboard
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2037899437"] = "Copies the server URL to the clipboard"
 
@@ -5097,6 +5154,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2557066213"] = "Used Open Source
 -- Build time
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T260228112"] = "Build time"
 
+-- This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2619858133"] = "This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant."
+
 -- This crate provides derive macros for Rust enums, which we use to reduce boilerplate when implementing string conversions and metadata for runtime types. This is helpful for the communication between our Rust and .NET systems.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T2635482790"] = "This crate provides derive macros for Rust enums, which we use to reduce boilerplate when implementing string conversions and metadata for runtime types. This is helpful for the communication between our Rust and .NET systems."
 
@@ -5214,6 +5274,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T566998575"] = "This is a library
 -- Used .NET SDK
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T585329785"] = "Used .NET SDK"
 
+-- This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated.
+UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T633932150"] = "This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated."
+
 -- Did you find a bug or are you experiencing issues? Report your concern here.
 UI_TEXT_CONTENT["AISTUDIO::PAGES::INFORMATION::T639371534"] = "Did you find a bug or are you experiencing issues? Report your concern here."
 
@@ -5244,6 +5307,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T158493184"] = "Internal Plugins"
 -- Disabled Plugins
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T1724138133"] = "Disabled Plugins"
 
+-- Send a mail
+UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T1999487139"] = "Send a mail"
+
 -- Enable plugin
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T2057806005"] = "Enable plugin"
 
@@ -5256,6 +5322,9 @@ UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T2738444034"] = "Enabled Plugins"
 -- Actions
 UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T3865031940"] = "Actions"
 
+-- Open website
+UI_TEXT_CONTENT["AISTUDIO::PAGES::PLUGINS::T4239378936"] = "Open website"
+
 -- Settings
 UI_TEXT_CONTENT["AISTUDIO::PAGES::SETTINGS::T1258653480"] = "Settings"
 
@@ -5772,6 +5841,21 @@ UI_TEXT_CONTENT["AISTUDIO::TOOLS::CONFIDENCESCHEMESEXTENSIONS::T3893997203"] = "
 -- Trust all LLM providers
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::CONFIDENCESCHEMESEXTENSIONS::T4107860491"] = "Trust all LLM providers"
 
+-- Storage size
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T1230141403"] = "Storage size"
+
+-- HTTP port
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T1717573768"] = "HTTP port"
+
+-- Reported version
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T3556099842"] = "Reported version"
+
+-- gRPC port
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T757840040"] = "gRPC port"
+
+-- Number of collections
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::DATABASES::QDRANT::QDRANTCLIENTIMPLEMENTATION::T842647336"] = "Number of collections"
+
 -- The related data is not allowed to be sent to any LLM provider. This means that this data source cannot be used at the moment.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::ERICLIENT::DATAMODEL::PROVIDERTYPEEXTENSIONS::T1555790630"] = "The related data is not allowed to be sent to any LLM provider. This means that this data source cannot be used at the moment."
 
@@ -5961,15 +6045,18 @@ UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2262604281"] = "The
 -- The field DESCRIPTION does not exist or is not a valid string.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T229488255"] = "The field DESCRIPTION does not exist or is not a valid string."
 
--- The field SOURCE_URL is not a valid URL. The URL must start with 'http://' or 'https://'.
-UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2320984047"] = "The field SOURCE_URL is not a valid URL. The URL must start with 'http://' or 'https://'."
-
 -- The field VERSION is not a valid version number. The version number must be formatted as string in the major.minor.patch format (X.X.X).
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2538827536"] = "The field VERSION is not a valid version number. The version number must be formatted as string in the major.minor.patch format (X.X.X)."
 
+-- The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'.
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2892057533"] = "The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'."
+
 -- The table AUTHORS is empty. At least one author must be specified.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T2981832540"] = "The table AUTHORS is empty. At least one author must be specified."
 
+-- The field SOURCE_URL is not a valid URL. When the URL starts with 'mailto:', it must contain a valid email address as recipient.
+UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T3165663073"] = "The field SOURCE_URL is not a valid URL. When the URL starts with 'mailto:', it must contain a valid email address as recipient."
+
 -- The field SUPPORT_CONTACT is empty. The support contact must be a non-empty string.
 UI_TEXT_CONTENT["AISTUDIO::TOOLS::PLUGINSYSTEM::PLUGINBASE::T3524814526"] = "The field SUPPORT_CONTACT is empty. The support contact must be a non-empty string."
 

app/MindWork AI Studio/Program.cs

@@ -1,5 +1,7 @@
 using AIStudio.Agents;
 using AIStudio.Settings;
+using AIStudio.Tools.Databases;
+using AIStudio.Tools.Databases.Qdrant;
 using AIStudio.Tools.PluginSystem;
 using AIStudio.Tools.Services;
 
@@ -24,6 +26,7 @@ internal sealed class Program
     public static string API_TOKEN = null!;
     public static IServiceProvider SERVICE_PROVIDER = null!;
     public static ILoggerFactory LOGGER_FACTORY = null!;
+    public static DatabaseClient DATABASE_CLIENT = null!;
     
     public static async Task Main()
     {
@@ -82,6 +85,39 @@ internal sealed class Program
             return;
         }
         
+        var qdrantInfo = await rust.GetQdrantInfo();
+        if (qdrantInfo.Path == string.Empty)
+        {
+            Console.WriteLine("Error: Failed to get the Qdrant path from Rust.");
+            return;
+        }
+        
+        if (qdrantInfo.PortHttp == 0)
+        {
+            Console.WriteLine("Error: Failed to get the Qdrant HTTP port from Rust.");
+            return;
+        }
+
+        if (qdrantInfo.PortGrpc == 0)
+        {
+            Console.WriteLine("Error: Failed to get the Qdrant gRPC port from Rust.");
+            return;
+        }
+
+        if (qdrantInfo.Fingerprint == string.Empty)
+        {
+            Console.WriteLine("Error: Failed to get the Qdrant fingerprint from Rust.");
+            return;
+        }
+        
+        if (qdrantInfo.ApiToken == string.Empty)
+        {
+            Console.WriteLine("Error: Failed to get the Qdrant API token from Rust.");
+            return;
+        }
+
+        var databaseClient = new QdrantClientImplementation("Qdrant", qdrantInfo.Path, qdrantInfo.PortHttp, qdrantInfo.PortGrpc, qdrantInfo.Fingerprint, qdrantInfo.ApiToken);
+        
         var builder = WebApplication.CreateBuilder();
         builder.WebHost.ConfigureKestrel(kestrelServerOptions =>
         {
@@ -133,6 +169,7 @@ internal sealed class Program
         builder.Services.AddHostedService<UpdateService>();
         builder.Services.AddHostedService<TemporaryChatService>();
         builder.Services.AddHostedService<EnterpriseEnvironmentService>();
+        builder.Services.AddSingleton<DatabaseClient>(databaseClient);
         builder.Services.AddHostedService<GlobalShortcutService>();
         builder.Services.AddHostedService<RustAvailabilityMonitorService>();
         
@@ -192,6 +229,10 @@ internal sealed class Program
         RUST_SERVICE = rust;
         ENCRYPTION = encryption;
         
+        var databaseLogger = app.Services.GetRequiredService<ILogger<DatabaseClient>>();
+        databaseClient.SetLogger(databaseLogger);
+        DATABASE_CLIENT = databaseClient;
+
         programLogger.LogInformation("Initialize internal file system.");
         app.Use(Redirect.HandlerContentAsync);
         app.Use(FileHandler.HandlerAsync);
@@ -228,6 +269,7 @@ internal sealed class Program
         await serverTask;
         
         RUST_SERVICE.Dispose();
+        DATABASE_CLIENT.Dispose();
         PluginFactory.Dispose();
         programLogger.LogInformation("The AI Studio server was stopped.");
     }

app/MindWork AI Studio/Provider/BaseProvider.cs

@@ -112,9 +112,14 @@ public abstract class BaseProvider : IProvider, ISecretId
     
     #endregion
     
+    /// <summary>
+    /// Whether this provider was imported from an enterprise configuration plugin.
+    /// </summary>
+    public bool IsEnterpriseConfiguration { get; init; }
+
     #region Implementation of ISecretId
 
-    public string SecretId => this.Id;
+    public string SecretId => this.IsEnterpriseConfiguration ? $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{this.Id}" : this.Id;
 
     public string SecretName => this.InstanceName;
 

app/MindWork AI Studio/Provider/LLMProvidersExtensions.cs

@@ -186,7 +186,7 @@ public static class LLMProvidersExtensions
     /// <returns>The provider instance.</returns>
     public static IProvider CreateProvider(this AIStudio.Settings.Provider providerSettings)
     {
-        return providerSettings.UsedLLMProvider.CreateProvider(providerSettings.InstanceName, providerSettings.Host, providerSettings.Hostname, providerSettings.Model, providerSettings.HFInferenceProvider, providerSettings.AdditionalJsonApiParameters);
+        return providerSettings.UsedLLMProvider.CreateProvider(providerSettings.InstanceName, providerSettings.Host, providerSettings.Hostname, providerSettings.Model, providerSettings.HFInferenceProvider, providerSettings.AdditionalJsonApiParameters, providerSettings.IsEnterpriseConfiguration);
     }
     
     /// <summary>
@@ -196,7 +196,7 @@ public static class LLMProvidersExtensions
     /// <returns>The provider instance.</returns>
     public static IProvider CreateProvider(this EmbeddingProvider embeddingProviderSettings)
     {
-        return embeddingProviderSettings.UsedLLMProvider.CreateProvider(embeddingProviderSettings.Name, embeddingProviderSettings.Host, embeddingProviderSettings.Hostname, embeddingProviderSettings.Model, HFInferenceProvider.NONE);
+        return embeddingProviderSettings.UsedLLMProvider.CreateProvider(embeddingProviderSettings.Name, embeddingProviderSettings.Host, embeddingProviderSettings.Hostname, embeddingProviderSettings.Model, HFInferenceProvider.NONE, isEnterpriseConfiguration: embeddingProviderSettings.IsEnterpriseConfiguration);
     }
     
     /// <summary>
@@ -206,33 +206,33 @@ public static class LLMProvidersExtensions
     /// <returns>The provider instance.</returns>
     public static IProvider CreateProvider(this TranscriptionProvider transcriptionProviderSettings)
     {
-        return transcriptionProviderSettings.UsedLLMProvider.CreateProvider(transcriptionProviderSettings.Name, transcriptionProviderSettings.Host, transcriptionProviderSettings.Hostname, transcriptionProviderSettings.Model, HFInferenceProvider.NONE);
+        return transcriptionProviderSettings.UsedLLMProvider.CreateProvider(transcriptionProviderSettings.Name, transcriptionProviderSettings.Host, transcriptionProviderSettings.Hostname, transcriptionProviderSettings.Model, HFInferenceProvider.NONE, isEnterpriseConfiguration: transcriptionProviderSettings.IsEnterpriseConfiguration);
     }
     
-    private static IProvider CreateProvider(this LLMProviders provider, string instanceName, Host host, string hostname, Model model, HFInferenceProvider inferenceProvider, string expertProviderApiParameter = "")
+    private static IProvider CreateProvider(this LLMProviders provider, string instanceName, Host host, string hostname, Model model, HFInferenceProvider inferenceProvider, string expertProviderApiParameter = "", bool isEnterpriseConfiguration = false)
     {
         try
         {
             return provider switch
             {
-                LLMProviders.OPEN_AI => new ProviderOpenAI { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.ANTHROPIC => new ProviderAnthropic { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.MISTRAL => new ProviderMistral { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.GOOGLE => new ProviderGoogle { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.X => new ProviderX { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.DEEP_SEEK => new ProviderDeepSeek { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.ALIBABA_CLOUD => new ProviderAlibabaCloud { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.PERPLEXITY => new ProviderPerplexity { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.OPEN_ROUTER => new ProviderOpenRouter { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
+                LLMProviders.OPEN_AI => new ProviderOpenAI { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.ANTHROPIC => new ProviderAnthropic { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.MISTRAL => new ProviderMistral { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.GOOGLE => new ProviderGoogle { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.X => new ProviderX { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.DEEP_SEEK => new ProviderDeepSeek { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.ALIBABA_CLOUD => new ProviderAlibabaCloud { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.PERPLEXITY => new ProviderPerplexity { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.OPEN_ROUTER => new ProviderOpenRouter { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
 
-                LLMProviders.GROQ => new ProviderGroq { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.FIREWORKS => new ProviderFireworks { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.HUGGINGFACE => new ProviderHuggingFace(inferenceProvider, model) { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter }, 
+                LLMProviders.GROQ => new ProviderGroq { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.FIREWORKS => new ProviderFireworks { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.HUGGINGFACE => new ProviderHuggingFace(inferenceProvider, model) { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
 
-                LLMProviders.SELF_HOSTED => new ProviderSelfHosted(host, hostname) { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
+                LLMProviders.SELF_HOSTED => new ProviderSelfHosted(host, hostname) { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
 
-                LLMProviders.HELMHOLTZ => new ProviderHelmholtz { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
-                LLMProviders.GWDG => new ProviderGWDG { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter },
+                LLMProviders.HELMHOLTZ => new ProviderHelmholtz { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
+                LLMProviders.GWDG => new ProviderGWDG { InstanceName = instanceName, AdditionalJsonApiParameters = expertProviderApiParameter, IsEnterpriseConfiguration = isEnterpriseConfiguration },
 
                 _ => new NoProvider(),
             };

app/MindWork AI Studio/Settings/DataModel/DataApp.cs

@@ -94,6 +94,11 @@ public sealed class DataApp(Expression<Func<Data, DataApp>>? configSelection = n
     /// </summary>
     public bool AllowUserToAddProvider { get; set; } = ManagedConfiguration.Register(configSelection, n => n.AllowUserToAddProvider, true);
     
+    /// <summary>
+    /// Should administration settings be visible in the UI?
+    /// </summary>
+    public bool ShowAdminSettings { get; set; } = ManagedConfiguration.Register(configSelection, n => n.ShowAdminSettings, false);
+
     /// <summary>
     /// List of assistants that should be hidden from the UI.
     /// </summary>

app/MindWork AI Studio/Settings/EmbeddingProvider.cs

@@ -43,7 +43,7 @@ public sealed record EmbeddingProvider(
 
     /// <inheritdoc />
     [JsonIgnore]
-    public string SecretId => this.Id;
+    public string SecretId => this.IsEnterpriseConfiguration ? $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{this.UsedLLMProvider.ToName()}" : this.UsedLLMProvider.ToName();
 
     /// <inheritdoc />
     [JsonIgnore]
@@ -110,6 +110,34 @@ public sealed record EmbeddingProvider(
             Host = host,
         };
 
+        // Handle encrypted API key if present:
+        if (table.TryGetValue("APIKey", out var apiKeyValue) && apiKeyValue.TryRead<string>(out var apiKeyText) && !string.IsNullOrWhiteSpace(apiKeyText))
+        {
+            if (!EnterpriseEncryption.IsEncrypted(apiKeyText))
+                LOGGER.LogWarning($"The configured embedding provider {idx} contains a plaintext API key. Only encrypted API keys (starting with 'ENC:v1:') are supported.");
+            else
+            {
+                var encryption = PluginFactory.EnterpriseEncryption;
+                if (encryption?.IsAvailable == true)
+                {
+                    if (encryption.TryDecrypt(apiKeyText, out var decryptedApiKey))
+                    {
+                        // Queue the API key for storage in the OS keyring:
+                        PendingEnterpriseApiKeys.Add(new(
+                            $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{usedLLMProvider.ToName()}",
+                            name,
+                            decryptedApiKey,
+                            SecretStoreType.EMBEDDING_PROVIDER));
+                        LOGGER.LogDebug($"Successfully decrypted API key for embedding provider {idx}. It will be stored in the OS keyring.");
+                    }
+                    else
+                        LOGGER.LogWarning($"Failed to decrypt API key for embedding provider {idx}. The encryption secret may be incorrect.");
+                }
+                else
+                    LOGGER.LogWarning($"The configured embedding provider {idx} contains an encrypted API key, but no encryption secret is configured.");
+            }
+        }
+
         return true;
     }
 
@@ -131,4 +159,36 @@ public sealed record EmbeddingProvider(
         model = new(id, displayName);
         return true;
     }
+
+    /// <summary>
+    /// Exports the embedding provider configuration as a Lua configuration section.
+    /// </summary>
+    /// <param name="encryptedApiKey">Optional encrypted API key to include in the export.</param>
+    /// <returns>A Lua configuration section string.</returns>
+    public string ExportAsConfigurationSection(string? encryptedApiKey = null)
+    {
+        var apiKeyLine = string.Empty;
+        if (!string.IsNullOrWhiteSpace(encryptedApiKey))
+        {
+            apiKeyLine = $"""
+                          ["APIKey"] = "{LuaTools.EscapeLuaString(encryptedApiKey)}",
+                          """;
+        }
+
+        return $$"""
+                CONFIG["EMBEDDING_PROVIDERS"][#CONFIG["EMBEDDING_PROVIDERS"]+1] = {
+                    ["Id"] = "{{Guid.NewGuid().ToString()}}",
+                    ["Name"] = "{{LuaTools.EscapeLuaString(this.Name)}}",
+                    ["UsedLLMProvider"] = "{{this.UsedLLMProvider}}",
+                 
+                    ["Host"] = "{{this.Host}}",
+                    ["Hostname"] = "{{LuaTools.EscapeLuaString(this.Hostname)}}",
+                    {{apiKeyLine}}
+                    ["Model"] = {
+                        ["Id"] = "{{LuaTools.EscapeLuaString(this.Model.Id)}}",
+                        ["DisplayName"] = "{{LuaTools.EscapeLuaString(this.Model.DisplayName ?? string.Empty)}}",
+                    },
+                }
+                """;
+    }
 }

app/MindWork AI Studio/Settings/Provider.cs

@@ -71,7 +71,7 @@ public sealed record Provider(
     
     /// <inheritdoc />
     [JsonIgnore]
-    public string SecretId => this.Id;
+    public string SecretId => this.IsEnterpriseConfiguration ? $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{this.UsedLLMProvider.ToName()}" : this.UsedLLMProvider.ToName();
     
     /// <inheritdoc />
     [JsonIgnore]
@@ -122,6 +122,16 @@ public sealed record Provider(
             return false;
         }
 
+        var hfInferenceProvider = HFInferenceProvider.NONE;
+        if (table.TryGetValue("HFInferenceProvider", out var hfInferenceProviderValue) && hfInferenceProviderValue.TryRead<string>(out var hfInferenceProviderText))
+        {
+            if (!Enum.TryParse(hfInferenceProviderText, true, out hfInferenceProvider))
+            {
+                LOGGER.LogWarning($"The configured provider {idx} does not contain a valid Hugging Face inference provider enum value.");
+                hfInferenceProvider = HFInferenceProvider.NONE;
+            }
+        }
+        
         if (!table.TryGetValue("Model", out var modelValue) || !modelValue.TryRead<LuaTable>(out var modelTable))
         {
             LOGGER.LogWarning($"The configured provider {idx} does not contain a valid model table.");
@@ -153,9 +163,38 @@ public sealed record Provider(
             EnterpriseConfigurationPluginId = configPluginId,
             Hostname = hostname,
             Host = host,
+            HFInferenceProvider = hfInferenceProvider,
             AdditionalJsonApiParameters = additionalJsonApiParameters,
         };
 
+        // Handle encrypted API key if present:
+        if (table.TryGetValue("APIKey", out var apiKeyValue) && apiKeyValue.TryRead<string>(out var apiKeyText) && !string.IsNullOrWhiteSpace(apiKeyText))
+        {
+            if (!EnterpriseEncryption.IsEncrypted(apiKeyText))
+                LOGGER.LogWarning($"The configured provider {idx} contains a plaintext API key. Only encrypted API keys (starting with 'ENC:v1:') are supported.");
+            else
+            {
+                var encryption = PluginFactory.EnterpriseEncryption;
+                if (encryption?.IsAvailable == true)
+                {
+                    if (encryption.TryDecrypt(apiKeyText, out var decryptedApiKey))
+                    {
+                        // Queue the API key for storage in the OS keyring:
+                        PendingEnterpriseApiKeys.Add(new(
+                            $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{usedLLMProvider.ToName()}",
+                            instanceName,
+                            decryptedApiKey,
+                            SecretStoreType.LLM_PROVIDER));
+                        LOGGER.LogDebug($"Successfully decrypted API key for provider {idx}. It will be stored in the OS keyring.");
+                    }
+                    else
+                        LOGGER.LogWarning($"Failed to decrypt API key for provider {idx}. The encryption secret may be incorrect.");
+                }
+                else
+                    LOGGER.LogWarning($"The configured provider {idx} contains an encrypted API key, but no encryption secret is configured.");
+            }
+        }
+
         return true;
     }
 
@@ -177,4 +216,46 @@ public sealed record Provider(
         model = new(id, displayName);
         return true;
     }
+
+    /// <summary>
+    /// Exports the provider configuration as a Lua configuration section.
+    /// </summary>
+    /// <param name="encryptedApiKey">Optional encrypted API key to include in the export.</param>
+    /// <returns>A Lua configuration section string.</returns>
+    public string ExportAsConfigurationSection(string? encryptedApiKey = null)
+    {
+        var hfInferenceProviderLine = string.Empty;
+        if (this.HFInferenceProvider is not HFInferenceProvider.NONE)
+        {
+            hfInferenceProviderLine = $"""
+                                       ["HFInferenceProvider"] = "{this.HFInferenceProvider}",
+                                       """;
+        }
+
+        var apiKeyLine = string.Empty;
+        if (!string.IsNullOrWhiteSpace(encryptedApiKey))
+        {
+            apiKeyLine = $"""
+                          ["APIKey"] = "{LuaTools.EscapeLuaString(encryptedApiKey)}",
+                          """;
+        }
+
+        return $$"""
+                CONFIG["LLM_PROVIDERS"][#CONFIG["LLM_PROVIDERS"]+1] = {
+                    ["Id"] = "{{Guid.NewGuid().ToString()}}",
+                    ["InstanceName"] = "{{LuaTools.EscapeLuaString(this.InstanceName)}}",
+                    ["UsedLLMProvider"] = "{{this.UsedLLMProvider}}",
+
+                    ["Host"] = "{{this.Host}}",
+                    ["Hostname"] = "{{LuaTools.EscapeLuaString(this.Hostname)}}",
+                    {{hfInferenceProviderLine}}
+                    {{apiKeyLine}}
+                    ["AdditionalJsonApiParameters"] = "{{LuaTools.EscapeLuaString(this.AdditionalJsonApiParameters)}}",
+                    ["Model"] = {
+                        ["Id"] = "{{LuaTools.EscapeLuaString(this.Model.Id)}}",
+                        ["DisplayName"] = "{{LuaTools.EscapeLuaString(this.Model.DisplayName ?? string.Empty)}}",
+                    },
+                }
+                """;
+    }
 }

app/MindWork AI Studio/Settings/TranscriptionProvider.cs

@@ -43,7 +43,7 @@ public sealed record TranscriptionProvider(
 
     /// <inheritdoc />
     [JsonIgnore]
-    public string SecretId => this.Id;
+    public string SecretId => this.IsEnterpriseConfiguration ? $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{this.UsedLLMProvider.ToName()}" : this.UsedLLMProvider.ToName();
 
     /// <inheritdoc />
     [JsonIgnore]
@@ -110,6 +110,34 @@ public sealed record TranscriptionProvider(
             Host = host,
         };
 
+        // Handle encrypted API key if present:
+        if (table.TryGetValue("APIKey", out var apiKeyValue) && apiKeyValue.TryRead<string>(out var apiKeyText) && !string.IsNullOrWhiteSpace(apiKeyText))
+        {
+            if (!EnterpriseEncryption.IsEncrypted(apiKeyText))
+                LOGGER.LogWarning($"The configured transcription provider {idx} contains a plaintext API key. Only encrypted API keys (starting with 'ENC:v1:') are supported.");
+            else
+            {
+                var encryption = PluginFactory.EnterpriseEncryption;
+                if (encryption?.IsAvailable == true)
+                {
+                    if (encryption.TryDecrypt(apiKeyText, out var decryptedApiKey))
+                    {
+                        // Queue the API key for storage in the OS keyring:
+                        PendingEnterpriseApiKeys.Add(new(
+                            $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{usedLLMProvider.ToName()}",
+                            name,
+                            decryptedApiKey,
+                            SecretStoreType.TRANSCRIPTION_PROVIDER));
+                        LOGGER.LogDebug($"Successfully decrypted API key for transcription provider {idx}. It will be stored in the OS keyring.");
+                    }
+                    else
+                        LOGGER.LogWarning($"Failed to decrypt API key for transcription provider {idx}. The encryption secret may be incorrect.");
+                }
+                else
+                    LOGGER.LogWarning($"The configured transcription provider {idx} contains an encrypted API key, but no encryption secret is configured.");
+            }
+        }
+
         return true;
     }
 
@@ -131,4 +159,36 @@ public sealed record TranscriptionProvider(
         model = new(id, displayName);
         return true;
     }
+
+    /// <summary>
+    /// Exports the transcription provider configuration as a Lua configuration section.
+    /// </summary>
+    /// <param name="encryptedApiKey">Optional encrypted API key to include in the export.</param>
+    /// <returns>A Lua configuration section string.</returns>
+    public string ExportAsConfigurationSection(string? encryptedApiKey = null)
+    {
+        var apiKeyLine = string.Empty;
+        if (!string.IsNullOrWhiteSpace(encryptedApiKey))
+        {
+            apiKeyLine = $"""
+                          ["APIKey"] = "{LuaTools.EscapeLuaString(encryptedApiKey)}",
+                          """;
+        }
+
+        return $$"""
+                CONFIG["TRANSCRIPTION_PROVIDERS"][#CONFIG["TRANSCRIPTION_PROVIDERS"]+1] = {
+                    ["Id"] = "{{Guid.NewGuid().ToString()}}",
+                    ["Name"] = "{{LuaTools.EscapeLuaString(this.Name)}}",
+                    ["UsedLLMProvider"] = "{{this.UsedLLMProvider}}",
+
+                    ["Host"] = "{{this.Host}}",
+                    ["Hostname"] = "{{LuaTools.EscapeLuaString(this.Hostname)}}",
+                    {{apiKeyLine}}
+                    ["Model"] = {
+                        ["Id"] = "{{LuaTools.EscapeLuaString(this.Model.Id)}}",
+                        ["DisplayName"] = "{{LuaTools.EscapeLuaString(this.Model.DisplayName ?? string.Empty)}}",
+                    },
+                }
+                """;
+    }
 }

app/MindWork AI Studio/Tools/Databases/DatabaseClient.cs

@@ -0,0 +1,52 @@
+namespace AIStudio.Tools.Databases;
+
+public abstract class DatabaseClient(string name, string path)
+{
+    public string Name => name;
+    
+    private string Path => path;
+
+    private ILogger<DatabaseClient>? logger;
+    
+    public abstract IAsyncEnumerable<(string Label, string Value)> GetDisplayInfo();
+
+    protected string GetStorageSize()
+    {
+        if (string.IsNullOrWhiteSpace(this.Path))
+        {
+            this.logger!.LogError($"Error: Database path '{this.Path}' cannot be null or empty.");
+            return "0 B";
+        }
+
+        if (!Directory.Exists(this.Path))
+        {
+            this.logger!.LogError($"Error: Database path '{this.Path}' does not exist.");
+            return "0 B";
+        }
+        var files = Directory.EnumerateFiles(this.Path, "*", SearchOption.AllDirectories)
+            .Where(file => !System.IO.Path.GetDirectoryName(file)!.Contains("cert", StringComparison.OrdinalIgnoreCase));
+        var size = files.Sum(file => new FileInfo(file).Length);
+        return FormatBytes(size);
+    }
+
+    private static string FormatBytes(long size)
+    {
+        string[] suffixes = { "B", "KB", "MB", "GB", "TB", "PB" };
+        int suffixIndex = 0;
+    
+        while (size >= 1024 && suffixIndex < suffixes.Length - 1)
+        {
+            size /= 1024;
+            suffixIndex++;
+        }
+    
+        return $"{size:0##} {suffixes[suffixIndex]}";
+    }
+    
+    public void SetLogger(ILogger<DatabaseClient> logService)
+    {
+        this.logger = logService;
+    }
+
+    public abstract void Dispose();
+}

app/MindWork AI Studio/Tools/Databases/Qdrant/QdrantClientImplementation.cs

@@ -0,0 +1,66 @@
+using Qdrant.Client;
+using Qdrant.Client.Grpc;
+using AIStudio.Tools.PluginSystem;
+
+namespace AIStudio.Tools.Databases.Qdrant;
+
+public class QdrantClientImplementation : DatabaseClient
+{
+    private static string TB(string fallbackEN) => I18N.I.T(fallbackEN, typeof(QdrantClientImplementation).Namespace, nameof(QdrantClientImplementation));
+
+    private int HttpPort { get; }
+    
+    private int GrpcPort { get; }
+    
+    private QdrantClient GrpcClient { get; }
+    
+    private string Fingerprint { get; }
+    
+    private string ApiToken { get; }
+    
+    public QdrantClientImplementation(string name, string path, int httpPort, int grpcPort, string fingerprint, string apiToken): base(name, path)
+    {
+        this.HttpPort = httpPort;
+        this.GrpcPort = grpcPort;
+        this.Fingerprint = fingerprint;
+        this.ApiToken = apiToken;
+        this.GrpcClient = this.CreateQdrantClient();
+    }
+    
+    private const string IP_ADDRESS = "localhost";
+
+    private QdrantClient CreateQdrantClient()
+    {
+        var address = "https://" + IP_ADDRESS + ":" + this.GrpcPort;
+        var channel = QdrantChannel.ForAddress(address, new ClientConfiguration
+        {
+            ApiKey = this.ApiToken,
+            CertificateThumbprint = this.Fingerprint
+        });
+        var grpcClient = new QdrantGrpcClient(channel);
+        return new QdrantClient(grpcClient);
+    }
+
+    private async Task<string> GetVersion()
+    {
+        var operation =  await this.GrpcClient.HealthAsync();
+        return "v"+operation.Version;
+    }
+
+    private async Task<string> GetCollectionsAmount()
+    {
+        var operation = await this.GrpcClient.ListCollectionsAsync();
+        return operation.Count.ToString();
+    }
+    
+    public override async IAsyncEnumerable<(string Label, string Value)> GetDisplayInfo()
+    {
+        yield return (TB("HTTP port"), this.HttpPort.ToString());
+        yield return (TB("gRPC port"), this.GrpcPort.ToString());
+        yield return (TB("Reported version"), await this.GetVersion());
+        yield return (TB("Storage size"), $"{this.GetStorageSize()}");
+        yield return (TB("Number of collections"), await this.GetCollectionsAmount());
+    }
+
+    public override void Dispose() => this.GrpcClient.Dispose();
+}

app/MindWork AI Studio/Tools/EnterpriseEncryption.cs

@@ -0,0 +1,211 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace AIStudio.Tools;
+
+/// <summary>
+/// Provides encryption and decryption functionality for enterprise configuration plugins.
+/// This is used to encrypt/decrypt API keys in Lua configuration files.
+/// </summary>
+/// <remarks>
+/// Important: This is obfuscation, not security. Users with administrative access
+/// to their machines can potentially extract the decrypted API keys. This feature
+/// is designed to prevent casual exposure of API keys in configuration files. It
+/// also protects against accidental leaks while sharing configuration snippets,
+/// as the encrypted values cannot be decrypted without the secret key.
+/// </remarks>
+public sealed class EnterpriseEncryption
+{
+    /// <summary>
+    /// The number of iterations to derive the key and IV from the password.
+    /// We use a higher iteration count here because the secret is static
+    /// (not regenerated each startup like the IPC encryption).
+    /// </summary>
+    private const int ITERATIONS = 10_000;
+
+    /// <summary>
+    /// The length of the salt in bytes.
+    /// </summary>
+    private const int SALT_LENGTH = 16;
+
+    /// <summary>
+    /// The prefix for encrypted values.
+    /// </summary>
+    private const string PREFIX = "ENC:v1:";
+
+    private readonly ILogger<EnterpriseEncryption> logger;
+    private readonly byte[]? secretKey;
+
+    /// <summary>
+    /// Gets a value indicating whether the encryption service is available.
+    /// </summary>
+    public bool IsAvailable { get; }
+
+    /// <summary>
+    /// Creates a new instance of the enterprise encryption service.
+    /// </summary>
+    /// <param name="logger">The logger instance.</param>
+    /// <param name="base64Secret">The base64-encoded 32-byte encryption secret.</param>
+    public EnterpriseEncryption(ILogger<EnterpriseEncryption> logger, string? base64Secret)
+    {
+        this.logger = logger;
+
+        if (string.IsNullOrWhiteSpace(base64Secret))
+        {
+            this.logger.LogWarning("No enterprise encryption secret configured. Encrypted API keys in configuration plugins will not be available.");
+            this.IsAvailable = false;
+            return;
+        }
+
+        try
+        {
+            this.secretKey = Convert.FromBase64String(base64Secret);
+            if (this.secretKey.Length != 32)
+            {
+                this.logger.LogWarning($"The enterprise encryption secret must be exactly 32 bytes (256 bits). Got {this.secretKey.Length} bytes.");
+                this.secretKey = null;
+                this.IsAvailable = false;
+                return;
+            }
+
+            this.IsAvailable = true;
+            this.logger.LogInformation("Enterprise encryption service initialized successfully.");
+        }
+        catch (FormatException ex)
+        {
+            this.logger.LogWarning(ex, "Failed to decode the enterprise encryption secret from base64.");
+            this.IsAvailable = false;
+        }
+    }
+
+    /// <summary>
+    /// Checks if the given value is encrypted (has the encryption prefix).
+    /// </summary>
+    /// <param name="value">The value to check.</param>
+    /// <returns>True if the value starts with the encryption prefix; otherwise, false.</returns>
+    public static bool IsEncrypted(string? value) => value?.StartsWith(PREFIX, StringComparison.Ordinal) ?? false;
+
+    /// <summary>
+    /// Tries to decrypt an encrypted value.
+    /// </summary>
+    /// <param name="encryptedValue">The encrypted value (with ENC:v1: prefix).</param>
+    /// <param name="decryptedValue">When successful, contains the decrypted plaintext.</param>
+    /// <returns>True if decryption was successful; otherwise, false.</returns>
+    public bool TryDecrypt(string encryptedValue, out string decryptedValue)
+    {
+        decryptedValue = string.Empty;
+        if (!this.IsAvailable)
+        {
+            this.logger.LogWarning("Cannot decrypt: Enterprise encryption service is not available.");
+            return false;
+        }
+
+        if (!IsEncrypted(encryptedValue))
+        {
+            this.logger.LogWarning("Cannot decrypt: Value does not have the expected encryption prefix.");
+            return false;
+        }
+
+        try
+        {
+            // Extract the base64-encoded data after the prefix:
+            var base64Data = encryptedValue[PREFIX.Length..];
+            var encryptedBytes = Convert.FromBase64String(base64Data);
+            if (encryptedBytes.Length < SALT_LENGTH + 1)
+            {
+                this.logger.LogWarning("Cannot decrypt: Encrypted data is too short.");
+                return false;
+            }
+
+            // Extract salt and encrypted content:
+            var salt = encryptedBytes[..SALT_LENGTH];
+            var cipherText = encryptedBytes[SALT_LENGTH..];
+
+            // Derive key and IV using PBKDF2:
+            using var keyDerivation = new Rfc2898DeriveBytes(this.secretKey!, salt, ITERATIONS, HashAlgorithmName.SHA512);
+            var key = keyDerivation.GetBytes(32); // AES-256
+            var iv = keyDerivation.GetBytes(16);  // AES block size
+
+            // Decrypt using AES-256-CBC:
+            using var aes = Aes.Create();
+            aes.Key = key;
+            aes.IV = iv;
+            aes.Mode = CipherMode.CBC;
+            aes.Padding = PaddingMode.PKCS7;
+
+            using var decryptor = aes.CreateDecryptor();
+            var decryptedBytes = decryptor.TransformFinalBlock(cipherText, 0, cipherText.Length);
+            decryptedValue = Encoding.UTF8.GetString(decryptedBytes);
+
+            return true;
+        }
+        catch (FormatException ex)
+        {
+            this.logger.LogWarning(ex, "Failed to decode encrypted value from base64.");
+            return false;
+        }
+        catch (CryptographicException ex)
+        {
+            this.logger.LogWarning(ex, "Failed to decrypt value. The encryption secret may be incorrect.");
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Encrypts a plaintext value.
+    /// </summary>
+    /// <param name="plaintext">The plaintext to encrypt.</param>
+    /// <param name="encryptedValue">When successful, contains the encrypted value with prefix.</param>
+    /// <returns>True if encryption was successful; otherwise, false.</returns>
+    public bool TryEncrypt(string plaintext, out string encryptedValue)
+    {
+        encryptedValue = string.Empty;
+        if (!this.IsAvailable)
+        {
+            this.logger.LogWarning("Cannot encrypt: Enterprise encryption service is not available.");
+            return false;
+        }
+
+        try
+        {
+            // Generate a random salt:
+            var salt = RandomNumberGenerator.GetBytes(SALT_LENGTH);
+
+            // Derive key and IV using PBKDF2:
+            using var keyDerivation = new Rfc2898DeriveBytes(this.secretKey!, salt, ITERATIONS, HashAlgorithmName.SHA512);
+            var key = keyDerivation.GetBytes(32); // AES-256
+            var iv = keyDerivation.GetBytes(16);  // AES block size
+
+            // Encrypt using AES-256-CBC:
+            using var aes = Aes.Create();
+            aes.Key = key;
+            aes.IV = iv;
+            aes.Mode = CipherMode.CBC;
+            aes.Padding = PaddingMode.PKCS7;
+
+            using var encryptor = aes.CreateEncryptor();
+            var plaintextBytes = Encoding.UTF8.GetBytes(plaintext);
+            var cipherText = encryptor.TransformFinalBlock(plaintextBytes, 0, plaintextBytes.Length);
+
+            // Combine salt and ciphertext
+            var combined = new byte[SALT_LENGTH + cipherText.Length];
+            Array.Copy(salt, 0, combined, 0, SALT_LENGTH);
+            Array.Copy(cipherText, 0, combined, SALT_LENGTH, cipherText.Length);
+
+            // Encode to base64 and add the prefix:
+            encryptedValue = PREFIX + Convert.ToBase64String(combined);
+            return true;
+        }
+        catch (CryptographicException ex)
+        {
+            this.logger.LogWarning(ex, "Failed to encrypt value.");
+            return false;
+        }
+    }
+
+    /// <summary>
+    /// Generates a new random 32-byte secret key and returns it as a base64 string.
+    /// </summary>
+    /// <returns>A base64-encoded 32-byte secret key.</returns>
+    public static string GenerateSecret() => Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
+}

app/MindWork AI Studio/Tools/ISecretId.cs

@@ -5,6 +5,13 @@ namespace AIStudio.Tools;
 /// </summary>
 public interface ISecretId
 {
+    /// <summary>
+    /// Prefix used for secrets imported from enterprise configuration plugins.
+    /// This helps distinguish enterprise-managed keys from user-added keys
+    /// in the OS keyring.
+    /// </summary>
+    public const string ENTERPRISE_KEY_PREFIX = "config-plugin";
+
     /// <summary>
     /// The unique ID of the secret.
     /// </summary>

app/MindWork AI Studio/Tools/LuaTools.cs

@@ -0,0 +1,16 @@
+namespace AIStudio.Tools;
+
+public static class LuaTools
+{
+    public static string EscapeLuaString(string? value)
+    {
+        if (string.IsNullOrEmpty(value))
+            return string.Empty;
+
+        return value
+            .Replace("\\", "\\\\")
+            .Replace("\"", "\\\"")
+            .Replace("\r", "\\r")
+            .Replace("\n", "\\n");
+    }
+}

app/MindWork AI Studio/Tools/Metadata/MetaDataDatabasesAttribute.cs

@@ -0,0 +1,6 @@
+namespace AIStudio.Tools.Metadata;
+
+public class MetaDataDatabasesAttribute(string databaseVersion) : Attribute
+{
+    public string DatabaseVersion => databaseVersion;
+}

app/MindWork AI Studio/Tools/PluginSystem/PendingEnterpriseApiKey.cs

@@ -0,0 +1,49 @@
+namespace AIStudio.Tools.PluginSystem;
+
+/// <summary>
+/// Represents a pending API key that needs to be stored in the OS keyring.
+/// This is used during plugin loading to collect API keys from configuration plugins
+/// before storing them asynchronously.
+/// </summary>
+/// <param name="SecretId">The secret ID (provider ID).</param>
+/// <param name="SecretName">The secret name (provider instance name).</param>
+/// <param name="ApiKey">The decrypted API key.</param>
+/// <param name="StoreType">The type of secret store to use.</param>
+public sealed record PendingEnterpriseApiKey(
+    string SecretId,
+    string SecretName,
+    string ApiKey,
+    SecretStoreType StoreType);
+
+/// <summary>
+/// Static container for pending API keys during plugin loading.
+/// </summary>
+public static class PendingEnterpriseApiKeys
+{
+    private static readonly List<PendingEnterpriseApiKey> PENDING_KEYS = [];
+    private static readonly Lock LOCK = new();
+
+    /// <summary>
+    /// Adds a pending API key to the list.
+    /// </summary>
+    /// <param name="key">The pending API key to add.</param>
+    public static void Add(PendingEnterpriseApiKey key)
+    {
+        lock (LOCK)
+            PENDING_KEYS.Add(key);
+    }
+
+    /// <summary>
+    /// Gets and clears all pending API keys.
+    /// </summary>
+    /// <returns>A list of all pending API keys.</returns>
+    public static IReadOnlyList<PendingEnterpriseApiKey> GetAndClear()
+    {
+        lock (LOCK)
+        {
+            var keys = PENDING_KEYS.ToList();
+            PENDING_KEYS.Clear();
+            return keys;
+        }
+    }
+}

app/MindWork AI Studio/Tools/PluginSystem/PluginBase.cs

@@ -332,17 +332,56 @@ public abstract partial class PluginBase : IPluginMetadata
             return false;
         }
 
-        if (!url.StartsWith("http://", StringComparison.InvariantCultureIgnoreCase) && !url.StartsWith("https://", StringComparison.InvariantCultureIgnoreCase))
+        url = url.Trim();
+        if (!Uri.TryCreate(url, UriKind.Absolute, out var sourceUri))
         {
             url = string.Empty;
-            message = TB("The field SOURCE_URL is not a valid URL. The URL must start with 'http://' or 'https://'.");
+            message = TB("The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'.");
             return false;
         }
 
+        var isHttp = sourceUri.Scheme.Equals(Uri.UriSchemeHttp, StringComparison.OrdinalIgnoreCase);
+        var isHttps = sourceUri.Scheme.Equals(Uri.UriSchemeHttps, StringComparison.OrdinalIgnoreCase);
+        var isMailTo = sourceUri.Scheme.Equals(Uri.UriSchemeMailto, StringComparison.OrdinalIgnoreCase);
+        if (!isHttp && !isHttps && !isMailTo)
+        {
+            url = string.Empty;
+            message = TB("The field SOURCE_URL is not a valid URL. The URL must start with 'http://', 'https://', or 'mailto:'.");
+            return false;
+        }
+
+        if (isMailTo)
+        {
+            var recipient = ExtractMailtoRecipient(url);
+            if (string.IsNullOrWhiteSpace(recipient))
+            {
+                url = string.Empty;
+                message = TB("The field SOURCE_URL is not a valid URL. When the URL starts with 'mailto:', it must contain a valid email address as recipient.");
+                return false;
+            }
+        }
+
+        url = sourceUri.ToString();
+        
         message = string.Empty;
         return true;
     }
 
+    private static string ExtractMailtoRecipient(string rawUrl)
+    {
+        var separatorIndex = rawUrl.IndexOf(':');
+        if (separatorIndex < 0 || separatorIndex + 1 >= rawUrl.Length)
+            return string.Empty;
+
+        var schemeSpecificPart = rawUrl[(separatorIndex + 1)..];
+        var queryStart = schemeSpecificPart.IndexOf('?');
+        var recipient = queryStart >= 0
+            ? schemeSpecificPart[..queryStart]
+            : schemeSpecificPart;
+        
+        return recipient.Trim();
+    }
+    
     /// <summary>
     /// Tries to read the categories of the plugin.
     /// </summary>

app/MindWork AI Studio/Tools/PluginSystem/PluginConfiguration.cs

@@ -1,4 +1,5 @@
 using AIStudio.Settings;
+using AIStudio.Tools.Services;
 
 using Lua;
 
@@ -8,6 +9,7 @@ public sealed class PluginConfiguration(bool isInternal, LuaState state, PluginT
 {
     private static string TB(string fallbackEN) => I18N.I.T(fallbackEN, typeof(PluginConfiguration).Namespace, nameof(PluginConfiguration));
     private static readonly SettingsManager SETTINGS_MANAGER = Program.SERVICE_PROVIDER.GetRequiredService<SettingsManager>();
+    private static readonly ILogger LOG = Program.LOGGER_FACTORY.CreateLogger(nameof(PluginConfiguration));
 
     private List<PluginConfigurationObject> configObjects = [];
     
@@ -23,11 +25,50 @@ public sealed class PluginConfiguration(bool isInternal, LuaState state, PluginT
 
         if (!dryRun)
         {
+            // Store any decrypted API keys from enterprise configuration in the OS keyring:
+            await StoreEnterpriseApiKeysAsync();
+
             await SETTINGS_MANAGER.StoreSettings();
             await MessageBus.INSTANCE.SendMessage<bool>(null, Event.CONFIGURATION_CHANGED);
         }
     }
 
+    /// <summary>
+    /// Stores any pending enterprise API keys in the OS keyring.
+    /// </summary>
+    private static async Task StoreEnterpriseApiKeysAsync()
+    {
+        var pendingKeys = PendingEnterpriseApiKeys.GetAndClear();
+        if (pendingKeys.Count == 0)
+            return;
+
+        LOG.LogInformation($"Storing {pendingKeys.Count} enterprise API key(s) in the OS keyring.");
+        var rustService = Program.SERVICE_PROVIDER.GetRequiredService<RustService>();
+        foreach (var pendingKey in pendingKeys)
+        {
+            try
+            {
+                // Create a temporary secret ID object for storing the key:
+                var secretId = new TemporarySecretId(pendingKey.SecretId, pendingKey.SecretName);
+                var result = await rustService.SetAPIKey(secretId, pendingKey.ApiKey, pendingKey.StoreType);
+
+                if (result.Success)
+                    LOG.LogDebug($"Successfully stored enterprise API key for '{pendingKey.SecretName}' in the OS keyring.");
+                else
+                    LOG.LogWarning($"Failed to store enterprise API key for '{pendingKey.SecretName}': {result.Issue}");
+            }
+            catch (Exception ex)
+            {
+                LOG.LogError(ex, $"Exception while storing enterprise API key for '{pendingKey.SecretName}'.");
+            }
+        }
+    }
+
+    /// <summary>
+    /// Temporary implementation of ISecretId for storing enterprise API keys.
+    /// </summary>
+    private sealed record TemporarySecretId(string SecretId, string SecretName) : ISecretId;
+
     /// <summary>
     /// Tries to initialize the UI text content of the plugin.
     /// </summary>
@@ -61,6 +102,9 @@ public sealed class PluginConfiguration(bool isInternal, LuaState state, PluginT
         // Config: allow the user to add providers?
         ManagedConfiguration.TryProcessConfiguration(x => x.App, x => x.AllowUserToAddProvider, this.Id, settingsTable, dryRun);
 
+        // Config: show administration settings?
+        ManagedConfiguration.TryProcessConfiguration(x => x.App, x => x.ShowAdminSettings, this.Id, settingsTable, dryRun);
+        
         // Config: preview features visibility
         ManagedConfiguration.TryProcessConfiguration(x => x.App, x => x.PreviewVisibility, this.Id, settingsTable, dryRun);
         

app/MindWork AI Studio/Tools/PluginSystem/PluginConfigurationObject.cs

@@ -2,6 +2,7 @@ using System.Linq.Expressions;
 
 using AIStudio.Settings;
 using AIStudio.Settings.DataModel;
+using AIStudio.Tools.Services;
 
 using Lua;
 
@@ -13,6 +14,7 @@ namespace AIStudio.Tools.PluginSystem;
 /// </summary>
 public sealed record PluginConfigurationObject
 {
+    private static readonly RustService RUST_SERVICE = Program.SERVICE_PROVIDER.GetRequiredService<RustService>();
     private static readonly SettingsManager SETTINGS_MANAGER = Program.SERVICE_PROVIDER.GetRequiredService<SettingsManager>();
     private static readonly ILogger LOG = Program.LOGGER_FACTORY.CreateLogger<PluginConfigurationObject>();
     
@@ -168,37 +170,45 @@ public sealed record PluginConfigurationObject
     /// <param name="configObjectSelection">A selection expression to retrieve the configuration objects from the main configuration.</param>
     /// <param name="availablePlugins">A list of currently available plugins.</param>
     /// <param name="configObjectList">A list of all existing configuration objects.</param>
+    /// <param name="secretStoreType">An optional parameter specifying the type of secret store to use for deleting associated API keys from the OS keyring, if applicable.</param>
     /// <returns>Returns true if the configuration was altered during cleanup; otherwise, false.</returns>
-    public static bool CleanLeftOverConfigurationObjects<TClass>(
+    public static async Task<bool> CleanLeftOverConfigurationObjects<TClass>(
         PluginConfigurationObjectType configObjectType,
         Expression<Func<Data, List<TClass>>> configObjectSelection,
         IList<IAvailablePlugin> availablePlugins,
-        IList<PluginConfigurationObject> configObjectList) where TClass : IConfigurationObject
+        IList<PluginConfigurationObject> configObjectList,
+        SecretStoreType? secretStoreType = null) where TClass : IConfigurationObject
     {
         var configuredObjects = configObjectSelection.Compile()(SETTINGS_MANAGER.ConfigurationData);
         var leftOverObjects = new List<TClass>();
         foreach (var configuredObject in configuredObjects)
         {
+            // Only process objects that are based on enterprise configuration plugins (aka configuration plugins),
+            // as only those can be left over after a plugin was removed:
             if(!configuredObject.IsEnterpriseConfiguration)
                 continue;
 
+            // From what plugin is this configuration object coming from?
             var configObjectSourcePluginId = configuredObject.EnterpriseConfigurationPluginId;
             if(configObjectSourcePluginId == Guid.Empty)
                 continue;
             
+            // Is the source plugin still available? If not, we can be pretty sure that this configuration object is left
+            // over and should be removed:
             var templateSourcePlugin = availablePlugins.FirstOrDefault(plugin => plugin.Id == configObjectSourcePluginId);
             if(templateSourcePlugin is null)
             {
-                LOG.LogWarning($"The configured object '{configuredObject.Name}' (id={configuredObject.Id}) is based on a plugin that is not available anymore. Removing the chat template from the settings.");
+                LOG.LogWarning($"The configured object '{configuredObject.Name}' (id={configuredObject.Id}) is based on a plugin that is not available anymore. Removing this object from the settings.");
                 leftOverObjects.Add(configuredObject);
             }
             
+            // Is the configuration object still present in the configuration plugin? If not, it is also left over and should be removed:
             if(!configObjectList.Any(configObject =>
                    configObject.Type == configObjectType &&
                    configObject.ConfigPluginId == configObjectSourcePluginId &&
                    configObject.Id.ToString() == configuredObject.Id))
             {
-                LOG.LogWarning($"The configured object '{configuredObject.Name}' (id={configuredObject.Id}) is not present in the configuration plugin anymore. Removing the chat template from the settings.");
+                LOG.LogWarning($"The configured object '{configuredObject.Name}' (id={configuredObject.Id}) is not present in the configuration plugin anymore. Removing the object from the settings.");
                 leftOverObjects.Add(configuredObject);
             }
         }
@@ -206,8 +216,20 @@ public sealed record PluginConfigurationObject
         // Remove collected items after enumeration to avoid modifying the collection during iteration:
         var wasConfigurationChanged = leftOverObjects.Count > 0;
         foreach (var item in leftOverObjects.Distinct())
+        {
             configuredObjects.Remove(item);
         
+            // Delete the API key from the OS keyring if the removed object has one:
+            if(secretStoreType is not null && item is ISecretId secretId)
+            {
+                var deleteResult = await RUST_SERVICE.DeleteAPIKey(secretId, secretStoreType.Value);
+                if (deleteResult.Success)
+                    LOG.LogInformation($"Successfully deleted API key for removed enterprise provider '{item.Name}' from the OS keyring.");
+                else
+                    LOG.LogWarning($"Failed to delete API key for removed enterprise provider '{item.Name}' from the OS keyring: {deleteResult.Issue}");
+            }
+        }
+
         return wasConfigurationChanged;
     }
 }

app/MindWork AI Studio/Tools/PluginSystem/PluginFactory.Loading.cs

@@ -131,26 +131,26 @@ public static partial class PluginFactory
         //
         
         // Check LLM providers:
-        var wasConfigurationChanged = PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.LLM_PROVIDER, x => x.Providers, AVAILABLE_PLUGINS, configObjectList);
+        var wasConfigurationChanged = await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.LLM_PROVIDER, x => x.Providers, AVAILABLE_PLUGINS, configObjectList, SecretStoreType.LLM_PROVIDER);
 
         // Check transcription providers:
-        if(PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.TRANSCRIPTION_PROVIDER, x => x.TranscriptionProviders, AVAILABLE_PLUGINS, configObjectList))
+        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.TRANSCRIPTION_PROVIDER, x => x.TranscriptionProviders, AVAILABLE_PLUGINS, configObjectList, SecretStoreType.TRANSCRIPTION_PROVIDER))
             wasConfigurationChanged = true;
 
         // Check embedding providers:
-        if(PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.EMBEDDING_PROVIDER, x => x.EmbeddingProviders, AVAILABLE_PLUGINS, configObjectList))
+        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.EMBEDDING_PROVIDER, x => x.EmbeddingProviders, AVAILABLE_PLUGINS, configObjectList, SecretStoreType.EMBEDDING_PROVIDER))
             wasConfigurationChanged = true;
 
         // Check chat templates:
-        if(PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.CHAT_TEMPLATE, x => x.ChatTemplates, AVAILABLE_PLUGINS, configObjectList))
+        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.CHAT_TEMPLATE, x => x.ChatTemplates, AVAILABLE_PLUGINS, configObjectList))
             wasConfigurationChanged = true;
 
         // Check profiles:
-        if(PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.PROFILE, x => x.Profiles, AVAILABLE_PLUGINS, configObjectList))
+        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.PROFILE, x => x.Profiles, AVAILABLE_PLUGINS, configObjectList))
             wasConfigurationChanged = true;
 
         // Check document analysis policies:
-        if(PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.DOCUMENT_ANALYSIS_POLICY, x => x.DocumentAnalysis.Policies, AVAILABLE_PLUGINS, configObjectList))
+        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.DOCUMENT_ANALYSIS_POLICY, x => x.DocumentAnalysis.Policies, AVAILABLE_PLUGINS, configObjectList))
             wasConfigurationChanged = true;
         
         // Check for a preselected profile:
@@ -169,6 +169,10 @@ public static partial class PluginFactory
         if(ManagedConfiguration.IsConfigurationLeftOver(x => x.App, x => x.AllowUserToAddProvider, AVAILABLE_PLUGINS))
             wasConfigurationChanged = true;
 
+        // Check for admin settings visibility:
+        if(ManagedConfiguration.IsConfigurationLeftOver(x => x.App, x => x.ShowAdminSettings, AVAILABLE_PLUGINS))
+            wasConfigurationChanged = true;
+        
         // Check for preview visibility:
         if(ManagedConfiguration.IsConfigurationLeftOver(x => x.App, x => x.PreviewVisibility, AVAILABLE_PLUGINS))
             wasConfigurationChanged = true;

app/MindWork AI Studio/Tools/PluginSystem/PluginFactory.cs

@@ -18,6 +18,29 @@ public static partial class PluginFactory
 
     public static ILanguagePlugin BaseLanguage => BASE_LANGUAGE_PLUGIN;
 
+    /// <summary>
+    /// Gets the enterprise encryption instance for decrypting API keys in configuration plugins.
+    /// </summary>
+    public static EnterpriseEncryption? EnterpriseEncryption { get; private set; }
+
+    /// <summary>
+    /// Initializes the enterprise encryption service by reading the encryption secret
+    /// from the Windows Registry or environment variables.
+    /// </summary>
+    /// <param name="rustService">The Rust service to use for reading the encryption secret.</param>
+    public static async Task InitializeEnterpriseEncryption(Services.RustService rustService)
+    {
+        LOG.LogInformation("Initializing enterprise encryption service...");
+        var encryptionSecret = await rustService.EnterpriseEnvConfigEncryptionSecret();
+        var enterpriseEncryptionLogger = Program.LOGGER_FACTORY.CreateLogger<EnterpriseEncryption>();
+        EnterpriseEncryption = new EnterpriseEncryption(enterpriseEncryptionLogger, encryptionSecret);
+
+        if (EnterpriseEncryption.IsAvailable)
+            LOG.LogInformation("Enterprise encryption service is available.");
+        else
+            LOG.LogWarning("Enterprise encryption service is not available (no secret configured).");
+    }
+
     /// <summary>
     /// Set up the plugin factory. We will read the data directory from the settings manager.
     /// Afterward, we will create the plugins directory and the internal plugin directory.

app/MindWork AI Studio/Tools/Rust/QdrantInfo.cs

@@ -0,0 +1,17 @@
+namespace AIStudio.Tools.Rust;
+
+/// <summary>
+/// The response of the Qdrant information request.
+/// </summary>
+public readonly record struct QdrantInfo
+{
+    public string Path { get; init; }
+    
+    public int PortHttp { get; init; }
+    
+    public int PortGrpc { get; init; }
+    
+    public string Fingerprint { get; init; }
+    
+    public string ApiToken { get; init; }
+}

app/MindWork AI Studio/Tools/Services/RustService.Databases.cs

@@ -0,0 +1,25 @@
+using AIStudio.Tools.Rust;
+
+namespace AIStudio.Tools.Services;
+
+public sealed partial class RustService
+{
+    public async Task<QdrantInfo> GetQdrantInfo()
+    {
+        try
+        {
+            var cts = new CancellationTokenSource(TimeSpan.FromSeconds(45));
+            var response = await this.http.GetFromJsonAsync<QdrantInfo>("/system/qdrant/info", this.jsonRustSerializerOptions, cts.Token);
+            return response;
+        }
+        catch (Exception e)
+        {
+            if(this.logger is not null)
+                this.logger.LogError(e, "Error while fetching Qdrant info from Rust service.");
+            else
+                Console.WriteLine($"Error while fetching Qdrant info from Rust service: '{e}'.");
+            
+            return default;
+        }
+    }
+}

app/MindWork AI Studio/Tools/Services/RustService.Enterprise.cs

@@ -65,4 +65,24 @@ public sealed partial class RustService
         var serverUrl = await result.Content.ReadAsStringAsync();
         return string.IsNullOrWhiteSpace(serverUrl) ? string.Empty : serverUrl;
     }
+
+    /// <summary>
+    /// Tries to read the enterprise environment for the configuration encryption secret.
+    /// </summary>
+    /// <returns>
+    /// Returns an empty string when the environment is not set or the request fails.
+    /// Otherwise, the base64-encoded encryption secret.
+    /// </returns>
+    public async Task<string> EnterpriseEnvConfigEncryptionSecret()
+    {
+        var result = await this.http.GetAsync("/system/enterprise/config/encryption_secret");
+        if (!result.IsSuccessStatusCode)
+        {
+            this.logger!.LogError($"Failed to query the enterprise configuration encryption secret: '{result.StatusCode}'");
+            return string.Empty;
+        }
+
+        var encryptionSecret = await result.Content.ReadAsStringAsync();
+        return string.IsNullOrWhiteSpace(encryptionSecret) ? string.Empty : encryptionSecret;
+    }
 }

app/MindWork AI Studio/packages.lock.json

@@ -62,6 +62,16 @@
           "MudBlazor": "8.11.0"
         }
       },
+      "Qdrant.Client": {
+        "type": "Direct",
+        "requested": "[1.16.1, )",
+        "resolved": "1.16.1",
+        "contentHash": "EJo50JXTdjY2JOUphCFLXoHukI/tz/ykLCmMnQHUjsKT22ZfL0XIdEziHOC3vjw2SOoY8WDVQ+AxixEonejOZA==",
+        "dependencies": {
+          "Google.Protobuf": "3.31.0",
+          "Grpc.Net.Client": "2.71.0"
+        }
+      },
       "ReverseMarkdown": {
         "type": "Direct",
         "requested": "[5.0.0, )",
@@ -76,6 +86,33 @@
         "resolved": "3.2.449",
         "contentHash": "uA9sYDy4VepL3xwzBTLcP2LyuVYMt0ZIT3gaSiXvGoX15Ob+rOP+hGydhevlSVd+rFo+Y+VQFEHDuWU8HBW+XA=="
       },
+      "Google.Protobuf": {
+        "type": "Transitive",
+        "resolved": "3.31.0",
+        "contentHash": "OZXSf6igaJBeo+kAzMhYF0R5zp0nRgf4G0Uis/IsGKACc4RGP9bQPLpHLengIFuASl0lY92utMB8rRpTx4TaOg=="
+      },
+      "Grpc.Core.Api": {
+        "type": "Transitive",
+        "resolved": "2.71.0",
+        "contentHash": "QquqUC37yxsDzd1QaDRsH2+uuznWPTS8CVE2Yzwl3CvU4geTNkolQXoVN812M2IwT6zpv3jsZRc9ExJFNFslTg=="
+      },
+      "Grpc.Net.Client": {
+        "type": "Transitive",
+        "resolved": "2.71.0",
+        "contentHash": "U1vr20r5ngoT9nlb7wejF28EKN+taMhJsV9XtK9MkiepTZwnKxxiarriiMfCHuDAfPUm9XUjFMn/RIuJ4YY61w==",
+        "dependencies": {
+          "Grpc.Net.Common": "2.71.0",
+          "Microsoft.Extensions.Logging.Abstractions": "6.0.0"
+        }
+      },
+      "Grpc.Net.Common": {
+        "type": "Transitive",
+        "resolved": "2.71.0",
+        "contentHash": "v0c8R97TwRYwNXlC8GyRXwYTCNufpDfUtj9la+wUrZFzVWkFJuNAltU+c0yI3zu0jl54k7en6u2WKgZgd57r2Q==",
+        "dependencies": {
+          "Grpc.Core.Api": "2.71.0"
+        }
+      },
       "Markdig": {
         "type": "Transitive",
         "resolved": "0.41.3",

app/MindWork AI Studio/wwwroot/changelog/v26.2.2.md

@@ -1 +1,10 @@
 # v26.2.2, build 234 (2026-02-xx xx:xx UTC)
+- Added a vector database (Qdrant) as a building block for our local RAG (retrieval-augmented generation) solution. Thank you very much, Paul (`PaulKoudelka`), for this major contribution. Note that our local RAG implementation remained in preview and has not yet been released; other building blocks are not yet ready.
+- Added an app setting to enable administration options for IT staff to configure and maintain organization-wide settings.
+- Added an option to export all provider types (LLMs, embeddings, transcriptions) so you can use them in a configuration plugin. You'll be asked if you want to export the related API key too. API keys will be encrypted in the export. This feature only shows up when administration options are enabled.
+- Added an option in the app settings to create an encryption secret, which is required to encrypt values (for example, API keys) in configuration plugins. This feature only shows up when administration options are enabled.
+- Improved the document analysis assistant (in beta) by hiding the export functionality by default. Enable the administration options in the app settings to show and use the export functionality. This streamlines the usage for regular users.
+- Improved the workspaces experience by using a different color for the delete button to avoid confusion.
+- Improved the plugins page by adding an action to open the plugin source link. The action opens website URLs in an external browser, supports `mailto:` links for direct email composition.
+- Fixed an issue where manually saving chats in workspace manual-storage mode could appear unreliable during response streaming. The save button is now disabled while streaming to prevent partial saves.
+- Upgraded dependencies.

documentation/Build.md

@@ -45,7 +45,17 @@ Do you want to test your changes before creating a PR? Follow these steps:
 9. Execute the command `dotnet run`.
 10. After compiling the .NET code, the app will finally start inside the Tauri runtime window.
 
-You can now test your changes.
+You can now test your changes. To stop the application:  
+- Close the Tauri window (GUI).  
+- Press ``Ctrl+C`` in the terminal where the app is running.  
+- Stop the process via your IDE’s run/debug controls.
+
+> ⚠️ Important: Stopping the app via ``Ctrl+C`` or the IDE may not terminate the Qdrant sidecar process, especially on Windows. This can lead to startup failures when restarting the app.
+
+If you encounter issues with restarting Tauri, then manually kill the Qdrant process:  
+- **Linux/macOS:** Run pkill -f qdrant in your terminal.  
+- **Windows:** Open Task Manager → Find qdrant.exe → Right-click → “End task”.
+- Restart your Tauri app.
 
 ## Create a release
 In order to create a release:

documentation/Enterprise IT.md

@@ -27,6 +27,8 @@ The following keys and values (registry) and variables are checked and read:
 
 - Key `HKEY_CURRENT_USER\Software\github\MindWork AI Studio\Enterprise IT`, value `config_server_url` or variable `MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_SERVER_URL`: An HTTP or HTTPS address using an IP address or DNS name. This is the web server from which AI Studio attempts to load the specified configuration as a ZIP file.
 
+- Key `HKEY_CURRENT_USER\Software\github\MindWork AI Studio\Enterprise IT`, value `config_encryption_secret` or variable `MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_ENCRYPTION_SECRET`: A base64-encoded 32-byte encryption key for decrypting API keys in configuration plugins. This is optional and only needed if you want to include encrypted API keys in your configuration.
+
 Let's assume as example that `https://intranet.my-company.com:30100/ai-studio/configuration` is the server address and `9072b77d-ca81-40da-be6a-861da525ef7b` is the configuration ID. AI Studio will derive the following address from this information: `https://intranet.my-company.com:30100/ai-studio/configuration/9072b77d-ca81-40da-be6a-861da525ef7b.zip`. Important: The configuration ID will always be written in lowercase, even if it is configured in uppercase. If `9072B77D-CA81-40DA-BE6A-861DA525EF7B` is configured, the same address will be derived. Your web server must be configured accordingly.
 
 Finally, AI Studio will send a GET request and download the ZIP file. The ZIP file only contains the files necessary for the configuration. It's normal to include a file for an icon along with the actual configuration plugin.
@@ -82,14 +84,61 @@ The latest example of an AI Studio configuration via configuration plugin can al
 Please note that the icon must be an SVG vector graphic. Raster graphics like PNGs, GIFs, and others aren’t supported. You can use the sample icon, which looks like a gear.
 
 Currently, you can configure the following things:
-- Any number of self-hosted LLM providers (a combination of server and model), but currently only without API keys
+- Any number of LLM providers (self-hosted or cloud providers with encrypted API keys)
+- Any number of transcription providers for voice-to-text functionality
+- Any number of embedding providers for RAG
 - The update behavior of AI Studio
+- Various UI and feature settings (see the example configuration for details)
 
 All other settings can be made by the user themselves. If you need additional settings, feel free to create an issue in our planning repository: https://github.com/MindWorkAI/Planning/issues
 
-In the coming months, we will allow more settings, such as:
-- Using API keys for providers
-- Configuration of embedding providers for RAG
-- Configuration of data sources for RAG
-- Configuration of chat templates
-- Configuration of assistant plugins (for example, your own assistants for your company or specific departments)
+## Encrypted API Keys
+
+You can include encrypted API keys in your configuration plugins for cloud providers (like OpenAI, Anthropic) or secured on-premise models. This feature provides obfuscation to prevent casual exposure of API keys in configuration files.
+
+**Important Security Note:** This is obfuscation, not absolute security. Users with administrative access to their machines can potentially extract the decrypted API keys with sufficient effort. This feature is designed to:
+- Prevent API keys from being visible in plaintext in configuration files
+- Protect against accidental exposure when sharing or reviewing configurations
+- Add a barrier against casual snooping
+
+### Setting Up Encrypted API Keys
+
+1. **Generate an encryption secret:**
+   In AI Studio, enable the "Show administration settings" toggle in the app settings. Then click the "Generate encryption secret and copy to clipboard" button in the "Enterprise Administration" section. This generates a cryptographically secure 256-bit key and copies it to your clipboard as a base64 string.
+
+2. **Deploy the encryption secret:**
+   Distribute the secret to all client machines via Group Policy (Windows Registry) or environment variables:
+   - Registry: `HKEY_CURRENT_USER\Software\github\MindWork AI Studio\Enterprise IT\config_encryption_secret`
+   - Environment: `MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_ENCRYPTION_SECRET`
+
+   You must also deploy the same secret on the machine where you will export the encrypted API keys (step 3).
+
+3. **Export encrypted API keys from AI Studio:**
+   Once the encryption secret is deployed on your machine:
+   - Configure a provider with an API key in AI Studio's settings
+   - Click the export button for that provider
+   - If an API key is configured, you will be asked if you want to include the encrypted API key in the export
+   - The exported Lua code will contain the encrypted API key in the format `ENC:v1:<base64-encoded data>`
+
+4. **Add encrypted keys to your configuration:**
+   Copy the exported configuration (including the encrypted API key) into your configuration plugin.
+
+### Example Configuration with Encrypted API Key
+
+```lua
+CONFIG["LLM_PROVIDERS"][#CONFIG["LLM_PROVIDERS"]+1] = {
+    ["Id"] = "9072b77d-ca81-40da-be6a-861da525ef7b",
+    ["InstanceName"] = "Corporate OpenAI GPT-4",
+    ["UsedLLMProvider"] = "OPEN_AI",
+    ["Host"] = "NONE",
+    ["Hostname"] = "",
+    ["APIKey"] = "ENC:v1:MTIzNDU2Nzg5MDEyMzQ1NkFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFla...",
+    ["AdditionalJsonApiParameters"] = "",
+    ["Model"] = {
+        ["Id"] = "gpt-4",
+        ["DisplayName"] = "GPT-4",
+    }
+}
+```
+
+The API key will be automatically decrypted when the configuration is loaded and stored securely in the operating system's credential store (Windows Credential Manager / macOS Keychain).

metadata.txt

@@ -9,3 +9,4 @@
 8f9cd40d060, release
 osx-arm64
 144.0.7543.0
+1.16.3

runtime/Cargo.lock

@@ -197,9 +197,12 @@ dependencies = [
 
 [[package]]
 name = "atoi_simd"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4790f9e8961209112beb783d85449b508673cf4a6a419c8449b210743ac4dbe9"
+checksum = "8ad17c7c205c2c28b527b9845eeb91cf1b4d008b438f98ce0e628227a822758e"
+dependencies = [
+ "debug_unsafe",
+]
 
 [[package]]
 name = "atomic"
@@ -406,9 +409,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 
 [[package]]
 name = "bytes"
-version = "1.10.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f61dac84819c6588b558454b194026eb1f09c293b9036ae9b159e74e73ab6cf9"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 dependencies = [
  "serde",
 ]
@@ -458,9 +461,9 @@ dependencies = [
 
 [[package]]
 name = "calamine"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41bdeb83af82cd9cb686a19ed7efc2f50a21c262610f51ce945a8528860725ce"
+checksum = "96ae094b353c7810cd5efd2e69413ebb9354816138a387c09f7b90d4e826a49f"
 dependencies = [
  "atoi_simd",
  "byteorder",
@@ -470,7 +473,7 @@ dependencies = [
  "log",
  "quick-xml 0.38.4",
  "serde",
- "zip 4.2.0",
+ "zip 7.4.0",
 ]
 
 [[package]]
@@ -789,9 +792,9 @@ checksum = "19d374276b40fb8bbdee95aef7c7fa6b5316ec764510eb64b8dd0e2ed0d7e7f5"
 
 [[package]]
 name = "crc32fast"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
 dependencies = [
  "cfg-if",
 ]
@@ -948,6 +951,12 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "debug_unsafe"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85d3cef41d236720ed453e102153a53e4cc3d2fde848c0078a50cf249e8e3e5b"
+
 [[package]]
 name = "deflate64"
 version = "0.1.9"
@@ -970,12 +979,12 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.4.0"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+checksum = "ececcb659e7ba858fb4f10388c250a7252eb0a27373f1a72b8748afdd248e587"
 dependencies = [
  "powerfmt",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1073,6 +1082,16 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd0c93bb4b0c6d9b77f4435b0ae98c24d17f1c45b2ff844c6151a07256ca923b"
 
+[[package]]
+name = "dispatch2"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89a09f22a6c6069a18470eb92d2298acf25463f14256d24778e1230d789a2aec"
+dependencies = [
+ "bitflags 2.6.0",
+ "objc2",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -2082,7 +2101,7 @@ dependencies = [
  "iana-time-zone-haiku",
  "js-sys",
  "wasm-bindgen",
- "windows-core",
+ "windows-core 0.52.0",
 ]
 
 [[package]]
@@ -2776,11 +2795,11 @@ dependencies = [
  "arboard",
  "async-stream",
  "base64 0.22.1",
+ "bytes",
  "calamine",
  "cbc",
  "cfg-if",
  "cipher",
- "crossbeam-channel",
  "file-format",
  "flexi_logger",
  "futures",
@@ -2796,20 +2815,20 @@ dependencies = [
  "rand_chacha 0.9.0",
  "rcgen",
  "reqwest 0.13.1",
- "ring",
  "rocket",
  "serde",
  "serde_json",
  "sha2",
  "strum_macros",
  "sys-locale",
+ "sysinfo",
  "tauri",
  "tauri-build",
  "tauri-plugin-window-state",
+ "tempfile",
+ "time",
  "tokio",
  "tokio-stream",
- "tracing-subscriber",
- "url",
  "windows-registry 0.6.1",
 ]
 
@@ -2942,6 +2961,15 @@ dependencies = [
  "minimal-lexical",
 ]
 
+[[package]]
+name = "ntapi"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c70f219e21142367c70c0b30c6a9e3a14d55b4d12a204d897fbec83a0363f081"
+dependencies = [
+ "winapi",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.1"
@@ -2986,9 +3014,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
 
 [[package]]
 name = "num-integer"
@@ -3084,9 +3112,9 @@ dependencies = [
 
 [[package]]
 name = "objc2"
-version = "0.6.0"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3531f65190d9cff863b77a99857e74c314dd16bf56c538c4b57c7cbc3f3a6e59"
+checksum = "b7c2599ce0ec54857b29ce62166b0ed9b4f6f1a70ccc9a71165b6154caca8c05"
 dependencies = [
  "objc2-encode",
 ]
@@ -3105,11 +3133,12 @@ dependencies = [
 
 [[package]]
 name = "objc2-core-foundation"
-version = "0.3.0"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "daeaf60f25471d26948a1c2f840e3f7d86f4109e3af4e8e4b5cd70c39690d925"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
  "bitflags 2.6.0",
+ "dispatch2",
  "objc2",
 ]
 
@@ -3142,6 +3171,16 @@ dependencies = [
  "objc2-core-foundation",
 ]
 
+[[package]]
+name = "objc2-io-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33fafba39597d6dc1fb709123dfa8289d39406734be322956a69f0931c73bb15"
+dependencies = [
+ "libc",
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-io-surface"
 version = "0.3.0"
@@ -4897,6 +4936,20 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "sysinfo"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe840c5b1afe259a5657392a4dbb74473a14c8db999c3ec2f4ae812e028a94da"
+dependencies = [
+ "libc",
+ "memchr",
+ "ntapi",
+ "objc2-core-foundation",
+ "objc2-io-kit",
+ "windows 0.62.2",
+]
+
 [[package]]
 name = "system-configuration"
 version = "0.5.1"
@@ -5008,7 +5061,7 @@ dependencies = [
  "unicode-segmentation",
  "uuid",
  "windows 0.39.0",
- "windows-implement",
+ "windows-implement 0.39.0",
  "x11-dl",
 ]
 
@@ -5348,30 +5401,30 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa 1.0.11",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
@@ -5663,6 +5716,12 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "typed-path"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3015e6ce46d5ad8751e4a772543a30c7511468070e98e64e20165f8f81155b64"
+
 [[package]]
 name = "typenum"
 version = "1.17.0"
@@ -6028,7 +6087,7 @@ dependencies = [
  "webview2-com-macros",
  "webview2-com-sys",
  "windows 0.39.0",
- "windows-implement",
+ "windows-implement 0.39.0",
 ]
 
 [[package]]
@@ -6125,7 +6184,7 @@ version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1c4bd0a50ac6020f65184721f758dba47bb9fbc2133df715ec74a237b26794a"
 dependencies = [
- "windows-implement",
+ "windows-implement 0.39.0",
  "windows_aarch64_msvc 0.39.0",
  "windows_i686_gnu 0.39.0",
  "windows_i686_msvc 0.39.0",
@@ -6142,6 +6201,18 @@ dependencies = [
  "windows-targets 0.48.5",
 ]
 
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core 0.62.2",
+ "windows-future",
+ "windows-numerics",
+]
+
 [[package]]
 name = "windows-bindgen"
 version = "0.39.0"
@@ -6152,6 +6223,15 @@ dependencies = [
  "windows-tokens",
 ]
 
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core 0.62.2",
+]
+
 [[package]]
 name = "windows-core"
 version = "0.52.0"
@@ -6161,6 +6241,30 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement 0.60.2",
+ "windows-interface",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core 0.62.2",
+ "windows-link 0.2.1",
+ "windows-threading",
+]
+
 [[package]]
 name = "windows-implement"
 version = "0.39.0"
@@ -6171,6 +6275,28 @@ dependencies = [
  "windows-tokens",
 ]
 
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.93",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.93",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.1.3"
@@ -6189,6 +6315,16 @@ version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ee5e275231f07c6e240d14f34e1b635bf1faa1c76c57cfd59a5cdb9848e4278"
 
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core 0.62.2",
+ "windows-link 0.2.1",
+]
+
 [[package]]
 name = "windows-registry"
 version = "0.5.3"
@@ -6379,6 +6515,15 @@ dependencies = [
  "windows_x86_64_msvc 0.53.1",
 ]
 
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link 0.2.1",
+]
+
 [[package]]
 name = "windows-tokens"
 version = "0.39.0"
@@ -6728,7 +6873,7 @@ dependencies = [
  "webkit2gtk-sys",
  "webview2-com",
  "windows 0.39.0",
- "windows-implement",
+ "windows-implement 0.39.0",
 ]
 
 [[package]]
@@ -6973,15 +7118,15 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "4.2.0"
+version = "7.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95ab361742de920c5535880f89bbd611ee62002bf11341d16a5f057bb8ba6899"
+checksum = "cc12baa6db2b15a140161ce53d72209dacea594230798c24774139b54ecaa980"
 dependencies = [
- "arbitrary",
  "crc32fast",
  "flate2",
  "indexmap 2.7.0",
  "memchr",
+ "typed-path",
  "zopfli",
 ]
 

runtime/Cargo.toml

@@ -34,18 +34,18 @@ hmac = "0.12.1"
 sha2 = "0.10.8"
 rcgen = { version = "0.14.7", features = ["pem"] }
 file-format = "0.28.0"
-calamine = "0.32.0"
+calamine = "0.33.0"
 pdfium-render = "0.8.37"
 sys-locale = "0.3.2"
 cfg-if = "1.0.4"
 pptx-to-md = "0.4.0"
+tempfile = "3.8"
 strum_macros = "0.27"
+sysinfo = "0.38.0"
 
 # Fixes security vulnerability downstream, where the upstream is not fixed yet:
-url = "2.5.8"
-ring = "0.17.14"
-crossbeam-channel = "0.5.15"
-tracing-subscriber = "0.3.22"
+time = "0.3.47" # -> Rocket
+bytes = "1.11.1" # -> almost every dependency
 
 [target.'cfg(target_os = "linux")'.dependencies]
 # See issue https://github.com/tauri-apps/tauri/issues/4470

runtime/build.rs

@@ -1,4 +1,4 @@
-use std::path::PathBuf;
+use std::path::{PathBuf};
 
 fn main() {
     tauri_build::build();

runtime/resources/databases/qdrant/config.yaml

@@ -0,0 +1,354 @@
+log_level: INFO
+
+# Logging configuration
+# Qdrant logs to stdout. You may configure to also write logs to a file on disk.
+# Be aware that this file may grow indefinitely.
+# logger:
+#   # Logging format, supports `text` and `json`
+#   format: text
+#   on_disk:
+#     enabled: true
+#     log_file: path/to/log/file.log
+#     log_level: INFO
+#     # Logging format, supports `text` and `json`
+#     format: text
+#     buffer_size_bytes: 1024
+
+storage:
+
+  snapshots_config:
+    # "local" or "s3" - where to store snapshots
+    snapshots_storage: local
+    # s3_config:
+    #   bucket: ""
+    #   region: ""
+    #   access_key: ""
+    #   secret_key: ""
+
+  # Where to store temporary files
+  # If null, temporary snapshots are stored in: storage/snapshots_temp/
+  temp_path: null
+
+  # If true - point payloads will not be stored in memory.
+  # It will be read from the disk every time it is requested.
+  # This setting saves RAM by (slightly) increasing the response time.
+  # Note: those payload values that are involved in filtering and are indexed - remain in RAM.
+  #
+  # Default: true
+  on_disk_payload: true
+
+  # Maximum number of concurrent updates to shard replicas
+  # If `null` - maximum concurrency is used.
+  update_concurrency: null
+
+  # Write-ahead-log related configuration
+  wal:
+    # Size of a single WAL segment
+    wal_capacity_mb: 32
+
+    # Number of WAL segments to create ahead of actual data requirement
+    wal_segments_ahead: 0
+
+  # Normal node - receives all updates and answers all queries
+  node_type: "Normal"
+
+  # Listener node - receives all updates, but does not answer search/read queries
+  # Useful for setting up a dedicated backup node
+  # node_type: "Listener"
+
+  performance:
+    # Number of parallel threads used for search operations. If 0 - auto selection.
+    max_search_threads: 0
+
+    # CPU budget, how many CPUs (threads) to allocate for an optimization job.
+    # If 0 - auto selection, keep 1 or more CPUs unallocated depending on CPU size
+    # If negative - subtract this number of CPUs from the available CPUs.
+    # If positive - use this exact number of CPUs.
+    optimizer_cpu_budget: 0
+
+    # Prevent DDoS of too many concurrent updates in distributed mode.
+    # One external update usually triggers multiple internal updates, which breaks internal
+    # timings. For example, the health check timing and consensus timing.
+    # If null - auto selection.
+    update_rate_limit: null
+
+    # Limit for number of incoming automatic shard transfers per collection on this node, does not affect user-requested transfers.
+    # The same value should be used on all nodes in a cluster.
+    # Default is to allow 1 transfer.
+    # If null - allow unlimited transfers.
+    #incoming_shard_transfers_limit: 1
+
+    # Limit for number of outgoing automatic shard transfers per collection on this node, does not affect user-requested transfers.
+    # The same value should be used on all nodes in a cluster.
+    # Default is to allow 1 transfer.
+    # If null - allow unlimited transfers.
+    #outgoing_shard_transfers_limit: 1
+
+    # Enable async scorer which uses io_uring when rescoring.
+    # Only supported on Linux, must be enabled in your kernel.
+    # See: <https://qdrant.tech/articles/io_uring/#and-what-about-qdrant>
+    #async_scorer: false
+
+  optimizers:
+    # The minimal fraction of deleted vectors in a segment, required to perform segment optimization
+    deleted_threshold: 0.2
+
+    # The minimal number of vectors in a segment, required to perform segment optimization
+    vacuum_min_vector_number: 1000
+
+    # Target amount of segments optimizer will try to keep.
+    # Real amount of segments may vary depending on multiple parameters:
+    #  - Amount of stored points
+    #  - Current write RPS
+    #
+    # It is recommended to select default number of segments as a factor of the number of search threads,
+    # so that each segment would be handled evenly by one of the threads.
+    # If `default_segment_number = 0`, will be automatically selected by the number of available CPUs
+    default_segment_number: 0
+
+    # Do not create segments larger this size (in KiloBytes).
+    # Large segments might require disproportionately long indexation times,
+    # therefore it makes sense to limit the size of segments.
+    #
+    # If indexation speed have more priority for your - make this parameter lower.
+    # If search speed is more important - make this parameter higher.
+    # Note: 1Kb = 1 vector of size 256
+    # If not set, will be automatically selected considering the number of available CPUs.
+    max_segment_size_kb: null
+
+    # Maximum size (in KiloBytes) of vectors allowed for plain index.
+    # Default value based on experiments and observations.
+    # Note: 1Kb = 1 vector of size 256
+    # To explicitly disable vector indexing, set to `0`.
+    # If not set, the default value will be used.
+    indexing_threshold_kb: 10000
+
+    # Interval between forced flushes.
+    flush_interval_sec: 5
+
+    # Max number of threads (jobs) for running optimizations per shard.
+    # Note: each optimization job will also use `max_indexing_threads` threads by itself for index building.
+    # If null - have no limit and choose dynamically to saturate CPU.
+    # If 0 - no optimization threads, optimizations will be disabled.
+    max_optimization_threads: null
+
+  # This section has the same options as 'optimizers' above. All values specified here will overwrite the collections
+  # optimizers configs regardless of the config above and the options specified at collection creation.
+  #optimizers_overwrite:
+  #  deleted_threshold: 0.2
+  #  vacuum_min_vector_number: 1000
+  #  default_segment_number: 0
+  #  max_segment_size_kb: null
+  #  indexing_threshold_kb: 10000
+  #  flush_interval_sec: 5
+  #  max_optimization_threads: null
+
+  # Default parameters of HNSW Index. Could be overridden for each collection or named vector individually
+  hnsw_index:
+    # Number of edges per node in the index graph. Larger the value - more accurate the search, more space required.
+    m: 16
+
+    # Number of neighbours to consider during the index building. Larger the value - more accurate the search, more time required to build index.
+    ef_construct: 100
+
+    # Minimal size threshold (in KiloBytes) below which full-scan is preferred over HNSW search.
+    # This measures the total size of vectors being queried against.
+    # When the maximum estimated amount of points that a condition satisfies is smaller than
+    # `full_scan_threshold_kb`, the query planner will use full-scan search instead of HNSW index
+    # traversal for better performance.
+    # Note: 1Kb = 1 vector of size 256
+    full_scan_threshold_kb: 10000
+
+    # Number of parallel threads used for background index building.
+    # If 0 - automatically select.
+    # Best to keep between 8 and 16 to prevent likelihood of building broken/inefficient HNSW graphs.
+    # On small CPUs, less threads are used.
+    max_indexing_threads: 0
+
+    # Store HNSW index on disk. If set to false, index will be stored in RAM. Default: false
+    on_disk: false
+
+    # Custom M param for hnsw graph built for payload index. If not set, default M will be used.
+    payload_m: null
+
+  # Default shard transfer method to use if none is defined.
+  # If null - don't have a shard transfer preference, choose automatically.
+  # If stream_records, snapshot or wal_delta - prefer this specific method.
+  # More info: https://qdrant.tech/documentation/guides/distributed_deployment/#shard-transfer-method
+  shard_transfer_method: null
+
+  # Default parameters for collections
+  collection:
+    # Number of replicas of each shard that network tries to maintain
+    replication_factor: 1
+
+    # How many replicas should apply the operation for us to consider it successful
+    write_consistency_factor: 1
+
+    # Default parameters for vectors.
+    vectors:
+      # Whether vectors should be stored in memory or on disk.
+      on_disk: null
+
+    # shard_number_per_node: 1
+
+    # Default quantization configuration.
+    # More info: https://qdrant.tech/documentation/guides/quantization
+    quantization: null
+
+      # Default strict mode parameters for newly created collections.
+      #strict_mode:
+      # Whether strict mode is enabled for a collection or not.
+      #enabled: false
+
+      # Max allowed `limit` parameter for all APIs that don't have their own max limit.
+      #max_query_limit: null
+
+      # Max allowed `timeout` parameter.
+      #max_timeout: null
+
+      # Allow usage of unindexed fields in retrieval based (eg. search) filters.
+      #unindexed_filtering_retrieve: null
+
+      # Allow usage of unindexed fields in filtered updates (eg. delete by payload).
+      #unindexed_filtering_update: null
+
+      # Max HNSW value allowed in search parameters.
+      #search_max_hnsw_ef: null
+
+      # Whether exact search is allowed or not.
+      #search_allow_exact: null
+
+      # Max oversampling value allowed in search.
+    #search_max_oversampling: null
+
+  # Maximum number of collections allowed to be created
+  # If null - no limit.
+  max_collections: null
+
+service:
+  # Maximum size of POST data in a single request in megabytes
+  max_request_size_mb: 32
+
+  # Number of parallel workers used for serving the api. If 0 - equal to the number of available cores.
+  # If missing - Same as storage.max_search_threads
+  max_workers: 0
+
+  # Host to bind the service on
+  host: 127.0.0.1
+
+  # HTTP(S) port to bind the service on
+  # http_port: 6333
+
+  # gRPC port to bind the service on.
+  # If `null` - gRPC is disabled. Default: null
+  # Comment to disable gRPC:
+  # grpc_port: 6334
+
+  # Enable CORS headers in REST API.
+  # If enabled, browsers would be allowed to query REST endpoints regardless of query origin.
+  # More info: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
+  # Default: true
+  enable_cors: false
+
+  # Enable HTTPS for the REST and gRPC API
+  # TLS is enabled in AI Studio through environment variables when instantiating Qdrant as a sidecar.
+  # enable_tls: false
+
+  # Check user HTTPS client certificate against CA file specified in tls config
+  verify_https_client_certificate: false
+
+  # Set an api-key.
+  # If set, all requests must include a header with the api-key.
+  # example header: `api-key: <API-KEY>`
+  #
+  # If you enable this you should also enable TLS.
+  # (Either above or via an external service like nginx.)
+  # Sending an api-key over an unencrypted channel is insecure.
+  #
+  # Uncomment to enable.
+  # api_key: your_secret_api_key_here
+
+  # Set an api-key for read-only operations.
+  # If set, all requests must include a header with the api-key.
+  # example header: `api-key: <API-KEY>`
+  #
+  # If you enable this you should also enable TLS.
+  # (Either above or via an external service like nginx.)
+  # Sending an api-key over an unencrypted channel is insecure.
+  #
+  # Uncomment to enable.
+  # read_only_api_key: your_secret_read_only_api_key_here
+
+  # Uncomment to enable JWT Role Based Access Control (RBAC).
+  # If enabled, you can generate JWT tokens with fine-grained rules for access control.
+  # Use generated token instead of API key.
+  #
+  # jwt_rbac: true
+
+  # Hardware reporting adds information to the API responses with a
+  # hint on how many resources were used to execute the request.
+  #
+  # Warning: experimental, this feature is still under development and is not supported yet.
+  #
+  # Uncomment to enable.
+  # hardware_reporting: true
+  #
+  # Uncomment to enable.
+  # Prefix for the names of metrics in the /metrics API.
+  # metrics_prefix: qdrant_
+
+cluster:
+  # Use `enabled: true` to run Qdrant in distributed deployment mode
+  enabled: false
+
+  # Configuration of the inter-cluster communication
+  p2p:
+    # Port for internal communication between peers
+    port: 6335
+
+    # Use TLS for communication between peers
+    enable_tls: false
+
+  # Configuration related to distributed consensus algorithm
+  consensus:
+    # How frequently peers should ping each other.
+    # Setting this parameter to lower value will allow consensus
+    # to detect disconnected nodes earlier, but too frequent
+    # tick period may create significant network and CPU overhead.
+    # We encourage you NOT to change this parameter unless you know what you are doing.
+    tick_period_ms: 100
+
+    # Compact consensus operations once we have this amount of applied
+    # operations. Allows peers to join quickly with a consensus snapshot without
+    # replaying a huge amount of operations.
+    # If 0 - disable compaction
+    compact_wal_entries: 128
+
+# Set to true to prevent service from sending usage statistics to the developers.
+# Read more: https://qdrant.tech/documentation/guides/telemetry
+telemetry_disabled: true
+
+# TLS configuration.
+# Required if either service.enable_tls or cluster.p2p.enable_tls is true.
+tls:
+  # Server certificate chain file
+  # cert: ./tls/cert.pem
+
+  # Server private key file
+  # key: ./tls/key.pem
+
+  # Certificate authority certificate file.
+  # This certificate will be used to validate the certificates
+  # presented by other nodes during inter-cluster communication.
+  #
+  # If verify_https_client_certificate is true, it will verify
+  # HTTPS client certificate
+  #
+  # Required if cluster.p2p.enable_tls is true.
+  ca_cert: ./tls/cacert.pem
+
+  # TTL in seconds to reload certificate from disk, useful for certificate rotations.
+  # Only works for HTTPS endpoints. Does not support gRPC (and intra-cluster communication).
+  # If `null` - TTL is disabled.
+  cert_ttl: 3600

runtime/src/api_token.rs

@@ -1,21 +1,5 @@
-use log::info;
-use once_cell::sync::Lazy;
 use rand::{RngCore, SeedableRng};
-use rocket::http::Status;
-use rocket::Request;
-use rocket::request::FromRequest;
-
-/// The API token used to authenticate requests.
-pub static API_TOKEN: Lazy<APIToken> = Lazy::new(|| {
-    let mut token = [0u8; 32];
-    let mut rng = rand_chacha::ChaChaRng::from_os_rng();
-    rng.fill_bytes(&mut token);
-    
-    let token = APIToken::from_bytes(token.to_vec());
-    info!("API token was generated successfully.");
-    
-    token
-});
+use rand_chacha::ChaChaRng;
 
 /// The API token data structure used to authenticate requests.
 pub struct APIToken {
@@ -34,7 +18,7 @@ impl APIToken {
     }
 
     /// Creates a new API token from a hexadecimal text.
-    fn from_hex_text(hex_text: &str) -> Self {
+    pub fn from_hex_text(hex_text: &str) -> Self {
         APIToken {
             hex_text: hex_text.to_string(),
         }
@@ -45,40 +29,14 @@ impl APIToken {
     }
 
     /// Validates the received token against the valid token.
-    fn validate(&self, received_token: &Self) -> bool {
+    pub fn validate(&self, received_token: &Self) -> bool {
         received_token.to_hex_text() == self.to_hex_text()
     }
 }
 
-/// The request outcome type used to handle API token requests.
-type RequestOutcome<R, T> = rocket::request::Outcome<R, T>;
-
-/// The request outcome implementation for the API token.
-#[rocket::async_trait]
-impl<'r> FromRequest<'r> for APIToken {
-    type Error = APITokenError;
-
-    /// Handles the API token requests.
-    async fn from_request(request: &'r Request<'_>) -> RequestOutcome<Self, Self::Error> {
-        let token = request.headers().get_one("token");
-        match token {
-            Some(token) => {
-                let received_token = APIToken::from_hex_text(token);
-                if API_TOKEN.validate(&received_token) {
-                    RequestOutcome::Success(received_token)
-                } else {
-                    RequestOutcome::Error((Status::Unauthorized, APITokenError::Invalid))
-                }
-            }
-
-            None => RequestOutcome::Error((Status::Unauthorized, APITokenError::Missing)),
-        }
-    }
-}
-
-/// The API token error types.
-#[derive(Debug)]
-pub enum APITokenError {
-    Missing,
-    Invalid,
+pub fn generate_api_token() -> APIToken {
+    let mut token = [0u8; 32];
+    let mut rng = ChaChaRng::from_os_rng();
+    rng.fill_bytes(&mut token);
+    APIToken::from_bytes(token.to_vec())
 }

runtime/src/app_window.rs

@@ -10,15 +10,18 @@ use rocket::serde::Serialize;
 use serde::Deserialize;
 use strum_macros::Display;
 use tauri::updater::UpdateResponse;
-use tauri::{FileDropEvent, GlobalShortcutManager, UpdaterEvent, RunEvent, Manager, PathResolver, Window, WindowEvent};
+use tauri::{FileDropEvent, GlobalShortcutManager, UpdaterEvent, RunEvent, Manager, PathResolver, Window, WindowEvent, generate_context};
 use tauri::api::dialog::blocking::FileDialogBuilder;
 use tokio::sync::broadcast;
 use tokio::time;
 use crate::api_token::APIToken;
-use crate::dotnet::stop_dotnet_server;
+use crate::dotnet::{cleanup_dotnet_server, start_dotnet_server, stop_dotnet_server};
 use crate::environment::{is_prod, is_dev, CONFIG_DIRECTORY, DATA_DIRECTORY};
 use crate::log::switch_to_file_logging;
 use crate::pdfium::PDFIUM_LIB_PATH;
+use crate::qdrant::{cleanup_qdrant, start_qdrant_server, stop_qdrant_server};
+#[cfg(debug_assertions)]
+use crate::dotnet::create_startup_env_file;
 
 /// The Tauri main window.
 static MAIN_WINDOW: Lazy<Mutex<Option<Window>>> = Lazy::new(|| Mutex::new(None));
@@ -101,16 +104,28 @@ pub fn start_tauri() {
             let data_path = data_path.join("data");
 
             // Get and store the data and config directories:
-            DATA_DIRECTORY.set(data_path.to_str().unwrap().to_string()).map_err(|_| error!("Was not abe to set the data directory.")).unwrap();
+            DATA_DIRECTORY.set(data_path.to_str().unwrap().to_string()).map_err(|_| error!("Was not able to set the data directory.")).unwrap();
             CONFIG_DIRECTORY.set(app.path_resolver().app_config_dir().unwrap().to_str().unwrap().to_string()).map_err(|_| error!("Was not able to set the config directory.")).unwrap();
 
+            cleanup_qdrant();
+            cleanup_dotnet_server();
+
+            if is_dev() {
+                #[cfg(debug_assertions)]
+                create_startup_env_file();
+            } else {
+                start_dotnet_server();
+            }
+            start_qdrant_server();
+
             info!(Source = "Bootloader Tauri"; "Reconfigure the file logger to use the app data directory {data_path:?}");
             switch_to_file_logging(data_path).map_err(|e| error!("Failed to switch logging to file: {e}")).unwrap();
             set_pdfium_path(app.path_resolver());
+
             Ok(())
         })
         .plugin(tauri_plugin_window_state::Builder::default().build())
-        .build(tauri::generate_context!())
+        .build(generate_context!())
         .expect("Error while running Tauri application");
 
     // The app event handler:
@@ -155,6 +170,7 @@ pub fn start_tauri() {
 
                         if is_prod() {
                             stop_dotnet_server();
+                            stop_qdrant_server();
                         } else {
                             warn!(Source = "Tauri"; "Development environment detected; do not stop the .NET server.");
                         }
@@ -183,6 +199,11 @@ pub fn start_tauri() {
 
             RunEvent::ExitRequested { .. } => {
                 warn!(Source = "Tauri"; "Run event: exit was requested.");
+                stop_qdrant_server();
+                if is_prod() {
+                    warn!("Try to stop the .NET server as well...");
+                    stop_dotnet_server();
+                }
             }
 
             RunEvent::Ready => {
@@ -194,10 +215,6 @@ pub fn start_tauri() {
     });
 
     warn!(Source = "Tauri"; "Tauri app was stopped.");
-    if is_prod() {
-        warn!("Try to stop the .NET server as well...");
-        stop_dotnet_server();
-    }
 }
 
 /// Our event API endpoint for Tauri events. We try to send an endless stream of events to the client.

runtime/src/certificate.rs

@@ -1,38 +0,0 @@
-use std::sync::OnceLock;
-use log::info;
-use rcgen::generate_simple_self_signed;
-use sha2::{Sha256, Digest};
-
-/// The certificate used for the runtime API server.
-pub static CERTIFICATE: OnceLock<Vec<u8>> = OnceLock::new();
-
-/// The private key used for the certificate of the runtime API server.
-pub static CERTIFICATE_PRIVATE_KEY: OnceLock<Vec<u8>> = OnceLock::new();
-
-/// The fingerprint of the certificate used for the runtime API server.
-pub static CERTIFICATE_FINGERPRINT: OnceLock<String> = OnceLock::new();
-
-/// Generates a TLS certificate for the runtime API server.
-pub fn generate_certificate() {
-    
-    info!("Try to generate a TLS certificate for the runtime API server...");
-    
-    let subject_alt_names = vec!["localhost".to_string()];
-    let certificate_data = generate_simple_self_signed(subject_alt_names).unwrap();
-    let certificate_binary_data = certificate_data.cert.der().to_vec();
-    
-    let certificate_fingerprint = Sha256::digest(certificate_binary_data).to_vec();
-    let certificate_fingerprint = certificate_fingerprint.iter().fold(String::new(), |mut result, byte| {
-        result.push_str(&format!("{:02x}", byte));
-        result
-    });
-    
-    let certificate_fingerprint = certificate_fingerprint.to_uppercase();
-    
-    CERTIFICATE_FINGERPRINT.set(certificate_fingerprint.clone()).expect("Could not set the certificate fingerprint.");
-    CERTIFICATE.set(certificate_data.cert.pem().as_bytes().to_vec()).expect("Could not set the certificate.");
-    CERTIFICATE_PRIVATE_KEY.set(certificate_data.signing_key.serialize_pem().as_bytes().to_vec()).expect("Could not set the private key.");
-    
-    info!("Certificate fingerprint: '{certificate_fingerprint}'.");
-    info!("Done generating certificate for the runtime API server.");
-}

runtime/src/certificate_factory.rs

@@ -0,0 +1,32 @@
+use log::info;
+use rcgen::generate_simple_self_signed;
+use sha2::{Sha256, Digest};
+
+pub struct Certificate {
+    pub certificate: Vec<u8>,
+    pub private_key: Vec<u8>,
+    pub fingerprint: String,
+}
+
+pub fn generate_certificate() -> Certificate {
+    
+    let subject_alt_names = vec!["localhost".to_string()];
+    let certificate_data = generate_simple_self_signed(subject_alt_names).unwrap();
+    let certificate_binary_data = certificate_data.cert.der().to_vec();
+
+    let certificate_fingerprint = Sha256::digest(certificate_binary_data).to_vec();
+    let certificate_fingerprint = certificate_fingerprint.iter().fold(String::new(), |mut result, byte| {
+        result.push_str(&format!("{:02x}", byte));
+        result
+    });
+
+    let certificate_fingerprint = certificate_fingerprint.to_uppercase();
+    
+    info!("Certificate fingerprint: '{certificate_fingerprint}'.");
+    
+    Certificate {
+        certificate: certificate_data.cert.pem().as_bytes().to_vec(),
+        private_key: certificate_data.signing_key.serialize_pem().as_bytes().to_vec(),
+        fingerprint: certificate_fingerprint.clone()
+    }
+}

runtime/src/dotnet.rs

@@ -1,4 +1,5 @@
 use std::collections::HashMap;
+use std::path::Path;
 use std::sync::{Arc, Mutex};
 use base64::Engine;
 use base64::prelude::BASE64_STANDARD;
@@ -7,13 +8,16 @@ use once_cell::sync::Lazy;
 use rocket::get;
 use tauri::api::process::{Command, CommandChild, CommandEvent};
 use tauri::Url;
-use crate::api_token::{APIToken, API_TOKEN};
+use crate::api_token::APIToken;
+use crate::runtime_api_token::API_TOKEN;
 use crate::app_window::change_location_to;
-use crate::certificate::CERTIFICATE_FINGERPRINT;
+use crate::runtime_certificate::CERTIFICATE_FINGERPRINT;
 use crate::encryption::ENCRYPTION;
-use crate::environment::is_dev;
+use crate::environment::{is_dev, DATA_DIRECTORY};
 use crate::network::get_available_port;
 use crate::runtime_api::API_SERVER_PORT;
+use crate::stale_process_cleanup::{kill_stale_process, log_potential_stale_process};
+use crate::sidecar_types::SidecarType;
 
 // The .NET server is started in a separate process and communicates with this
 // runtime process via IPC. However, we do net start the .NET server in
@@ -26,6 +30,9 @@ static DOTNET_SERVER_PORT: Lazy<u16> = Lazy::new(|| get_available_port().unwrap(
 
 static DOTNET_INITIALIZED: Lazy<Mutex<bool>> = Lazy::new(|| Mutex::new(false));
 
+pub const PID_FILE_NAME: &str = "mindwork_ai_studio.pid";
+const SIDECAR_TYPE:SidecarType = SidecarType::Dotnet;
+
 /// Returns the desired port of the .NET server. Our .NET app calls this endpoint to get
 /// the port where the .NET server should listen to.
 #[get("/system/dotnet/port")]
@@ -93,9 +100,9 @@ pub fn start_dotnet_server() {
                 .envs(dotnet_server_environment)
                 .spawn()
                 .expect("Failed to spawn .NET server process.");
-
         let server_pid = child.pid();
         info!(Source = "Bootloader .NET"; "The .NET server process started with PID={server_pid}.");
+        log_potential_stale_process(Path::new(DATA_DIRECTORY.get().unwrap()).join(PID_FILE_NAME), server_pid, SIDECAR_TYPE);
 
         // Save the server process to stop it later:
         *server_spawn_clone.lock().unwrap() = Some(child);
@@ -108,6 +115,7 @@ pub fn start_dotnet_server() {
             info!(Source = ".NET Server (stdout)"; "{line}");
         }
     });
+
 }
 
 /// This endpoint is called by the .NET server to signal that the server is ready.
@@ -152,4 +160,14 @@ pub fn stop_dotnet_server() {
     } else {
         warn!("The .NET server process was not started or is already stopped.");
     }
+    info!("Start dotnet server cleanup");
+    cleanup_dotnet_server();
+}
+
+/// Remove old Pid files and kill the corresponding processes
+pub fn cleanup_dotnet_server() {
+    let pid_path = Path::new(DATA_DIRECTORY.get().unwrap()).join(PID_FILE_NAME);
+    if let Err(e) = kill_stale_process(pid_path, SIDECAR_TYPE) {
+        warn!(Source = ".NET"; "Error during the cleanup of .NET: {}", e);
+    }
 }

runtime/src/environment.rs

@@ -119,6 +119,30 @@ pub fn read_enterprise_env_config_server_url(_token: APIToken) -> String {
     )
 }
 
+#[get("/system/enterprise/config/encryption_secret")]
+pub fn read_enterprise_env_config_encryption_secret(_token: APIToken) -> String {
+    //
+    // When we are on a Windows machine, we try to read the enterprise config from
+    // the Windows registry. In case we can't find the registry key, or we are on a
+    // macOS or Linux machine, we try to read the enterprise config from the
+    // environment variables.
+    //
+    // The registry key is:
+    // HKEY_CURRENT_USER\Software\github\MindWork AI Studio\Enterprise IT
+    //
+    // In this registry key, we expect the following values:
+    // - config_encryption_secret
+    //
+    // The environment variable is:
+    // MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_ENCRYPTION_SECRET
+    //
+    debug!("Trying to read the enterprise environment for the config encryption secret.");
+    get_enterprise_configuration(
+        "config_encryption_secret",
+        "MINDWORK_AI_STUDIO_ENTERPRISE_CONFIG_ENCRYPTION_SECRET",
+    )
+}
+
 fn get_enterprise_configuration(_reg_value: &str, env_name: &str) -> String {
     cfg_if::cfg_if! {
         if #[cfg(target_os = "windows")] {

runtime/src/lib.rs

@@ -8,8 +8,13 @@ pub mod app_window;
 pub mod secret;
 pub mod clipboard;
 pub mod runtime_api;
-pub mod certificate;
+pub mod runtime_certificate;
 pub mod file_data;
 pub mod metadata;
 pub mod pdfium;
 pub mod pandoc;
+pub mod qdrant;
+pub mod certificate_factory;
+pub mod runtime_api_token;
+pub mod stale_process_cleanup;
+mod sidecar_types;

runtime/src/main.rs

@@ -6,15 +6,12 @@ extern crate core;
 
 use log::{info, warn};
 use mindwork_ai_studio::app_window::start_tauri;
-use mindwork_ai_studio::certificate::{generate_certificate};
-use mindwork_ai_studio::dotnet::start_dotnet_server;
+use mindwork_ai_studio::runtime_certificate::{generate_runtime_certificate};
 use mindwork_ai_studio::environment::is_dev;
 use mindwork_ai_studio::log::init_logging;
 use mindwork_ai_studio::metadata::MetaData;
 use mindwork_ai_studio::runtime_api::start_runtime_api;
 
-#[cfg(debug_assertions)]
-use mindwork_ai_studio::dotnet::create_startup_env_file;
 
 #[tokio::main]
 async fn main() {
@@ -38,6 +35,7 @@ async fn main() {
     info!(".. MudBlazor: v{mud_blazor_version}", mud_blazor_version = metadata.mud_blazor_version);
     info!(".. Tauri: v{tauri_version}", tauri_version = metadata.tauri_version);
     info!(".. PDFium: v{pdfium_version}", pdfium_version = metadata.pdfium_version);
+    info!(".. Qdrant: v{qdrant_version}", qdrant_version = metadata.qdrant_version);
 
     if is_dev() {
         warn!("Running in development mode.");
@@ -45,15 +43,8 @@ async fn main() {
         info!("Running in production mode.");
     }
 
-    generate_certificate();
+    generate_runtime_certificate();
     start_runtime_api();
     
-    if is_dev() {
-        #[cfg(debug_assertions)]
-        create_startup_env_file();
-    } else {
-        start_dotnet_server();
-    }
-    
     start_tauri();
 }

runtime/src/metadata.rs

@@ -16,6 +16,7 @@ pub struct MetaData {
     pub app_commit_hash: String,
     pub architecture: String,
     pub pdfium_version: String,
+    pub qdrant_version: String,
 }
 
 impl MetaData {
@@ -39,6 +40,7 @@ impl MetaData {
         let app_commit_hash = metadata_lines.next().unwrap();
         let architecture = metadata_lines.next().unwrap();
         let pdfium_version = metadata_lines.next().unwrap();
+        let qdrant_version = metadata_lines.next().unwrap();
 
         let metadata = MetaData {
             architecture: architecture.to_string(),
@@ -52,6 +54,7 @@ impl MetaData {
             rust_version: rust_version.to_string(),
             tauri_version: tauri_version.to_string(),
             pdfium_version: pdfium_version.to_string(),
+            qdrant_version: qdrant_version.to_string(),
         };
 
         *META_DATA.lock().unwrap() = Some(metadata.clone());

runtime/src/qdrant.rs

@@ -0,0 +1,222 @@
+use std::collections::HashMap;
+use std::{fs};
+use std::error::Error;
+use std::fs::File;
+use std::io::Write;
+use std::path::Path;
+use std::sync::{Arc, Mutex, OnceLock};
+use log::{debug, error, info, warn};
+use once_cell::sync::Lazy;
+use rocket::get;
+use rocket::serde::json::Json;
+use rocket::serde::Serialize;
+use tauri::api::process::{Command, CommandChild, CommandEvent};
+use crate::api_token::{APIToken};
+use crate::environment::DATA_DIRECTORY;
+use crate::certificate_factory::generate_certificate;
+use std::path::PathBuf;
+use tempfile::{TempDir, Builder};
+use crate::stale_process_cleanup::{kill_stale_process, log_potential_stale_process};
+use crate::sidecar_types::SidecarType;
+
+// Qdrant server process started in a separate process and can communicate
+// via HTTP or gRPC with the .NET server and the runtime process
+static QDRANT_SERVER: Lazy<Arc<Mutex<Option<CommandChild>>>> = Lazy::new(|| Arc::new(Mutex::new(None)));
+
+// Qdrant server port (default is 6333 for HTTP and 6334 for gRPC)
+static QDRANT_SERVER_PORT_HTTP: Lazy<u16> = Lazy::new(|| {
+    crate::network::get_available_port().unwrap_or(6333)
+});
+
+static QDRANT_SERVER_PORT_GRPC: Lazy<u16> = Lazy::new(|| {
+    crate::network::get_available_port().unwrap_or(6334)
+});
+
+pub static CERTIFICATE_FINGERPRINT: OnceLock<String> = OnceLock::new();
+static API_TOKEN: Lazy<APIToken> = Lazy::new(|| {
+    crate::api_token::generate_api_token()
+});
+
+static TMPDIR: Lazy<Mutex<Option<TempDir>>> = Lazy::new(|| Mutex::new(None));
+
+const PID_FILE_NAME: &str = "qdrant.pid";
+const SIDECAR_TYPE:SidecarType = SidecarType::Qdrant;
+
+#[derive(Serialize)]
+pub struct ProvideQdrantInfo {
+    path: String,
+    port_http: u16,
+    port_grpc: u16,
+    fingerprint: String,
+    api_token: String,
+}
+
+#[get("/system/qdrant/info")]
+pub fn qdrant_port(_token: APIToken) -> Json<ProvideQdrantInfo> {
+    Json(ProvideQdrantInfo {
+        path: Path::new(DATA_DIRECTORY.get().unwrap()).join("databases").join("qdrant").to_str().unwrap().to_string(),
+        port_http: *QDRANT_SERVER_PORT_HTTP,
+        port_grpc: *QDRANT_SERVER_PORT_GRPC,
+        fingerprint: CERTIFICATE_FINGERPRINT.get().expect("Certificate fingerprint not available").to_string(),
+        api_token: API_TOKEN.to_hex_text().to_string(),
+    })
+}
+
+/// Starts the Qdrant server in a separate process.
+pub fn start_qdrant_server(){
+    
+    let base_path = DATA_DIRECTORY.get().unwrap();
+    let path = Path::new(base_path).join("databases").join("qdrant");
+    if !path.exists() {
+        if let Err(e) = fs::create_dir_all(&path){
+            error!(Source="Qdrant"; "The required directory to host the Qdrant database could not be created: {}", e.to_string());
+        };
+    }
+    let (cert_path, key_path) =create_temp_tls_files(&path).unwrap();
+    
+    let storage_path = path.join("storage").to_str().unwrap().to_string();
+    let snapshot_path = path.join("snapshots").to_str().unwrap().to_string();
+    let init_path = path.join(".qdrant-initalized").to_str().unwrap().to_string();
+    
+    let qdrant_server_environment = HashMap::from_iter([
+        (String::from("QDRANT__SERVICE__HTTP_PORT"), QDRANT_SERVER_PORT_HTTP.to_string()),
+        (String::from("QDRANT__SERVICE__GRPC_PORT"), QDRANT_SERVER_PORT_GRPC.to_string()),
+        (String::from("QDRANT_INIT_FILE_PATH"), init_path),
+        (String::from("QDRANT__STORAGE__STORAGE_PATH"), storage_path),
+        (String::from("QDRANT__STORAGE__SNAPSHOTS_PATH"), snapshot_path),
+        (String::from("QDRANT__TLS__CERT"), cert_path.to_str().unwrap().to_string()),
+        (String::from("QDRANT__TLS__KEY"), key_path.to_str().unwrap().to_string()),
+        (String::from("QDRANT__SERVICE__ENABLE_TLS"), "true".to_string()),
+        (String::from("QDRANT__SERVICE__API_KEY"), API_TOKEN.to_hex_text().to_string()),
+    ]);
+    
+    let server_spawn_clone = QDRANT_SERVER.clone();
+    tauri::async_runtime::spawn(async move {
+        let (mut rx, child) = Command::new_sidecar("qdrant")
+            .expect("Failed to create sidecar for Qdrant")
+            .args(["--config-path", "resources/databases/qdrant/config.yaml"])
+            .envs(qdrant_server_environment)
+            .spawn()
+            .expect("Failed to spawn Qdrant server process.");
+
+        let server_pid = child.pid();
+        info!(Source = "Bootloader Qdrant"; "Qdrant server process started with PID={server_pid}.");
+        log_potential_stale_process(path.join(PID_FILE_NAME), server_pid, SIDECAR_TYPE);
+
+        // Save the server process to stop it later:
+        *server_spawn_clone.lock().unwrap() = Some(child);
+
+        // Log the output of the Qdrant server:
+        while let Some(event) = rx.recv().await {
+            match event {
+                CommandEvent::Stdout(line) => {
+                    let line = line.trim_end();
+                    if line.contains("INFO") || line.contains("info") {
+                        info!(Source = "Qdrant Server"; "{line}");
+                    } else if line.contains("WARN") || line.contains("warning") {
+                        warn!(Source = "Qdrant Server"; "{line}");
+                    } else if line.contains("ERROR") || line.contains("error") {
+                        error!(Source = "Qdrant Server"; "{line}");
+                    } else {
+                        debug!(Source = "Qdrant Server"; "{line}");
+                    }
+                },
+            
+                CommandEvent::Stderr(line) => {
+                    error!(Source = "Qdrant Server (stderr)"; "{line}");
+                },
+            
+                _ => {}
+            }
+        }
+    });
+}
+
+/// Stops the Qdrant server process.
+pub fn stop_qdrant_server() {
+    if let Some(server_process) = QDRANT_SERVER.lock().unwrap().take() {
+        let server_kill_result = server_process.kill();
+        match server_kill_result {
+            Ok(_) => warn!(Source = "Qdrant"; "Qdrant server process was stopped."),
+            Err(e) => error!(Source = "Qdrant"; "Failed to stop Qdrant server process: {e}."),
+        }
+    } else {
+        warn!(Source = "Qdrant"; "Qdrant server process was not started or is already stopped.");
+    }
+
+    drop_tmpdir();
+    cleanup_qdrant();
+}
+
+/// Create temporary directory with TLS relevant files
+pub fn create_temp_tls_files(path: &PathBuf) -> Result<(PathBuf, PathBuf), Box<dyn Error>> {
+    let cert = generate_certificate();
+    
+    let temp_dir = init_tmpdir_in(path);
+    let cert_path = temp_dir.join("cert.pem");
+    let key_path = temp_dir.join("key.pem");
+
+    let mut cert_file = File::create(&cert_path)?;
+    cert_file.write_all(&*cert.certificate)?;
+
+    let mut key_file = File::create(&key_path)?;
+    key_file.write_all(&*cert.private_key)?;
+    
+    CERTIFICATE_FINGERPRINT.set(cert.fingerprint).expect("Could not set the certificate fingerprint.");
+
+    Ok((cert_path, key_path))
+}
+
+pub fn init_tmpdir_in<P: AsRef<Path>>(path: P) -> PathBuf {
+    let mut guard = TMPDIR.lock().unwrap();
+    let dir = guard.get_or_insert_with(|| {
+        Builder::new()
+            .prefix("cert-")
+            .tempdir_in(path)
+            .expect("failed to create tempdir")
+    });
+
+    dir.path().to_path_buf()
+}
+
+pub fn drop_tmpdir() {
+    let mut guard = TMPDIR.lock().unwrap();
+    *guard = None;
+    warn!(Source = "Qdrant"; "Temporary directory for TLS was dropped.");
+}
+
+/// Remove old Pid files and kill the corresponding processes
+pub fn cleanup_qdrant() {
+    let pid_path = Path::new(DATA_DIRECTORY.get().unwrap()).join("databases").join("qdrant").join(PID_FILE_NAME);
+    if let Err(e) = kill_stale_process(pid_path, SIDECAR_TYPE) {
+        warn!(Source = "Qdrant"; "Error during the cleanup of Qdrant: {}", e);
+    }
+    if let Err(e) = delete_old_certificates() {
+        warn!(Source = "Qdrant"; "Error during the cleanup of Qdrant: {}", e);
+    }
+    
+}
+
+pub fn delete_old_certificates() -> Result<(), Box<dyn Error>> {
+    let dir_path =  Path::new(DATA_DIRECTORY.get().unwrap()).join("databases").join("qdrant");
+
+    if !dir_path.exists() {
+        return Ok(());
+    }
+
+    for entry in fs::read_dir(dir_path)? {
+        let entry = entry?;
+        let path = entry.path();
+
+        if path.is_dir() {
+            let file_name = entry.file_name();
+            let folder_name = file_name.to_string_lossy();
+
+            if folder_name.starts_with("cert-") {
+                fs::remove_dir_all(&path)?;
+                warn!(Source="Qdrant"; "Removed old certificates in: {}", path.display());
+            }
+        }
+    }
+    Ok(())
+}

runtime/src/runtime_api.rs

@@ -3,7 +3,7 @@ use once_cell::sync::Lazy;
 use rocket::config::Shutdown;
 use rocket::figment::Figment;
 use rocket::routes;
-use crate::certificate::{CERTIFICATE, CERTIFICATE_PRIVATE_KEY};
+use crate::runtime_certificate::{CERTIFICATE, CERTIFICATE_PRIVATE_KEY};
 use crate::environment::is_dev;
 use crate::network::get_available_port;
 
@@ -67,6 +67,7 @@ pub fn start_runtime_api() {
             .mount("/", routes![
                 crate::dotnet::dotnet_port,
                 crate::dotnet::dotnet_ready,
+                crate::qdrant::qdrant_port,
                 crate::clipboard::set_clipboard,
                 crate::app_window::get_event_stream,
                 crate::app_window::check_for_update,
@@ -84,6 +85,7 @@ pub fn start_runtime_api() {
                 crate::environment::read_enterprise_env_config_id,
                 crate::environment::delete_enterprise_env_config_id,
                 crate::environment::read_enterprise_env_config_server_url,
+                crate::environment::read_enterprise_env_config_encryption_secret,
                 crate::file_data::extract_data,
                 crate::log::get_log_paths,
                 crate::log::log_event,

runtime/src/runtime_api_token.rs

@@ -0,0 +1,40 @@
+use once_cell::sync::Lazy;
+use rocket::http::Status;
+use rocket::Request;
+use rocket::request::FromRequest;
+use crate::api_token::{generate_api_token, APIToken};
+
+pub static API_TOKEN: Lazy<APIToken> = Lazy::new(|| generate_api_token());
+
+/// The request outcome type used to handle API token requests.
+type RequestOutcome<R, T> = rocket::request::Outcome<R, T>;
+
+/// The request outcome implementation for the API token.
+#[rocket::async_trait]
+impl<'r> FromRequest<'r> for APIToken {
+    type Error = APITokenError;
+
+    /// Handles the API token requests.
+    async fn from_request(request: &'r Request<'_>) -> RequestOutcome<Self, Self::Error> {
+        let token = request.headers().get_one("token");
+        match token {
+            Some(token) => {
+                let received_token = APIToken::from_hex_text(token);
+                if API_TOKEN.validate(&received_token) {
+                    RequestOutcome::Success(received_token)
+                } else {
+                    RequestOutcome::Error((Status::Unauthorized, APITokenError::Invalid))
+                }
+            }
+
+            None => RequestOutcome::Error((Status::Unauthorized, APITokenError::Missing)),
+        }
+    }
+}
+
+/// The API token error types.
+#[derive(Debug)]
+pub enum APITokenError {
+    Missing,
+    Invalid,
+}

runtime/src/runtime_certificate.rs

@@ -0,0 +1,26 @@
+use std::sync::OnceLock;
+use log::info;
+use crate::certificate_factory::generate_certificate;
+
+/// The certificate used for the runtime API server.
+pub static CERTIFICATE: OnceLock<Vec<u8>> = OnceLock::new();
+
+/// The private key used for the certificate of the runtime API server.
+pub static CERTIFICATE_PRIVATE_KEY: OnceLock<Vec<u8>> = OnceLock::new();
+
+/// The fingerprint of the certificate used for the runtime API server.
+pub static CERTIFICATE_FINGERPRINT: OnceLock<String> = OnceLock::new();
+
+/// Generates a TLS certificate for the runtime API server.
+pub fn generate_runtime_certificate() {
+    
+    info!("Try to generate a TLS certificate for the runtime API server...");
+
+    let cert = generate_certificate();
+    
+    CERTIFICATE_FINGERPRINT.set(cert.fingerprint).expect("Could not set the certificate fingerprint.");
+    CERTIFICATE.set(cert.certificate).expect("Could not set the certificate.");
+    CERTIFICATE_PRIVATE_KEY.set(cert.private_key).expect("Could not set the private key.");
+    
+    info!("Done generating certificate for the runtime API server.");
+}

runtime/src/sidecar_types.rs

@@ -0,0 +1,15 @@
+use std::fmt;
+
+pub enum SidecarType {
+    Dotnet,
+    Qdrant,
+}
+
+impl fmt::Display for SidecarType {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            SidecarType::Dotnet => write!(f, ".Net"),
+            SidecarType::Qdrant => write!(f, "Qdrant"),
+        }
+    }
+}

runtime/src/stale_process_cleanup.rs

@@ -0,0 +1,89 @@
+use std::fs;
+use std::fs::File;
+use std::io::{Error, ErrorKind, Write};
+use std::path::{PathBuf};
+use log::{info, warn};
+use sysinfo::{Pid, ProcessesToUpdate, Signal, System};
+use crate::sidecar_types::SidecarType;
+
+fn parse_pid_file(content: &str) -> Result<(u32, String), Error> {
+    let mut lines = content
+        .lines()
+        .map(|line| line.trim())
+        .filter(|line| !line.is_empty());
+    let pid_str = lines
+        .next()
+        .ok_or_else(|| Error::new(ErrorKind::InvalidData, "Missing PID in file"))?;
+    let pid: u32 = pid_str
+        .parse()
+        .map_err(|_| Error::new(ErrorKind::InvalidData, "Invalid PID in file"))?;
+    let name = lines
+        .next()
+        .ok_or_else(|| Error::new(ErrorKind::InvalidData, "Missing process name in file"))?
+        .to_string();
+    Ok((pid, name))
+}
+
+pub fn kill_stale_process(pid_file_path: PathBuf, sidecar_type: SidecarType) -> Result<(), Error> {
+    if !pid_file_path.exists() {
+        return Ok(());
+    }
+
+    let pid_file_content = fs::read_to_string(&pid_file_path)?;
+    let (pid, expected_name) = parse_pid_file(&pid_file_content)?;
+
+    let mut system = System::new_all();
+
+    let pid = Pid::from_u32(pid);
+    system.refresh_processes(ProcessesToUpdate::Some(&[pid]), true);
+    if let Some(process) = system.process(pid){
+        let name = process.name().to_string_lossy();
+        if name != expected_name {
+            return Err(Error::new(
+                ErrorKind::InvalidInput,
+                format!(
+                    "Process name does not match: expected '{}' but found '{}'",
+                    expected_name, name
+                ),
+            ));
+        }
+
+        let killed = process.kill_with(Signal::Kill).unwrap_or_else(|| process.kill());
+        if !killed {
+            return Err(Error::new(ErrorKind::Other, "Failed to kill process"));
+        }
+        info!(Source="Stale Process Cleanup";"{}: Killed process: \"{}\"", sidecar_type,pid_file_path.display());
+    } else {
+        info!(Source="Stale Process Cleanup";"{}: Pid file with process number '{}' was found, but process was not.", sidecar_type, pid);
+    };
+
+    fs::remove_file(&pid_file_path)?;
+    info!(Source="Stale Process Cleanup";"{}: Deleted redundant Pid file: \"{}\"", sidecar_type,pid_file_path.display());
+    Ok(())
+}
+
+pub fn log_potential_stale_process(pid_file_path: PathBuf, pid: u32, sidecar_type: SidecarType) {
+    let mut system = System::new_all();
+    let pid = Pid::from_u32(pid);
+    system.refresh_processes(ProcessesToUpdate::Some(&[pid]), true);
+    let Some(process) = system.process(pid) else {
+        warn!(Source="Stale Process Cleanup";
+            "{}: Pid file with process number '{}' was not created because the process was not found.",
+            sidecar_type, pid
+        );
+        return;
+    };
+
+    match File::create(&pid_file_path) {
+        Ok(mut file) => {
+            let name = process.name().to_string_lossy();
+            let content = format!("{pid}\n{name}\n");
+            if let Err(e) = file.write_all(content.as_bytes()) {
+                warn!(Source="Stale Process Cleanup";"{}: Failed to write to \"{}\": {}", sidecar_type,pid_file_path.display(), e);
+            }
+        }
+        Err(e) => {
+            warn!(Source="Stale Process Cleanup";"{}: Failed to create \"{}\": {}", sidecar_type, pid_file_path.display(), e);
+        }
+    }
+}

runtime/tauri.conf.json

@@ -20,6 +20,11 @@
             "name": "../app/MindWork AI Studio/bin/dist/mindworkAIStudioServer",
             "sidecar": true,
             "args": true
+          },
+          {
+            "name": "target/databases/qdrant/qdrant",
+            "sidecar": true,
+            "args": true
           }
         ]
       },
@@ -59,7 +64,8 @@
       "targets": "all",
       "identifier": "com.github.mindwork-ai.ai-studio",
       "externalBin": [
-        "../app/MindWork AI Studio/bin/dist/mindworkAIStudioServer"
+        "../app/MindWork AI Studio/bin/dist/mindworkAIStudioServer",
+        "target/databases/qdrant/qdrant"
       ],
       "resources": [
         "resources/*"