Still support conf

docker/install_management_commands.sh

@@ -4,7 +4,8 @@
 
 set -eu
 
-for command in document_archiver \
+for command in decrypt_documents \
+	document_archiver \
 	document_exporter \
 	document_importer \
 	mail_fetcher \

docker/rootfs/etc/s6-overlay/s6-rc.d/init-migrations/run

@@ -8,6 +8,11 @@ echo "${log_prefix} Apply database migrations..."
 
 cd "${PAPERLESS_SRC_DIR}"
 
+if [[ "${PAPERLESS_MIGRATION_MODE:-0}" == "1" ]]; then
+	echo "${log_prefix} Migration mode enabled, skipping migrations."
+	exit 0
+fi
+
 # The whole migrate, with flock, needs to run as the right user
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
 	exec s6-setlock -n "${data_dir}/migration_lock" python3 manage.py migrate --skip-checks --no-input

docker/rootfs/etc/s6-overlay/s6-rc.d/init-system-checks/run

@@ -9,7 +9,15 @@ echo "${log_prefix} Running Django checks"
 cd "${PAPERLESS_SRC_DIR}"
 
 if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	python3 manage.py check
+	if [[ "${PAPERLESS_MIGRATION_MODE:-0}" == "1" ]]; then
+		python3 manage_migration.py check
+	else
+		python3 manage.py check
+	fi
 else
-	s6-setuidgid paperless python3 manage.py check
+	if [[ "${PAPERLESS_MIGRATION_MODE:-0}" == "1" ]]; then
+		s6-setuidgid paperless python3 manage_migration.py check
+	else
+		s6-setuidgid paperless python3 manage.py check
+	fi
 fi

docker/rootfs/etc/s6-overlay/s6-rc.d/svc-webserver/run

@@ -13,8 +13,14 @@ if [[ -n "${PAPERLESS_FORCE_SCRIPT_NAME}" ]]; then
 	export GRANIAN_URL_PATH_PREFIX=${PAPERLESS_FORCE_SCRIPT_NAME}
 fi
 
-if [[ -n "${USER_IS_NON_ROOT}" ]]; then
-	exec granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+if [[ "${PAPERLESS_MIGRATION_MODE:-0}" == "1" ]]; then
+	app_module="paperless.migration_asgi:application"
 else
-	exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+	app_module="paperless.asgi:application"
+fi
+
+if [[ -n "${USER_IS_NON_ROOT}" ]]; then
+	exec granian --interface asginl --ws --loop uvloop "${app_module}"
+else
+	exec s6-setuidgid paperless granian --interface asginl --ws --loop uvloop "${app_module}"
 fi

docker/rootfs/usr/local/bin/decrypt_documents

@@ -0,0 +1,14 @@
+#!/command/with-contenv /usr/bin/bash
+# shellcheck shell=bash
+
+set -e
+
+cd "${PAPERLESS_SRC_DIR}"
+
+if [[ $(id -u) == 0 ]]; then
+	s6-setuidgid paperless python3 manage.py decrypt_documents "$@"
+elif [[ $(id -un) == "paperless" ]]; then
+	python3 manage.py decrypt_documents "$@"
+else
+	echo "Unknown user."
+fi

docs/administration.md

@@ -580,6 +580,36 @@ document.
     documents, such as encrypted PDF documents. The archiver will skip over
     these documents each time it sees them.
 
+### Managing encryption {#encryption}
+
+!!! warning
+
+    Encryption was removed in [paperless-ng 0.9](changelog.md#paperless-ng-090)
+    because it did not really provide any additional security, the passphrase
+    was stored in a configuration file on the same system as the documents.
+    Furthermore, the entire text content of the documents is stored plain in
+    the database, even if your documents are encrypted. Filenames are not
+    encrypted as well. Finally, the web server provides transparent access to
+    your encrypted documents.
+
+    Consider running paperless on an encrypted filesystem instead, which
+    will then at least provide security against physical hardware theft.
+
+#### Enabling encryption
+
+Enabling encryption is no longer supported.
+
+#### Disabling encryption
+
+Basic usage to disable encryption of your document store:
+
+(Note: If `PAPERLESS_PASSPHRASE` isn't set already, you need to specify
+it here)
+
+```
+decrypt_documents [--passphrase SECR3TP4SSPHRA$E]
+```
+
 ### Detecting duplicates {#fuzzy_duplicate}
 
 Paperless already catches and prevents upload of exactly matching documents,

docs/advanced_usage.md

@@ -501,7 +501,7 @@ The `datetime` filter formats a datetime string or datetime object using Python'
 See the [strftime format code documentation](https://docs.python.org/3.13/library/datetime.html#strftime-and-strptime-format-codes)
 for the possible codes and their meanings.
 
-##### Date Localization {#date-localization}
+##### Date Localization
 
 The `localize_date` filter formats a date or datetime object into a localized string using Babel internationalization.
 This takes into account the provided locale for translation. Since this must be used on a date or datetime object,
@@ -851,8 +851,8 @@ followed by the even pages.
 
 It's important that the scan files get consumed in the correct order, and one at a time.
 You therefore need to make sure that Paperless is running while you upload the files into
-the directory; and if you're using polling, make sure that
-`CONSUMER_POLLING_INTERVAL` is set to a value lower than it takes for the second scan to appear,
+the directory; and if you're using [polling](configuration.md#polling), make sure that
+`CONSUMER_POLLING` is set to a value lower than it takes for the second scan to appear,
 like 5-10 or even lower.
 
 Another thing that might happen is that you start a double sided scan, but then forget

docs/configuration.md

@@ -1175,45 +1175,21 @@ don't exist yet.
 
 #### [`PAPERLESS_CONSUMER_IGNORE_PATTERNS=<json>`](#PAPERLESS_CONSUMER_IGNORE_PATTERNS) {#PAPERLESS_CONSUMER_IGNORE_PATTERNS}
 
-: Additional regex patterns for files to ignore in the consumption directory. Patterns are matched against filenames only (not full paths)
-using Python's `re.match()`, which anchors at the start of the filename.
+: By default, paperless ignores certain files and folders in the
+consumption directory, such as system files created by the Mac OS
+or hidden folders some tools use to store data.
 
-    See the [watchfiles documentation](https://watchfiles.helpmanual.io/api/filters/#watchfiles.BaseFilter.ignore_entity_patterns)
+    This can be adjusted by configuring a custom json array with
+    patterns to exclude.
 
-    This setting is for additional patterns beyond the built-in defaults. Common system files and directories are already ignored automatically.
-    The patterns will be compiled via Python's standard `re` module.
+    For example, `.DS_STORE/*` will ignore any files found in a folder
+    named `.DS_STORE`, including `.DS_STORE/bar.pdf` and `foo/.DS_STORE/bar.pdf`
 
-    Example custom patterns:
+    A pattern like `._*` will ignore anything starting with `._`, including:
+    `._foo.pdf` and `._bar/foo.pdf`
 
-    ```json
-    ["^temp_", "\\.bak$", "^~"]
-    ```
-
-    This would ignore:
-
-    - Files starting with `temp_` (e.g., `temp_scan.pdf`)
-    - Files ending with `.bak` (e.g., `document.pdf.bak`)
-    - Files starting with `~` (e.g., `~$document.docx`)
-
-    Defaults to `[]` (empty list, uses only built-in defaults).
-
-    The default ignores are `[.DS_Store, .DS_STORE, ._*, desktop.ini, Thumbs.db]` and cannot be overridden.
-
-#### [`PAPERLESS_CONSUMER_IGNORE_DIRS=<json>`](#PAPERLESS_CONSUMER_IGNORE_DIRS) {#PAPERLESS_CONSUMER_IGNORE_DIRS}
-
-: Additional directory names to ignore in the consumption directory. Directories matching these names (and all their contents) will be skipped.
-
-    This setting is for additional directories beyond the built-in defaults. Matching is done by directory name only, not full path.
-
-    Example:
-
-    ```json
-    ["temp", "incoming", ".hidden"]
-    ```
-
-    Defaults to `[]` (empty list, uses only built-in defaults).
-
-    The default ignores are `[.stfolder, .stversions, .localized, @eaDir, .Spotlight-V100, .Trashes, __MACOSX]` and cannot be overridden.
+    Defaults to
+    `[".DS_Store", ".DS_STORE", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini", "@eaDir/*", "Thumbs.db"]`.
 
 #### [`PAPERLESS_CONSUMER_BARCODE_SCANNER=<string>`](#PAPERLESS_CONSUMER_BARCODE_SCANNER) {#PAPERLESS_CONSUMER_BARCODE_SCANNER}
 
@@ -1312,24 +1288,48 @@ within your documents.
 
     Defaults to false.
 
-#### [`PAPERLESS_CONSUMER_POLLING_INTERVAL=<num>`](#PAPERLESS_CONSUMER_POLLING_INTERVAL) {#PAPERLESS_CONSUMER_POLLING_INTERVAL}
+### Polling {#polling}
 
-: Configures how the consumer detects new files in the consumption directory.
+#### [`PAPERLESS_CONSUMER_POLLING=<num>`](#PAPERLESS_CONSUMER_POLLING) {#PAPERLESS_CONSUMER_POLLING}
 
-    When set to `0` (default), paperless uses native filesystem notifications for efficient, immediate detection of new files.
+: If paperless won't find documents added to your consume folder, it
+might not be able to automatically detect filesystem changes. In
+that case, specify a polling interval in seconds here, which will
+then cause paperless to periodically check your consumption
+directory for changes. This will also disable listening for file
+system changes with `inotify`.
 
-    When set to a positive number, paperless polls the consumption directory at that interval in seconds. Use polling for network filesystems (NFS, SMB/CIFS) where native notifications may not work reliably.
+    Defaults to 0, which disables polling and uses filesystem
+    notifications.
 
-    Defaults to 0.
+#### [`PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=<num>`](#PAPERLESS_CONSUMER_POLLING_RETRY_COUNT) {#PAPERLESS_CONSUMER_POLLING_RETRY_COUNT}
 
-#### [`PAPERLESS_CONSUMER_STABILITY_DELAY=<num>`](#PAPERLESS_CONSUMER_STABILITY_DELAY) {#PAPERLESS_CONSUMER_STABILITY_DELAY}
+: If consumer polling is enabled, sets the maximum number of times
+paperless will check for a file to remain unmodified. If a file's
+modification time and size are identical for two consecutive checks, it
+will be consumed.
 
-: Sets the time in seconds that a file must remain unchanged (same size and modification time) before paperless will begin consuming it.
+    Defaults to 5.
 
-    Increase this value if you experience issues with files being consumed before they are fully written, particularly on slower network storage or
-    with certain scanner quirks
+#### [`PAPERLESS_CONSUMER_POLLING_DELAY=<num>`](#PAPERLESS_CONSUMER_POLLING_DELAY) {#PAPERLESS_CONSUMER_POLLING_DELAY}
 
-    Defaults to 5.0 seconds.
+: If consumer polling is enabled, sets the delay in seconds between
+each check (above) paperless will do while waiting for a file to
+remain unmodified.
+
+    Defaults to 5.
+
+### iNotify {#inotify}
+
+#### [`PAPERLESS_CONSUMER_INOTIFY_DELAY=<num>`](#PAPERLESS_CONSUMER_INOTIFY_DELAY) {#PAPERLESS_CONSUMER_INOTIFY_DELAY}
+
+: Sets the time in seconds the consumer will wait for additional
+events from inotify before the consumer will consider a file ready
+and begin consumption. Certain scanners or network setups may
+generate multiple events for a single file, leading to multiple
+consumers working on the same file. Configure this to prevent that.
+
+    Defaults to 0.5 seconds.
 
 ## Workflow webhooks
 

docs/migration.md

@@ -1,25 +0,0 @@
-# v3 Migration Guide
-
-## Consumer Settings Changes
-
-The v3 consumer command uses a [different library](https://watchfiles.helpmanual.io/) to unify
-the watching for new files in the consume directory. For the user, this removes several configuration options related to delays and retries
-and replaces with a single unified setting. It also adjusts how the consumer ignore filtering happens, replaced `fnmatch` with `regex` and
-separating the directory ignore from the file ignore.
-
-### Summary
-
-| Old Setting                    | New Setting                                                                         | Notes                                                                                |
-| ------------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
-| `CONSUMER_POLLING`             | [`CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL) | Renamed for clarity                                                                  |
-| `CONSUMER_INOTIFY_DELAY`       | [`CONSUMER_STABILITY_DELAY`](configuration.md#PAPERLESS_CONSUMER_STABILITY_DELAY)   | Unified for all modes                                                                |
-| `CONSUMER_POLLING_DELAY`       | _Removed_                                                                           | Use `CONSUMER_STABILITY_DELAY`                                                       |
-| `CONSUMER_POLLING_RETRY_COUNT` | _Removed_                                                                           | Automatic with stability tracking                                                    |
-| `CONSUMER_IGNORE_PATTERNS`     | [`CONSUMER_IGNORE_PATTERNS`](configuration.md#PAPERLESS_CONSUMER_IGNORE_PATTERNS)   | **Now regex, not fnmatch**; user patterns are added to (not replacing) default ones  |
-| _New_                          | [`CONSUMER_IGNORE_DIRS`](configuration.md#PAPERLESS_CONSUMER_IGNORE_DIRS)           | Additional directories to ignore; user entries are added to (not replacing) defaults |
-
-## Encryption Support
-
-Document and thumbnail encryption is no longer supported. This was previously deprecated in [paperless-ng 0.9.3](https://github.com/paperless-ngx/paperless-ngx/blob/dev/docs/changelog.md#paperless-ng-093)
-
-Users must decrypt their document using the `decrypt_documents` command before upgrading.

docs/setup.md

@@ -124,7 +124,8 @@ account. The script essentially automatically performs the steps described in [D
         system notifications with `inotify`. When storing the consumption
         directory on such a file system, paperless will not pick up new
         files with the default configuration. You will need to use
-        [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL), which will disable inotify.
+        [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING), which will disable inotify. See
+        [here](configuration.md#polling).
 
 5.  Run `docker compose pull`. This will pull the image from the GitHub container registry
     by default but you can change the image to pull from Docker Hub by changing the `image`

docs/troubleshooting.md

@@ -46,9 +46,9 @@ run:
 If you notice that the consumer will only pickup files in the
 consumption directory at startup, but won't find any other files added
 later, you will need to enable filesystem polling with the configuration
-option [`PAPERLESS_CONSUMER_POLLING_INTERVAL`](configuration.md#PAPERLESS_CONSUMER_POLLING_INTERVAL).
+option [`PAPERLESS_CONSUMER_POLLING`](configuration.md#PAPERLESS_CONSUMER_POLLING).
 
-This will disable automatic listening for filesystem changes and
+This will disable listening to filesystem changes with inotify and
 paperless will manually check the consumption directory for changes
 instead.
 
@@ -234,9 +234,47 @@ FileNotFoundError: [Errno 2] No such file or directory: '/tmp/ocrmypdf.io.yhk3zb
 
 This probably indicates paperless tried to consume the same file twice.
 This can happen for a number of reasons, depending on how documents are
-placed into the consume folder, such as how a scanner may modify a file multiple times as it scans.
-Try adjusting the
-[file stability delay](configuration.md#PAPERLESS_CONSUMER_STABILITY_DELAY) to a larger value.
+placed into the consume folder. If paperless is using inotify (the
+default) to check for documents, try adjusting the
+[inotify configuration](configuration.md#inotify). If polling is enabled, try adjusting the
+[polling configuration](configuration.md#polling).
+
+## Consumer fails waiting for file to remain unmodified.
+
+You might find messages like these in your log files:
+
+```
+[ERROR] [paperless.management.consumer] Timeout while waiting on file /usr/src/paperless/src/../consume/SCN_0001.pdf to remain unmodified.
+```
+
+This indicates paperless timed out while waiting for the file to be
+completely written to the consume folder. Adjusting
+[polling configuration](configuration.md#polling) values should resolve the issue.
+
+!!! note
+
+    The user will need to manually move the file out of the consume folder
+    and back in, for the initial failing file to be consumed.
+
+## Consumer fails reporting "OS reports file as busy still".
+
+You might find messages like these in your log files:
+
+```
+[WARNING] [paperless.management.consumer] Not consuming file /usr/src/paperless/src/../consume/SCN_0001.pdf: OS reports file as busy still
+```
+
+This indicates paperless was unable to open the file, as the OS reported
+the file as still being in use. To prevent a crash, paperless did not
+try to consume the file. If paperless is using inotify (the default) to
+check for documents, try adjusting the
+[inotify configuration](configuration.md#inotify). If polling is enabled, try adjusting the
+[polling configuration](configuration.md#polling).
+
+!!! note
+
+    The user will need to manually move the file out of the consume folder
+    and back in, for the initial failing file to be consumed.
 
 ## Log reports "Creating PaperlessTask failed".
 

docs/usage.md

@@ -565,7 +565,7 @@ This allows for complex logic to be used to generate the title, including [logic
 and [filters](https://jinja.palletsprojects.com/en/3.1.x/templates/#id11).
 The template is provided as a string.
 
-Using Jinja2 Templates is also useful for [Date localization](advanced_usage.md#date-localization) in the title.
+Using Jinja2 Templates is also useful for [Date localization](advanced_usage.md#Date-Localization) in the title.
 
 The available inputs differ depending on the type of workflow trigger.
 This is because at the time of consumption (when the text is to be set), no automatic tags etc. have been

mkdocs.yml

@@ -69,9 +69,8 @@ nav:
   - development.md
   - 'FAQs': faq.md
   - troubleshooting.md
-  - 'Migration to v3': migration.md
   - changelog.md
-copyright: Copyright © 2016 - 2026 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
+copyright: Copyright © 2016 - 2023 Daniel Quinn, Jonas Winkler, and the Paperless-ngx team
 extra:
   social:
     - icon: fontawesome/brands/github

paperless.conf.example

@@ -55,10 +55,10 @@
 #PAPERLESS_TASK_WORKERS=1
 #PAPERLESS_THREADS_PER_WORKER=1
 #PAPERLESS_TIME_ZONE=UTC
-#PAPERLESS_CONSUMER_POLLING_INTERVAL=10
+#PAPERLESS_CONSUMER_POLLING=10
 #PAPERLESS_CONSUMER_DELETE_DUPLICATES=false
 #PAPERLESS_CONSUMER_RECURSIVE=false
-#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[]  # Defaults are built in; add filename regexes, e.g. ["^\\.DS_Store$", "^desktop\\.ini$"]
+#PAPERLESS_CONSUMER_IGNORE_PATTERNS=[".DS_STORE/*", "._*", ".stfolder/*", ".stversions/*", ".localized/*", "desktop.ini"]
 #PAPERLESS_CONSUMER_SUBDIRS_AS_TAGS=false
 #PAPERLESS_CONSUMER_ENABLE_BARCODES=false
 #PAPERLESS_CONSUMER_BARCODE_STRING=PATCHT

pyproject.toml

@@ -50,6 +50,7 @@ dependencies = [
   "gotenberg-client~=0.13.1",
   "httpx-oauth~=0.16",
   "imap-tools~=1.11.0",
+  "inotifyrecursive~=0.3",
   "jinja2~=3.1.5",
   "langdetect~=1.0.9",
   "llama-index-core>=0.14.12",
@@ -78,7 +79,7 @@ dependencies = [
   "tika-client~=0.10.0",
   "torch~=2.9.1",
   "tqdm~=4.67.1",
-  "watchfiles>=1.1.1",
+  "watchdog~=6.0",
   "whitenoise~=6.9",
   "whoosh-reloaded>=2.7.5",
   "zxing-cpp~=2.3.0",

src/documents/__init__.py

@@ -1,4 +1,5 @@
 # this is here so that django finds the checks.
+from documents.checks import changed_password_check
 from documents.checks import parser_check
 
-__all__ = ["parser_check"]
+__all__ = ["changed_password_check", "parser_check"]

src/documents/admin.py

@@ -60,6 +60,7 @@ class DocumentAdmin(GuardedModelAdmin):
         "added",
         "modified",
         "mime_type",
+        "storage_type",
         "filename",
         "checksum",
         "archive_filename",

src/documents/checks.py

@@ -1,12 +1,60 @@
+import textwrap
+
 from django.conf import settings
 from django.core.checks import Error
 from django.core.checks import Warning
 from django.core.checks import register
+from django.core.exceptions import FieldError
+from django.db.utils import OperationalError
+from django.db.utils import ProgrammingError
 
 from documents.signals import document_consumer_declaration
 from documents.templating.utils import convert_format_str_to_template_format
 
 
+@register()
+def changed_password_check(app_configs, **kwargs):
+    from documents.models import Document
+    from paperless.db import GnuPG
+
+    try:
+        encrypted_doc = (
+            Document.objects.filter(
+                storage_type=Document.STORAGE_TYPE_GPG,
+            )
+            .only("pk", "storage_type")
+            .first()
+        )
+    except (OperationalError, ProgrammingError, FieldError):
+        return []  # No documents table yet
+
+    if encrypted_doc:
+        if not settings.PASSPHRASE:
+            return [
+                Error(
+                    "The database contains encrypted documents but no password is set.",
+                ),
+            ]
+
+        if not GnuPG.decrypted(encrypted_doc.source_file):
+            return [
+                Error(
+                    textwrap.dedent(
+                        """
+                The current password doesn't match the password of the
+                existing documents.
+
+                If you intend to change your password, you must first export
+                all of the old documents, start fresh with the new password
+                and then re-import them."
+                """,
+                    ),
+                ),
+            ]
+
+    return []
+
+
 @register()
 def parser_check(app_configs, **kwargs):
     parsers = []

src/documents/conditionals.py

@@ -128,7 +128,7 @@ def thumbnail_last_modified(request, pk: int) -> datetime | None:
     Cache should be (slightly?) faster than filesystem
     """
     try:
-        doc = Document.objects.only("pk").get(pk=pk)
+        doc = Document.objects.only("storage_type").get(pk=pk)
         if not doc.thumbnail_path.exists():
             return None
         doc_key = get_thumbnail_modified_key(pk)

src/documents/consumer.py

@@ -497,6 +497,7 @@ class ConsumerPlugin(
                     create_source_path_directory(document.source_path)
 
                     self._write(
+                        document.storage_type,
                         self.unmodified_original
                         if self.unmodified_original is not None
                         else self.working_copy,
@@ -504,6 +505,7 @@ class ConsumerPlugin(
                     )
 
                     self._write(
+                        document.storage_type,
                         thumbnail,
                         document.thumbnail_path,
                     )
@@ -515,6 +517,7 @@ class ConsumerPlugin(
                         )
                         create_source_path_directory(document.archive_path)
                         self._write(
+                            document.storage_type,
                             archive_path,
                             document.archive_path,
                         )
@@ -634,6 +637,8 @@ class ConsumerPlugin(
             )
             self.log.debug(f"Creation date from st_mtime: {create_date}")
 
+        storage_type = Document.STORAGE_TYPE_UNENCRYPTED
+
         if self.metadata.filename:
             title = Path(self.metadata.filename).stem
         else:
@@ -660,6 +665,7 @@ class ConsumerPlugin(
             checksum=hashlib.md5(file_for_checksum.read_bytes()).hexdigest(),
             created=create_date,
             modified=create_date,
+            storage_type=storage_type,
             page_count=page_count,
             original_filename=self.filename,
         )
@@ -730,7 +736,7 @@ class ConsumerPlugin(
                 }
                 CustomFieldInstance.objects.create(**args)  # adds to document
 
-    def _write(self, source, target):
+    def _write(self, storage_type, source, target):
         with (
             Path(source).open("rb") as read_file,
             Path(target).open("wb") as write_file,

src/documents/file_handling.py

@@ -126,6 +126,7 @@ def generate_filename(
     doc: Document,
     *,
     counter=0,
+    append_gpg=True,
     archive_filename=False,
 ) -> Path:
     base_path: Path | None = None
@@ -169,4 +170,8 @@ def generate_filename(
         final_filename = f"{doc.pk:07}{counter_str}{filetype_str}"
         full_path = Path(final_filename)
 
+    # Add GPG extension if needed
+    if append_gpg and doc.storage_type == doc.STORAGE_TYPE_GPG:
+        full_path = full_path.with_suffix(full_path.suffix + ".gpg")
+
     return full_path

src/documents/management/commands/decrypt_documents.py

@@ -0,0 +1,93 @@
+from pathlib import Path
+
+from django.conf import settings
+from django.core.management.base import BaseCommand
+from django.core.management.base import CommandError
+
+from documents.models import Document
+from paperless.db import GnuPG
+
+
+class Command(BaseCommand):
+    help = (
+        "This is how you migrate your stored documents from an encrypted "
+        "state to an unencrypted one (or vice-versa)"
+    )
+
+    def add_arguments(self, parser) -> None:
+        parser.add_argument(
+            "--passphrase",
+            help=(
+                "If PAPERLESS_PASSPHRASE isn't set already, you need to specify it here"
+            ),
+        )
+
+    def handle(self, *args, **options) -> None:
+        try:
+            self.stdout.write(
+                self.style.WARNING(
+                    "\n\n"
+                    "WARNING: This script is going to work directly on your "
+                    "document originals, so\n"
+                    "WARNING: you probably shouldn't run "
+                    "this unless you've got a recent backup\n"
+                    "WARNING: handy.  It "
+                    "*should* work without a hitch, but be safe and backup your\n"
+                    "WARNING: stuff first.\n\n"
+                    "Hit Ctrl+C to exit now, or Enter to "
+                    "continue.\n\n",
+                ),
+            )
+            _ = input()
+        except KeyboardInterrupt:
+            return
+
+        passphrase = options["passphrase"] or settings.PASSPHRASE
+        if not passphrase:
+            raise CommandError(
+                "Passphrase not defined.  Please set it with --passphrase or "
+                "by declaring it in your environment or your config.",
+            )
+
+        self.__gpg_to_unencrypted(passphrase)
+
+    def __gpg_to_unencrypted(self, passphrase: str) -> None:
+        encrypted_files = Document.objects.filter(
+            storage_type=Document.STORAGE_TYPE_GPG,
+        )
+
+        for document in encrypted_files:
+            self.stdout.write(f"Decrypting {document}")
+
+            old_paths = [document.source_path, document.thumbnail_path]
+
+            with document.source_file as file_handle:
+                raw_document = GnuPG.decrypted(file_handle, passphrase)
+            with document.thumbnail_file as file_handle:
+                raw_thumb = GnuPG.decrypted(file_handle, passphrase)
+
+            document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
+
+            ext: str = Path(document.filename).suffix
+
+            if not ext == ".gpg":
+                raise CommandError(
+                    f"Abort: encrypted file {document.source_path} does not "
+                    f"end with .gpg",
+                )
+
+            document.filename = Path(document.filename).stem
+
+            with document.source_path.open("wb") as f:
+                f.write(raw_document)
+
+            with document.thumbnail_path.open("wb") as f:
+                f.write(raw_thumb)
+
+            Document.objects.filter(id=document.id).update(
+                storage_type=document.storage_type,
+                filename=document.filename,
+            )
+
+            for path in old_paths:
+                path.unlink()

src/documents/management/commands/document_consumer.py

@@ -1,343 +1,135 @@
-"""
-Document consumer management command.
-
-Watches a consumption directory for new documents and queues them for processing.
-Uses watchfiles for efficient file system monitoring with support for both
-native OS notifications and polling fallback.
-"""
-
-from __future__ import annotations
-
 import logging
-from dataclasses import dataclass
+import os
+from concurrent.futures import ThreadPoolExecutor
+from fnmatch import filter
 from pathlib import Path
+from pathlib import PurePath
 from threading import Event
 from time import monotonic
-from typing import TYPE_CHECKING
+from time import sleep
 from typing import Final
 
 from django import db
 from django.conf import settings
 from django.core.management.base import BaseCommand
 from django.core.management.base import CommandError
-from watchfiles import Change
-from watchfiles import DefaultFilter
-from watchfiles import watch
+from watchdog.events import FileSystemEventHandler
+from watchdog.observers.polling import PollingObserver
 
 from documents.data_models import ConsumableDocument
 from documents.data_models import DocumentMetadataOverrides
 from documents.data_models import DocumentSource
 from documents.models import Tag
-from documents.parsers import get_supported_file_extensions
+from documents.parsers import is_file_ext_supported
 from documents.tasks import consume_file
 
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
+try:
+    from inotifyrecursive import INotify
+    from inotifyrecursive import flags
+except ImportError:  # pragma: no cover
+    INotify = flags = None
 
 logger = logging.getLogger("paperless.management.consumer")
 
 
-@dataclass
-class TrackedFile:
-    """Represents a file being tracked for stability."""
-
-    path: Path
-    last_event_time: float
-    last_mtime: float | None = None
-    last_size: int | None = None
-
-    def update_stats(self) -> bool:
-        """
-        Update file stats. Returns True if file exists and stats were updated.
-        """
-        try:
-            stat = self.path.stat()
-            self.last_mtime = stat.st_mtime
-            self.last_size = stat.st_size
-            return True
-        except OSError:
-            return False
-
-    def is_unchanged(self) -> bool:
-        """
-        Check if file stats match the previously recorded values.
-        Returns False if file doesn't exist or stats changed.
-        """
-        try:
-            stat = self.path.stat()
-            return stat.st_mtime == self.last_mtime and stat.st_size == self.last_size
-        except OSError:
-            return False
-
-
-class FileStabilityTracker:
+def _tags_from_path(filepath: Path) -> list[int]:
     """
-    Tracks file events and determines when files are stable for consumption.
-
-    A file is considered stable when:
-    1. No new events have been received for it within the stability delay
-    2. Its size and modification time haven't changed
-    3. It still exists as a regular file
-
-    This handles various edge cases:
-    - Network copies that write in chunks
-    - Scanners that open/close files multiple times
-    - Temporary files that get renamed
-    - Files that are deleted before becoming stable
-    """
-
-    def __init__(self, stability_delay: float = 1.0) -> None:
-        """
-        Initialize the tracker.
-
-        Args:
-            stability_delay: Time in seconds a file must remain unchanged
-                           before being considered stable.
-        """
-        self.stability_delay = stability_delay
-        self._tracked: dict[Path, TrackedFile] = {}
-
-    def track(self, path: Path, change: Change) -> None:
-        """
-        Register a file event.
-
-        Args:
-            path: The file path that changed.
-            change: The type of change (added, modified, deleted).
-        """
-        path = path.resolve()
-
-        match change:
-            case Change.deleted:
-                self._tracked.pop(path, None)
-                logger.debug(f"Stopped tracking deleted file: {path}")
-            case Change.added | Change.modified:
-                current_time = monotonic()
-                if path in self._tracked:
-                    tracked = self._tracked[path]
-                    tracked.last_event_time = current_time
-                    tracked.update_stats()
-                    logger.debug(f"Updated tracking for: {path}")
-                else:
-                    tracked = TrackedFile(path=path, last_event_time=current_time)
-                    if tracked.update_stats():
-                        self._tracked[path] = tracked
-                        logger.debug(f"Started tracking: {path}")
-                    else:
-                        logger.debug(f"Could not stat file, not tracking: {path}")
-
-    def get_stable_files(self) -> Iterator[Path]:
-        """
-        Yield files that have been stable for the configured delay.
-
-        Files are removed from tracking once yielded or determined to be invalid.
-        """
-        current_time = monotonic()
-        to_remove: list[Path] = []
-        to_yield: list[Path] = []
-
-        for path, tracked in self._tracked.items():
-            time_since_event = current_time - tracked.last_event_time
-
-            if time_since_event < self.stability_delay:
-                continue
-
-            # File has waited long enough, verify it's unchanged
-            if not tracked.is_unchanged():
-                # Stats changed or file gone - update and wait again
-                if tracked.update_stats():
-                    tracked.last_event_time = current_time
-                    logger.debug(f"File changed during stability check: {path}")
-                else:
-                    # File no longer exists, remove from tracking
-                    to_remove.append(path)
-                    logger.debug(f"File disappeared during stability check: {path}")
-                continue
-
-            # File is stable, we can return it
-            to_yield.append(path)
-            logger.info(f"File is stable: {path}")
-
-        # Remove files that are no longer valid
-        for path in to_remove:
-            self._tracked.pop(path, None)
-
-        # Remove and yield stable files
-        for path in to_yield:
-            self._tracked.pop(path, None)
-            yield path
-
-    def has_pending_files(self) -> bool:
-        """Check if there are files waiting for stability check."""
-        return len(self._tracked) > 0
-
-    @property
-    def pending_count(self) -> int:
-        """Number of files being tracked."""
-        return len(self._tracked)
-
-
-class ConsumerFilter(DefaultFilter):
-    """
-    Filter for watchfiles that accepts only supported document types
-    and ignores system files/directories.
-
-    Extends DefaultFilter leveraging its built-in filtering:
-    - `ignore_dirs`: Directory names to ignore (and all their contents)
-    - `ignore_entity_patterns`: Regex patterns matched against filename/dirname only
-
-    We add custom logic for file extension filtering (only accept supported
-    document types), which the library doesn't provide.
-    """
-
-    # Regex patterns for files to always ignore (matched against filename only)
-    # These are passed to DefaultFilter.ignore_entity_patterns
-    DEFAULT_IGNORE_PATTERNS: Final[tuple[str, ...]] = (
-        r"^\.DS_Store$",
-        r"^\.DS_STORE$",
-        r"^\._.*",
-        r"^desktop\.ini$",
-        r"^Thumbs\.db$",
-    )
-
-    # Directories to always ignore (passed to DefaultFilter.ignore_dirs)
-    # These are matched by directory name, not full path
-    DEFAULT_IGNORE_DIRS: Final[tuple[str, ...]] = (
-        ".stfolder",  # Syncthing
-        ".stversions",  # Syncthing
-        ".localized",  # macOS
-        "@eaDir",  # Synology NAS
-        ".Spotlight-V100",  # macOS
-        ".Trashes",  # macOS
-        "__MACOSX",  # macOS archive artifacts
-    )
-
-    def __init__(
-        self,
-        *,
-        supported_extensions: frozenset[str] | None = None,
-        ignore_patterns: list[str] | None = None,
-        ignore_dirs: list[str] | None = None,
-    ) -> None:
-        """
-        Initialize the consumer filter.
-
-        Args:
-            supported_extensions: Set of file extensions to accept (e.g., {".pdf", ".png"}).
-                If None, uses get_supported_file_extensions().
-            ignore_patterns: Additional regex patterns to ignore (matched against filename).
-            ignore_dirs: Additional directory names to ignore (merged with defaults).
-        """
-        # Get supported extensions
-        if supported_extensions is None:
-            supported_extensions = frozenset(get_supported_file_extensions())
-        self._supported_extensions = supported_extensions
-
-        # Combine default and user patterns
-        all_patterns: list[str] = list(self.DEFAULT_IGNORE_PATTERNS)
-        if ignore_patterns:
-            all_patterns.extend(ignore_patterns)
-
-        # Combine default and user ignore_dirs
-        all_ignore_dirs: list[str] = list(self.DEFAULT_IGNORE_DIRS)
-        if ignore_dirs:
-            all_ignore_dirs.extend(ignore_dirs)
-
-        # Let DefaultFilter handle all the pattern and directory filtering
-        super().__init__(
-            ignore_dirs=tuple(all_ignore_dirs),
-            ignore_entity_patterns=tuple(all_patterns),
-            ignore_paths=(),
-        )
-
-    def __call__(self, change: Change, path: str) -> bool:
-        """
-        Filter function for watchfiles.
-
-        Returns True if the path should be watched, False to ignore.
-
-        The parent DefaultFilter handles:
-        - Hidden files/directories (starting with .)
-        - Directories in ignore_dirs
-        - Files/directories matching ignore_entity_patterns
-
-        We additionally filter files by extension.
-        """
-        # Let parent filter handle directory ignoring and pattern matching
-        if not super().__call__(change, path):
-            return False
-
-        path_obj = Path(path)
-
-        # For directories, parent filter already handled everything
-        if path_obj.is_dir():
-            return True
-
-        # For files, check extension
-        return self._has_supported_extension(path_obj)
-
-    def _has_supported_extension(self, path: Path) -> bool:
-        """Check if the file has a supported extension."""
-        suffix = path.suffix.lower()
-        return suffix in self._supported_extensions
-
-
-def _tags_from_path(filepath: Path, consumption_dir: Path) -> list[int]:
-    """
-    Walk up the directory tree from filepath to consumption_dir
+    Walk up the directory tree from filepath to CONSUMPTION_DIR
     and get or create Tag IDs for every directory.
 
-    Returns list of Tag primary keys.
+    Returns set of Tag models
     """
     db.close_old_connections()
-    tag_ids: set[int] = set()
-    path_parts = filepath.relative_to(consumption_dir).parent.parts
-
+    tag_ids = set()
+    path_parts = filepath.relative_to(settings.CONSUMPTION_DIR).parent.parts
     for part in path_parts:
-        tag, _ = Tag.objects.get_or_create(
-            name__iexact=part,
-            defaults={"name": part},
+        tag_ids.add(
+            Tag.objects.get_or_create(name__iexact=part, defaults={"name": part})[0].pk,
         )
-        tag_ids.add(tag.pk)
 
     return list(tag_ids)
 
 
-def _consume_file(
-    filepath: Path,
-    consumption_dir: Path,
-    *,
-    subdirs_as_tags: bool,
-) -> None:
+def _is_ignored(filepath: Path) -> bool:
     """
-    Queue a file for consumption.
+    Checks if the given file should be ignored, based on configured
+    patterns.
 
-    Args:
-        filepath: Path to the file to consume.
-        consumption_dir: Base consumption directory.
-        subdirs_as_tags: Whether to create tags from subdirectory names.
+    Returns True if the file is ignored, False otherwise
     """
-    # Verify file still exists and is accessible
+    # Trim out the consume directory, leaving only filename and it's
+    # path relative to the consume directory
+    filepath_relative = PurePath(filepath).relative_to(settings.CONSUMPTION_DIR)
+
+    # March through the components of the path, including directories and the filename
+    # looking for anything matching
+    # foo/bar/baz/file.pdf -> (foo, bar, baz, file.pdf)
+    parts = []
+    for part in filepath_relative.parts:
+        # If the part is not the name (ie, it's a dir)
+        # Need to append the trailing slash or fnmatch doesn't match
+        # fnmatch("dir", "dir/*") == False
+        # fnmatch("dir/", "dir/*") == True
+        if part != filepath_relative.name:
+            part = part + "/"
+        parts.append(part)
+
+    for pattern in settings.CONSUMER_IGNORE_PATTERNS:
+        if len(filter(parts, pattern)):
+            return True
+
+    return False
+
+
+def _consume(filepath: Path) -> None:
+    # Check permissions early
     try:
-        if not filepath.is_file():
-            logger.debug(f"Not consuming {filepath}: not a file or doesn't exist")
-            return
-    except OSError as e:
-        logger.warning(f"Not consuming {filepath}: {e}")
+        filepath.stat()
+    except (PermissionError, OSError):
+        logger.warning(f"Not consuming file {filepath}: Permission denied.")
         return
 
-    # Get tags from path if configured
-    tag_ids: list[int] | None = None
-    if subdirs_as_tags:
-        try:
-            tag_ids = _tags_from_path(filepath, consumption_dir)
-        except Exception:
-            logger.exception(f"Error creating tags from path for {filepath}")
+    if filepath.is_dir() or _is_ignored(filepath):
+        return
 
-    # Queue for consumption
+    if not filepath.is_file():
+        logger.debug(f"Not consuming file {filepath}: File has moved.")
+        return
+
+    if not is_file_ext_supported(filepath.suffix):
+        logger.warning(f"Not consuming file {filepath}: Unknown file extension.")
+        return
+
+    # Total wait time: up to 500ms
+    os_error_retry_count: Final[int] = 50
+    os_error_retry_wait: Final[float] = 0.01
+
+    read_try_count = 0
+    file_open_ok = False
+    os_error_str = None
+
+    while (read_try_count < os_error_retry_count) and not file_open_ok:
+        try:
+            with filepath.open("rb"):
+                file_open_ok = True
+        except OSError as e:
+            read_try_count += 1
+            os_error_str = str(e)
+            sleep(os_error_retry_wait)
+
+    if read_try_count >= os_error_retry_count:
+        logger.warning(f"Not consuming file {filepath}: OS reports {os_error_str}")
+        return
+
+    tag_ids = None
     try:
-        logger.info(f"Adding {filepath} to the task queue")
+        if settings.CONSUMER_SUBDIRS_AS_TAGS:
+            tag_ids = _tags_from_path(filepath)
+    except Exception:
+        logger.exception("Error creating tags from path")
+
+    try:
+        logger.info(f"Adding {filepath} to the task queue.")
         consume_file.delay(
             ConsumableDocument(
                 source=DocumentSource.ConsumeFolder,
@@ -346,209 +138,228 @@ def _consume_file(
             DocumentMetadataOverrides(tag_ids=tag_ids),
         )
     except Exception:
-        logger.exception(f"Error while queuing document {filepath}")
+        # Catch all so that the consumer won't crash.
+        # This is also what the test case is listening for to check for
+        # errors.
+        logger.exception("Error while consuming document")
+
+
+def _consume_wait_unmodified(file: Path) -> None:
+    """
+    Waits for the given file to appear unmodified based on file size
+    and modification time.  Will wait a configured number of seconds
+    and retry a configured number of times before either consuming or
+    giving up
+    """
+    if _is_ignored(file):
+        return
+
+    logger.debug(f"Waiting for file {file} to remain unmodified")
+    mtime = -1
+    size = -1
+    current_try = 0
+    while current_try < settings.CONSUMER_POLLING_RETRY_COUNT:
+        try:
+            stat_data = file.stat()
+            new_mtime = stat_data.st_mtime
+            new_size = stat_data.st_size
+        except FileNotFoundError:
+            logger.debug(
+                f"File {file} moved while waiting for it to remain unmodified.",
+            )
+            return
+        if new_mtime == mtime and new_size == size:
+            _consume(file)
+            return
+        mtime = new_mtime
+        size = new_size
+        sleep(settings.CONSUMER_POLLING_DELAY)
+        current_try += 1
+
+    logger.error(f"Timeout while waiting on file {file} to remain unmodified.")
+
+
+class Handler(FileSystemEventHandler):
+    def __init__(self, pool: ThreadPoolExecutor) -> None:
+        super().__init__()
+        self._pool = pool
+
+    def on_created(self, event):
+        self._pool.submit(_consume_wait_unmodified, Path(event.src_path))
+
+    def on_moved(self, event):
+        self._pool.submit(_consume_wait_unmodified, Path(event.dest_path))
 
 
 class Command(BaseCommand):
     """
-    Watch a consumption directory and queue new documents for processing.
-
-    Uses watchfiles for efficient file system monitoring. Supports both
-    native OS notifications (inotify on Linux, FSEvents on macOS) and
-    polling for network filesystems.
+    On every iteration of an infinite loop, consume what we can from the
+    consumption directory.
     """
 
-    help = "Watch the consumption directory for new documents"
-
-    # For testing - allows tests to stop the consumer
-    stop_flag: Event = Event()
-
-    # Testing timeout in seconds
+    # This is here primarily for the tests and is irrelevant in production.
+    stop_flag = Event()
+    # Also only for testing, configures in one place the timeout used before checking
+    # the stop flag
     testing_timeout_s: Final[float] = 0.5
+    testing_timeout_ms: Final[float] = testing_timeout_s * 1000.0
 
-    def add_arguments(self, parser) -> None:
+    def add_arguments(self, parser):
         parser.add_argument(
             "directory",
-            default=None,
+            default=settings.CONSUMPTION_DIR,
             nargs="?",
-            help="The consumption directory (defaults to CONSUMPTION_DIR setting)",
-        )
-        parser.add_argument(
-            "--oneshot",
-            action="store_true",
-            help="Process existing files and exit without watching",
+            help="The consumption directory.",
         )
+        parser.add_argument("--oneshot", action="store_true", help="Run only once.")
+
+        # Only use during unit testing, will configure a timeout
+        # Leaving it unset or false and the consumer will exit when it
+        # receives SIGINT
         parser.add_argument(
             "--testing",
             action="store_true",
-            help="Enable testing mode with shorter timeouts",
+            help="Flag used only for unit testing",
             default=False,
         )
 
-    def handle(self, *args, **options) -> None:
-        # Resolve consumption directory
-        directory = options.get("directory")
+    def handle(self, *args, **options):
+        directory = options["directory"]
+        recursive = settings.CONSUMER_RECURSIVE
+
         if not directory:
-            directory = getattr(settings, "CONSUMPTION_DIR", None)
-        if not directory:
-            raise CommandError("CONSUMPTION_DIR is not configured")
+            raise CommandError("CONSUMPTION_DIR does not appear to be set.")
 
         directory = Path(directory).resolve()
 
-        if not directory.exists():
-            raise CommandError(f"Consumption directory does not exist: {directory}")
-
         if not directory.is_dir():
-            raise CommandError(f"Consumption path is not a directory: {directory}")
+            raise CommandError(f"Consumption directory {directory} does not exist")
 
-        # Ensure scratch directory exists
+        # Consumer will need this
         settings.SCRATCH_DIR.mkdir(parents=True, exist_ok=True)
 
-        # Get settings
-        recursive: bool = settings.CONSUMER_RECURSIVE
-        subdirs_as_tags: bool = settings.CONSUMER_SUBDIRS_AS_TAGS
-        polling_interval: float = settings.CONSUMER_POLLING_INTERVAL
-        stability_delay: float = settings.CONSUMER_STABILITY_DELAY
-        ignore_patterns: list[str] = settings.CONSUMER_IGNORE_PATTERNS
-        ignore_dirs: list[str] = settings.CONSUMER_IGNORE_DIRS
-        is_testing: bool = options.get("testing", False)
-        is_oneshot: bool = options.get("oneshot", False)
+        if recursive:
+            for dirpath, _, filenames in os.walk(directory):
+                for filename in filenames:
+                    filepath = Path(dirpath) / filename
+                    _consume(filepath)
+        else:
+            for filepath in directory.iterdir():
+                _consume(filepath)
 
-        # Create filter
-        consumer_filter = ConsumerFilter(
-            ignore_patterns=ignore_patterns,
-            ignore_dirs=ignore_dirs,
-        )
-
-        # Process existing files
-        self._process_existing_files(
-            directory=directory,
-            recursive=recursive,
-            subdirs_as_tags=subdirs_as_tags,
-            consumer_filter=consumer_filter,
-        )
-
-        if is_oneshot:
-            logger.info("Oneshot mode: processed existing files, exiting")
+        if options["oneshot"]:
             return
 
-        # Start watching
-        self._watch_directory(
-            directory=directory,
-            recursive=recursive,
-            subdirs_as_tags=subdirs_as_tags,
-            consumer_filter=consumer_filter,
-            polling_interval=polling_interval,
-            stability_delay=stability_delay,
-            is_testing=is_testing,
-        )
-
-        logger.debug("Consumer exiting")
-
-    def _process_existing_files(
-        self,
-        *,
-        directory: Path,
-        recursive: bool,
-        subdirs_as_tags: bool,
-        consumer_filter: ConsumerFilter,
-    ) -> None:
-        """Process any existing files in the consumption directory."""
-        logger.info(f"Processing existing files in {directory}")
-
-        glob_pattern = "**/*" if recursive else "*"
-
-        for filepath in directory.glob(glob_pattern):
-            # Use filter to check if file should be processed
-            if not filepath.is_file():
-                continue
-
-            if not consumer_filter(Change.added, str(filepath)):
-                continue
-
-            _consume_file(
-                filepath=filepath,
-                consumption_dir=directory,
-                subdirs_as_tags=subdirs_as_tags,
-            )
-
-    def _watch_directory(
-        self,
-        *,
-        directory: Path,
-        recursive: bool,
-        subdirs_as_tags: bool,
-        consumer_filter: ConsumerFilter,
-        polling_interval: float,
-        stability_delay: float,
-        is_testing: bool,
-    ) -> None:
-        """Watch directory for changes and process stable files."""
-        use_polling = polling_interval > 0
-        poll_delay_ms = int(polling_interval * 1000) if use_polling else 0
-
-        if use_polling:
-            logger.info(
-                f"Watching {directory} using polling (interval: {polling_interval}s)",
-            )
+        if settings.CONSUMER_POLLING == 0 and INotify:
+            self.handle_inotify(directory, recursive, is_testing=options["testing"])
         else:
-            logger.info(f"Watching {directory} using native file system events")
+            if INotify is None and settings.CONSUMER_POLLING == 0:  # pragma: no cover
+                logger.warning("Using polling as INotify import failed")
+            self.handle_polling(directory, recursive, is_testing=options["testing"])
 
-        # Create stability tracker
-        tracker = FileStabilityTracker(stability_delay=stability_delay)
+        logger.debug("Consumer exiting.")
 
-        # Calculate timeouts
-        stability_timeout_ms = int(stability_delay * 1000)
-        testing_timeout_ms = int(self.testing_timeout_s * 1000)
+    def handle_polling(self, directory, recursive, *, is_testing: bool):
+        logger.info(f"Polling directory for changes: {directory}")
 
-        # Start with no timeout (wait indefinitely for first event)
-        # unless in testing mode
-        timeout_ms = testing_timeout_ms if is_testing else 0
+        timeout = None
+        if is_testing:
+            timeout = self.testing_timeout_s
+            logger.debug(f"Configuring timeout to {timeout}s")
 
-        self.stop_flag.clear()
+        polling_interval = settings.CONSUMER_POLLING
+        if polling_interval == 0:  # pragma: no cover
+            # Only happens if INotify failed to import
+            logger.warning("Using polling of 10s, consider setting this")
+            polling_interval = 10
 
-        while not self.stop_flag.is_set():
+        with ThreadPoolExecutor(max_workers=4) as pool:
+            observer = PollingObserver(timeout=polling_interval)
+            observer.schedule(Handler(pool), directory, recursive=recursive)
+            observer.start()
             try:
-                for changes in watch(
-                    directory,
-                    watch_filter=consumer_filter,
-                    rust_timeout=timeout_ms,
-                    yield_on_timeout=True,
-                    force_polling=use_polling,
-                    poll_delay_ms=poll_delay_ms,
-                    recursive=recursive,
-                    stop_event=self.stop_flag,
-                ):
-                    # Process each change
-                    for change_type, path in changes:
-                        path = Path(path).resolve()
-                        if not path.is_file():
+                while observer.is_alive():
+                    observer.join(timeout)
+                    if self.stop_flag.is_set():
+                        observer.stop()
+            except KeyboardInterrupt:
+                observer.stop()
+            observer.join()
+
+    def handle_inotify(self, directory, recursive, *, is_testing: bool):
+        logger.info(f"Using inotify to watch directory for changes: {directory}")
+
+        timeout_ms = None
+        if is_testing:
+            timeout_ms = self.testing_timeout_ms
+            logger.debug(f"Configuring timeout to {timeout_ms}ms")
+
+        inotify = INotify()
+        inotify_flags = flags.CLOSE_WRITE | flags.MOVED_TO | flags.MODIFY
+        if recursive:
+            inotify.add_watch_recursive(directory, inotify_flags)
+        else:
+            inotify.add_watch(directory, inotify_flags)
+
+        inotify_debounce_secs: Final[float] = settings.CONSUMER_INOTIFY_DELAY
+        inotify_debounce_ms: Final[int] = inotify_debounce_secs * 1000
+
+        finished = False
+
+        notified_files = {}
+
+        try:
+            while not finished:
+                try:
+                    for event in inotify.read(timeout=timeout_ms):
+                        path = inotify.get_path(event.wd) if recursive else directory
+                        filepath = Path(path) / event.name
+                        if flags.MODIFY in flags.from_mask(event.mask):
+                            notified_files.pop(filepath, None)
+                        else:
+                            notified_files[filepath] = monotonic()
+
+                    # Check the files against the timeout
+                    still_waiting = {}
+                    # last_event_time is time of the last inotify event for this file
+                    for filepath, last_event_time in notified_files.items():
+                        # Current time - last time over the configured timeout
+                        waited_long_enough = (
+                            monotonic() - last_event_time
+                        ) > inotify_debounce_secs
+
+                        # Also make sure the file exists still, some scanners might write a
+                        # temporary file first
+                        try:
+                            file_still_exists = filepath.exists() and filepath.is_file()
+                        except (PermissionError, OSError):  # pragma: no cover
+                            # If we can't check, let it fail in the _consume function
+                            file_still_exists = True
                             continue
-                        logger.debug(f"Event: {change_type.name} for {path}")
-                        tracker.track(path, change_type)
 
-                    # Check for stable files
-                    for stable_path in tracker.get_stable_files():
-                        _consume_file(
-                            filepath=stable_path,
-                            consumption_dir=directory,
-                            subdirs_as_tags=subdirs_as_tags,
-                        )
+                        if waited_long_enough and file_still_exists:
+                            _consume(filepath)
+                        elif file_still_exists:
+                            still_waiting[filepath] = last_event_time
 
-                    # Exit watch loop to reconfigure timeout
-                    break
+                    # These files are still waiting to hit the timeout
+                    notified_files = still_waiting
 
-                # Determine next timeout
-                if tracker.has_pending_files():
-                    # Check pending files at stability interval
-                    timeout_ms = stability_timeout_ms
-                elif is_testing:
-                    # In testing, use short timeout to check stop flag
-                    timeout_ms = testing_timeout_ms
-                else:  # pragma: nocover
-                    # No pending files, wait indefinitely
-                    timeout_ms = 0
+                    # If files are waiting, need to exit read() to check them
+                    # Otherwise, go back to infinite sleep time, but only if not testing
+                    if len(notified_files) > 0:
+                        timeout_ms = inotify_debounce_ms
+                    elif is_testing:
+                        timeout_ms = self.testing_timeout_ms
+                    else:
+                        timeout_ms = None
 
-            except KeyboardInterrupt:  # pragma: nocover
-                logger.info("Received interrupt, stopping consumer")
-                self.stop_flag.set()
+                    if self.stop_flag.is_set():
+                        logger.debug("Finishing because event is set")
+                        finished = True
+
+                except KeyboardInterrupt:
+                    logger.info("Received SIGINT, stopping inotify")
+                    finished = True
+        finally:
+            inotify.close()

src/documents/management/commands/document_exporter.py

@@ -3,6 +3,7 @@ import json
 import os
 import shutil
 import tempfile
+import time
 from pathlib import Path
 from typing import TYPE_CHECKING
 
@@ -55,6 +56,7 @@ from documents.settings import EXPORTER_FILE_NAME
 from documents.settings import EXPORTER_THUMBNAIL_NAME
 from documents.utils import copy_file_with_basic_stats
 from paperless import version
+from paperless.db import GnuPG
 from paperless.models import ApplicationConfiguration
 from paperless_mail.models import MailAccount
 from paperless_mail.models import MailRule
@@ -314,17 +316,20 @@ class Command(CryptMixin, BaseCommand):
             total=len(document_manifest),
             disable=self.no_progress_bar,
         ):
+            # 3.1. store files unencrypted
+            document_dict["fields"]["storage_type"] = Document.STORAGE_TYPE_UNENCRYPTED
+
             document = document_map[document_dict["pk"]]
 
-            # 3.1. generate a unique filename
+            # 3.2. generate a unique filename
             base_name = self.generate_base_name(document)
 
-            # 3.2. write filenames into manifest
+            # 3.3. write filenames into manifest
             original_target, thumbnail_target, archive_target = (
                 self.generate_document_targets(document, base_name, document_dict)
             )
 
-            # 3.3. write files to target folder
+            # 3.4. write files to target folder
             if not self.data_only:
                 self.copy_document_files(
                     document,
@@ -418,6 +423,7 @@ class Command(CryptMixin, BaseCommand):
                 base_name = generate_filename(
                     document,
                     counter=filename_counter,
+                    append_gpg=False,
                 )
             else:
                 base_name = document.get_public_filename(counter=filename_counter)
@@ -476,24 +482,46 @@ class Command(CryptMixin, BaseCommand):
 
         If the document is encrypted, the files are decrypted before copying them to the target location.
         """
-        self.check_and_copy(
-            document.source_path,
-            document.checksum,
-            original_target,
-        )
+        if document.storage_type == Document.STORAGE_TYPE_GPG:
+            t = int(time.mktime(document.created.timetuple()))
 
-        if thumbnail_target:
-            self.check_and_copy(document.thumbnail_path, None, thumbnail_target)
+            original_target.parent.mkdir(parents=True, exist_ok=True)
+            with document.source_file as out_file:
+                original_target.write_bytes(GnuPG.decrypted(out_file))
+                os.utime(original_target, times=(t, t))
 
-        if archive_target:
-            if TYPE_CHECKING:
-                assert isinstance(document.archive_path, Path)
+            if thumbnail_target:
+                thumbnail_target.parent.mkdir(parents=True, exist_ok=True)
+                with document.thumbnail_file as out_file:
+                    thumbnail_target.write_bytes(GnuPG.decrypted(out_file))
+                    os.utime(thumbnail_target, times=(t, t))
+
+            if archive_target:
+                archive_target.parent.mkdir(parents=True, exist_ok=True)
+                if TYPE_CHECKING:
+                    assert isinstance(document.archive_path, Path)
+                with document.archive_path as out_file:
+                    archive_target.write_bytes(GnuPG.decrypted(out_file))
+                    os.utime(archive_target, times=(t, t))
+        else:
             self.check_and_copy(
-                document.archive_path,
-                document.archive_checksum,
-                archive_target,
+                document.source_path,
+                document.checksum,
+                original_target,
             )
 
+            if thumbnail_target:
+                self.check_and_copy(document.thumbnail_path, None, thumbnail_target)
+
+            if archive_target:
+                if TYPE_CHECKING:
+                    assert isinstance(document.archive_path, Path)
+                self.check_and_copy(
+                    document.archive_path,
+                    document.archive_checksum,
+                    archive_target,
+                )
+
     def check_and_write_json(
         self,
         content: list[dict] | dict,

src/documents/management/commands/document_importer.py

@@ -383,6 +383,8 @@ class Command(CryptMixin, BaseCommand):
             else:
                 archive_path = None
 
+            document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
+
             with FileLock(settings.MEDIA_LOCK):
                 if Path(document.source_path).is_file():
                     raise FileExistsError(document.source_path)

src/documents/migrations/1003_mime_types.py

@@ -1,8 +1,51 @@
 # Generated by Django 3.1.3 on 2020-11-20 11:21
+from pathlib import Path
 
+import magic
+from django.conf import settings
 from django.db import migrations
 from django.db import models
 
+from paperless.db import GnuPG
+
+STORAGE_TYPE_UNENCRYPTED = "unencrypted"
+STORAGE_TYPE_GPG = "gpg"
+
+
+def source_path(self) -> Path:
+    if self.filename:
+        fname: str = str(self.filename)
+    else:
+        fname = f"{self.pk:07}.{self.file_type}"
+        if self.storage_type == STORAGE_TYPE_GPG:
+            fname += ".gpg"
+
+    return Path(settings.ORIGINALS_DIR) / fname
+
+
+def add_mime_types(apps, schema_editor):
+    Document = apps.get_model("documents", "Document")
+    documents = Document.objects.all()
+
+    for d in documents:
+        with Path(source_path(d)).open("rb") as f:
+            if d.storage_type == STORAGE_TYPE_GPG:
+                data = GnuPG.decrypted(f)
+            else:
+                data = f.read(1024)
+
+        d.mime_type = magic.from_buffer(data, mime=True)
+        d.save()
+
+
+def add_file_extensions(apps, schema_editor):
+    Document = apps.get_model("documents", "Document")
+    documents = Document.objects.all()
+
+    for d in documents:
+        d.file_type = Path(d.filename).suffix.lstrip(".")
+        d.save()
+
 
 class Migration(migrations.Migration):
     dependencies = [
@@ -16,7 +59,7 @@ class Migration(migrations.Migration):
             field=models.CharField(default="-", editable=False, max_length=256),
             preserve_default=False,
         ),
-        migrations.RunPython(migrations.RunPython.noop, migrations.RunPython.noop),
+        migrations.RunPython(add_mime_types, migrations.RunPython.noop),
         # This operation is here so that we can revert the entire migration:
         # By allowing this field to be blank and null, we can revert the
         # remove operation further down and the database won't complain about
@@ -41,7 +84,7 @@ class Migration(migrations.Migration):
                 blank=True,
             ),
         ),
-        migrations.RunPython(migrations.RunPython.noop, migrations.RunPython.noop),
+        migrations.RunPython(migrations.RunPython.noop, add_file_extensions),
         migrations.RemoveField(
             model_name="document",
             name="file_type",

src/documents/migrations/1077_remove_document_storage_type.py

@@ -1,16 +0,0 @@
-# Generated by Django 5.2.9 on 2026-01-21 22:16
-
-from django.db import migrations
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("documents", "1076_alter_paperlesstask_task_name"),
-    ]
-
-    operations = [
-        migrations.RemoveField(
-            model_name="document",
-            name="storage_type",
-        ),
-    ]

src/documents/models.py

@@ -154,6 +154,13 @@ class StoragePath(MatchingModel):
 
 
 class Document(SoftDeleteModel, ModelWithOwner):
+    STORAGE_TYPE_UNENCRYPTED = "unencrypted"
+    STORAGE_TYPE_GPG = "gpg"
+    STORAGE_TYPES = (
+        (STORAGE_TYPE_UNENCRYPTED, _("Unencrypted")),
+        (STORAGE_TYPE_GPG, _("Encrypted with GNU Privacy Guard")),
+    )
+
     correspondent = models.ForeignKey(
         Correspondent,
         blank=True,
@@ -243,6 +250,14 @@ class Document(SoftDeleteModel, ModelWithOwner):
         db_index=True,
     )
 
+    storage_type = models.CharField(
+        _("storage type"),
+        max_length=11,
+        choices=STORAGE_TYPES,
+        default=STORAGE_TYPE_UNENCRYPTED,
+        editable=False,
+    )
+
     added = models.DateTimeField(
         _("added"),
         default=timezone.now,
@@ -338,7 +353,12 @@ class Document(SoftDeleteModel, ModelWithOwner):
 
     @property
     def source_path(self) -> Path:
-        fname = str(self.filename) if self.filename else f"{self.pk:07}{self.file_type}"
+        if self.filename:
+            fname = str(self.filename)
+        else:
+            fname = f"{self.pk:07}{self.file_type}"
+            if self.storage_type == self.STORAGE_TYPE_GPG:
+                fname += ".gpg"  # pragma: no cover
 
         return (settings.ORIGINALS_DIR / Path(fname)).resolve()
 
@@ -387,6 +407,8 @@ class Document(SoftDeleteModel, ModelWithOwner):
     @property
     def thumbnail_path(self) -> Path:
         webp_file_name = f"{self.pk:07}.webp"
+        if self.storage_type == self.STORAGE_TYPE_GPG:
+            webp_file_name += ".gpg"
 
         webp_file_path = settings.THUMBNAIL_DIR / Path(webp_file_name)
 

src/documents/templating/filepath.py

@@ -108,6 +108,7 @@ def create_dummy_document():
         page_count=5,
         created=timezone.now(),
         modified=timezone.now(),
+        storage_type=Document.STORAGE_TYPE_UNENCRYPTED,
         added=timezone.now(),
         filename="/dummy/filename.pdf",
         archive_filename="/dummy/archive_filename.pdf",

src/documents/tests/test_checks.py

@@ -1,3 +1,4 @@
+import textwrap
 from unittest import mock
 
 from django.core.checks import Error
@@ -5,11 +6,60 @@ from django.core.checks import Warning
 from django.test import TestCase
 from django.test import override_settings
 
+from documents.checks import changed_password_check
 from documents.checks import filename_format_check
 from documents.checks import parser_check
+from documents.models import Document
+from documents.tests.factories import DocumentFactory
 
 
 class TestDocumentChecks(TestCase):
+    def test_changed_password_check_empty_db(self):
+        self.assertListEqual(changed_password_check(None), [])
+
+    def test_changed_password_check_no_encryption(self):
+        DocumentFactory.create(storage_type=Document.STORAGE_TYPE_UNENCRYPTED)
+        self.assertListEqual(changed_password_check(None), [])
+
+    def test_encrypted_missing_passphrase(self):
+        DocumentFactory.create(storage_type=Document.STORAGE_TYPE_GPG)
+        msgs = changed_password_check(None)
+        self.assertEqual(len(msgs), 1)
+        msg_text = msgs[0].msg
+        self.assertEqual(
+            msg_text,
+            "The database contains encrypted documents but no password is set.",
+        )
+
+    @override_settings(
+        PASSPHRASE="test",
+    )
+    @mock.patch("paperless.db.GnuPG.decrypted")
+    @mock.patch("documents.models.Document.source_file")
+    def test_encrypted_decrypt_fails(self, mock_decrypted, mock_source_file):
+        mock_decrypted.return_value = None
+        mock_source_file.return_value = b""
+
+        DocumentFactory.create(storage_type=Document.STORAGE_TYPE_GPG)
+
+        msgs = changed_password_check(None)
+
+        self.assertEqual(len(msgs), 1)
+        msg_text = msgs[0].msg
+        self.assertEqual(
+            msg_text,
+            textwrap.dedent(
+                """
+                The current password doesn't match the password of the
+                existing documents.
+
+                If you intend to change your password, you must first export
+                all of the old documents, start fresh with the new password
+                and then re-import them."
+                """,
+            ),
+        )
+
     def test_parser_check(self):
         self.assertEqual(parser_check(None), [])
 

src/documents/tests/test_file_handling.py

@@ -34,14 +34,22 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_generate_source_filename(self):
         document = Document()
         document.mime_type = "application/pdf"
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         self.assertEqual(generate_filename(document), Path(f"{document.pk:07d}.pdf"))
 
+        document.storage_type = Document.STORAGE_TYPE_GPG
+        self.assertEqual(
+            generate_filename(document),
+            Path(f"{document.pk:07d}.pdf.gpg"),
+        )
+
     @override_settings(FILENAME_FORMAT="{correspondent}/{correspondent}")
     def test_file_renaming(self):
         document = Document()
         document.mime_type = "application/pdf"
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Test default source_path
@@ -55,6 +63,11 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         # Ensure that filename is properly generated
         self.assertEqual(document.filename, Path("none/none.pdf"))
 
+        # Enable encryption and check again
+        document.storage_type = Document.STORAGE_TYPE_GPG
+        document.filename = generate_filename(document)
+        self.assertEqual(document.filename, Path("none/none.pdf.gpg"))
+
         document.save()
 
         # test that creating dirs for the source_path creates the correct directory
@@ -74,14 +87,14 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
             settings.ORIGINALS_DIR / "none",
         )
         self.assertIsFile(
-            settings.ORIGINALS_DIR / "test" / "test.pdf",
+            settings.ORIGINALS_DIR / "test" / "test.pdf.gpg",
         )
 
     @override_settings(FILENAME_FORMAT="{correspondent}/{correspondent}")
     def test_file_renaming_missing_permissions(self):
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -115,13 +128,14 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_file_renaming_database_error(self):
         Document.objects.create(
             mime_type="application/pdf",
+            storage_type=Document.STORAGE_TYPE_UNENCRYPTED,
             checksum="AAAAA",
         )
 
         document = Document()
         document.mime_type = "application/pdf"
         document.checksum = "BBBBB"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -156,7 +170,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_document_delete(self):
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -182,7 +196,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_document_delete_trash_dir(self):
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -207,7 +221,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         # Create an identical document and ensure it is trashed under a new name
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
         document.filename = generate_filename(document)
         document.save()
@@ -221,7 +235,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_document_delete_nofile(self):
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         document.delete()
@@ -231,7 +245,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_directory_not_empty(self):
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -348,7 +362,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
     def test_nested_directory_cleanup(self):
         document = Document()
         document.mime_type = "application/pdf"
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -376,6 +390,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         document = Document()
         document.pk = 1
         document.mime_type = "application/pdf"
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
 
         self.assertEqual(generate_filename(document), Path("0000001.pdf"))
 
@@ -388,6 +403,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         document = Document()
         document.pk = 1
         document.mime_type = "application/pdf"
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
 
         self.assertEqual(generate_filename(document), Path("0000001.pdf"))
 
@@ -413,6 +429,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         document = Document()
         document.pk = 1
         document.mime_type = "application/pdf"
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
 
         self.assertEqual(generate_filename(document), Path("0000001.pdf"))
 
@@ -421,6 +438,7 @@ class TestFileHandling(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         document = Document()
         document.pk = 1
         document.mime_type = "application/pdf"
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
 
         self.assertEqual(generate_filename(document), Path("0000001.pdf"))
 
@@ -1240,7 +1258,7 @@ class TestFilenameGeneration(DirectoriesMixin, TestCase):
             title="doc1",
             mime_type="application/pdf",
         )
-
+        document.storage_type = Document.STORAGE_TYPE_UNENCRYPTED
         document.save()
 
         # Ensure that filename is properly generated
@@ -1714,6 +1732,7 @@ class TestPathDateLocalization:
         document = DocumentFactory.create(
             title="My Document",
             mime_type="application/pdf",
+            storage_type=Document.STORAGE_TYPE_UNENCRYPTED,
             created=self.TEST_DATE,  # 2023-10-26 (which is a Thursday)
         )
         with override_settings(FILENAME_FORMAT=filename_format):

src/documents/tests/test_management.py

@@ -1,5 +1,7 @@
 import filecmp
+import hashlib
 import shutil
+import tempfile
 from io import StringIO
 from pathlib import Path
 from unittest import mock
@@ -94,6 +96,66 @@ class TestArchiver(DirectoriesMixin, FileSystemAssertsMixin, TestCase):
         self.assertEqual(doc2.archive_filename, "document_01.pdf")
 
 
+class TestDecryptDocuments(FileSystemAssertsMixin, TestCase):
+    @mock.patch("documents.management.commands.decrypt_documents.input")
+    def test_decrypt(self, m):
+        media_dir = tempfile.mkdtemp()
+        originals_dir = Path(media_dir) / "documents" / "originals"
+        thumb_dir = Path(media_dir) / "documents" / "thumbnails"
+        originals_dir.mkdir(parents=True, exist_ok=True)
+        thumb_dir.mkdir(parents=True, exist_ok=True)
+
+        with override_settings(
+            ORIGINALS_DIR=originals_dir,
+            THUMBNAIL_DIR=thumb_dir,
+            PASSPHRASE="test",
+            FILENAME_FORMAT=None,
+        ):
+            doc = Document.objects.create(
+                checksum="82186aaa94f0b98697d704b90fd1c072",
+                title="wow",
+                filename="0000004.pdf.gpg",
+                mime_type="application/pdf",
+                storage_type=Document.STORAGE_TYPE_GPG,
+            )
+
+            shutil.copy(
+                (
+                    Path(__file__).parent
+                    / "samples"
+                    / "documents"
+                    / "originals"
+                    / "0000004.pdf.gpg"
+                ),
+                originals_dir / "0000004.pdf.gpg",
+            )
+            shutil.copy(
+                (
+                    Path(__file__).parent
+                    / "samples"
+                    / "documents"
+                    / "thumbnails"
+                    / "0000004.webp.gpg"
+                ),
+                thumb_dir / f"{doc.id:07}.webp.gpg",
+            )
+
+            call_command("decrypt_documents")
+
+            doc.refresh_from_db()
+
+            self.assertEqual(doc.storage_type, Document.STORAGE_TYPE_UNENCRYPTED)
+            self.assertEqual(doc.filename, "0000004.pdf")
+            self.assertIsFile(Path(originals_dir) / "0000004.pdf")
+            self.assertIsFile(doc.source_path)
+            self.assertIsFile(Path(thumb_dir) / f"{doc.id:07}.webp")
+            self.assertIsFile(doc.thumbnail_path)
+
+            with doc.source_file as f:
+                checksum: str = hashlib.md5(f.read()).hexdigest()
+                self.assertEqual(checksum, doc.checksum)
+
+
 class TestMakeIndex(TestCase):
     @mock.patch("documents.management.commands.document_index.index_reindex")
     def test_reindex(self, m):

src/documents/tests/test_management_exporter.py

@@ -86,8 +86,9 @@ class TestExportImport(
             content="Content",
             checksum="82186aaa94f0b98697d704b90fd1c072",
             title="wow_dec",
-            filename="0000004.pdf",
+            filename="0000004.pdf.gpg",
             mime_type="application/pdf",
+            storage_type=Document.STORAGE_TYPE_GPG,
         )
 
         self.note = Note.objects.create(
@@ -241,6 +242,11 @@ class TestExportImport(
                     checksum = hashlib.md5(f.read()).hexdigest()
                 self.assertEqual(checksum, element["fields"]["checksum"])
 
+                self.assertEqual(
+                    element["fields"]["storage_type"],
+                    Document.STORAGE_TYPE_UNENCRYPTED,
+                )
+
                 if document_exporter.EXPORTER_ARCHIVE_NAME in element:
                     fname = (
                         self.target / element[document_exporter.EXPORTER_ARCHIVE_NAME]
@@ -430,7 +436,7 @@ class TestExportImport(
         Document.objects.create(
             checksum="AAAAAAAAAAAAAAAAA",
             title="wow",
-            filename="0000010.pdf",
+            filename="0000004.pdf",
             mime_type="application/pdf",
         )
         self.assertRaises(FileNotFoundError, call_command, "document_exporter", target)

src/documents/tests/test_migration_mime_type.py

@@ -8,6 +8,7 @@ from documents.parsers import get_default_file_extension
 from documents.tests.utils import DirectoriesMixin
 from documents.tests.utils import TestMigrations
 
+STORAGE_TYPE_UNENCRYPTED = "unencrypted"
 STORAGE_TYPE_GPG = "gpg"
 
 

src/documents/views.py

@@ -195,6 +195,7 @@ from paperless import version
 from paperless.celery import app as celery_app
 from paperless.config import AIConfig
 from paperless.config import GeneralConfig
+from paperless.db import GnuPG
 from paperless.models import ApplicationConfiguration
 from paperless.serialisers import GroupSerializer
 from paperless.serialisers import UserSerializer
@@ -1070,8 +1071,10 @@ class DocumentViewSet(
                 doc,
             ):
                 return HttpResponseForbidden("Insufficient permissions")
-
-            handle = doc.thumbnail_file
+            if doc.storage_type == Document.STORAGE_TYPE_GPG:
+                handle = GnuPG.decrypted(doc.thumbnail_file)
+            else:
+                handle = doc.thumbnail_file
 
             return HttpResponse(handle, content_type="image/webp")
         except (FileNotFoundError, Document.DoesNotExist):
@@ -2821,6 +2824,9 @@ def serve_file(*, doc: Document, use_archive: bool, disposition: str):
         if mime_type in {"application/csv", "text/csv"} and disposition == "inline":
             mime_type = "text/plain"
 
+    if doc.storage_type == Document.STORAGE_TYPE_GPG:
+        file_handle = GnuPG.decrypted(file_handle)
+
     response = HttpResponse(file_handle, content_type=mime_type)
     # Firefox is not able to handle unicode characters in filename field
     # RFC 5987 addresses this issue

src/manage_migration.py

@@ -0,0 +1,13 @@
+#!/usr/bin/env python3
+import os
+import sys
+
+if __name__ == "__main__":
+    os.environ.setdefault(
+        "DJANGO_SETTINGS_MODULE",
+        "paperless_migration.settings",
+    )
+
+    from django.core.management import execute_from_command_line
+
+    execute_from_command_line(sys.argv)

src/paperless/db.py

@@ -0,0 +1,17 @@
+import gnupg
+from django.conf import settings
+
+
+class GnuPG:
+    """
+    A handy singleton to use when handling encrypted files.
+    """
+
+    gpg = gnupg.GPG(gnupghome=settings.GNUPG_HOME)
+
+    @classmethod
+    def decrypted(cls, file_handle, passphrase=None):
+        if not passphrase:
+            passphrase = settings.PASSPHRASE
+
+        return cls.gpg.decrypt_file(file_handle, passphrase=passphrase).data

src/paperless/migration_asgi.py

@@ -0,0 +1,7 @@
+import os
+
+from django.core.asgi import get_asgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "paperless_migration.settings")
+
+application = get_asgi_application()

src/paperless/settings.py

@@ -1044,30 +1044,29 @@ IGNORABLE_FILES: Final[list[str]] = [
     "Thumbs.db",
 ]
 
-CONSUMER_POLLING_INTERVAL = float(os.getenv("PAPERLESS_CONSUMER_POLLING_INTERVAL", 0))
+CONSUMER_POLLING = int(os.getenv("PAPERLESS_CONSUMER_POLLING", 0))
 
-CONSUMER_STABILITY_DELAY = float(os.getenv("PAPERLESS_CONSUMER_STABILITY_DELAY", 5))
+CONSUMER_POLLING_DELAY = int(os.getenv("PAPERLESS_CONSUMER_POLLING_DELAY", 5))
+
+CONSUMER_POLLING_RETRY_COUNT = int(
+    os.getenv("PAPERLESS_CONSUMER_POLLING_RETRY_COUNT", 5),
+)
+
+CONSUMER_INOTIFY_DELAY: Final[float] = __get_float(
+    "PAPERLESS_CONSUMER_INOTIFY_DELAY",
+    0.5,
+)
 
 CONSUMER_DELETE_DUPLICATES = __get_boolean("PAPERLESS_CONSUMER_DELETE_DUPLICATES")
 
 CONSUMER_RECURSIVE = __get_boolean("PAPERLESS_CONSUMER_RECURSIVE")
 
-# Ignore regex patterns, matched against filename only
+# Ignore glob patterns, relative to PAPERLESS_CONSUMPTION_DIR
 CONSUMER_IGNORE_PATTERNS = list(
     json.loads(
         os.getenv(
             "PAPERLESS_CONSUMER_IGNORE_PATTERNS",
-            json.dumps([]),
-        ),
-    ),
-)
-
-# Directories to always ignore.  These are matched by directory name, not full path
-CONSUMER_IGNORE_DIRS = list(
-    json.loads(
-        os.getenv(
-            "PAPERLESS_CONSUMER_IGNORE_DIRS",
-            json.dumps([]),
+            json.dumps(IGNORABLE_FILES),
         ),
     ),
 )
@@ -1203,6 +1202,19 @@ EMAIL_PARSE_DEFAULT_LAYOUT = __get_int(
     1,  # MailRule.PdfLayout.TEXT_HTML but that can't be imported here
 )
 
+# Pre-2.x versions of Paperless stored your documents locally with GPG
+# encryption, but that is no longer the default.  This behaviour is still
+# available, but it must be explicitly enabled by setting
+# `PAPERLESS_PASSPHRASE` in your environment or config file.  The default is to
+# store these files unencrypted.
+#
+# Translation:
+# * If you're a new user, you can safely ignore this setting.
+# * If you're upgrading from 1.x, this must be set, OR you can run
+#   `./manage.py change_storage_type gpg unencrypted` to decrypt your files,
+#   after which you can unset this value.
+PASSPHRASE = os.getenv("PAPERLESS_PASSPHRASE")
+
 # Trigger a script after every successful document consumption?
 PRE_CONSUME_SCRIPT = os.getenv("PAPERLESS_PRE_CONSUME_SCRIPT")
 POST_CONSUME_SCRIPT = os.getenv("PAPERLESS_POST_CONSUME_SCRIPT")

src/paperless_migration/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class PaperlessMigrationConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "paperless_migration"

src/paperless_migration/settings.py

@@ -0,0 +1,193 @@
+"""Settings for migration-mode Django instance."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Any
+
+from dotenv import load_dotenv
+
+BASE_DIR = Path(__file__).resolve().parent.parent
+
+DEBUG = False
+
+ALLOWED_HOSTS = ["*"]
+
+# Tap paperless.conf if it's available
+for path in [
+    os.getenv("PAPERLESS_CONFIGURATION_PATH"),
+    "../paperless.conf",
+    "/etc/paperless.conf",
+    "/usr/local/etc/paperless.conf",
+]:
+    if path and Path(path).exists():
+        load_dotenv(path)
+        break
+
+
+def __get_path(
+    key: str,
+    default: str | Path,
+) -> Path:
+    if key in os.environ:
+        return Path(os.environ[key]).resolve()
+    return Path(default).resolve()
+
+
+DATA_DIR = __get_path("PAPERLESS_DATA_DIR", BASE_DIR.parent / "data")
+
+
+def _parse_db_settings() -> dict[str, dict[str, Any]]:
+    databases: dict[str, dict[str, Any]] = {
+        "default": {
+            "ENGINE": "django.db.backends.sqlite3",
+            "NAME": DATA_DIR / "db.sqlite3",
+            "OPTIONS": {},
+        },
+    }
+    if os.getenv("PAPERLESS_DBHOST"):
+        databases["sqlite"] = databases["default"].copy()
+        databases["default"] = {
+            "HOST": os.getenv("PAPERLESS_DBHOST"),
+            "NAME": os.getenv("PAPERLESS_DBNAME", "paperless"),
+            "USER": os.getenv("PAPERLESS_DBUSER", "paperless"),
+            "PASSWORD": os.getenv("PAPERLESS_DBPASS", "paperless"),
+            "OPTIONS": {},
+        }
+        if os.getenv("PAPERLESS_DBPORT"):
+            databases["default"]["PORT"] = os.getenv("PAPERLESS_DBPORT")
+
+        if os.getenv("PAPERLESS_DBENGINE") == "mariadb":
+            engine = "django.db.backends.mysql"
+            options = {
+                "read_default_file": "/etc/mysql/my.cnf",
+                "charset": "utf8mb4",
+                "ssl_mode": os.getenv("PAPERLESS_DBSSLMODE", "PREFERRED"),
+                "ssl": {
+                    "ca": os.getenv("PAPERLESS_DBSSLROOTCERT"),
+                    "cert": os.getenv("PAPERLESS_DBSSLCERT"),
+                    "key": os.getenv("PAPERLESS_DBSSLKEY"),
+                },
+            }
+        else:
+            engine = "django.db.backends.postgresql"
+            options = {
+                "sslmode": os.getenv("PAPERLESS_DBSSLMODE", "prefer"),
+                "sslrootcert": os.getenv("PAPERLESS_DBSSLROOTCERT"),
+                "sslcert": os.getenv("PAPERLESS_DBSSLCERT"),
+                "sslkey": os.getenv("PAPERLESS_DBSSLKEY"),
+            }
+
+        databases["default"]["ENGINE"] = engine
+        databases["default"]["OPTIONS"].update(options)
+
+    if os.getenv("PAPERLESS_DB_TIMEOUT") is not None:
+        timeout = int(os.getenv("PAPERLESS_DB_TIMEOUT"))
+        if databases["default"]["ENGINE"] == "django.db.backends.sqlite3":
+            databases["default"]["OPTIONS"].update({"timeout": timeout})
+        else:
+            databases["default"]["OPTIONS"].update({"connect_timeout": timeout})
+            databases["sqlite"]["OPTIONS"].update({"timeout": timeout})
+    return databases
+
+
+DATABASES = _parse_db_settings()
+
+SECRET_KEY = os.getenv(
+    "PAPERLESS_SECRET_KEY",
+    "e11fl1oa-*ytql8p)(06fbj4ukrlo+n7k&q5+$1md7i+mge=ee",
+)
+
+AUTH_PASSWORD_VALIDATORS = [
+    {
+        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
+    },
+    {
+        "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
+    },
+]
+
+LANGUAGE_CODE = "en-us"
+TIME_ZONE = "UTC"
+USE_I18N = True
+USE_TZ = True
+CSRF_TRUSTED_ORIGINS: list[str] = []
+
+INSTALLED_APPS = [
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    "allauth",
+    "allauth.account",
+    "allauth.socialaccount",
+    "allauth.mfa",
+    "paperless_migration",
+]
+
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+    "django.middleware.clickjacking.XFrameOptionsMiddleware",
+    "allauth.account.middleware.AccountMiddleware",
+]
+
+ROOT_URLCONF = "paperless_migration.urls"
+
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "DIRS": [],
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ],
+        },
+    },
+]
+
+WSGI_APPLICATION = "paperless_migration.wsgi.application"
+
+AUTHENTICATION_BACKENDS = [
+    "django.contrib.auth.backends.ModelBackend",
+    "allauth.account.auth_backends.AuthenticationBackend",
+]
+
+STATIC_URL = "/static/"
+
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+
+LOGIN_URL = "/accounts/login/"
+LOGIN_REDIRECT_URL = "/migration/"
+LOGOUT_REDIRECT_URL = "/accounts/login/?loggedout=1"
+
+ACCOUNT_ADAPTER = "allauth.account.adapter.DefaultAccountAdapter"
+ACCOUNT_AUTHENTICATED_LOGIN_REDIRECTS = False
+SOCIALACCOUNT_ADAPTER = "allauth.socialaccount.adapter.DefaultSocialAccountAdapter"
+SOCIALACCOUNT_ENABLED = False
+
+SESSION_ENGINE = "django.contrib.sessions.backends.db"
+
+MIGRATION_EXPORT_PATH = os.getenv(
+    "PAPERLESS_MIGRATION_EXPORT_PATH",
+    "/data/export.json",
+)
+MIGRATION_TRANSFORMED_PATH = os.getenv(
+    "PAPERLESS_MIGRATION_TRANSFORMED_PATH",
+    "/data/export.v3.json",
+)

src/paperless_migration/templates/paperless_migration/migration_home.html

@@ -0,0 +1,61 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Paperless-ngx Migration Mode</title>
+  </head>
+  <body>
+    <main>
+      <h1>Migration Mode</h1>
+      <p>
+        This instance is running in migration mode. Use this interface to run
+        the v2 → v3 migration.
+      </p>
+      {% if messages %}
+        <ul>
+          {% for message in messages %}
+            <li>{{ message }}</li>
+          {% endfor %}
+        </ul>
+      {% endif %}
+      <section>
+        <h2>Step 1 — Export (v2)</h2>
+        <p>Expected export file:</p>
+        <ul>
+          <li><strong>Path:</strong> {{ export_path }}</li>
+          <li><strong>Status:</strong> {{ export_exists|yesno:"Found,Missing" }}</li>
+        </ul>
+        <form method="post">
+          {% csrf_token %}
+          <button type="submit" name="action" value="check">
+            Re-check export
+          </button>
+        </form>
+      </section>
+      <section>
+        <h2>Step 2 — Transform</h2>
+        <p>Expected transformed file:</p>
+        <ul>
+          <li><strong>Path:</strong> {{ transformed_path }}</li>
+          <li><strong>Status:</strong> {{ transformed_exists|yesno:"Found,Missing" }}</li>
+        </ul>
+        <form method="post">
+          {% csrf_token %}
+          <button type="submit" name="action" value="transform">
+            Transform export
+          </button>
+        </form>
+      </section>
+      <section>
+        <h2>Step 3 — Import (v3)</h2>
+        <form method="post">
+          {% csrf_token %}
+          <button type="submit" name="action" value="import">
+            Import transformed data
+          </button>
+        </form>
+      </section>
+    </main>
+  </body>
+</html>

src/paperless_migration/urls.py

@@ -0,0 +1,9 @@
+from django.urls import include
+from django.urls import path
+
+from paperless_migration import views
+
+urlpatterns = [
+    path("accounts/", include("allauth.urls")),
+    path("migration/", views.migration_home, name="migration_home"),
+]

src/paperless_migration/views.py

@@ -0,0 +1,46 @@
+from pathlib import Path
+
+from django.contrib import messages
+from django.contrib.auth.decorators import login_required
+from django.http import HttpResponseForbidden
+from django.shortcuts import redirect
+from django.shortcuts import render
+from django.views.decorators.http import require_http_methods
+
+from paperless_migration import settings
+
+
+@login_required
+@require_http_methods(["GET", "POST"])
+def migration_home(request):
+    if not request.user.is_superuser:
+        return HttpResponseForbidden("Superuser access required")
+
+    export_path = Path(settings.MIGRATION_EXPORT_PATH)
+    transformed_path = Path(settings.MIGRATION_TRANSFORMED_PATH)
+
+    if request.method == "POST":
+        action = request.POST.get("action")
+        if action == "check":
+            messages.success(request, "Checked export paths.")
+        elif action == "transform":
+            messages.info(
+                request,
+                "Transform step is not implemented yet.",
+            )
+        elif action == "import":
+            messages.info(
+                request,
+                "Import step is not implemented yet.",
+            )
+        else:
+            messages.error(request, "Unknown action.")
+        return redirect("migration_home")
+
+    context = {
+        "export_path": export_path,
+        "export_exists": export_path.exists(),
+        "transformed_path": transformed_path,
+        "transformed_exists": transformed_path.exists(),
+    }
+    return render(request, "paperless_migration/migration_home.html", context)

src/paperless_migration/wsgi.py

@@ -0,0 +1,7 @@
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "paperless_migration.settings")
+
+application = get_wsgi_application()

uv.lock

@@ -1842,6 +1842,26 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2c/e1/e6716421ea10d38022b952c159d5161ca1193197fb744506875fbb87ea7b/iniconfig-2.1.0-py3-none-any.whl", hash = "sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760", size = 6050, upload-time = "2025-03-19T20:10:01.071Z" },
 ]
 
+[[package]]
+name = "inotify-simple"
+version = "2.0.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/5c/bfe40e15d684bc30b0073aa97c39be410a5fbef3d33cad6f0bf2012571e0/inotify_simple-2.0.1.tar.gz", hash = "sha256:f010bbbd8283bd71a9f4eb2de94765804ede24bd47320b0e6ef4136e541cdc2c", size = 7101, upload-time = "2025-08-25T06:28:20.998Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e3/86/8be1ac7e90f80b413e81f1e235148e8db771218886a2353392f02da01be3/inotify_simple-2.0.1-py3-none-any.whl", hash = "sha256:e5da495f2064889f8e68b67f9358b0d102e03b783c2d42e5b8e132ab859a5d8a", size = 7449, upload-time = "2025-08-25T06:28:19.919Z" },
+]
+
+[[package]]
+name = "inotifyrecursive"
+version = "0.3.5"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "inotify-simple", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/19/3a/9ed038cb750a3ba8090869cf3ad50f5628077a936d911aee14ca83e40f6a/inotifyrecursive-0.3.5.tar.gz", hash = "sha256:a2c450b317693e4538416f90eb1d7858506dafe6b8b885037bd2dd9ae2dafa1e", size = 4576, upload-time = "2020-11-20T12:38:48.035Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/fc/4e5a141c3f7c7bed550ac1f69e599e92b6be449dd4677ec09f325cad0955/inotifyrecursive-0.3.5-py3-none-any.whl", hash = "sha256:7e5f4a2e1dc2bef0efa3b5f6b339c41fb4599055a2b54909d020e9e932cc8d2f", size = 8009, upload-time = "2020-11-20T12:38:46.981Z" },
+]
 
 [[package]]
 name = "isodate"
@@ -2949,6 +2969,7 @@ dependencies = [
     { name = "gotenberg-client", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "httpx-oauth", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "imap-tools", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
+    { name = "inotifyrecursive", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "jinja2", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "langdetect", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "llama-index-core", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
@@ -2978,7 +2999,7 @@ dependencies = [
     { name = "torch", version = "2.9.1", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'darwin'" },
     { name = "torch", version = "2.9.1+cpu", source = { registry = "https://download.pytorch.org/whl/cpu" }, marker = "sys_platform == 'linux'" },
     { name = "tqdm", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
-    { name = "watchfiles", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
+    { name = "watchdog", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "whitenoise", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "whoosh-reloaded", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
     { name = "zxing-cpp", version = "2.3.0", source = { registry = "https://pypi.org/simple" }, marker = "(python_full_version != '3.12.*' and platform_machine == 'aarch64' and sys_platform == 'linux') or (python_full_version != '3.12.*' and platform_machine == 'x86_64' and sys_platform == 'linux') or (platform_machine != 'aarch64' and platform_machine != 'x86_64' and sys_platform == 'linux') or sys_platform == 'darwin'" },
@@ -3098,6 +3119,7 @@ requires-dist = [
     { name = "granian", extras = ["uvloop"], marker = "extra == 'webserver'", specifier = "~=2.5.1" },
     { name = "httpx-oauth", specifier = "~=0.16" },
     { name = "imap-tools", specifier = "~=1.11.0" },
+    { name = "inotifyrecursive", specifier = "~=0.3" },
     { name = "jinja2", specifier = "~=3.1.5" },
     { name = "langdetect", specifier = "~=1.0.9" },
     { name = "llama-index-core", specifier = ">=0.14.12" },
@@ -3132,7 +3154,7 @@ requires-dist = [
     { name = "tika-client", specifier = "~=0.10.0" },
     { name = "torch", specifier = "~=2.9.1", index = "https://download.pytorch.org/whl/cpu" },
     { name = "tqdm", specifier = "~=4.67.1" },
-    { name = "watchfiles", specifier = ">=1.1.1" },
+    { name = "watchdog", specifier = "~=6.0" },
     { name = "whitenoise", specifier = "~=6.9" },
     { name = "whoosh-reloaded", specifier = ">=2.7.5" },
     { name = "zxing-cpp", marker = "(python_full_version != '3.12.*' and platform_machine == 'aarch64') or (python_full_version != '3.12.*' and platform_machine == 'x86_64') or (platform_machine != 'aarch64' and platform_machine != 'x86_64') or sys_platform != 'linux'", specifier = "~=2.3.0" },
@@ -5578,95 +5600,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b5/e8/dbf020b4d98251a9860752a094d09a65e1b436ad181faf929983f697048f/watchdog-6.0.0-py3-none-manylinux2014_x86_64.whl", hash = "sha256:20ffe5b202af80ab4266dcd3e91aae72bf2da48c0d33bdb15c66658e685e94e2", size = 79078, upload-time = "2024-11-01T14:07:07.547Z" },
 ]
 
-[[package]]
-name = "watchfiles"
-version = "1.1.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "anyio", marker = "sys_platform == 'darwin' or sys_platform == 'linux'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/c2/c9/8869df9b2a2d6c59d79220a4db37679e74f807c559ffe5265e08b227a210/watchfiles-1.1.1.tar.gz", hash = "sha256:a173cb5c16c4f40ab19cecf48a534c409f7ea983ab8fed0741304a1c0a31b3f2", size = 94440, upload-time = "2025-10-14T15:06:21.08Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/a7/1a/206e8cf2dd86fddf939165a57b4df61607a1e0add2785f170a3f616b7d9f/watchfiles-1.1.1-cp310-cp310-macosx_10_12_x86_64.whl", hash = "sha256:eef58232d32daf2ac67f42dea51a2c80f0d03379075d44a587051e63cc2e368c", size = 407318, upload-time = "2025-10-14T15:04:18.753Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/0f/abaf5262b9c496b5dad4ed3c0e799cbecb1f8ea512ecb6ddd46646a9fca3/watchfiles-1.1.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:03fa0f5237118a0c5e496185cafa92878568b652a2e9a9382a5151b1a0380a43", size = 394478, upload-time = "2025-10-14T15:04:20.297Z" },
-    { url = "https://files.pythonhosted.org/packages/b1/04/9cc0ba88697b34b755371f5ace8d3a4d9a15719c07bdc7bd13d7d8c6a341/watchfiles-1.1.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8ca65483439f9c791897f7db49202301deb6e15fe9f8fe2fed555bf986d10c31", size = 449894, upload-time = "2025-10-14T15:04:21.527Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/9c/eda4615863cd8621e89aed4df680d8c3ec3da6a4cf1da113c17decd87c7f/watchfiles-1.1.1-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f0ab1c1af0cb38e3f598244c17919fb1a84d1629cc08355b0074b6d7f53138ac", size = 459065, upload-time = "2025-10-14T15:04:22.795Z" },
-    { url = "https://files.pythonhosted.org/packages/84/13/f28b3f340157d03cbc8197629bc109d1098764abe1e60874622a0be5c112/watchfiles-1.1.1-cp310-cp310-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3bc570d6c01c206c46deb6e935a260be44f186a2f05179f52f7fcd2be086a94d", size = 488377, upload-time = "2025-10-14T15:04:24.138Z" },
-    { url = "https://files.pythonhosted.org/packages/86/93/cfa597fa9389e122488f7ffdbd6db505b3b915ca7435ecd7542e855898c2/watchfiles-1.1.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e84087b432b6ac94778de547e08611266f1f8ffad28c0ee4c82e028b0fc5966d", size = 595837, upload-time = "2025-10-14T15:04:25.057Z" },
-    { url = "https://files.pythonhosted.org/packages/57/1e/68c1ed5652b48d89fc24d6af905d88ee4f82fa8bc491e2666004e307ded1/watchfiles-1.1.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:620bae625f4cb18427b1bb1a2d9426dc0dd5a5ba74c7c2cdb9de405f7b129863", size = 473456, upload-time = "2025-10-14T15:04:26.497Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/dc/1a680b7458ffa3b14bb64878112aefc8f2e4f73c5af763cbf0bd43100658/watchfiles-1.1.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:544364b2b51a9b0c7000a4b4b02f90e9423d97fbbf7e06689236443ebcad81ab", size = 455614, upload-time = "2025-10-14T15:04:27.539Z" },
-    { url = "https://files.pythonhosted.org/packages/61/a5/3d782a666512e01eaa6541a72ebac1d3aae191ff4a31274a66b8dd85760c/watchfiles-1.1.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:bbe1ef33d45bc71cf21364df962af171f96ecaeca06bd9e3d0b583efb12aec82", size = 630690, upload-time = "2025-10-14T15:04:28.495Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/73/bb5f38590e34687b2a9c47a244aa4dd50c56a825969c92c9c5fc7387cea1/watchfiles-1.1.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:1a0bb430adb19ef49389e1ad368450193a90038b5b752f4ac089ec6942c4dff4", size = 622459, upload-time = "2025-10-14T15:04:29.491Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/f8/2c5f479fb531ce2f0564eda479faecf253d886b1ab3630a39b7bf7362d46/watchfiles-1.1.1-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:f57b396167a2565a4e8b5e56a5a1c537571733992b226f4f1197d79e94cf0ae5", size = 406529, upload-time = "2025-10-14T15:04:32.899Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/cd/f515660b1f32f65df671ddf6f85bfaca621aee177712874dc30a97397977/watchfiles-1.1.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:421e29339983e1bebc281fab40d812742268ad057db4aee8c4d2bce0af43b741", size = 394384, upload-time = "2025-10-14T15:04:33.761Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/c3/28b7dc99733eab43fca2d10f55c86e03bd6ab11ca31b802abac26b23d161/watchfiles-1.1.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6e43d39a741e972bab5d8100b5cdacf69db64e34eb19b6e9af162bccf63c5cc6", size = 448789, upload-time = "2025-10-14T15:04:34.679Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/24/33e71113b320030011c8e4316ccca04194bf0cbbaeee207f00cbc7d6b9f5/watchfiles-1.1.1-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f537afb3276d12814082a2e9b242bdcf416c2e8fd9f799a737990a1dbe906e5b", size = 460521, upload-time = "2025-10-14T15:04:35.963Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/c3/3c9a55f255aa57b91579ae9e98c88704955fa9dac3e5614fb378291155df/watchfiles-1.1.1-cp311-cp311-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b2cd9e04277e756a2e2d2543d65d1e2166d6fd4c9b183f8808634fda23f17b14", size = 488722, upload-time = "2025-10-14T15:04:37.091Z" },
-    { url = "https://files.pythonhosted.org/packages/49/36/506447b73eb46c120169dc1717fe2eff07c234bb3232a7200b5f5bd816e9/watchfiles-1.1.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5f3f58818dc0b07f7d9aa7fe9eb1037aecb9700e63e1f6acfed13e9fef648f5d", size = 596088, upload-time = "2025-10-14T15:04:38.39Z" },
-    { url = "https://files.pythonhosted.org/packages/82/ab/5f39e752a9838ec4d52e9b87c1e80f1ee3ccdbe92e183c15b6577ab9de16/watchfiles-1.1.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9bb9f66367023ae783551042d31b1d7fd422e8289eedd91f26754a66f44d5cff", size = 472923, upload-time = "2025-10-14T15:04:39.666Z" },
-    { url = "https://files.pythonhosted.org/packages/af/b9/a419292f05e302dea372fa7e6fda5178a92998411f8581b9830d28fb9edb/watchfiles-1.1.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:aebfd0861a83e6c3d1110b78ad54704486555246e542be3e2bb94195eabb2606", size = 456080, upload-time = "2025-10-14T15:04:40.643Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/c3/d5932fd62bde1a30c36e10c409dc5d54506726f08cb3e1d8d0ba5e2bc8db/watchfiles-1.1.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:5fac835b4ab3c6487b5dbad78c4b3724e26bcc468e886f8ba8cc4306f68f6701", size = 629432, upload-time = "2025-10-14T15:04:41.789Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/77/16bddd9779fafb795f1a94319dc965209c5641db5bf1edbbccace6d1b3c0/watchfiles-1.1.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:399600947b170270e80134ac854e21b3ccdefa11a9529a3decc1327088180f10", size = 623046, upload-time = "2025-10-14T15:04:42.718Z" },
-    { url = "https://files.pythonhosted.org/packages/74/d5/f039e7e3c639d9b1d09b07ea412a6806d38123f0508e5f9b48a87b0a76cc/watchfiles-1.1.1-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:8c89f9f2f740a6b7dcc753140dd5e1ab9215966f7a3530d0c0705c83b401bd7d", size = 404745, upload-time = "2025-10-14T15:04:46.731Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/96/a881a13aa1349827490dab2d363c8039527060cfcc2c92cc6d13d1b1049e/watchfiles-1.1.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:bd404be08018c37350f0d6e34676bd1e2889990117a2b90070b3007f172d0610", size = 391769, upload-time = "2025-10-14T15:04:48.003Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/5b/d3b460364aeb8da471c1989238ea0e56bec24b6042a68046adf3d9ddb01c/watchfiles-1.1.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8526e8f916bb5b9a0a777c8317c23ce65de259422bba5b31325a6fa6029d33af", size = 449374, upload-time = "2025-10-14T15:04:49.179Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/44/5769cb62d4ed055cb17417c0a109a92f007114a4e07f30812a73a4efdb11/watchfiles-1.1.1-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2edc3553362b1c38d9f06242416a5d8e9fe235c204a4072e988ce2e5bb1f69f6", size = 459485, upload-time = "2025-10-14T15:04:50.155Z" },
-    { url = "https://files.pythonhosted.org/packages/19/0c/286b6301ded2eccd4ffd0041a1b726afda999926cf720aab63adb68a1e36/watchfiles-1.1.1-cp312-cp312-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:30f7da3fb3f2844259cba4720c3fc7138eb0f7b659c38f3bfa65084c7fc7abce", size = 488813, upload-time = "2025-10-14T15:04:51.059Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/2b/8530ed41112dd4a22f4dcfdb5ccf6a1baad1ff6eed8dc5a5f09e7e8c41c7/watchfiles-1.1.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f8979280bdafff686ba5e4d8f97840f929a87ed9cdf133cbbd42f7766774d2aa", size = 594816, upload-time = "2025-10-14T15:04:52.031Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/d2/f5f9fb49489f184f18470d4f99f4e862a4b3e9ac2865688eb2099e3d837a/watchfiles-1.1.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:dcc5c24523771db3a294c77d94771abcfcb82a0e0ee8efd910c37c59ec1b31bb", size = 475186, upload-time = "2025-10-14T15:04:53.064Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/68/5707da262a119fb06fbe214d82dd1fe4a6f4af32d2d14de368d0349eb52a/watchfiles-1.1.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1db5d7ae38ff20153d542460752ff397fcf5c96090c1230803713cf3147a6803", size = 456812, upload-time = "2025-10-14T15:04:55.174Z" },
-    { url = "https://files.pythonhosted.org/packages/66/ab/3cbb8756323e8f9b6f9acb9ef4ec26d42b2109bce830cc1f3468df20511d/watchfiles-1.1.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:28475ddbde92df1874b6c5c8aaeb24ad5be47a11f87cde5a28ef3835932e3e94", size = 630196, upload-time = "2025-10-14T15:04:56.22Z" },
-    { url = "https://files.pythonhosted.org/packages/78/46/7152ec29b8335f80167928944a94955015a345440f524d2dfe63fc2f437b/watchfiles-1.1.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:36193ed342f5b9842edd3532729a2ad55c4160ffcfa3700e0d54be496b70dd43", size = 622657, upload-time = "2025-10-14T15:04:57.521Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/f4/f750b29225fe77139f7ae5de89d4949f5a99f934c65a1f1c0b248f26f747/watchfiles-1.1.1-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:130e4876309e8686a5e37dba7d5e9bc77e6ed908266996ca26572437a5271e18", size = 404321, upload-time = "2025-10-14T15:05:02.063Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/f9/f07a295cde762644aa4c4bb0f88921d2d141af45e735b965fb2e87858328/watchfiles-1.1.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5f3bde70f157f84ece3765b42b4a52c6ac1a50334903c6eaf765362f6ccca88a", size = 391783, upload-time = "2025-10-14T15:05:03.052Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/11/fc2502457e0bea39a5c958d86d2cb69e407a4d00b85735ca724bfa6e0d1a/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:14e0b1fe858430fc0251737ef3824c54027bedb8c37c38114488b8e131cf8219", size = 449279, upload-time = "2025-10-14T15:05:04.004Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/1f/d66bc15ea0b728df3ed96a539c777acfcad0eb78555ad9efcaa1274688f0/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f27db948078f3823a6bb3b465180db8ebecf26dd5dae6f6180bd87383b6b4428", size = 459405, upload-time = "2025-10-14T15:05:04.942Z" },
-    { url = "https://files.pythonhosted.org/packages/be/90/9f4a65c0aec3ccf032703e6db02d89a157462fbb2cf20dd415128251cac0/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:059098c3a429f62fc98e8ec62b982230ef2c8df68c79e826e37b895bc359a9c0", size = 488976, upload-time = "2025-10-14T15:05:05.905Z" },
-    { url = "https://files.pythonhosted.org/packages/37/57/ee347af605d867f712be7029bb94c8c071732a4b44792e3176fa3c612d39/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:bfb5862016acc9b869bb57284e6cb35fdf8e22fe59f7548858e2f971d045f150", size = 595506, upload-time = "2025-10-14T15:05:06.906Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/78/cc5ab0b86c122047f75e8fc471c67a04dee395daf847d3e59381996c8707/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:319b27255aacd9923b8a276bb14d21a5f7ff82564c744235fc5eae58d95422ae", size = 474936, upload-time = "2025-10-14T15:05:07.906Z" },
-    { url = "https://files.pythonhosted.org/packages/62/da/def65b170a3815af7bd40a3e7010bf6ab53089ef1b75d05dd5385b87cf08/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c755367e51db90e75b19454b680903631d41f9e3607fbd941d296a020c2d752d", size = 456147, upload-time = "2025-10-14T15:05:09.138Z" },
-    { url = "https://files.pythonhosted.org/packages/57/99/da6573ba71166e82d288d4df0839128004c67d2778d3b566c138695f5c0b/watchfiles-1.1.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:c22c776292a23bfc7237a98f791b9ad3144b02116ff10d820829ce62dff46d0b", size = 630007, upload-time = "2025-10-14T15:05:10.117Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/51/7439c4dd39511368849eb1e53279cd3454b4a4dbace80bab88feeb83c6b5/watchfiles-1.1.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:3a476189be23c3686bc2f4321dd501cb329c0a0469e77b7b534ee10129ae6374", size = 622280, upload-time = "2025-10-14T15:05:11.146Z" },
-    { url = "https://files.pythonhosted.org/packages/79/42/e0a7d749626f1e28c7108a99fb9bf524b501bbbeb9b261ceecde644d5a07/watchfiles-1.1.1-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:563b116874a9a7ce6f96f87cd0b94f7faf92d08d0021e837796f0a14318ef8da", size = 403389, upload-time = "2025-10-14T15:05:15.777Z" },
-    { url = "https://files.pythonhosted.org/packages/15/49/08732f90ce0fbbc13913f9f215c689cfc9ced345fb1bcd8829a50007cc8d/watchfiles-1.1.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3ad9fe1dae4ab4212d8c91e80b832425e24f421703b5a42ef2e4a1e215aff051", size = 389964, upload-time = "2025-10-14T15:05:16.85Z" },
-    { url = "https://files.pythonhosted.org/packages/27/0d/7c315d4bd5f2538910491a0393c56bf70d333d51bc5b34bee8e68e8cea19/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce70f96a46b894b36eba678f153f052967a0d06d5b5a19b336ab0dbbd029f73e", size = 448114, upload-time = "2025-10-14T15:05:17.876Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/24/9e096de47a4d11bc4df41e9d1e61776393eac4cb6eb11b3e23315b78b2cc/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:cb467c999c2eff23a6417e58d75e5828716f42ed8289fe6b77a7e5a91036ca70", size = 460264, upload-time = "2025-10-14T15:05:18.962Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/0f/e8dea6375f1d3ba5fcb0b3583e2b493e77379834c74fd5a22d66d85d6540/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:836398932192dae4146c8f6f737d74baeac8b70ce14831a239bdb1ca882fc261", size = 487877, upload-time = "2025-10-14T15:05:20.094Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/5b/df24cfc6424a12deb41503b64d42fbea6b8cb357ec62ca84a5a3476f654a/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:743185e7372b7bc7c389e1badcc606931a827112fbbd37f14c537320fca08620", size = 595176, upload-time = "2025-10-14T15:05:21.134Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/b5/853b6757f7347de4e9b37e8cc3289283fb983cba1ab4d2d7144694871d9c/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:afaeff7696e0ad9f02cbb8f56365ff4686ab205fcf9c4c5b6fdfaaa16549dd04", size = 473577, upload-time = "2025-10-14T15:05:22.306Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/f7/0a4467be0a56e80447c8529c9fce5b38eab4f513cb3d9bf82e7392a5696b/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3f7eb7da0eb23aa2ba036d4f616d46906013a68caf61b7fdbe42fc8b25132e77", size = 455425, upload-time = "2025-10-14T15:05:23.348Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/e0/82583485ea00137ddf69bc84a2db88bd92ab4a6e3c405e5fb878ead8d0e7/watchfiles-1.1.1-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:831a62658609f0e5c64178211c942ace999517f5770fe9436be4c2faeba0c0ef", size = 628826, upload-time = "2025-10-14T15:05:24.398Z" },
-    { url = "https://files.pythonhosted.org/packages/28/9a/a785356fccf9fae84c0cc90570f11702ae9571036fb25932f1242c82191c/watchfiles-1.1.1-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:f9a2ae5c91cecc9edd47e041a930490c31c3afb1f5e6d71de3dc671bfaca02bf", size = 622208, upload-time = "2025-10-14T15:05:25.45Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/f4/0872229324ef69b2c3edec35e84bd57a1289e7d3fe74588048ed8947a323/watchfiles-1.1.1-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:d1715143123baeeaeadec0528bb7441103979a1d5f6fd0e1f915383fea7ea6d5", size = 404315, upload-time = "2025-10-14T15:05:26.501Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/22/16d5331eaed1cb107b873f6ae1b69e9ced582fcf0c59a50cd84f403b1c32/watchfiles-1.1.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:39574d6370c4579d7f5d0ad940ce5b20db0e4117444e39b6d8f99db5676c52fd", size = 390869, upload-time = "2025-10-14T15:05:27.649Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/7e/5643bfff5acb6539b18483128fdc0ef2cccc94a5b8fbda130c823e8ed636/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7365b92c2e69ee952902e8f70f3ba6360d0d596d9299d55d7d386df84b6941fb", size = 449919, upload-time = "2025-10-14T15:05:28.701Z" },
-    { url = "https://files.pythonhosted.org/packages/51/2e/c410993ba5025a9f9357c376f48976ef0e1b1aefb73b97a5ae01a5972755/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:bfff9740c69c0e4ed32416f013f3c45e2ae42ccedd1167ef2d805c000b6c71a5", size = 460845, upload-time = "2025-10-14T15:05:30.064Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/a4/2df3b404469122e8680f0fcd06079317e48db58a2da2950fb45020947734/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b27cf2eb1dda37b2089e3907d8ea92922b673c0c427886d4edc6b94d8dfe5db3", size = 489027, upload-time = "2025-10-14T15:05:31.064Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/84/4587ba5b1f267167ee715b7f66e6382cca6938e0a4b870adad93e44747e6/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:526e86aced14a65a5b0ec50827c745597c782ff46b571dbfe46192ab9e0b3c33", size = 595615, upload-time = "2025-10-14T15:05:32.074Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/0f/c6988c91d06e93cd0bb3d4a808bcf32375ca1904609835c3031799e3ecae/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:04e78dd0b6352db95507fd8cb46f39d185cf8c74e4cf1e4fbad1d3df96faf510", size = 474836, upload-time = "2025-10-14T15:05:33.209Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/36/ded8aebea91919485b7bbabbd14f5f359326cb5ec218cd67074d1e426d74/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5c85794a4cfa094714fb9c08d4a218375b2b95b8ed1666e8677c349906246c05", size = 455099, upload-time = "2025-10-14T15:05:34.189Z" },
-    { url = "https://files.pythonhosted.org/packages/98/e0/8c9bdba88af756a2fce230dd365fab2baf927ba42cd47521ee7498fd5211/watchfiles-1.1.1-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:74d5012b7630714b66be7b7b7a78855ef7ad58e8650c73afc4c076a1f480a8d6", size = 630626, upload-time = "2025-10-14T15:05:35.216Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/84/a95db05354bf2d19e438520d92a8ca475e578c647f78f53197f5a2f17aaf/watchfiles-1.1.1-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:8fbe85cb3201c7d380d3d0b90e63d520f15d6afe217165d7f98c9c649654db81", size = 622519, upload-time = "2025-10-14T15:05:36.259Z" },
-    { url = "https://files.pythonhosted.org/packages/47/a8/e3af2184707c29f0f14b1963c0aace6529f9d1b8582d5b99f31bbf42f59e/watchfiles-1.1.1-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:88863fbbc1a7312972f1c511f202eb30866370ebb8493aef2812b9ff28156a21", size = 403820, upload-time = "2025-10-14T15:05:40.932Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/ec/e47e307c2f4bd75f9f9e8afbe3876679b18e1bcec449beca132a1c5ffb2d/watchfiles-1.1.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:55c7475190662e202c08c6c0f4d9e345a29367438cf8e8037f3155e10a88d5a5", size = 390510, upload-time = "2025-10-14T15:05:41.945Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/a0/ad235642118090f66e7b2f18fd5c42082418404a79205cdfca50b6309c13/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3f53fa183d53a1d7a8852277c92b967ae99c2d4dcee2bfacff8868e6e30b15f7", size = 448408, upload-time = "2025-10-14T15:05:43.385Z" },
-    { url = "https://files.pythonhosted.org/packages/df/85/97fa10fd5ff3332ae17e7e40e20784e419e28521549780869f1413742e9d/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6aae418a8b323732fa89721d86f39ec8f092fc2af67f4217a2b07fd3e93c6101", size = 458968, upload-time = "2025-10-14T15:05:44.404Z" },
-    { url = "https://files.pythonhosted.org/packages/47/c2/9059c2e8966ea5ce678166617a7f75ecba6164375f3b288e50a40dc6d489/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f096076119da54a6080e8920cbdaac3dbee667eb91dcc5e5b78840b87415bd44", size = 488096, upload-time = "2025-10-14T15:05:45.398Z" },
-    { url = "https://files.pythonhosted.org/packages/94/44/d90a9ec8ac309bc26db808a13e7bfc0e4e78b6fc051078a554e132e80160/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:00485f441d183717038ed2e887a7c868154f216877653121068107b227a2f64c", size = 596040, upload-time = "2025-10-14T15:05:46.502Z" },
-    { url = "https://files.pythonhosted.org/packages/95/68/4e3479b20ca305cfc561db3ed207a8a1c745ee32bf24f2026a129d0ddb6e/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a55f3e9e493158d7bfdb60a1165035f1cf7d320914e7b7ea83fe22c6023b58fc", size = 473847, upload-time = "2025-10-14T15:05:47.484Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/55/2af26693fd15165c4ff7857e38330e1b61ab8c37d15dc79118cdba115b7a/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8c91ed27800188c2ae96d16e3149f199d62f86c7af5f5f4d2c61a3ed8cd3666c", size = 455072, upload-time = "2025-10-14T15:05:48.928Z" },
-    { url = "https://files.pythonhosted.org/packages/66/1d/d0d200b10c9311ec25d2273f8aad8c3ef7cc7ea11808022501811208a750/watchfiles-1.1.1-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:311ff15a0bae3714ffb603e6ba6dbfba4065ab60865d15a6ec544133bdb21099", size = 629104, upload-time = "2025-10-14T15:05:49.908Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/bd/fa9bb053192491b3867ba07d2343d9f2252e00811567d30ae8d0f78136fe/watchfiles-1.1.1-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:a916a2932da8f8ab582f242c065f5c81bed3462849ca79ee357dd9551b0e9b01", size = 622112, upload-time = "2025-10-14T15:05:50.941Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/4c/a888c91e2e326872fa4705095d64acd8aa2fb9c1f7b9bd0588f33850516c/watchfiles-1.1.1-pp310-pypy310_pp73-macosx_10_12_x86_64.whl", hash = "sha256:17ef139237dfced9da49fb7f2232c86ca9421f666d78c264c7ffca6601d154c3", size = 409611, upload-time = "2025-10-14T15:06:05.809Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/c7/5420d1943c8e3ce1a21c0a9330bcf7edafb6aa65d26b21dbb3267c9e8112/watchfiles-1.1.1-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:672b8adf25b1a0d35c96b5888b7b18699d27d4194bac8beeae75be4b7a3fc9b2", size = 396889, upload-time = "2025-10-14T15:06:07.035Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/e5/0072cef3804ce8d3aaddbfe7788aadff6b3d3f98a286fdbee9fd74ca59a7/watchfiles-1.1.1-pp310-pypy310_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:77a13aea58bc2b90173bc69f2a90de8e282648939a00a602e1dc4ee23e26b66d", size = 451616, upload-time = "2025-10-14T15:06:08.072Z" },
-    { url = "https://files.pythonhosted.org/packages/83/4e/b87b71cbdfad81ad7e83358b3e447fedd281b880a03d64a760fe0a11fc2e/watchfiles-1.1.1-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0b495de0bb386df6a12b18335a0285dda90260f51bdb505503c02bcd1ce27a8b", size = 458413, upload-time = "2025-10-14T15:06:09.209Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/8e/e500f8b0b77be4ff753ac94dc06b33d8f0d839377fee1b78e8c8d8f031bf/watchfiles-1.1.1-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:db476ab59b6765134de1d4fe96a1a9c96ddf091683599be0f26147ea1b2e4b88", size = 408250, upload-time = "2025-10-14T15:06:10.264Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/95/615e72cd27b85b61eec764a5ca51bd94d40b5adea5ff47567d9ebc4d275a/watchfiles-1.1.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:89eef07eee5e9d1fda06e38822ad167a044153457e6fd997f8a858ab7564a336", size = 396117, upload-time = "2025-10-14T15:06:11.28Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/81/e7fe958ce8a7fb5c73cc9fb07f5aeaf755e6aa72498c57d760af760c91f8/watchfiles-1.1.1-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce19e06cbda693e9e7686358af9cd6f5d61312ab8b00488bc36f5aabbaf77e24", size = 450493, upload-time = "2025-10-14T15:06:12.321Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/d4/ed38dd3b1767193de971e694aa544356e63353c33a85d948166b5ff58b9e/watchfiles-1.1.1-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3e6f39af2eab0118338902798b5aa6664f46ff66bc0280de76fca67a7f262a49", size = 457546, upload-time = "2025-10-14T15:06:13.372Z" },
-]
-
 [[package]]
 name = "wcwidth"
 version = "0.2.14"